Enable Chef 12 mode for local mode by default

4 files changed, 474 insertions, 235 deletions

diff --git a/chef-config/lib/chef-config/config.rb b/chef-config/lib/chef-config/config.rb
index eda684a6b4..a5ccea5234 100644
--- a/chef-config/lib/chef-config/config.rb
+++ b/chef-config/lib/chef-config/config.rb
@@ -106,6 +106,9 @@ module ChefConfig
     # that upload or download files (such as knife upload, knife role from file,
     # etc.) work.
     default :chef_repo_path do
+      # TODO: this should also look at the cookbook_artifacts path, for the
+      # case when we have a repo from `chef export` that has cookbook artifacts
+      # and no cookbooks.
       if self.configuration[:cookbook_path]
         if self.configuration[:cookbook_path].kind_of?(String)
           File.expand_path("..", self.configuration[:cookbook_path])
@@ -306,6 +309,30 @@ module ChefConfig
     default :diff_output_threshold,   1000000
     default :local_mode, false
 
+    # Configures the mode of operation for ChefFS, which is applied to the
+    # ChefFS-based knife commands and chef-client's local mode. (ChefFS-based
+    # knife commands include: knife delete, knife deps, knife diff, knife down,
+    # knife edit, knife list, knife show, knife upload, and knife xargs.)
+    #
+    # Valid values are:
+    # * "static": ChefFS only manages objects that exist in a traditional Chef
+    #   Repo as of Chef 11.
+    # * "everything": ChefFS manages all object types that existed on the OSS
+    #   Chef 11 server.
+    # * "hosted_everything": ChefFS manages all object types as of the Chef 12
+    #   Server, including RBAC objects and Policyfile objects (new to Chef 12).
+    #
+    # TODO: add a test
+    default :repo_mode do
+      if local_mode
+        "hosted_everything"
+      elsif chef_server_url =~ /\/+organizations\/.+/
+        "hosted_everything"
+      else
+        "everything"
+      end
+    end
+
     default :pid_file, nil
 
     # Whether Chef Zero local mode should bind to a port. All internal requests
@@ -321,6 +348,21 @@ module ChefConfig
       default(:enabled) { ChefConfig::Config.local_mode }
       default :host, "localhost"
       default :port, 8889.upto(9999) # Will try ports from 8889-9999 until one works
+
+      # When set to a String, Chef Zero disables multitenant support.  This is
+      # what you want when using Chef Zero to serve a single Chef Repo. Setting
+      # this to `false` enables multi-tenant.
+      default :single_org, "chef"
+
+      # Whether Chef Zero should operate in a mode analogous to OSS Chef Server
+      # 11 (true) or Chef Server 12 (false). Chef Zero can still serve
+      # policyfile objects in Chef 11 mode, as long as `repo_mode` is set to
+      # "hosted_everything". The primary differences are:
+      # * Chef 11 mode doesn't support multi-tennant, so there is no
+      #   distinction between global and org-specific objects (since there are
+      #   no orgs).
+      # * Chef 11 mode doesn't expose RBAC objects
+      default :osc_compat, false
     end
     default :chef_server_url, "https://localhost:443"
 
diff --git a/lib/chef/chef_fs/chef_fs_data_store.rb b/lib/chef/chef_fs/chef_fs_data_store.rb
index 634faaec7e..59c2699cca 100644
--- a/lib/chef/chef_fs/chef_fs_data_store.rb
+++ b/lib/chef/chef_fs/chef_fs_data_store.rb
@@ -126,6 +126,24 @@ class Chef
     #    - `delete(association_requests/NAME)` -> `get(/invitations.json)`, remove name, `set(/invitations.json)`
     #
     class ChefFSDataStore
+
+      # The base directories in a Chef Repo; even when these don't exist, a
+      # matching GET for these objects will return an empty list instead of a
+      # 404.
+      BASE_DIRNAMES = %w{
+        clients
+        cookbooks
+        data
+        environments
+        nodes
+        roles
+        users
+        containers
+        groups
+        policy_groups
+        policies
+      }.freeze
+
       #
       # Create a new ChefFSDataStore
       #
@@ -469,7 +487,11 @@ class Chef
         # LIST /policies
         elsif path == [ "policies" ]
           with_entry([ path[0] ]) do |policies|
-            policies.children.map { |policy| policy.name[0..-6].rpartition("-")[0] }.uniq
+            begin
+              policies.children.map { |policy| policy.name[0..-6].rpartition("-")[0] }.uniq
+            rescue Chef::ChefFS::FileSystem::NotFoundError
+              []
+            end
           end
 
         # LIST /policies/POLICY/revisions
@@ -741,7 +763,7 @@ class Chef
       end
 
       def path_always_exists?(path)
-        return path.length == 1 && %w{clients cookbooks data environments nodes roles users}.include?(path[0])
+        return path.length == 1 && BASE_DIRNAMES.include?(path[0])
       end
 
       def with_entry(path)
diff --git a/lib/chef/local_mode.rb b/lib/chef/local_mode.rb
index 53234ec7d5..82d9cdee32 100644
--- a/lib/chef/local_mode.rb
+++ b/lib/chef/local_mode.rb
@@ -65,6 +65,8 @@ class Chef
         server_options = {}
         server_options[:data_store] = data_store
         server_options[:log_level] = Chef::Log.level
+        server_options[:osc_compat] = Chef::Config.chef_zero.osc_compat
+        server_options[:single_org] = Chef::Config.chef_zero.single_org
 
         server_options[:host] = Chef::Config.chef_zero.host
         server_options[:port] = parse_port(Chef::Config.chef_zero.port)
diff --git a/spec/integration/knife/chef_fs_data_store_spec.rb b/spec/integration/knife/chef_fs_data_store_spec.rb
index b2f5ade0ce..145adc3e4c 100644
--- a/spec/integration/knife/chef_fs_data_store_spec.rb
+++ b/spec/integration/knife/chef_fs_data_store_spec.rb
@@ -29,22 +29,54 @@ describe "ChefFSDataStore tests", :workstation do
   let(:cookbook_x_100_metadata_rb) { cb_metadata("x", "1.0.0") }
   let(:cookbook_z_100_metadata_rb) { cb_metadata("z", "1.0.0") }
 
-  when_the_repository "has one of each thing" do
+  describe "with repo mode 'hosted_everything' (default)" do
     before do
-      file "clients/x.json", {}
-      file "cookbooks/x/metadata.rb", cookbook_x_100_metadata_rb
-      file "data_bags/x/y.json", {}
-      file "environments/x.json", {}
-      file "nodes/x.json", {}
-      file "roles/x.json", {}
-      file "users/x.json", {}
+      Chef::Config.chef_zero.osc_compat = false
     end
 
-    context "GET /TYPE" do
-      it "knife list -z -R returns everything" do
-        knife("list -z -Rfp /").should_succeed <<EOM
+    when_the_repository "has one of each thing" do
+      before do
+        file "clients/x.json", {}
+        file "cookbooks/x/metadata.rb", cookbook_x_100_metadata_rb
+        file "data_bags/x/y.json", {}
+        file "environments/x.json", {}
+        file "nodes/x.json", {}
+        file "roles/x.json", {}
+        # file "users/x.json", {}
+        file "containers/x.json", {}
+        file "groups/x.json", {}
+        file "containers/x.json", {}
+        file "groups/x.json", {}
+        file "policies/x.json", {}
+        file "policy_groups/x.json", {}
+      end
+
+      context "GET /TYPE" do
+        it "knife list -z -R returns everything" do
+          knife("list -z -Rfp /").should_succeed <<EOM
+/acls/
+/acls/clients/
+/acls/clients/x.json
+/acls/containers/
+/acls/containers/x.json
+/acls/cookbooks/
+/acls/cookbooks/x.json
+/acls/data_bags/
+/acls/data_bags/x.json
+/acls/environments/
+/acls/environments/x.json
+/acls/groups/
+/acls/groups/x.json
+/acls/nodes/
+/acls/nodes/x.json
+/acls/organization.json
+/acls/roles/
+/acls/roles/x.json
 /clients/
 /clients/x.json
+/containers/
+/containers/x.json
+/cookbook_artifacts/
 /cookbooks/
 /cookbooks/x/
 /cookbooks/x/metadata.rb
@@ -53,317 +85,458 @@ describe "ChefFSDataStore tests", :workstation do
 /data_bags/x/y.json
 /environments/
 /environments/x.json
+/groups/
+/groups/x.json
+/invitations.json
+/members.json
 /nodes/
 /nodes/x.json
+/org.json
+/policies/
+/policy_groups/
+/policy_groups/x.json
 /roles/
 /roles/x.json
-/users/
-/users/x.json
 EOM
+        end
       end
-    end
 
-    context "DELETE /TYPE/NAME" do
-      it "knife delete -z /clients/x.json works" do
-        knife("delete -z /clients/x.json").should_succeed "Deleted /clients/x.json\n"
-        knife("list -z -Rfp /clients").should_succeed ""
-      end
+      context "DELETE /TYPE/NAME" do
+        it "knife delete -z /clients/x.json works" do
+          knife("delete -z /clients/x.json").should_succeed "Deleted /clients/x.json\n"
+          knife("list -z -Rfp /clients").should_succeed ""
+        end
 
-      it "knife delete -z -r /cookbooks/x works" do
-        knife("delete -z -r /cookbooks/x").should_succeed "Deleted /cookbooks/x\n"
-        knife("list -z -Rfp /cookbooks").should_succeed ""
-      end
+        it "knife delete -z -r /cookbooks/x works" do
+          knife("delete -z -r /cookbooks/x").should_succeed "Deleted /cookbooks/x\n"
+          knife("list -z -Rfp /cookbooks").should_succeed ""
+        end
 
-      it "knife delete -z -r /data_bags/x works" do
-        knife("delete -z -r /data_bags/x").should_succeed "Deleted /data_bags/x\n"
-        knife("list -z -Rfp /data_bags").should_succeed ""
-      end
+        it "knife delete -z -r /data_bags/x works" do
+          knife("delete -z -r /data_bags/x").should_succeed "Deleted /data_bags/x\n"
+          knife("list -z -Rfp /data_bags").should_succeed ""
+        end
 
-      it "knife delete -z /data_bags/x/y.json works" do
-        knife("delete -z /data_bags/x/y.json").should_succeed "Deleted /data_bags/x/y.json\n"
-        knife("list -z -Rfp /data_bags").should_succeed "/data_bags/x/\n"
-      end
+        it "knife delete -z /data_bags/x/y.json works" do
+          knife("delete -z /data_bags/x/y.json").should_succeed "Deleted /data_bags/x/y.json\n"
+          knife("list -z -Rfp /data_bags").should_succeed "/data_bags/x/\n"
+        end
 
-      it "knife delete -z /environments/x.json works" do
-        knife("delete -z /environments/x.json").should_succeed "Deleted /environments/x.json\n"
-        knife("list -z -Rfp /environments").should_succeed ""
-      end
+        it "knife delete -z /environments/x.json works" do
+          knife("delete -z /environments/x.json").should_succeed "Deleted /environments/x.json\n"
+          knife("list -z -Rfp /environments").should_succeed ""
+        end
 
-      it "knife delete -z /nodes/x.json works" do
-        knife("delete -z /nodes/x.json").should_succeed "Deleted /nodes/x.json\n"
-        knife("list -z -Rfp /nodes").should_succeed ""
-      end
+        it "knife delete -z /nodes/x.json works" do
+          knife("delete -z /nodes/x.json").should_succeed "Deleted /nodes/x.json\n"
+          knife("list -z -Rfp /nodes").should_succeed ""
+        end
 
-      it "knife delete -z /roles/x.json works" do
-        knife("delete -z /roles/x.json").should_succeed "Deleted /roles/x.json\n"
-        knife("list -z -Rfp /roles").should_succeed ""
-      end
+        it "knife delete -z /roles/x.json works" do
+          knife("delete -z /roles/x.json").should_succeed "Deleted /roles/x.json\n"
+          knife("list -z -Rfp /roles").should_succeed ""
+        end
 
-      it "knife delete -z /users/x.json works" do
-        knife("delete -z /users/x.json").should_succeed "Deleted /users/x.json\n"
-        knife("list -z -Rfp /users").should_succeed ""
       end
-    end
 
-    context "GET /TYPE/NAME" do
-      it "knife show -z /clients/x.json works" do
-        knife("show -z /clients/x.json").should_succeed( /"x"/ )
-      end
+      context "GET /TYPE/NAME" do
+        it "knife show -z /clients/x.json works" do
+          knife("show -z /clients/x.json").should_succeed( /"x"/ )
+        end
 
-      it "knife show -z /cookbooks/x/metadata.rb works" do
-        knife("show -z /cookbooks/x/metadata.rb").should_succeed "/cookbooks/x/metadata.rb:\n#{cookbook_x_100_metadata_rb}\n"
-      end
+        it "knife show -z /cookbooks/x/metadata.rb works" do
+          knife("show -z /cookbooks/x/metadata.rb").should_succeed "/cookbooks/x/metadata.rb:\n#{cookbook_x_100_metadata_rb}\n"
+        end
 
-      it "knife show -z /data_bags/x/y.json works" do
-        knife("show -z /data_bags/x/y.json").should_succeed( /"y"/ )
-      end
+        it "knife show -z /data_bags/x/y.json works" do
+          knife("show -z /data_bags/x/y.json").should_succeed( /"y"/ )
+        end
 
-      it "knife show -z /environments/x.json works" do
-        knife("show -z /environments/x.json").should_succeed( /"x"/ )
-      end
+        it "knife show -z /environments/x.json works" do
+          knife("show -z /environments/x.json").should_succeed( /"x"/ )
+        end
 
-      it "knife show -z /nodes/x.json works" do
-        knife("show -z /nodes/x.json").should_succeed( /"x"/ )
-      end
+        it "knife show -z /nodes/x.json works" do
+          knife("show -z /nodes/x.json").should_succeed( /"x"/ )
+        end
 
-      it "knife show -z /roles/x.json works" do
-        knife("show -z /roles/x.json").should_succeed( /"x"/ )
-      end
+        it "knife show -z /roles/x.json works" do
+          knife("show -z /roles/x.json").should_succeed( /"x"/ )
+        end
 
-      it "knife show -z /users/x.json works" do
-        knife("show -z /users/x.json").should_succeed( /"x"/ )
       end
-    end
 
-    context "PUT /TYPE/NAME" do
-      before do
-        file "empty.json", {}
-        file "dummynode.json", { "name" => "x", "chef_environment" => "rspec" , "json_class" => "Chef::Node", "normal" => {"foo" => "bar"}}
-        file "rolestuff.json", '{"description":"hi there","name":"x"}'
-        file "cookbooks_to_upload/x/metadata.rb", cookbook_x_100_metadata_rb
-      end
+      context "PUT /TYPE/NAME" do
+        before do
+          file "empty.json", {}
+          file "dummynode.json", { "name" => "x", "chef_environment" => "rspec" , "json_class" => "Chef::Node", "normal" => {"foo" => "bar"}}
+          file "rolestuff.json", '{"description":"hi there","name":"x"}'
+          file "cookbooks_to_upload/x/metadata.rb", cookbook_x_100_metadata_rb
+        end
 
-      it "knife raw -z -i empty.json -m PUT /clients/x" do
-        knife("raw -z -i #{path_to('empty.json')} -m PUT /clients/x").should_succeed( /"x"/ )
-        knife("list --local /clients").should_succeed "/clients/x.json\n"
-      end
+        it "knife raw -z -i empty.json -m PUT /clients/x" do
+          knife("raw -z -i #{path_to('empty.json')} -m PUT /clients/x").should_succeed( /"x"/ )
+          knife("list --local /clients").should_succeed "/clients/x.json\n"
+        end
 
-      it "knife cookbook upload works" do
-        knife("cookbook upload -z --cookbook-path #{path_to('cookbooks_to_upload')} x").should_succeed :stderr => <<EOM
+        it "knife cookbook upload works" do
+          knife("cookbook upload -z --cookbook-path #{path_to('cookbooks_to_upload')} x").should_succeed :stderr => <<EOM
 Uploading x              [1.0.0]
 Uploaded 1 cookbook.
 EOM
-        knife("list --local -Rfp /cookbooks").should_succeed "/cookbooks/x/\n/cookbooks/x/metadata.rb\n"
-      end
-
-      it "knife raw -z -i empty.json -m PUT /data/x/y" do
-        knife("raw -z -i #{path_to('empty.json')} -m PUT /data/x/y").should_succeed( /"y"/ )
-        knife("list --local -Rfp /data_bags").should_succeed "/data_bags/x/\n/data_bags/x/y.json\n"
-      end
-
-      it "knife raw -z -i empty.json -m PUT /environments/x" do
-        knife("raw -z -i #{path_to('empty.json')} -m PUT /environments/x").should_succeed( /"x"/ )
-        knife("list --local /environments").should_succeed "/environments/x.json\n"
-      end
-
-      it "knife raw -z -i dummynode.json -m PUT /nodes/x" do
-        knife("raw -z -i #{path_to('dummynode.json')} -m PUT /nodes/x").should_succeed( /"x"/ )
-        knife("list --local /nodes").should_succeed "/nodes/x.json\n"
-        knife("show -z /nodes/x.json --verbose").should_succeed(/"bar"/)
-      end
-
-      it "knife raw -z -i empty.json -m PUT /roles/x" do
-        knife("raw -z -i #{path_to('empty.json')} -m PUT /roles/x").should_succeed( /"x"/ )
-        knife("list --local /roles").should_succeed "/roles/x.json\n"
-      end
-
-      it "knife raw -z -i empty.json -m PUT /users/x" do
-        knife("raw -z -i #{path_to('empty.json')} -m PUT /users/x").should_succeed( /"x"/ )
-        knife("list --local /users").should_succeed "/users/x.json\n"
-      end
-
-      it "After knife raw -z -i rolestuff.json -m PUT /roles/x, the output is pretty", :skip => (RUBY_VERSION < "1.9") do
-        knife("raw -z -i #{path_to('rolestuff.json')} -m PUT /roles/x").should_succeed( /"x"/ )
-        expect(IO.read(path_to("roles/x.json"))).to eq <<EOM.strip
+          knife("list --local -Rfp /cookbooks").should_succeed "/cookbooks/x/\n/cookbooks/x/metadata.rb\n"
+        end
+
+        it "knife raw -z -i empty.json -m PUT /data/x/y" do
+          knife("raw -z -i #{path_to('empty.json')} -m PUT /data/x/y").should_succeed( /"y"/ )
+          knife("list --local -Rfp /data_bags").should_succeed "/data_bags/x/\n/data_bags/x/y.json\n"
+        end
+
+        it "knife raw -z -i empty.json -m PUT /environments/x" do
+          knife("raw -z -i #{path_to('empty.json')} -m PUT /environments/x").should_succeed( /"x"/ )
+          knife("list --local /environments").should_succeed "/environments/x.json\n"
+        end
+
+        it "knife raw -z -i dummynode.json -m PUT /nodes/x" do
+          knife("raw -z -i #{path_to('dummynode.json')} -m PUT /nodes/x").should_succeed( /"x"/ )
+          knife("list --local /nodes").should_succeed "/nodes/x.json\n"
+          knife("show -z /nodes/x.json --verbose").should_succeed(/"bar"/)
+        end
+
+        it "knife raw -z -i empty.json -m PUT /roles/x" do
+          knife("raw -z -i #{path_to('empty.json')} -m PUT /roles/x").should_succeed( /"x"/ )
+          knife("list --local /roles").should_succeed "/roles/x.json\n"
+        end
+
+        it "After knife raw -z -i rolestuff.json -m PUT /roles/x, the output is pretty", :skip => (RUBY_VERSION < "1.9") do
+          knife("raw -z -i #{path_to('rolestuff.json')} -m PUT /roles/x").should_succeed( /"x"/ )
+          expect(IO.read(path_to("roles/x.json"))).to eq <<EOM.strip
 {
   "name": "x",
   "description": "hi there"
 }
 EOM
+        end
       end
     end
-  end
 
-  when_the_repository "is empty" do
-    context "POST /TYPE/NAME" do
-      before do
-        file "empty.json", { "name" => "z" }
-        file "dummynode.json", { "name" => "z", "chef_environment" => "rspec" , "json_class" => "Chef::Node", "normal" => {"foo" => "bar"}}
-        file "empty_x.json", { "name" => "x" }
-        file "empty_id.json", { "id" => "z" }
-        file "rolestuff.json", '{"description":"hi there","name":"x"}'
-        file "cookbooks_to_upload/z/metadata.rb", cookbook_z_100_metadata_rb
-      end
-
-      it "knife raw -z -i empty.json -m POST /clients" do
-        knife("raw -z -i #{path_to('empty.json')} -m POST /clients").should_succeed( /uri/ )
-        knife("list --local /clients").should_succeed "/clients/z.json\n"
-      end
-
-      it "knife cookbook upload works" do
-        knife("cookbook upload -z --cookbook-path #{path_to('cookbooks_to_upload')} z").should_succeed :stderr => <<EOM
+    when_the_repository "is empty" do
+      context "POST /TYPE/NAME" do
+        before do
+          file "empty.json", { "name" => "z" }
+          file "dummynode.json", { "name" => "z", "chef_environment" => "rspec" , "json_class" => "Chef::Node", "normal" => {"foo" => "bar"}}
+          file "empty_x.json", { "name" => "x" }
+          file "empty_id.json", { "id" => "z" }
+          file "rolestuff.json", '{"description":"hi there","name":"x"}'
+          file "cookbooks_to_upload/z/metadata.rb", cookbook_z_100_metadata_rb
+        end
+
+        it "knife raw -z -i empty.json -m POST /clients" do
+          knife("raw -z -i #{path_to('empty.json')} -m POST /clients").should_succeed( /uri/ )
+          knife("list --local /clients").should_succeed "/clients/z.json\n"
+        end
+
+        it "knife cookbook upload works" do
+          knife("cookbook upload -z --cookbook-path #{path_to('cookbooks_to_upload')} z").should_succeed :stderr => <<EOM
 Uploading z            [1.0.0]
 Uploaded 1 cookbook.
 EOM
-        knife("list --local -Rfp /cookbooks").should_succeed "/cookbooks/z/\n/cookbooks/z/metadata.rb\n"
-      end
-
-      it "knife raw -z -i empty.json -m POST /data" do
-        knife("raw -z -i #{path_to('empty.json')} -m POST /data").should_succeed( /uri/ )
-        knife("list --local -Rfp /data_bags").should_succeed "/data_bags/z/\n"
-      end
-
-      it "knife raw -z -i empty.json -m POST /data/x" do
-        knife("raw -z -i #{path_to('empty_x.json')} -m POST /data").should_succeed( /uri/ )
-        knife("raw -z -i #{path_to('empty_id.json')} -m POST /data/x").should_succeed( /"z"/ )
-        knife("list --local -Rfp /data_bags").should_succeed "/data_bags/x/\n/data_bags/x/z.json\n"
-      end
-
-      it "knife raw -z -i empty.json -m POST /environments" do
-        knife("raw -z -i #{path_to('empty.json')} -m POST /environments").should_succeed( /uri/ )
-        knife("list --local /environments").should_succeed "/environments/z.json\n"
-      end
-
-      it "knife raw -z -i dummynode.json -m POST /nodes" do
-        knife("raw -z -i #{path_to('dummynode.json')} -m POST /nodes").should_succeed( /uri/ )
-        knife("list --local /nodes").should_succeed "/nodes/z.json\n"
-        knife("show -z /nodes/z.json").should_succeed(/"bar"/)
-      end
-
-      it "knife raw -z -i empty.json -m POST /roles" do
-        knife("raw -z -i #{path_to('empty.json')} -m POST /roles").should_succeed( /uri/ )
-        knife("list --local /roles").should_succeed "/roles/z.json\n"
-      end
-
-      it "knife raw -z -i empty.json -m POST /users" do
-        knife("raw -z -i #{path_to('empty.json')} -m POST /users").should_succeed( /uri/ )
-        knife("list --local /users").should_succeed "/users/z.json\n"
-      end
-
-      it "After knife raw -z -i rolestuff.json -m POST /roles, the output is pretty", :skip => (RUBY_VERSION < "1.9") do
-        knife("raw -z -i #{path_to('rolestuff.json')} -m POST /roles").should_succeed( /uri/ )
-        expect(IO.read(path_to("roles/x.json"))).to eq <<EOM.strip
+          knife("list --local -Rfp /cookbooks").should_succeed "/cookbooks/z/\n/cookbooks/z/metadata.rb\n"
+        end
+
+        it "knife raw -z -i empty.json -m POST /data" do
+          knife("raw -z -i #{path_to('empty.json')} -m POST /data").should_succeed( /uri/ )
+          knife("list --local -Rfp /data_bags").should_succeed "/data_bags/z/\n"
+        end
+
+        it "knife raw -z -i empty.json -m POST /data/x" do
+          knife("raw -z -i #{path_to('empty_x.json')} -m POST /data").should_succeed( /uri/ )
+          knife("raw -z -i #{path_to('empty_id.json')} -m POST /data/x").should_succeed( /"z"/ )
+          knife("list --local -Rfp /data_bags").should_succeed "/data_bags/x/\n/data_bags/x/z.json\n"
+        end
+
+        it "knife raw -z -i empty.json -m POST /environments" do
+          knife("raw -z -i #{path_to('empty.json')} -m POST /environments").should_succeed( /uri/ )
+          knife("list --local /environments").should_succeed "/environments/z.json\n"
+        end
+
+        it "knife raw -z -i dummynode.json -m POST /nodes" do
+          knife("raw -z -i #{path_to('dummynode.json')} -m POST /nodes").should_succeed( /uri/ )
+          knife("list --local /nodes").should_succeed "/nodes/z.json\n"
+          knife("show -z /nodes/z.json").should_succeed(/"bar"/)
+        end
+
+        it "knife raw -z -i empty.json -m POST /roles" do
+          knife("raw -z -i #{path_to('empty.json')} -m POST /roles").should_succeed( /uri/ )
+          knife("list --local /roles").should_succeed "/roles/z.json\n"
+        end
+
+        it "After knife raw -z -i rolestuff.json -m POST /roles, the output is pretty", :skip => (RUBY_VERSION < "1.9") do
+          knife("raw -z -i #{path_to('rolestuff.json')} -m POST /roles").should_succeed( /uri/ )
+          expect(IO.read(path_to("roles/x.json"))).to eq <<EOM.strip
 {
   "name": "x",
   "description": "hi there"
 }
 EOM
+        end
       end
-    end
 
-    it "knife list -z -R returns nothing" do
-      knife("list -z -Rfp /").should_succeed <<EOM
+      it "knife list -z -R returns nothing" do
+        knife("list -z -Rfp /").should_succeed <<EOM
+/acls/
+/acls/clients/
+/acls/containers/
+/acls/cookbooks/
+/acls/data_bags/
+/acls/environments/
+/acls/groups/
+/acls/nodes/
+/acls/organization.json
+/acls/roles/
 /clients/
+/containers/
+/cookbook_artifacts/
 /cookbooks/
 /data_bags/
 /environments/
+/groups/
+/invitations.json
+/members.json
 /nodes/
+/org.json
+/policies/
+/policy_groups/
 /roles/
-/users/
 EOM
-    end
-
-    context "DELETE /TYPE/NAME" do
-      it "knife delete -z /clients/x.json fails with an error" do
-        knife("delete -z /clients/x.json").should_fail "ERROR: /clients/x.json: No such file or directory\n"
       end
 
-      it "knife delete -z -r /cookbooks/x fails with an error" do
-        knife("delete -z -r /cookbooks/x").should_fail "ERROR: /cookbooks/x: No such file or directory\n"
-      end
+      context "DELETE /TYPE/NAME" do
+        it "knife delete -z /clients/x.json fails with an error" do
+          knife("delete -z /clients/x.json").should_fail "ERROR: /clients/x.json: No such file or directory\n"
+        end
 
-      it "knife delete -z -r /data_bags/x fails with an error" do
-        knife("delete -z -r /data_bags/x").should_fail "ERROR: /data_bags/x: No such file or directory\n"
-      end
+        it "knife delete -z -r /cookbooks/x fails with an error" do
+          knife("delete -z -r /cookbooks/x").should_fail "ERROR: /cookbooks/x: No such file or directory\n"
+        end
 
-      it "knife delete -z /data_bags/x/y.json fails with an error" do
-        knife("delete -z /data_bags/x/y.json").should_fail "ERROR: /data_bags/x/y.json: No such file or directory\n"
-      end
+        it "knife delete -z -r /data_bags/x fails with an error" do
+          knife("delete -z -r /data_bags/x").should_fail "ERROR: /data_bags/x: No such file or directory\n"
+        end
 
-      it "knife delete -z /environments/x.json fails with an error" do
-        knife("delete -z /environments/x.json").should_fail "ERROR: /environments/x.json: No such file or directory\n"
-      end
+        it "knife delete -z /data_bags/x/y.json fails with an error" do
+          knife("delete -z /data_bags/x/y.json").should_fail "ERROR: /data_bags/x/y.json: No such file or directory\n"
+        end
+
+        it "knife delete -z /environments/x.json fails with an error" do
+          knife("delete -z /environments/x.json").should_fail "ERROR: /environments/x.json: No such file or directory\n"
+        end
+
+        it "knife delete -z /nodes/x.json fails with an error" do
+          knife("delete -z /nodes/x.json").should_fail "ERROR: /nodes/x.json: No such file or directory\n"
+        end
+
+        it "knife delete -z /roles/x.json fails with an error" do
+          knife("delete -z /roles/x.json").should_fail "ERROR: /roles/x.json: No such file or directory\n"
+        end
 
-      it "knife delete -z /nodes/x.json fails with an error" do
-        knife("delete -z /nodes/x.json").should_fail "ERROR: /nodes/x.json: No such file or directory\n"
       end
 
-      it "knife delete -z /roles/x.json fails with an error" do
-        knife("delete -z /roles/x.json").should_fail "ERROR: /roles/x.json: No such file or directory\n"
+      context "GET /TYPE/NAME" do
+        it "knife show -z /clients/x.json fails with an error" do
+          knife("show -z /clients/x.json").should_fail "ERROR: /clients/x.json: No such file or directory\n"
+        end
+
+        it "knife show -z /cookbooks/x/metadata.rb fails with an error" do
+          knife("show -z /cookbooks/x/metadata.rb").should_fail "ERROR: /cookbooks/x/metadata.rb: No such file or directory\n"
+        end
+
+        it "knife show -z /data_bags/x/y.json fails with an error" do
+          knife("show -z /data_bags/x/y.json").should_fail "ERROR: /data_bags/x/y.json: No such file or directory\n"
+        end
+
+        it "knife show -z /environments/x.json fails with an error" do
+          knife("show -z /environments/x.json").should_fail "ERROR: /environments/x.json: No such file or directory\n"
+        end
+
+        it "knife show -z /nodes/x.json fails with an error" do
+          knife("show -z /nodes/x.json").should_fail "ERROR: /nodes/x.json: No such file or directory\n"
+        end
+
+        it "knife show -z /roles/x.json fails with an error" do
+          knife("show -z /roles/x.json").should_fail "ERROR: /roles/x.json: No such file or directory\n"
+        end
+
       end
 
-      it "knife delete -z /users/x.json fails with an error" do
-        knife("delete -z /users/x.json").should_fail "ERROR: /users/x.json: No such file or directory\n"
+      context "PUT /TYPE/NAME" do
+        before do
+          file "empty.json", {}
+        end
+
+        it "knife raw -z -i empty.json -m PUT /clients/x fails with 404" do
+          knife("raw -z -i #{path_to('empty.json')} -m PUT /clients/x").should_fail( /404/ )
+        end
+
+        it "knife raw -z -i empty.json -m PUT /data/x/y fails with 404" do
+          knife("raw -z -i #{path_to('empty.json')} -m PUT /data/x/y").should_fail( /404/ )
+        end
+
+        it "knife raw -z -i empty.json -m PUT /environments/x fails with 404" do
+          knife("raw -z -i #{path_to('empty.json')} -m PUT /environments/x").should_fail( /404/ )
+        end
+
+        it "knife raw -z -i empty.json -m PUT /nodes/x fails with 404" do
+          knife("raw -z -i #{path_to('empty.json')} -m PUT /nodes/x").should_fail( /404/ )
+        end
+
+        it "knife raw -z -i empty.json -m PUT /roles/x fails with 404" do
+          knife("raw -z -i #{path_to('empty.json')} -m PUT /roles/x").should_fail( /404/ )
+        end
+
       end
     end
+  end
 
-    context "GET /TYPE/NAME" do
-      it "knife show -z /clients/x.json fails with an error" do
-        knife("show -z /clients/x.json").should_fail "ERROR: /clients/x.json: No such file or directory\n"
-      end
+  # We have to configure Zero for Chef 11 mode in order to test users because:
+  # 1. local mode overrides your `chef_server_url` to something like "http://localhost:PORT"
+  # 2. single org mode maps requests like "https://localhost:PORT/users" so
+  #   they're functionally equivalent to "https://localhost:PORT/organizations/DEFAULT/users"
+  # 3. Users are global objects in Chef 12, and should be accessed at URLs like
+  #   "https://localhost:PORT/users" (there is an org-specific users endpoint,
+  #   but it's for listing users in an org, not for managing users).
+  # 4. Therefore you can't hit the _real_ users endpoint in local mode when
+  #   configured for Chef Server 12 mode.
+  #
+  # Because of this, we have to configure Zero for Chef 11 OSC mode in order to
+  # test the users part of the data store with local mode.
+  describe "with repo mode 'everything'" do
+    before do
+      Chef::Config.repo_mode = "everything"
+      Chef::Config.chef_zero.osc_compat = true
+    end
 
-      it "knife show -z /cookbooks/x/metadata.rb fails with an error" do
-        knife("show -z /cookbooks/x/metadata.rb").should_fail "ERROR: /cookbooks/x/metadata.rb: No such file or directory\n"
+    when_the_repository "has one of each thing" do
+      before do
+        file "clients/x.json", {}
+        file "cookbooks/x/metadata.rb", cookbook_x_100_metadata_rb
+        file "data_bags/x/y.json", {}
+        file "environments/x.json", {}
+        file "nodes/x.json", {}
+        file "roles/x.json", {}
+        file "users/x.json", {}
+      end
+
+      context "GET /TYPE" do
+        it "knife list -z -R returns everything" do
+          knife("list -z -Rfp /").should_succeed <<EOM
+/clients/
+/clients/x.json
+/cookbooks/
+/cookbooks/x/
+/cookbooks/x/metadata.rb
+/data_bags/
+/data_bags/x/
+/data_bags/x/y.json
+/environments/
+/environments/x.json
+/nodes/
+/nodes/x.json
+/roles/
+/roles/x.json
+/users/
+/users/x.json
+EOM
+        end
       end
 
-      it "knife show -z /data_bags/x/y.json fails with an error" do
-        knife("show -z /data_bags/x/y.json").should_fail "ERROR: /data_bags/x/y.json: No such file or directory\n"
+      context "DELETE /TYPE/NAME" do
+        it "knife delete -z /users/x.json works" do
+          knife("delete -z /users/x.json").should_succeed "Deleted /users/x.json\n"
+          knife("list -z -Rfp /users").should_succeed ""
+        end
       end
 
-      it "knife show -z /environments/x.json fails with an error" do
-        knife("show -z /environments/x.json").should_fail "ERROR: /environments/x.json: No such file or directory\n"
+      context "GET /TYPE/NAME" do
+        it "knife show -z /users/x.json works" do
+          knife("show -z /users/x.json").should_succeed( /"x"/ )
+        end
       end
 
-      it "knife show -z /nodes/x.json fails with an error" do
-        knife("show -z /nodes/x.json").should_fail "ERROR: /nodes/x.json: No such file or directory\n"
-      end
+      context "PUT /TYPE/NAME" do
+        before do
+          file "empty.json", {}
+          file "dummynode.json", { "name" => "x", "chef_environment" => "rspec" , "json_class" => "Chef::Node", "normal" => {"foo" => "bar"}}
+          file "rolestuff.json", '{"description":"hi there","name":"x"}'
+          file "cookbooks_to_upload/x/metadata.rb", cookbook_x_100_metadata_rb
+        end
 
-      it "knife show -z /roles/x.json fails with an error" do
-        knife("show -z /roles/x.json").should_fail "ERROR: /roles/x.json: No such file or directory\n"
-      end
+        it "knife raw -z -i empty.json -m PUT /users/x" do
+          knife("raw -z -i #{path_to('empty.json')} -m PUT /users/x").should_succeed( /"x"/ )
+          knife("list --local /users").should_succeed "/users/x.json\n"
+        end
 
-      it "knife show -z /users/x.json fails with an error" do
-        knife("show -z /users/x.json").should_fail "ERROR: /users/x.json: No such file or directory\n"
+        it "After knife raw -z -i rolestuff.json -m PUT /roles/x, the output is pretty", :skip => (RUBY_VERSION < "1.9") do
+          knife("raw -z -i #{path_to('rolestuff.json')} -m PUT /roles/x").should_succeed( /"x"/ )
+          expect(IO.read(path_to("roles/x.json"))).to eq <<EOM.strip
+{
+  "name": "x",
+  "description": "hi there"
+}
+EOM
+        end
       end
     end
 
-    context "PUT /TYPE/NAME" do
-      before do
-        file "empty.json", {}
-      end
+    when_the_repository "is empty" do
+      context "POST /TYPE/NAME" do
+        before do
+          file "empty.json", { "name" => "z" }
+          file "dummynode.json", { "name" => "z", "chef_environment" => "rspec" , "json_class" => "Chef::Node", "normal" => {"foo" => "bar"}}
+          file "empty_x.json", { "name" => "x" }
+          file "empty_id.json", { "id" => "z" }
+          file "rolestuff.json", '{"description":"hi there","name":"x"}'
+          file "cookbooks_to_upload/z/metadata.rb", cookbook_z_100_metadata_rb
+        end
 
-      it "knife raw -z -i empty.json -m PUT /clients/x fails with 404" do
-        knife("raw -z -i #{path_to('empty.json')} -m PUT /clients/x").should_fail( /404/ )
+        it "knife raw -z -i empty.json -m POST /users" do
+          knife("raw -z -i #{path_to('empty.json')} -m POST /users").should_succeed( /uri/ )
+          knife("list --local /users").should_succeed "/users/z.json\n"
+        end
       end
 
-      it "knife raw -z -i empty.json -m PUT /data/x/y fails with 404" do
-        knife("raw -z -i #{path_to('empty.json')} -m PUT /data/x/y").should_fail( /404/ )
+      it "knife list -z -R returns nothing" do
+        knife("list -z -Rfp /").should_succeed <<EOM
+/clients/
+/cookbooks/
+/data_bags/
+/environments/
+/nodes/
+/roles/
+/users/
+EOM
       end
 
-      it "knife raw -z -i empty.json -m PUT /environments/x fails with 404" do
-        knife("raw -z -i #{path_to('empty.json')} -m PUT /environments/x").should_fail( /404/ )
+      context "DELETE /TYPE/NAME" do
+        it "knife delete -z /users/x.json fails with an error" do
+          knife("delete -z /users/x.json").should_fail "ERROR: /users/x.json: No such file or directory\n"
+        end
       end
 
-      it "knife raw -z -i empty.json -m PUT /nodes/x fails with 404" do
-        knife("raw -z -i #{path_to('empty.json')} -m PUT /nodes/x").should_fail( /404/ )
+      context "GET /TYPE/NAME" do
+        it "knife show -z /users/x.json fails with an error" do
+          knife("show -z /users/x.json").should_fail "ERROR: /users/x.json: No such file or directory\n"
+        end
       end
 
-      it "knife raw -z -i empty.json -m PUT /roles/x fails with 404" do
-        knife("raw -z -i #{path_to('empty.json')} -m PUT /roles/x").should_fail( /404/ )
-      end
+      context "PUT /TYPE/NAME" do
+        before do
+          file "empty.json", {}
+        end
 
-      it "knife raw -z -i empty.json -m PUT /users/x fails with 404" do
-        knife("raw -z -i #{path_to('empty.json')} -m PUT /users/x").should_fail( /404/ )
+        it "knife raw -z -i empty.json -m PUT /users/x fails with 404" do
+          knife("raw -z -i #{path_to('empty.json')} -m PUT /users/x").should_fail( /404/ )
+        end
       end
     end
   end