Add knife/ChefFS support for policyfiles and policy_groups.

4 files changed, 427 insertions, 58 deletions

diff --git a/spec/integration/knife/delete_spec.rb b/spec/integration/knife/delete_spec.rb
index 733a7ef72b..384f06cf83 100644
--- a/spec/integration/knife/delete_spec.rb
+++ b/spec/integration/knife/delete_spec.rb
@@ -967,6 +967,8 @@ EOM
       organization 'foo' do
         container 'x', {}
         group 'x', {}
+        policy 'x', '1.2.3', {}
+        policy_group 'x', { 'policies' => { 'x' => { 'revision_id' => '1.2.3' } } }
       end
     end
 
@@ -975,7 +977,7 @@ EOM
     end
 
     it 'knife delete /acls/containers/environments.json fails with a reasonable error' do
-      knife('delete /acls/containers/environments.json').should_fail "ERROR: /acls/containers/environments.json (remote) cannot be deleted.\n"
+      knife('delete /acls/containers/environments.json').should_fail "ERROR: /acls/containers/environments.json (remote) ACLs cannot be deleted.\n"
     end
 
     it 'knife delete /containers/x.json succeeds' do
@@ -988,6 +990,18 @@ EOM
       knife('raw /groups/x.json').should_fail(/404/)
     end
 
+    it 'knife delete /policies/x-1.2.3.json succeeds' do
+      knife('raw /policies/x/revisions/1.2.3').should_succeed "{\n  \"name\": \"x\",\n  \"revision_id\": \"1.2.3\",\n  \"run_list\": [\n\n  ],\n  \"cookbook_locks\": {\n\n  }\n}\n"
+      knife('delete /policies/x-1.2.3.json').should_succeed "Deleted /policies/x-1.2.3.json\n"
+      knife('raw /policies/x/revisions/1.2.3').should_fail(/404/)
+    end
+
+    it 'knife delete /policy_groups/x.json succeeds' do
+      knife('raw /policy_groups/x').should_succeed "{\n  \"uri\": \"http://127.0.0.1:8900/organizations/foo/policy_groups/x\",\n  \"policies\": {\n    \"x\": {\n      \"revision_id\": \"1.2.3\"\n    }\n  }\n}\n"
+      knife('delete /policy_groups/x.json').should_succeed "Deleted /policy_groups/x.json\n"
+      knife('raw /policy_groups/x').should_fail(/404/)
+    end
+
     it 'knife delete /org.json fails with a reasonable error' do
       knife('delete /org.json').should_fail "ERROR: /org.json (remote) cannot be deleted.\n"
     end
diff --git a/spec/integration/knife/download_spec.rb b/spec/integration/knife/download_spec.rb
index b8a19061b7..0c334fc65c 100644
--- a/spec/integration/knife/download_spec.rb
+++ b/spec/integration/knife/download_spec.rb
@@ -1094,27 +1094,18 @@ EOM
 
   when_the_chef_server "is in Enterprise mode", :osc_compat => false, :single_org => false do
     before do
-      organization 'foo' do
-        container 'x', {}
-        group 'x', {}
-      end
+      user 'foo', {}
+      user 'bar', {}
+      user 'foobar', {}
+      organization 'foo', { 'full_name' => 'Something' }
     end
 
     before :each do
       Chef::Config.chef_server_url = URI.join(Chef::Config.chef_server_url, '/organizations/foo')
     end
-    when_the_repository 'has existing top level files' do
-      before do
-        file 'invitations.json', {}
-      end
 
-      it "can still download top level files" do
-        knife('download /invitations.json').should_succeed
-      end
-    end
-
-    when_the_repository 'is empty' do
-      it 'knife download / downloads everything' do
+    when_the_repository "has all the default stuff" do
+      before do
         knife('download /').should_succeed <<EOM
 Created /acls
 Created /acls/clients
@@ -1131,7 +1122,6 @@ Created /acls/containers/nodes.json
 Created /acls/containers/policies.json
 Created /acls/containers/roles.json
 Created /acls/containers/sandboxes.json
-Created /acls/containers/x.json
 Created /acls/cookbooks
 Created /acls/data_bags
 Created /acls/environments
@@ -1141,7 +1131,6 @@ Created /acls/groups/admins.json
 Created /acls/groups/billing-admins.json
 Created /acls/groups/clients.json
 Created /acls/groups/users.json
-Created /acls/groups/x.json
 Created /acls/nodes
 Created /acls/roles
 Created /acls/organization.json
@@ -1159,7 +1148,6 @@ Created /containers/nodes.json
 Created /containers/policies.json
 Created /containers/roles.json
 Created /containers/sandboxes.json
-Created /containers/x.json
 Created /cookbooks
 Created /data_bags
 Created /environments
@@ -1169,14 +1157,141 @@ Created /groups/admins.json
 Created /groups/billing-admins.json
 Created /groups/clients.json
 Created /groups/users.json
-Created /groups/x.json
 Created /invitations.json
 Created /members.json
 Created /nodes
 Created /org.json
+Created /policies
+Created /policy_groups
 Created /roles
 EOM
-        knife('diff --name-status /').should_succeed ''
+      end
+
+      context 'and the server has one of each thing' do
+        before do
+          # acl_for %w(organizations foo groups blah)
+          client 'x', {}
+          cookbook 'x', '1.0.0'
+          container 'x', {}
+          data_bag 'x', { 'y' => {} }
+          environment 'x', {}
+          group 'x', {}
+          org_invite 'foo'
+          org_member 'bar'
+          node 'x', {}
+          policy 'x', '1.0.0', {}
+          policy 'blah', '1.0.0', {}
+          policy_group 'x', {
+            'policies' => {
+              'x' => { 'revision_id' => '1.0.0' },
+              'blah' => { 'revision_id' => '1.0.0' }
+            }
+          }
+          role 'x', {}
+        end
+
+        before do
+          knife('download /acls /groups/clients.json /groups/users.json').should_succeed <<-EOM
+Created /acls/clients/x.json
+Created /acls/containers/x.json
+Created /acls/cookbooks/x.json
+Created /acls/data_bags/x.json
+Created /acls/environments/x.json
+Created /acls/groups/x.json
+Created /acls/nodes/x.json
+Created /acls/roles/x.json
+Updated /groups/clients.json
+Updated /groups/users.json
+EOM
+        end
+
+        it 'knife download / downloads everything' do
+          knife('download /').should_succeed <<EOM
+Created /clients/x.json
+Created /containers/x.json
+Created /cookbooks/x
+Created /cookbooks/x/metadata.rb
+Created /data_bags/x
+Created /data_bags/x/y.json
+Created /environments/x.json
+Created /groups/x.json
+Updated /invitations.json
+Updated /members.json
+Created /nodes/x.json
+Created /policies/blah-1.0.0.json
+Created /policies/x-1.0.0.json
+Created /policy_groups/x.json
+Created /roles/x.json
+EOM
+          knife('diff --name-status /').should_succeed ''
+        end
+
+        context "and the repository has an identical copy of each thing" do
+          before do
+            # TODO We have to upload acls for an existing group due to a lack of
+            # dependency detection during upload.  Fix that!
+            file 'clients/x.json', { 'public_key' => ChefZero::PUBLIC_KEY }
+            file 'containers/x.json', {}
+            file 'cookbooks/x/metadata.rb', cb_metadata("x", "1.0.0")
+            file 'data_bags/x/y.json', {}
+            file 'environments/x.json', {}
+            file 'groups/x.json', {}
+            file 'invitations.json', [ 'foo' ]
+            file 'members.json', [ 'bar' ]
+            file 'nodes/x.json', {}
+            file 'org.json', { 'full_name' => 'Something' }
+            file 'policies/x-1.0.0.json', { }
+            file 'policies/blah-1.0.0.json', { }
+            file 'policy_groups/x.json', { 'policies' => { 'x' => { 'revision_id' => '1.0.0' }, 'blah' => { 'revision_id' => '1.0.0' } } }
+            file 'roles/x.json', {}
+          end
+
+          it 'knife download makes no changes' do
+            knife('download /').should_succeed ''
+          end
+        end
+
+        context "and the repository has a slightly different copy of each thing" do
+          before do
+            # acl_for %w(organizations foo groups blah)
+            file 'clients/x.json', { 'validator' => true }
+            file 'containers/x.json', {}
+            file 'cookbooks/x/metadata.rb', cb_metadata("x", "1.0.1")
+            file 'data_bags/x/y.json', { 'a' => 'b' }
+            file 'environments/x.json', { 'description' => 'foo' }
+            file 'groups/x.json', { 'description' => 'foo' }
+            file 'groups/x.json', { 'groups' => [ 'admin' ] }
+            file 'nodes/x.json', { 'run_list' => [ 'blah' ] }
+            file 'org.json', { 'full_name' => 'Something Else ' }
+            file 'policies/x-1.0.0.json', { 'run_list' => [ 'blah' ] }
+            file 'policy_groups/x.json', {
+              'policies' => {
+                'x' => { 'revision_id' => '1.0.1' },
+                'y' => { 'revision_id' => '1.0.0' }
+              }
+            }
+            file 'roles/x.json', { 'run_list' => [ 'blah' ] }
+          end
+
+          it 'knife download updates everything' do
+            knife('download /').should_succeed <<EOM
+Updated /clients/x.json
+Updated /cookbooks/x/metadata.rb
+Updated /data_bags/x/y.json
+Updated /environments/x.json
+Updated /groups/x.json
+Updated /invitations.json
+Updated /members.json
+Updated /nodes/x.json
+Updated /org.json
+Created /policies/blah-1.0.0.json
+Updated /policies/x-1.0.0.json
+Updated /policy_groups/x.json
+Updated /roles/x.json
+EOM
+            knife('diff --name-status /').should_succeed ''
+          end
+        end
       end
     end
   end
diff --git a/spec/integration/knife/list_spec.rb b/spec/integration/knife/list_spec.rb
index b289642c7d..eb2ed279e5 100644
--- a/spec/integration/knife/list_spec.rb
+++ b/spec/integration/knife/list_spec.rb
@@ -27,7 +27,7 @@ describe 'knife list', :workstation do
 
   when_the_chef_server "is empty" do
     it "knife list / returns all top level directories" do
-      knife('list /').should_succeed <<EOM
+      knife('list /').should_succeed <<-EOM
 /clients
 /cookbooks
 /data_bags
@@ -39,7 +39,7 @@ EOM
     end
 
     it "knife list -R / returns everything" do
-      knife('list -R /').should_succeed <<EOM
+      knife('list -R /').should_succeed <<-EOM
 /:
 clients
 cookbooks
@@ -82,6 +82,9 @@ EOM
       environment 'environment2', {}
       node 'node1', {}
       node 'node2', {}
+      policy 'policy1', '1.2.3', {}
+      policy 'policy2', '1.2.3', {}
+      policy 'policy2', '1.3.5', {}
       role 'role1', {}
       role 'role2', {}
       user 'user1', {}
@@ -89,7 +92,7 @@ EOM
     end
 
     it "knife list / returns all top level directories" do
-      knife('list /').should_succeed <<EOM
+      knife('list /').should_succeed <<-EOM
 /clients
 /cookbooks
 /data_bags
@@ -101,7 +104,7 @@ EOM
     end
 
     it "knife list -R / returns everything" do
-      knife('list -R /').should_succeed <<EOM
+      knife('list -R /').should_succeed <<-EOM
 /:
 clients
 cookbooks
@@ -164,7 +167,7 @@ EOM
     end
 
     it "knife list -R --flat / returns everything" do
-      knife('list -R --flat /').should_succeed <<EOM
+      knife('list -R --flat /').should_succeed <<-EOM
 /clients
 /clients/chef-validator.json
 /clients/chef-webui.json
@@ -202,7 +205,7 @@ EOM
     end
 
     it "knife list -Rfp / returns everything" do
-      knife('list -Rfp /').should_succeed <<EOM
+      knife('list -Rfp /').should_succeed <<-EOM
 /clients/
 /clients/chef-validator.json
 /clients/chef-webui.json
@@ -240,7 +243,7 @@ EOM
     end
 
     it "knife list /cookbooks returns the list of cookbooks" do
-      knife('list /cookbooks').should_succeed <<EOM
+      knife('list /cookbooks').should_succeed <<-EOM
 /cookbooks/cookbook1
 /cookbooks/cookbook2
 EOM
@@ -251,7 +254,7 @@ EOM
     end
 
     it "knife list /**.rb returns all ruby files" do
-      knife('list /**.rb').should_succeed <<EOM
+      knife('list /**.rb').should_succeed <<-EOM
 /cookbooks/cookbook1/metadata.rb
 /cookbooks/cookbook2/metadata.rb
 /cookbooks/cookbook2/recipes/default.rb
@@ -259,7 +262,7 @@ EOM
     end
 
     it "knife list /cookbooks/**.rb returns all ruby files" do
-      knife('list /cookbooks/**.rb').should_succeed <<EOM
+      knife('list /cookbooks/**.rb').should_succeed <<-EOM
 /cookbooks/cookbook1/metadata.rb
 /cookbooks/cookbook2/metadata.rb
 /cookbooks/cookbook2/recipes/default.rb
@@ -267,7 +270,7 @@ EOM
     end
 
     it "knife list /**.json returns all json files" do
-      knife('list /**.json').should_succeed <<EOM
+      knife('list /**.json').should_succeed <<-EOM
 /clients/chef-validator.json
 /clients/chef-webui.json
 /clients/client1.json
@@ -290,7 +293,7 @@ EOM
     end
 
     it "knife list /data**.json returns all data bag json files" do
-      knife('list /data**.json').should_succeed <<EOM
+      knife('list /data**.json').should_succeed <<-EOM
 /data_bags/bag1/item1.json
 /data_bags/bag1/item2.json
 /data_bags/bag2/item1.json
@@ -322,7 +325,7 @@ EOM
           before { cwd '.' }
 
           it "knife list -Rfp returns everything" do
-            knife('list -Rfp').should_succeed <<EOM
+            knife('list -Rfp').should_succeed <<-EOM
 clients/
 clients/chef-validator.json
 clients/chef-webui.json
@@ -367,7 +370,7 @@ EOM
           before { cwd 'cookbooks' }
 
           it "knife list -Rfp / returns everything" do
-            knife('list -Rfp /').should_succeed <<EOM
+            knife('list -Rfp /').should_succeed <<-EOM
 /clients/
 /clients/chef-validator.json
 /clients/chef-webui.json
@@ -405,7 +408,7 @@ EOM
           end
 
           it "knife list -Rfp .. returns everything" do
-            knife('list -Rfp ..').should_succeed <<EOM
+            knife('list -Rfp ..').should_succeed <<-EOM
 /clients/
 /clients/chef-validator.json
 /clients/chef-webui.json
@@ -443,7 +446,7 @@ EOM
           end
 
           it "knife list -Rfp returns cookbooks" do
-            knife('list -Rfp').should_succeed <<EOM
+            knife('list -Rfp').should_succeed <<-EOM
 cookbook1/
 cookbook1/metadata.rb
 cookbook2/
@@ -462,7 +465,7 @@ EOM
           before { cwd 'cookbooks/cookbook2' }
 
           it "knife list -Rfp returns cookbooks" do
-            knife('list -Rfp').should_succeed <<EOM
+            knife('list -Rfp').should_succeed <<-EOM
 metadata.rb
 recipes/
 recipes/default.rb
@@ -481,7 +484,7 @@ EOM
           before { cwd 'cookbooks' }
 
           it "knife list -Rfp returns cookbooks" do
-            knife('list -Rfp').should_succeed <<EOM
+            knife('list -Rfp').should_succeed <<-EOM
 cookbook1/
 cookbook1/metadata.rb
 cookbook2/
@@ -496,7 +499,7 @@ EOM
           before { cwd 'symlinked' }
 
           it "knife list -Rfp returns cookbooks" do
-            knife('list -Rfp').should_succeed <<EOM
+            knife('list -Rfp').should_succeed <<-EOM
 cookbook1/
 cookbook1/metadata.rb
 cookbook2/
@@ -518,7 +521,7 @@ EOM
           before { cwd 'real_cookbooks' }
 
           it "knife list -Rfp returns cookbooks" do
-            knife('list -Rfp').should_succeed <<EOM
+            knife('list -Rfp').should_succeed <<-EOM
 cookbook1/
 cookbook1/metadata.rb
 cookbook2/
@@ -533,7 +536,7 @@ EOM
           before { cwd 'cookbooks' }
 
           it "knife list -Rfp returns cookbooks" do
-            knife('list -Rfp').should_succeed <<EOM
+            knife('list -Rfp').should_succeed <<-EOM
 cookbook1/
 cookbook1/metadata.rb
 cookbook2/
@@ -586,6 +589,7 @@ EOM
         file 'environments/environment2.json', {}
         file 'nodes/node1.json', {}
         file 'nodes/node2.json', {}
+
         file 'roles/role1.json', {}
         file 'roles/role2.json', {}
         file 'users/user1.json', {}
@@ -593,7 +597,7 @@ EOM
       end
 
       it "knife list -Rfp / returns everything" do
-        knife('list -Rp --local --flat /').should_succeed <<EOM
+        knife('list -Rp --local --flat /').should_succeed <<-EOM
 /clients/
 /clients/client1.json
 /clients/client2.json
@@ -653,7 +657,7 @@ EOM
 
     context 'and is empty' do
       it "knife list / returns all top level directories" do
-        knife('list /').should_succeed <<EOM
+        knife('list /').should_succeed <<-EOM
 /acls
 /clients
 /containers
@@ -665,12 +669,14 @@ EOM
 /members.json
 /nodes
 /org.json
+/policies
+/policy_groups
 /roles
 EOM
       end
 
       it "knife list -R / returns everything" do
-        knife('list -R /').should_succeed <<EOM
+        knife('list -R /').should_succeed <<-EOM
 /:
 acls
 clients
@@ -683,6 +689,8 @@ invitations.json
 members.json
 nodes
 org.json
+policies
+policy_groups
 roles
 
 /acls:
@@ -760,23 +768,17 @@ users.json
 
 /nodes:
 
+/policies:
+
+/policy_groups:
+
 /roles:
 EOM
       end
     end
-  end
-
-  when_the_chef_server "is in Enterprise mode", :osc_compat => false, :single_org => false do
-    before do
-      organization 'foo'
-    end
-
-    before :each do
-      Chef::Config.chef_server_url = URI.join(Chef::Config.chef_server_url, '/organizations/foo')
-    end
 
     it 'knife list -R / returns everything' do
-      knife('list -R /').should_succeed <<EOM
+      knife('list -R /').should_succeed <<-EOM
 /:
 acls
 clients
@@ -789,6 +791,8 @@ invitations.json
 members.json
 nodes
 org.json
+policies
+policy_groups
 roles
 
 /acls:
@@ -866,8 +870,149 @@ users.json
 
 /nodes:
 
+/policies:
+
+/policy_groups:
+
 /roles:
 EOM
     end
+
+    context "has plenty of stuff in it" do
+      before do
+        client 'client1', {}
+        client 'client2', {}
+        container 'container1', {}
+        container 'container2', {}
+        cookbook 'cookbook1', '1.0.0'
+        cookbook 'cookbook2', '1.0.1', { 'recipes' => { 'default.rb' => '' } }
+        data_bag 'bag1', { 'item1' => {}, 'item2' => {} }
+        data_bag 'bag2', { 'item1' => {}, 'item2' => {} }
+        environment 'environment1', {}
+        environment 'environment2', {}
+        group 'group1', {}
+        group 'group2', {}
+        node 'node1', {}
+        node 'node2', {}
+        org_invite 'user1'
+        org_member 'user2'
+        policy 'policy1', '1.2.3', {}
+        policy 'policy2', '1.2.3', {}
+        policy 'policy2', '1.3.5', {}
+        policy_group 'policy_group1', { 'policies' => { 'policy1' => { 'revision_id' => '1.2.3' } } }
+        policy_group 'policy_group2', { 'policies' => { 'policy2' => { 'revision_id' => '1.3.5' } } }
+        role 'role1', {}
+        role 'role2', {}
+        user 'user1', {}
+        user 'user2', {}
+      end
+
+      it "knife list -Rfp / returns everything" do
+        knife('list -Rfp /').should_succeed <<-EOM
+/acls/
+/acls/clients/
+/acls/clients/client1.json
+/acls/clients/client2.json
+/acls/clients/foo-validator.json
+/acls/containers/
+/acls/containers/clients.json
+/acls/containers/container1.json
+/acls/containers/container2.json
+/acls/containers/containers.json
+/acls/containers/cookbook_artifacts.json
+/acls/containers/cookbooks.json
+/acls/containers/data.json
+/acls/containers/environments.json
+/acls/containers/groups.json
+/acls/containers/nodes.json
+/acls/containers/policies.json
+/acls/containers/roles.json
+/acls/containers/sandboxes.json
+/acls/cookbooks/
+/acls/cookbooks/cookbook1.json
+/acls/cookbooks/cookbook2.json
+/acls/data_bags/
+/acls/data_bags/bag1.json
+/acls/data_bags/bag2.json
+/acls/environments/
+/acls/environments/_default.json
+/acls/environments/environment1.json
+/acls/environments/environment2.json
+/acls/groups/
+/acls/groups/admins.json
+/acls/groups/billing-admins.json
+/acls/groups/clients.json
+/acls/groups/group1.json
+/acls/groups/group2.json
+/acls/groups/users.json
+/acls/nodes/
+/acls/nodes/node1.json
+/acls/nodes/node2.json
+/acls/organization.json
+/acls/roles/
+/acls/roles/role1.json
+/acls/roles/role2.json
+/clients/
+/clients/client1.json
+/clients/client2.json
+/clients/foo-validator.json
+/containers/
+/containers/clients.json
+/containers/container1.json
+/containers/container2.json
+/containers/containers.json
+/containers/cookbook_artifacts.json
+/containers/cookbooks.json
+/containers/data.json
+/containers/environments.json
+/containers/groups.json
+/containers/nodes.json
+/containers/policies.json
+/containers/roles.json
+/containers/sandboxes.json
+/cookbooks/
+/cookbooks/cookbook1/
+/cookbooks/cookbook1/metadata.rb
+/cookbooks/cookbook2/
+/cookbooks/cookbook2/metadata.rb
+/cookbooks/cookbook2/recipes/
+/cookbooks/cookbook2/recipes/default.rb
+/data_bags/
+/data_bags/bag1/
+/data_bags/bag1/item1.json
+/data_bags/bag1/item2.json
+/data_bags/bag2/
+/data_bags/bag2/item1.json
+/data_bags/bag2/item2.json
+/environments/
+/environments/_default.json
+/environments/environment1.json
+/environments/environment2.json
+/groups/
+/groups/admins.json
+/groups/billing-admins.json
+/groups/clients.json
+/groups/group1.json
+/groups/group2.json
+/groups/users.json
+/invitations.json
+/members.json
+/nodes/
+/nodes/node1.json
+/nodes/node2.json
+/org.json
+/policies/
+/policies/policy1-1.2.3.json
+/policies/policy2-1.2.3.json
+/policies/policy2-1.3.5.json
+/policy_groups/
+/policy_groups/policy_group1.json
+/policy_groups/policy_group2.json
+/roles/
+/roles/role1.json
+/roles/role2.json
+EOM
+      end
+    end
   end
 end
diff --git a/spec/integration/knife/upload_spec.rb b/spec/integration/knife/upload_spec.rb
index d72cbb82f5..f7d4fb3cd4 100644
--- a/spec/integration/knife/upload_spec.rb
+++ b/spec/integration/knife/upload_spec.rb
@@ -1248,6 +1248,7 @@ EOM
     end
   end # with versioned cookbooks
 
+
   when_the_chef_server 'has a user' do
     before do
       user 'x', {}
@@ -1268,7 +1269,7 @@ EOM
       user 'foo', {}
       user 'bar', {}
       user 'foobar', {}
-      organization 'foo', { 'full_name' => 'Something'}
+      organization 'foo', { 'full_name' => 'Something' }
     end
 
     before :each do
@@ -1278,7 +1279,7 @@ EOM
     context 'and has nothing but a single group named blah' do
       group 'blah', {}
 
-      when_the_repository 'has one of each thing' do
+      when_the_repository 'has at least one of each thing' do
 
         before do
           # TODO We have to upload acls for an existing group due to a lack of
@@ -1292,8 +1293,11 @@ EOM
           file 'groups/x.json', {}
           file 'invitations.json', [ 'foo' ]
           file 'members.json', [ 'bar' ]
-          file 'nodes/x.json', {}
           file 'org.json', { 'full_name' => 'wootles' }
+          file 'nodes/x.json', {}
+          file 'policies/x-1.0.0.json', { }
+          file 'policies/blah-1.0.0.json', { }
+          file 'policy_groups/x.json', { 'policies' => { 'x' => { 'revision_id' => '1.0.0' }, 'blah' => { 'revision_id' => '1.0.0' } } }
           file 'roles/x.json', {}
         end
 
@@ -1311,11 +1315,102 @@ Updated /invitations.json
 Updated /members.json
 Created /nodes/x.json
 Updated /org.json
+Created /policies/blah-1.0.0.json
+Created /policies/x-1.0.0.json
+Created /policy_groups/x.json
 Created /roles/x.json
 EOM
           expect(api.get('association_requests').map { |a| a['username'] }).to eq([ 'foo' ])
           expect(api.get('users').map { |a| a['user']['username'] }).to eq([ 'bar' ])
         end
+
+        context "When the chef server has an identical copy of each thing" do
+          before do
+            file 'invitations.json', [ 'foo' ]
+            file 'members.json', [ 'bar' ]
+            file 'org.json', { 'full_name' => 'Something' }
+
+            # acl_for %w(organizations foo groups blah)
+            client 'x', {}
+            cookbook 'x', '1.0.0'
+            container 'x', {}
+            data_bag 'x', { 'y' => {} }
+            environment 'x', {}
+            group 'x', {}
+            org_invite 'foo'
+            org_member 'bar'
+            node 'x', {}
+            policy 'x', '1.0.0', {}
+            policy 'blah', '1.0.0', {}
+            policy_group 'x', {
+              'policies' => {
+                'x' => { 'revision_id' => '1.0.0' },
+                'blah' => { 'revision_id' => '1.0.0' }
+              }
+            }
+            role 'x', {}
+          end
+
+          it 'knife upload makes no changes' do
+            knife('upload /').should_succeed <<EOM
+Updated /acls/groups/blah.json
+EOM
+          end
+        end
+
+        context "When the chef server has a slightly different copy of the policy revision" do
+          before do
+            policy 'x', '1.0.0', { 'run_list' => [ 'blah' ] }
+          end
+
+          it "should fail because policies are not updateable" do
+            knife("upload /policies/x-1.0.0.json").should_fail <<EOM
+ERROR: /policies/x-1.0.0.json cannot be updated: policy revisions are immutable once uploaded. If you want to change the policy, create a new revision with your changes.
+EOM
+          end
+        end
+
+        context "When the chef server has a slightly different copy of each thing (except policy revisions)" do
+          before do
+            # acl_for %w(organizations foo groups blah)
+            client 'x', { 'validator' => true }
+            container 'x', {}
+            cookbook 'x', '1.0.0', { 'recipes' => { 'default.rb' => '' } }
+            data_bag 'x', { 'y' => { 'a' => 'b' } }
+            environment 'x', { 'description' => 'foo' }
+            group 'x', { 'groups' => [ 'admin' ] }
+            node 'x', { 'run_list' => [ 'blah' ] }
+            policy 'x', '1.0.0', { }
+            policy 'x', '1.0.1', { }
+            policy 'y', '1.0.0', { }
+            policy_group 'x', {
+              'policies' => {
+                'x' => { 'revision_id' => '1.0.1' },
+                'y' => { 'revision_id' => '1.0.0' }
+              }
+            }
+            role 'x', { 'run_list' => [ 'blah' ] }
+          end
+
+          it 'knife upload updates everything' do
+            knife('upload /').should_succeed <<EOM
+Updated /acls/groups/blah.json
+Updated /clients/x.json
+Updated /cookbooks/x
+Updated /data_bags/x/y.json
+Updated /environments/x.json
+Updated /groups/x.json
+Updated /invitations.json
+Updated /members.json
+Updated /nodes/x.json
+Updated /org.json
+Created /policies/blah-1.0.0.json
+Updated /policy_groups/x.json
+Updated /roles/x.json
+EOM
+            knife('diff --name-status --diff-filter=AMT /').should_succeed ''
+          end
+        end
       end
 
       when_the_repository 'has an org.json that does not change full_name' do