InviteServicePermissionsFilter extends CheMethodInvokerFilter { @Override protected void filter(GenericResourceMethod genericMethodResource, Object[] arguments) throws ApiException { String methodName = genericMethodResource.getMethod().getName(); String domain; String instance; switch (methodName) { case INVITE_METHOD: InviteDto inviteDto = (InviteDto) arguments[0]; domain = inviteDto.getDomainId(); instance = inviteDto.getInstanceId(); break; case GET_INVITES_METHOD: case REMOVE_METHOD: domain = ((String) arguments[0]); instance = ((String) arguments[1]); break; default: throw new ForbiddenException("User is not authorized to perform specified operation"); } if (!EnvironmentContext.getCurrent() .getSubject() .hasPermission(domain, instance, SET_PERMISSIONS)) { throw new ForbiddenException("User is not authorized to invite into specified instance"); } }    }
@Test public void shouldTestThatAllPublicMethodsAreCoveredByPermissionsFilter() throws Exception { final List<String> collect = Stream.of(InviteService.class.getDeclaredMethods()) .filter(method -> Modifier.isPublic(method.getModifiers())) .map(Method::getName) .collect(Collectors.toList()); assertEquals(collect.size(), 3); assertTrue(collect.contains(InviteServicePermissionsFilter.GET_INVITES_METHOD)); assertTrue(collect.contains(InviteServicePermissionsFilter.INVITE_METHOD)); assertTrue(collect.contains(InviteServicePermissionsFilter.REMOVE_METHOD)); }
@Test( expectedExceptions = ForbiddenException.class, expectedExceptionsMessageRegExp = "User is not authorized to perform specified operation" ) public void shouldThrowForbiddenExceptionWhenRequestedUnknownMethod() throws Exception { final GenericResourceMethod mock = mock(GenericResourceMethod.class); Method injectLinks = InviteService.class.getMethod("getServiceDescriptor"); when(mock.getMethod()).thenReturn(injectLinks); permissionsFilter.filter(mock, new Object[] {}); }