UserServicePermissionsFilter extends CheMethodInvokerFilter { @Override protected void filter(GenericResourceMethod genericResourceMethod, Object[] arguments) throws ApiException { final String methodName = genericResourceMethod.getMethod().getName(); final Subject subject = EnvironmentContext.getCurrent().getSubject(); switch (methodName) { case "getCurrent": case "updatePassword": case "getById": case "find": case "getSettings": return; case "create": final String token = (String) arguments[1]; if (token != null) { if (!userSelfCreationAllowed && !subject.hasPermission(SystemDomain.DOMAIN_ID, null, MANAGE_USERS_ACTION)) { throw new ForbiddenException( "Currently only admins can create accounts. Please contact our Admin Team for further info."); } return; } subject.checkPermission(SystemDomain.DOMAIN_ID, null, MANAGE_USERS_ACTION); break; case "remove": final String userToRemove = (String) arguments[0]; if (subject.getUserId().equals(userToRemove)) { return; } subject.checkPermission(SystemDomain.DOMAIN_ID, null, MANAGE_USERS_ACTION); break; default: throw new ForbiddenException("User is not authorized to perform this operation"); } } @Inject  UserServicePermissionsFilter(
      @Named(USER_SELF_CREATION_ALLOWED) boolean userSelfCreationAllowed);  static final String MANAGE_USERS_ACTION; }
@Test(dataProvider = "publicMethods") public void shouldNotCheckPermissionsForPublicMethods(String methodName) throws Exception { final Method method = Stream.of(UserService.class.getMethods()) .filter(userServiceMethod -> userServiceMethod.getName().equals(methodName)) .findAny() .orElseGet(null); assertNotNull(method); final GenericResourceMethod mock = mock(GenericResourceMethod.class); when(mock.getMethod()).thenReturn(method); permissionsFilter.filter(mock, new Object[] {}); verifyNoMoreInteractions(subject); }