OrganizationResourceDistributionServicePermissionsFilter extends CheMethodInvokerFilter { @Override protected void filter(GenericResourceMethod genericMethodResource, Object[] arguments) throws ApiException { final String methodName = genericMethodResource.getMethod().getName(); final Subject currentSubject = EnvironmentContext.getCurrent().getSubject(); String organizationId; switch (methodName) { case GET_RESOURCES_CAP_METHOD: if (superPrivilegesChecker.hasSuperPrivileges()) { return; } case CAP_RESOURCES_METHOD: Organization organization = organizationManager.getById((String) arguments[0]); organizationId = organization.getParent(); if (organizationId == null) { return; } break; case GET_DISTRIBUTED_RESOURCES: organizationId = (String) arguments[0]; organizationManager.getById(organizationId); if (superPrivilegesChecker.hasSuperPrivileges()) { return; } break; default: throw new ForbiddenException("The user does not have permission to perform this operation"); } if (!currentSubject.hasPermission( OrganizationDomain.DOMAIN_ID, organizationId, OrganizationDomain.MANAGE_RESOURCES)) { throw new ForbiddenException( "The user does not have permission to manage resources of organization with id '" + organizationId + "'"); } }    }
@Test public void shouldTestThatAllPublicMethodsAreCoveredByPermissionsFilter() throws Exception { final List<String> collect = Stream.of(OrganizationResourcesDistributionService.class.getDeclaredMethods()) .filter(method -> Modifier.isPublic(method.getModifiers())) .map(Method::getName) .collect(toList()); assertEquals(collect.size(), 3); assertTrue( collect.contains( OrganizationResourceDistributionServicePermissionsFilter.CAP_RESOURCES_METHOD)); assertTrue( collect.contains( OrganizationResourceDistributionServicePermissionsFilter.GET_RESOURCES_CAP_METHOD)); assertTrue( collect.contains( OrganizationResourceDistributionServicePermissionsFilter.GET_DISTRIBUTED_RESOURCES)); }
@Test( expectedExceptions = ForbiddenException.class, expectedExceptionsMessageRegExp = "The user does not have permission to perform this operation") public void shouldThrowForbiddenExceptionWhenRequestedUnknownMethod() throws Exception { final GenericResourceMethod mock = mock(GenericResourceMethod.class); Method unknownMethod = OrganizationResourcesDistributionService.class.getMethod("getServiceDescriptor"); when(mock.getMethod()).thenReturn(unknownMethod); permissionsFilter.filter(mock, new Object[] {}); }