AdminUserServicePermissionsFilter extends CheMethodInvokerFilter { @Override protected void filter(GenericResourceMethod grm, Object[] arguments) throws ApiException { final String methodName = grm.getMethod().getName(); if ("getAll".equals(methodName) || "find".equals(methodName)) { EnvironmentContext.getCurrent() .getSubject() .checkPermission(SystemDomain.DOMAIN_ID, null, MANAGE_USERS_ACTION); } else { throw new ForbiddenException("User is not authorized to perform this operation"); } }    }
@Test( expectedExceptions = ForbiddenException.class, expectedExceptionsMessageRegExp = "User is not authorized to perform this operation" ) public void shouldThrowForbiddenExceptionWhenRequestedUnknownMethod() throws Exception { final GenericResourceMethod mock = mock(GenericResourceMethod.class); Method getServiceDescriptor = AdminUserService.class.getMethod("getServiceDescriptor"); when(mock.getMethod()).thenReturn(getServiceDescriptor); permissionsFilter.filter(mock, new Object[] {}); }