BaseResourceTypeResourceImpl implements BaseResourceTypeResource<T> { @Override public Response getById(String id, AttributeReferenceListWrapper attributes, AttributeReferenceListWrapper excludedAttributes) { if (servletRequest.getParameter("filter") != null) { return Response.status(Status.FORBIDDEN) .build(); } try { Provider<T> provider = getProviderInternal(); endpointUtil.process(uriInfo); T resource = null; try { resource = provider.get(id); } catch (UnableToRetrieveResourceException e2) { if (e2.getStatus() .getFamily() .equals(Family.SERVER_ERROR)) { return createGenericExceptionResponse(e2, e2.getStatus()); } } catch (Exception e) { log.error("Uncaught provider exception", e); return provider.handleException(e); } if (resource != null) { EntityTag backingETag = null; try { backingETag = etagGenerator.generateEtag(resource); } catch (JsonProcessingException | NoSuchAlgorithmException | UnsupportedEncodingException e1) { return createETagErrorResponse(); } ResponseBuilder evaluatePreconditionsResponse = request.evaluatePreconditions(backingETag); if (evaluatePreconditionsResponse != null) { return Response.status(Status.NOT_MODIFIED) .build(); } } Set<AttributeReference> attributeReferences = Optional.ofNullable(attributes) .map(wrapper -> wrapper.getAttributeReferences()) .orElse(Collections.emptySet()); Set<AttributeReference> excludedAttributeReferences = Optional.ofNullable(excludedAttributes) .map(wrapper -> wrapper.getAttributeReferences()) .orElse(Collections.emptySet()); if (!attributeReferences.isEmpty() && !excludedAttributeReferences.isEmpty()) { return createAmbiguousAttributeParametersResponse(); } if (resource == null) { return createNotFoundResponse(id); } EntityTag etag = null; try { etag = etagGenerator.generateEtag(resource); } catch (JsonProcessingException | NoSuchAlgorithmException | UnsupportedEncodingException e) { return createETagErrorResponse(); } try { resource = processFilterAttributeExtensions(provider, resource, attributeReferences, excludedAttributeReferences); } catch (ClientFilterException e1) { ErrorResponse er = new ErrorResponse(e1.getStatus(), e1.getMessage()); return er.toResponse(); } try { if (!excludedAttributeReferences.isEmpty()) { resource = attributeUtil.setExcludedAttributesForDisplay(resource, excludedAttributeReferences); } else { resource = attributeUtil.setAttributesForDisplay(resource, attributeReferences); } return Response.ok() .entity(resource) .location(buildLocationTag(resource)) .tag(etag) .build(); } catch (IllegalArgumentException | IllegalAccessException | AttributeDoesNotExistException | IOException e) { e.printStackTrace(); return createAttriubteProcessingErrorResponse(e); } } catch (ScimServerException sse) { LOG.error("Error Processing SCIM Request", sse); return sse.getErrorResponse() .toResponse(); } }  abstract Provider<T> getProvider(); @Override Response getById(String id, AttributeReferenceListWrapper attributes, AttributeReferenceListWrapper excludedAttributes); @Override Response query(AttributeReferenceListWrapper attributes, AttributeReferenceListWrapper excludedAttributes, FilterWrapper filter, AttributeReference sortBy, SortOrder sortOrder, Integer startIndex, Integer count); @Override Response create(T resource, AttributeReferenceListWrapper attributes, AttributeReferenceListWrapper excludedAttributes); @Override Response find(SearchRequest request); @Override Response update(T resource, String id, AttributeReferenceListWrapper attributes, AttributeReferenceListWrapper excludedAttributes); @Override Response patch(PatchRequest patchRequest, String id, AttributeReferenceListWrapper attributes, AttributeReferenceListWrapper excludedAttributes); @Override Response delete(String id); static Response createGenericExceptionResponse(Throwable e1, Status status);  }
@SuppressWarnings("unchecked") @Test public void testGetById_ForbiddenIfNoFilter() { @SuppressWarnings("rawtypes") BaseResourceTypeResourceImpl baseResourceImpl = Mockito.mock(BaseResourceTypeResourceImpl.class); HttpServletRequest servletRequest = Mockito.mock(HttpServletRequest.class); baseResourceImpl.servletRequest = servletRequest; when(servletRequest.getParameter("filter")).thenReturn("not null"); when(baseResourceImpl.getById("1", includedAttributeList, excludedAttributeList)).thenCallRealMethod(); Response response = baseResourceImpl.getById("1", includedAttributeList, excludedAttributeList); assertTrue(response != null); assertTrue(response.getStatus() == Status.FORBIDDEN.getStatusCode()); }