UserService extends Service { @ApiOperation(value = "Delete user", notes = "Delete a user from the system. Roles allowed: system/admin") @ApiResponses({@ApiResponse(code = 204, message = "Deleted"), @ApiResponse(code = 404, message = "Not Found"), @ApiResponse(code = 409, message = "Impossible to remove user"), @ApiResponse(code = 500, message = "Internal Server Error")}) @DELETE @Path("/{id}") @GenerateLink(rel = LINK_REL_REMOVE_USER_BY_ID) @RolesAllowed("system/admin") public void remove(@ApiParam(value = "User ID") @PathParam("id") String id) throws NotFoundException, ServerException, ConflictException { userDao.remove(id); } @Inject  UserService(UserDao userDao,
                       UserProfileDao profileDao,
                       PreferenceDao preferenceDao,
                       TokenValidator tokenValidator); @ApiOperation(value = "Create a new user", notes = "Create a new user in the system. There are two ways to create a user: through a regular registration workflow " + "and by system/admin. In the former case, auth token is sent to user's mailbox, while system/admin can create a user directly " + "with predefined name and password", response = UserDescriptor.class) @ApiResponses({@ApiResponse(code = 201, message = "Created"), @ApiResponse(code = 401, message = "Missed token parameter"), @ApiResponse(code = 409, message = "Invalid token"), @ApiResponse(code = 403, message = "Invalid or missing request parameters"), @ApiResponse(code = 500, message = "Internal Server Error")}) @POST @Path("/create") @Consumes(APPLICATION_JSON) @Produces(APPLICATION_JSON) @GenerateLink(rel = LINK_REL_CREATE_USER) Response create(@ApiParam(value = "New user") NewUser newUser,
                           @ApiParam(value = "Authentication token") @QueryParam("token") String token,
                           @ApiParam(value = "User type") @QueryParam("temporary") @DefaultValue("false") Boolean isTemporary,
                           @Context SecurityContext context); @ApiOperation(value = "Get current user", notes = "Get user currently logged in the system", response = UserDescriptor.class, position = 2) @ApiResponses({@ApiResponse(code = 200, message = "OK"), @ApiResponse(code = 404, message = "Not Found"), @ApiResponse(code = 500, message = "Internal Server Error")}) @GET @GenerateLink(rel = LINK_REL_GET_CURRENT_USER) @RolesAllowed({"user", "temp_user"}) @Produces(APPLICATION_JSON) UserDescriptor getCurrent(@Context SecurityContext context); @ApiOperation(value = "Update password", notes = "Update current password") @ApiResponses({@ApiResponse(code = 204, message = "OK"), @ApiResponse(code = 404, message = "Not Found"), @ApiResponse(code = 403, message = "Invalid password"), @ApiResponse(code = 500, message = "Internal Server Error")}) @POST @Path("/password") @GenerateLink(rel = LINK_REL_UPDATE_PASSWORD) @RolesAllowed("user") @Consumes(APPLICATION_FORM_URLENCODED) void updatePassword(@ApiParam(value = "New password", required = true)
                               @FormParam("password")
                               String password); @ApiOperation(value = "Get user by ID", notes = "Get user by its ID in the system. Roles allowed: system/admin, system/manager.", response = UserDescriptor.class) @ApiResponses({@ApiResponse(code = 200, message = "OK"), @ApiResponse(code = 404, message = "Not Found"), @ApiResponse(code = 500, message = "Internal Server Error")}) @GET @Path("/{id}") @GenerateLink(rel = LINK_REL_GET_USER_BY_ID) @RolesAllowed({"user", "system/admin", "system/manager"}) @Produces(APPLICATION_JSON) UserDescriptor getById(@ApiParam(value = "User ID") @PathParam("id") String id,
                                  @Context SecurityContext context); @ApiOperation(value = "Get user by email", notes = "Get user by registration email. Roles allowed: system/admin, system/manager.", response = UserDescriptor.class) @ApiResponses({@ApiResponse(code = 200, message = "OK"), @ApiResponse(code = 403, message = "Missed parameter email"), @ApiResponse(code = 404, message = "Not Found"), @ApiResponse(code = 500, message = "Internal Server Error")}) @GET @Path("/find") @GenerateLink(rel = LINK_REL_GET_USER_BY_EMAIL) @RolesAllowed({"user", "system/admin", "system/manager"}) @Produces(APPLICATION_JSON) UserDescriptor getByEmail(@ApiParam(value = "User email", required = true) @QueryParam("email") @Required String email,
                                     @Context SecurityContext context); @ApiOperation(value = "Delete user", notes = "Delete a user from the system. Roles allowed: system/admin") @ApiResponses({@ApiResponse(code = 204, message = "Deleted"), @ApiResponse(code = 404, message = "Not Found"), @ApiResponse(code = 409, message = "Impossible to remove user"), @ApiResponse(code = 500, message = "Internal Server Error")}) @DELETE @Path("/{id}") @GenerateLink(rel = LINK_REL_REMOVE_USER_BY_ID) @RolesAllowed("system/admin") void remove(@ApiParam(value = "User ID")
                       @PathParam("id") String id); @ApiOperation(value = "Check role for the authenticated user", notes = "Check if user has a role in given scope (default is system) and with an optional scope id. Roles allowed: user, system/admin, system/manager.", response = UserInRoleDescriptor.class) @ApiResponses({@ApiResponse(code = 200, message = "OK"), @ApiResponse(code = 403, message = "Unable to check for the given scope"), @ApiResponse(code = 500, message = "Internal Server Error")}) @GET @Path("/inrole") @GenerateLink(rel = LINK_REL_INROLE) @RolesAllowed({"user", "system/admin", "system/manager"}) @Produces(APPLICATION_JSON) @Beta UserInRoleDescriptor inRole(@Required @Description("role inside a scope") @QueryParam("role") String role,
                                       @DefaultValue("system") @Description("scope of the role (like system, workspace)") @QueryParam("scope") String scope,
                                       @DefaultValue("") @Description("id used by the scope, like workspaceId for workspace scope") @QueryParam("scopeId") String scopeId,
                                       @Context SecurityContext context);  }
@Test public void shouldBeAbleToRemoveUser() throws Exception { final User testUser = createUser(); final ContainerResponse response = makeRequest(HttpMethod.DELETE, SERVICE_PATH + "/" + testUser.getId(), null); assertEquals(response.getStatus(), NO_CONTENT.getStatusCode()); verify(userDao).remove(testUser.getId()); }