ClientResource extends AbstractResource { @PUT public Response put(@Context HttpServletRequest request, @PathParam("resourceServerId") Long resourceServerId, Client client) { Response validateScopeResponse = validateScope(request, Collections.singletonList(AbstractResource.SCOPE_WRITE)); if (validateScopeResponse != null) { return validateScopeResponse; } ResourceServer resourceServer = getResourceServer(request, resourceServerId); client.setResourceServer(resourceServer); client.setClientId(generateClientId(client)); client.setSecret(client.isAllowedImplicitGrant() ? null : generateSecret()); Client clientSaved; try { clientSaved = clientRepository.save(client); } catch (RuntimeException e) { return buildErrorResponse(e); } if (LOG.isDebugEnabled()) { LOG.debug("Saved client: {}", clientSaved); } final URI uri = UriBuilder.fromPath("{clientId}.json").build(clientSaved.getId()); return Response.created(uri).entity(clientSaved).build(); }  @GET Response getAll(@Context HttpServletRequest request,
                         @PathParam("resourceServerId") Long resourceServerId); @GET @Path("/{clientId}") Response getById(@Context HttpServletRequest request,
                          @PathParam("resourceServerId") Long resourceServerId,
                          @PathParam("clientId") Long id); @PUT Response put(@Context HttpServletRequest request,
                      @PathParam("resourceServerId") Long resourceServerId, Client client); @DELETE @Path("/{clientId}") Response delete(@Context HttpServletRequest request,
                         @PathParam("clientId") Long id,
                         @PathParam("resourceServerId") Long resourceServerId); @POST @Path("/{clientId}") Response post(@Valid Client newOne, @PathParam("clientId") Long id,
                       @Context HttpServletRequest request,
                       @PathParam("resourceServerId") Long resourceServerId
  );  }
@Test public void scopesShouldBeSubsetOfResourceServerScopes() { Client client = new Client(); request.setAttribute(AuthorizationServerFilter.VERIFY_TOKEN_RESPONSE, new VerifyTokenResponse("", new ArrayList<String>(), new AuthenticatedPrincipal("user"), 0L)); client.setScopes(Arrays.asList("Some", "arbitrary", "set")); client.setName("clientname"); ResourceServer resourceServer = new ResourceServer(); resourceServer.setScopes(Arrays.asList("read", "update", "delete")); when(resourceServerRepository.findByIdAndOwner(1L, "user")).thenReturn(resourceServer); final ConstraintViolation<Client> violation = (ConstraintViolation<Client>) mock(ConstraintViolation.class); Set<ConstraintViolation<Client>> violations = Collections.singleton(violation); when(validator.validate(client)).thenReturn(violations); final Response response = clientResource.put(request, 1L, client); assertEquals(400, response.getStatus()); assertEquals("invalid_scope", ((ErrorResponse) response.getEntity()).getError()); }