AccountResource { @PUT @Path("/me") @ApiOperation(value = "Update user's account", response = AccountDTO.class, authorizations = {@Authorization(value = "authorization")}) @ApiResponses(value = { @ApiResponse(code = 200, message = "Successful retrieval of updated AccountDTO"), @ApiResponse(code = 401, message = "Unauthorized"), @ApiResponse(code = 403, message = "Forbidden"), @ApiResponse(code = 500, message = "Internal server error") }) @Produces(MediaType.APPLICATION_JSON) @Consumes(MediaType.APPLICATION_JSON) public Response updateAccount( @ApiParam(hidden = true) @HeaderParam("Authorization") String authorizationString, @ApiParam(required = true, value = "Updated account") AccountDTO accountDTO) throws EntityNotFoundException, NotAllowedException { String password = accountDTO.getPassword(); if (password != null && !password.isEmpty()) { if (accountManager.authenticateAccount(contextManager.getCallerPrincipalLogin(), accountDTO.getPassword()) == null) { throw new NotAllowedException("NotAllowedException68"); } } else { if (authorizationString == null || !authorizationString.startsWith("Bearer ") || !JWTokenFactory.isJWTValidBefore(authConfig.getJWTKey(), 2 * 60, authorizationString.substring("Bearer ".length()))) { return Response.status(Response.Status.FORBIDDEN).build(); } } Account account = accountManager.updateAccount(accountDTO.getName(), accountDTO.getEmail(), accountDTO.getLanguage(), accountDTO.getNewPassword(), accountDTO.getTimeZone()); AccountDTO accountDTOResult = mapper.map(account, AccountDTO.class); accountDTOResult.setAdmin(contextManager.isCallerInRole(UserGroupMapping.ADMIN_ROLE_ID)); return Response.ok().entity(accountDTOResult).build(); } AccountResource(); @PostConstruct void init(); @GET @Path("/me") @ApiOperation(value = "Get authenticated user's account", response = AccountDTO.class, authorizations = {@Authorization(value = "authorization")}) @ApiResponses(value = { @ApiResponse(code = 200, message = "Successful retrieval of AccountDTO"), @ApiResponse(code = 401, message = "Unauthorized"), @ApiResponse(code = 500, message = "Internal server error") }) @Produces(MediaType.APPLICATION_JSON) AccountDTO getAccount(); @PUT @Path("/me") @ApiOperation(value = "Update user's account", response = AccountDTO.class, authorizations = {@Authorization(value = "authorization")}) @ApiResponses(value = { @ApiResponse(code = 200, message = "Successful retrieval of updated AccountDTO"), @ApiResponse(code = 401, message = "Unauthorized"), @ApiResponse(code = 403, message = "Forbidden"), @ApiResponse(code = 500, message = "Internal server error") }) @Produces(MediaType.APPLICATION_JSON) @Consumes(MediaType.APPLICATION_JSON) Response updateAccount(
            @ApiParam(hidden = true) @HeaderParam("Authorization") String authorizationString,
            @ApiParam(required = true, value = "Updated account") AccountDTO accountDTO); @POST @Path("/create") @ApiOperation(value = "Create a new account", response = AccountDTO.class, authorizations = {}) @ApiResponses(value = { @ApiResponse(code = 200, message = "Successful retrieval of created AccountDTO. Response will contain authentication token."), @ApiResponse(code = 202, message = "Account creation successful, but not yet enabled"), @ApiResponse(code = 400, message = "Bad request, read response message for more details"), @ApiResponse(code = 403, message = "Forbidden"), @ApiResponse(code = 500, message = "Internal server error") }) @Produces(MediaType.APPLICATION_JSON) Response createAccount(
            @Context HttpServletRequest request,
            @Context HttpServletResponse response,
            @ApiParam(required = true, value = "Account to create") AccountDTO accountDTO); @GET @Path("/workspaces") @ApiOperation(value = "Get workspaces where authenticated user is active", response = WorkspaceDTO.class, responseContainer = "List", authorizations = {@Authorization(value = "authorization")}) @ApiResponses(value = { @ApiResponse(code = 200, message = "Successful retrieval of Workspaces. It can be an empty list."), @ApiResponse(code = 401, message = "Unauthorized"), @ApiResponse(code = 500, message = "Internal server error") }) @Produces(MediaType.APPLICATION_JSON) Response getWorkspaces(); @PUT @Path("gcm") @ApiOperation(value = "Update GCM account for authenticated user", response = Response.class, authorizations = {@Authorization(value = "authorization")}) @ApiResponses(value = { @ApiResponse(code = 204, message = "Successful retrieval of created GCMAccount."), @ApiResponse(code = 401, message = "Unauthorized"), @ApiResponse(code = 500, message = "Internal server error") }) @Consumes(MediaType.APPLICATION_JSON) Response setGCMAccount(
            @ApiParam(required = true, value = "GCM account to set") GCMAccountDTO data); @DELETE @Path("gcm") @ApiOperation(value = "Update GCM account for authenticated user", response = Response.class, authorizations = {@Authorization(value = "authorization")}) @ApiResponses(value = { @ApiResponse(code = 204, message = "Successful delete of GCMAccount"), @ApiResponse(code = 401, message = "Unauthorized"), @ApiResponse(code = 500, message = "Internal server error") }) Response deleteGCMAccount();  }
@Test public void updateAccountTest() throws ApplicationException, UnsupportedEncodingException { Key key = new HmacKey("verySecretPhrase".getBytes("UTF-8")); UserGroupMapping groupMapping = new UserGroupMapping("FooBar", UserGroupMapping.REGULAR_USER_ROLE_ID); String authToken = JWTokenFactory.createAuthToken(key, groupMapping); Account account = new Account("FooBar"); Mockito.when(authConfig.getJWTKey()).thenReturn(key); Mockito.when(accountManager.updateAccount(Matchers.anyString(), Matchers.anyString(), Matchers.anyString(), Matchers.anyString(), Matchers.anyString())).thenReturn(account); AccountDTO accountDTO = new AccountDTO(); accountDTO.setLogin(account.getLogin()); Response res = accountResource.updateAccount(null, accountDTO); Assert.assertEquals(Response.Status.FORBIDDEN.getStatusCode(), res.getStatus()); accountDTO.setPassword(""); res = accountResource.updateAccount(null, accountDTO); Assert.assertEquals(Response.Status.FORBIDDEN.getStatusCode(), res.getStatus()); res = accountResource.updateAccount("WithoutBearer " + authToken, accountDTO); Assert.assertEquals(Response.Status.FORBIDDEN.getStatusCode(), res.getStatus()); res = accountResource.updateAccount("Bearer " + authToken, accountDTO); Assert.assertEquals(Response.Status.OK.getStatusCode(), res.getStatus()); accountDTO.setPassword("SomePass"); Mockito.when(accountManager.authenticateAccount(Matchers.anyString(), Matchers.anyString())) .thenReturn(null); try { accountResource.updateAccount(null, accountDTO); Assert.fail("Should have thrown"); } catch (NotAllowedException e) { Assert.assertNotNull(e.getMessage()); } Mockito.when(accountManager.authenticateAccount(Matchers.anyString(), Matchers.anyString())) .thenReturn(account); res = accountResource.updateAccount(null, accountDTO); Assert.assertEquals(Response.Status.OK.getStatusCode(), res.getStatus()); Mockito.when(contextManager.isCallerInRole(UserGroupMapping.ADMIN_ROLE_ID)).thenReturn(true); res = accountResource.updateAccount(null, accountDTO); Object entity = res.getEntity(); Assert.assertTrue(((AccountDTO) entity).isAdmin()); }