MachineTokenAuthorizedSubject extends AuthorizedSubject { @Override public boolean hasPermission(String domain, String instance, String action) { if (domain.equals(WorkspaceDomain.DOMAIN_ID) && !instance.equals(claimsWorkspaceId)) { return false; } return super.hasPermission(domain, instance, action); } MachineTokenAuthorizedSubject(
      Subject baseSubject, PermissionChecker permissionChecker, String claimsWorkspaceId); @Override boolean hasPermission(String domain, String instance, String action);  }
@Test public void shouldRejectPermissionsFromAnotherWorkspace() { assertFalse( subject.hasPermission(WorkspaceDomain.DOMAIN_ID, "another_ws", WorkspaceDomain.READ)); }
@Test public void shouldRequestPermissionsFromBaseSubjectForNonWorkspaceDomains() throws Exception { subject.hasPermission(SystemDomain.DOMAIN_ID, "", SystemDomain.MANAGE_SYSTEM_ACTION); verify(permissionChecker, atLeastOnce()) .hasPermission( eq(USER_ID), eq(SystemDomain.DOMAIN_ID), eq(""), eq(SystemDomain.MANAGE_SYSTEM_ACTION)); }