ShiroAuthorizingInterceptor implements MethodInterceptor { @Override public Object invoke(MethodInvocation invocation) throws Throwable { checkState(initialized); Method method = invocation.getMethod(); checkArgument(Response.class.isAssignableFrom(method.getReturnType())); Subject subject = subjectProvider.get(); Permission checkedPermission = Permissions.createUnscopedPermission(domain, method.getName()); if (subject.isPermitted(checkedPermission)) { return invocation.proceed(); } else { shiroAdminAuthorizationFailures.incrementAndGet(); String responseMessage = "Subject " + subject.getPrincipal() + " lacks permission " + checkedPermission; LOG.warn(responseMessage); return Responses.addMessage(Responses.empty(), ResponseCode.AUTH_FAILED, responseMessage); } } ShiroAuthorizingInterceptor(Domain domain); @Override Object invoke(MethodInvocation invocation);  }
@Test public void testAuthorized() throws Throwable { Response response = Responses.ok(); expect(methodInvocation.getMethod()).andReturn(interceptedMethod); expectSubjectPermitted().andReturn(true); expect(methodInvocation.proceed()).andReturn(response); replayAndInitialize(); assertSame(response, interceptor.invoke(methodInvocation)); }
@Test public void testNotAuthorized() throws Throwable { expect(methodInvocation.getMethod()).andReturn(interceptedMethod); expectSubjectPermitted().andReturn(false); expect(subject.getPrincipal()).andReturn("ksweeney"); replayAndInitialize(); assertEquals( ResponseCode.AUTH_FAILED, ((Response) interceptor.invoke(methodInvocation)).getResponseCode()); }