MachineTokenAccessFilter extends CheMethodInvokerFilter { @Override protected void filter(GenericResourceMethod genericMethodResource, Object[] arguments) throws ForbiddenException { if (!(EnvironmentContext.getCurrent().getSubject() instanceof MachineTokenAuthorizedSubject)) { return; } if (!allowedMethodsByPath .get(genericMethodResource.getParentResource().getPathValue().getPath()) .contains(genericMethodResource.getMethod().getName())) { throw new ForbiddenException("This operation cannot be performed using machine token."); } } @Inject  MachineTokenAccessFilter(Set<MachineAuthenticatedResource> resources);   }
@Test public void shouldNotLimitAccessIfSubjectIsNotMachineAuthorized() throws Exception { when(environmentContext.getSubject()).thenReturn(authorizedSubject); EnvironmentContext.setCurrent(environmentContext); filter.filter(genericMethodResource, new Object[] {}); verifyZeroInteractions(genericMethodResource); }
@Test(expectedExceptions = ForbiddenException.class) public void shouldLimitAccessIfMethodIsNotAllowed() throws Exception { when(environmentContext.getSubject()).thenReturn(machineTokenAuthorizedSubject); EnvironmentContext.setCurrent(environmentContext); Method method = WorkspaceService.class.getMethod("getServiceDescriptor"); ResourceDescriptor descriptor = mock(ResourceDescriptor.class); PathValue pathValue = mock(PathValue.class); when(genericMethodResource.getMethod()).thenReturn(method); when(descriptor.getPathValue()).thenReturn(pathValue); when(genericMethodResource.getParentResource()).thenReturn(descriptor); when(pathValue.getPath()).thenReturn("/workspace"); filter.filter(genericMethodResource, new Object[] {}); }