StreamingAccessAdvice implements MethodBeforeAdvice, Ordered { @Override public void before(Method method, Object[] args, Object target) throws Throwable { String taskName = (String) args[0]; if (!taskName.matches(StorageTaskConstants.GET_URL_TASK_NAME) && !taskName.matches(StorageTaskConstants.GET_SIGNED_URL_TASK_NAME)) { return; } TaskProvider taskProvider = (TaskProvider) target; String storeId = taskProvider.getStoreId(); Authentication auth = SecurityContextHolder.getContext().getAuthentication(); if (this.authHelper.hasAdmin(auth)) { return; } String taskParams = (String) args[1]; GetUrlTaskParameters params = GetUrlTaskParameters.deserialize(taskParams); String spaceId = params.getSpaceId(); Map<String, AclType> acls = this.authHelper.getSpaceACLs(storeId, spaceId); if (!this.authHelper.hasReadAccess(auth.getName(), acls) && !this.authHelper.groupsHaveReadAccess(auth, acls)) { log.error(auth.getName() + " is not authorized to view content in " + spaceId); throw new UnauthorizedException("You are not authorized to access space " + spaceId + "."); } else { log.debug("successfully authorized {} to view {}", auth.getName(), spaceId); } } StreamingAccessAdvice(AuthorizationHelper authHelper); void setOrder(int order); @Override int getOrder(); @Override void before(Method method, Object[] args, Object target);  }
@Test public void testSuccessNoMethodMatch() throws Throwable { replayAll(); advice = new StreamingAccessAdvice(helper); advice.before(null, getArgs("no-match-method"), taskProvider); }
@Test public void testSuccessAdmin() throws Throwable { expect(helper.hasAdmin(isA(Authentication.class))).andReturn(true); setupTaskProvider(); replayAll(); advice = new StreamingAccessAdvice(helper); advice.before(null, getArgs(StorageTaskConstants.GET_URL_TASK_NAME), taskProvider); }