FactoryPermissionsFilter extends CheMethodInvokerFilter { @Override protected void filter(GenericResourceMethod genericResourceMethod, Object[] arguments) throws ApiException { final String methodName = genericResourceMethod.getMethod().getName(); final Subject currentSubject = EnvironmentContext.getCurrent().getSubject(); switch (methodName) { case "getFactoryJson": { String workspaceId = ((String) arguments[0]); currentSubject.checkPermission( WorkspaceDomain.DOMAIN_ID, workspaceId, WorkspaceDomain.READ); return; } case "removeFactory": checkSubjectIsCreator((String) arguments[0], currentSubject, "remove"); return; case "updateFactory": checkSubjectIsCreator((String) arguments[0], currentSubject, "update"); return; case "getFactory": case "saveFactory": case "getFactoryByAttribute": case "resolveFactory": return; default: throw new ForbiddenException("The user does not have permission to perform this operation"); } } @Inject  FactoryPermissionsFilter(FactoryManager factoryManager);   }
@Test(dataProvider = "publicMethods") public void shouldDoNothingWhenPublicMethodMethodIsCalled(String name, Class[] parameterTypes) throws Exception { GenericResourceMethod genericResourceMethod = mock(GenericResourceMethod.class); when(genericResourceMethod.getMethod()) .thenReturn(FactoryService.class.getMethod(name, parameterTypes)); permissionsFilter.filter(genericResourceMethod, new Object[0]); }
@Test( expectedExceptions = ForbiddenException.class, expectedExceptionsMessageRegExp = "The user does not have permission to perform this operation") public void shouldThrowForbiddenExceptionWhenUnlistedMethodIsCalled() throws Exception { GenericResourceMethod genericResourceMethod = mock(GenericResourceMethod.class); when(genericResourceMethod.getMethod()) .thenReturn(FactoryService.class.getMethod("getServiceDescriptor")); permissionsFilter.filter(genericResourceMethod, new Object[0]); }