UserService extends BasicService { @POST @Path("/users/{userId}/impersonate") public Response impersonateUser(@PathParam("userId") long userId) { if (!isAdmin()) { throwUnauthorized(); } User existingUser = getExistingUser(userId); userUtil.impersonateUser(request, existingUser.getUserId()); return RESPONSE_OK; }  @GET @Path("/user") @Produces(MediaType.APPLICATION_JSON) User getCurrentUser(); @GET @Path("/users/{userId}") @Produces(MediaType.APPLICATION_JSON) User getUser(@PathParam("userId") long userId); @DELETE @Path("/users/{userId}") Response deleteUser(@PathParam("userId") long userId); @POST @Path("/users/{userId}/impersonate") Response impersonateUser(@PathParam("userId") long userId); @POST @Path("/stopimpersonation") Response stopImpersonation(); @POST @Path("/logout") Response logoutCurrentUser();  }
@Test(expected = WebApplicationException.class) public void testNonAdminImpersonation() throws Exception { simpleUser = UserUtil.getInstance().getDBUser(simpleUser.getUserId()); simpleUser2 = UserUtil.getInstance().getDBUser(simpleUser2.getUserId()); userService.impersonateUser(simpleUser2.getId()); }