@Test public void testReadInaccessible() { String inaccessibleId = "inaccessible-id"; EntityBody body = getValidRoleDoc(); body.put("realmId", "BAD-REALM"); Mockito.when(service.get(inaccessibleId)).thenReturn(body); Response res = resource.read(inaccessibleId, uriInfo); Assert.assertEquals(403, res.getStatus()); Assert.assertEquals(CustomRoleResource.ERROR_FORBIDDEN, res.getEntity()); }
@GET @Path("{id}") @RightsAllowed({Right.CRUD_ROLE }) public Response read(@PathParam("id") String id, @Context final UriInfo uriInfo) { EntityBody customRole = service.get(id); String realmId = (String)customRole.get("realmId"); if (!realmHelper.getAssociatedRealmIds().contains(realmId)) { auditSecEvent(uriInfo, "Failed to read custom role with id: " + id + " wrong tenant + realm combination.",realmId); return Response.status(Status.FORBIDDEN).entity(ERROR_FORBIDDEN).build(); } return Response.ok(customRole).build(); }
CustomRoleResource { @GET @Path("{id}") @RightsAllowed({Right.CRUD_ROLE }) public Response read(@PathParam("id") String id, @Context final UriInfo uriInfo) { EntityBody customRole = service.get(id); String realmId = (String)customRole.get("realmId"); if (!realmHelper.getAssociatedRealmIds().contains(realmId)) { auditSecEvent(uriInfo, "Failed to read custom role with id: " + id + " wrong tenant + realm combination.",realmId); return Response.status(Status.FORBIDDEN).entity(ERROR_FORBIDDEN).build(); } return Response.ok(customRole).build(); } }
CustomRoleResource { @GET @Path("{id}") @RightsAllowed({Right.CRUD_ROLE }) public Response read(@PathParam("id") String id, @Context final UriInfo uriInfo) { EntityBody customRole = service.get(id); String realmId = (String)customRole.get("realmId"); if (!realmHelper.getAssociatedRealmIds().contains(realmId)) { auditSecEvent(uriInfo, "Failed to read custom role with id: " + id + " wrong tenant + realm combination.",realmId); return Response.status(Status.FORBIDDEN).entity(ERROR_FORBIDDEN).build(); } return Response.ok(customRole).build(); }  }
CustomRoleResource { @GET @Path("{id}") @RightsAllowed({Right.CRUD_ROLE }) public Response read(@PathParam("id") String id, @Context final UriInfo uriInfo) { EntityBody customRole = service.get(id); String realmId = (String)customRole.get("realmId"); if (!realmHelper.getAssociatedRealmIds().contains(realmId)) { auditSecEvent(uriInfo, "Failed to read custom role with id: " + id + " wrong tenant + realm combination.",realmId); return Response.status(Status.FORBIDDEN).entity(ERROR_FORBIDDEN).build(); } return Response.ok(customRole).build(); }  @PostConstruct void init(); @GET @RightsAllowed({Right.CRUD_ROLE }) Response readAll(@Context final UriInfo uriInfo,
            @DefaultValue("") @QueryParam("realmId") String realmId); @GET @Path("{id}") @RightsAllowed({Right.CRUD_ROLE }) Response read(@PathParam("id") String id, @Context final UriInfo uriInfo); @POST @RightsAllowed({Right.CRUD_ROLE }) Response createCustomRole(EntityBody newCustomRole, @Context final UriInfo uriInfo); @PUT @Path("{id}") @RightsAllowed({Right.CRUD_ROLE }) Response updateCustomRole(@PathParam("id") String id, EntityBody updated, @Context final UriInfo uriInfo); @DELETE @Path("{id}") @RightsAllowed({Right.CRUD_ROLE }) Response deleteCustomRole(@PathParam("id") String id, @Context final UriInfo uriInfo); }
CustomRoleResource { @GET @Path("{id}") @RightsAllowed({Right.CRUD_ROLE }) public Response read(@PathParam("id") String id, @Context final UriInfo uriInfo) { EntityBody customRole = service.get(id); String realmId = (String)customRole.get("realmId"); if (!realmHelper.getAssociatedRealmIds().contains(realmId)) { auditSecEvent(uriInfo, "Failed to read custom role with id: " + id + " wrong tenant + realm combination.",realmId); return Response.status(Status.FORBIDDEN).entity(ERROR_FORBIDDEN).build(); } return Response.ok(customRole).build(); }  @PostConstruct void init(); @GET @RightsAllowed({Right.CRUD_ROLE }) Response readAll(@Context final UriInfo uriInfo,
            @DefaultValue("") @QueryParam("realmId") String realmId); @GET @Path("{id}") @RightsAllowed({Right.CRUD_ROLE }) Response read(@PathParam("id") String id, @Context final UriInfo uriInfo); @POST @RightsAllowed({Right.CRUD_ROLE }) Response createCustomRole(EntityBody newCustomRole, @Context final UriInfo uriInfo); @PUT @Path("{id}") @RightsAllowed({Right.CRUD_ROLE }) Response updateCustomRole(@PathParam("id") String id, EntityBody updated, @Context final UriInfo uriInfo); @DELETE @Path("{id}") @RightsAllowed({Right.CRUD_ROLE }) Response deleteCustomRole(@PathParam("id") String id, @Context final UriInfo uriInfo); static final String RESOURCE_NAME; }