### Question:
XacmlService extends ServerResource { @VisibleForTesting boolean checkPermission(String action) throws EntitlementException { try { Request restletRequest = getRequest(); String urlLastSegment = restletRequest.getResourceRef().getLastSegment(); String realm = RestletRealmRouter.getRealmFromRequest(restletRequest); final Map<String, String> context = (Map<String, String>) ServletUtils.getRequest(getRequest()).getAttribute(FORGEROCK_AUTH_CONTEXT); final String tokenId = context.get("tokenId"); final SSOToken token = SSOTokenManager.getInstance().createSSOToken(tokenId); return checkPermission(action, urlLastSegment, realm, token); } catch (SSOException e) { debug.warning("XacmlService permission evaluation failed", e); throw new EntitlementException(INTERNAL_ERROR, e); } } @Inject  XacmlService(XACMLExportImport importExport, PrivilegedAction<SSOToken> adminTokenAction,
            @Named("frRest") Debug debug, RestLog restLog, DelegationEvaluator evaluator,
            JacksonRepresentationFactory jacksonRepresentationFactory); @Post Representation importXACML(Representation entity); @Get Representation exportXACML(); static final String QUERY_PARAM_STRING; }### Answer:
@Test public void testPermissionsCheckSuccess() { RestLog restLog = PowerMockito.mock(RestLog.class); DelegationEvaluator evaluator = mock(DelegationEvaluator.class); XacmlService xacmlService = new XacmlService(importExport, adminTokenAction, this.debug, restLog, evaluator, jacksonRepresentationFactory); SSOToken adminToken = mock(SSOToken.class); DelegationPermission delegationPermission = mock(DelegationPermission.class); String urlLastSegment = "blah"; try { when(evaluator.isAllowed(adminToken, delegationPermission, Collections.EMPTY_MAP)).thenReturn(true); boolean result = xacmlService.checkPermission(delegationPermission, adminToken, urlLastSegment); assertThat(result).isTrue(); verify(restLog).auditAccessGranted(anyString(), anyString(), anyString(), any(SSOToken.class)); } catch (DelegationException de) { fail("Did not expect DelegationException"); } catch (SSOException ssoe) { fail("Did not expect SSOException"); } catch (Exception e) { fail("Did not expect " + e.getClass().getName() + " with message " + e.getMessage()); } }
@Test public void testPermissionsCheckFail() { RestLog restLog = PowerMockito.mock(RestLog.class); DelegationEvaluator evaluator = mock(DelegationEvaluator.class); XacmlService xacmlService = new XacmlService(importExport, adminTokenAction, this.debug, restLog, evaluator, jacksonRepresentationFactory); SSOToken adminToken = mock(SSOToken.class); DelegationPermission delegationPermission = mock(DelegationPermission.class); String urlLastSegment = "blah"; try { when(evaluator.isAllowed(adminToken, delegationPermission, Collections.EMPTY_MAP)).thenReturn(false); boolean result = xacmlService.checkPermission(delegationPermission, adminToken, urlLastSegment); assertThat(result).isFalse(); verify(restLog).auditAccessDenied(anyString(), anyString(), anyString(), any(SSOToken.class)); } catch (DelegationException de) { fail("Did not expect DelegationException"); } catch (SSOException ssoe) { fail("Did not expect SSOException"); } catch (Exception e) { fail("Did not expect " + e.getClass().getName() + " with message " + e.getMessage()); } }