### Question:
AdvertisementService { @PreAuthorize("hasPermission(#id, 'com.sap.cp.appsec.domain.Advertisement', 'read')") public Advertisement findById(Long id) throws NotFoundException { Optional<Advertisement> advertisement = repository.findById(id); if (!advertisement.isPresent()) { NotFoundException notFoundException = new NotFoundException("no Advertisement with id " + id); logger.warn("request failed", notFoundException); throw notFoundException; } return advertisement.get(); } @Autowired  AdvertisementService(AdvertisementAclRepository repository,
                                AclSupport aclService); @Transactional Advertisement create(Advertisement newAds); @PreAuthorize("hasPermission(#id, 'com.sap.cp.appsec.domain.Advertisement', 'read')") Advertisement findById(Long id); Page<Advertisement> findAll(int pageNumber, int pageSize, Sort.Direction sortDirection, String[] properties); Page<Advertisement> findAllPublished(int pageNumber, int pageSize, Sort.Direction sortDirection, String[] properties); @PreAuthorize("hasPermission(#updatedAds, 'write')") Advertisement update(Advertisement updatedAds); @PreAuthorize("hasPermission(#id, 'com.sap.cp.appsec.domain.Advertisement', 'administration')") @Transactional void grantPermissions(Long id, String principal, Permission[] permissions); @PreAuthorize("hasPermission(#id, 'com.sap.cp.appsec.domain.Advertisement', 'administration')") @Transactional void removePermissions(Long id, String principal, Permission[] permissions); @PreAuthorize("hasPermission(#id, 'com.sap.cp.appsec.domain.Advertisement', 'administration')") @Transactional void grantPermissionsToUserGroup(Long id, String groupName, Permission[] permissions); @PreAuthorize("hasPermission(#id, 'com.sap.cp.appsec.domain.Advertisement', 'administration')" + " and hasPermission(#boardName, 'bulletinboard', 'read')") @Transactional void publishToBulletinboard(@PathVariable("id") @Min(0) Long id, String boardName); @PreAuthorize("hasPermission(#id, 'com.sap.cp.appsec.domain.Advertisement', 'administration')") @Transactional void deleteById(Long id);  }### Answer:
@Test @WithMockUser(username = OWNER) public void owner_canRead() { Advertisement adsRead = service.findById(advertisementId); assertThat(adsRead, is(notNullValue())); }
@Test @WithMockUser(username = READER) public void reader_canRead() { boolean readerHasReadPermission = hasUserPermission(READER, new Permission[]{BasePermission.READ}); assertThat(readerHasReadPermission, is(true)); Advertisement adsRead = service.findById(advertisementId); assertThat(adsRead, is(notNullValue())); }