### Question:
X509SvidValidator { public static void verifySpiffeId(@NonNull final X509Certificate x509Certificate, @NonNull final Supplier<Set<SpiffeId>> acceptedSpiffeIdsSupplier) throws CertificateException { val spiffeIdSet = acceptedSpiffeIdsSupplier.get(); if (spiffeIdSet.isEmpty()) { String error = "The supplier of accepted SPIFFE IDs supplied an empty set"; log.warning(error); throw new CertificateException(error); } val spiffeId = CertificateUtils.getSpiffeId(x509Certificate); if (!spiffeIdSet.contains(spiffeId)) { val error = String.format("SPIFFE ID %s in X.509 certificate is not accepted", spiffeId); log.warning(String.format("Client SPIFFE ID validation failed: %s", error)); throw new CertificateException(String.format(error, spiffeId)); } } private  X509SvidValidator(); static void verifyChain(
            @NonNull final List<X509Certificate> chain,
            @NonNull final BundleSource<X509Bundle> x509BundleSource); static void verifySpiffeId(@NonNull final X509Certificate x509Certificate,
                                      @NonNull final Supplier<Set<SpiffeId>> acceptedSpiffeIdsSupplier);  }### Answer:
@Test void verifySpiffeId_givenASpiffeIdInTheListOfAcceptedIds_doesntThrowException() throws IOException, CertificateException, URISyntaxException { val spiffeId1 = SpiffeId.parse("spiffe: val spiffeId2 = SpiffeId.parse("spiffe: val spiffeIdSet = Sets.newHashSet(spiffeId1, spiffeId2); X509SvidValidator.verifySpiffeId(leaf.getCertificate(), () -> spiffeIdSet); }
@Test void verifySpiffeId_givenASpiffeIdNotInTheListOfAcceptedIds_throwsCertificateException() throws IOException, CertificateException, URISyntaxException { val spiffeId1 = SpiffeId.parse("spiffe: val spiffeId2 = SpiffeId.parse("spiffe: val spiffeIdSet = Sets.newHashSet(spiffeId1, spiffeId2); try { X509SvidValidator.verifySpiffeId(leaf.getCertificate(), () -> spiffeIdSet); fail("Should have thrown CertificateException"); } catch (CertificateException e) { assertEquals("SPIFFE ID spiffe: } }
@Test void verifySpiffeId_givenAnEmptySupplier_throwsCertificateException() { try { X509SvidValidator.verifySpiffeId(leaf.getCertificate(), Collections::emptySet); fail("Should have thrown CertificateException"); } catch (CertificateException e) { assertEquals("The supplier of accepted SPIFFE IDs supplied an empty set", e.getMessage()); } }
@Test void checkSpiffeId_nullX509Certificate_throwsNullPointerException() throws CertificateException { try { X509SvidValidator.verifySpiffeId(null, Collections::emptySet); fail("should have thrown an exception"); } catch (NullPointerException e) { assertEquals("x509Certificate is marked non-null but is null", e.getMessage()); } }
@Test void checkSpiffeId_nullAcceptedSpiffeIdsSuppplier_throwsNullPointerException() throws CertificateException, URISyntaxException, IOException { try { X509SvidValidator.verifySpiffeId(leaf.getCertificate(), null); fail("should have thrown an exception"); } catch (NullPointerException e) { assertEquals("acceptedSpiffeIdsSupplier is marked non-null but is null", e.getMessage()); } }