### Question:
AdminDelegationResource { @GET @RightsAllowed({Right.EDORG_DELEGATE, Right.EDORG_APP_AUTHZ }) public Response getDelegations() { SecurityUtil.ensureAuthenticated(); if (SecurityUtil.hasRight(Right.EDORG_DELEGATE)) { String edOrg = SecurityUtil.getEdOrg(); if (edOrg == null) { throw new APIAccessDeniedException("Can not grant access because no edOrg exists on principal."); } List<Map<String, Object>> results = new ArrayList<Map<String, Object>>(); NeutralQuery query = new NeutralQuery(); Set<String> delegatedEdorgs = new HashSet<String>(); delegatedEdorgs.addAll(util.getSecurityEventDelegateEdOrgs()); query.addCriteria(new NeutralCriteria(LEA_ID, NeutralCriteria.CRITERIA_IN, delegatedEdorgs)); for (Entity entity : repo.findAll(RESOURCE_NAME, query)) { entity.getBody().put("id", entity.getEntityId()); results.add(entity.getBody()); } return Response.ok(results).build(); } else if (SecurityUtil.hasRight(Right.EDORG_APP_AUTHZ)) { EntityBody entity = getEntity(); if (entity == null) { return Response.status(Status.NOT_FOUND).build(); } return Response.status(Status.OK).entity(Arrays.asList(entity)).build(); } return SecurityUtil.forbiddenResponse(); }  @PostConstruct void init(); @GET @RightsAllowed({Right.EDORG_DELEGATE, Right.EDORG_APP_AUTHZ }) Response getDelegations(); @PUT @Path("myEdOrg") @RightsAllowed({Right.EDORG_APP_AUTHZ }) Response setLocalDelegation(EntityBody body, @Context final UriInfo uriInfo); @POST @RightsAllowed({Right.EDORG_APP_AUTHZ }) Response create(EntityBody body, @Context final UriInfo uriInfo); @GET @Path("myEdOrg") @RightsAllowed({Right.EDORG_DELEGATE, Right.EDORG_APP_AUTHZ }) Response getSingleDelegation(); static final String RESOURCE_NAME; static final String LEA_ID; }### Answer:
@Test(expected = APIAccessDeniedException.class) public void testGetDelegationsNoEdOrg() throws Exception { securityContextInjector.setLeaAdminContext(); resource.getDelegations(); }
@Test public void testGetDelegationsBadRole() throws Exception { securityContextInjector.setEducatorContext(); Assert.assertEquals(Response.Status.FORBIDDEN.getStatusCode(), resource.getDelegations().getStatus()); }