### Question:
MetadataApiService { @PreAuthorize("hasRole('ADMIN') OR @grantPermissionManager.listMetadataPermissions(#entities, 'READ')") public List<MetadataEntry> listMetadataItems(List<EntityVO> entities) { return metadataManager.listMetadataItems(entities); }  @PreAuthorize(AclExpressions.METADATA_OWNER) MetadataEntry updateMetadataItemKey(MetadataVO metadataVO); @PreAuthorize(AclExpressions.METADATA_OWNER) MetadataEntry updateMetadataItemKeys(MetadataVO metadataVO); @PreAuthorize(AclExpressions.METADATA_OWNER) MetadataEntry updateMetadataItem(MetadataVO metadataVO); @PreAuthorize("hasRole('ADMIN') OR @grantPermissionManager.listMetadataPermissions(#entities, 'READ')") List<MetadataEntry> listMetadataItems(List<EntityVO> entities); @PreAuthorize(AclExpressions.METADATA_ENTRY_OWNER) MetadataEntry deleteMetadataItemKey(EntityVO entityVO, String key); @PreAuthorize(AclExpressions.METADATA_ENTRY_OWNER) MetadataEntry deleteMetadataItem(EntityVO entityVO); @PreAuthorize(AclExpressions.METADATA_OWNER) MetadataEntry deleteMetadataItemKeys(MetadataVO metadataVO); @PostAuthorize("hasRole('ADMIN') OR @grantPermissionManager.metadataPermission(returnObject, 'READ')") MetadataEntry findMetadataEntityIdByName(String entityName, AclClass entityClass); @PreAuthorize(AclExpressions.METADATA_ENTRY_OWNER) MetadataEntry uploadMetadataFromFile(final EntityVO entityVO,
                                                final MultipartFile file,
                                                final boolean mergeWithExistingMetadata); @PostFilter("hasRole('ADMIN') OR " + "@grantPermissionManager.metadataPermission(" + "filterObject.entity.entityId, filterObject.entity.entityClass, 'READ')") List<MetadataEntryWithIssuesCount> loadEntitiesMetadataFromFolder(Long parentFolderId); @PostFilter("hasRole('ADMIN') OR " + "@grantPermissionManager.metadataPermission(" + "filterObject.entityId, filterObject.entityClass, 'READ')") List<EntityVO> searchMetadataByClassAndKeyValue(final AclClass entityClass, final String key,
                                                           final String value); @PreAuthorize(AclExpressions.ADMIN_OR_GENERAL_USER) Set<String> getMetadataKeys(final AclClass entityClass);  }### Answer:
@Test @Transactional(propagation = Propagation.REQUIRES_NEW) @WithMockUser(username = TEST_USER1, roles = ADMIN_ROLE) public void adminShouldLoadMetadataForPipelineUser() { final List<MetadataEntry> metadataEntries = metadataApiService .listMetadataItems(Collections.singletonList(pipelineUserEntity)); assertEquals(Collections.singletonList(pipelineUserMetadata), metadataEntries); }
@Test @Transactional(propagation = Propagation.REQUIRES_NEW) @WithMockUser(username = TEST_USER1) public void ownerShouldLoadMetadataForPipelineUser() { final List<MetadataEntry> metadataEntries = metadataApiService .listMetadataItems(Collections.singletonList(pipelineUserEntity)); assertEquals(Collections.singletonList(pipelineUserMetadata), metadataEntries); }
@Test(expected = AccessDeniedException.class) @Transactional(propagation = Propagation.REQUIRES_NEW) @WithMockUser(username = TEST_USER2) public void nonAdminAndNotOwnerShouldNotLoadMetadataForPipelineUser() { metadataApiService.listMetadataItems(Collections.singletonList(pipelineUserEntity)); }
@Test @Transactional(propagation = Propagation.REQUIRES_NEW) @WithMockUser(username = TEST_USER1, roles = ADMIN_ROLE) public void adminShouldLoadMetadataForRole() { final List<MetadataEntry> metadataEntries = metadataApiService .listMetadataItems(Collections.singletonList(roleEntity)); assertEquals(Collections.singletonList(roleMetadata), metadataEntries); }
@Test(expected = AccessDeniedException.class) @Transactional(propagation = Propagation.REQUIRES_NEW) @WithMockUser(username = TEST_USER1) public void nonAdminShouldNotLoadMetadataForRole() { metadataApiService.listMetadataItems(Collections.singletonList(roleEntity)); }