### Question:
Security implements SecurityContext { void validateSession(final String token) { if (!Objects.equals(token, getSessionToken())) { throw new BadRequestException("Invalid session ID"); } } @Inject @SuppressWarnings("unchecked")  Security(
            final SecurityDao dao,
            @Context final Configuration configuration,
            @HeaderParam(AUTHORIZATION) final String authorization,
            @CookieParam(COOKIE_NAME) final String cookie); Class<SecurityUser> getUserClass(); @Override @SuppressWarnings("unchecked") T getUserPrincipal(); boolean isLoggedIn(); void requireLogin(); String getSessionToken(); LoginResult login(final String email, final String password); NewCookie loginAs(final SecurityUser candidate); NewCookie logout(); ChangePasswordResult changePassword(final String oldPassword, final String newPassword, final String confirmNewPassword); String forgotPassword(final SecurityUser user); ResetPasswordResult resetPassword(final String resetId, final String newPassword, final String confirmNewPassword); @Override boolean isUserInRole(final String role); @Override boolean isSecure(); @Override String getAuthenticationScheme(); static final int MINIMUM_PASSWORD_LENGTH; static final String COOKIE_NAME; }### Answer:
@Test(expected = NotAuthorizedException.class) public void testAnonymousValidateSession() { final SecurityDao dao = mock(SecurityDao.class); final Configuration config = mock(Configuration.class); final Security<User> security = new Security<>(dao, config, null, null); security.validateSession("foo"); }
@Test(expected = BadRequestException.class) public void testInvalidSessionToken() { final User user = new User(); final UserSession session = new UserSession(); session.setUser(user); final String cookie = session.getId().toString(); final SecurityDao dao = mock(SecurityDao.class); when(dao.read(eq(UserSession.class), eq(session.getId()))).thenReturn(session); when(dao.read(eq(User.class), eq(user.getId()))).thenReturn(user); final Configuration config = mock(Configuration.class); when(config.getProperty(eq(MinijaxProperties.SECURITY_USER_CLASS))).thenReturn(User.class); final Security<User> security = new Security<>(dao, config, null, cookie); security.validateSession("not-the-right-token"); }