### Question:
AdvertisementService { @PreAuthorize("hasPermission(#id, 'com.sap.cp.appsec.domain.Advertisement', 'administration')") @Transactional public void grantPermissions(Long id, String principal, Permission[] permissions) { aclService.grantPermissionsToUser( Advertisement.class.getName(), id, getUniqueUserName(principal), permissions); } @Autowired  AdvertisementService(AdvertisementAclRepository repository,
                                AclSupport aclService); @Transactional Advertisement create(Advertisement newAds); @PreAuthorize("hasPermission(#id, 'com.sap.cp.appsec.domain.Advertisement', 'read')") Advertisement findById(Long id); Page<Advertisement> findAll(int pageNumber, int pageSize, Sort.Direction sortDirection, String[] properties); Page<Advertisement> findAllPublished(int pageNumber, int pageSize, Sort.Direction sortDirection, String[] properties); @PreAuthorize("hasPermission(#updatedAds, 'write')") Advertisement update(Advertisement updatedAds); @PreAuthorize("hasPermission(#id, 'com.sap.cp.appsec.domain.Advertisement', 'administration')") @Transactional void grantPermissions(Long id, String principal, Permission[] permissions); @PreAuthorize("hasPermission(#id, 'com.sap.cp.appsec.domain.Advertisement', 'administration')") @Transactional void removePermissions(Long id, String principal, Permission[] permissions); @PreAuthorize("hasPermission(#id, 'com.sap.cp.appsec.domain.Advertisement', 'administration')") @Transactional void grantPermissionsToUserGroup(Long id, String groupName, Permission[] permissions); @PreAuthorize("hasPermission(#id, 'com.sap.cp.appsec.domain.Advertisement', 'administration')" + " and hasPermission(#boardName, 'bulletinboard', 'read')") @Transactional void publishToBulletinboard(@PathVariable("id") @Min(0) Long id, String boardName); @PreAuthorize("hasPermission(#id, 'com.sap.cp.appsec.domain.Advertisement', 'administration')") @Transactional void deleteById(Long id);  }### Answer:
@Test @WithMockUser(username = OWNER) public void owner_canGrantAdminPermissionsToOtherUser() { service.grantPermissions(advertisementId, OTHERUSER, new Permission[]{BasePermission.ADMINISTRATION}); boolean otherUserIsAdmin = hasUserPermission(OTHERUSER, new Permission[]{BasePermission.ADMINISTRATION}); assertThat(otherUserIsAdmin, is(true)); }
@Test(expected = AccessDeniedException.class) @WithMockUser(username = READER) public void reader_cannotGrantPermissions() { service.grantPermissions(advertisementId, OTHERUSER, new Permission[]{BasePermission.READ}); }
@Test @WithMockUser(username = ADMIN) public void admin_canGrantReadWritePermissions() { service.grantPermissions(advertisementId, OTHERUSER, new Permission[]{BasePermission.READ, BasePermission.WRITE}); boolean otherUserCanReadAndWrite = hasUserPermission(OTHERUSER, new Permission[]{BasePermission.READ, BasePermission.WRITE}); assertThat(otherUserCanReadAndWrite, is(true)); }
@Test(expected = AccessDeniedException.class) @WithMockUser(username = WRITER) public void writer_cannotGrantAdminPermissions() { service.grantPermissions(advertisementId, OTHERUSER, new Permission[]{BasePermission.ADMINISTRATION}); }