### Question:
TokenOwnerAuthzModule implements CrestAuthorizationModule { @Override public Promise<AuthorizationResult, ResourceException> authorizeAction(Context context, ActionRequest request) { try { if (actionCanBeInvokedBySelf(request.getAction()) && isTokenOwner(context, request)) { return Promises.newResultPromise(AuthorizationResult.accessPermitted()); } } catch (ResourceException e) { return e.asPromise(); } catch (SSOException e) { return new ForbiddenException().asPromise(); } return new ForbiddenException().asPromise(); } TokenOwnerAuthzModule(String tokenId, SSOTokenManager ssoTokenManager, String... allowedActions); @Override String getName(); @Override Promise<AuthorizationResult, ResourceException> authorizeCreate(Context context, CreateRequest createRequest); @Override Promise<AuthorizationResult, ResourceException> authorizeRead(Context context, ReadRequest readRequest); @Override Promise<AuthorizationResult, ResourceException> authorizeUpdate(Context context, UpdateRequest updateRequest); @Override Promise<AuthorizationResult, ResourceException> authorizeDelete(Context context, DeleteRequest deleteRequest); @Override Promise<AuthorizationResult, ResourceException> authorizePatch(Context context, PatchRequest patchRequest); @Override Promise<AuthorizationResult, ResourceException> authorizeAction(Context context, ActionRequest request); @Override Promise<AuthorizationResult, ResourceException> authorizeQuery(Context context, QueryRequest queryRequest); final static String NAME; }### Answer:
@Test public void shouldAllowValidQueryParamToken() throws SSOException, ExecutionException, InterruptedException, BadRequestException { ActionRequest request = Requests.newActionRequest("resource", "deleteProperty"); request.setAdditionalParameter("tokenId", "token"); given(mockService.isSuperUser(eq("universal_id"))).willReturn(false); Promise<AuthorizationResult, ResourceException> result = testModule.authorizeAction(mockContext, request); assertThat(result).succeeded(); assertTrue(result.get().isAuthorized()); }
@Test public void shouldFailDifferentOwnerQueryParamToken() throws SSOException, ExecutionException, InterruptedException, BadRequestException { ActionRequest request = Requests.newActionRequest("resource", "deleteProperty"); request.setAdditionalParameter("tokenId", "token"); given(mockService.isSuperUser(eq("universal_id"))).willReturn(false); given(mockService.isSuperUser(eq("john"))).willReturn(false); Context otherContext = setupUser("john"); setupUser("universal_id"); Promise<AuthorizationResult, ResourceException> result = testModule.authorizeAction(otherContext, request); assertThat(result).failedWithException().isInstanceOf(ForbiddenException.class); }
@Test public void shouldFailInvalidQueryParamToken() throws SSOException, ExecutionException, InterruptedException, BadRequestException { ActionRequest request = Requests.newActionRequest("resource", "deleteProperty"); request.setAdditionalParameter("tokenId", "token"); given(mockService.isSuperUser(eq("universal_id"))).willReturn(false); given(mockTokenManager.createSSOToken(eq("token"))).willThrow(new SSOException("")); Promise<AuthorizationResult, ResourceException> result = testModule.authorizeAction(mockContext, request); assertThat(result).failedWithException().isInstanceOf(ForbiddenException.class); }