### Question:
DefaultRolesToRightsResolver implements RolesToRightsResolver { @Override public Set<Role> mapRoles(String tenantId, String realmId, List<String> roleNames, boolean isAdminRealm) { Set<Role> roles = new HashSet<Role>(); Entity realm = findRealm(realmId); if (isAdminRealm) { roles.addAll(roleRightAccess.findAdminRoles(roleNames)); LOG.debug("Mapped admin roles {} to {}.", roleNames, roles); } else if (isDeveloperRealm(realm)) { roles.addAll(roleRightAccess.findAdminRoles(roleNames)); boolean canLoginAsDeveloper = false; for (Role role : roles) { if (role.hasRight(Right.PRODUCTION_LOGIN)) { canLoginAsDeveloper = true; break; } } if (canLoginAsDeveloper) { roles = new HashSet<Role>(); roles.addAll(roleRightAccess.findAdminRoles(Arrays.asList(SecureRoleRightAccessImpl.APP_DEVELOPER))); LOG.debug("With PRODUCTION_LOGIN right, converted {} to {}.", roleNames, roles); } } else { roles.addAll(roleRightAccess.findRoles(tenantId, realmId, roleNames)); LOG.debug("Mapped user roles {} to {}.", roleNames, roles); } return roles; }  @Override Set<GrantedAuthority> resolveRolesIntersect(String tenantId, String realmId, List<String> roleNames, boolean isAdminRealm, boolean getSelfRights); @Override Set<GrantedAuthority> resolveRolesUnion(String tenantId, String realmId, List<String> roleNames, boolean isAdminRealm, boolean getSelfRights); @Override Set<Role> mapRoles(String tenantId, String realmId,
            List<String> roleNames, boolean isAdminRealm);  }### Answer:
@Test public void sandboxAdminBecomeDeveloperInDevRealm() { Set<Role> roles = resolver.mapRoles(null, DEVELOPER_REALM_ID, sandboxRole, false); assertTrue("sandbox admin is not mapped to developer in developer realm", roles.containsAll(defaultRoles.findAdminRoles(appAndProdLoginUser))); assertTrue("sandbox admin is not only mapped to developer in developer realm", defaultRoles.findAdminRoles(appAndProdLoginUser).containsAll(roles)); }
@Test public void sandboxAdminstaysSandboxAdminInAdminRealm() { Set<Role> roles = resolver.mapRoles(null, ADMIN_REALM_ID, sandboxRole, true); assertTrue("sandbox admin is changed in admin realm", roles.containsAll(defaultRoles.findAdminRoles(Arrays.asList(SecureRoleRightAccessImpl.SANDBOX_ADMINISTRATOR)))); assertTrue("sandbox admin is only mapped to sandbox admin in admin realm", defaultRoles.findAdminRoles(Arrays.asList(SecureRoleRightAccessImpl.SANDBOX_ADMINISTRATOR)).containsAll(roles)); }
@Test public void roleWithoutProdLoginIsChangedToEmptyGroupInDevRealm() { Set<Role> roles = resolver.mapRoles(null, DEVELOPER_REALM_ID, otherRole, false); assertTrue("other admin is not mapped to developer in developer realm", roles.isEmpty()); }