### Question:
UmsAccountAuthorizationService { public void checkCallerIsSelfOrHasRight(String actorCrnStr, String targetUserCrnStr, AuthorizationResourceAction action) { Crn actorCrn = Crn.safeFromString(actorCrnStr); Crn targetUserCrn = Crn.safeFromString(targetUserCrnStr); if (actorCrn.equals(targetUserCrn)) { return; } if (!actorCrn.getAccountId().equals(targetUserCrn.getAccountId())) { String unauthorizedMessage = "Unauthorized to run this operation in a different account"; LOGGER.error(unauthorizedMessage); throw new AccessDeniedException(unauthorizedMessage); } if (!umsClient.checkRight(ThreadBasedUserCrnProvider.INTERNAL_ACTOR_CRN, actorCrn.toString(), umsRightProvider.getRight(action), getRequestId())) { String unauthorizedMessage = String.format("You have no right to perform %s on user %s.", umsRightProvider.getRight(action), targetUserCrnStr); LOGGER.error(unauthorizedMessage); throw new AccessDeniedException(unauthorizedMessage); } }  void checkRightOfUser(String userCrn, AuthorizationResourceAction action); Boolean hasRightOfUser(String userCrn, String action); void checkCallerIsSelfOrHasRight(String actorCrnStr, String targetUserCrnStr, AuthorizationResourceAction action);  }### Answer:
@Test public void testCheckCallerIsSelfOrHasRightSameActor() { ThreadBasedUserCrnProvider.doAs(USER_CRN, () -> underTest.checkCallerIsSelfOrHasRight(USER_CRN, USER_CRN, AuthorizationResourceAction.GET_KEYTAB)); }
@Test public void testCheckCallerIsSelfOrHasRightDifferent() { String userInDifferentAccount = "crn:cdp:iam:us-west-1:" + UUID.randomUUID() + ":user:" + UUID.randomUUID(); thrown.expect(AccessDeniedException.class); thrown.expectMessage("Unauthorized to run this operation in a different account"); ThreadBasedUserCrnProvider.doAs(USER_CRN, () -> underTest. checkCallerIsSelfOrHasRight(USER_CRN, userInDifferentAccount, AuthorizationResourceAction.DATALAKE_READ)); }
@Test public void testActorAndTargetDifferentAndMissingRight() { String user2 = "crn:cdp:iam:us-west-1:1234:user:someOtherUserId"; when(umsClient.checkRight(any(), any(), any(), any())).thenReturn(false); thrown.expect(AccessDeniedException.class); thrown.expectMessage(String.format("You have no right to perform datalake/read on user %s", user2)); ThreadBasedUserCrnProvider.doAs(USER_CRN, () -> underTest. checkCallerIsSelfOrHasRight(USER_CRN, user2, AuthorizationResourceAction.DATALAKE_READ)); }
@Test public void testActorAndTargetDifferentHasRequiredRight() { String user2 = "crn:cdp:iam:us-west-1:1234:user:someOtherUserId"; when(umsClient.checkRight(any(), any(), any(), any())).thenReturn(true); ThreadBasedUserCrnProvider.doAs(USER_CRN, () -> underTest. checkCallerIsSelfOrHasRight(USER_CRN, user2, AuthorizationResourceAction.DATALAKE_READ)); }