private void verifyPermissionToGrantRoles ( Subject subject , Iterable < RoleIdentifier > roleIds ) { Set < RoleIdentifier > unauthorizedIds = Sets . newTreeSet ( ) ; boolean anyAuthorized = false ; for ( RoleIdentifier roleId : roleIds ) { // Verify the caller has permission to grant this role if ( subject . hasPermission ( Permissions . grantRole ( roleId ) ) ) { anyAuthorized = true ; } else { unauthorizedIds . add ( roleId ) ; } } if ( ! unauthorizedIds . isEmpty ( ) ) { // If the caller was not authorized to assign any of the provided roles raise a generic exception, otherwise // the exception provides insight as to which roles were unauthorized. This provides some helpful feedback // where appropriate without exposing potentially exploitable information about whether the subject's API key // is valid. if ( ! anyAuthorized ) { throw new UnauthorizedException ( ) ; } else { throw new UnauthorizedException ( "Not authorized for roles: " + Joiner . on ( ", " ) . join ( unauthorizedIds ) ) ; } } }
Verifies whether the user has permission to grant all of the provided roles . If not it throws an UnauthorizedException .