<commit_before>package com.devicehive.auth.rest;

import com.google.common.net.HttpHeaders;

import com.devicehive.configuration.Constants;
import com.devicehive.configuration.Messages;

import java.io.IOException;
import java.util.Collection;
import java.util.HashSet;
import java.util.Set;

import javax.annotation.Priority;
import javax.ws.rs.Priorities;
import javax.ws.rs.container.ContainerRequestContext;
import javax.ws.rs.container.ContainerRequestFilter;
import javax.ws.rs.core.Response;

@Priority(Priorities.AUTHORIZATION)
public class RolesAllowedFilter implements ContainerRequestFilter {

    private final Set<String> allowedRoles;

    public RolesAllowedFilter(Collection<String> allowedRoles) {
        this.allowedRoles = new HashSet<>(allowedRoles);
    }

    @Override
    public void filter(ContainerRequestContext requestContext) throws IOException {
        for (String role : allowedRoles) {
            if (requestContext.getSecurityContext().isUserInRole(role)) {
                return;
            }
        }

        boolean
            isOauth =
            Constants.OAUTH_AUTH_SCEME.equals(requestContext.getSecurityContext().getAuthenticationScheme());

        requestContext.abortWith(Response
                                     .status(Response.Status.UNAUTHORIZED)
                                     .header(HttpHeaders.WWW_AUTHENTICATE,
                                             isOauth ? Messages.OAUTH_REALM : Messages.BASIC_REALM)
                                     .entity(Messages.NOT_AUTHORIZED)
                                     .build());
    }
}<commit_msg>403 responses are now used instead of 401<commit_after>package com.devicehive.auth.rest;

import com.google.common.net.HttpHeaders;

import com.devicehive.configuration.Constants;
import com.devicehive.configuration.Messages;

import java.io.IOException;
import java.util.Collection;
import java.util.HashSet;
import java.util.Set;

import javax.annotation.Priority;
import javax.ws.rs.ForbiddenException;
import javax.ws.rs.Priorities;
import javax.ws.rs.container.ContainerRequestContext;
import javax.ws.rs.container.ContainerRequestFilter;
import javax.ws.rs.core.Response;

@Priority(Priorities.AUTHORIZATION)
public class RolesAllowedFilter implements ContainerRequestFilter {

    private final Set<String> allowedRoles;

    public RolesAllowedFilter(Collection<String> allowedRoles) {
        this.allowedRoles = new HashSet<>(allowedRoles);
    }

    @Override
    public void filter(ContainerRequestContext requestContext) throws IOException {
        for (String role : allowedRoles) {
            if (requestContext.getSecurityContext().isUserInRole(role)) {
                return;
            }
        }
        throw new ForbiddenException();
    }
}
{'fraction_non_alphanumeric': 0.0853352456077447, 'fraction_numerical': 0.002151308712800287, 'mean_word_length': 2.997134670487106, 'pattern_counts': {'":': 0, '<': 9, '<?xml version=': 0, '>': 9, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 6, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3110459', 'n_tokens_mistral': 756, 'n_tokens_neox': 739, 'n_words': 135}