// Bob should be able to read customers but not to update
CredentialsInjector.inject(customerService, "bob", "bobspassword");
try {
List<Customer> customersByName = customerService.getCustomersByName("Fred");
Customer customer = customersByName.get(0);
logger.info("Bob was able to load the customer " + customer.getName());
} catch (Exception e) {
Assert.fail("Bob should be allowed to read customers");
}
CredentialsInjector.inject(customerService, "bob", "bobspassword");
try {
Customer customer = new Customer();
customer.setName("Fred");
customerService.updateCustomer(customer);
Assert.fail("Bob should not be allowed to update a customer");
} catch (Exception e) {
logger.info("Bob's request was correctly denied. " + getMessage(e));
}
// Jim should be able to read and update customers
CredentialsInjector.inject(customerService, "jim", "jimspassword");
try {
List<Customer> customersByName = customerService.getCustomersByName("Fred");
Customer customer = customersByName.get(0);
logger.info("Jim was able to load the customer " + customer.getName());
} catch (Exception e) {
Assert.fail("Jim should be allowed to read customers");
}
CredentialsInjector.inject(customerService, "jim", "jimspassword");
try {
Customer customer = new Customer();
customer.setName("Fred");
customerService.updateCustomer(customer);
logger.info("Jim was able to update the customer");
} catch (Exception e) {
Assert.fail("Jim should be allowed to update a customer");
}