@Override
public List<ResourceFilter> create(AbstractMethod am) {

    LinkedList<ResourceFilter> filters = Lists.newLinkedList();

    // Check the resource
    RequiresPermissions permAnnotation = am.getResource().getAnnotation(RequiresPermissions.class);
    if (permAnnotation != null) {
        filters.add(new AuthorizationResourceFilter(ImmutableList.copyOf(permAnnotation.value()), permAnnotation.logical(), createSubstitutionMap(permAnnotation, am)));
    }

    // Check the method
    permAnnotation = am.getAnnotation(RequiresPermissions.class);
    if (permAnnotation != null) {
        filters.add(new AuthorizationResourceFilter(ImmutableList.copyOf(permAnnotation.value()), permAnnotation.logical(), createSubstitutionMap(permAnnotation, am)));
    }

    // If we're doing authorization or if authentication is explicitly requested then add it as the first filter
    if (!filters.isEmpty() ||
            am.getResource().getAnnotation(RequiresAuthentication.class) != null ||
            am.getAnnotation(RequiresAuthentication.class) != null) {
        filters.addFirst(new AuthenticationResourceFilter(_securityManager, _tokenGenerator));
    }

    return filters;
}
 

public BasicAuthRequestFilter(Authenticator<BasicCredentials, User> authenticator, AbstractMethod method) {
    this.authenticator = authenticator;
    this.method = method;
    this.hasPermitAllAnnotation = method.isAnnotationPresent(PermitAll.class);
    this.hasDenyAllAnnotation = method.isAnnotationPresent(DenyAll.class);
    this.hasRolesAllowedAnnotation = method.isAnnotationPresent(RolesAllowed.class);
    this.isSecurityDefined = this.hasPermitAllAnnotation || this.hasDenyAllAnnotation || this.hasRolesAllowedAnnotation;
    for (Parameter parameter : method.getMethod().getParameters()) {
        if (isAuthRequired && isAuthDefined) {
            break;
        }
        Auth[] authAnnotations = parameter.getAnnotationsByType(Auth.class);
        this.isAuthDefined = authAnnotations.length > 0 || this.isAuthDefined;
        for (Auth auth : authAnnotations) {
            this.isAuthRequired = auth.required() || this.isAuthRequired;
        }
    }
    this.isSecurityDefined = this.isAuthDefined || this.isSecurityDefined;
    Preconditions.checkArgument(!(this.hasDenyAllAnnotation && this.hasPermitAllAnnotation), "Conflict @DenyAll and @PermitAll on method " + this.method.toString());
}
 

@Override
public List<ResourceFilter> create(AbstractMethod am) {
    List<ResourceFilter> rolesFilters = new ArrayList<ResourceFilter>();

    RightsAllowed check = am.getAnnotation(RightsAllowed.class);
    if (check != null) {
        rolesFilters.add(new RightCheckResourceFilter(check.value(), am.getResource()));
        if (check.value().length == 0 && !check.any()) {
            LOG.warn("Class {} should be specifying any=true in the {} annotation.", am.getResource().getClass().getName(), RightsAllowed.class.getSimpleName());
        }

    } else {
        logNoFilterMessage(am);
    }
    return rolesFilters;

}
 

private void logNoFilterMessage(AbstractMethod am) {

        Class<?> resourceClass = am.getResource().getResourceClass();

        if (LOG_EXCLUDE_LIST.contains(resourceClass.getName())) {
            return;
        }

        //Don't worry about non-sli classes
        if (!resourceClass.getPackage().getName().startsWith("org.slc.sli")) {
            return;
        }

        //Don't worry about the dynamic endpoints
        if (GenericResource.class.isAssignableFrom(resourceClass)) {
            return;
        }
        LOG.debug("No RightsAllowed specified for {} of {}.",
                am.getMethod().getName(),
                am.getResource().getResourceClass().getName());
    }
 

@Override
public List<ResourceFilter> create(AbstractMethod am) {
	if (am instanceof AbstractResourceMethod)
	{
		OAuth20 oauth20 = am.getAnnotation(OAuth20.class);
		AllowedScopes scopes = am.getAnnotation(AllowedScopes.class);
		
		if (oauth20!=null)
		{
			LOGGER.debug("Installing oauth2 filter on {}", am.getResource());
			return getFilters(scopes);
		}
		else {
			oauth20 = am.getResource().getAnnotation(OAuth20.class);
			scopes = am.getResource().getAnnotation(AllowedScopes.class);
			if (oauth20!=null)
			{
				LOGGER.debug("Installing oauth2 filter on {}", am.getResource());
				return getFilters(scopes);				
			}
			return null;	
		}
	} else
		return null;
}
 

@Override
public List<ResourceFilter> create(AbstractMethod abstractMethod) {
    List<ResourceFilter> resourceFilters = Lists.newArrayList();
    if (abstractMethod.isAnnotationPresent(ThrottleConcurrentRequests.class)) {
        int maxRequests = abstractMethod.getAnnotation(ThrottleConcurrentRequests.class).maxRequests();
        InstanceConcurrentRequestRegulatorSupplier regulatorSupplier =
                new InstanceConcurrentRequestRegulatorSupplier(
                        new DefaultConcurrentRequestRegulator(SEMAPHORE_PROPERTY, maxRequests, _meter));
        resourceFilters.add(new ConcurrentRequestsThrottlingFilter(regulatorSupplier));
    }
    return resourceFilters;
}
 

/**
 * Returns a mapping from permissions found in the annotations to functions which can perform any necessary
 * substitutions based on actual values in the request.
 */
private Map<String,Function<HttpRequestContext, String>> createSubstitutionMap(String[] permissions, AbstractMethod am) {
    Map<String, Function<HttpRequestContext, String>> map = Maps.newLinkedHashMap();

    for (String permission : permissions) {
        Matcher matcher = SUBSTITUTION_MATCHER.matcher(permission);
        while (matcher.find()) {
            String match = matcher.group();
            if (map.containsKey(match)) {
                continue;
            }

            String param = matcher.group("param");
            Function<HttpRequestContext, String> substitution;

            if (param.startsWith("?")) {
                substitution = createQuerySubstitution(param.substring(1));
            } else {
                substitution = createPathSubstitution(param, am);
            }

            map.put(match, substitution);
        }
    }

    return map;
}
 

/**
 * Creates a substitution function for path values, such as
 * <code>@RequiresPermission("resource|update|{id}")</code>
 */
private Function<HttpRequestContext, String> createPathSubstitution(final String param, final AbstractMethod am) {
    int from = 0;
    int segment = -1;

    // Get the path from resource then from the method
    Path[] annotations = new Path[] { am.getResource().getAnnotation(Path.class), am.getAnnotation(Path.class) };

    for (Path annotation : annotations) {
        if (annotation == null)  {
            continue;
        }

        int index = getSubstitutionIndex(param, annotation.value());
        if (index >= 0) {
            segment = from + index;
        } else {
            from += -index;
        }
    }

    if (segment == -1) {
        throw new IllegalArgumentException("Param not found in path: " + param);
    }

    final int validatedSegment = segment;

    return new Function<HttpRequestContext, String>() {
        @Override
        public String apply(HttpRequestContext request) {
            return request.getPathSegments().get(validatedSegment).getPath();
        }
    };
}
 

@Override
public List<ResourceFilter> create(AbstractMethod am) {
    if (am.getResource().getAnnotation(Unbuffered.class) != null || am.getAnnotation(Unbuffered.class) != null) {
        return ImmutableList.of(this);
    }
    return ImmutableList.of();
}
 

@Override
public List<ResourceFilter> create(AbstractMethod abstractMethod) {
    return Arrays.asList(new ResourceFilter() {
        @Override
        public ContainerRequestFilter getRequestFilter() {
            return new BasicAuthRequestFilter(authenticator, abstractMethod);
        }

        @Override
        public ContainerResponseFilter getResponseFilter() {
            return null;
        }
    });
}
 

@Before
public void setup() {
    SecurityContextHolder.clearContext();
    method = Mockito.mock(AbstractMethod.class);
    AbstractResource res = new TestClass(this.getClass());
    Mockito.when(method.getResource()).thenReturn(res);
}
 

private Map<String,Function<HttpRequestContext, String>> createSubstitutionMap(RequiresPermissions permAnnotation, AbstractMethod am) {
    return createSubstitutionMap(permAnnotation.value(), am);
}