package com.atlassian.plugins.rest.common.security.jersey;
   
   import com.atlassian.plugins.rest.common.security.AuthenticationRequiredException;
   import com.atlassian.sal.api.user.UserManager;
   import com.google.common.base.Preconditions;
   import com.sun.jersey.spi.container.ContainerRequest;
   import com.sun.jersey.spi.container.ContainerRequestFilter;
   import com.sun.jersey.spi.container.ContainerResponseFilter;
   import com.sun.jersey.spi.container.ResourceFilter;
  
  import javax.ws.rs.ext.Provider;
  
  /**
   * Filter that can be used to restrict access to resources to administrators.
   *
   * @since 2.7.1
   */
  @Provider
  public class AdminOnlyResourceFilter implements ResourceFilter, ContainerRequestFilter
  {
      private final UserManager userManager;
  
      public AdminOnlyResourceFilter(UserManager userManager)
      {
          this.userManager = Preconditions.checkNotNull(userManager);
      }
  
      public ContainerRequestFilter getRequestFilter()
      {
          return this;
      }
  
      public ContainerResponseFilter getResponseFilter()
      {
          return null;
      }
  
      public ContainerRequest filter(final ContainerRequest containerRequest)
      {
          String username = userManager.getRemoteUsername();
          if (username == null)
          {
              throw new AuthenticationRequiredException();
          }
          if (!userManager.isAdmin(username))
          {
              throw new SecurityException("Client must be authenticated as an administrator to access this resource.");
          }
          return containerRequest;
      }
  }