SpringMvcHttpResponseCodesResource.java

package org.jboss.resteasy.test.spring.inmodule.resource;

import javax.ws.rs.Consumes;
import javax.ws.rs.ForbiddenException;
import javax.ws.rs.POST;
import javax.ws.rs.Path;
import javax.ws.rs.Produces;
import javax.ws.rs.core.MediaType;
import javax.ws.rs.core.SecurityContext;

import org.jboss.resteasy.spi.ResteasyProviderFactory;

@Path("/")
public class SpringMvcHttpResponseCodesResource {
    @POST
    @Path("/test/json")
    @Consumes(MediaType.APPLICATION_JSON)
    @Produces(MediaType.APPLICATION_JSON)
    public SpringMvcHttpResponseCodesPerson postJson(SpringMvcHttpResponseCodesPerson person) {
        return person;
    }

    @POST
    @Path("/secured/json")
    @Consumes(MediaType.APPLICATION_JSON)
    @Produces(MediaType.APPLICATION_JSON)
    public SpringMvcHttpResponseCodesPerson postJsonSecured(SpringMvcHttpResponseCodesPerson person) {
        //Using the workaround below instead of @RolesAllowed("admin")
        //as I can't easily turn security on in the ResteasyDeployment built through the springmvc-resteasy.xml descriptor
        SecurityContext context = ResteasyProviderFactory.getContextData(SecurityContext.class);
        if (context != null) {
            if (!context.isUserInRole("admin")) {
                throw new ForbiddenException();
            }
        }
        return person;
    }
}