private void verifyPermissionToGrantRoles(Subject subject, Iterable<RoleIdentifier> roleIds) {
        Set<RoleIdentifier> unauthorizedIds = Sets.newTreeSet();
        boolean anyAuthorized = false;

        for (RoleIdentifier roleId : roleIds) {
            // Verify the caller has permission to grant this role
            if (subject.hasPermission(Permissions.grantRole(roleId))) {
                anyAuthorized = true;
            } else {
                unauthorizedIds.add(roleId);
            }
        }

        if (!unauthorizedIds.isEmpty()) {
            // If the caller was not authorized to assign any of the provided roles raise a generic exception, otherwise
            // the exception provides insight as to which roles were unauthorized.  This provides some helpful feedback
            // where appropriate without exposing potentially exploitable information about whether the subject's API key
            // is valid.
            if (!anyAuthorized) {
                throw new UnauthorizedException();
            } else {
                throw new UnauthorizedException("Not authorized for roles: " + Joiner.on(", ").join(unauthorizedIds));
            }
        }
    }
private void verifyPermissionToGrantRoles ( Subject subject , Iterable < RoleIdentifier > roleIds ) { Set < RoleIdentifier > unauthorizedIds = Sets . newTreeSet ( ) ; boolean anyAuthorized = false ; for ( RoleIdentifier roleId : roleIds ) { if ( subject . hasPermission ( Permissions . grantRole ( roleId ) ) ) { anyAuthorized = true ; } else { unauthorizedIds . add ( roleId ) ; } } if ( ! unauthorizedIds . isEmpty ( ) ) { if ( ! anyAuthorized ) { throw new UnauthorizedException ( ) ; } else { throw new UnauthorizedException ( "Not authorized for roles: " + Joiner . on ( ", " ) . join ( unauthorizedIds ) ) ; } } }
Verifies whether the user has permission to grant all of the provided roles.  If not it throws an UnauthorizedException.
@throws UnauthorizedException User did not have the permission to grant at least one role.