class SecretDeliveryResource {

  @Timed @ExceptionMetered
  @GET
  public SecretDeliveryResponse getSecret(@NotEmpty @PathParam("secretName") String secretName,
                                          @Auth Client client) {
    Optional<SanitizedSecret> sanitizedSecret = aclDAO.getSanitizedSecretFor(client, secretName);
    Optional<Secret> secret = secretController.getSecretByName(secretName);

    if (!sanitizedSecret.isPresent()) {
      boolean clientExists = clientDAO.getClientByName(client.getName()).isPresent();
      boolean secretExists = secret.isPresent();

      if (clientExists && secretExists) {
        throw new ForbiddenException(format("Access denied: %s at '%s' by '%s'", client.getName(),
                "/secret/" + secretName, client));
      } else {
        if (clientExists) {
          logger.info("Client {} requested unknown secret {}", client.getName(), secretName);
        }
        throw new NotFoundException();
      }
    }

    logger.info("Client {} granted access to {}.", client.getName(), secretName);
    try {
      return SecretDeliveryResponse.fromSecret(secret.get());
    } catch (IllegalArgumentException e) {
      logger.error(format("Failed creating response for secret %s", secretName), e);
      throw new InternalServerErrorException();
    }
  }

  @Inject public  SecretDeliveryResource(@Readonly SecretController secretController,
      AclDAOFactory aclDAOFactory, ClientDAOFactory clientDAOFactory);
  @VisibleForTesting  SecretDeliveryResource(SecretController secretController, AclDAO aclDAO,
      ClientDAO clientDAO);

}