class UserRest {

    @PUT
    @Path("{username}/roles")
    @RolesAllowed("admin")
    @ApiOperation("Add roles to a Mobi User")
    public Response addUserRoles(@PathParam("username") String username, @QueryParam("roles") List<String> roles) {
        if (StringUtils.isEmpty(username) || roles.isEmpty()) {
            throw ErrorUtils.sendError("Both username and roles must be provided", Response.Status.BAD_REQUEST);
        }

        try {
            User savedUser = engineManager.retrieveUser(username).orElseThrow(() ->
                    ErrorUtils.sendError("User " + username + " not found", Response.Status.BAD_REQUEST));
            roles.stream()
                    .map(s -> engineManager.getRole(s).orElseThrow(() ->
                            ErrorUtils.sendError("Role " + s + " not found", Response.Status.BAD_REQUEST)))
                    .forEach(savedUser::addHasUserRole);
            engineManager.updateUser(savedUser);
            logger.info("Role(s) " + String.join(", ", roles) + " added to user " + username);
            return Response.ok().build();
        } catch (IllegalArgumentException ex) {
            throw ErrorUtils.sendError(ex.getMessage(), Response.Status.BAD_REQUEST);
        }
    }

}