@Test
public void testAuthorizeWritePublicBucketWithUnauthorizedUserAndAuthorizedProxyChain() {

    final NiFiUser user = USER_WITH_PROXY_CHAIN;
    final RequestAction action = RequestAction.WRITE;
    // first request will be to authorize the proxy
    final AuthorizationRequest expectedProxyAuthorizationRequest = getProxyAuthorizationRequest(action, user.getChain());
    when(authorizer.authorize(argThat(new AuthorizationRequestMatcher(expectedProxyAuthorizationRequest))))
            .thenReturn(AuthorizationResult.approved());
    // second request will be to the specific bucket
    final AuthorizationRequest expectedBucketAuthorizationRequest = getBucketAuthorizationRequest(
            bucketPublic.getIdentifier(), action, user);
    when(authorizer.authorize(argThat(new AuthorizationRequestMatcher(expectedBucketAuthorizationRequest))))
            .thenReturn(AuthorizationResult.denied());
    // third request will go to parent of /buckets
    final AuthorizationRequest expectedBucketsAuthorizationRequest = getBucketsAuthorizationRequest(action, user);
    when(authorizer.authorize(argThat(new AuthorizationRequestMatcher(expectedBucketsAuthorizationRequest))))
            .thenReturn(AuthorizationResult.denied());
    // the authorization of the proxy chain should throw UntrustedProxyException
    final Authorizable bucketAuthorizable = authorizableLookup.getBucketAuthorizable(bucketPublic.getIdentifier());
    try {
        bucketAuthorizable.authorize(authorizer, action, user);
        Assert.fail("Should have thrown exception");
    } catch (AccessDeniedException e) {
        // Should call authorizer three times for /proxy, /bucket/{id}, and /buckets
        verify(authorizer, times(3)).authorize(any(AuthorizationRequest.class));
    }
}