@Test
public void testCheckWritePublicBucketWithUnauthorizedUserAndNoProxyChain() {

    final RequestAction action = RequestAction.WRITE;
    // first request will be to the specific bucket
    final AuthorizationRequest expectedBucketAuthorizationRequest = getBucketAuthorizationRequest(
            bucketPublic.getIdentifier(), action, USER_NO_PROXY_CHAIN);
    when(authorizer.authorize(argThat(new AuthorizationRequestMatcher(expectedBucketAuthorizationRequest))))
            .thenReturn(AuthorizationResult.denied());
    // second request will go to parent of /buckets
    final AuthorizationRequest expectedBucketsAuthorizationRequest = getBucketsAuthorizationRequest(action, USER_NO_PROXY_CHAIN);
    when(authorizer.authorize(argThat(new AuthorizationRequestMatcher(expectedBucketsAuthorizationRequest))))
            .thenReturn(AuthorizationResult.denied());
    // should reach authorizer and return denied
    final Authorizable bucketAuthorizable = authorizableLookup.getBucketAuthorizable(bucketPublic.getIdentifier());
    final AuthorizationResult result = bucketAuthorizable.checkAuthorization(authorizer, action, USER_NO_PROXY_CHAIN);
    assertNotNull(result);
    assertEquals(AuthorizationResult.Result.Denied, result.getResult());
    // Should call authorizer twice for specific bucket and top-level /buckets
    verify(authorizer, times(2)).authorize(any(AuthorizationRequest.class));
}