class OrganizationalAccountPermissionsChecker implements AccountPermissionsChecker {

  @Override
  public void checkPermissions(String accountId, AccountOperation operation)
      throws ForbiddenException {
    Subject subject = EnvironmentContext.getCurrent().getSubject();
    switch (operation) {
      case CREATE_WORKSPACE:
        if (!subject.hasPermission(
            OrganizationDomain.DOMAIN_ID, accountId, OrganizationDomain.CREATE_WORKSPACES)) {
          throw new ForbiddenException(
              "User is not authorized to create workspaces in specified namespace.");
        }
        break;
      case MANAGE_WORKSPACES:
        if (!subject.hasPermission(
            OrganizationDomain.DOMAIN_ID, accountId, OrganizationDomain.MANAGE_WORKSPACES)) {
          throw new ForbiddenException("User is not authorized to use specified namespace.");
        }
        break;
      case SEE_RESOURCE_INFORMATION:
        if (subject.hasPermission(DOMAIN_ID, accountId, CREATE_WORKSPACES)
            || subject.hasPermission(DOMAIN_ID, accountId, MANAGE_WORKSPACES)
            || subject.hasPermission(DOMAIN_ID, accountId, MANAGE_RESOURCES)) {

          // user is able to see resources usage information
          return;
        }
        throw new ForbiddenException(
            "User is not authorized to see resources information of requested organization.");
      default:
        throw new ForbiddenException("User is not authorized to use specified namespace.");
    }
  }

}