class AcmPluginRoleBasedAccessInterceptor extends HandlerInterceptorAdapter {

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws AcmNotAuthorizedException
    {
        String method = request.getMethod();
        String url = request.getServletPath();

        log.debug("Checking user privilege for url: {} {}", method, url);

        HttpSession session = request.getSession(false);

        if (session == null)
        {
            // no session yet - login must not have completed? Anyway, proceed with the next handler.
            return true;
        }

        Map<String, Boolean> userPrivileges = (Map<String, Boolean>) session.getAttribute("acm_privileges");
        if (userPrivileges == null)
        {
            // no user privileges. somehow the user is logged in and is calling a plugin URL, but does not have
            // privileges in the user session. Somehow the login success handler did not run. This is an
            // anomalous situation. Better return HTTP 403.
            throw new AcmNotAuthorizedException(request.getServletPath());
        }
        else
        {
            List<AcmPluginUrlPrivilege> urlPrivileges = getAcmPluginManager().getUrlPrivileges();
            boolean hasPrivilege = determinePrivilege(method, url, userPrivileges, urlPrivileges);

            if (!hasPrivilege)
            {
                throw new AcmNotAuthorizedException(request.getServletPath());
            }
        }

        return true;
    }

}