class WorkspaceRemoteSubscriptionPermissionFilter implements RemoteSubscriptionPermissionCheck {

  @Override
  public void check(String methodName, Map<String, String> scope) throws ForbiddenException {
    String workspaceId = scope.get("workspaceId");

    if (workspaceId == null) {
      throw new ForbiddenException("Workspace id must be specified in scope");
    }

    Subject currentSubject = EnvironmentContext.getCurrent().getSubject();
    if (!currentSubject.hasPermission(WorkspaceDomain.DOMAIN_ID, workspaceId, WorkspaceDomain.RUN)
        && !currentSubject.hasPermission(
            WorkspaceDomain.DOMAIN_ID, workspaceId, WorkspaceDomain.USE)) {
      throw new ForbiddenException(
          "The current user doesn't have permissions to listen to the specified workspace events");
    }
  }

}