class OrganizationResourceDistributionServicePermissionsFilter extends CheMethodInvokerFilter {

  @Override
  protected void filter(GenericResourceMethod genericMethodResource, Object[] arguments)
      throws ApiException {
    final String methodName = genericMethodResource.getMethod().getName();

    final Subject currentSubject = EnvironmentContext.getCurrent().getSubject();
    String organizationId;
    switch (methodName) {
      case GET_RESOURCES_CAP_METHOD:
        if (superPrivilegesChecker.hasSuperPrivileges()) {
          // user is able to see information about all organizations
          return;
        }
        // fall through
      case CAP_RESOURCES_METHOD:
        // we should check permissions on parent organization level
        Organization organization = organizationManager.getById((String) arguments[0]);
        organizationId = organization.getParent();
        if (organizationId == null) {
          // requested organization is root so manager should throw exception
          return;
        }
        break;

      case GET_DISTRIBUTED_RESOURCES:
        organizationId = (String) arguments[0];
        // get organization to ensure that organization exists
        organizationManager.getById(organizationId);
        if (superPrivilegesChecker.hasSuperPrivileges()) {
          // user is able to see information about all organizations
          return;
        }
        break;

      default:
        throw new ForbiddenException("The user does not have permission to perform this operation");
    }

    if (!currentSubject.hasPermission(
        OrganizationDomain.DOMAIN_ID, organizationId, OrganizationDomain.MANAGE_RESOURCES)) {
      throw new ForbiddenException(
          "The user does not have permission to manage resources of organization with id '"
              + organizationId
              + "'");
    }
  }

}