@Test(expectedExceptions = { ResourceException.class })

public void testAuthorizeInvalid() {
    HttpServletRequest reqMock = Mockito.mock(HttpServletRequest.class);
    HttpServletResponse resMock = Mockito.mock(HttpServletResponse.class);
    AuthorityList authListMock = new AuthorityList();
    Authorizer authorizerMock = Mockito.mock(Authorizer.class);
    Metric metricMock = Mockito.mock(Metric.class);
    Object timerMetricMock = Mockito.mock(Object.class);
    Mockito.when(reqMock.getHeader("testheader")).thenReturn("testcred");
    Mockito.when(reqMock.getRemoteAddr()).thenReturn("1.1.1.1");
    Mockito.when(reqMock.getMethod()).thenReturn("POST");
    // force true access right
    Mockito.when(authorizerMock.access(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any()))
            .thenReturn(true);
    RsrcCtxWrapper wrapper = new RsrcCtxWrapper(
            reqMock,
            resMock,
            authListMock,
            false,
            authorizerMock,
            metricMock,
            timerMetricMock,
            "apiName");
    // when not set authority
    wrapper.authorize("add-domain", "test", "test");
}