@Test
public void testPostRoleCertificateRequestInvalidRequests() {

    // this csr is for sports:role.readers role
    RoleCertificateRequest req = new RoleCertificateRequest()
            .setCsr(ROLE_CERT_CORETECH_REQUEST).setExpiryTime(3600L);
    
    SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true);
    store.processDomain(signedDomain, false);
    Principal principal = SimplePrincipal.create("user_domain", "user1",
            "v=U1;d=user_domain;n=user;s=signature", 0, null);
    ResourceContext context = createResourceContext(principal);
    // this time we're passing an invalid role name so we should
    // get no access - 403
    
    try {
        zts.postRoleCertificateRequest(context, "coretech", "unknownrole", req);
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 403);
    }
    
    // this time we're passing an role name that the user has access to
    // but it's not the readers role as in the csr
    
    try {
        zts.postRoleCertificateRequest(context, "coretech", "writers", req);
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 400);
    }
    
    // this time we're passing unknown domain
    
    try {
        zts.postRoleCertificateRequest(context, "unknown-domain", "readers", req);
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 404);
    }
}