@Test
public void testVerifyAuthorizedServiceOperation() {

    
    // null authorized service means it's all good
    
    zms.verifyAuthorizedServiceOperation(null, "putrole");
    
    // our test resource json file includes two services:
    // coretech.storage - allowed for putrole and putpolicy
    // sports.hockey - not allowed for any ops
    
    zms.verifyAuthorizedServiceOperation("coretech.storage", "putrole");
    zms.verifyAuthorizedServiceOperation("coretech.storage", "putpolicy");
    try {
        zms.verifyAuthorizedServiceOperation("coretech.storage", "postdomain");
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 403);
    }
    try {
        zms.verifyAuthorizedServiceOperation("coretech.storage", "deleterole");
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 403);
    }
    
    try {
        zms.verifyAuthorizedServiceOperation("sports.hockey", "putrole");
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 403);
    }
    try {
        zms.verifyAuthorizedServiceOperation("sports.hockey", "putpolicy");
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 403);
    }
    try {
        zms.verifyAuthorizedServiceOperation("sports.hockey", "deleterole");
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 403);
    }
    try {
        zms.verifyAuthorizedServiceOperation("sports.hockey", "putserviceidentity");
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 403);
    }
    
    // ATHENZ-1528
    // Try passing along operationItem key + value to see if verification works
    
    // First, try with AllowAll operation
    zms.verifyAuthorizedServiceOperation("coretech.newsvc", "putrole"); // putrole has no restriction. This should pass.
    
    // Second, try with restricted operation. Currently, putmembership only allow single operation item.
    zms.verifyAuthorizedServiceOperation("coretech.newsvc", "putmembership", "role", "platforms_deployer");
    zms.verifyAuthorizedServiceOperation("coretech.newsvc", "putmembership", "role", "platforms_different_deployer");
    zms.verifyAuthorizedServiceOperation("coretech.newsvc", "putmembership", "not_role", "platforms_role_deployer");
    
    // Third, try with restriction operation, with not-specified operation item.
    try {
        zms.verifyAuthorizedServiceOperation("coretech.newsvc", "putmembership", "role", "platforms_deployer_new");
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 403);
    }
    
    try {
        zms.verifyAuthorizedServiceOperation("coretech.newsvc", "putmembership", "not_role", "platforms_deployer_new_new");
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 403);
    }
    
    try {
        zms.verifyAuthorizedServiceOperation("coretech.storage2", "postdomain");
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 403);
    }
    
    try {
        zms.verifyAuthorizedServiceOperation("media.storage", "deleterole");
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 403);
    }
}