/*
 * Copyright (C) 2013 tarent AG
 *
 * Permission is hereby granted, free of charge, to any person obtaining
 * a copy of this software and associated documentation files (the
 * "Software"), to deal in the Software without restriction, including
 * without limitation the rights to use, copy, modify, merge, publish,
 * distribute, sublicense, and/or sell copies of the Software, and to
 * permit persons to whom the Software is furnished to do so, subject to
 * the following conditions:
 *
 * The above copyright notice and this permission notice shall be
 * included in all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
 * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
 * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
 * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 */

package org.osiam.client;

import org.junit.Test;
import org.junit.runner.RunWith;
import org.springframework.test.context.ContextConfiguration;
import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;

import javax.ws.rs.NotAuthorizedException;
import javax.ws.rs.core.MediaType;
import java.io.IOException;

@RunWith(SpringJUnit4ClassRunner.class)
@ContextConfiguration("/context.xml")
public class OAuthSecurityIT extends AbstractIntegrationTestBase {

    @Test(expected = NotAuthorizedException.class)
    public void client_is_secured() throws IOException {
        CLIENT.target(AUTH_ENDPOINT_ADDRESS + "/Client")
                .path("example-client")
                .request(MediaType.APPLICATION_JSON)
                .get(String.class);
    }

    @Test(expected = NotAuthorizedException.class)
    public void users_is_secured() throws IOException {
        CLIENT.target(RESOURCE_ENDPOINT_ADDRESS + "/Users")
                .request(MediaType.APPLICATION_JSON)
                .get(String.class);
    }

    @Test(expected = NotAuthorizedException.class)
    public void groups_is_secured() throws IOException {
        CLIENT.target(RESOURCE_ENDPOINT_ADDRESS + "/Groups")
                .request(MediaType.APPLICATION_JSON)
                .get(String.class);
    }

    @Test(expected = NotAuthorizedException.class)
    public void metrics_is_secured() throws IOException {
        CLIENT.target(RESOURCE_ENDPOINT_ADDRESS + "/Metrics")
                .request(MediaType.APPLICATION_JSON)
                .get(String.class);
    }
}

@@ -1875,32 +1875,1456 @@
 .class);%0A    %7D%0A%0A
+    @Test(expected = NotAuthorizedException.class)%0A    public void oauth_token_is_secured() throws IOException %7B%0A        CLIENT.target(AUTH_ENDPOINT_ADDRESS + %22/oauth/token%22)%0A                .request(MediaType.APPLICATION_JSON)%0A                .get(String.class);%0A    %7D%0A%0A    @Test(expected = NotAuthorizedException.class)%0A    public void fb_oauth_token_is_secured() throws IOException %7B%0A        CLIENT.target(AUTH_ENDPOINT_ADDRESS + %22/fb/oauth/access_token%22)%0A                .request(MediaType.APPLICATION_JSON)%0A                .get(String.class);%0A    %7D%0A%0A    @Test(expected = NotAuthorizedException.class)%0A    public void token_validation_is_secured() throws IOException %7B%0A        CLIENT.target(AUTH_ENDPOINT_ADDRESS + %22/token/validation%22)%0A                .request(MediaType.APPLICATION_JSON)%0A                .get(String.class);%0A    %7D%0A%0A    @Test(expected = NotAuthorizedException.class)%0A    public void token_revocation_is_secured() throws IOException %7B%0A        CLIENT.target(AUTH_ENDPOINT_ADDRESS + %22/token/revocation%22)%0A                .request(MediaType.APPLICATION_JSON)%0A                .get(String.class);%0A    %7D%0A%0A    @Test(expected = NotAuthorizedException.class)%0A    public void token_revocation_for_user_id_is_secured() throws IOException %7B%0A        CLIENT.target(AUTH_ENDPOINT_ADDRESS + %22/token/revocation/exampleUserId%22)%0A                .request(MediaType.APPLICATION_JSON)%0A                .get(String.class);%0A    %7D%0A%0A
     @Test(expect

Add more tests to prove basic security constraints