Source:
public void patchReplaceEmailWithTokenFail() throws Exception { context.turnOffAuthorisationSystem(); String originalEmail = "Johndoe@fake-email.com"; EPerson ePerson = EPersonBuilder.createEPerson(context) .withNameInMetadata("John", "Doe") .withEmail(originalEmail) .withPassword(password) .build(); String newEmail = "johnyandmaria@fake-email.com"; context.restoreAuthSystemState(); List<Operation> ops = new ArrayList<Operation>(); ReplaceOperation replaceOperation = new ReplaceOperation("/email", newEmail); ops.add(replaceOperation); String patchBody = getPatchContent(ops); accountService.sendRegistrationInfo(context, ePerson.getEmail()); String tokenForEPerson = registrationDataService.findByEmail(context, ePerson.getEmail()).getToken(); String token = getAuthToken(admin.getEmail(), password); PasswordHash oldPassword = ePersonService.getPasswordHash(ePerson); getClient(token).perform(patch("/api/eperson/epersons/" + ePerson.getID()) .content(patchBody) .contentType(MediaType.APPLICATION_JSON_PATCH_JSON) .param("token", tokenForEPerson)) .andExpect(status().isForbidden()); PasswordHash newPasswordHash = ePersonService.getPasswordHash(ePerson); assertTrue(StringUtils.equalsIgnoreCase(oldPassword.getHashString(),newPasswordHash.getHashString())); assertFalse(registrationDataService.findByEmail(context, ePerson.getEmail()) == null); assertTrue(StringUtils.equalsIgnoreCase(ePerson.getEmail(), originalEmail)); context.turnOffAuthorisationSystem(); registrationDataService.delete(context, registrationDataService.findByEmail(context, ePerson.getEmail())); registrationDataService.deleteByToken(context, tokenForEPerson); context.restoreAuthSystemState(); }

Target:
public void patchReplaceEmailWithTokenFail() throws Exception { context.turnOffAuthorisationSystem(); String originalEmail = "johndoe@fake-email.com"; EPerson ePerson = EPersonBuilder.createEPerson(context) .withNameInMetadata("John", "Doe") .withEmail(originalEmail) .withPassword(password) .build(); String newEmail = "johnyandmaria@fake-email.com"; context.restoreAuthSystemState(); List<Operation> ops = new ArrayList<Operation>(); ReplaceOperation replaceOperation = new ReplaceOperation("/email", newEmail); ops.add(replaceOperation); String patchBody = getPatchContent(ops); accountService.sendRegistrationInfo(context, ePerson.getEmail()); String tokenForEPerson = registrationDataService.findByEmail(context, ePerson.getEmail()).getToken(); PasswordHash oldPassword = ePersonService.getPasswordHash(ePerson); getClient().perform(patch("/api/eperson/epersons/" + ePerson.getID()) .content(patchBody) .contentType(MediaType.APPLICATION_JSON_PATCH_JSON) .param("token", tokenForEPerson)) .andExpect(status().isUnauthorized()); PasswordHash newPasswordHash = ePersonService.getPasswordHash(ePerson); assertEquals(oldPassword.getHashString(),newPasswordHash.getHashString()); assertNotNull(registrationDataService.findByEmail(context, ePerson.getEmail())); assertEquals(ePerson.getEmail(), originalEmail); context.turnOffAuthorisationSystem(); registrationDataService.delete(context, registrationDataService.findByEmail(context, ePerson.getEmail())); registrationDataService.deleteByToken(context, tokenForEPerson); context.restoreAuthSystemState(); }