Source:
public AccessToken accessToken(@Scope({OAuthScope.IMPLICIT_TOKEN}) final AccessToken accessToken, final ImplicitTokenRequest implicitTokenRequest) { LOGGER.info("raw request {}", implicitTokenRequest); final Optional<Account> accountOptional = accountDAO.getByEmail(implicitTokenRequest.email); if (!accountOptional.isPresent()) { throw new WebApplicationException(Response.status(Response.Status.NOT_FOUND) .entity(new JsonError(Response.Status.NOT_FOUND.getStatusCode(), "Account not found")).build()); } final Long accountId = accountOptional.get().id.get(); LOGGER.info("Attempt to generate token on behalf of account - email {}", accountId, implicitTokenRequest.email); final Optional<Application> applicationOptional = applicationStore.getApplicationByClientId(implicitTokenRequest.clientId); if (!applicationOptional.isPresent()) { LOGGER.error("application wasn't found for clientId : {}", implicitTokenRequest.clientId); throw new WebApplicationException(Response.status(Response.Status.UNAUTHORIZED).build()); } final Application application = applicationOptional.get(); if (!application.hasScope(OAuthScope.AUTH)) { LOGGER.error("application does not have proper scope : {}", implicitTokenRequest.clientId); throw new WebApplicationException(Response.status(Response.Status.UNAUTHORIZED).build()); } final ClientDetails details = new ClientDetails( GrantTypeParam.GrantType.IMPLICIT, implicitTokenRequest.clientId, application.redirectURI, application.scopes, "", "", accountId, application.clientSecret ); details.setApp(application); AccessToken impersonalizeToken; try { impersonalizeToken = tokenStore.storeAccessToken(details); } catch (ClientAuthenticationException e) { throw new WebApplicationException(Response.status(Response.Status.INTERNAL_SERVER_ERROR) .entity(new JsonError(Response.Status.INTERNAL_SERVER_ERROR.getStatusCode(), String.format("Failed to generate token on behalf of account because {}", implicitTokenRequest.email, e.getMessage()))).build()); } LOGGER.debug("Impersonalize Token is for account {}", impersonalizeToken.toString(), implicitTokenRequest.email); return impersonalizeToken; }

Target:
public AccessToken accessToken(@Scope({OAuthScope.IMPLICIT_TOKEN}) final AccessToken accessToken, final ImplicitTokenRequest implicitTokenRequest) { LOGGER.debug("Raw implicit token request {}", implicitTokenRequest); String requesterEmail = this.request.getHeader(HelloHttpHeader.ADMIN); if (requesterEmail == null || !requesterEmail.endsWith("@sayhello.com")) { LOGGER.error("Unauthorized attempt to generate token from email {}", requesterEmail); throw new WebApplicationException(Response.status(Response.Status.UNAUTHORIZED).build()); } final Optional<Account> accountOptional = accountDAO.getByEmail(implicitTokenRequest.email); if (!accountOptional.isPresent()) { LOGGER.error("Account not found for email {}", implicitTokenRequest.email); throw new WebApplicationException(Response.status(Response.Status.UNAUTHORIZED).build()); } final Long accountId = accountOptional.get().id.get(); LOGGER.debug("Admin attempts to generate token on behalf of account - email {}", requesterEmail, accountId, implicitTokenRequest.email); final Optional<Application> applicationOptional = applicationStore.getApplicationByClientId(implicitTokenRequest.clientId); if (!applicationOptional.isPresent()) { LOGGER.error("application wasn't found for clientId : {}", implicitTokenRequest.clientId); throw new WebApplicationException(Response.status(Response.Status.UNAUTHORIZED).build()); } final Application application = applicationOptional.get(); if (!application.hasScope(OAuthScope.AUTH)) { LOGGER.error("application does not have proper scope : {}", implicitTokenRequest.clientId); throw new WebApplicationException(Response.status(Response.Status.UNAUTHORIZED).build()); } final ClientDetails details = ClientDetails.createWithImplicitGrantType(application, accountId); details.setApp(application); AccessToken implicitToken; try { implicitToken = tokenStore.storeAccessToken(details); } catch (ClientAuthenticationException e) { LOGGER.error("Failed to generate token on behalf of account because {}", implicitTokenRequest.email, e.getMessage()); throw new WebApplicationException(Response.status(Response.Status.UNAUTHORIZED).build()); } LOGGER.info("Admin created implicit token for account {}", requesterEmail, implicitToken.toString(), implicitTokenRequest.email); return implicitToken; }