@Override
    public Optional<ErrorResponse> filter(DiscFilterRequest request) {
        try {
            Optional<ResourceNameAndAction> resourceMapping =
                    requestResourceMapper.getResourceNameAndAction(request);
            log.log(Level.FINE, () -> String.format("Resource mapping for '%s': %s", request, resourceMapping));
            if (resourceMapping.isEmpty()) {
                incrementAcceptedMetrics(request, false, Optional.empty());
                return Optional.empty();
            }
            Result result = checkAccessAllowed(request, resourceMapping.get());
            AuthorizationResult.Type resultType = result.zpeResult.type();
            setAttribute(request, RESULT_ATTRIBUTE, resultType.name());
            if (resultType == AuthorizationResult.Type.ALLOW) {
                populateRequestWithResult(request, result);
                incrementAcceptedMetrics(request, true, Optional.of(result));
                return Optional.empty();
            }
            log.log(Level.FINE, () -> String.format("Forbidden (403) for '%s': %s", request, resultType.name()));
            incrementRejectedMetrics(request, FORBIDDEN, resultType.name(), Optional.of(result));
            return Optional.of(new ErrorResponse(FORBIDDEN, "Access forbidden: " + resultType.getDescription()));
        } catch (IllegalArgumentException e) {
            log.log(Level.FINE, () -> String.format("Unauthorized (401) for '%s': %s", request, e.getMessage()));
            incrementRejectedMetrics(request, UNAUTHORIZED, "Unauthorized", Optional.empty());
            return Optional.of(new ErrorResponse(UNAUTHORIZED, e.getMessage()));
        }
    }
@Test
    void ignores_access_token_if_client_has_role_certificate() {
        AthenzAuthorizationFilter filter = createFilter(new AllowingZpe(), List.of());

        MockResponseHandler responseHandler = new MockResponseHandler();
        DiscFilterRequest request = createRequest(null, ACCESS_TOKEN, ROLE_CERTIFICATE);
        filter.filter(request, responseHandler);

        assertAuthorizationResult(request, Type.ALLOW);
        assertRequestNotFiltered(responseHandler);
        assertMatchedCredentialType(request, EnabledCredentials.ROLE_CERTIFICATE);
        assertMatchedRole(request, ROLE);
    }