@POST
    @ApiOperation(value = "Retrieve the field list of a given set of streams")
    @NoAuditEvent("This is not changing any data")
    public Set<MappedFieldTypeDTO> byStreams(@ApiParam(name = "JSON body", required = true)
                                             @Valid @NotNull FieldTypesForStreamsRequest request,
                                             @Context SearchUser searchUser) {
        final ImmutableSet<String> streams = searchUser.streams().readableOrAllIfEmpty(request.streams());
        return mappedFieldTypesService.fieldTypesByStreamIds(streams, request.timerange().orElse(RelativeRange.allTime()));
    }
@Test
    public void shouldNotAllowAccessWithoutPermission() {
        final SearchUser searchUser = TestSearchUser
                .builder()
                .denyStream("2323")
                .allowStream("4242")
                .build();

        final FieldTypesForStreamsRequest req = FieldTypesForStreamsRequest.Builder.builder()
                .streams(ImmutableSet.of("2323", "4242"))
                .build();

        final FieldTypesResource resource = new FieldTypesResource((streamIds, timeRange) -> Collections.emptySet(), mock(IndexFieldTypePollerPeriodical.class));
        assertThatExceptionOfType(MissingStreamPermissionException.class)
                .isThrownBy(() -> resource.byStreams(req, searchUser))
                .satisfies(ex -> assertThat(ex.streamsWithMissingPermissions()).contains("2323"));
    }