@POST
    @ApiOperation("Create a new view")
    @AuditEvent(type = ViewsAuditEventTypes.VIEW_CREATE)
    public ViewDTO create(@ApiParam @Valid @NotNull(message = "View is mandatory") ViewDTO dto,
                          @Context UserContext userContext,
                          @Context SearchUser searchUser) throws ValidationException {
        if (dto.type().equals(ViewDTO.Type.DASHBOARD) && !searchUser.canCreateDashboards()) {
            throw new ForbiddenException("User is not allowed to create new dashboards.");
        }

        validateIntegrity(dto, searchUser, true);

        final User user = userContext.getUser();
        var result = dbService.saveWithOwner(dto.toBuilder().owner(searchUser.username()).build(), user);
        recentActivityService.create(result.id(), result.type().equals(ViewDTO.Type.DASHBOARD) ? GRNTypes.DASHBOARD : GRNTypes.SEARCH, searchUser);
        return result;
    }
@Test
    public void shouldNotCreateADashboardWithoutPermission() {
        final ViewsResource viewsResource = createViewsResource(
                mock(ViewService.class),
                mock(StartPageService.class),
                mock(RecentActivityService.class),
                mock(ClusterEventBus.class),
                new ReferencedSearchFiltersHelper(),
                EMPTY_SEARCH_FILTER_VISIBILITY_CHECKER,
                EMPTY_VIEW_RESOLVERS
        );

        final SearchUser user = TestSearchUser.builder()
                .canCreateDashboards(false)
                .build();

        assertThatThrownBy(() -> viewsResource.create(TEST_DASHBOARD_VIEW, mock(UserContext.class), user))
                .isInstanceOf(ForbiddenException.class);
    }