@Test
public void testProcessRoleUserAuthorityRestrictions() {

    Authority savedAuthority = zms.dbService.zmsConfig.getUserAuthority();
    Authority authority = Mockito.mock(Authority.class);
    Mockito.when(authority.getDateAttribute("user.joe", "elevated-clearance"))
            .thenReturn(null);
    zms.dbService.zmsConfig.setUserAuthority(authority);
    final String domainName = "authority-test";
    final String roleName = "auth-role";
    ObjectStoreConnection mockConn = Mockito.mock(ObjectStoreConnection.class);
    Mockito.when(mockConn.insertRoleMember(Mockito.anyString(), Mockito.anyString(), Mockito.any(),
            Mockito.any(), Mockito.anyString())).thenReturn(true);
    Mockito.when(mockConn.updateDomainModTimestamp(domainName)).thenReturn(true);
    Mockito.when(mockObjStore.getConnection(true, true)).thenReturn(mockConn);
    Mockito.when(mockObjStore.getConnection(true, false)).thenReturn(mockConn);
    // first we're going to return a null role and then a role
    // with no members - in both cases we return without processing
    // any code
    Role role = new Role().setUserAuthorityExpiration("elevated-clearance");
    List<RoleMember> roleMembers = new ArrayList<>();
    roleMembers.add(new RoleMember().setMemberName("user.joe"));
    Mockito.when(mockConn.getRole(domainName, roleName)).thenReturn(role);
    Mockito.when(mockConn.listRoleMembers(domainName, roleName, false))
            .thenReturn(roleMembers);
    // first we're going to return no roles and then list of roles
    // in the second one
    List<PrincipalRole> roles = new ArrayList<>();
    PrincipalRole prRole = new PrincipalRole();
    prRole.setDomainName(domainName);
    prRole.setRoleName(roleName);
    roles.add(prRole);
    Mockito.when(mockConn.listRolesWithUserAuthorityRestrictions())
            .thenReturn(null)
            .thenReturn(roles);
    ObjectStore savedStore = zms.dbService.store;
    zms.dbService.store = mockObjStore;
    // the request should complete successfully
    // first time we'll get no roles so no work is done
    // second time we'll get a single role that we'll process
    zms.dbService.processRoleUserAuthorityRestrictions();
    zms.dbService.processRoleUserAuthorityRestrictions();
    zms.dbService.zmsConfig.setUserAuthority(savedAuthority);
    zms.dbService.store = savedStore;
}