@Test
public void testUpdateRoleMembersSystemDisabledState() {

    Authority savedAuthority = zms.dbService.zmsConfig.getUserAuthority();
    Authority authority = Mockito.mock(Authority.class);
    Mockito.when(authority.isAttributeSet("user.john", "employee")).thenReturn(true);
    Mockito.when(authority.isAttributeSet("user.jane", "employee")).thenReturn(false);
    Mockito.when(authority.isAttributeSet("user.joe", "employee")).thenReturn(true);
    zms.dbService.zmsConfig.setUserAuthority(authority);
    ObjectStoreConnection mockConn = Mockito.mock(ObjectStoreConnection.class);
    Mockito.when(mockConn.updateRoleMemberDisabledState(Mockito.anyString(), Mockito.anyString(), Mockito.any(),
            Mockito.any(), Mockito.anyInt(), Mockito.anyString())).thenReturn(true);
    final String domainName = "user-auth-attrs";
    Mockito.when(mockConn.updateDomainModTimestamp(domainName)).thenReturn(true);
    List<RoleMember> roleMembers = new ArrayList<>();
    roleMembers.add(new RoleMember().setMemberName("user.john"));
    roleMembers.add(new RoleMember().setMemberName("user.jane"));
    roleMembers.add(new RoleMember().setMemberName("sports.api"));
    Timestamp tstamp = Timestamp.fromMillis(System.currentTimeMillis() - 10000);
    roleMembers.add(new RoleMember().setMemberName("weather.api").setExpiration(tstamp));
    Role originalRole = new Role()
            .setName(domainName + ":role.auth-role")
            .setRoleMembers(roleMembers);
    Role updatedRole = new Role().setName(domainName + ":role.auth-role")
            .setUserAuthorityFilter("employee")
            .setRoleMembers(roleMembers);
    zms.dbService.updateRoleMembersSystemDisabledState(mockDomRsrcCtx, mockConn, domainName,
            "auth-role", originalRole, updatedRole, auditRef, "unit-test");
    // john should not have an expiry while jane should have the disabled state
    // since jane no longer has the user attribute set
    RoleMember member = getRoleMember(updatedRole, "user.john");
    assertNull(member.getExpiration());
    assertNull(member.getSystemDisabled());
    member = getRoleMember(updatedRole, "user.jane");
    assertNull(member.getExpiration());
    assertEquals(member.getSystemDisabled(), Integer.valueOf(ZMSConsts.ZMS_DISABLED_AUTHORITY_FILTER));
    // sports api should not be disabled set since it's not a user
    member = getRoleMember(updatedRole, "sports.api");
    assertNull(member.getExpiration());
    assertNull(member.getSystemDisabled());
    // weather api expiry should not change since it's already expired
    member = getRoleMember(updatedRole, "weather.api");
    assertEquals(member.getExpiration(), tstamp);
    assertNull(member.getSystemDisabled());
    // now let's reset the state back to null which should
    // remove the filter disabled flag
    originalRole.setUserAuthorityFilter("employee");
    updatedRole.setUserAuthorityFilter(null);
    zms.dbService.updateRoleMembersSystemDisabledState(mockDomRsrcCtx, mockConn, domainName,
            "auth-role", originalRole, updatedRole, auditRef, "unit-test");
    member = getRoleMember(updatedRole, "user.john");
    assertNull(member.getExpiration());
    assertNull(member.getSystemDisabled());
    member = getRoleMember(updatedRole, "user.jane");
    assertNull(member.getExpiration());
    assertEquals(member.getSystemDisabled(), Integer.valueOf(0));
    member = getRoleMember(updatedRole, "sports.api");
    assertNull(member.getExpiration());
    assertNull(member.getSystemDisabled());
    member = getRoleMember(updatedRole, "weather.api");
    assertEquals(member.getExpiration(), tstamp);
    assertNull(member.getSystemDisabled());
    // reset authority to its original value
    zms.dbService.zmsConfig.setUserAuthority(savedAuthority);
}