@Test
public void testIsAllowedPutMembership() {

    TopLevelDomain dom1 = createTopLevelDomainObject("testdomain1","Role Test Domain1", "testOrg", "user.user1");
    zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1);
    Role role1 = createRoleObject("testdomain1", "testrole1", null,"user.john", "user.jane");
    zms.putRole(mockDomRsrcCtx, "testdomain1", "testrole1", auditRef, role1);
    AthenzDomain domain = zms.getAthenzDomain("testdomain1", false);
    Role role = zms.getRoleFromDomain("testrole1", domain);
    RoleMember roleMember = new RoleMember().setMemberName("user.user1");
    assertTrue(zms.isAllowedPutMembership(mockDomRestRsrcCtx.principal(), domain, role, roleMember));//admin allowed
    assertTrue(roleMember.getApproved());
    Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority();
    String unsignedCreds = "v=U1;d=user;n=bob";
    final Principal rsrcPrince = SimplePrincipal.create("user", "bob", unsignedCreds + ";s=signature",0, principalAuthority);
    assertNotNull(rsrcPrince);
    ((SimplePrincipal) rsrcPrince).setUnsignedCreds(unsignedCreds);
    roleMember = new RoleMember().setMemberName("user.bob");
    assertFalse(zms.isAllowedPutMembership(rsrcPrince, domain, role, roleMember));//bob trying to add himself
    // without self-serve bob is not allowed to add dave
    roleMember = new RoleMember().setMemberName("user.dave");
    assertFalse(zms.isAllowedPutMembership(rsrcPrince, domain, role, roleMember));//bob trying to add dave
    Role selfserverole = createRoleObject("testdomain1", "testrole2", null,"user.john", "user.jane");
    zms.putRole(mockDomRsrcCtx, "testdomain1", "testrole2", auditRef, selfserverole);
    RoleMeta rm = createRoleMetaObject(true);
    zms.putRoleMeta(mockDomRsrcCtx, "testdomain1", "testrole2",  auditRef, rm);
    domain = zms.getAthenzDomain("testdomain1", false);
    role = zms.getRoleFromDomain("testrole2", domain);
    roleMember = new RoleMember().setMemberName("user.bob");
    assertTrue(zms.isAllowedPutMembership(rsrcPrince, domain, role, roleMember));//bob trying to add himself
    assertFalse(roleMember.getApproved());
    // with self-serve bob is now allowed to add dave
    roleMember.setMemberName("user.dave");
    assertTrue(zms.isAllowedPutMembership(rsrcPrince, domain, role, roleMember));//bob trying to add dave
    assertFalse(roleMember.getApproved());
    DomainMeta meta = createDomainMetaObject("Domain Meta for Role Meta test", "testOrg",
            true, true, "12345", 1001);
    zms.putDomainMeta(mockDomRsrcCtx, "testdomain1", auditRef, meta);
    zms.putDomainSystemMeta(mockDomRsrcCtx, "testdomain1", "auditenabled", auditRef, meta);
    Role auditedRole = createRoleObject("testdomain1", "testrole3", null,"user.john", "user.jane");
    zms.putRole(mockDomRsrcCtx, "testdomain1", "testrole3", auditRef, auditedRole);
    RoleSystemMeta rsm = createRoleSystemMetaObject(true);
    zms.putRoleSystemMeta(mockDomRsrcCtx, "testdomain1", "testrole3", "auditenabled", auditRef, rsm);
    domain = zms.getAthenzDomain("testdomain1", false);
    role = zms.getRoleFromDomain("testrole3", domain);
    roleMember = new RoleMember().setMemberName("user.user1");
    assertTrue(zms.isAllowedPutMembership(mockDomRestRsrcCtx.principal(), domain, role, roleMember));//admin allowed
    assertFalse(roleMember.getApproved());
    roleMember = new RoleMember().setMemberName("user.bob");
    assertFalse(zms.isAllowedPutMembership(rsrcPrince, domain, role, roleMember));//bob trying to add himself not allowed
    roleMember = new RoleMember().setMemberName("user.dave");
    assertFalse(zms.isAllowedPutMembership(rsrcPrince, domain, role, roleMember));//bob trying to add dave not allowed
    zms.deleteTopLevelDomain(mockDomRsrcCtx, "testdomain1", auditRef);
}