@Test
public void testProcessGroupUserAuthorityRestrictions() {

    Authority savedAuthority = zms.dbService.zmsConfig.getUserAuthority();
    Authority authority = Mockito.mock(Authority.class);
    Mockito.when(authority.getDateAttribute("user.joe", "elevated-clearance"))
            .thenReturn(null);
    zms.dbService.zmsConfig.setUserAuthority(authority);
    final String domainName = "authority-test";
    final String groupName = "auth-group";
    ObjectStoreConnection mockConn = Mockito.mock(ObjectStoreConnection.class);
    Mockito.when(mockConn.insertGroupMember(Mockito.anyString(), Mockito.anyString(), Mockito.any(),
            Mockito.any(), Mockito.anyString())).thenReturn(true);
    Mockito.when(mockConn.updateDomainModTimestamp(domainName)).thenReturn(true);
    Mockito.when(mockObjStore.getConnection(true, true)).thenReturn(mockConn);
    Mockito.when(mockObjStore.getConnection(true, false)).thenReturn(mockConn);
    // first we're going to return a null group and then a group
    // with no members - in both cases we return without processing
    // any code
    Group group = new Group().setUserAuthorityExpiration("elevated-clearance");
    List<GroupMember> groupMembers = new ArrayList<>();
    groupMembers.add(new GroupMember().setMemberName("user.joe"));
    Mockito.when(mockConn.getGroup(domainName, groupName)).thenReturn(group);
    Mockito.when(mockConn.listGroupMembers(domainName, groupName, false))
            .thenReturn(groupMembers);
    // first we're going to return no groups and then list of groups
    // in the second one
    List<PrincipalGroup> groups = new ArrayList<>();
    PrincipalGroup prGroup = new PrincipalGroup();
    prGroup.setDomainName(domainName);
    prGroup.setGroupName(groupName);
    groups.add(prGroup);
    Mockito.when(mockConn.listGroupsWithUserAuthorityRestrictions())
            .thenReturn(null)
            .thenReturn(groups);
    ObjectStore savedStore = zms.dbService.store;
    zms.dbService.store = mockObjStore;
    // the request should complete successfully
    // first time we'll get no groups so no work is done
    // second time we'll get a single group that we'll process
    zms.dbService.processGroupUserAuthorityRestrictions();
    zms.dbService.processGroupUserAuthorityRestrictions();
    zms.dbService.zmsConfig.setUserAuthority(savedAuthority);
    zms.dbService.store = savedStore;
}