Problems with the Decorator pattern

We're often told to favor composition over inheritance, but I just got caught by a subtle bug using delegation and was wondering whether anyone else had fallen into the same trap and/or whether there's an easy way to detect or avoid the issue. Maybe I'm misusing the decorator pattern and, if so, I'd like to know how to use it properly.

Here's an example. Sorry it's a bit long.

I have an interface:

public interface Request { 
 
    boolean hasRemoteUser(); 
 
    String getRemoteUser(); 
} 

And a simple implementation:

public class SimpleRequest implements Request { 
 
    @Override 
    public boolean hasRemoteUser() { 
        return getRemoteUser() != null; 
    } 
 
    @Override 
    public String getRemoteUser() { 
        return null; 
    } 
} 

Approach 1: Inheritance

The SimpleRequest code is self-encapsulated, i.e. hasRemoteUser() is defined in terms of getRemoteUser() which means if I extend the class like this:

public class ExtendedRequest extends SimpleRequest { 
 
    @Override 
    public String getRemoteUser() { 
        return "fred"; 
    } 
} 

The following tests will pass:

Request extendedRequest = new ExtendedRequest(); 
assertEquals("fred", extendedRequest.getRemoteUser()); 
assertTrue(extendedRequest.hasRemoteUser()); 

Approach 2: Composition

I don't want to use inheritance, though. My requests are passed through a filter which adds the user information, so the decorator pattern is more suitable.

I start by writing a ForwardingRequest class that forwards all method calls to a delegate request.

public class ForwardingRequest implements Request { 
 
    private final Request delegate; 
 
    public ForwardingRequest(Request request) { 
        this.delegate = request; 
    } 
 
    @Override 
    public boolean hasRemoteUser() { 
        return delegate.hasRemoteUser(); 
    } 
 
    @Override 
    public String getRemoteUser() { 
        return delegate.getRemoteUser(); 
    } 
} 

Now I can write code like this:

Request simpleRequest = new SimpleRequest(); 
 
Request alteredRequest = new ForwardingRequest(simpleRequest) { 
 
    @Override 
    public String getRemoteUser() { 
        return "fred"; 
    } 
}; 

The following test passes:

assertEquals("fred", alteredRequest.getRemoteUser()); 

But unfortunately this one does not:

assertTrue(alteredRequest.hasRemoteUser()); 

Why not? Because the hasRemoteUser() method of the delegate does not call the getRemoteUser() method of the ForwardingRequest, but calls the getRemoteUser() method of SimpleRequest (which returns null).

The Danger of Decorating

It seems to me that this kind of defect could occur in any code where forwarding is used and methods are overridden. Even if the code works now, there's nothing to say that a subtle bug couldn't be introduced later on by changes to the wrapped class.

It's left me a bit concerned. Have I missed something important? Am I using the pattern wrongly? Or is this just another reason to write lots of tests?