sechmachine/labtimesheet
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

correct platform verification evidence

Browse Source
This commit is contained in:
sechmachine
2026-08-15 02:50:27 +07:00
parent 8ff6ee3d87
commit 98688dec7e
15 changed files with 418 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/tests/integration/first-admin-bootstrap.md
+10 -7
View File
@@ -1,18 +1,18 @@
# Test Evidence: Atomic first administrator bootstrap
- **Test type:** Integration
- **Requirement IDs:** `ACC-001–ACC-004, SEC-001–SEC-002, GOV-013`
- **Scenario IDs:** `AC-ACC-001, AC-ACC-002, AC-SEC-001`
- **Requirement IDs:** `ACC-001–ACC-003, ACC-009, SEC-001`
- **Scenario IDs:** `AC-ACC-001, AC-ACC-002`
- **Test class/method:** `com.lab.labtimesheet.feature.account.service.BootstrapIntegrationTest`
- **Implementation commit:** `this milestone commit`
- **Implementation commit:** `bc70db1d0d8eaa68bb8e22db44e38af27b0fa945`; restart characterization added in `8ff6ee3d873db909b1ce9df690f7a3abb2c3c79d`
## Protected behavior
Before initialization only bootstrap and health are reachable. Concurrent valid submissions create exactly one active Admin, atomically persist initialization, and permanently close bootstrap. The public account service resolves the winning Admin by normalized email or ID without exposing JPA entities or repositories.
Before initialization only bootstrap, bootstrap assets, health, and error rendering are reachable. Concurrent valid submissions create exactly one active Admin, atomically persist initialization, and permanently close bootstrap. A separately started Spring application context connected to the same PostgreSQL database observes the initialized state and cannot create another Admin.
## Test method
A PostgreSQL 18.4 integration test releases two Java 25 virtual-thread-safe requests onto the same service concurrently and asserts the row-locked outcomes and database state through Spring Data JPA. MockMvc checks pre/post-bootstrap route exposure, and the account API is checked against the actual concurrent winner.
A PostgreSQL 18.4 integration test releases two Java 25 tasks onto the same service concurrently and asserts the row-locked outcomes and database state through Spring Data JPA. MockMvc checks pre/post-bootstrap route exposure. A characterization method then starts and closes an independent servlet application context against the same container datasource and verifies the durable state through the public bootstrap service.
## Hand-derived expected result
@@ -47,16 +47,19 @@ The public bootstrap behavior did not exist.
export JAVA_HOME=/opt/homebrew/opt/openjdk@25
export PATH="$JAVA_HOME/bin:/opt/homebrew/opt/node@24/bin:$PATH"
export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
./mvnw -Dtest=BootstrapIntegrationTest,SmtpAccountIntegrationTest test
./mvnw -Dtest=BootstrapIntegrationTest test
```
**Observed result**
```text
Tests run: 3, Failures: 0, Errors: 0, Skipped: 0
Tests run: 4, Failures: 0, Errors: 0, Skipped: 0
BUILD SUCCESS
```
The independent-context restart assertion was added as characterization coverage for an evidence gap. No
retrospective RED is claimed because the persisted implementation already satisfied it when the test was added.
## Affected suite
**Command and result**