correct platform verification evidence

2026-08-15 02:50:27 +07:00
parent 8ff6ee3d87
commit 98688dec7e
15 changed files with 418 additions and 28 deletions
@@ -0,0 +1,93 @@
+# Test Evidence: Validated bootstrap, SMTP, and account onboarding
+
+- **Test type:** Web
+- **Requirement IDs:** `ACC-005–ACC-012`, `INT-004`, `INT-006–INT-008`, `SEC-001`
+- **Scenario IDs:** `AC-ACC-003`; `AC-INT-002` (Admin browser boundary)
+- **Test class/method:** `com.lab.labtimesheet.feature.account.controller.BootstrapOnboardingWebIntegrationTest`, `com.lab.labtimesheet.feature.integration.controller.SmtpOnboardingWebIntegrationTest`, `com.lab.labtimesheet.feature.account.controller.AccountWebIntegrationTest#invalidAndDuplicateAccountFormsReturnActionableErrorsWithoutCreatingAnotherAccount`
+- **Implementation commit:** `17fa25bb0921718f780037cd8c55a956bbdf6b19`; SMTP failure feedback added in `8ff6ee3d873db909b1ce9df690f7a3abb2c3c79d`
+
+## Protected behavior
+
+Bootstrap offers SMTP setup after creating the first Admin. The Admin can save a validated draft, test it, and
+activate only a successful test; or traverse five distinct ordered deferral acknowledgements before finishing.
+Restricted-installation warnings persist until activation. Invalid bootstrap/account/SMTP forms retain only safe
+non-secret values and show actionable errors. All state-changing browser operations require CSRF.
+
+## Test method
+
+MockMvc drives the production controllers, Bean Validation, Thymeleaf rendering, Spring Security filter chain, JPA
+services, and PostgreSQL 18.4. SMTP is replaced only at its network adapter. The tests inspect rendered status,
+buttons, warnings, validation messages, password non-retention, CSRF denial, ordered deferral navigation, and the
+failed-probe response while verifying that activation remains unavailable.
+
+## Hand-derived expected result
+
+Successful bootstrap lands on `/admin/smtp?onboarding`. A saved draft shows Test but not Activate; a successful test
+shows Activate; activation clears the restricted warning. Deferral exposes warnings one through five in order, Back
+and Configure on every screen, and Finish only on screen five. Invalid data returns HTTP 200 with field/global errors
+and no submitted password. A failed SMTP probe displays its safe error and leaves the draft untested.
+
+## RED
+
+**Command**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
+./mvnw -Dtest=BootstrapOnboardingWebIntegrationTest,SmtpOnboardingWebIntegrationTest test
+```
+
+**Observed result**
+
+```text
+Tests run: 6, Failures: 5, Errors: 1, Skipped: 0
+Bootstrap redirected to /login instead of SMTP onboarding; deferral returned 404; SMTP status and warning were
+absent; invalid form input raised a validation exception.
+BUILD FAILURE
+```
+
+The later failure-feedback regression used this focused command:
+
+```text
+./mvnw -Dtest=SmtpOnboardingWebIntegrationTest#failedSmtpTestRendersActionableFeedbackWithoutActivatingTheDraft test
+Tests run: 1, Failures: 1, Errors: 0, Skipped: 0
+Expected the configured connection-refusal message, but smtp/form omitted it.
+BUILD FAILURE
+```
+
+## GREEN
+
+**Command**
+
+```text
+export JAVA_HOME=/opt/homebrew/opt/openjdk@25
+export PATH="$JAVA_HOME/bin:$PATH"
+export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
+./mvnw -Dtest=BootstrapOnboardingWebIntegrationTest,SmtpOnboardingWebIntegrationTest test
+```
+
+**Observed result**
+
+```text
+Tests run: 7, Failures: 0, Errors: 0, Skipped: 0
+BUILD SUCCESS
+PostgreSQL: 18.4
+```
+
+## Affected suite
+
+**Command and result**
+
+```text
+./mvnw -Dtest=BootstrapIntegrationTest,SmtpOnboardingWebIntegrationTest,AccountActivationIntegrationTest,AccountWebIntegrationTest,BootstrapOnboardingWebIntegrationTest,JavaMailSmtpProbeTest,SecurityResponseIntegrationTest test
+Tests run: 20, Failures: 0, Errors: 0, Skipped: 0
+BUILD SUCCESS
+PostgreSQL: 18.4
+```
+
+## External-test boundaries
+
+The SMTP adapter is in-memory here, so this does not prove external Mailpit/server interoperability. MockMvc is not a
+real browser or accessibility run. The test exposes only the adapter's safe failure message fixture and never a raw
+password, integration secret, or activation bearer token.