3.5 KiB
Test Evidence: Account creation, activation, authentication, and logout
- Test type: Web
- Requirement IDs:
ACC-008–ACC-011, ACC-014, ACC-019, AUTH-001–AUTH-002, SEC-002–SEC-004 - Scenario IDs:
AC-ACC-005, AC-ACC-007, AC-AUTH-001 - Test class/method:
com.lab.labtimesheet.feature.account.controller.AccountWebIntegrationTest.adminCreatesMentorAndInternThenMentorActivatesAuthenticatesAndLogsOut - Implementation commit:
this milestone commit
Protected behavior
An authenticated Admin can use the account form to create pending Mentor and Intern accounts, the intended recipient can follow the emailed activation link and set a first password, normalized email login succeeds, a Mentor is denied the Admin account route, and logout clears authentication. Browser-submitted blank Intern fields do not prevent Mentor creation.
Test method
MockMvc drives the production controllers, Thymeleaf templates, CSRF protection, Spring Security login/logout handlers, JPA services, and PostgreSQL 18.4. SMTP is replaced only at the network boundary by an in-memory recording probe. The test extracts the activation token from that immediate test message without logging or persisting the raw value, then exercises the public activation form.
Hand-derived expected result
The Admin form returns 200. Mentor and Intern submissions redirect to ?created and persist their immutable roles as pending accounts. Activation redirects to /login?activated; login with a case/whitespace variant authenticates the normalized Mentor identity. That session receives 403 at the Admin form and becomes unauthenticated after POST /logout.
RED
Command
export JAVA_HOME=/opt/homebrew/opt/openjdk@25
export PATH="$JAVA_HOME/bin:/opt/homebrew/opt/node@24/bin:$PATH"
export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
./mvnw -Dtest=AccountWebIntegrationTest test
Observed result
GET /admin/accounts/new resolved to ResourceHttpRequestHandler
Status expected:<200> but was:<404>
Tests run: 1, Failures: 1, Errors: 0, Skipped: 0
BUILD FAILURE
After the MVC boundary first reached GREEN, the test was tightened to submit blank Intern controls exactly as the browser form does and observed a second RED:
POST /admin/accounts returned accounts/new with
"Internship fields are allowed only for Intern accounts"
Range for response status value 200 expected:<REDIRECTION> but was:<SUCCESSFUL>
Tests run: 1, Failures: 1, Errors: 0, Skipped: 0
BUILD FAILURE
GREEN
Command
export JAVA_HOME=/opt/homebrew/opt/openjdk@25
export PATH="$JAVA_HOME/bin:/opt/homebrew/opt/node@24/bin:$PATH"
export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
./mvnw -Dtest=AccountWebIntegrationTest test
Observed result
Tests run: 1, Failures: 0, Errors: 0, Skipped: 0
BUILD SUCCESS
Affected suite
Command and result
export JAVA_HOME=/opt/homebrew/opt/openjdk@25
export PATH="$JAVA_HOME/bin:/opt/homebrew/opt/node@24/bin:$PATH"
export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
./mvnw test
Tests run: 10, Failures: 0, Errors: 0, Skipped: 0
BUILD SUCCESS
External-test boundaries
This test does not contact Mailpit or an external SMTP server and is not a real browser/accessibility test. It does not cover activation resend, password reset, account lock/deactivation, session invalidation after credential/state changes, production origin configuration, containerization, CI, or deployment.