95 lines
4.1 KiB
Markdown
95 lines
4.1 KiB
Markdown
# Test Evidence: Validated bootstrap, SMTP, and account onboarding
|
||
|
||
- **Test type:** Web
|
||
- **Requirement IDs:** `ACC-005–ACC-012`, `INT-004`, `INT-006–INT-008`, `SEC-001`
|
||
- **Scenario IDs:** `AC-ACC-003`; `AC-INT-002` (Admin browser boundary)
|
||
- **Test class/method:** `com.lab.labtimesheet.feature.account.controller.BootstrapOnboardingWebIntegrationTest`, `com.lab.labtimesheet.feature.integration.controller.SmtpOnboardingWebIntegrationTest`, `com.lab.labtimesheet.feature.account.controller.AccountWebIntegrationTest#invalidAndDuplicateAccountFormsReturnActionableErrorsWithoutCreatingAnotherAccount`
|
||
- **Implementation commit:** `17fa25bb0921718f780037cd8c55a956bbdf6b19`; SMTP failure feedback added in `8ff6ee3d873db909b1ce9df690f7a3abb2c3c79d`
|
||
|
||
## Protected behavior
|
||
|
||
Bootstrap offers SMTP setup after creating the first Admin. The Admin can save a validated draft, test it, and
|
||
activate only a successful test; or traverse five distinct ordered deferral acknowledgements before finishing.
|
||
Restricted-installation warnings persist until activation. Invalid bootstrap/account/SMTP forms retain only safe
|
||
non-secret values and show actionable errors. All state-changing browser operations require CSRF.
|
||
|
||
## Test method
|
||
|
||
MockMvc drives the production controllers, Bean Validation, Thymeleaf rendering, Spring Security filter chain, JPA
|
||
services, and PostgreSQL 18.4. SMTP is replaced only at its network adapter. The tests inspect rendered status,
|
||
buttons, warnings, validation messages, password non-retention, CSRF denial, ordered deferral navigation, and the
|
||
failed-probe response while verifying that activation remains unavailable and raw adapter diagnostics are absent.
|
||
|
||
## Hand-derived expected result
|
||
|
||
Successful bootstrap lands on `/admin/smtp?onboarding`. A saved draft shows Test but not Activate; a successful test
|
||
shows Activate; activation clears the restricted warning. Deferral exposes warnings one through five in order, Back
|
||
and Configure on every screen, and Finish only on screen five. Invalid data returns HTTP 200 with field/global errors
|
||
and no submitted password. A failed SMTP probe displays fixed operator guidance and leaves the draft untested without
|
||
rendering the adapter's diagnostic.
|
||
|
||
## RED
|
||
|
||
**Command**
|
||
|
||
```text
|
||
export JAVA_HOME=/opt/homebrew/opt/openjdk@25
|
||
export PATH="$JAVA_HOME/bin:$PATH"
|
||
export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
|
||
./mvnw -Dtest=BootstrapOnboardingWebIntegrationTest,SmtpOnboardingWebIntegrationTest test
|
||
```
|
||
|
||
**Observed result**
|
||
|
||
```text
|
||
Tests run: 6, Failures: 5, Errors: 1, Skipped: 0
|
||
Bootstrap redirected to /login instead of SMTP onboarding; deferral returned 404; SMTP status and warning were
|
||
absent; invalid form input raised a validation exception.
|
||
BUILD FAILURE
|
||
```
|
||
|
||
The later failure-feedback regression used this focused command:
|
||
|
||
```text
|
||
./mvnw -Dtest=SmtpOnboardingWebIntegrationTest#failedSmtpTestRendersActionableFeedbackWithoutActivatingTheDraft test
|
||
Tests run: 1, Failures: 1, Errors: 0, Skipped: 0
|
||
Expected the configured connection-refusal message, but smtp/form omitted it.
|
||
BUILD FAILURE
|
||
```
|
||
|
||
## GREEN
|
||
|
||
**Command**
|
||
|
||
```text
|
||
export JAVA_HOME=/opt/homebrew/opt/openjdk@25
|
||
export PATH="$JAVA_HOME/bin:$PATH"
|
||
export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
|
||
./mvnw -Dtest=BootstrapOnboardingWebIntegrationTest,SmtpOnboardingWebIntegrationTest test
|
||
```
|
||
|
||
**Observed result**
|
||
|
||
```text
|
||
Tests run: 7, Failures: 0, Errors: 0, Skipped: 0
|
||
BUILD SUCCESS
|
||
PostgreSQL: 18.4
|
||
```
|
||
|
||
## Affected suite
|
||
|
||
**Command and result**
|
||
|
||
```text
|
||
./mvnw -Dtest=BootstrapIntegrationTest,SmtpOnboardingWebIntegrationTest,AccountActivationIntegrationTest,AccountWebIntegrationTest,BootstrapOnboardingWebIntegrationTest,JavaMailSmtpProbeTest,SecurityResponseIntegrationTest test
|
||
Tests run: 20, Failures: 0, Errors: 0, Skipped: 0
|
||
BUILD SUCCESS
|
||
PostgreSQL: 18.4
|
||
```
|
||
|
||
## External-test boundaries
|
||
|
||
The SMTP adapter is in-memory here, so this does not prove external Mailpit/server interoperability. MockMvc is not a
|
||
real browser or accessibility run. The test uses a non-secret diagnostic fixture only to prove that raw adapter text
|
||
is absent; it never exposes a password, integration secret, or activation bearer token.
|