Test Evidence: Validated bootstrap, SMTP, and account onboarding

Test type: Web
Requirement IDs: ACC-005–ACC-012, INT-004, INT-006–INT-008, SEC-001
Scenario IDs: AC-ACC-003; AC-INT-002 (Admin browser boundary)
Test class/method: com.lab.labtimesheet.feature.account.controller.BootstrapOnboardingWebIntegrationTest, com.lab.labtimesheet.feature.integration.controller.SmtpOnboardingWebIntegrationTest, com.lab.labtimesheet.feature.account.controller.AccountWebIntegrationTest#invalidAndDuplicateAccountFormsReturnActionableErrorsWithoutCreatingAnotherAccount
Implementation commit: 17fa25bb0921718f780037cd8c55a956bbdf6b19; SMTP failure feedback added in 8ff6ee3d873db909b1ce9df690f7a3abb2c3c79d

Protected behavior

Bootstrap offers SMTP setup after creating the first Admin. The Admin can save a validated draft, test it, and activate only a successful test; or traverse five distinct ordered deferral acknowledgements before finishing. Restricted-installation warnings persist until activation. Invalid bootstrap/account/SMTP forms retain only safe non-secret values and show actionable errors. All state-changing browser operations require CSRF.

Test method

MockMvc drives the production controllers, Bean Validation, Thymeleaf rendering, Spring Security filter chain, JPA services, and PostgreSQL 18.4. SMTP is replaced only at its network adapter. The tests inspect rendered status, buttons, warnings, validation messages, password non-retention, CSRF denial, ordered deferral navigation, and the failed-probe response while verifying that activation remains unavailable and raw adapter diagnostics are absent.

Hand-derived expected result

Successful bootstrap lands on /admin/smtp?onboarding. A saved draft shows Test but not Activate; a successful test shows Activate; activation clears the restricted warning. Deferral exposes warnings one through five in order, Back and Configure on every screen, and Finish only on screen five. Invalid data returns HTTP 200 with field/global errors and no submitted password. A failed SMTP probe displays fixed operator guidance and leaves the draft untested without rendering the adapter's diagnostic.

RED

Command

export JAVA_HOME=/opt/homebrew/opt/openjdk@25
export PATH="$JAVA_HOME/bin:$PATH"
export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
./mvnw -Dtest=BootstrapOnboardingWebIntegrationTest,SmtpOnboardingWebIntegrationTest test

Observed result

Tests run: 6, Failures: 5, Errors: 1, Skipped: 0
Bootstrap redirected to /login instead of SMTP onboarding; deferral returned 404; SMTP status and warning were
absent; invalid form input raised a validation exception.
BUILD FAILURE

The later failure-feedback regression used this focused command:

./mvnw -Dtest=SmtpOnboardingWebIntegrationTest#failedSmtpTestRendersActionableFeedbackWithoutActivatingTheDraft test
Tests run: 1, Failures: 1, Errors: 0, Skipped: 0
Expected the configured connection-refusal message, but smtp/form omitted it.
BUILD FAILURE

GREEN

Command

export JAVA_HOME=/opt/homebrew/opt/openjdk@25
export PATH="$JAVA_HOME/bin:$PATH"
export DOCKER_HOST=unix:///Users/sechmachine/.orbstack/run/docker.sock
./mvnw -Dtest=BootstrapOnboardingWebIntegrationTest,SmtpOnboardingWebIntegrationTest test

Observed result

Tests run: 7, Failures: 0, Errors: 0, Skipped: 0
BUILD SUCCESS
PostgreSQL: 18.4

Affected suite

Command and result

./mvnw -Dtest=BootstrapIntegrationTest,SmtpOnboardingWebIntegrationTest,AccountActivationIntegrationTest,AccountWebIntegrationTest,BootstrapOnboardingWebIntegrationTest,JavaMailSmtpProbeTest,SecurityResponseIntegrationTest test
Tests run: 20, Failures: 0, Errors: 0, Skipped: 0
BUILD SUCCESS
PostgreSQL: 18.4

External-test boundaries

The SMTP adapter is in-memory here, so this does not prove external Mailpit/server interoperability. MockMvc is not a real browser or accessibility run. The test uses a non-secret diagnostic fixture only to prove that raw adapter text is absent; it never exposes a password, integration secret, or activation bearer token.

4.1 KiB Raw Blame History Unescape Escape