Testing and Quality

Testing and Quality

Running the tests

./gradlew test

Tests use JUnit 5, MockK, and WebTestClient, plus a Testcontainers-backed Redis test for the distributed rate limiter (needs Docker). A JaCoCo coverage report is written to build/reports/jacoco/test/html/index.html.

What's covered

• Services (MockK): auth, customers, rate limiter.
• Full HTTP flows (WebTestClient): login, /api/me, customer CRUD + search/pagination/sort, the role matrix (a pass and a 403 per protected endpoint), validation (400), duplicate email (409), the audit trail, CORS, and password change.
• Distributed limiter: per-IP isolation and 429 against real Redis (Testcontainers).

The suite runs with JWT_SECRET injected and rate limiting disabled by default, and runs on every push in CI (see CI CD Pipeline).

API tests (Postman / Newman)

The postman/ collection covers the Auth / User / Admin / Customers / Docs areas with assertions, including negative cases (e.g. an invalid email → 400). Run it headless from the repo root:

npx newman run postman/customer-management.postman_collection.json \
  -e postman/customer-management-local.postman_environment.json

A green run reports 0 failures across all requests and assertions. See postman/README.md for the full guide.