[patrickbradley-cog]

Summary

Smoke tests for the appointment endpoints, part of the Boot 1.5.4 → 4.1 migration (COG-1144). Stacked on #335 (COG-1141 Testcontainers harness). This PR targets that branch so the diff contains only this ticket's test. It will be retargeted to master once #335 merges.

Rebased onto the canonical harness. The PR's own copies of AbstractIntegrationTest, the UserFrontApplicationTests change and the pom test dependencies (Testcontainers 1.20.6, spring-security-test) are dropped. The only file left is AppointmentSmokeTest extends AbstractIntegrationTest, which uses the inherited mockMvc. No production code changes.

Coverage is unchanged (all 4 tests pass against today's 1.5.4 behaviour):

• POST /appointment/create using the datetime-picker format, with the lenient SimpleDateFormat("yyyy-MM-dd hh:mm") results pinned:

  "2016-10-21 15:25" -> 15:25
  "2016-10-21 12:30" -> 00:30   // noon becomes midnight
  

• GET /api/appointment/all as ROLE_ADMIN
• GET /api/appointment/{id}/confirm as ROLE_ADMIN → 200. The request lives in a single confirm(id) helper. When COG-1153: AppointmentResource.confirm → POST (server + AdminPortal caller) #336 (COG-1153, confirm → POST) lands, whichever of the two PRs merges second changes that helper and the expected status.

Test data is kept separate from the sibling smoke suites. The user is now apptsmoke-user / apptsmoke-user@[REDACTED SECRET].com; before, it was the smokeuser that #109 also creates. latestAppointment() also only looks at this user's appointments. The known static account-number counter bug (COG-1179) never fires here: the user is created once through UserService.createUser against a new per-JVM container, and no account rows are inserted directly.

Verification (Temurin 1.8.0_504, Docker 29.7.2)

mvn -B -f UserFront/pom.xml clean verify, this branch only:

Tests run: 4, Failures: 0, Errors: 0, Skipped: 0 - in com.userFront.AppointmentSmokeTest
Tests run: 1, Failures: 0, Errors: 0, Skipped: 0 - in com.userFront.UserFrontApplicationTests
Tests run: 5, Failures: 0, Errors: 0, Skipped: 0
BUILD SUCCESS

Same command with the sibling suites copied in locally and not committed (AuthSmokeTest from COG-1142, MoneyMovementSmokeTest from COG-1143), all in one JVM:

Tests run: 9, Failures: 0, Errors: 0, Skipped: 0 - in com.userFront.MoneyMovementSmokeTest
Tests run: 4, Failures: 0, Errors: 0, Skipped: 0 - in com.userFront.AppointmentSmokeTest
Tests run: 1, Failures: 0, Errors: 0, Skipped: 0 - in com.userFront.UserFrontApplicationTests
Tests run: 5, Failures: 0, Errors: 0, Skipped: 0 - in com.userFront.AuthSmokeTest
Tests run: 19, Failures: 0, Errors: 0, Skipped: 0
BUILD SUCCESS

Devin-Org: engineering

Link to Devin session: https://app.devin.ai/sessions/3458130a8d5d4e9b996031fa9ec32800
Open in Devin Desktop: https://app.devin.ai/desktop/session/3458130a8d5d4e9b996031fa9ec32800?variant=devin
Requested by: @patrickbradley-cog

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Devin Review found 2 potential issues.

[devin-ai-integration]

🔍 Form smoke test skips browser submission

MockMvc posts form fields directly, so it never exercises the date picker or confirmation callback that submits the browser form. A broken client-side submission can leave these tests green.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

Intentional — COG-1144 asks for server-side smoke coverage of the controller's date parsing. The picker format is pinned by sending exactly what main.js emits; client-side submission is out of scope here.

[devin-ai-integration]

🔍 Admin tests use synthetic authentication

user("admin").roles("ADMIN") bypasses database-backed admin login. The tests exercise endpoint authorization, but cannot detect broken admin account or role loading.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

Deliberate: these tests are the migration regression contract for the appointment endpoints, so they assert route/verb/role behaviour, not admin account provisioning. A DB-backed admin login belongs in a separate auth smoke test.