[patrickbradley-cog]

Summary

W0 regression contract for the Boot 1.5.4 → 4.1 migration: AuthSmokeTest, a MockMvc smoke suite for signup, form login, logout and remember-me. It adds one test file and changes nothing under src/main.

Stacked on #335 (COG-1141, the canonical Testcontainers harness). The base branch is devin/cog-1141-w0-testcontainers-mysql-harness-for-springboottest-boot-154, so the diff shows only this ticket's test. I'll retarget it to master when #335 merges.

Changes from the earlier revision:

• Rebased onto the COG-1141 branch. This PR's own AbstractIntegrationTest, the pom.xml Testcontainers dep, the mysql.version 5.1.49 bump and the UserFrontApplicationTests edit are all dropped. COG-1141: Testcontainers MySQL harness for @SpringBootTest (Boot 1.5.4 / Java 8) #335 now owns those.
• AuthSmokeTest extends AbstractIntegrationTest and uses the inherited protected MockMvc mockMvc.
• Test data is namespaced to this ticket: authsmoke-user / authsmoke-user@[REDACTED SECRET].com (COG-1144 also used smokeuser, and the two collided in one JVM).
• Order independence vs. the static account counter (COG-1179). AccountServiceImpl.nextAccountNumber is a static int that ignores existing rows, so if accounts with the next numbers are already committed, signup's findByAccountNumber throws NonUniqueResultException. The @Before now moves the counter past the highest committed account number (test-side only, via ReflectionTestUtils; the counter only moves forward):

  highest = max(accountNumber over primaryAccountDao.findAll() ∪ savingsAccountDao.findAll())
  if (AccountServiceImpl.nextAccountNumber < highest) nextAccountNumber = highest

• The class stays @Transactional, so each test's user/accounts roll back and nothing leaks into sibling suites.

What the suite asserts (today's behaviour):

• POST /signup stores a $2a$ BCrypt hash, one ROLE_USER and both accounts. These are re-read from the DB after flush()/clear().
• POST /index redirects to /userFront; a bad password redirects to /index?error.
• GET /logout redirects to /index?logout and expires remember-me. The test uses GET on purpose: it proves logoutRequestMatcher still allows GET once W2 turns CSRF on.
• remember-me=on issues a cookie that authenticates a fresh session. That cookie still authenticates after logout (token-based remember-me). The test records this; it doesn't endorse it.

Verification

Temurin 1.8.0_504 and Docker only (no local MySQL).

All four W0 smoke suites in one JVM. Test files copied in uncommitted, unmodified, from COG-1143 3c92928 (MoneyMovementSmokeTest), COG-1144 90a5636 (AppointmentSmokeTest) and COG-1145 3da5d40 (AdminRestSmokeTest, golden/*, fixtures). Command: mvn -B -f UserFront/pom.xml clean verify -Dsurefire.runOrder=<order>

alphabetical:

Tests run: 7, Failures: 0, Errors: 0 - in com.userFront.AdminRestSmokeTest
Tests run: 4, Failures: 0, Errors: 0 - in com.userFront.AppointmentSmokeTest
Tests run: 5, Failures: 0, Errors: 0 - in com.userFront.AuthSmokeTest
Tests run: 9, Failures: 0, Errors: 0 - in com.userFront.MoneyMovementSmokeTest
Tests run: 1, Failures: 0, Errors: 0 - in com.userFront.UserFrontApplicationTests
Tests run: 8, Failures: 0, Errors: 0 - in com.userFront.golden.JsonParseEquivalenceTest
Tests run: 34, Failures: 0, Errors: 0, Skipped: 0
BUILD SUCCESS

reversealphabetical (MoneyMovement runs before Auth):

Tests run: 8, Failures: 0, Errors: 0 - in com.userFront.golden.JsonParseEquivalenceTest
Tests run: 1, Failures: 0, Errors: 0 - in com.userFront.UserFrontApplicationTests
Tests run: 9, Failures: 0, Errors: 0 - in com.userFront.MoneyMovementSmokeTest
Tests run: 5, Failures: 0, Errors: 0 - in com.userFront.AuthSmokeTest
Tests run: 4, Failures: 0, Errors: 0 - in com.userFront.AppointmentSmokeTest
Tests run: 7, Failures: 0, Errors: 0 - in com.userFront.AdminRestSmokeTest
Tests run: 34, Failures: 0, Errors: 0, Skipped: 0
BUILD SUCCESS

Counter-collision guard, forced. A throwaway local test (not committed), ordered first, commits primary and savings accounts at nextAccountNumber + 1..4 and then AuthSmokeTest runs:

• previous AuthSmokeTest (a7c02aa): Tests run: 5, Failures: 4 with IncorrectResultSizeDataAccessException / NonUniqueResultException: result returns more than one elements, BUILD FAILURE
• this revision: Tests run: 5, Failures: 0, BUILD SUCCESS

Ticket: COG-1142

Devin-Org: engineering

Link to Devin session: https://app.devin.ai/sessions/2aa363754ec043a3b0798775bb8b94dd
Open in Devin Desktop: https://app.devin.ai/desktop/session/2aa363754ec043a3b0798775bb8b94dd?variant=devin
Requested by: @patrickbradley-cog

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Devin Review found 1 new potential issue.

🐛 1 issue in files not directly in the diff

🐛 MySQL 8 database connections fail

On MySQL 8, removing mysql.version restores Boot's Connector/J 5.1.42. That driver queries the removed query_cache_size variable, so UserFront cannot connect.

[devin-ai-integration]

Re: Devin Review "MySQL 8 database connections fail" (UserFront/pom.xml). This is not a regression from this PR. The PR diff against its base (#335) touches only AuthSmokeTest.java and does not change pom.xml. mysql.version was never set on master or on the COG-1141 harness branch. It was only set in this PR's earlier, pre-rebase revision, which bumped it to run against MySQL 8. The canonical harness deliberately runs mysql:5.7.44 with the Boot 1.5 default Connector/J 5.1.42 (see the AbstractIntegrationTest javadoc in #335). The Connector/J upgrade and the move to MySQL 8 belong to a later migration ticket, not to this smoke suite. No change made here.