cd /workspace/backend
./mvnw test -Dtest="*SecurityTest"

# Authentication Security
./mvnw test -Dtest=AuthControllerSecurityTest

# JWT Token Security
./mvnw test -Dtest=JwtTokenSecurityTest

# Password Security
./mvnw test -Dtest=PasswordSecurityTest

# Security Headers & CORS
./mvnw test -Dtest=SecurityHeadersTest

# Rate Limiting & DDoS
./mvnw test -Dtest=RateLimitingSecurityTest

./mvnw clean test jacoco:report
open target/site/jacoco/index.html

@Test
void testSqlInjectionProtection_Login() {
    // Verifies SQL injection is blocked
}

@Test
void testValidateToken_WrongSignature() {
    // Verifies tampered tokens are rejected
}

@Test
void testPasswordHashing_UniqueSalts() {
    // Verifies each password gets unique salt
}

@Test
void testCors_LocalhostOriginsAllowed() {
    // Verifies CORS from localhost:4200
}

@Test
void testBruteForceProtection_MultipleFailedLogins() {
    // Verifies system handles brute force attacks
}

@Test
void testSqlInjection() {
    String maliciousInput = "' OR '1'='1' --";

    mockMvc.perform(post("/api/auth/login")
            .contentType(MediaType.APPLICATION_JSON)
            .content("{\"email\":\"" + maliciousInput + "\"}"))
        .andExpect(status().isUnauthorized());
}

@Test
void testXssProtection() {
    String xssAttempt = "<script>alert('XSS')</script>";
    RegisterRequest request = RegisterRequest.builder()
        .firstName(xssAttempt)
        .build();

    mockMvc.perform(post("/api/auth/register")
            .content(objectMapper.writeValueAsString(request)))
        .andExpect(status().isBadRequest());
}

@Test
void testJwtValidation() {
    String token = jwtTokenProvider.generateToken(userDetails);

    assertTrue(jwtTokenProvider.isTokenValid(token, userDetails));
}

@Test
void testPasswordStrength() {
    String weakPassword = "weak";

    assertFalse(isPasswordStrong(weakPassword));
}

@Test
void testSecurityHeaders() {
    mockMvc.perform(get("/api/jobs"))
        .andExpect(header().exists("X-Frame-Options"))
        .andExpect(header().exists("X-XSS-Protection"));
}

./mvnw clean install
./mvnw test -Dtest="*SecurityTest"

# application-test.yml
security:
  jwt:
    secret: test-secret-key-minimum-256-bits-long

# Run without rate limiting tests
./mvnw test -Dtest="*SecurityTest" -Dtest="!RateLimitingSecurityTest"

// Good
@Test
@DisplayName("Should reject SQL injection in login email field")
void testSqlInjectionProtection_Login() { }

// Bad
@Test
void test1() { }

// Good
assertFalse(isPasswordStrong(weakPassword),
    "Weak passwords should be rejected");

// Bad
assertFalse(isPasswordStrong(weakPassword));

@ParameterizedTest
@ValueSource(strings = {"admin", "password", "123456"})
void testCommonPasswords(String password) {
    assertTrue(isCommonPassword(password));
}

name: Security Tests

on: [push, pull_request]

jobs:
  security-tests:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Set up JDK 17
        uses: actions/setup-java@v3
        with:
          java-version: '17'
      - name: Run Security Tests
        run: ./mvnw test -Dtest="*SecurityTest"
      - name: Generate Coverage Report
        run: ./mvnw jacoco:report
      - name: Upload Coverage
        uses: codecov/codecov-action@v3

# application-test.yml
logging:
  level:
    nl.glorylabs: DEBUG
    org.springframework.security: DEBUG

./mvnw test -Dtest=AuthControllerSecurityTest#testSqlInjectionProtection_Login -X

# HTML report
open target/surefire-reports/index.html

# Console output
cat target/surefire-reports/TEST-*.xml

find backend/src/test -name "*Security*Test.java"

grep -r "@Test" backend/src/test/java/*Security* | wc -l

./mvnw jacoco:report
grep -A 3 "Total" target/site/jacoco/index.html

./mvnw test -Dtest="*SecurityTest" -DforkCount=4