test: spec-driven acceptance suite for Article Comments (issue #188, AC1–AC14)

[devin-ai-integration]

Summary

Adds a spec-driven automated test suite covering every acceptance criterion (AC1–AC14) of the Article Comments feature spec (#188). Tests only — no production code and no existing tests were modified. Two new files, split by tier so each AC is validated at the lowest faithful level:

• src/test/java/io/spring/api/CommentsApiAcceptanceTest.java — REST API tier (@WebMvcTest(CommentsApi.class) + WebSecurityConfig, REST-Assured MockMvc), covering the create/list/delete endpoints and their auth/validation contracts (401/403/404/422, author-profile shape, creation-order, removal).
• src/test/java/io/spring/application/comment/CommentReadModelTest.java — read-model/service tier (CommentQueryService over DbTestBase H2), covering the real follow-state and per-comment author-profile/timestamp behavior that a mocked query service can't validate.

Existing coverage in CommentsApiTest and CommentQueryServiceTest is reused (not duplicated); the matrix below references those existing tests where they already cover an AC, and the new tests fill the gaps.

Spec note (finding, not a change)

AC1 states the create endpoint returns 200, but CommentsApi.createComment returns 201 Created (matching the existing CommentsApiTest.should_create_comment_success). Per the playbook I did not modify production code; the tests assert the actual 201 and this discrepancy is surfaced here for the spec owner to reconcile.

Traceability matrix (AC → covering test)

AC	Behavior	Tier	Covering test(s)
AC1	Auth user, non-empty body → 201*, comment.body matches input	API	CommentsApiAcceptanceTest.createComment_returnsAuthorProfile; existing CommentsApiTest.should_create_comment_success
AC2	Response includes comment.author (username, bio, image, following)	API	CommentsApiAcceptanceTest.createComment_returnsAuthorProfile
AC3	Empty/blank body → 422 validation error	API	existing CommentsApiTest.should_get_422_with_empty_body (empty); CommentsApiAcceptanceTest.createComment_blankBody_returns422 (blank)
AC4	Unauthenticated create → 401	API	CommentsApiAcceptanceTest.createComment_unauthenticated_returns401
AC5	Create on non-existent article → 404	API	CommentsApiAcceptanceTest.createComment_missingArticle_returns404
AC6	List existing article → 200, comments array in creation order	API	CommentsApiAcceptanceTest.listComments_preservesCreationOrder; existing CommentsApiTest.should_get_comments_of_article_success
AC7	Auth viewer → each author.following reflects follow state	service	CommentReadModelTest.followingReflectsViewerFollowState
AC8	Anonymous viewer lists comments, following=false	API + service	CommentsApiAcceptanceTest.listComments_anonymous_followingFalse; CommentReadModelTest.anonymousViewerSeesFollowingFalse
AC9	List on non-existent article → 404	API	CommentsApiAcceptanceTest.listComments_missingArticle_returns404
AC10	Author deletes own comment → 204 and removed	API	CommentsApiAcceptanceTest.deleteComment_byAuthor_returns204AndRemoves (asserts commentRepository.remove); existing CommentsApiTest.should_delete_comment_success
AC11	Deleting another user's comment → 403	API	existing CommentsApiTest.should_get_403_if_not_author_of_article_or_author_of_comment_when_delete_comment
AC12	Unauthenticated delete → 401	API	CommentsApiAcceptanceTest.deleteComment_unauthenticated_returns401
AC13	Delete non-existent comment id → 404	API	CommentsApiAcceptanceTest.deleteComment_missingComment_returns404
AC14	Read model returns correct author profile + creation timestamp per comment	service	CommentReadModelTest.readModelReturnsAuthorProfileAndTimestampPerComment

* See spec note above re: AC1 (201 vs 200).

Run command

./gradlew clean test spotlessCheck -x jacocoTestCoverageVerification

This mirrors the repo's CI gate (.github/workflows/gradle.yml runs ./gradlew clean test -x jacocoTestCoverageVerification). Result: BUILD SUCCESSFUL, 81 tests, 0 failed (was 68); Spotless clean.

Coverage before → after

Repo-wide jacocoTestCoverageVerification (80% instruction rule) is excluded from the CI gate and fails pre-existing on main (~34% line); this PR does not change that rule or the build config. Coverage on the classes touched by the spec:

Class	Metric	Before	After
io.spring.api.CommentsApi	line / branch	100% / 100%	100% / 100%
io.spring.application.CommentQueryService	line / branch	51.2% / 25.0%	51.2% / 30.0%

CommentsApi line coverage was already saturated by existing tests; the new API tests add the missing behavioral assertions (401/404 paths, blank body, author-profile shape, ordering, removal verification, anonymous follow state). CommentQueryService branch coverage improves via the real follow-state / anonymous paths (its remaining uncovered lines are the out-of-scope findByArticleIdWithCursor cursor method).

Assumptions

• AC1 "200" interpreted as the implemented 201 (see spec note).
• AC6 "creation order" validated as the endpoint preserving the query service's returned order (the findByArticleId SQL has no explicit ORDER BY; comments are returned in natural insertion order).

Closes #188

Link to Devin session: https://partner-workshops.devinenterprise.com/sessions/7569f8f87acf4e4085811288d43960d4
Requested by: @mbatchelor81

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring