Quality and coverage strategy¶

The target is 100% line and branch coverage for code that makes a product or security decision. Coverage is evidence of exercised behavior, not the goal by itself.

Test priorities¶

1. Service tests prove state transitions, locking order, idempotency, ownership, validation, and repository interactions.
2. Controller tests prove status codes, delegation, authenticated-principal behavior, and rejected input.
3. Security tests prove JWT validation, filter behavior, authentication rules, and CSRF protection through the MVC boundary.
4. Error-handler tests prove stable public responses and that internal details are not returned.
5. The application-context tests prove that JPA mappings and endpoint wiring still start against the test database.

Generated mapper implementations, data-only entity/model accessors, Mockito artifacts, and framework bootstrap/configuration glue are excluded identically from JaCoCo and Sonar. Any new exclusion requires a reason in the review.

Verification¶

./mvnw clean verify
./mvnw jacoco:report

When a branch is not covered, first decide whether the behavior is missing a test or the code is unnecessarily difficult to exercise. Prefer simplifying the code or adding a focused behavior test. Do not add assertions that only execute dead code, duplicate another test, or preserve an accidental implementation detail.