test(mfa): rename tests to follow naming convention and add enforcement test

Rename 11 test methods across MfaConfigurationTest and
MfaFeatureEnabledIntegrationTest to follow the project's
should[ExpectedBehavior]When[Condition] naming convention.

Add integration test verifying that the
DelegatingMissingAuthorityAccessDeniedHandler redirects to the
password entry-point URI when a user is missing the PASSWORD factor
authority.

Author: devondragon

src/test/java/com/digitalsanctuary/spring/user/api/MfaFeatureEnabledIntegrationTest.java

@@ -4,6 +4,7 @@
 import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.user;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.redirectedUrlPattern;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
 import java.util.Set;
 import java.util.stream.Collectors;
@@ -47,7 +48,7 @@ void shouldRegisterMfaBeansAndMappingsWhenEnabled() {
 
 	@Test
 	@DisplayName("should return MFA status for authenticated user")
-	void shouldReturnMfaStatusForAuthenticatedUser() throws Exception {
+	void shouldReturnMfaStatusWhenUserIsAuthenticated() throws Exception {
 		mockMvc.perform(get("/user/mfa/status").with(user("user@test.com").roles("USER")))
 				.andExpect(status().isOk())
 				.andExpect(jsonPath("$.success").value(true))
@@ -58,7 +59,7 @@ void shouldReturnMfaStatusForAuthenticatedUser() throws Exception {
 
 	@Test
 	@DisplayName("should return MFA status for unauthenticated request")
-	void shouldReturnMfaStatusForUnauthenticatedRequest() throws Exception {
+	void shouldReturnMfaStatusWhenRequestIsUnauthenticated() throws Exception {
 		// The MFA status endpoint should be accessible without full authentication
 		// since it's added to unprotected URIs
 		mockMvc.perform(get("/user/mfa/status"))
@@ -70,12 +71,23 @@ void shouldReturnMfaStatusForUnauthenticatedRequest() throws Exception {
 
 	@Test
 	@DisplayName("should report PASSWORD as missing factor when user has no password authority")
-	void shouldReportPasswordAsMissingFactor() throws Exception {
+	void shouldReportPasswordAsMissingFactorWhenUserLacksAuthority() throws Exception {
 		// A standard user login via MockMvc's .with(user()) does not add FactorGrantedAuthority,
 		// so PASSWORD should be reported as missing
 		mockMvc.perform(get("/user/mfa/status").with(user("user@test.com").roles("USER")))
 				.andExpect(status().isOk())
 				.andExpect(jsonPath("$.data.missingFactors[0]").value("PASSWORD"))
 				.andExpect(jsonPath("$.data.fullyAuthenticated").value(false));
 	}
+
+	@Test
+	@DisplayName("should redirect to password entry point when user is missing password factor authority")
+	void shouldRedirectToPasswordEntryPointWhenMissingFactorAuthority() throws Exception {
+		// A user with ROLE_USER but no FactorGrantedAuthority hits a protected endpoint.
+		// The DelegatingMissingAuthorityAccessDeniedHandler should redirect to the
+		// password entry-point URI since the PASSWORD factor is not satisfied.
+		mockMvc.perform(get("/protected.html").with(user("user@test.com").roles("USER")))
+				.andExpect(status().is3xxRedirection())
+				.andExpect(redirectedUrlPattern(mfaConfigProperties.getPasswordEntryPointUri() + "**"));
+	}
 }

src/test/java/com/digitalsanctuary/spring/user/security/MfaConfigurationTest.java

@@ -31,21 +31,21 @@ class MapFactorToAuthority {
 
 		@Test
 		@DisplayName("should map PASSWORD to FactorGrantedAuthority.PASSWORD_AUTHORITY")
-		void shouldMapPasswordFactor() {
+		void shouldMapToPasswordAuthorityWhenPasswordFactorGiven() {
 			assertThat(MfaConfiguration.mapFactorToAuthority("PASSWORD"))
 					.isEqualTo(FactorGrantedAuthority.PASSWORD_AUTHORITY);
 		}
 
 		@Test
 		@DisplayName("should map WEBAUTHN to FactorGrantedAuthority.WEBAUTHN_AUTHORITY")
-		void shouldMapWebauthnFactor() {
+		void shouldMapToWebauthnAuthorityWhenWebauthnFactorGiven() {
 			assertThat(MfaConfiguration.mapFactorToAuthority("WEBAUTHN"))
 					.isEqualTo(FactorGrantedAuthority.WEBAUTHN_AUTHORITY);
 		}
 
 		@Test
 		@DisplayName("should be case-insensitive")
-		void shouldBeCaseInsensitive() {
+		void shouldMapCorrectlyWhenFactorNameIsLowercase() {
 			assertThat(MfaConfiguration.mapFactorToAuthority("password"))
 					.isEqualTo(FactorGrantedAuthority.PASSWORD_AUTHORITY);
 			assertThat(MfaConfiguration.mapFactorToAuthority("webauthn"))
@@ -54,7 +54,7 @@ void shouldBeCaseInsensitive() {
 
 		@Test
 		@DisplayName("should return null for unknown factor")
-		void shouldReturnNullForUnknownFactor() {
+		void shouldReturnNullWhenFactorIsUnknown() {
 			assertThat(MfaConfiguration.mapFactorToAuthority("UNKNOWN")).isNull();
 		}
 	}
@@ -65,7 +65,7 @@ class ResolveFactorAuthorities {
 
 		@Test
 		@DisplayName("should resolve configured factors to authority strings")
-		void shouldResolveConfiguredFactors() {
+		void shouldResolveAuthoritiesWhenFactorsConfigured() {
 			mfaConfigProperties.setFactors(List.of("PASSWORD", "WEBAUTHN"));
 			List<String> authorities = mfaConfiguration.resolveFactorAuthorities();
 			assertThat(authorities).containsExactly(
@@ -75,14 +75,14 @@ void shouldResolveConfiguredFactors() {
 
 		@Test
 		@DisplayName("should return empty list for empty factors")
-		void shouldReturnEmptyForEmptyFactors() {
+		void shouldReturnEmptyListWhenNoFactorsConfigured() {
 			mfaConfigProperties.setFactors(List.of());
 			assertThat(mfaConfiguration.resolveFactorAuthorities()).isEmpty();
 		}
 
 		@Test
 		@DisplayName("should skip unknown factors")
-		void shouldSkipUnknownFactors() {
+		void shouldSkipUnknownWhenMixedFactorsConfigured() {
 			mfaConfigProperties.setFactors(List.of("PASSWORD", "UNKNOWN"));
 			List<String> authorities = mfaConfiguration.resolveFactorAuthorities();
 			assertThat(authorities).containsExactly(FactorGrantedAuthority.PASSWORD_AUTHORITY);
@@ -144,7 +144,7 @@ void shouldNotThrowWhenWebauthnFactorAndWebauthnEnabled() {
 
 		@Test
 		@DisplayName("should not throw for PASSWORD-only configuration")
-		void shouldNotThrowForPasswordOnly() {
+		void shouldNotThrowWhenPasswordOnlyConfigured() {
 			mfaConfigProperties.setEnabled(true);
 			mfaConfigProperties.setFactors(List.of("PASSWORD"));
 			// Should not throw (but will log a warning)