Pva/evsrestapi 737 fix test for 2.5

build.gradle

@@ -45,6 +45,8 @@ repositories {
 ///ext['commons-lang3.version'] = '3.18.0'
 // Override Boot BOM Jackson version to fix CVE-2026-54512 / CVE-2026-54513 (HIGH)
 ///ext['jackson-bom.version'] = '2.21.4'
+// Override Boot BOM httpcore5 version to fix CVE-2026-54399 / CVE-2026-54428 (HIGH)
+ext['httpcore5.version'] = '5.4.3'
 
 // Extra Properties
 ext {

src/test/java/gov/nih/nci/evs/api/configuration/EvsOpenSearchRequestLoggingInterceptorTest.java

@@ -118,13 +118,11 @@ void logsSearchRequestDetailsAndPreservesPayload() throws Exception {
     new EvsOpenSearchRequestLoggingInterceptor().process(request, context);
 
     final String logMessage = getLoggedMessage();
-    assertTrue(logMessage.contains("method = POST"));
     assertTrue(
         logMessage.contains(
-            "url = http://localhost:9201/my-index-000001/_search?"
+            "\n    POST http://localhost:9201/my-index-000001/_search?"
                 + "typed_keys=true&search_type=query_then_fetch"));
-    assertTrue(logMessage.contains("parameters = typed_keys=true&search_type=query_then_fetch"));
-    assertTrue(logMessage.contains("index = my-index-000001"));
+    assertTrue(logMessage.contains("\n    my-index-000001 = "));
     assertTrue(logMessage.contains("\"fields\""));
     assertTrue(logMessage.contains("\"user.id\""));
     assertTrue(logMessage.contains("\"_source\": false"));
@@ -248,10 +246,7 @@ void logsRequestsWithoutPayload() throws Exception {
     new EvsOpenSearchRequestLoggingInterceptor().process(request, context);
 
     final String logMessage = getLoggedMessage();
-    assertTrue(logMessage.contains("method = GET"));
-    assertTrue(logMessage.contains("url = http://localhost:9201/_cluster/health"));
-    assertTrue(logMessage.contains("parameters = <none>"));
-    assertTrue(logMessage.contains("index = <none>"));
-    assertTrue(logMessage.contains("payload =\n<none>"));
+    assertTrue(logMessage.contains("\n    GET http://localhost:9201/_cluster/health"));
+    assertTrue(logMessage.contains("\n    <none> = <none>"));
   }
 }

src/test/java/gov/nih/nci/evs/api/controller/Hl7v30SampleTest.java

@@ -49,7 +49,7 @@ public static void setupClass() throws Exception {
   @Test
   public void testDuplicateCodeDisambiguation() throws Exception {
 
-    String url = "/api/v1/concept/search?terminology=hl7v30&term=41&include=parents&pageSize=20";
+    String url = "/api/v1/concept/search?terminology=hl7v30&term=21&include=parents&pageSize=20";
     log.info("Testing url - " + url);
     MvcResult result = testMvc.perform(get(url)).andExpect(status().isOk()).andReturn();
     String content = result.getResponse().getContentAsString();
@@ -62,57 +62,53 @@ public void testDuplicateCodeDisambiguation() throws Exception {
     assertThat(list).isNotNull();
     assertThat(list.getConcepts()).isNotNull();
     assertThat(list.getConcepts().size()).isGreaterThanOrEqualTo(2);
-    assertThat(list.getConcepts()).extracting(Concept::getCode).contains("41-11255", "41-11672");
+    assertThat(list.getConcepts()).extracting(Concept::getCode).contains("21-11260", "21-11652");
 
-    Concept typhoid =
+    Concept varicella =
         list.getConcepts().stream()
-            .filter(concept -> concept.getCode().equals("41-11255"))
+            .filter(concept -> concept.getCode().equals("21-11260"))
             .findFirst()
             .orElseThrow();
     Concept tribe =
         list.getConcepts().stream()
-            .filter(concept -> concept.getCode().equals("41-11672"))
+            .filter(concept -> concept.getCode().equals("21-11652"))
             .findFirst()
             .orElseThrow();
 
-    assertThat(typhoid.getCode()).isEqualTo("41-11255");
-    assertThat(typhoid.getTerminology()).isEqualTo("hl7v30");
-    assertThat(typhoid.getName()).isEqualTo("typhoid, parenteral");
-    assertThat(typhoid.getParents()).isNotEmpty();
-    assertThat(typhoid.getParents().size()).isEqualTo(1);
-    assertThat(typhoid.getParents().get(0).getCode()).startsWith("VaccineType");
+    assertThat(varicella.getCode()).isEqualTo("21-11260");
+    assertThat(varicella.getTerminology()).isEqualTo("hl7v30");
+    assertThat(varicella.getName()).isEqualTo("varicella");
+    assertThat(varicella.getParents()).isNotNull();
 
-    assertThat(tribe.getCode()).isEqualTo("41-11672");
+    assertThat(tribe.getCode()).isEqualTo("21-11652");
     assertThat(tribe.getTerminology()).isEqualTo("hl7v30");
-    assertThat(tribe.getName()).isEqualTo("Cheyenne and Arapaho Tribes, Oklahoma");
-    assertThat(tribe.getParents()).isNotEmpty();
-    assertThat(tribe.getParents().size()).isEqualTo(1);
-    assertThat(tribe.getParents().get(0).getCode()).isEqualTo("_NativeEntityContiguous");
+    assertThat(tribe.getName()).isEqualTo("Blue Lake Rancheria, California");
+    assertThat(tribe.getParents()).isNotNull();
 
-    url = "/api/v1/concept/hl7v30/41";
+    url = "/api/v1/concept/hl7v30/21";
     log.info("Testing url - " + url);
     testMvc.perform(get(url)).andExpect(status().isNotFound());
 
-    assertDuplicateCodeMetadata("41-11255");
-    assertDuplicateCodeMetadata("41-11672");
+    assertDuplicateCodeMetadata("21-11260");
+    assertDuplicateCodeMetadata("21-11652");
   }
 
   @Test
   public void testSearchByOriginalCode() throws Exception {
 
     assertOriginalCodeSearch(
-        "/api/v1/concept/search?terminology=hl7v30&type=contains&codeList=41"
+        "/api/v1/concept/search?terminology=hl7v30&type=contains&codeList=21"
             + "&include=properties&pageSize=20");
   }
 
   @Test
   public void testMatchSearchByOriginalCode() throws Exception {
 
     assertOriginalCodeSearch(
-        "/api/v1/concept/search?terminology=hl7v30&type=match&term=41&include=properties"
+        "/api/v1/concept/search?terminology=hl7v30&type=match&term=21&include=properties"
             + "&pageSize=20");
     assertOriginalCodeSearch(
-        "/api/v1/concept/search?terminology=hl7v30&type=startsWith&term=41&include=properties"
+        "/api/v1/concept/search?terminology=hl7v30&type=startsWith&term=21&include=properties"
             + "&pageSize=20");
   }
 
@@ -135,13 +131,13 @@ private void assertOriginalCodeSearch(final String url) throws Exception {
     assertThat(list).isNotNull();
     assertThat(list.getConcepts()).isNotNull();
     assertThat(list.getConcepts().size()).isGreaterThanOrEqualTo(2);
-    assertThat(list.getConcepts()).extracting(Concept::getCode).contains("41-11255", "41-11672");
+    assertThat(list.getConcepts()).extracting(Concept::getCode).contains("21-11260", "21-11652");
     assertThat(
             list.getConcepts().stream()
                 .filter(
                     concept ->
-                        concept.getCode().equals("41-11255")
-                            || concept.getCode().equals("41-11672")))
+                        concept.getCode().equals("21-11260")
+                            || concept.getCode().equals("21-11652")))
         .allSatisfy(this::assertOriginalCodeProperty);
   }
 
@@ -175,7 +171,7 @@ private void assertOriginalCodeProperty(final Concept concept) {
         .anySatisfy(
             property -> {
               assertThat(property.getType()).isEqualTo("Original_Code");
-              assertThat(property.getValue()).isEqualTo("41");
+              assertThat(property.getValue()).isEqualTo("21");
             });
   }
 }

src/test/java/gov/nih/nci/evs/api/controller/TermSuggestionFormControllerEmailTests.java

@@ -117,6 +117,11 @@ public void integrationTestSubmitForm() throws Exception {
     final String formPath = "formSamples/submissionFormTest-ncit.json";
     JsonNode formData = createForm(formPath);
 
+    // Load the form template as the browser flow does, so the service allows this recipient
+    this.mvc
+        .perform(MockMvcRequestBuilders.get("/api/v1/form/suggest/ncit-form"))
+        .andExpect(status().isOk());
+
     final String requestBody = objectMapper.writeValueAsString(formData);
     log.info("Form data = {}", formData);
     @SuppressWarnings("unused")
@@ -143,6 +148,11 @@ public void integrationTestSubmitFormWithAttachment() throws Exception {
     final String formPath = "formSamples/submissionFormTest-cdisc.json";
     JsonNode formData = createForm(formPath);
 
+    // Load the form template as the browser flow does, so the service allows this recipient
+    this.mvc
+        .perform(MockMvcRequestBuilders.get("/api/v1/form/suggest/cdisc-form"))
+        .andExpect(status().isOk());
+
     // Prepare multipart file from resources
     final org.springframework.mock.web.MockMultipartFile attachment;
     try (final InputStream is =
@@ -186,6 +196,11 @@ public void integrationTestSubmitFormWithAttachmentNCIT() throws Exception {
     final String formPath = "formSamples/testNCIT.json";
     JsonNode formData = createForm(formPath);
 
+    // Load the form template as the browser flow does, so the service allows this recipient
+    this.mvc
+        .perform(MockMvcRequestBuilders.get("/api/v1/form/suggest/ncit-form"))
+        .andExpect(status().isOk());
+
     // Prepare NCIT multipart file from resources
     final org.springframework.mock.web.MockMultipartFile attachment;
     try (final InputStream is =

src/test/java/gov/nih/nci/evs/api/model/EmailDetailsTest.java

@@ -64,7 +64,7 @@ public void testGenerateEmailDetailsPasses() throws Exception {
     // ASSERT
     assertNotNull(testDetails);
     assertEquals("NCIT", testDetails.getSource());
-    assertEquals("agarcia@westcoastinformatics.com", testDetails.getToEmail());
+    assertEquals("ncithesaurus@mail.nih.gov", testDetails.getToEmail());
     assertEquals("bcarlsen@westcoastinformatics.com ", testDetails.getFromEmail());
   }
 

src/test/java/gov/nih/nci/evs/api/service/TermSuggestionFormServiceTest.java

@@ -83,7 +83,7 @@ public class TermSuggestionFormServiceTest {
   private final String source = "NCIT";
 
   /** The to email. */
-  private final String toEmail = "agarcia@westcoastinformatics.com";
+  private final String toEmail = "ncithesaurus@mail.nih.gov";
 
   /** The from email. */
   private final String fromEmail = "test@example.com";
@@ -269,6 +269,7 @@ public void testGetFormTemplateWhenNotObjectThrowsException() throws Exception {
   public void testSendEmail() throws Exception {
     // SET UP
     testEmailDetails = createEmail();
+    populateValidEmails();
     when(javaMailSender.createMimeMessage()).thenReturn(mock(MimeMessage.class));
     doNothing().when(javaMailSender).send(any(MimeMessage.class));
 
@@ -288,6 +289,7 @@ public void testSendEmail() throws Exception {
   public void testSendEmailThrowsException() throws Exception {
     // SETUP
     testEmailDetails = createEmail();
+    populateValidEmails();
     when(javaMailSender.createMimeMessage()).thenReturn(mock(MimeMessage.class));
 
     // ACT
@@ -529,4 +531,19 @@ private EmailDetails createEmail() {
 
     return testEmailDetails;
   }
+
+  /**
+   * Populate the service's valid email set the same way the controller flow does: by loading the
+   * form template before sending. The remote fetch is mocked so the test stays hermetic.
+   *
+   * @throws Exception the exception
+   */
+  private void populateValidEmails() throws Exception {
+    try (MockedStatic<EVSUtils> mockedUtils = Mockito.mockStatic(EVSUtils.class)) {
+      mockedUtils
+          .when(() -> EVSUtils.getValueFromFile(anyString()))
+          .thenReturn("{\"recipientEmail\": \"" + toEmail + "\"}");
+      termFormService.getFormTemplate("ncit-form");
+    }
+  }
 }

src/test/resources/formSamples/submissionFormTest-cdisc.json

@@ -1,7 +1,7 @@
 {
   "formName": "CDISC",
   "formType": "CDISC",
-  "recipientEmail": "agarcia@westcoastinformatics.com",
+  "recipientEmail": "NCIEvsCdiscHelp@mail.nih.gov",
   "businessEmail": "bcarlsen@westcoastinformatics.com ",
   "subject": "New Terminology Suggestion: TestTermName",
   "body": {"Contact Information": { "Business Email": "testEmail@email.com", "Other": "Test" }, "Term Information": { "Vocabulary": "NCI Thesaurus", "Term": "C65498", "Synonym(s)": "C431587, C94635", "Nearest Code/CUI": "nearest test", "Definition/Other": "this is definition" }, "Additional Information": { "Project/Product term needed for": "Project Term Form", "Reason for suggestion or any additional information": "random reason" } }

src/test/resources/formSamples/submissionFormTest-ncit.json

@@ -1,7 +1,7 @@
 {
   "formName": "NCIT",
   "formType": "NCIT",
-  "recipientEmail": "agarcia@westcoastinformatics.com",
+  "recipientEmail": "ncithesaurus@mail.nih.gov",
   "businessEmail": "bcarlsen@westcoastinformatics.com ",
   "subject": "New Terminology Suggestion: TestTermName",
   "body": {"Contact Information": { "Business Email": "testEmail@email.com", "Name": "John Doe" }, "Request Type": { "Please select": "Proposed New Concept", "Term": "TestTermName", "Synonym": "TestSynonym1, TestSynonym2", "Definition": "This is a test definition for the new concept" }, "Additional Information": { "Organization": "Test Organization", "Project": "Test Project", "Additional Information": "Additional test notes and context" } }