[test-improver] Add DatabaseHelper bug-pin and functional tests (11 tests)

[github-actions]

🤖 Test Improver — automated AI assistant focused on improving tests.

Goal & Rationale

DatabaseHelper is the project's raw JDBC layer with zero test coverage. It contains several well-commented security vulnerabilities and a portability bug that are completely invisible without tests. This PR adds 11 tests that document both the happy-path behaviour and the known defects.

Approach

Used @SpringBootTest so that JPA/Hibernate creates the full H2 schema before the raw JDBC calls run. The Spring-managed datasource and the DatabaseHelper static connection share the same jdbc:h2:mem:taskflow in-memory database, so inserts via TaskRepository are immediately visible to DatabaseHelper queries.

Tests added (DatabaseHelperTest.java)

Test	Type	What it documents
getConnection_returnsOpenConnection	functional	Basic connection health check
getConnection_reusesSameConnection	functional	Static connection caching (not thread-safe)
searchTasks_matchesByTitle	functional	Happy-path keyword search
searchTasks_noMatch_returnsEmptyList	functional	Empty result for non-matching keyword
searchTasks_sqlInjection_BUG_returnsAllRows	bug-pin	' OR '1'='1 injection returns all rows
getTasksByUser_returnsTasksForAssignee	functional	Filters by assignee_id
updateTaskStatus_existingTask_returnsTrue	functional	Returns true on successful update
updateTaskStatus_nonExistentId_returnsFalse	functional	Returns false when id not found
deleteTasks_singleId_deletesRow	functional	Deletes single row and verifies removal
deleteTasks_emptyList_BUG_returnsZeroInH2	bug-pin	Empty IN () clause: H2 silently returns 0, but MySQL/PostgreSQL throw syntax error
deleteTasks_multipleIds_deletesAll	functional	Deletes two rows atomically

Bug-pin highlights

SQL injection in searchTasks (and getTasksByUser, getProjectStats): string concatenation into SQL statements. The test searchTasks_sqlInjection_BUG_returnsAllRows demonstrates that ' OR '1'='1 returns every row in the table.

Non-portable empty IN clause in deleteTasks: deleteTasks(emptyList()) generates DELETE FROM tasks WHERE id IN (). H2 accepts this gracefully (returns 0), but MySQL and PostgreSQL raise a syntax error, making the method silently broken when targeting production databases.

Coverage Impact

DatabaseHelper had 0% coverage; these 11 tests exercise all 5 public methods.

Trade-offs

• Uses @SpringBootTest (slow context load), but this is the only practical way to get the schema without duplicating DDL
• SQL injection test is a pin on current buggy behaviour; it will fail (correctly) once the code is fixed with PreparedStatement

Test Status

Tests run: 11, Failures: 0, Errors: 0, Skipped: 0

(Pre-existing failures on main — DateUtilsTest.testGetQuarter and TaskServiceTest.testGetTaskStatistics — are unaffected.)

Reproducibility

mvn test -Dtest=DatabaseHelperTest -B

Generated by Test Improver · 110.2 AIC · ⌖ 11.1 AIC · ⊞ 10.9K · ◷
_{Comment /test-assist to run again}

Add this agentic workflows to your repo

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/test-improver.md@1c6668b751c51af8571f01204ceffb19362e0f66