}

    @Test
    public void test_name() {
        // Test name() method returns correct string representation
        assertEquals("METADATA", SsoResponseType.METADATA.name());
        assertEquals("LOGOUT", SsoResponseType.LOGOUT.name());
    }

    @Test
    public void test_ordinal() {
        // Test ordinal() method returns correct position
        assertEquals(0, SsoResponseType.METADATA.ordinal());

public class FessActionValidatorTest extends UnitFessTestCase {

    @Test
    public void test_constructor() {
        // Test basic class structure without complex mocking
        assertEquals("FessActionValidator should be in correct package", "org.codelibs.fess.validation.FessActionValidator",
                FessActionValidator.class.getName());
    }

    @Test
    public void test_inheritance() {

The correct place is:

* In the key `content`, that has as value another JSON object (`dict`) that contains:
    * A key with the media type, e.g. `application/json`, that contains as value another JSON object, that contains:
        * A key `schema`, that has as the value the JSON Schema from the model, here's the correct place.

        }

        // Verify that the scroll method exists with correct signature
        try {
            SearchEngineUtil.class.getMethod("scroll", String.class, java.util.function.Function.class);
        } catch (NoSuchMethodException e) {
            fail("scroll method should exist with correct signature");
        }
    }

    @Test

Of course, the attackers would not try all this by hand, they would write a program to do it, possibly with thousands or millions of tests per second. And they would get just one extra correct letter at a time.

But doing that, in some minutes or hours the attackers would have guessed the correct username and password, with the "help" of our application, just using the time taken to answer.

#### Fix it with `secrets.compare_digest()` { #fix-it-with-secrets-compare-digest }

        String result = purgeDocJob.execute();

        // Assert deleteByQuery was called
        assertTrue(deleteByQueryCalled);

        // Assert correct index was used
        assertEquals("fess.update", deleteIndex);

        // Assert query builder is correct
        assertNotNull(deleteQuery);
        assertTrue(deleteQuery instanceof RangeQueryBuilder);

    List<String> expectedEvents = new ArrayList<>();
    expectedEvents.add(EVENT);
    expectedEvents.add(EVENT);

    assertEquals("Two correct events should be delivered.", expectedEvents, catcher1.getEvents());

    assertEquals(
        "One correct event should be delivered.", Lists.newArrayList(EVENT), catcher2.getEvents());

    bus.unregister(catcher1);
    bus.post(EVENT);

    assertEquals(

    List<String> expectedEvents = new ArrayList<>();
    expectedEvents.add(EVENT);
    expectedEvents.add(EVENT);

    assertEquals("Two correct events should be delivered.", expectedEvents, catcher1.getEvents());

    assertEquals(
        "One correct event should be delivered.", Lists.newArrayList(EVENT), catcher2.getEvents());

    bus.unregister(catcher1);
    bus.post(EVENT);

    assertEquals(

    assertEquals("correct", f.apply(new Object()));
    assertEquals("correct", f.apply(null));

    Function<@Nullable Object, @Nullable String> g = Functions.constant(null);
    assertThat(g.apply(2)).isNull();
    assertThat(g.apply(null)).isNull();

    new EqualsTester()
        .addEqualityGroup(f, Functions.constant("correct"))

This gives you a lot of **flexibility**. You can return any data type, override any data declaration or validation, etc.

It also gives you a lot of **responsibility**. You have to make sure that the data you return is correct, in the correct format, that it can be serialized, etc.

## Using the `jsonable_encoder` in a `Response` { #using-the-jsonable-encoder-in-a-response }