// The constant should be accessible and properly named
        // We can't easily test the actual configuration without full DI setup,
        // but we verify the class structure is correct
        assertTrue(true);
    }

    @Test
    public void test_securitySettings_allowUnsecureBasic() throws Exception {
        // Verify the ALLOW_UNSEC_BASIC setting is documented with security warnings

import org.junit.jupiter.api.Test;

public class FessWebResourceRootTest extends UnitFessTestCase {

    @Test
    public void test_classExists() {
        // Basic test to verify the class exists and has the correct structure
        assertNotNull(FessWebResourceRoot.class, "FessWebResourceRoot class should exist");
    }

    @Test
    public void test_inheritance() {
        // Verify that FessWebResourceRoot extends StandardRoot

    }

    @Test
    public void test_name() {
        // Test name() method returns correct string representation
        assertEquals("METADATA", SsoResponseType.METADATA.name());
        assertEquals("LOGOUT", SsoResponseType.LOGOUT.name());
    }

    @Test
    public void test_ordinal() {
        // Test ordinal() method returns correct position
        assertEquals(0, SsoResponseType.METADATA.ordinal());

public class FessActionValidatorTest extends UnitFessTestCase {

    @Test
    public void test_constructor() {
        // Test basic class structure without complex mocking
        assertEquals("FessActionValidator should be in correct package", "org.codelibs.fess.validation.FessActionValidator",
                FessActionValidator.class.getName());
    }

    @Test
    public void test_inheritance() {

The correct place is:

* In the key `content`, that has as value another JSON object (`dict`) that contains:
    * A key with the media type, e.g. `application/json`, that contains as value another JSON object, that contains:
        * A key `schema`, that has as the value the JSON Schema from the model, here's the correct place.

        }

        // Verify that the scroll method exists with correct signature
        try {
            SearchEngineUtil.class.getMethod("scroll", String.class, java.util.function.Function.class);
        } catch (NoSuchMethodException e) {
            fail("scroll method should exist with correct signature");
        }
    }

    @Test

Of course, the attackers would not try all this by hand, they would write a program to do it, possibly with thousands or millions of tests per second. And they would get just one extra correct letter at a time.

But doing that, in some minutes or hours the attackers would have guessed the correct username and password, with the "help" of our application, just using the time taken to answer.

#### Fix it with `secrets.compare_digest()` { #fix-it-with-secrets-compare-digest }

        String result = purgeDocJob.execute();

        // Assert deleteByQuery was called
        assertTrue(deleteByQueryCalled);

        // Assert correct index was used
        assertEquals("fess.update", deleteIndex);

        // Assert query builder is correct
        assertNotNull(deleteQuery);
        assertTrue(deleteQuery instanceof RangeQueryBuilder);

    List<String> expectedEvents = new ArrayList<>();
    expectedEvents.add(EVENT);
    expectedEvents.add(EVENT);

    assertEquals("Two correct events should be delivered.", expectedEvents, catcher1.getEvents());

    assertEquals(
        "One correct event should be delivered.", Lists.newArrayList(EVENT), catcher2.getEvents());

    bus.unregister(catcher1);
    bus.post(EVENT);

    assertEquals(

    List<String> expectedEvents = new ArrayList<>();
    expectedEvents.add(EVENT);
    expectedEvents.add(EVENT);

    assertEquals("Two correct events should be delivered.", expectedEvents, catcher1.getEvents());

    assertEquals(
        "One correct event should be delivered.", Lists.newArrayList(EVENT), catcher2.getEvents());

    bus.unregister(catcher1);
    bus.post(EVENT);

    assertEquals(