Beef up testing section.

README.md

@@ -61,8 +61,30 @@ JWT_SECRET=dev-secret-change-me-do-not-use-in-production mvn spring-boot:run
 - The service returns structured error responses for application-level failures so clients can handle validation, authentication, authorization, and conflict cases predictably.
 - This implementation favors clarity over extra infrastructure. Features such as refresh tokens, token revocation, audit logging, pagination, rate limiting, and OpenAPI generation would be good production follow-ups.
 
-## Test App
+## Testing
-A React app located at https://git.seanstarkey.dev/starkey/notes was used to test the API. This app exercises the API and displays REST requests/responses for debugging. It runs in a docker container.
+
+The automated tests run with Spring Boot, MockMvc, Spring Security, JPA, validation, and Flyway-backed H2 enabled. This keeps the tests close to real API behavior while still making them fast enough to run locally.
+
+Run the test suite with:
+
+```bash
+make test
+```
+
+Current automated coverage includes:
+
+- Registration creates users, hashes passwords, rejects duplicate usernames, and returns validation errors for invalid payloads.
+- Note creation requires a bearer token, persists notes for the authenticated owner, and rejects invalid note payloads.
+- Note listing returns only notes owned by the caller plus notes explicitly shared with the caller.
+- Note retrieval returns owned notes, returns shared notes as `SHARED_READ`, and verifies that a user cannot access another user's unshared note.
+- Protected endpoints return `401 Unauthorized` when no JWT is supplied.
+- Invalid UUID path variables return a structured `400 Bad Request` response.
+
+The required access-control test is covered by `NoteRetrievalControllerTest.getNoteReturnsNotFoundForUnsharedNoteOwnedByAnotherUser`, which creates a note as one user, authenticates as a different user, and asserts that the second user receives `404 Not Found` for the unshared note.
+
+Given time, more automated tests would be done and a full coverage analysis would be in order.
+
+A React app located at https://git.seanstarkey.dev/starkey/notes was also used for manual API testing. It exercises the API from a client perspective and displays REST requests/responses for debugging. It runs in a Docker container. This app was worth the investment because of the problems I had with some REST communications.
 
 ## API Endpoints