@ClassRule public static final ResourceTestRule
    userResource =
    ResourceTestRule.builder().addResource(new UserResource(USER_DAO, PERSON_DAO)).build();

when(USER_DAO.save(any(User.class))).thenReturn(Optional.of(user));
when(PERSON_DAO.save(any(Person.class))).thenReturn(Optional.of(person));

final Response
response =
userResource.client().target("/user").request(MediaType.APPLICATION_JSON_TYPE)
  .post(Entity.entity(user, MediaType.APPLICATION_JSON_TYPE));

assertThat(response.getStatusInfo()).isEqualTo(Response.Status.OK);
verify(USER_DAO).save(userCaptor.capture());
verify(PERSON_DAO).save(personCaptor.capture());
User savedUser = userCaptor.getValue();
assertThat(savedUser).isEqualToIgnoringGivenFields(user, "salt", "password", "person");
assertThat(savedUser.getPerson()).isEqualToComparingFieldByFieldRecursively(user.getPerson());

@POST
@Timed
  public User create(@NotNull @Valid User user) {
    if (user.getPerson() != null) {
      try {
        personDAO.save(user.getPerson());
        // todo justin - abstract this
      } catch (DuplicateKeyException e) {
        throw new WebApplicationException("That person exists already.", Response.SC_BAD_REQUEST);
      }
    }

    try {
      user = userDAO.save(user).get();
    } catch (DuplicateKeyException e) {
      throw new WebApplicationException("That user exists already.", Response.SC_BAD_REQUEST);
    }
    return user;
  }

user = new User();
user.setEmail("justin@email.com");
user.setPassword("test");

person = new Person();
person.setFirstName("Justin");
person.setLastName("K");

user.setPerson(person);

public class User extends BaseModel implements Principal {
  @Id
  @JsonSerialize(using = ToStringSerializer.class)
  private ObjectId id = new ObjectId();

  @Email
  @NotBlank
  private String email;

  @NotEmpty
  private byte[] password;

  private byte[] salt = Security.getSalt();

  public ObjectId getId() {
    return id;
  }

  public void setId(ObjectId id) {
    this.id = id;
  }

  public String getEmail() {
    return email;
  }

  public void setEmail(String email) {
    this.email = email;
  }

  @JsonIgnore // ignored when serialized FROM object TO json
  public byte[] getPassword() {
    return password;
  }

  @JsonProperty
  public void setPassword(byte[] password) {
    this.password = password;
  }

  @JsonProperty
  public void setPassword(String password) {
    this.password = Security.hashPassword(password.toCharArray(), this.getSalt());
  }

  @JsonIgnore // ignored when serialized FROM object TO json
  public byte[] getSalt() {
    return salt;
  }

  @JsonProperty
  public void setSalt(byte[] salt) {
    this.salt = salt;
  }