What coding structure is required for using testbox and mockbox?

We have built a coldfusion 2018 app over the last 6 years. We are now trying to include unit testing using testbox and mockbox. I was able to add a test for a coldfusion endpoint, but it is using a real user in the database. I’d like to mock a user so we don’t need to mess around with existing data that could change between tests because of users accessing and updating the data. All of the information I was able to find references a DAO which I don’t believe we use. We utilize the session object for verifying user data that is not passed to the frontend. We have a function that takes the user id, then does a select on the database and assigns values to the session.user object. I am not sure how to mock out the session object in this way without passing the function an ID to get the data from the database and assign it to the session object. Do I need to create a bean that would stub out a testing user without hitting the database that would then get updated with the database is actually hit? I am all for making changes, but I need to make sure that it is required because it would probably be a major change.

We built this a bit differently because the CEO wanted to use cfclient which never worked, so we built our own way of doing it where we have a html/css/javascript frontend that hits cfms through ajax calls that then hit cfcs where the queries on the database are run. These queries are normal selects, Inserts, Updates, and deletes. We did not build out entities and controllers like we did in our node API. Please let me know if you need more information. I really want to get these tests done and working for a few new endpoints I created recently, then we could have tech debt to get everything else working with the tests, but the major piece is getting a user in the session that can be used.

The endpoints I’m talking about are coldfusion RestAPI cfcs, trying a new way of doing things, There are create, get, update, and delete endpoints that verify the user session object, using the Account ID in the session, the cfid and cftoken need to be included in hitting the API to persist the session. These are all verified before the restAPI cfc calls another cfc which runs the query. But in all this I don’t want to actually enter data into the database and figured I could use transactions and roll them back, to do that would I need to include a parameter from the test that would be checked as an argument to roll back or not. Would the get even work in that case? The test I wrote using a real user checks that the endpoint returned a 200, but I think I would want to make sure it is returning the correct data in the proper structure, but if I write these endpoints to return fake data is that a valid test in the end? How can that be mocked if testbox is hitting the endpoint and expecting data to be returned.

Sorry if some of these questions sound dumb. I have never written a unit test in my career and really want to learn how to do it correctly.

Thanks.
DC