# Testing Strategy

## Required Layers

| Layer | Purpose |
| --- | --- |
| Unit | Pure domain logic, validators, mappers, specifications, policies |
| Service / Command / Query | Business rules with DB/fakes; read-side without write side-effects |
| Repository | Query correctness, tenant filters, soft-delete, page/filter/sort/search |
| API | HTTP contracts, authz, status codes, OpenAPI smoke when pattern exists |
| Integration | Multi-component flows (onboarding, OTP, SSO handoff) |
| Migration | Upgrade/downgrade smoke on clean DB; seeds when required |
| Tenant | Cross-tenant isolation negatives |
| Performance | Hot entitlement/resolve/list paths as needed |
| Security | Auth bypass attempts, token scope checks |
| Architecture | Boundary/layering rules (service suites) |
| Documentation validation | Links, registry completeness, DoD/handover for the phase |
| Permission | Privileged route denial cases |

## Rules

1. New behavior ships with tests in the same phase.
2. Tenant tests must include at least one cross-tenant denial case for new tenant-scoped APIs.
3. Do not rely on production data for assertions.
4. Prefer deterministic time/OTP fakes.
5. Phase is incomplete if tests fail or are absent for claimed deliverables.
6. CRUD-only coverage without domain-rule tests is insufficient when business rules exist ([definition-of-done.md](../ai-framework/definition-of-done.md)).
7. Architecture, security, and documentation validation are required for service/module implementation phases ([testing-template.md](../ai-framework/testing-template.md)).

## Commands (current)

```bash
cd backend/core-service
pytest -q

cd backend/services/identity-access
pytest -q
```

## Related Documents

- [Project Principles](project-principles.md)
- [Developer Guide](developer-guide.md)
- [Branching Strategy](branching-strategy.md)
- [AI Framework Testing Template](../ai-framework/testing-template.md)
- [Quality Gates](../ai-framework/quality-gates.md)
- [Definition of Done](../ai-framework/definition-of-done.md)