e41ecfad4c
Include Loyalty/Communication/Sports Center backends and registry updates alongside production nginx and compose wiring. Co-authored-by: Cursor <cursoragent@cursor.com>
85 lines
2.6 KiB
Markdown
85 lines
2.6 KiB
Markdown
# Testing Template
|
||
|
||
Mandatory test categories for implementation phases.
|
||
|
||
Baseline strategy: [testing-strategy.md](../development/testing-strategy.md).
|
||
|
||
Mark a category **N/A** only with written justification (e.g. docs-only phase).
|
||
|
||
## Unit
|
||
|
||
- Pure validators, mappers, permission helpers, formatting, template rendering without I/O.
|
||
- Deterministic; no real network.
|
||
|
||
## Repository
|
||
|
||
- Query correctness, pagination, unique constraints behavior.
|
||
- Soft-delete defaults.
|
||
- **Tenant filter** present on tenant-owned entities.
|
||
- Cross-tenant get/update returns empty/denied.
|
||
|
||
## Service
|
||
|
||
- Business rules and invariants.
|
||
- Audit/event emission expectations (outbox rows or publisher fakes).
|
||
- Domain error codes for illegal transitions.
|
||
|
||
## Integration / API
|
||
|
||
- HTTP contracts: status codes, auth, permission denials.
|
||
- Tenant header requirements.
|
||
- End-to-end flows for the phase’s primary use cases.
|
||
|
||
## Migration
|
||
|
||
- Upgrade applies on clean DB.
|
||
- Smoke query against new tables/columns.
|
||
- Downgrade only if the service supports it — document if not.
|
||
|
||
## Permission
|
||
|
||
- Each new privileged route denies without permission/role.
|
||
- Permission names match `{service}.*` trees documented in the phase.
|
||
|
||
## Security
|
||
|
||
- Unauthenticated access denied where required.
|
||
- Token scope / role bypass attempts fail.
|
||
- No secret leakage in error bodies.
|
||
|
||
## Performance
|
||
|
||
- Required for hot paths (entitlement, routing, queue claim, posting) when the phase touches them.
|
||
- Otherwise document N/A.
|
||
- Avoid unbounded queries; assert basic indexes usage indirectly via acceptable timing in CI only when stable.
|
||
|
||
## Tenant Isolation
|
||
|
||
- At least one cross-tenant denial per new tenant-scoped API/aggregate.
|
||
- No list endpoint returns other tenants’ rows.
|
||
|
||
## Documentation Validation
|
||
|
||
- Phase doc exists and matches delivered surface.
|
||
- Registry/manifest entries updated.
|
||
- Critical links resolve (tests or scripted checks when the service already has `test_docs` / architecture tests — follow sibling pattern).
|
||
|
||
## Architecture / Boundary (when service has them)
|
||
|
||
- No forbidden imports across services.
|
||
- Layering rules (optional static checks already used by CRM/Loyalty/Communication).
|
||
|
||
## Phase Rules
|
||
|
||
1. New behavior ships with tests in the same phase.
|
||
2. Failing or missing required tests → phase incomplete.
|
||
3. Do not use production data.
|
||
4. Prefer fakes for OTP, SMS providers, time.
|
||
|
||
## Related Documents
|
||
|
||
- [Testing Strategy](../development/testing-strategy.md)
|
||
- [Quality Gates](quality-gates.md)
|
||
- [Development Loop](development-loop.md)
|
||
- [Project Principles](../development/project-principles.md)
|