e41ecfad4c
Include Loyalty/Communication/Sports Center backends and registry updates alongside production nginx and compose wiring. Co-authored-by: Cursor <cursoragent@cursor.com>
2.6 KiB
2.6 KiB
Testing Template
Mandatory test categories for implementation phases.
Baseline strategy: testing-strategy.md.
Mark a category N/A only with written justification (e.g. docs-only phase).
Unit
- Pure validators, mappers, permission helpers, formatting, template rendering without I/O.
- Deterministic; no real network.
Repository
- Query correctness, pagination, unique constraints behavior.
- Soft-delete defaults.
- Tenant filter present on tenant-owned entities.
- Cross-tenant get/update returns empty/denied.
Service
- Business rules and invariants.
- Audit/event emission expectations (outbox rows or publisher fakes).
- Domain error codes for illegal transitions.
Integration / API
- HTTP contracts: status codes, auth, permission denials.
- Tenant header requirements.
- End-to-end flows for the phase’s primary use cases.
Migration
- Upgrade applies on clean DB.
- Smoke query against new tables/columns.
- Downgrade only if the service supports it — document if not.
Permission
- Each new privileged route denies without permission/role.
- Permission names match
{service}.*trees documented in the phase.
Security
- Unauthenticated access denied where required.
- Token scope / role bypass attempts fail.
- No secret leakage in error bodies.
Performance
- Required for hot paths (entitlement, routing, queue claim, posting) when the phase touches them.
- Otherwise document N/A.
- Avoid unbounded queries; assert basic indexes usage indirectly via acceptable timing in CI only when stable.
Tenant Isolation
- At least one cross-tenant denial per new tenant-scoped API/aggregate.
- No list endpoint returns other tenants’ rows.
Documentation Validation
- Phase doc exists and matches delivered surface.
- Registry/manifest entries updated.
- Critical links resolve (tests or scripted checks when the service already has
test_docs/ architecture tests — follow sibling pattern).
Architecture / Boundary (when service has them)
- No forbidden imports across services.
- Layering rules (optional static checks already used by CRM/Loyalty/Communication).
Phase Rules
- New behavior ships with tests in the same phase.
- Failing or missing required tests → phase incomplete.
- Do not use production data.
- Prefer fakes for OTP, SMS providers, time.