Strategy & Pipeline

Testing Strategy

Test pyramid

Level	Tool	Scope
Unit	Jest (API), Vitest (Web)	Business logic per module, isolated
Integration	Jest	Cross-module workflows through the route layer
E2E	Jest E2E (API), Playwright (Web)	Real HTTP / browser flows
Smoke	—	Health checks, root exports
Security	CodeQL, Semgrep, Trivy, ZAP	SAST + DAST in CI

Running tests

pnpm test                                   # all unit tests (workspace)
pnpm --filter @flowgeist-tool/api test:e2e  # API E2E
pnpm e2e                                    # Playwright (Web)

Writing tests — project conventions

• setup() per spec file encapsulates wiring — no shared mutable beforeEach state.
• Specific error assertions: rejects.toThrow(ConflictException), never bare toThrow().
• Tenant isolation is mandatory in service tests — cross-tenant access must return 404 / NOT_FOUND. See Multi-Tenancy.
• No PII in fixtures: synthetic UUIDs (00000000-0000-4000-8000-*), example.com addresses.
• No any in tests except where strictly needed for mocks.
• Mock at boundaries (external APIs, ClamAV, SMTP) — not the database layer for integration tests.

Current coverage (baseline)

• API: ~1300 unit/integration tests across ~77 suites
• Web: ~690 tests across ~40 files
• E2E: provisioning/auth flows, security-relevant paths

When a change needs tests

Change	Expected coverage
New endpoint	Controller + service unit tests, E2E for auth/error paths
New service logic	Unit tests incl. tenant isolation + error cases
Bug fix	Regression test reproducing the bug first
Guard/permission change	E2E proving 401/403/404 behavior

Security testing in CI

• SAST: CodeQL + Semgrep on every PR.
• Dependencies: Trivy + SBOM audit.
• DAST: ZAP baseline against production (passive, advisory).
• Findings are triaged in .zap/rules.tsv — INFO for accepted items, WARN as regression guards.