Operations
Testing & Quality Assurance
Testing strategy
| Layer | Tool | What it proves |
|---|---|---|
| Unit | Vitest (bunx vitest run) | Pure functions, parsers, role helpers behave correctly. |
| Component | React Testing Library | Critical UI behaviours (forms, role switcher, MFA). |
| Server function | Vitest with mocked Supabase | Authorization is enforced; inputs validated. |
| Route smoke | Manual preview check | Route renders, head() correct, no console errors. |
| Security | Lovable Project security scan | Zero critical findings before publish. |
| Visual / accessibility | Manual review in preview | Contrast, focus order, keyboard navigation. |
Tests live in src/routes/__tests__/ and alongside source files as *.test.ts(x).
Validation procedures
Before merging a change:
- Run targeted unit tests for the touched module.
- Verify in preview the route(s) affected.
- Read console + network panels — no warnings, no 4xx/5xx from internal calls.
- Confirm the Project Manual is updated (see Definition of Done).
For schema changes:
- Migration applies cleanly to a fresh DB.
supabase--linterreturns no warnings.- RLS policies tested for each role (positive + negative).
For security changes:
- Re-run security scan.
- Update
chapters/05-security-compliance.mdto reflect the new posture. - Update
SECURITY.mdif the regulatory mapping changes.
Release checklist
Use before every published release:
- Build passes in preview.
- No critical security findings.
- Manual updated (chapter + changelog + version bump if structural).
- PDF export of
/docsopens cleanly and bookmarks resolve. - Smoke-test sign-in → MFA →
/appfor at least one role. - Audit log viewer renders without error.
- No new secrets committed to git.
- Release note drafted in
chapters/10-change-management.md.
Known gaps
| Gap | Mitigation / next step |
|---|---|
| No automated end-to-end (Playwright) suite yet | Manual smoke + targeted Vitest component tests. Roadmap: introduce Playwright for the auth + MFA + access-governance flows. |
| No automated visual regression | Manual review against design tokens in src/styles.css. |
| Coverage metrics not enforced in CI | Add Vitest --coverage gate once Playwright lands. |
Open gaps are tracked in the Technical debt register in chapters/10-change-management.md.