Skip to main content
Operations

Testing & Quality Assurance

Testing strategy

LayerToolWhat it proves
UnitVitest (bunx vitest run)Pure functions, parsers, role helpers behave correctly.
ComponentReact Testing LibraryCritical UI behaviours (forms, role switcher, MFA).
Server functionVitest with mocked SupabaseAuthorization is enforced; inputs validated.
Route smokeManual preview checkRoute renders, head() correct, no console errors.
SecurityLovable Project security scanZero critical findings before publish.
Visual / accessibilityManual review in previewContrast, focus order, keyboard navigation.

Tests live in src/routes/__tests__/ and alongside source files as *.test.ts(x).

Validation procedures

Before merging a change:

  1. Run targeted unit tests for the touched module.
  2. Verify in preview the route(s) affected.
  3. Read console + network panels — no warnings, no 4xx/5xx from internal calls.
  4. Confirm the Project Manual is updated (see Definition of Done).

For schema changes:

  1. Migration applies cleanly to a fresh DB.
  2. supabase--linter returns no warnings.
  3. RLS policies tested for each role (positive + negative).

For security changes:

  1. Re-run security scan.
  2. Update chapters/05-security-compliance.md to reflect the new posture.
  3. Update SECURITY.md if the regulatory mapping changes.

Release checklist

Use before every published release:

  • Build passes in preview.
  • No critical security findings.
  • Manual updated (chapter + changelog + version bump if structural).
  • PDF export of /docs opens cleanly and bookmarks resolve.
  • Smoke-test sign-in → MFA → /app for at least one role.
  • Audit log viewer renders without error.
  • No new secrets committed to git.
  • Release note drafted in chapters/10-change-management.md.

Known gaps

GapMitigation / next step
No automated end-to-end (Playwright) suite yetManual smoke + targeted Vitest component tests. Roadmap: introduce Playwright for the auth + MFA + access-governance flows.
No automated visual regressionManual review against design tokens in src/styles.css.
Coverage metrics not enforced in CIAdd Vitest --coverage gate once Playwright lands.

Open gaps are tracked in the Technical debt register in chapters/10-change-management.md.