Testing

Every change comes with its tests, in the same change. A fixed bug gets a test that would have caught it.

Layer	Tool	Where	Command
Unit (web apps)	Vitest 5 (jsdom + Testing Library for React)	next to the code (*.spec.ts(x))	pnpm test, pnpm test:coverage
Unit and integration (API)	PHPUnit 12	apps/api/tests/{Unit,Feature}	pnpm api:test
Code quality (API)	Pint (style), Larastan level 8 (types)	apps/api	pnpm api:lint
End-to-end (API)	Node scripts against the running API, MySQL or MariaDB, Mailpit	tests/e2e	pnpm test:e2e
Browser	Playwright, axe-core	tests/browser	pnpm --filter @taraba/browser-tests test

Current state: 175 web unit tests, 40 API tests (266 assertions), 439 end-to-end checks in 14 suites, passing on MySQL 8.0 and MariaDB 10.11; Larastan reports no errors.

The end-to-end suites

They are the contract between the API and the three apps: the same suites checked the previous NestJS API and check the Laravel API now. node tests/e2e/run-all.mjs loads fresh demo data before each suite; --only orders,crm runs some of them. Settings: API_URL (default http://127.0.0.1:3000/graphql), MYSQL_CMD (the SQL client used for checks in the database), MAILPIT_URL. The alerts suite starts a second API instance (port 3010) and its scheduler, then stops and restarts a probe app to check the "down" and "back up" emails.

How the API tests are built

• Pure rules (TOTP with the RFC 6238 vectors, password policy, IBAN, company identifiers with the same cases as the web forms in packages/shared/src/business.vectors.json, legal rules, the schema and the SQL files) are tested directly.
• Feature tests run against a real database (the taraba_laravel_test database set in phpunit.xml): seeders, GraphQL error format, job locks, the health endpoint, password hashing.
• Everything that goes through the GraphQL operations is covered by the end-to-end suites.

Bugs found by the tests so far

• The moderation keyboard shortcuts crashed when the key event came from the document itself.
• Demo data: automation steps lost their email templates; 19 orders pointed at listings still for sale (db:check now guards both).
• During the Laravel rewrite: mutable dates turned session expiry into creation time; a TOTP code could be replayed in a race; the seller payout accounts lost their keys (no payout would have been sent); the job lock could not be seen on a single-worker development server; status alerts did not recognise a refused connection; report totals missed the first partial day; bcrypt alone made long passwords that start the same equivalent.