@atlashub/smartstack-cli 3.37.0 → 3.39.0

package/templates/skills/application/references/test-coverage-requirements.md

@@ -0,0 +1,213 @@
+# Test Generation: Coverage Requirements & Categories
+
+> Referenced from `steps/step-07-tests.md` — Test coverage minimums and category definitions.
+
+---
+
+## Minimum Test Coverage Per Category
+
+| Category | Minimum Tests | Focus Areas |
+|----------|---------------|------------|
+| Controller (mock) | 10 | CRUD routing, auth/tenant handling, error responses |
+| Controller (real integration) | 8 | CRUD with actual DB persistence, tenant isolation, 404/409 cases |
+| Service | 8 | Business logic, CRUD, error handling, edge cases |
+| Entity | 5 | Factory method, property updates, validation, soft delete |
+| Validator | 8 | Code validation, name validation, security rules |
+| Repository | 8 | CRUD, tenant filtering, pagination, indexes |
+| Security | 10 | Auth bypass attempts, injection attacks, header validation |
+
+**Total minimum:** ~67 tests per entity
+
+---
+
+## Real Integration Test Coverage
+
+Integration tests (with actual DB):
+- GET all → 200 with list
+- GET by ID → 200 when exists, 404 when not
+- POST → 201/200 when valid, persist to DB, read back to verify
+- POST → 400 when invalid data
+- POST → 409 when duplicate code
+- PUT → 200 when valid, persist changes, read back to verify
+- PUT → 404 when not exists
+- DELETE → 204 when exists
+- DELETE → 404 when not exists
+- Tenant isolation → create in tenant A, invisible in tenant B (REAL DB)
+- Authorization → 401 when not authenticated
+
+---
+
+## Test Naming Convention (BLOCKING)
+
+All test methods MUST follow: `{Method}_When{Condition}_Should{Result}`
+
+**FORBIDDEN patterns:**
+- `Test1`, `Test2`, `TestMethod`, `MyTest`
+- `Should_Return_OK`, `test_get_all`
+
+**REQUIRED pattern:**
+```csharp
+GetAll_WhenCalled_ShouldReturn200WithList
+Create_WhenDuplicateCode_ShouldThrowException
+Delete_WhenNotAuthenticated_ShouldReturn401
+```
+
+---
+
+## Test Structure (BLOCKING)
+
+All tests MUST follow Arrange-Act-Assert:
+
+```csharp
+// CORRECT
+[Fact]
+public async Task GetById_WhenExists_ShouldReturn200()
+{
+    // Arrange
+    var id = Guid.NewGuid();
+    // ... setup
+
+    // Act
+    var response = await _client.GetAsync($"/api/{entityCode}/{id}");
+
+    // Assert
+    response.StatusCode.Should().Be(HttpStatusCode.OK);
+}
+
+// FORBIDDEN - No structure
+[Fact]
+public void TestGetById()
+{
+    var response = _client.GetAsync("/api/product/1");
+    Assert.Equal(200, response.StatusCode);
+}
+```
+
+---
+
+## Dependencies Check (BLOCKING)
+
+Verify test project uses:
+- `FluentAssertions` (NOT `Assert.Equal`)
+- `Moq` (NOT manual fakes)
+- `xunit` (NOT NUnit or MSTest)
+
+---
+
+## Test Categories
+
+### 1. Controller Mock Tests
+
+Unit tests with mocked dependencies:
+- Routing validation
+- Authentication/Authorization
+- Error response formatting
+- Input validation
+
+```csharp
+[Fact]
+public async Task GetAll_WhenCalled_ShouldReturn200WithList()
+{
+    // Mock service
+    _mockService.Setup(s => s.GetAllAsync(It.IsAny<CancellationToken>()))
+        .ReturnsAsync(new List<ProductDto>());
+
+    // Act & Assert
+    ...
+}
+```
+
+### 2. Controller Integration Tests
+
+REAL tests with actual DB (via WebApplicationFactory):
+- Full HTTP flow
+- Database persistence
+- Tenant isolation
+- Query validation
+
+### 3. Service Tests
+
+Unit tests for business logic:
+- CRUD operations
+- Error handling
+- Validation logic
+
+### 4. Entity Tests
+
+Domain model tests:
+- Factory methods
+- Property validation
+- State transitions
+- Soft delete
+
+### 5. Validator Tests
+
+Input validation:
+- Code format validation
+- Name constraints
+- Security rules (XSS, SQL injection detection)
+
+### 6. Repository Tests
+
+Data access tests:
+- Query correctness
+- Tenant filtering
+- Pagination
+- Indexes
+
+### 7. Security Tests
+
+OWASP coverage:
+- Authentication bypass attempts
+- Authorization bypass attempts
+- SQL injection attempts
+- XSS payload handling
+- CSRF token validation
+- Tenant isolation breach attempts
+- Header injection attempts
+
+---
+
+## Build & Run Checks (BLOCKING)
+
+```bash
+# Build
+dotnet build tests/{SolutionName}.Tests/{SolutionName}.Tests.csproj
+
+# Run
+dotnet test tests/{SolutionName}.Tests/{SolutionName}.Tests.csproj --no-build --verbosity normal
+```
+
+**ALL tests MUST pass.** If tests fail:
+1. Read the failure output carefully
+2. Fix the failing tests or the code they test
+3. Re-run until all tests pass
+4. Do NOT proceed to the next step until all tests are green
+
+---
+
+## Frontend Test Categories
+
+| File | Category | Focus |
+|------|----------|-------|
+| `{EntityName}Page.test.tsx` | Page | Loading, error, render with data |
+| `{EntityName}ListView.test.tsx` | List | Pagination, filtering, view toggle |
+| `{EntityName}DetailPage.test.tsx` | Detail | Tab switching, back navigation |
+| `use{EntityName}Preferences.test.ts` | Hooks | State persistence, local storage |
+| `{entityName}Api.test.ts` | API Client | MSW mocking, HTTP methods |
+
+---
+
+## Validation Checklist
+
+- [ ] All test methods follow `{Method}_When{Condition}_Should{Result}` naming
+- [ ] All tests use Arrange-Act-Assert structure
+- [ ] FluentAssertions used throughout (not Assert.Equal)
+- [ ] Moq used for mock-based tests only
+- [ ] Minimum test count met per category
+- [ ] Real integration tests verify DB persistence
+- [ ] Security tests cover OWASP top 10 issues
+- [ ] Backend tests build successfully
+- [ ] **ALL backend tests pass**
+- [ ] Frontend tests build successfully
+- [ ] **ALL frontend tests pass**

package/templates/skills/application/references/test-frontend.md

@@ -53,9 +53,9 @@ Args:
 ```
 
 This generates:
-- `src/pages/{context}/{application}/__tests__/{EntityName}Page.test.tsx` - Page rendering, loading, error states
-- `src/pages/{context}/{application}/__tests__/{EntityName}ListView.test.tsx` - List display, pagination, view toggle
-- `src/pages/{context}/{application}/__tests__/{EntityName}DetailPage.test.tsx` - Detail view, tabs, back navigation
+- `src/pages/{application}/__tests__/{EntityName}Page.test.tsx` - Page rendering, loading, error states
+- `src/pages/{application}/__tests__/{EntityName}ListView.test.tsx` - List display, pagination, view toggle
+- `src/pages/{application}/__tests__/{EntityName}DetailPage.test.tsx` - Detail view, tabs, back navigation
 - `src/hooks/__tests__/use{EntityName}Preferences.test.ts` - Preference get/set
 - `src/services/api/__tests__/{entityName}Api.test.ts` - API client calls with MSW
 

package/templates/skills/application/steps/step-00-init.md

@@ -1,260 +1,130 @@
----
-name: step-00-init
-description: Initialize application/module creation - parse parameters and validate context
-next_step: steps/step-01-navigation.md
----
-
-# Step 0: Initialization
-
-## MANDATORY EXECUTION RULES
-
-- NEVER skip parameter validation
-- ALWAYS detect the navigation level from user request
-- ALWAYS validate MCP availability before proceeding
-- YOU ARE AN INITIALIZER, not an executor
-- FORBIDDEN to call MCP tools until init is complete
-
-## YOUR TASK
-
-Initialize the application/module creation by parsing parameters, detecting level, and validating the SmartStack context.
-
----
-
-## EXECUTION SEQUENCE
-
-### 1. Detect Navigation Level
-
-From user request, identify the level:
-
-| Hint in Request | → Level | Parent Required |
-|-----------------|---------|-----------------|
-| "context", "workspace", "nouveau contexte" | context | No |
-| "application", "app", "nouvelle application" | application | Yes (context) |
-| "module", "feature", "nouveau module" | module | Yes (context.application) |
-| "section", "tab", "nouvelle section" | section | Yes (context.app.module) |
-
-### 2. Extract Parameters
-
-```yaml
-# Required
-level: context | application | module | section
-code: kebab-case (e.g., "products", "order-management")
-labels:
-  fr: "Label français"
-  en: "English label"
-  it: "Etichetta italiana"
-  de: "Deutsche Bezeichnung"
-icon: Lucide icon name (e.g., "Package", "ShoppingCart")
-displayOrder: number
-
-# Conditional (required for non-context levels)
-parentPath: "context.application.module" (dot-separated)
-```
-
-### 3. MCP Prerequisite Check (BLOCKING)
-
-**CRITICAL:** This check is **BLOCKING** - the skill cannot proceed without MCP.
-
-> See `_shared.md` → "MCP Prerequisite Guard (BLOCKING)" for the full pattern.
-
-```
-Call: mcp__smartstack__validate_conventions
-Args: { checks: ["tables"] }
-```
-
-**On success:** Set `mcp_available = true`, continue to Step 4.
-
-**On failure (STOP):**
-
-```
-═══════════════════════════════════════════════════════════════
-  MCP SMARTSTACK NOT AVAILABLE - SKILL BLOCKED
-═══════════════════════════════════════════════════════════════
-
-  The SmartStack MCP server is required for the application
-  skill but could not be reached.
-
-  To install:
-    claude mcp add smartstack -- npx --package @atlashub/smartstack-cli smartstack-mcp
-
-  To verify:
-    /mcp:healthcheck
-
-  After installation, restart Claude Code and retry.
-
-═══════════════════════════════════════════════════════════════
-```
-
-**DO NOT** offer manual instructions or degraded execution.
-**DO NOT** proceed with step files.
-**STOP the skill immediately.**
-
-### 4. Detect Project Type
-
-Read `.smartstack/config.json` at the project root to determine the seeding strategy:
-
-```
-Read: .smartstack/config.json
-Extract: projectType, dbContext
-```
-
-| projectType | dbContext | Seeding Strategy |
-|-------------|----------|-----------------|
-| `core` | `core` | HasData() in Configuration files (existing pattern) |
-| `client` | `extensions` | IClientSeedDataProvider (runtime seeding) |
-
-**If file not found or projectType missing:** Default to `core` / `hasdata`.
-
-Store:
-```
-{project_type} = "core" or "client"
-{db_context} = "core" or "extensions"
-{seeding_strategy} = "hasdata" or "provider"
-```
-
-### 4b. Detect Feature.json Context (Optional Enrichment)
-
-Search for a Business Analysis feature.json for the target module:
-
-```
-Glob: docs/business/*/{code}/business-analyse/v*/feature.json
-      .business-analyse/business/*/modules/{code}/features/*/feature.json
-```
-
-**If found (status = "handed-off" or "consolidated"):**
-
-Read the feature.json and extract context for subsequent steps:
-
-| feature.json Section | Used In Step | Extracted Data |
-|----------------------|-------------|----------------|
-| `analysis.entities[]` | step-04 (backend) | Entity names, attributes, relationships, validations |
-| `specification.useCases[]` | step-04 (backend) | API endpoint definitions beyond basic CRUD |
-| `specification.permissionMatrix` | step-02 (permissions) | Custom permission paths and role assignments |
-| `specification.apiEndpoints[]` | step-04 (backend) | Exact HTTP methods, routes, DTOs |
-| `specification.navigation` | step-01 (navigation) | Navigation hierarchy with labels and icons |
-| `specification.i18nKeys` | step-05 (frontend) | Pre-defined translation keys |
-| `specification.validations[]` | step-04 (backend) | Field-level validation rules |
-| `specification.uiWireframes[]` | step-05 (frontend) | UI layout guidance |
-| `specification.seedDataCore` | step-01, step-02, step-03 | Pre-computed seeds |
-| `analysis.businessRules[]` | step-04, step-07 | Business rules for service logic and tests |
-| `specification.lifeCycles[]` | step-04 (backend) | Entity state machines |
-| `specification.dashboards` | step-05 (frontend) | Dashboard KPIs and chart specs |
-| `documentation` | step-08 | userDocRequired / techDocRequired flags |
-
-Store:
-```
-{feature_json_path} = "path/to/feature.json" or null
-{has_feature_context} = true or false
-{feature_data} = parsed feature.json object (if found)
-```
-
-**If NOT found or status not in ["handed-off", "consolidated"]:**
-
-```
-{has_feature_context} = false
-```
-
-Continue normally. All subsequent steps use their standard generation logic (generic CRUD).
-
-> **When `{has_feature_context} = true`**, subsequent steps SHOULD use the feature.json data
-> to generate more accurate code: entities with correct attributes and relationships, custom
-> permissions beyond basic CRUD, specific API routes, validation rules, and business logic
-> in services. This reduces post-generation manual corrections significantly.
-
-### 5. Build Full Path
-
-```
-{full_path} = {parentPath}.{code}  (if parentPath exists)
-{full_path} = {code}               (if context level)
-
-Example:
-  level: module
-  parentPath: erp.sales
-  code: products
-  → full_path: erp.sales.products
-```
-
-### 6. Infer Descriptions (if not provided)
-
-```yaml
-descriptions:
-  fr: "Gestion de {labels.fr}"
-  en: "{labels.en} management"
-  it: "Gestione di {labels.it}"
-  de: "Verwaltung von {labels.de}"
-```
-
-### 7. Show Summary
-
-```
-## Application Skill: {level} - {code}
-
-| Parameter | Value |
-|-----------|-------|
-| Level | {level} |
-| Code | {code} |
-| Full Path | {full_path} |
-| Parent | {parentPath} |
-| Icon | {icon} |
-| Display Order | {displayOrder} |
-| Project Type | {project_type} |
-| Seeding Strategy | {seeding_strategy} |
-| Feature.json | {has_feature_context ? feature_json_path : "Not found (standard generation)"} |
-
-### Labels
-| Language | Label |
-|----------|-------|
-| FR | {labels.fr} |
-| EN | {labels.en} |
-| IT | {labels.it} |
-| DE | {labels.de} |
-
-→ Proceeding to navigation generation...
-```
-
----
-
-## STATE VARIABLES TO PERSIST
-
-| Variable | Description |
-|----------|-------------|
-| `{level}` | context, application, module, or section |
-| `{code}` | kebab-case identifier |
-| `{full_path}` | Complete navigation path |
-| `{parent_path}` | Parent path (null for context) |
-| `{labels}` | Object with fr, en, it, de |
-| `{descriptions}` | Object with fr, en, it, de |
-| `{icon}` | Lucide icon name |
-| `{display_order}` | Numeric display order |
-| `{mcp_available}` | Boolean - MCP connectivity status |
-| `{project_type}` | "core" or "client" (from .smartstack/config.json) |
-| `{db_context}` | "core" or "extensions" (from .smartstack/config.json) |
-| `{seeding_strategy}` | "hasdata" (core) or "provider" (client) |
-| `{feature_json_path}` | Path to feature.json (null if not found) |
-| `{has_feature_context}` | Boolean - whether BA context is available |
-| `{feature_data}` | Parsed feature.json object (null if not found) |
-
----
-
-## SUCCESS METRICS
-
-- Level correctly detected
-- All required parameters extracted
-- MCP availability verified
-- Project type and seeding strategy detected
-- Feature.json detected if available (enrichment context loaded)
-- Full path computed correctly
-- Summary displayed
-- Proceeded to step-01-navigation.md
-
-## FAILURE MODES
-
-- Missing required parameters (ask user)
-- Invalid level detection (clarify with user)
-- MCP not available (STOP - display install instructions)
-
----
-
-## NEXT STEP
-
-After showing initialization summary, proceed to `./step-01-navigation.md`
+---
+name: step-00-init
+description: Initialize application/module creation - parse parameters and validate context
+next_step: steps/step-01-navigation.md
+---
+
+# Step 0: Initialization
+
+## MANDATORY EXECUTION RULES
+
+- NEVER skip parameter validation
+- ALWAYS detect the navigation level from user request
+- ALWAYS validate MCP availability before proceeding
+- YOU ARE AN INITIALIZER, not an executor
+- FORBIDDEN to call MCP tools until init is complete
+
+## YOUR TASK
+
+Initialize the application/module creation by parsing parameters, detecting level, and validating the SmartStack context.
+
+---
+
+## EXECUTION SEQUENCE
+
+### 1-4. Parameter Detection & Project Analysis
+
+See [references/init-parameter-detection.md](../references/init-parameter-detection.md) for:
+- Navigation level detection (application/module/section/resource)
+- Parameter extraction (code, labels, icon, displayOrder)
+- Project type & seeding strategy detection
+- Feature.json context enrichment (optional)
+- MCP prerequisite validation (BLOCKING)
+
+### 5. Build Full Path
+
+```
+{full_path} = {parentPath}.{code}  (if parentPath exists)
+{full_path} = {code}               (if application level)
+
+Example:
+  level: module
+  parentPath: sales
+  code: products
+  → full_path: sales.products
+```
+
+### 6. Infer Descriptions (if not provided)
+
+```yaml
+descriptions:
+  fr: "Gestion de {labels.fr}"
+  en: "{labels.en} management"
+  it: "Gestione di {labels.it}"
+  de: "Verwaltung von {labels.de}"
+```
+
+### 7. Show Summary
+
+```
+## Application Skill: {level} - {code}
+
+| Parameter | Value |
+|-----------|-------|
+| Level | {level} |
+| Code | {code} |
+| Full Path | {full_path} |
+| Parent | {parentPath} |
+| Icon | {icon} |
+| Display Order | {displayOrder} |
+| Project Type | {project_type} |
+| Seeding Strategy | {seeding_strategy} |
+| Feature.json | {has_feature_context ? feature_json_path : "Not found (standard generation)"} |
+
+### Labels
+| Language | Label |
+|----------|-------|
+| FR | {labels.fr} |
+| EN | {labels.en} |
+| IT | {labels.it} |
+| DE | {labels.de} |
+
+→ Proceeding to navigation generation...
+```
+
+---
+
+## STATE VARIABLES TO PERSIST
+
+| Variable | Description |
+|----------|-------------|
+| `{level}` | application, module, section, or resource |
+| `{code}` | kebab-case identifier |
+| `{full_path}` | Complete navigation path |
+| `{parent_path}` | Parent path (null for context) |
+| `{labels}` | Object with fr, en, it, de |
+| `{descriptions}` | Object with fr, en, it, de |
+| `{icon}` | Lucide icon name |
+| `{display_order}` | Numeric display order |
+| `{mcp_available}` | Boolean - MCP connectivity status |
+| `{project_type}` | "core" or "client" (from .smartstack/config.json) |
+| `{db_context}` | "core" or "extensions" (from .smartstack/config.json) |
+| `{seeding_strategy}` | "hasdata" (core) or "provider" (client) |
+| `{feature_json_path}` | Path to feature.json (null if not found) |
+| `{has_feature_context}` | Boolean - whether BA context is available |
+| `{feature_data}` | Parsed feature.json object (null if not found) |
+
+---
+
+## SUCCESS METRICS
+
+- Level correctly detected
+- All required parameters extracted
+- MCP availability verified
+- Project type and seeding strategy detected
+- Feature.json detected if available (enrichment context loaded)
+- Full path computed correctly
+- Summary displayed
+- Proceeded to step-01-navigation.md
+
+## FAILURE MODES
+
+- Missing required parameters (ask user)
+- Invalid level detection (clarify with user)
+- MCP not available (STOP - display install instructions)
+
+---
+
+## NEXT STEP
+
+After showing initialization summary, proceed to `./step-01-navigation.md`