@etus/bhono-app 0.1.1

package/templates/base/docs/test-coverage-gap-analysis.md

@@ -0,0 +1,242 @@
+# Test Coverage Gap Analysis
+
+> **Updated:** 2026-01-02
+> **Total Features:** 261 (212 functional + 49 style)
+> **Test Files:** 122 (81 src + 41 e2e)
+
+## Summary
+
+| Category | Features | Covered | Gap | Coverage % |
+|----------|----------|---------|-----|------------|
+| Authentication | 13 | 13 | 0 | 100% |
+| Users CRUD | 13 | 13 | 0 | 100% |
+| Accounts CRUD | 8 | 8 | 0 | 100% |
+| Invitations | 8 | 8 | 0 | 100% |
+| Audit Logs | 8 | 8 | 0 | 100% |
+| Storage | 5 | 5 | 0 | 100% |
+| Health/Docs | 4 | 4 | 0 | 100% |
+| RBAC | 9 | 9 | 0 | 100% |
+| Security | 12 | 12 | 0 | 100% |
+| UI Pages | 40 | 40 | 0 | 100% |
+| Form Validation | 8 | 8 | 0 | 100% |
+| Error Handling | 8 | 8 | 0 | 100% |
+| Multi-tenancy | 5 | 5 | 0 | 100% |
+| Accessibility | 8 | 8 | 0 | 100% |
+| Performance | 10 | 10 | 0 | 100% |
+| Build/Deploy | 12 | 12 | 0 | 100% |
+| Email | 4 | 4 | 0 | 100% |
+| Navigation/Routing | 6 | 6 | 0 | 100% |
+| **Style (Visual)** | 49 | 49 | 0 | 100% |
+| **TOTAL** | **261** | **261** | **0** | **100%** |
+
+---
+
+## ✅ Features WITH Test Coverage
+
+### Authentication (13/13 covered) ✓
+| Feature | Test File(s) |
+|---------|-------------|
+| Google OAuth login initiates redirect | `oauth.test.ts`, `auth.spec.ts` |
+| OAuth callback creates session | `auth-service.test.ts`, `oauth.test.ts` |
+| OAuth creates new user on first login | `auth-service.test.ts` |
+| OAuth links existing user by email | `oauth.test.ts` |
+| Super admin pre-registration | `super-admin.test.ts` |
+| Logout destroys session | `logout.test.ts`, `auth-logout.unauth.spec.ts` |
+| Logout redirects to login | `auth-logout.unauth.spec.ts` |
+| /auth/me returns user info | `handlers.test.ts` (auth) |
+| /auth/me returns 401 for unauth | `handlers.test.ts` (auth) |
+| Session expiration | `session-expiry.test.ts` |
+| Invitation token in cookie during OAuth | `oauth.test.ts` |
+| Invalid invitation token error | `oauth.test.ts` |
+| Expired invitation token shows expiration error | `invitation-token.test.ts` |
+
+### Users CRUD (13/13 covered) ✓
+| Feature | Test File(s) |
+|---------|-------------|
+| List users paginated | `list.test.ts`, `users.spec.ts` |
+| List users search by email | `list.test.ts` |
+| List users search by name | `list.test.ts` |
+| Get user by ID | `crud.test.ts`, `handlers.test.ts` |
+| Get user 404 for non-existent | `handlers.test.ts` |
+| Update user requires ADMIN | `handlers.test.ts`, `guards-roles.test.ts` |
+| Update user changes name | `crud.test.ts`, `handlers.test.ts` |
+| Update user status | `handlers.test.ts` |
+| Delete user (soft delete) | `crud.test.ts`, `handlers.test.ts` |
+| Delete user requires ADMIN | `handlers.test.ts` |
+| Restore user requires Super Admin | `handlers.test.ts`, `super-admin.test.ts` |
+| Bulk assign users to accounts | `handlers.test.ts` (users) |
+| Bulk remove users from accounts | `handlers.test.ts` (users) |
+
+### Accounts CRUD (8/8 covered) ✓
+| Feature | Test File(s) |
+|---------|-------------|
+| List accounts returns user's accounts | `crud.test.ts`, `accounts.spec.ts` |
+| Get account by ID | `handlers.test.ts` |
+| Get account 403 for non-member | `handlers.test.ts` |
+| Create account requires Super Admin | `handlers.test.ts`, `super-admin.test.ts` |
+| Create account validates fields | `handlers.test.ts` |
+| Update account requires ADMIN role | `handlers.test.ts` |
+| Delete account requires Super Admin | `handlers.test.ts` |
+| Restore account requires Super Admin | `handlers.test.ts` |
+
+### Invitations (8/8 covered) ✓
+| Feature | Test File(s) |
+|---------|-------------|
+| Create invitation sends email | `crud.test.ts`, `email.test.ts` |
+| Create invitation links existing user | `handlers.test.ts` |
+| Create invitation prevents duplicates | `handlers.test.ts` |
+| List pending invitations | `handlers.test.ts` |
+| Delete invitation revokes | `crud.test.ts`, `handlers.test.ts` |
+| Delete invitation requires MANAGER | `handlers.test.ts` |
+| Expired invitation error | `handlers.test.ts`, `invitation-token.test.ts` |
+| Invitation token expiration | `invitation-token.test.ts` |
+
+### Audit Logs (8/8 covered) ✓
+| Feature | Test File(s) |
+|---------|-------------|
+| Query paginated results | `list.test.ts`, `audit-logs.spec.ts` |
+| Filter by entity type | `handlers.test.ts` |
+| Filter by action type | `handlers.test.ts` |
+| Filter by entity ID | `handlers.test.ts` |
+| Require ADMIN or ANALYTICS | `handlers.test.ts`, `analytics-role.test.ts` |
+| Super admin sees all accounts | `handlers.test.ts` |
+| Regular admin sees own account | `handlers.test.ts` |
+| Captures IP, User-Agent, changes | `audited-db.test.ts`, `audit-investigation.spec.ts` |
+
+### Storage (5/5 covered) ✓
+| Feature | Test File(s) |
+|---------|-------------|
+| Generate presigned upload URL | `upload.test.ts`, `storage.spec.ts` |
+| Upload file to R2 | `handlers.test.ts` |
+| Delete file from R2 | `handlers.test.ts` |
+| Storage requires authentication | `handlers.test.ts` |
+| File type/size validation | `validation.test.ts`, `file-management.spec.ts` |
+
+### Health/Docs (4/4 covered) ✓
+| Feature | Test File(s) |
+|---------|-------------|
+| Health check returns status ok | `health.test.ts`, `smoke.unauth.spec.ts` |
+| OpenAPI documentation accessible | `smoke.test.ts` |
+| Swagger UI accessible | `smoke.test.ts` |
+| Request context includes transactionId | `request-context.test.ts` |
+
+### RBAC (9/9 covered) ✓
+| Feature | Test File(s) |
+|---------|-------------|
+| Role hierarchy enforcement | `role-hierarchy.test.ts`, `rbac-enforcement.spec.ts` |
+| VIEWER read-only access | `guards-roles.test.ts`, `roles.test.ts` |
+| EDITOR create/modify content | `guards-roles.test.ts` |
+| MANAGER team management | `guards-roles.test.ts` |
+| ADMIN full account management | `guards-roles.test.ts` |
+| BILLING financial access | `billing-role.test.ts` |
+| ANALYTICS reporting access | `analytics-role.test.ts` |
+| Account middleware (query param) | `account.test.ts` |
+| Account middleware (header) | `account.test.ts` |
+
+### Security (12/12 covered) ✓
+| Feature | Test File(s) |
+|---------|-------------|
+| CORS allows configured origins | `cors.test.ts` |
+| CORS blocks unknown origins | `cors.test.ts` |
+| Session cookie httpOnly | `cookie-security.test.ts` |
+| Session cookie secure (prod) | `cookie-security.test.ts` |
+| Session cookie sameSite=Lax | `cookie-security.test.ts` |
+| XSS prevention | `xss-prevention.test.ts` |
+| SQL injection prevention | `sql-injection.test.ts` |
+| CSRF protection | `csrf-protection.test.ts` |
+| JWT validation | `jwt-validation.test.ts` |
+| Token hashing | `token-hashing.test.ts` |
+| Rate limiting | `rate-limiting.test.ts` |
+| Sensitive data not logged | `log-sanitization.test.ts` |
+
+### Multi-tenancy (5/5 covered) ✓
+| Feature | Test File(s) |
+|---------|-------------|
+| Soft deleted excluded from lists | `crud.test.ts` |
+| Soft delete preserves integrity | `constraints.test.ts` |
+| Multiple accounts same user | `multi-tenancy.test.ts`, `multi-account.spec.ts` |
+| User can switch accounts | `multi-account.spec.ts` |
+| Test login (dev only) | `auth.setup.ts` |
+
+---
+
+## ✅ All Feature Gaps Closed
+
+All 261 features now have test coverage. The following tests were added to close previous gaps:
+
+### Tests Added
+| Gap Category | Test File Added |
+|--------------|-----------------|
+| Authentication (invitation expiry) | `invitation-token.test.ts` |
+| Users (bulk operations) | `handlers.test.ts` (users) |
+| Storage (file validation) | `validation.test.ts`, `file-management.spec.ts` |
+| Security (log sanitization) | `log-sanitization.test.ts` |
+| Performance (benchmarks) | `response-times.test.ts`, `benchmarks.spec.ts` |
+| Build/Deploy (production) | `production-behavior.test.ts` |
+| Navigation/Routing | `routing.spec.ts` |
+| Accessibility | `keyboard-navigation.spec.ts` |
+| UI Pages | `ui-features.spec.ts` |
+| Error Handling | `error-boundary.spec.ts` |
+| Form Validation | `form-validation.spec.ts` |
+| Email Content | `email.test.ts` |
+| Style/Visual | `components.spec.ts`, `visual-regression.spec.ts` |
+
+---
+
+## Test File Reference
+
+### Unit/Integration Tests (81 files in `src/`)
+```
+src/server/lib/*.test.ts           - Core utilities (14 files)
+src/server/middleware/*.test.ts    - Middleware (7 files)
+src/server/auth/*.test.ts          - Auth & roles (4 files)
+src/server/routes/*/*.test.ts      - Route handlers (10 files)
+src/server/services/*.test.ts      - Business logic (6 files)
+src/server/__integration__/        - Integration tests (39 files)
+src/shared/schemas/*.test.ts       - Validation schemas (1 file)
+```
+
+### E2E Tests (41 files in `e2e/`)
+```
+e2e/api/*.spec.ts          - API integration (5 files)
+e2e/crud/*.spec.ts         - CRUD operations (4 files)
+e2e/journeys/*.spec.ts     - User journeys (14 files)
+e2e/a11y/*.spec.ts         - Accessibility (2 files)
+e2e/visual/*.spec.ts       - Visual regression (5 files)
+e2e/mobile/*.spec.ts       - Responsive (1 file)
+e2e/compatibility/*.spec.ts - Cross-browser (1 file)
+e2e/performance/*.spec.ts  - Performance (2 files)
+e2e/errors/*.spec.ts       - Error handling (3 files)
+e2e/invitations/*.spec.ts  - Invitation flows (1 file)
+e2e/forms/*.spec.ts        - Form validation (2 files)
+e2e/navigation/*.spec.ts   - Routing tests (1 file)
+```
+
+---
+
+## Conclusion
+
+**Current Coverage:** 100% (261/261 features)
+
+**All categories now at 100%:**
+- Authentication (13/13) ✓
+- Users CRUD (13/13) ✓
+- Accounts CRUD (8/8) ✓
+- Invitations (8/8) ✓
+- Audit Logs (8/8) ✓
+- Storage (5/5) ✓
+- Health/Docs (4/4) ✓
+- RBAC (9/9) ✓
+- Security (12/12) ✓
+- Multi-tenancy (5/5) ✓
+- UI Pages (40/40) ✓
+- Form Validation (8/8) ✓
+- Error Handling (8/8) ✓
+- Accessibility (8/8) ✓
+- Performance (10/10) ✓
+- Build/Deploy (12/12) ✓
+- Email (4/4) ✓
+- Navigation/Routing (6/6) ✓
+- Style/Visual (49/49) ✓
+
+**Test Suite:** 122 test files (81 unit/integration + 41 E2E)

package/templates/base/docs/testing.md

@@ -0,0 +1,188 @@
+# Testing Guide
+
+## Quick Start
+
+```bash
+# Run all tests
+npm test              # Backend unit tests (watch mode)
+npm run test:client   # Frontend tests (watch mode)
+npm run test:e2e      # Playwright E2E tests
+
+# Run with coverage
+npm run test:coverage        # Backend with coverage
+npm run test:coverage:client # Frontend with coverage
+
+# CI mode (no watch)
+npm run test:run
+```
+
+## Test Structure
+
+```
+src/
+├── server/
+│   ├── __tests__/mocks/     # D1, KV, R2 mocks for Cloudflare services
+│   ├── services/__tests__/  # Service layer tests
+│   ├── routes/*/__tests__/  # Route handler tests
+│   └── middleware/*.test.ts # Middleware tests
+├── client/
+│   ├── __tests__/           # Component and route tests
+│   ├── components/__tests__/ # UI component tests
+│   └── hooks/__tests__/     # Custom hook tests
+e2e/
+├── fixtures.ts              # Playwright fixtures
+├── auth.setup.ts            # Auth state setup
+├── smoke.unauth.spec.ts     # Smoke tests (no auth)
+├── auth/                    # Authentication flow tests
+└── crud/                    # CRUD operation tests
+```
+
+## Backend Tests (Vitest)
+
+### Running Tests
+
+```bash
+npm test                        # Watch mode
+npm run test:run                # Single run
+npm run test:coverage           # With coverage report
+vitest run src/server/services  # Specific folder
+```
+
+### Mock Services
+
+Import mocks for Cloudflare services:
+
+```typescript
+import { createMockD1Database, createMockSession } from '../__tests__/mocks/db'
+import { MockKVStore } from '../__tests__/mocks/kv'
+import { MockR2Bucket } from '../__tests__/mocks/r2'
+
+describe('MyService', () => {
+  let db: MockD1Database
+
+  beforeEach(() => {
+    db = createMockD1Database([
+      // Seed data for your test
+      { id: '1', name: 'Test User', ... }
+    ])
+  })
+})
+```
+
+### Testing Routes
+
+Use Hono's testClient for type-safe route testing:
+
+```typescript
+import { testClient } from 'hono/testing'
+import { createTestApp } from '../test-helpers'
+
+const { app, db, kv } = createTestApp()
+const client = testClient(app)
+
+it('should create user', async () => {
+  const res = await client.users.$post({ json: { name: 'Test' } })
+  expect(res.status).toBe(201)
+})
+```
+
+## Frontend Tests (Vitest + RTL)
+
+### Running Tests
+
+```bash
+npm run test:client            # Watch mode
+npm run test:coverage:client   # With coverage
+```
+
+### Component Testing
+
+```typescript
+import { render, screen } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { Button } from './button'
+
+it('should handle click', async () => {
+  const onClick = vi.fn()
+  render(<Button onClick={onClick}>Click me</Button>)
+
+  await userEvent.click(screen.getByRole('button'))
+  expect(onClick).toHaveBeenCalled()
+})
+```
+
+### Route Testing
+
+```typescript
+import { renderRoute, waitForRouteLoad } from '../__tests__/setup'
+
+it('should render dashboard', async () => {
+  renderRoute('/dashboard', { authenticated: true })
+  await waitForRouteLoad()
+
+  expect(screen.getByText('Dashboard')).toBeInTheDocument()
+})
+```
+
+## E2E Tests (Playwright)
+
+### Running Tests
+
+```bash
+npm run test:e2e             # All tests
+npm run test:e2e:ui          # UI mode (interactive)
+npm run test:e2e:headed      # Visible browser
+npm run test:e2e:debug       # Debug mode
+
+# Run specific project
+npm run test:e2e -- --project=chromium-unauth
+```
+
+### Test Projects
+
+- `chromium-unauth`: Unauthenticated flows
+- `chromium`: Authenticated flows (requires setup)
+- `firefox`: Cross-browser testing
+- `mobile-chrome`: Mobile device emulation
+
+### Writing E2E Tests
+
+```typescript
+import { test, expect } from '../fixtures'
+
+test('user can navigate to dashboard', async ({ page, authenticatedPage }) => {
+  await authenticatedPage.goto('/dashboard')
+  await expect(page.getByRole('heading', { name: 'Dashboard' })).toBeVisible()
+})
+```
+
+## CI/CD (GitHub Actions)
+
+Tests run automatically on push/PR to main/master:
+
+- **Unit Tests**: Backend + Frontend with coverage
+- **E2E Tests**: Chromium unauthenticated flows
+- **Type Check**: TypeScript compilation
+- **Lint**: ESLint checks
+
+Coverage reports upload to Codecov automatically.
+
+## Coverage Thresholds
+
+| Layer | Statements | Branches | Functions | Lines |
+|-------|------------|----------|-----------|-------|
+| Backend | 90% | 85% | 85% | 90% |
+| Frontend | 85% | 70% | 60% | 85% |
+| Shared | 95% | 95% | 95% | 95% |
+
+View coverage reports:
+- `coverage/server/index.html` - Backend coverage
+- `coverage/client/index.html` - Frontend coverage
+
+## Best Practices
+
+1. **Test behavior, not implementation** - Focus on what the code does, not how
+2. **Use realistic data** - Mock data should resemble production
+3. **Isolate tests** - Each test should be independent
+4. **Avoid flaky tests** - Use proper waits, not arbitrary timeouts
+5. **Keep tests fast** - Slow tests discourage running them

package/templates/base/index.html

@@ -0,0 +1,16 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <link rel="icon" type="image/svg+xml" href="/vite.svg" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>Hono Boilerplate</title>
+    <link rel="preconnect" href="https://fonts.googleapis.com" />
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
+    <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap" rel="stylesheet" />
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/client/main.tsx"></script>
+  </body>
+</html>

package/templates/base/package.json

@@ -0,0 +1,115 @@
+{
+  "name": "{{projectName}}",
+  "version": "1.0.0",
+  "type": "module",
+  "packageManager": "pnpm@10.15.1",
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "better-sqlite3",
+      "esbuild",
+      "sharp",
+      "workerd"
+    ]
+  },
+  "scripts": {
+    "dev": "vite",
+    "build": "vite build",
+    "preview": "vite preview",
+    "deploy": "wrangler deploy --config config/wrangler.json",
+    "db:push": "drizzle-kit push --config config/drizzle.config.ts",
+    "db:generate": "drizzle-kit generate --config config/drizzle.config.ts",
+    "db:studio": "drizzle-kit studio --config config/drizzle.config.ts",
+    "db:seed": "pnpm tsx src/server/db/seed.ts",
+    "api:spec": "pnpm tsx scripts/generate-openapi.ts",
+    "api:types": "pnpm api:spec && openapi-typescript docs/openapi.json -o src/shared/types/api.ts",
+    "cf-typegen": "wrangler types --config config/wrangler.json",
+    "lint": "eslint . --config config/eslint.config.js",
+    "typecheck": "tsc --build",
+    "typecheck:client": "tsc --build tsconfig.app.json",
+    "typecheck:server": "tsc --build tsconfig.server.json",
+    "test:unit:server": "vitest run --coverage",
+    "test:unit:client": "vitest run --config vitest.config.frontend.ts --coverage",
+    "test:unit": "pnpm test:unit:server && pnpm test:unit:client",
+    "test:unit:watch": "vitest --coverage",
+    "test:integration": "vitest run --config tests/integration/vitest.config.ts --coverage",
+    "test:integration:watch": "vitest --config tests/integration/vitest.config.ts --coverage",
+    "test:e2e": "playwright test",
+    "test:e2e:ui": "playwright test --ui",
+    "test:e2e:headed": "playwright test --headed",
+    "test:e2e:debug": "playwright test --debug",
+    "test:e2e:report": "playwright show-report .test-output/reports/playwright",
+    "test:e2e:coverage": "E2E_COVERAGE=true playwright test; pnpm test:e2e:coverage:report",
+    "test:e2e:coverage:report": "nyc report --reporter=html --reporter=text --report-dir=.test-output/coverage/e2e --temp-dir=.test-output/coverage/e2e/.nyc_output",
+    "test:e2e:prod": "BASE_URL=https://{{projectName}}.a3s.workers.dev playwright test",
+    "test:e2e:prod:auth": "tsx scripts/capture-prod-session.ts",
+    "test": "pnpm test:unit && pnpm test:integration && pnpm test:e2e"
+  },
+  "dependencies": {
+    "@hono/swagger-ui": "^0.5.3",
+    "@hono/zod-openapi": "^1.2.0",
+    "@hookform/resolvers": "^5.2.2",
+    "@radix-ui/react-dialog": "^1.1.15",
+    "@radix-ui/react-slot": "^1.2.4",
+    "@tanstack/react-query": "^5.90.16",
+    "@tanstack/react-router": "^1.144.0",
+    "class-variance-authority": "^0.7.1",
+    "clsx": "^2.1.1",
+    "drizzle-orm": "^0.45.1",
+    "hono": "^4.11.3",
+    "lucide-react": "^0.562.0",
+    "react": "^19.2.3",
+    "react-dom": "^19.2.3",
+    "react-hook-form": "^7.69.0",
+    "sonner": "^2.0.7",
+    "tailwind-merge": "^3.4.0",
+    "uuidv7": "^1.1.0",
+    "zod": "^4.3.4"
+  },
+  "devDependencies": {
+    "@cloudflare/vite-plugin": "^1.17.1",
+    "@cloudflare/workers-types": "^4.20260101.0",
+    "@eslint-react/eslint-plugin": "^2.5.0",
+    "@eslint/js": "^9.39.2",
+    "@playwright/test": "^1.57.0",
+    "@tailwindcss/vite": "^4.1.18",
+    "@tanstack/eslint-plugin-query": "^5.91.2",
+    "@tanstack/eslint-plugin-router": "^1.141.0",
+    "@tanstack/react-query-devtools": "^5.91.2",
+    "@tanstack/react-router-devtools": "^1.144.0",
+    "@tanstack/router-plugin": "^1.145.2",
+    "@testing-library/dom": "^10.4.1",
+    "@testing-library/jest-dom": "^6.9.1",
+    "@testing-library/react": "^16.3.1",
+    "@testing-library/user-event": "^14.6.1",
+    "@types/better-sqlite3": "^7.6.13",
+    "@types/node": "^25.0.3",
+    "@types/react": "^19.2.7",
+    "@types/react-dom": "^19.2.3",
+    "@vitejs/plugin-react": "^5.1.2",
+    "@vitest/browser": "^4.0.16",
+    "@vitest/browser-playwright": "^4.0.16",
+    "@vitest/coverage-istanbul": "^4.0.16",
+    "@vitest/coverage-v8": "^4.0.16",
+    "better-sqlite3": "^12.5.0",
+    "drizzle-kit": "^0.31.8",
+    "eslint": "^9.39.2",
+    "eslint-plugin-boundaries": "^5.3.1",
+    "eslint-plugin-promise": "^7.2.1",
+    "eslint-plugin-react-hooks": "^7.0.1",
+    "eslint-plugin-react-you-might-not-need-an-effect": "^0.8.3",
+    "eslint-plugin-unicorn": "^62.0.0",
+    "jsdom": "^27.4.0",
+    "msw": "^2.12.7",
+    "nyc": "^17.1.0",
+    "openapi-typescript": "^7.8.1",
+    "tailwindcss": "^4.1.18",
+    "tsx": "^4.20.5",
+    "typescript": "^5.9.3",
+    "typescript-eslint": "^8.51.0",
+    "uuid": "^13.0.0",
+    "vite": "^7.3.0",
+    "vite-plugin-istanbul": "^7.2.1",
+    "vitest": "^4.0.16",
+    "wrangler": "^4.54.0"
+  }
+}