@schalkneethling/toolkit 0.1.5 → 0.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +29 -7
- package/dist/index.mjs +90 -6
- package/dist/index.mjs.map +1 -1
- package/hooks/auto-approve-safe-commands/hook.mjs +134 -0
- package/hooks/auto-approve-safe-commands/hook.mts +188 -0
- package/hooks/auto-approve-safe-commands/settings-fragment.json +17 -0
- package/hooks/block-dangerous-commands/hook.mjs +3 -3
- package/hooks/block-dangerous-commands/hook.mts +23 -10
- package/package.json +8 -10
- package/skills/css-coder/SKILL.md +95 -0
- package/skills/css-coder/references/patterns.md +224 -0
- package/skills/css-tokens/README.md +152 -0
- package/skills/css-tokens/SKILL.md +125 -0
- package/skills/css-tokens/references/tokens.css +162 -0
- package/skills/frontend-security/SKILL.md +134 -0
- package/skills/frontend-security/references/csp-configuration.md +191 -0
- package/skills/frontend-security/references/csrf-protection.md +327 -0
- package/skills/frontend-security/references/dom-security.md +229 -0
- package/skills/frontend-security/references/file-upload-security.md +310 -0
- package/skills/frontend-security/references/framework-patterns.md +307 -0
- package/skills/frontend-security/references/input-validation.md +232 -0
- package/skills/frontend-security/references/jwt-security.md +300 -0
- package/skills/frontend-security/references/nodejs-npm-security.md +261 -0
- package/skills/frontend-security/references/xss-prevention.md +163 -0
- package/skills/frontend-testing/SKILL.md +357 -0
- package/skills/frontend-testing/references/accessibility-testing.md +368 -0
- package/skills/frontend-testing/references/aria-snapshots.md +517 -0
- package/skills/frontend-testing/references/locator-strategies.md +295 -0
- package/skills/frontend-testing/references/visual-regression.md +466 -0
- package/skills/refined-plan-mode/SKILL.md +84 -0
|
@@ -0,0 +1,357 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: frontend-testing
|
|
3
|
+
description: Write tests that start with acceptance criteria, then add implementation tests for robustness. Use when writing unit tests (Vitest), end-to-end tests (Playwright), visual regression tests, or accessibility tests. Emphasizes user-centric testing, semantic locators, accessibility validation, and the balance between acceptance and implementation testing.
|
|
4
|
+
---
|
|
5
|
+
|
|
6
|
+
# Frontend Testing
|
|
7
|
+
|
|
8
|
+
Start by writing tests that validate acceptance criteria. Then add implementation tests where they provide value.
|
|
9
|
+
|
|
10
|
+
## Core Principle
|
|
11
|
+
|
|
12
|
+
> "The more your tests resemble the way your software is used, the more confidence they can give you." — Kent C. Dodds
|
|
13
|
+
|
|
14
|
+
This principle guides testing decisions, but isn't the whole picture:
|
|
15
|
+
|
|
16
|
+
- **Acceptance criteria tests** verify the system does what users/stakeholders need. These should be stable across refactors.
|
|
17
|
+
- **Implementation tests** verify the pieces are robust — edge cases, error handling, complex logic. These may change when you refactor.
|
|
18
|
+
|
|
19
|
+
Both have value. The anti-pattern to avoid is tests that *only* mirror implementation without validating meaningful behavior.
|
|
20
|
+
|
|
21
|
+
## When to Load References
|
|
22
|
+
|
|
23
|
+
Load reference files based on test type:
|
|
24
|
+
|
|
25
|
+
- **Unit tests with DOM**: `references/locator-strategies.md`
|
|
26
|
+
- **E2E tests**: `references/locator-strategies.md`, `references/aria-snapshots.md`
|
|
27
|
+
- **Visual regression tests**: `references/visual-regression.md`
|
|
28
|
+
- **Accessibility audits**: `references/accessibility-testing.md`
|
|
29
|
+
- **Structure validation**: `references/aria-snapshots.md` — consolidate multiple assertions into one
|
|
30
|
+
- **All tests**: Start with this file for core workflow
|
|
31
|
+
|
|
32
|
+
## Workflow
|
|
33
|
+
|
|
34
|
+
### Step 1: Start with Acceptance Criteria
|
|
35
|
+
|
|
36
|
+
Before writing any test, identify what the code should do from the user's perspective.
|
|
37
|
+
|
|
38
|
+
Ask for or extract criteria from:
|
|
39
|
+
- Ticket description or user story
|
|
40
|
+
- Figma annotations
|
|
41
|
+
- Functional requirements
|
|
42
|
+
- Product owner clarification
|
|
43
|
+
|
|
44
|
+
Document criteria as a checklist. These become your first tests.
|
|
45
|
+
|
|
46
|
+
**Write acceptance tests before reading implementation.** This prevents circular validation where tests just confirm "code does what code does."
|
|
47
|
+
|
|
48
|
+
### Step 2: Map Criteria to Test Cases
|
|
49
|
+
|
|
50
|
+
For each criterion, identify:
|
|
51
|
+
- **Happy path**: Normal expected behavior
|
|
52
|
+
- **Edge cases**: Boundary conditions
|
|
53
|
+
- **Error cases**: Invalid inputs, failures
|
|
54
|
+
|
|
55
|
+
Example mapping:
|
|
56
|
+
```text
|
|
57
|
+
Criterion: "User can filter products by category"
|
|
58
|
+
├─ Happy path: Select category, products filter correctly
|
|
59
|
+
├─ Edge case: No products match filter, show empty state
|
|
60
|
+
├─ Edge case: Clear filter, all products show again
|
|
61
|
+
├─ Error case: Filter API fails, show error message
|
|
62
|
+
└─ Accessibility: Filter controls are keyboard accessible
|
|
63
|
+
```
|
|
64
|
+
|
|
65
|
+
### Step 3: Add Implementation Tests (Unit Tests)
|
|
66
|
+
|
|
67
|
+
After acceptance tests pass, add unit tests for implementation robustness:
|
|
68
|
+
|
|
69
|
+
- **Edge cases** the criteria don't cover (null, undefined, empty arrays, boundary values)
|
|
70
|
+
- **Algorithm correctness** for complex calculations
|
|
71
|
+
- **Error handling paths** (exceptions, network failures, parse errors)
|
|
72
|
+
- **Complex branching logic** hard to exercise through integration tests
|
|
73
|
+
- **Performance-sensitive code** that needs specific validation
|
|
74
|
+
|
|
75
|
+
```text
|
|
76
|
+
Function: filterProducts(products, category)
|
|
77
|
+
├─ Acceptance: Returns matching products (from criteria)
|
|
78
|
+
├─ Implementation: Returns empty array when products is null
|
|
79
|
+
├─ Implementation: Returns all products when category is empty string
|
|
80
|
+
├─ Implementation: Handles case-insensitive category matching
|
|
81
|
+
└─ Implementation: Does not mutate original array
|
|
82
|
+
```
|
|
83
|
+
|
|
84
|
+
The distinction: acceptance tests should rarely change on refactor; implementation tests may need updates when internals change.
|
|
85
|
+
|
|
86
|
+
### Step 4: Choose Test Type
|
|
87
|
+
|
|
88
|
+
| Scenario | Test Type | Tool |
|
|
89
|
+
|----------|-----------|------|
|
|
90
|
+
| Pure logic (no DOM) | Unit test | Vitest |
|
|
91
|
+
| Component behavior | Unit test with DOM | Vitest + Testing Library |
|
|
92
|
+
| User flows, real browser | E2E test | Playwright |
|
|
93
|
+
| Semantic structure validation | ARIA snapshot | Playwright `toMatchAriaSnapshot` |
|
|
94
|
+
| Visual appearance | VRT | Playwright screenshots |
|
|
95
|
+
| Accessibility compliance | A11y test | Playwright + axe-core |
|
|
96
|
+
|
|
97
|
+
**ARIA snapshots** are particularly valuable for E2E tests. A single snapshot can replace multiple individual assertions while validating the accessibility tree structure.
|
|
98
|
+
|
|
99
|
+
**DOM Environment for Unit Tests:** Prefer happy-dom over jsdom. It's faster, and its API limitations serve as a useful signal — if happy-dom doesn't support what you're testing, consider whether it belongs in an E2E test instead.
|
|
100
|
+
|
|
101
|
+
### Step 5: Write Tests Before/Alongside Code
|
|
102
|
+
|
|
103
|
+
- **Ideal**: Write test first, then implementation (TDD)
|
|
104
|
+
- **Acceptable**: Write test immediately after implementing each criterion
|
|
105
|
+
- **Avoid**: Write all tests after implementation is "done"
|
|
106
|
+
|
|
107
|
+
## Test Structure
|
|
108
|
+
|
|
109
|
+
### Unit Tests (Vitest)
|
|
110
|
+
|
|
111
|
+
```javascript
|
|
112
|
+
describe("calculateDiscount", () => {
|
|
113
|
+
describe("when customer has premium membership", () => {
|
|
114
|
+
it("applies 20% discount to order total", () => {
|
|
115
|
+
// Arrange - Set up test data matching criterion
|
|
116
|
+
const order = { total: 100, membership: "premium" };
|
|
117
|
+
|
|
118
|
+
// Act - Call the function
|
|
119
|
+
const result = calculateDiscount(order);
|
|
120
|
+
|
|
121
|
+
// Assert - Verify expected outcome from requirements
|
|
122
|
+
expect(result).toBe(80);
|
|
123
|
+
});
|
|
124
|
+
});
|
|
125
|
+
});
|
|
126
|
+
```
|
|
127
|
+
|
|
128
|
+
### Component Tests (Vitest + Testing Library)
|
|
129
|
+
|
|
130
|
+
```javascript
|
|
131
|
+
import { render, screen } from "@testing-library/react";
|
|
132
|
+
import userEvent from "@testing-library/user-event";
|
|
133
|
+
|
|
134
|
+
describe("LoginForm", () => {
|
|
135
|
+
describe("when credentials are invalid", () => {
|
|
136
|
+
it("displays error message to user", async () => {
|
|
137
|
+
const user = userEvent.setup();
|
|
138
|
+
render(<LoginForm />);
|
|
139
|
+
|
|
140
|
+
// Interact using accessible queries
|
|
141
|
+
await user.type(
|
|
142
|
+
screen.getByLabelText(/email/i),
|
|
143
|
+
"invalid@test.com"
|
|
144
|
+
);
|
|
145
|
+
await user.type(
|
|
146
|
+
screen.getByLabelText(/password/i),
|
|
147
|
+
"wrong"
|
|
148
|
+
);
|
|
149
|
+
await user.click(
|
|
150
|
+
screen.getByRole("button", { name: /sign in/i })
|
|
151
|
+
);
|
|
152
|
+
|
|
153
|
+
// Assert on user-visible outcome
|
|
154
|
+
expect(
|
|
155
|
+
await screen.findByRole("alert")
|
|
156
|
+
).toHaveTextContent(/invalid credentials/i);
|
|
157
|
+
});
|
|
158
|
+
});
|
|
159
|
+
});
|
|
160
|
+
```
|
|
161
|
+
|
|
162
|
+
### E2E Tests (Playwright)
|
|
163
|
+
|
|
164
|
+
```javascript
|
|
165
|
+
import { test, expect } from "@playwright/test";
|
|
166
|
+
|
|
167
|
+
test.describe("Product Catalog", () => {
|
|
168
|
+
test.describe("filtering by category", () => {
|
|
169
|
+
test("shows only matching products", async ({ page }) => {
|
|
170
|
+
await page.goto("/products");
|
|
171
|
+
|
|
172
|
+
// Use semantic locators
|
|
173
|
+
await page.getByRole("combobox", { name: /category/i }).selectOption("Electronics");
|
|
174
|
+
|
|
175
|
+
// Assert count, then spot-check first/last
|
|
176
|
+
const products = page.getByRole("article");
|
|
177
|
+
await expect(products).toHaveCount(5);
|
|
178
|
+
await expect(products.first()).toContainText(/electronics/i);
|
|
179
|
+
await expect(products.last()).toContainText(/electronics/i);
|
|
180
|
+
});
|
|
181
|
+
});
|
|
182
|
+
});
|
|
183
|
+
```
|
|
184
|
+
|
|
185
|
+
When you need to verify all items, use `Promise.all` for parallel assertions:
|
|
186
|
+
|
|
187
|
+
```javascript
|
|
188
|
+
test("all products match filter", async ({ page }) => {
|
|
189
|
+
await page.goto("/products");
|
|
190
|
+
await page.getByRole("combobox", { name: /category/i }).selectOption("Electronics");
|
|
191
|
+
|
|
192
|
+
const products = await page.getByRole("article").all();
|
|
193
|
+
|
|
194
|
+
// Parallel assertions — faster than sequential await in a loop
|
|
195
|
+
await Promise.all(
|
|
196
|
+
products.map(product =>
|
|
197
|
+
expect(product.getByText(/electronics/i)).toBeVisible()
|
|
198
|
+
)
|
|
199
|
+
);
|
|
200
|
+
});
|
|
201
|
+
```
|
|
202
|
+
|
|
203
|
+
### E2E Tests with ARIA Snapshots
|
|
204
|
+
|
|
205
|
+
ARIA snapshots consolidate multiple assertions into one, validating semantic structure:
|
|
206
|
+
|
|
207
|
+
```javascript
|
|
208
|
+
test.describe("Login Page", () => {
|
|
209
|
+
test("has correct form structure", async ({ page }) => {
|
|
210
|
+
await page.goto("/login");
|
|
211
|
+
|
|
212
|
+
// One snapshot replaces 5+ individual assertions
|
|
213
|
+
await expect(page.getByRole("main")).toMatchAriaSnapshot(`
|
|
214
|
+
- heading "Sign In" [level=1]
|
|
215
|
+
- textbox "Email"
|
|
216
|
+
- textbox "Password"
|
|
217
|
+
- button "Sign In"
|
|
218
|
+
- link "Forgot password?"
|
|
219
|
+
`);
|
|
220
|
+
});
|
|
221
|
+
|
|
222
|
+
test("shows validation errors on empty submit", async ({ page }) => {
|
|
223
|
+
await page.goto("/login");
|
|
224
|
+
await page.getByRole("button", { name: /sign in/i }).click();
|
|
225
|
+
|
|
226
|
+
await expect(page.getByRole("form")).toMatchAriaSnapshot(`
|
|
227
|
+
- textbox "Email"
|
|
228
|
+
- text "Email is required"
|
|
229
|
+
- textbox "Password"
|
|
230
|
+
- text "Password is required"
|
|
231
|
+
- button "Sign In"
|
|
232
|
+
`);
|
|
233
|
+
});
|
|
234
|
+
});
|
|
235
|
+
```
|
|
236
|
+
|
|
237
|
+
## Locator Priority
|
|
238
|
+
|
|
239
|
+
Use locators that reflect how users and assistive technologies find elements:
|
|
240
|
+
|
|
241
|
+
1. **`getByRole`** — First choice. Queries accessibility tree.
|
|
242
|
+
2. **`getByLabelText`** — Best for form fields. Users find inputs by labels.
|
|
243
|
+
3. **`getByPlaceholderText`** — When no label exists (not ideal).
|
|
244
|
+
4. **`getByText`** — For non-interactive elements.
|
|
245
|
+
5. **`getByAltText`** — For images.
|
|
246
|
+
6. **`getByTestId`** — Last resort escape hatch.
|
|
247
|
+
|
|
248
|
+
If you can't find an element with semantic queries, the UI may have accessibility issues.
|
|
249
|
+
|
|
250
|
+
## Anti-Patterns
|
|
251
|
+
|
|
252
|
+
### Testing Only Implementation Details
|
|
253
|
+
|
|
254
|
+
Tests that only verify internals without validating meaningful behavior:
|
|
255
|
+
|
|
256
|
+
```javascript
|
|
257
|
+
// BAD: Tests internal method exists, provides no behavior guarantee
|
|
258
|
+
it("has a validateFields method", () => {
|
|
259
|
+
expect(typeof form.validateFields).toBe("function");
|
|
260
|
+
});
|
|
261
|
+
|
|
262
|
+
// BAD: Asserts implementation without verifying outcome
|
|
263
|
+
it("calls the validator", () => {
|
|
264
|
+
expect(mockValidator).toHaveBeenCalledWith(data);
|
|
265
|
+
});
|
|
266
|
+
|
|
267
|
+
// GOOD: Tests observable behavior (acceptance)
|
|
268
|
+
it("prevents submission with invalid email", async () => {
|
|
269
|
+
await user.type(emailInput, "not-an-email");
|
|
270
|
+
await user.click(submitButton);
|
|
271
|
+
expect(screen.getByRole("alert")).toHaveTextContent(/valid email/i);
|
|
272
|
+
});
|
|
273
|
+
|
|
274
|
+
// ALSO GOOD: Tests implementation robustness (unit)
|
|
275
|
+
it("returns validation errors for malformed email", () => {
|
|
276
|
+
const result = validateEmail("not-an-email");
|
|
277
|
+
expect(result.valid).toBe(false);
|
|
278
|
+
expect(result.error).toBe("Invalid email format");
|
|
279
|
+
});
|
|
280
|
+
```
|
|
281
|
+
|
|
282
|
+
The key distinction: implementation tests should verify *meaningful* behavior of units, not just that code paths execute.
|
|
283
|
+
|
|
284
|
+
### Circular Validation
|
|
285
|
+
|
|
286
|
+
```javascript
|
|
287
|
+
// BAD: Test data derived from implementation
|
|
288
|
+
const expected = formatPrice(100); // Don't compute expected from code!
|
|
289
|
+
expect(formatPrice(100)).toBe(expected);
|
|
290
|
+
|
|
291
|
+
// GOOD: Expected value from requirements
|
|
292
|
+
expect(formatPrice(100)).toBe("$100.00");
|
|
293
|
+
```
|
|
294
|
+
|
|
295
|
+
### Over-Mocking
|
|
296
|
+
|
|
297
|
+
```javascript
|
|
298
|
+
import { vi } from "vitest";
|
|
299
|
+
|
|
300
|
+
// BAD: Mock everything, test nothing real
|
|
301
|
+
vi.mock("./api");
|
|
302
|
+
vi.mock("./utils");
|
|
303
|
+
vi.mock("./formatter");
|
|
304
|
+
// Now just testing mocks talk to each other
|
|
305
|
+
|
|
306
|
+
// GOOD: Mock only external boundaries
|
|
307
|
+
// Mock: APIs, databases, time, file system
|
|
308
|
+
// Real: Business logic, components, formatters
|
|
309
|
+
```
|
|
310
|
+
|
|
311
|
+
### Brittle Selectors
|
|
312
|
+
|
|
313
|
+
```javascript
|
|
314
|
+
// BAD: Implementation-dependent selectors
|
|
315
|
+
page.locator(".btn-primary.submit-form");
|
|
316
|
+
page.locator("#root > div > form > button:nth-child(3)");
|
|
317
|
+
|
|
318
|
+
// GOOD: Semantic locators
|
|
319
|
+
page.getByRole("button", { name: /submit order/i });
|
|
320
|
+
```
|
|
321
|
+
|
|
322
|
+
## Failing Tests Mean Bugs (Usually)
|
|
323
|
+
|
|
324
|
+
When a test fails, the investigation depends on the test type:
|
|
325
|
+
|
|
326
|
+
**Acceptance test fails:**
|
|
327
|
+
1. Check the code under test first — likely a real bug
|
|
328
|
+
2. Verify the test still matches current requirements — requirements may have changed
|
|
329
|
+
3. Only update the test after confirming the new behavior is correct
|
|
330
|
+
|
|
331
|
+
**Implementation test fails:**
|
|
332
|
+
1. If you're refactoring, the test may legitimately need updating
|
|
333
|
+
2. If you're not refactoring, check the code — likely a bug
|
|
334
|
+
3. Consider whether the test is too tightly coupled to implementation
|
|
335
|
+
|
|
336
|
+
Don't reflexively update tests to pass. Investigate why they fail.
|
|
337
|
+
|
|
338
|
+
## Checklist Before Submitting Tests
|
|
339
|
+
|
|
340
|
+
- [ ] Each acceptance criterion has at least one test
|
|
341
|
+
- [ ] Edge cases from criteria are covered
|
|
342
|
+
- [ ] Implementation tests added for complex logic, error handling, boundary conditions
|
|
343
|
+
- [ ] Tests are named descriptively (criteria-based or behavior-based)
|
|
344
|
+
- [ ] Using semantic locators (getByRole, getByLabelText)
|
|
345
|
+
- [ ] No tests that only verify "code runs" without validating meaningful behavior
|
|
346
|
+
- [ ] Failing tests investigated appropriately (acceptance vs implementation)
|
|
347
|
+
- [ ] Accessibility checks included for interactive components
|
|
348
|
+
- [ ] Consider ARIA snapshots for structure validation (consolidates multiple assertions)
|
|
349
|
+
|
|
350
|
+
## References
|
|
351
|
+
|
|
352
|
+
Load these files for detailed guidance:
|
|
353
|
+
|
|
354
|
+
- `references/locator-strategies.md` — Complete locator hierarchy with examples
|
|
355
|
+
- `references/aria-snapshots.md` — Structure validation, consolidating assertions
|
|
356
|
+
- `references/accessibility-testing.md` — axe-core integration, WCAG targeting
|
|
357
|
+
- `references/visual-regression.md` — Screenshot testing, baseline management
|