@schalkneethling/toolkit 0.1.5 → 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (30) hide show
  1. package/README.md +29 -7
  2. package/dist/index.mjs +90 -6
  3. package/dist/index.mjs.map +1 -1
  4. package/hooks/auto-approve-safe-commands/hook.mjs +134 -0
  5. package/hooks/auto-approve-safe-commands/hook.mts +188 -0
  6. package/hooks/auto-approve-safe-commands/settings-fragment.json +17 -0
  7. package/hooks/block-dangerous-commands/hook.mjs +3 -3
  8. package/hooks/block-dangerous-commands/hook.mts +23 -10
  9. package/package.json +8 -10
  10. package/skills/css-coder/SKILL.md +95 -0
  11. package/skills/css-coder/references/patterns.md +224 -0
  12. package/skills/css-tokens/README.md +152 -0
  13. package/skills/css-tokens/SKILL.md +125 -0
  14. package/skills/css-tokens/references/tokens.css +162 -0
  15. package/skills/frontend-security/SKILL.md +134 -0
  16. package/skills/frontend-security/references/csp-configuration.md +191 -0
  17. package/skills/frontend-security/references/csrf-protection.md +327 -0
  18. package/skills/frontend-security/references/dom-security.md +229 -0
  19. package/skills/frontend-security/references/file-upload-security.md +310 -0
  20. package/skills/frontend-security/references/framework-patterns.md +307 -0
  21. package/skills/frontend-security/references/input-validation.md +232 -0
  22. package/skills/frontend-security/references/jwt-security.md +300 -0
  23. package/skills/frontend-security/references/nodejs-npm-security.md +261 -0
  24. package/skills/frontend-security/references/xss-prevention.md +163 -0
  25. package/skills/frontend-testing/SKILL.md +357 -0
  26. package/skills/frontend-testing/references/accessibility-testing.md +368 -0
  27. package/skills/frontend-testing/references/aria-snapshots.md +517 -0
  28. package/skills/frontend-testing/references/locator-strategies.md +295 -0
  29. package/skills/frontend-testing/references/visual-regression.md +466 -0
  30. package/skills/refined-plan-mode/SKILL.md +84 -0
@@ -0,0 +1,357 @@
1
+ ---
2
+ name: frontend-testing
3
+ description: Write tests that start with acceptance criteria, then add implementation tests for robustness. Use when writing unit tests (Vitest), end-to-end tests (Playwright), visual regression tests, or accessibility tests. Emphasizes user-centric testing, semantic locators, accessibility validation, and the balance between acceptance and implementation testing.
4
+ ---
5
+
6
+ # Frontend Testing
7
+
8
+ Start by writing tests that validate acceptance criteria. Then add implementation tests where they provide value.
9
+
10
+ ## Core Principle
11
+
12
+ > "The more your tests resemble the way your software is used, the more confidence they can give you." — Kent C. Dodds
13
+
14
+ This principle guides testing decisions, but isn't the whole picture:
15
+
16
+ - **Acceptance criteria tests** verify the system does what users/stakeholders need. These should be stable across refactors.
17
+ - **Implementation tests** verify the pieces are robust — edge cases, error handling, complex logic. These may change when you refactor.
18
+
19
+ Both have value. The anti-pattern to avoid is tests that *only* mirror implementation without validating meaningful behavior.
20
+
21
+ ## When to Load References
22
+
23
+ Load reference files based on test type:
24
+
25
+ - **Unit tests with DOM**: `references/locator-strategies.md`
26
+ - **E2E tests**: `references/locator-strategies.md`, `references/aria-snapshots.md`
27
+ - **Visual regression tests**: `references/visual-regression.md`
28
+ - **Accessibility audits**: `references/accessibility-testing.md`
29
+ - **Structure validation**: `references/aria-snapshots.md` — consolidate multiple assertions into one
30
+ - **All tests**: Start with this file for core workflow
31
+
32
+ ## Workflow
33
+
34
+ ### Step 1: Start with Acceptance Criteria
35
+
36
+ Before writing any test, identify what the code should do from the user's perspective.
37
+
38
+ Ask for or extract criteria from:
39
+ - Ticket description or user story
40
+ - Figma annotations
41
+ - Functional requirements
42
+ - Product owner clarification
43
+
44
+ Document criteria as a checklist. These become your first tests.
45
+
46
+ **Write acceptance tests before reading implementation.** This prevents circular validation where tests just confirm "code does what code does."
47
+
48
+ ### Step 2: Map Criteria to Test Cases
49
+
50
+ For each criterion, identify:
51
+ - **Happy path**: Normal expected behavior
52
+ - **Edge cases**: Boundary conditions
53
+ - **Error cases**: Invalid inputs, failures
54
+
55
+ Example mapping:
56
+ ```text
57
+ Criterion: "User can filter products by category"
58
+ ├─ Happy path: Select category, products filter correctly
59
+ ├─ Edge case: No products match filter, show empty state
60
+ ├─ Edge case: Clear filter, all products show again
61
+ ├─ Error case: Filter API fails, show error message
62
+ └─ Accessibility: Filter controls are keyboard accessible
63
+ ```
64
+
65
+ ### Step 3: Add Implementation Tests (Unit Tests)
66
+
67
+ After acceptance tests pass, add unit tests for implementation robustness:
68
+
69
+ - **Edge cases** the criteria don't cover (null, undefined, empty arrays, boundary values)
70
+ - **Algorithm correctness** for complex calculations
71
+ - **Error handling paths** (exceptions, network failures, parse errors)
72
+ - **Complex branching logic** hard to exercise through integration tests
73
+ - **Performance-sensitive code** that needs specific validation
74
+
75
+ ```text
76
+ Function: filterProducts(products, category)
77
+ ├─ Acceptance: Returns matching products (from criteria)
78
+ ├─ Implementation: Returns empty array when products is null
79
+ ├─ Implementation: Returns all products when category is empty string
80
+ ├─ Implementation: Handles case-insensitive category matching
81
+ └─ Implementation: Does not mutate original array
82
+ ```
83
+
84
+ The distinction: acceptance tests should rarely change on refactor; implementation tests may need updates when internals change.
85
+
86
+ ### Step 4: Choose Test Type
87
+
88
+ | Scenario | Test Type | Tool |
89
+ |----------|-----------|------|
90
+ | Pure logic (no DOM) | Unit test | Vitest |
91
+ | Component behavior | Unit test with DOM | Vitest + Testing Library |
92
+ | User flows, real browser | E2E test | Playwright |
93
+ | Semantic structure validation | ARIA snapshot | Playwright `toMatchAriaSnapshot` |
94
+ | Visual appearance | VRT | Playwright screenshots |
95
+ | Accessibility compliance | A11y test | Playwright + axe-core |
96
+
97
+ **ARIA snapshots** are particularly valuable for E2E tests. A single snapshot can replace multiple individual assertions while validating the accessibility tree structure.
98
+
99
+ **DOM Environment for Unit Tests:** Prefer happy-dom over jsdom. It's faster, and its API limitations serve as a useful signal — if happy-dom doesn't support what you're testing, consider whether it belongs in an E2E test instead.
100
+
101
+ ### Step 5: Write Tests Before/Alongside Code
102
+
103
+ - **Ideal**: Write test first, then implementation (TDD)
104
+ - **Acceptable**: Write test immediately after implementing each criterion
105
+ - **Avoid**: Write all tests after implementation is "done"
106
+
107
+ ## Test Structure
108
+
109
+ ### Unit Tests (Vitest)
110
+
111
+ ```javascript
112
+ describe("calculateDiscount", () => {
113
+ describe("when customer has premium membership", () => {
114
+ it("applies 20% discount to order total", () => {
115
+ // Arrange - Set up test data matching criterion
116
+ const order = { total: 100, membership: "premium" };
117
+
118
+ // Act - Call the function
119
+ const result = calculateDiscount(order);
120
+
121
+ // Assert - Verify expected outcome from requirements
122
+ expect(result).toBe(80);
123
+ });
124
+ });
125
+ });
126
+ ```
127
+
128
+ ### Component Tests (Vitest + Testing Library)
129
+
130
+ ```javascript
131
+ import { render, screen } from "@testing-library/react";
132
+ import userEvent from "@testing-library/user-event";
133
+
134
+ describe("LoginForm", () => {
135
+ describe("when credentials are invalid", () => {
136
+ it("displays error message to user", async () => {
137
+ const user = userEvent.setup();
138
+ render(<LoginForm />);
139
+
140
+ // Interact using accessible queries
141
+ await user.type(
142
+ screen.getByLabelText(/email/i),
143
+ "invalid@test.com"
144
+ );
145
+ await user.type(
146
+ screen.getByLabelText(/password/i),
147
+ "wrong"
148
+ );
149
+ await user.click(
150
+ screen.getByRole("button", { name: /sign in/i })
151
+ );
152
+
153
+ // Assert on user-visible outcome
154
+ expect(
155
+ await screen.findByRole("alert")
156
+ ).toHaveTextContent(/invalid credentials/i);
157
+ });
158
+ });
159
+ });
160
+ ```
161
+
162
+ ### E2E Tests (Playwright)
163
+
164
+ ```javascript
165
+ import { test, expect } from "@playwright/test";
166
+
167
+ test.describe("Product Catalog", () => {
168
+ test.describe("filtering by category", () => {
169
+ test("shows only matching products", async ({ page }) => {
170
+ await page.goto("/products");
171
+
172
+ // Use semantic locators
173
+ await page.getByRole("combobox", { name: /category/i }).selectOption("Electronics");
174
+
175
+ // Assert count, then spot-check first/last
176
+ const products = page.getByRole("article");
177
+ await expect(products).toHaveCount(5);
178
+ await expect(products.first()).toContainText(/electronics/i);
179
+ await expect(products.last()).toContainText(/electronics/i);
180
+ });
181
+ });
182
+ });
183
+ ```
184
+
185
+ When you need to verify all items, use `Promise.all` for parallel assertions:
186
+
187
+ ```javascript
188
+ test("all products match filter", async ({ page }) => {
189
+ await page.goto("/products");
190
+ await page.getByRole("combobox", { name: /category/i }).selectOption("Electronics");
191
+
192
+ const products = await page.getByRole("article").all();
193
+
194
+ // Parallel assertions — faster than sequential await in a loop
195
+ await Promise.all(
196
+ products.map(product =>
197
+ expect(product.getByText(/electronics/i)).toBeVisible()
198
+ )
199
+ );
200
+ });
201
+ ```
202
+
203
+ ### E2E Tests with ARIA Snapshots
204
+
205
+ ARIA snapshots consolidate multiple assertions into one, validating semantic structure:
206
+
207
+ ```javascript
208
+ test.describe("Login Page", () => {
209
+ test("has correct form structure", async ({ page }) => {
210
+ await page.goto("/login");
211
+
212
+ // One snapshot replaces 5+ individual assertions
213
+ await expect(page.getByRole("main")).toMatchAriaSnapshot(`
214
+ - heading "Sign In" [level=1]
215
+ - textbox "Email"
216
+ - textbox "Password"
217
+ - button "Sign In"
218
+ - link "Forgot password?"
219
+ `);
220
+ });
221
+
222
+ test("shows validation errors on empty submit", async ({ page }) => {
223
+ await page.goto("/login");
224
+ await page.getByRole("button", { name: /sign in/i }).click();
225
+
226
+ await expect(page.getByRole("form")).toMatchAriaSnapshot(`
227
+ - textbox "Email"
228
+ - text "Email is required"
229
+ - textbox "Password"
230
+ - text "Password is required"
231
+ - button "Sign In"
232
+ `);
233
+ });
234
+ });
235
+ ```
236
+
237
+ ## Locator Priority
238
+
239
+ Use locators that reflect how users and assistive technologies find elements:
240
+
241
+ 1. **`getByRole`** — First choice. Queries accessibility tree.
242
+ 2. **`getByLabelText`** — Best for form fields. Users find inputs by labels.
243
+ 3. **`getByPlaceholderText`** — When no label exists (not ideal).
244
+ 4. **`getByText`** — For non-interactive elements.
245
+ 5. **`getByAltText`** — For images.
246
+ 6. **`getByTestId`** — Last resort escape hatch.
247
+
248
+ If you can't find an element with semantic queries, the UI may have accessibility issues.
249
+
250
+ ## Anti-Patterns
251
+
252
+ ### Testing Only Implementation Details
253
+
254
+ Tests that only verify internals without validating meaningful behavior:
255
+
256
+ ```javascript
257
+ // BAD: Tests internal method exists, provides no behavior guarantee
258
+ it("has a validateFields method", () => {
259
+ expect(typeof form.validateFields).toBe("function");
260
+ });
261
+
262
+ // BAD: Asserts implementation without verifying outcome
263
+ it("calls the validator", () => {
264
+ expect(mockValidator).toHaveBeenCalledWith(data);
265
+ });
266
+
267
+ // GOOD: Tests observable behavior (acceptance)
268
+ it("prevents submission with invalid email", async () => {
269
+ await user.type(emailInput, "not-an-email");
270
+ await user.click(submitButton);
271
+ expect(screen.getByRole("alert")).toHaveTextContent(/valid email/i);
272
+ });
273
+
274
+ // ALSO GOOD: Tests implementation robustness (unit)
275
+ it("returns validation errors for malformed email", () => {
276
+ const result = validateEmail("not-an-email");
277
+ expect(result.valid).toBe(false);
278
+ expect(result.error).toBe("Invalid email format");
279
+ });
280
+ ```
281
+
282
+ The key distinction: implementation tests should verify *meaningful* behavior of units, not just that code paths execute.
283
+
284
+ ### Circular Validation
285
+
286
+ ```javascript
287
+ // BAD: Test data derived from implementation
288
+ const expected = formatPrice(100); // Don't compute expected from code!
289
+ expect(formatPrice(100)).toBe(expected);
290
+
291
+ // GOOD: Expected value from requirements
292
+ expect(formatPrice(100)).toBe("$100.00");
293
+ ```
294
+
295
+ ### Over-Mocking
296
+
297
+ ```javascript
298
+ import { vi } from "vitest";
299
+
300
+ // BAD: Mock everything, test nothing real
301
+ vi.mock("./api");
302
+ vi.mock("./utils");
303
+ vi.mock("./formatter");
304
+ // Now just testing mocks talk to each other
305
+
306
+ // GOOD: Mock only external boundaries
307
+ // Mock: APIs, databases, time, file system
308
+ // Real: Business logic, components, formatters
309
+ ```
310
+
311
+ ### Brittle Selectors
312
+
313
+ ```javascript
314
+ // BAD: Implementation-dependent selectors
315
+ page.locator(".btn-primary.submit-form");
316
+ page.locator("#root > div > form > button:nth-child(3)");
317
+
318
+ // GOOD: Semantic locators
319
+ page.getByRole("button", { name: /submit order/i });
320
+ ```
321
+
322
+ ## Failing Tests Mean Bugs (Usually)
323
+
324
+ When a test fails, the investigation depends on the test type:
325
+
326
+ **Acceptance test fails:**
327
+ 1. Check the code under test first — likely a real bug
328
+ 2. Verify the test still matches current requirements — requirements may have changed
329
+ 3. Only update the test after confirming the new behavior is correct
330
+
331
+ **Implementation test fails:**
332
+ 1. If you're refactoring, the test may legitimately need updating
333
+ 2. If you're not refactoring, check the code — likely a bug
334
+ 3. Consider whether the test is too tightly coupled to implementation
335
+
336
+ Don't reflexively update tests to pass. Investigate why they fail.
337
+
338
+ ## Checklist Before Submitting Tests
339
+
340
+ - [ ] Each acceptance criterion has at least one test
341
+ - [ ] Edge cases from criteria are covered
342
+ - [ ] Implementation tests added for complex logic, error handling, boundary conditions
343
+ - [ ] Tests are named descriptively (criteria-based or behavior-based)
344
+ - [ ] Using semantic locators (getByRole, getByLabelText)
345
+ - [ ] No tests that only verify "code runs" without validating meaningful behavior
346
+ - [ ] Failing tests investigated appropriately (acceptance vs implementation)
347
+ - [ ] Accessibility checks included for interactive components
348
+ - [ ] Consider ARIA snapshots for structure validation (consolidates multiple assertions)
349
+
350
+ ## References
351
+
352
+ Load these files for detailed guidance:
353
+
354
+ - `references/locator-strategies.md` — Complete locator hierarchy with examples
355
+ - `references/aria-snapshots.md` — Structure validation, consolidating assertions
356
+ - `references/accessibility-testing.md` — axe-core integration, WCAG targeting
357
+ - `references/visual-regression.md` — Screenshot testing, baseline management