npm - @vodailoc/kilo-kit-mcp - Versions diffs - 1.1.0 → 1.1.1 - Mend

@vodailoc/kilo-kit-mcp 1.1.0 → 1.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (570) hide show

package/skills/engineering/backend-development/references/backend-testing.md CHANGED Viewed

@@ -1,429 +1,429 @@
-# Backend Testing Strategies
-Comprehensive testing approaches, frameworks, and quality assurance practices (2025).
-## Test Pyramid (70-20-10 Rule)
-```
-        /\
-       /E2E\     10% - End-to-End Tests
-      /------\
-     /Integr.\ 20% - Integration Tests
-    /----------\
-   /   Unit     \ 70% - Unit Tests
-  /--------------\
-```
-**Rationale:**
-- Unit tests: Fast, cheap, isolate bugs quickly
-- Integration tests: Verify component interactions
-- E2E tests: Expensive, slow, but validate real user flows
-## Unit Testing
-### Frameworks by Language
-**TypeScript/JavaScript:**
-- **Vitest** - 50% faster than Jest in CI/CD, ESM native
-- **Jest** - Mature, large ecosystem, snapshot testing
-**Python:**
-- **Pytest** - Industry standard, fixtures, parametrization
-- **Unittest** - Built-in, standard library
-**Go:**
-- **testing** - Built-in, table-driven tests
-- **testify** - Assertions and mocking
-### Best Practices
-```typescript
-// Good: Test single responsibility
-describe('UserService', () => {
-  describe('createUser', () => {
-    it('should create user with valid data', async () => {
-      const userData = { email: 'test@example.com', name: 'Test' };
-      const user = await userService.createUser(userData);
-      expect(user).toMatchObject(userData);
-      expect(user.id).toBeDefined();
-    });
-    it('should throw error with duplicate email', async () => {
-      const userData = { email: 'existing@example.com', name: 'Test' };
-      await expect(userService.createUser(userData))
-        .rejects.toThrow('Email already exists');
-    });
-    it('should hash password before storing', async () => {
-      const userData = { email: 'test@example.com', password: 'plain123' };
-      const user = await userService.createUser(userData);
-      expect(user.password).not.toBe('plain123');
-      expect(user.password).toMatch(/^\$argon2id\$/);
-    });
-  });
-});
-```
-### Mocking
-```typescript
-// Mock external dependencies
-jest.mock('./emailService');
-it('should send welcome email after user creation', async () => {
-  const emailService = require('./emailService');
-  emailService.sendWelcomeEmail = jest.fn();
-  await userService.createUser({ email: 'test@example.com' });
-  expect(emailService.sendWelcomeEmail).toHaveBeenCalledWith('test@example.com');
-});
-```
-## Integration Testing
-### API Integration Tests
-```typescript
-import request from 'supertest';
-import { app } from '../app';
-describe('POST /api/users', () => {
-  beforeAll(async () => {
-    await db.connect(); // Real database connection (test DB)
-  });
-  afterAll(async () => {
-    await db.disconnect();
-  });
-  beforeEach(async () => {
-    await db.users.deleteMany({}); // Clean state
-  });
-  it('should create user and return 201', async () => {
-    const response = await request(app)
-      .post('/api/users')
-      .send({ email: 'test@example.com', name: 'Test User' })
-      .expect(201);
-    expect(response.body).toMatchObject({
-      email: 'test@example.com',
-      name: 'Test User',
-    });
-    // Verify database persistence
-    const user = await db.users.findOne({ email: 'test@example.com' });
-    expect(user).toBeDefined();
-  });
-  it('should return 400 for invalid email', async () => {
-    await request(app)
-      .post('/api/users')
-      .send({ email: 'invalid-email', name: 'Test' })
-      .expect(400)
-      .expect((res) => {
-        expect(res.body.error).toBe('Invalid email format');
-      });
-  });
-});
-```
-### Database Testing with TestContainers
-```typescript
-import { GenericContainer } from 'testcontainers';
-let container;
-let db;
-beforeAll(async () => {
-  // Spin up real PostgreSQL in Docker
-  container = await new GenericContainer('postgres:15')
-    .withEnvironment({ POSTGRES_PASSWORD: 'test' })
-    .withExposedPorts(5432)
-    .start();
-  const port = container.getMappedPort(5432);
-  db = await createConnection({
-    host: 'localhost',
-    port,
-    database: 'test',
-    password: 'test',
-  });
-}, 60000);
-afterAll(async () => {
-  await container.stop();
-});
-```
-## Contract Testing (Microservices)
-### Pact (Consumer-Driven Contracts)
-```typescript
-// Consumer test
-import { Pact } from '@pact-foundation/pact';
-const provider = new Pact({
-  consumer: 'UserService',
-  provider: 'AuthService',
-});
-describe('Auth Service Contract', () => {
-  beforeAll(() => provider.setup());
-  afterEach(() => provider.verify());
-  afterAll(() => provider.finalize());
-  it('should validate user token', async () => {
-    await provider.addInteraction({
-      state: 'user token exists',
-      uponReceiving: 'a request to validate token',
-      withRequest: {
-        method: 'POST',
-        path: '/auth/validate',
-        headers: { 'Content-Type': 'application/json' },
-        body: { token: 'valid-token-123' },
-      },
-      willRespondWith: {
-        status: 200,
-        body: { valid: true, userId: '123' },
-      },
-    });
-    const response = await authClient.validateToken('valid-token-123');
-    expect(response.valid).toBe(true);
-  });
-});
-```
-## Load Testing
-### Tools Comparison
-**k6** (Modern, Developer-Friendly)
-```javascript
-import http from 'k6/http';
-import { check, sleep } from 'k6';
-export const options = {
-  stages: [
-    { duration: '2m', target: 100 }, // Ramp up to 100 users
-    { duration: '5m', target: 100 }, // Stay at 100 users
-    { duration: '2m', target: 0 },   // Ramp down to 0 users
-  ],
-  thresholds: {
-    http_req_duration: ['p(95)<500'], // 95% requests under 500ms
-  },
-};
-export default function () {
-  const res = http.get('https://api.example.com/users');
-  check(res, {
-    'status is 200': (r) => r.status === 200,
-    'response time < 500ms': (r) => r.timings.duration < 500,
-  });
-  sleep(1);
-}
-```
-**Gatling** (JVM-based, Advanced Scenarios)
-**JMeter** (GUI-based, Traditional)
-### Performance Thresholds
-- **Response time:** p95 < 500ms, p99 < 1s
-- **Throughput:** 1000+ req/sec (target based on SLA)
-- **Error rate:** < 1%
-- **Concurrent users:** Test at 2x expected peak
-## E2E Testing
-### Playwright (Modern, Multi-Browser)
-```typescript
-import { test, expect } from '@playwright/test';
-test('user can register and login', async ({ page }) => {
-  // Navigate to registration page
-  await page.goto('https://app.example.com/register');
-  // Fill registration form
-  await page.fill('input[name="email"]', 'test@example.com');
-  await page.fill('input[name="password"]', 'SecurePass123!');
-  await page.click('button[type="submit"]');
-  // Verify redirect to dashboard
-  await expect(page).toHaveURL('/dashboard');
-  await expect(page.locator('h1')).toContainText('Welcome');
-  // Verify API call was made
-  const response = await page.waitForResponse('/api/users');
-  expect(response.status()).toBe(201);
-});
-```
-## Database Migration Testing
-**Critical:** 83% migrations fail without proper testing
-```typescript
-describe('Database Migrations', () => {
-  it('should migrate from v1 to v2 without data loss', async () => {
-    // Insert test data in v1 schema
-    await db.query(`
-      INSERT INTO users (id, email, name)
-      VALUES (1, 'test@example.com', 'Test User')
-    `);
-    // Run migration
-    await runMigration('v2-add-created-at.sql');
-    // Verify v2 schema
-    const result = await db.query('SELECT * FROM users WHERE id = 1');
-    expect(result.rows[0]).toMatchObject({
-      id: 1,
-      email: 'test@example.com',
-      name: 'Test User',
-      created_at: expect.any(Date),
-    });
-  });
-  it('should rollback migration successfully', async () => {
-    await runMigration('v2-add-created-at.sql');
-    await rollbackMigration('v2-add-created-at.sql');
-    // Verify v1 schema restored
-    const columns = await db.query(`
-      SELECT column_name FROM information_schema.columns
-      WHERE table_name = 'users'
-    `);
-    expect(columns.rows.map(r => r.column_name)).not.toContain('created_at');
-  });
-});
-```
-## Security Testing
-### SAST (Static Application Security Testing)
-```bash
-# SonarQube for code quality + security
-sonar-scanner \
-  -Dsonar.projectKey=my-backend \
-  -Dsonar.sources=src \
-  -Dsonar.host.url=http://localhost:9000
-# Semgrep for security patterns
-semgrep --config auto src/
-```
-### DAST (Dynamic Application Security Testing)
-```bash
-# OWASP ZAP for runtime security scanning
-docker run -t owasp/zap2docker-stable zap-baseline.py \
-  -t https://api.example.com \
-  -r zap-report.html
-```
-### Dependency Scanning (SCA)
-```bash
-# npm audit for Node.js
-npm audit fix
-# Snyk for multi-language
-snyk test
-snyk monitor  # Continuous monitoring
-```
-## Code Coverage
-### Target Metrics (SonarQube Standards)
-- **Overall coverage:** 80%+
-- **Critical paths:** 100% (authentication, payment, data integrity)
-- **New code:** 90%+
-### Implementation
-```bash
-# Vitest with coverage
-vitest run --coverage
-# Jest with coverage
-jest --coverage --coverageThreshold='{"global":{"branches":80,"functions":80,"lines":80}}'
-```
-## CI/CD Testing Pipeline
-```yaml
-# GitHub Actions example
-name: Test Pipeline
-on: [push, pull_request]
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - name: Unit Tests
-        run: npm run test:unit
-      - name: Integration Tests
-        run: npm run test:integration
-      - name: E2E Tests
-        run: npm run test:e2e
-      - name: Load Tests
-        run: k6 run load-test.js
-      - name: Security Scan
-        run: npm audit && snyk test
-      - name: Coverage Report
-        run: npm run test:coverage
-      - name: Upload to Codecov
-        uses: codecov/codecov-action@v3
-```
-## Testing Best Practices
-1. **Arrange-Act-Assert (AAA) Pattern**
-2. **One assertion per test** (when practical)
-3. **Descriptive test names** - `should throw error when email is invalid`
-4. **Test edge cases** - Empty inputs, boundary values, null/undefined
-5. **Clean test data** - Reset database state between tests
-6. **Fast tests** - Unit tests < 10ms, Integration < 100ms
-7. **Deterministic** - No flaky tests, avoid sleep(), use waitFor()
-8. **Independent** - Tests don't depend on execution order
-## Testing Checklist
-- [ ] Unit tests cover 70% of codebase
-- [ ] Integration tests for all API endpoints
-- [ ] Contract tests for microservices
-- [ ] Load tests configured (k6/Gatling)
-- [ ] E2E tests for critical user flows
-- [ ] Database migration tests
-- [ ] Security scanning in CI/CD (SAST, DAST, SCA)
-- [ ] Code coverage reports automated
-- [ ] Tests run on every PR
-- [ ] Flaky tests eliminated
-## Resources
-- **Vitest:** https://vitest.dev/
-- **Playwright:** https://playwright.dev/
-- **k6:** https://k6.io/docs/
-- **Pact:** https://docs.pact.io/
-- **TestContainers:** https://testcontainers.com/
+# Backend Testing Strategies
+Comprehensive testing approaches, frameworks, and quality assurance practices (2025).
+## Test Pyramid (70-20-10 Rule)
+```
+        /\
+       /E2E\     10% - End-to-End Tests
+      /------\
+     /Integr.\ 20% - Integration Tests
+    /----------\
+   /   Unit     \ 70% - Unit Tests
+  /--------------\
+```
+**Rationale:**
+- Unit tests: Fast, cheap, isolate bugs quickly
+- Integration tests: Verify component interactions
+- E2E tests: Expensive, slow, but validate real user flows
+## Unit Testing
+### Frameworks by Language
+**TypeScript/JavaScript:**
+- **Vitest** - 50% faster than Jest in CI/CD, ESM native
+- **Jest** - Mature, large ecosystem, snapshot testing
+**Python:**
+- **Pytest** - Industry standard, fixtures, parametrization
+- **Unittest** - Built-in, standard library
+**Go:**
+- **testing** - Built-in, table-driven tests
+- **testify** - Assertions and mocking
+### Best Practices
+```typescript
+// Good: Test single responsibility
+describe('UserService', () => {
+  describe('createUser', () => {
+    it('should create user with valid data', async () => {
+      const userData = { email: 'test@example.com', name: 'Test' };
+      const user = await userService.createUser(userData);
+      expect(user).toMatchObject(userData);
+      expect(user.id).toBeDefined();
+    });
+    it('should throw error with duplicate email', async () => {
+      const userData = { email: 'existing@example.com', name: 'Test' };
+      await expect(userService.createUser(userData))
+        .rejects.toThrow('Email already exists');
+    });
+    it('should hash password before storing', async () => {
+      const userData = { email: 'test@example.com', password: 'plain123' };
+      const user = await userService.createUser(userData);
+      expect(user.password).not.toBe('plain123');
+      expect(user.password).toMatch(/^\$argon2id\$/);
+    });
+  });
+});
+```
+### Mocking
+```typescript
+// Mock external dependencies
+jest.mock('./emailService');
+it('should send welcome email after user creation', async () => {
+  const emailService = require('./emailService');
+  emailService.sendWelcomeEmail = jest.fn();
+  await userService.createUser({ email: 'test@example.com' });
+  expect(emailService.sendWelcomeEmail).toHaveBeenCalledWith('test@example.com');
+});
+```
+## Integration Testing
+### API Integration Tests
+```typescript
+import request from 'supertest';
+import { app } from '../app';
+describe('POST /api/users', () => {
+  beforeAll(async () => {
+    await db.connect(); // Real database connection (test DB)
+  });
+  afterAll(async () => {
+    await db.disconnect();
+  });
+  beforeEach(async () => {
+    await db.users.deleteMany({}); // Clean state
+  });
+  it('should create user and return 201', async () => {
+    const response = await request(app)
+      .post('/api/users')
+      .send({ email: 'test@example.com', name: 'Test User' })
+      .expect(201);
+    expect(response.body).toMatchObject({
+      email: 'test@example.com',
+      name: 'Test User',
+    });
+    // Verify database persistence
+    const user = await db.users.findOne({ email: 'test@example.com' });
+    expect(user).toBeDefined();
+  });
+  it('should return 400 for invalid email', async () => {
+    await request(app)
+      .post('/api/users')
+      .send({ email: 'invalid-email', name: 'Test' })
+      .expect(400)
+      .expect((res) => {
+        expect(res.body.error).toBe('Invalid email format');
+      });
+  });
+});
+```
+### Database Testing with TestContainers
+```typescript
+import { GenericContainer } from 'testcontainers';
+let container;
+let db;
+beforeAll(async () => {
+  // Spin up real PostgreSQL in Docker
+  container = await new GenericContainer('postgres:15')
+    .withEnvironment({ POSTGRES_PASSWORD: 'test' })
+    .withExposedPorts(5432)
+    .start();
+  const port = container.getMappedPort(5432);
+  db = await createConnection({
+    host: 'localhost',
+    port,
+    database: 'test',
+    password: 'test',
+  });
+}, 60000);
+afterAll(async () => {
+  await container.stop();
+});
+```
+## Contract Testing (Microservices)
+### Pact (Consumer-Driven Contracts)
+```typescript
+// Consumer test
+import { Pact } from '@pact-foundation/pact';
+const provider = new Pact({
+  consumer: 'UserService',
+  provider: 'AuthService',
+});
+describe('Auth Service Contract', () => {
+  beforeAll(() => provider.setup());
+  afterEach(() => provider.verify());
+  afterAll(() => provider.finalize());
+  it('should validate user token', async () => {
+    await provider.addInteraction({
+      state: 'user token exists',
+      uponReceiving: 'a request to validate token',
+      withRequest: {
+        method: 'POST',
+        path: '/auth/validate',
+        headers: { 'Content-Type': 'application/json' },
+        body: { token: 'valid-token-123' },
+      },
+      willRespondWith: {
+        status: 200,
+        body: { valid: true, userId: '123' },
+      },
+    });
+    const response = await authClient.validateToken('valid-token-123');
+    expect(response.valid).toBe(true);
+  });
+});
+```
+## Load Testing
+### Tools Comparison
+**k6** (Modern, Developer-Friendly)
+```javascript
+import http from 'k6/http';
+import { check, sleep } from 'k6';
+export const options = {
+  stages: [
+    { duration: '2m', target: 100 }, // Ramp up to 100 users
+    { duration: '5m', target: 100 }, // Stay at 100 users
+    { duration: '2m', target: 0 },   // Ramp down to 0 users
+  ],
+  thresholds: {
+    http_req_duration: ['p(95)<500'], // 95% requests under 500ms
+  },
+};
+export default function () {
+  const res = http.get('https://api.example.com/users');
+  check(res, {
+    'status is 200': (r) => r.status === 200,
+    'response time < 500ms': (r) => r.timings.duration < 500,
+  });
+  sleep(1);
+}
+```
+**Gatling** (JVM-based, Advanced Scenarios)
+**JMeter** (GUI-based, Traditional)
+### Performance Thresholds
+- **Response time:** p95 < 500ms, p99 < 1s
+- **Throughput:** 1000+ req/sec (target based on SLA)
+- **Error rate:** < 1%
+- **Concurrent users:** Test at 2x expected peak
+## E2E Testing
+### Playwright (Modern, Multi-Browser)
+```typescript
+import { test, expect } from '@playwright/test';
+test('user can register and login', async ({ page }) => {
+  // Navigate to registration page
+  await page.goto('https://app.example.com/register');
+  // Fill registration form
+  await page.fill('input[name="email"]', 'test@example.com');
+  await page.fill('input[name="password"]', 'SecurePass123!');
+  await page.click('button[type="submit"]');
+  // Verify redirect to dashboard
+  await expect(page).toHaveURL('/dashboard');
+  await expect(page.locator('h1')).toContainText('Welcome');
+  // Verify API call was made
+  const response = await page.waitForResponse('/api/users');
+  expect(response.status()).toBe(201);
+});
+```
+## Database Migration Testing
+**Critical:** 83% migrations fail without proper testing
+```typescript
+describe('Database Migrations', () => {
+  it('should migrate from v1 to v2 without data loss', async () => {
+    // Insert test data in v1 schema
+    await db.query(`
+      INSERT INTO users (id, email, name)
+      VALUES (1, 'test@example.com', 'Test User')
+    `);
+    // Run migration
+    await runMigration('v2-add-created-at.sql');
+    // Verify v2 schema
+    const result = await db.query('SELECT * FROM users WHERE id = 1');
+    expect(result.rows[0]).toMatchObject({
+      id: 1,
+      email: 'test@example.com',
+      name: 'Test User',
+      created_at: expect.any(Date),
+    });
+  });
+  it('should rollback migration successfully', async () => {
+    await runMigration('v2-add-created-at.sql');
+    await rollbackMigration('v2-add-created-at.sql');
+    // Verify v1 schema restored
+    const columns = await db.query(`
+      SELECT column_name FROM information_schema.columns
+      WHERE table_name = 'users'
+    `);
+    expect(columns.rows.map(r => r.column_name)).not.toContain('created_at');
+  });
+});
+```
+## Security Testing
+### SAST (Static Application Security Testing)
+```bash
+# SonarQube for code quality + security
+sonar-scanner \
+  -Dsonar.projectKey=my-backend \
+  -Dsonar.sources=src \
+  -Dsonar.host.url=http://localhost:9000
+# Semgrep for security patterns
+semgrep --config auto src/
+```
+### DAST (Dynamic Application Security Testing)
+```bash
+# OWASP ZAP for runtime security scanning
+docker run -t owasp/zap2docker-stable zap-baseline.py \
+  -t https://api.example.com \
+  -r zap-report.html
+```
+### Dependency Scanning (SCA)
+```bash
+# npm audit for Node.js
+npm audit fix
+# Snyk for multi-language
+snyk test
+snyk monitor  # Continuous monitoring
+```
+## Code Coverage
+### Target Metrics (SonarQube Standards)
+- **Overall coverage:** 80%+
+- **Critical paths:** 100% (authentication, payment, data integrity)
+- **New code:** 90%+
+### Implementation
+```bash
+# Vitest with coverage
+vitest run --coverage
+# Jest with coverage
+jest --coverage --coverageThreshold='{"global":{"branches":80,"functions":80,"lines":80}}'
+```
+## CI/CD Testing Pipeline
+```yaml
+# GitHub Actions example
+name: Test Pipeline
+on: [push, pull_request]
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Unit Tests
+        run: npm run test:unit
+      - name: Integration Tests
+        run: npm run test:integration
+      - name: E2E Tests
+        run: npm run test:e2e
+      - name: Load Tests
+        run: k6 run load-test.js
+      - name: Security Scan
+        run: npm audit && snyk test
+      - name: Coverage Report
+        run: npm run test:coverage
+      - name: Upload to Codecov
+        uses: codecov/codecov-action@v3
+```
+## Testing Best Practices
+1. **Arrange-Act-Assert (AAA) Pattern**
+2. **One assertion per test** (when practical)
+3. **Descriptive test names** - `should throw error when email is invalid`
+4. **Test edge cases** - Empty inputs, boundary values, null/undefined
+5. **Clean test data** - Reset database state between tests
+6. **Fast tests** - Unit tests < 10ms, Integration < 100ms
+7. **Deterministic** - No flaky tests, avoid sleep(), use waitFor()
+8. **Independent** - Tests don't depend on execution order
+## Testing Checklist
+- [ ] Unit tests cover 70% of codebase
+- [ ] Integration tests for all API endpoints
+- [ ] Contract tests for microservices
+- [ ] Load tests configured (k6/Gatling)
+- [ ] E2E tests for critical user flows
+- [ ] Database migration tests
+- [ ] Security scanning in CI/CD (SAST, DAST, SCA)
+- [ ] Code coverage reports automated
+- [ ] Tests run on every PR
+- [ ] Flaky tests eliminated
+## Resources
+- **Vitest:** https://vitest.dev/
+- **Playwright:** https://playwright.dev/
+- **k6:** https://k6.io/docs/
+- **Pact:** https://docs.pact.io/
+- **TestContainers:** https://testcontainers.com/