acek-skills 1.0.0

package/skills/sf-security-review/SKILL.md

@@ -0,0 +1,320 @@
+---
+name: sf-security-review
+description: >
+  Use this skill for Salesforce security reviews, vulnerability analysis, and security pattern
+  enforcement. Trigger when the user asks to "review security", "check for vulnerabilities",
+  "security audit", "CRUD check", "FLS check", "sharing model", "with sharing", "SOQL injection",
+  "XSS in LWC", "hardcoded credentials", "permission check", or when preparing code for
+  production deployment and needing a security sign-off checklist. Also use when the user asks
+  about Salesforce Shield, encryption, audit trail, or data visibility concerns.
+---
+
+# Salesforce Security Review Skill
+
+## Environment Context
+- API Version: **61.0**
+- Apex LSP: **offline** — use `Schema.getGlobalDescribe()` pattern (not compile-time SObject reference)
+- All security decisions must be documented in the relevant CR before production deploy
+
+---
+
+## Security Layers — Salesforce Model
+
+```
+1. Org-Level          → Login IP ranges, MFA, session settings
+2. Object-Level       → Profiles + Permission Sets (CRUD)
+3. Field-Level        → FLS per Profile/Permission Set
+4. Record-Level       → OWD + Role Hierarchy + Sharing Rules + Manual Sharing
+5. Code-Level         → with sharing, CRUD/FLS checks, no injection
+```
+
+All five layers must be considered. Code-level checks (layer 5) cannot compensate for misconfigured org-level settings (layers 1–4).
+
+---
+
+## Apex Security — Core Patterns
+
+### 1. Sharing Keywords (mandatory)
+
+```apex
+// ✅ Use on all classes — enforces record-level security
+public with sharing class AccountService { }
+
+// Only acceptable on service classes called by other with sharing classes
+// AND where cross-user data access is explicitly required by business logic
+public without sharing class SystemEventLogger { }
+
+// Inherited — use for inner/helper classes that delegate sharing to caller
+public inherited sharing class AccountSelector { }
+```
+
+**Rule:** Default to `with sharing`. Document every `without sharing` with a comment explaining why.
+
+### 2. CRUD Check — LSP-Safe Pattern
+
+```apex
+// ✅ CORRECT — works with offline LSP (no org metadata needed)
+if (!Schema.getGlobalDescribe().get('Account').getDescribe().isCreateable()) {
+    throw new AuraHandledException('Insufficient access to create Account records.');
+}
+
+// ✅ For update
+if (!Schema.getGlobalDescribe().get('Account').getDescribe().isUpdateable()) {
+    throw new AuraHandledException('Insufficient access to update Account records.');
+}
+
+// ✅ For delete
+if (!Schema.getGlobalDescribe().get('Account').getDescribe().isDeletable()) {
+    throw new AuraHandledException('Insufficient access to delete Account records.');
+}
+
+// ❌ NEVER — compile-time reference, fails with offline LSP
+if (!Account.SObjectType.getDescribe().isCreateable()) { ... }
+```
+
+**Exception — `ContentDocumentLink`:**
+Skip explicit CRUD check for this junction object — it cannot be resolved by offline LSP.
+Protect via `with sharing` + try-catch wrapper instead.
+
+### 3. FLS Check
+
+```apex
+// ✅ Object-level isUpdateable() — safe with offline LSP
+if (!Schema.getGlobalDescribe().get('Account').getDescribe().isUpdateable()) {
+    throw new AuraHandledException('Insufficient access.');
+}
+
+// ⚠️ Field-level via evDescribe.fields NOT available with offline LSP
+// Use object-level check only; document the limitation in code comment
+```
+
+### 4. Exception Wrapping
+
+```apex
+// ✅ @AuraEnabled methods — always wrap, re-throw as AuraHandledException
+@AuraEnabled
+public static Result processRecord(Id recordId) {
+    try {
+        validateAccess();
+        return doWork(recordId);
+    } catch (AuraHandledException e) {
+        throw e; // re-throw as-is
+    } catch (Exception e) {
+        throw new AuraHandledException(e.getMessage());
+    }
+}
+
+// ✅ Private helper / callout methods — throw CalloutException
+// Caller (@AuraEnabled method) wraps it
+private static String callExternalSystem(String payload) {
+    HttpResponse res = new Http().send(buildRequest(payload));
+    if (res.getStatusCode() != 200) {
+        throw new CalloutException('HTTP ' + res.getStatusCode() + ': ' + res.getBody());
+    }
+    return res.getBody();
+}
+```
+
+### 5. SOQL Injection Prevention
+
+```apex
+// ❌ VULNERABLE — string concatenation in dynamic SOQL
+String query = 'SELECT Id FROM Account WHERE Name = \'' + userInput + '\'';
+List<Account> results = Database.query(query);
+
+// ✅ SAFE — bind variables (preferred for all cases)
+List<Account> results = [SELECT Id FROM Account WHERE Name = :userInput];
+
+// ✅ SAFE — if dynamic SOQL required, escape the input
+String safeInput = String.escapeSingleQuotes(userInput);
+String query = 'SELECT Id FROM Account WHERE Name = \'' + safeInput + '\'';
+List<Account> results = Database.query(query);
+```
+
+**Rule:** Always prefer bind variables (`:variable`) in SOQL. Dynamic SOQL only when absolutely necessary (dynamic field names, dynamic object names). Always `escapeSingleQuotes()` on any user-supplied string in dynamic SOQL.
+
+### 6. No Hardcoded Values
+
+```apex
+// ❌ NEVER — hardcoded ID, credential, or org-specific value
+String endpoint = 'https://api.myorg.salesforce.com/services/data/v61.0';
+Id recordTypeId = '012000000000XXXAAA';
+
+// ✅ Named Credentials for endpoints
+req.setEndpoint('callout:My_Named_Credential/resource');
+
+// ✅ Query for Record Type ID at runtime
+Id recordTypeId = Schema.getGlobalDescribe()
+    .get('Opportunity')
+    .getDescribe()
+    .getRecordTypeInfosByDeveloperName()
+    .get('Enterprise')
+    .getRecordTypeId();
+
+// ✅ Custom Metadata / Custom Settings for configurable values
+My_Config__mdt config = [SELECT Endpoint_URL__c FROM My_Config__mdt LIMIT 1];
+```
+
+---
+
+## LWC Security
+
+### 1. XSS Prevention
+
+```html
+<!-- ✅ SAFE — lwc:text auto-escapes output -->
+<p lwc:text={userGeneratedContent}></p>
+
+<!-- ❌ DANGEROUS — renders raw HTML, XSS risk -->
+<div innerHTML={userGeneratedContent}></div>
+```
+
+```javascript
+// ❌ NEVER use innerHTML with user data
+this.template.querySelector('.container').innerHTML = untrustedData;
+
+// ✅ Use lwc:text or set textContent
+element.textContent = untrustedData;
+```
+
+### 2. No Sensitive Data in JS / HTML
+
+```javascript
+// ❌ NEVER — credentials, tokens, or org-specific IDs in component
+const API_KEY = 'sk-1234567890abcdef';
+const RECORD_TYPE_ID = '012000000000XXXAAA';
+
+// ✅ Fetch from Apex / Custom Metadata at runtime
+@wire(getConfig)
+config;
+```
+
+### 3. Event Handling — Validate Data from Events
+
+```javascript
+handleCustomEvent(event) {
+    // ✅ Validate before using event data
+    const { recordId } = event.detail;
+    if (!recordId || typeof recordId !== 'string') return;
+    // proceed
+}
+```
+
+---
+
+## Trigger Architecture — Security Pattern
+
+Enforce one consistent pattern to prevent logic bypass:
+
+```
+MyObjectTrigger.trigger          → entry point only, 1-3 lines
+    └── MyObjectTriggerHandler.cls   → routes to methods, with sharing
+            └── MyObjectService.cls  → business logic, with sharing
+                    └── MyObjectSelector.cls  → SOQL only, inherited sharing
+```
+
+```apex
+// Trigger — entry point only
+trigger AccountTrigger on Account (before insert, before update, after insert, after update) {
+    AccountTriggerHandler.handle(Trigger.operationType, Trigger.new, Trigger.oldMap);
+}
+
+// Handler — with sharing, routes by operation
+public with sharing class AccountTriggerHandler {
+    public static void handle(
+        TriggerOperation op,
+        List<Account> newRecords,
+        Map<Id, Account> oldMap
+    ) {
+        if (op == TriggerOperation.BEFORE_INSERT) {
+            AccountService.beforeInsert(newRecords);
+        } else if (op == TriggerOperation.AFTER_UPDATE) {
+            AccountService.afterUpdate(newRecords, oldMap);
+        }
+    }
+}
+```
+
+---
+
+## Security Review Checklist
+
+### Apex
+- [ ] All classes declare `with sharing` (or documented `without sharing` with reason)
+- [ ] CRUD check present on all DML operations in `@AuraEnabled` methods
+- [ ] CRUD check uses `Schema.getGlobalDescribe()` (not compile-time SObject reference)
+- [ ] No SOQL injection — bind variables used; `escapeSingleQuotes()` on dynamic SOQL
+- [ ] No hardcoded IDs, credentials, URLs, or org-specific values
+- [ ] Named Credentials used for all external callouts
+- [ ] All `@AuraEnabled` methods wrapped in try-catch → `AuraHandledException`
+- [ ] Private helper methods throw `CalloutException`, not `AuraHandledException`
+- [ ] `ContentDocumentLink` DML: no explicit CRUD check, protected by `with sharing` + try-catch
+- [ ] Trigger follows Handler → Service → Selector architecture
+- [ ] No recursive trigger execution (use static flag or Trigger Handler pattern)
+
+### LWC
+- [ ] `lwc:text` used for dynamic content (not `innerHTML`)
+- [ ] No sensitive data (API keys, IDs, credentials) in JS/HTML
+- [ ] Event data validated before use
+- [ ] `@api` properties documented and typed
+- [ ] No direct DOM manipulation with user-supplied data
+
+### Org / Deployment
+- [ ] Profiles: minimal baseline permissions only
+- [ ] Permission Sets: additive, role-specific
+- [ ] OWD: most restrictive setting that satisfies business need
+- [ ] Sharing Rules: criteria documented and reviewed
+- [ ] No guest user access to sensitive objects
+- [ ] Named Credentials: configured in target org before deploy
+- [ ] Custom Metadata: values verified in production before activation
+
+### Git / Source
+- [ ] No Salesforce IDs in committed code
+- [ ] No credentials, API keys, or session tokens in any file
+- [ ] No org-specific URLs hardcoded
+- [ ] `.gitignore` covers `.sf/`, `.sfdx/`, `config/user/`
+
+---
+
+## Common Vulnerabilities — Quick Reference
+
+| Vulnerability | Where | Detection | Fix |
+|---|---|---|---|
+| SOQL Injection | Dynamic SOQL | String concat with user input | Bind variables / `escapeSingleQuotes()` |
+| Missing CRUD check | `@AuraEnabled` DML | No `isCreateable()` before insert | Add `Schema.getGlobalDescribe()` check |
+| XSS | LWC | `innerHTML` with user data | Use `lwc:text` or `textContent` |
+| Hardcoded credential | Apex / JS | `apiKey = '...'` literal | Named Credential / Custom Metadata |
+| `without sharing` abuse | Service class | No business justification | Change to `with sharing`; document if needed |
+| Recursive trigger | Trigger | No recursion guard | Static Boolean flag in handler |
+| Exposed Record IDs | LWC URL params | `recordId` passed in URL | Validate on server side, check access |
+| Insecure callout | HTTP callout | Endpoint hardcoded, no Named Cred | Use Named Credentials |
+
+---
+
+## Security Review Sign-Off Template
+
+Before every production deploy, add to CR:
+
+```markdown
+## Security Review
+
+**Reviewer:** [Name]
+**Date:** YYYY-MM-DD
+
+### Apex
+- Sharing model: [with sharing on all classes ✓ / exceptions documented below]
+- CRUD checks: [present on all DML ✓]
+- SOQL injection risk: [none — bind variables used ✓]
+- Hardcoded values: [none ✓]
+
+### LWC
+- XSS risk: [none — lwc:text used ✓]
+- Sensitive data in JS: [none ✓]
+
+### Exceptions & Justifications
+- [ClassName] uses `without sharing` because: [reason]
+
+### Sign-Off
+- [ ] All checklist items passed
+- [ ] Exceptions documented and accepted
+```

package/skills/sf-testing/SKILL.md

@@ -0,0 +1,361 @@
+---
+name: sf-testing
+description: >
+  Use this skill for ANY Salesforce test-related task: writing Apex test classes, building
+  TestDataFactory, mocking HTTP callouts, mocking platform events, writing test assertions,
+  generating test coverage reports, debugging test failures, and designing test strategies.
+  Trigger when the user asks to "write a test class", "fix test coverage", "mock a callout",
+  "write a TestDataFactory", "test fails in org but passes locally", "assert this method",
+  or anything about Apex unit testing, test data, or code coverage. Also use when coverage
+  drops below 85% or when AuraHandledException assertions are involved.
+---
+
+# Salesforce Testing Skill
+
+## Environment Context
+- Minimum coverage: **85%** (aim for 90%+)
+- API Version: **61.0**
+- `AuraHandledException.getMessage()` in test context **always** returns `'Script-thrown exception'` — this is Salesforce by design, not a bug
+
+---
+
+## Test Class Structure — Standard Pattern
+
+```apex
+@isTest
+private class AccountHelperTest {
+
+    // ─── Test Data Setup ───────────────────────────────────────────────────────
+    @TestSetup
+    static void makeData() {
+        // Use TestDataFactory for all record creation
+        List<Account> accounts = TestDataFactory.createAccounts(10, true);
+        TestDataFactory.createContacts(accounts, 2, true);
+    }
+
+    // ─── Happy Path ────────────────────────────────────────────────────────────
+    @isTest
+    static void testGetAccounts_returnsActiveRecords() {
+        List<Account> accounts = [SELECT Id FROM Account LIMIT 1];
+
+        Test.startTest();
+        List<Account> result = AccountHelper.getAccounts(accounts[0].Id);
+        Test.stopTest();
+
+        System.assertNotEquals(null, result, 'Result should not be null');
+        System.assertNotEquals(0, result.size(), 'Result should contain records');
+    }
+
+    // ─── Edge Case ─────────────────────────────────────────────────────────────
+    @isTest
+    static void testGetAccounts_noRecords_returnsEmptyList() {
+        Test.startTest();
+        List<Account> result = AccountHelper.getAccounts(null);
+        Test.stopTest();
+
+        System.assertNotEquals(null, result, 'Should return empty list, not null');
+        System.assertEquals(0, result.size(), 'Should return empty list for null Id');
+    }
+
+    // ─── Exception / Permission Path ───────────────────────────────────────────
+    @isTest
+    static void testGetAccounts_insufficientPermission_throwsException() {
+        // Simulate restricted user if needed
+        // System.runAs(TestDataFactory.createRestrictedUser()) { ... }
+        try {
+            AccountHelper.restrictedMethod(null);
+            System.assert(false, 'Expected AuraHandledException was not thrown');
+        } catch (AuraHandledException e) {
+            // Salesforce by design: getMessage() always returns this in test context
+            System.assertEquals('Script-thrown exception', e.getMessage());
+        }
+    }
+
+    // ─── Bulk / Governor Limit Test ────────────────────────────────────────────
+    @isTest
+    static void testGetAccounts_bulk_200Records() {
+        List<Account> bulk = TestDataFactory.createAccounts(200, true);
+
+        Test.startTest();
+        List<Account> result = AccountHelper.processAccounts(
+            new Map<Id, Account>(bulk).keySet()
+        );
+        Test.stopTest();
+
+        System.assertEquals(200, result.size(), 'Should process all 200 records');
+    }
+}
+```
+
+### Rules
+- **Always** use `Test.startTest()` / `Test.stopTest()` — resets governor limits and forces async execution
+- **Never** use `seeAllData = true` — always create test data explicitly
+- **Always** assert something — no test without `System.assert*`
+- **3 minimum scenarios** per class: happy path, edge case, exception/permission
+- `@TestSetup` for shared data across methods; method-level setup only when data differs per test
+
+---
+
+## TestDataFactory — Standard Pattern
+
+Create once, reuse everywhere. File: `force-app/main/default/classes/TestDataFactory.cls`
+
+```apex
+@isTest
+public class TestDataFactory {
+
+    // ─── Accounts ──────────────────────────────────────────────────────────────
+    public static List<Account> createAccounts(Integer count, Boolean doInsert) {
+        List<Account> accounts = new List<Account>();
+        for (Integer i = 0; i < count; i++) {
+            accounts.add(new Account(
+                Name = 'Test Account ' + i,
+                Industry = 'Technology',
+                Phone = '021000000' + i
+            ));
+        }
+        if (doInsert) insert accounts;
+        return accounts;
+    }
+
+    // ─── Contacts ──────────────────────────────────────────────────────────────
+    public static List<Contact> createContacts(
+        List<Account> accounts, Integer perAccount, Boolean doInsert
+    ) {
+        List<Contact> contacts = new List<Contact>();
+        for (Account acc : accounts) {
+            for (Integer i = 0; i < perAccount; i++) {
+                contacts.add(new Contact(
+                    FirstName = 'Test',
+                    LastName = 'Contact ' + i,
+                    AccountId = acc.Id,
+                    Email = 'test' + i + '@' + acc.Id + '.com'
+                ));
+            }
+        }
+        if (doInsert) insert contacts;
+        return contacts;
+    }
+
+    // ─── Users ─────────────────────────────────────────────────────────────────
+    public static User createUser(String profileName, Boolean doInsert) {
+        Profile p = [SELECT Id FROM Profile WHERE Name = :profileName LIMIT 1];
+        User u = new User(
+            FirstName     = 'Test',
+            LastName      = 'User ' + profileName,
+            Email         = 'testuser_' + profileName.replace(' ', '') + '@test.com',
+            Username      = 'testuser_' + profileName.replace(' ', '')
+                            + Datetime.now().getTime() + '@test.com',
+            Alias         = 'tuser',
+            TimeZoneSidKey    = 'Asia/Jakarta',
+            LocaleSidKey      = 'id_ID',
+            EmailEncodingKey  = 'UTF-8',
+            LanguageLocaleKey = 'en_US',
+            ProfileId         = p.Id
+        );
+        if (doInsert) insert u;
+        return u;
+    }
+
+    // ─── Custom Objects ────────────────────────────────────────────────────────
+    // Add your org-specific objects here following the same pattern:
+    // public static List<Project__c> createProjects(Integer count, Boolean doInsert) { ... }
+}
+```
+
+### Factory Rules
+- `doInsert` parameter on every method — caller decides whether to insert
+- Unique field values: use loop index + timestamp/Id to avoid duplicate errors
+- **Never** hardcode record IDs
+- Add org-specific objects in the `Custom Objects` section
+- Username must be globally unique — always append `Datetime.now().getTime()`
+
+---
+
+## Mocking HTTP Callouts
+
+### Step 1 — Create Mock Implementation
+```apex
+@isTest
+global class MyCalloutMock implements HttpCalloutMock {
+    global HTTPResponse respond(HTTPRequest req) {
+        HttpResponse res = new HttpResponse();
+        res.setHeader('Content-Type', 'application/json');
+        res.setStatusCode(200);
+        res.setBody('{"status":"success","id":"12345"}');
+        return res;
+    }
+}
+
+// For error scenarios:
+@isTest
+global class MyCalloutMockError implements HttpCalloutMock {
+    global HTTPResponse respond(HTTPRequest req) {
+        HttpResponse res = new HttpResponse();
+        res.setStatusCode(500);
+        res.setBody('{"error":"Internal Server Error"}');
+        return res;
+    }
+}
+```
+
+### Step 2 — Use in Test
+```apex
+@isTest
+static void testCallout_success() {
+    Test.setMock(HttpCalloutMock.class, new MyCalloutMock());
+
+    Test.startTest();
+    String result = MyService.callExternalSystem('payload');
+    Test.stopTest();
+
+    System.assertEquals('12345', result, 'Should return ID from mock response');
+}
+
+@isTest
+static void testCallout_serverError_throwsException() {
+    Test.setMock(HttpCalloutMock.class, new MyCalloutMockError());
+
+    Test.startTest();
+    try {
+        MyService.callExternalSystem('payload');
+        System.assert(false, 'Expected exception not thrown');
+    } catch (CalloutException e) {
+        System.assert(e.getMessage().contains('500'), 'Should surface HTTP 500 error');
+    }
+    Test.stopTest();
+}
+```
+
+### Rules
+- `Test.setMock()` must be called **before** `Test.startTest()`
+- Always test both success and failure mock paths
+- For multiple endpoints, use `StaticResourceCalloutMock` or a routing mock that checks `req.getEndpoint()`
+
+---
+
+## Mocking Platform Events
+
+```apex
+@isTest
+static void testPlatformEventPublish() {
+    Test.startTest();
+    MyService.publishEvent('payload');
+    // Fire platform event delivery
+    Test.getEventBus().deliver();
+    Test.stopTest();
+
+    // Assert downstream effect (e.g. record created by subscriber trigger)
+    List<MyLog__c> logs = [SELECT Id FROM MyLog__c];
+    System.assertEquals(1, logs.size(), 'Event subscriber should have created a log');
+}
+```
+
+---
+
+## System.runAs — Testing Permission Boundaries
+
+```apex
+@isTest
+static void testRestrictedUser_cannotDelete() {
+    User restrictedUser = TestDataFactory.createUser('Standard User', true);
+    Account acc = TestDataFactory.createAccounts(1, true)[0];
+
+    System.runAs(restrictedUser) {
+        Test.startTest();
+        try {
+            delete acc;
+            System.assert(false, 'Standard user should not be able to delete Account');
+        } catch (DmlException e) {
+            System.assert(
+                e.getMessage().contains('insufficient access'),
+                'Should throw insufficient access error'
+            );
+        }
+        Test.stopTest();
+    }
+}
+```
+
+---
+
+## Assertion Best Practices
+
+```apex
+// ✅ Always include a descriptive message (3rd param)
+System.assertEquals(expected, actual, 'Descriptive message of what was expected');
+System.assertNotEquals(null, result, 'Result should not be null');
+System.assert(result.size() > 0, 'List should not be empty after processing');
+
+// ✅ For AuraHandledException — always expect 'Script-thrown exception'
+System.assertEquals('Script-thrown exception', e.getMessage());
+
+// ✅ Assert specific fields, not just count
+System.assertEquals('Active', result[0].Status__c, 'Status should be Active after processing');
+
+// ❌ Never assert without message
+System.assertEquals(5, result.size()); // Bad — no context when it fails
+
+// ❌ Never test with catch-all that swallows the error
+try {
+    SomeClass.method();
+} catch (Exception e) {
+    // empty catch — useless
+}
+```
+
+---
+
+## Coverage Strategy
+
+### Minimum per component
+| Component | Required | Target |
+|---|---|---|
+| Apex Class (`@AuraEnabled`) | 85% | 90%+ |
+| Apex Trigger | 85% | 95%+ |
+| Batch / Schedulable / Queueable | 85% | 90%+ |
+
+### Run tests via SF CLI
+```bash
+# Run specific test class
+sf apex run test \
+  --class-names AccountHelperTest \
+  --target-org <alias> \
+  --result-format human \
+  --code-coverage
+
+# Run multiple test classes (deployment-style)
+sf apex run test \
+  --class-names AccountHelperTest,OpportunityServiceTest \
+  --target-org <alias> \
+  --result-format json \
+  --code-coverage
+
+# Check coverage of specific class
+sf apex run test \
+  --class-names AccountHelperTest \
+  --target-org <alias> \
+  --result-format human \
+  --code-coverage \
+  | grep -A 5 "AccountHelper"
+```
+
+### When coverage is below 85%
+1. Identify uncovered lines: run test with `--code-coverage` and review output
+2. Check: are there `if/else` branches not tested?
+3. Check: are there exception paths not triggered?
+4. Add targeted test methods — do **not** reduce test quality just to hit the number
+5. Never use `@SuppressWarnings` to bypass coverage requirements
+
+---
+
+## Common Test Failures & Fixes
+
+| Error | Cause | Fix |
+|---|---|---|
+| `MIXED_DML_OPERATION` | Inserting Setup object (User) and non-Setup object in same context | Wrap User insert in `System.runAs(new User())` |
+| `UNABLE_TO_LOCK_ROW` | Parallel tests updating same record | Use `@TestSetup` + unique records per test |
+| `Too many SOQL queries: 101` | SOQL in loop not caught by test | Add bulk test (200 records), fix the source |
+| `Script-thrown exception` in `getMessage()` | `AuraHandledException` — expected behavior | Assert this exact string — it's correct |
+| Test passes locally, fails in org | `seeAllData=true` dependency or hardcoded IDs | Remove `seeAllData`, use `TestDataFactory` |
+| `Callout not allowed` | HTTP callout without `Test.setMock()` | Add mock before `Test.startTest()` |