aigroup-workflow 2.1.2 → 2.2.0

package/skills/quality/test-master/references/integration-testing.md

@@ -0,0 +1,120 @@
+# Integration Testing
+
+## API Testing (Supertest)
+
+```typescript
+import request from 'supertest';
+import { app } from '../app';
+
+describe('POST /api/users', () => {
+  it('creates user with valid data', async () => {
+    const response = await request(app)
+      .post('/api/users')
+      .send({ email: 'test@test.com', name: 'Test' })
+      .expect(201);
+
+    expect(response.body).toMatchObject({
+      email: 'test@test.com',
+      name: 'Test',
+    });
+    expect(response.body.id).toBeDefined();
+  });
+
+  it('returns 400 for invalid email', async () => {
+    const response = await request(app)
+      .post('/api/users')
+      .send({ email: 'invalid', name: 'Test' })
+      .expect(400);
+
+    expect(response.body.error).toContain('email');
+  });
+
+  it('returns 401 without auth token', async () => {
+    await request(app)
+      .get('/api/users/me')
+      .expect(401);
+  });
+});
+```
+
+## Authenticated Requests
+
+```typescript
+describe('Protected endpoints', () => {
+  let authToken: string;
+
+  beforeAll(async () => {
+    const response = await request(app)
+      .post('/api/auth/login')
+      .send({ email: 'test@test.com', password: 'password' });
+    authToken = response.body.token;
+  });
+
+  it('accesses protected route', async () => {
+    await request(app)
+      .get('/api/users/me')
+      .set('Authorization', `Bearer ${authToken}`)
+      .expect(200);
+  });
+});
+```
+
+## Database Testing
+
+```typescript
+import { db } from '../database';
+
+describe('UserRepository', () => {
+  beforeEach(async () => {
+    await db.query('DELETE FROM users');
+  });
+
+  afterAll(async () => {
+    await db.end();
+  });
+
+  it('creates and retrieves user', async () => {
+    const user = await userRepo.create({
+      email: 'test@test.com',
+      name: 'Test',
+    });
+
+    const found = await userRepo.findById(user.id);
+    expect(found).toEqual(user);
+  });
+});
+```
+
+## pytest API Testing
+
+```python
+import pytest
+from httpx import AsyncClient
+
+@pytest.mark.asyncio
+async def test_create_user(client: AsyncClient):
+    response = await client.post("/api/users/", json={
+        "email": "test@example.com",
+        "name": "Test"
+    })
+    assert response.status_code == 201
+    assert response.json()["email"] == "test@example.com"
+
+@pytest.mark.asyncio
+async def test_invalid_email(client: AsyncClient):
+    response = await client.post("/api/users/", json={
+        "email": "invalid",
+        "name": "Test"
+    })
+    assert response.status_code == 422
+```
+
+## Quick Reference
+
+| Method | Purpose |
+|--------|---------|
+| `.send(body)` | Send request body |
+| `.set(header, value)` | Set header |
+| `.expect(status)` | Assert status code |
+| `.expect('Content-Type', /json/)` | Assert header |
+| `response.body` | Parsed JSON body |

package/skills/quality/test-master/references/performance-testing.md

@@ -0,0 +1,118 @@
+# Performance Testing
+
+## k6 Load Test
+
+```javascript
+import http from 'k6/http';
+import { check, sleep } from 'k6';
+
+export const options = {
+  stages: [
+    { duration: '30s', target: 20 },   // Ramp up to 20 users
+    { duration: '1m', target: 20 },    // Stay at 20 users
+    { duration: '30s', target: 0 },    // Ramp down
+  ],
+  thresholds: {
+    http_req_duration: ['p(95)<500'],  // 95% requests under 500ms
+    http_req_failed: ['rate<0.01'],    // <1% errors
+  },
+};
+
+export default function () {
+  const res = http.get('http://localhost:3000/api/users');
+
+  check(res, {
+    'status is 200': (r) => r.status === 200,
+    'response time < 200ms': (r) => r.timings.duration < 200,
+  });
+
+  sleep(1);
+}
+```
+
+## Stress Test
+
+```javascript
+export const options = {
+  stages: [
+    { duration: '2m', target: 100 },   // Ramp to 100 users
+    { duration: '5m', target: 100 },   // Stay at 100
+    { duration: '2m', target: 200 },   // Push to 200
+    { duration: '5m', target: 200 },   // Stay at 200
+    { duration: '2m', target: 0 },     // Ramp down
+  ],
+};
+```
+
+## Spike Test
+
+```javascript
+export const options = {
+  stages: [
+    { duration: '10s', target: 10 },   // Normal load
+    { duration: '1m', target: 10 },
+    { duration: '10s', target: 200 },  // Spike!
+    { duration: '3m', target: 200 },
+    { duration: '10s', target: 10 },   // Scale down
+    { duration: '3m', target: 10 },
+    { duration: '10s', target: 0 },
+  ],
+};
+```
+
+## API Testing with Auth
+
+```javascript
+import http from 'k6/http';
+
+export function setup() {
+  const loginRes = http.post('http://localhost:3000/api/login', {
+    email: 'test@test.com',
+    password: 'password',
+  });
+  return { token: loginRes.json('token') };
+}
+
+export default function (data) {
+  const params = {
+    headers: { Authorization: `Bearer ${data.token}` },
+  };
+
+  http.get('http://localhost:3000/api/protected', params);
+}
+```
+
+## Thresholds Reference
+
+```javascript
+thresholds: {
+  // Response time
+  http_req_duration: ['p(95)<500', 'p(99)<1000'],
+
+  // Error rate
+  http_req_failed: ['rate<0.01'],
+
+  // Throughput
+  http_reqs: ['rate>100'],
+
+  // Custom metrics
+  'http_req_duration{name:login}': ['p(95)<200'],
+}
+```
+
+## Quick Reference
+
+| Metric | Description |
+|--------|-------------|
+| `http_req_duration` | Response time |
+| `http_req_failed` | Failed requests rate |
+| `http_reqs` | Request rate |
+| `p(95)` | 95th percentile |
+| `rate` | Rate per second |
+
+| Test Type | Purpose |
+|-----------|---------|
+| Load | Normal expected load |
+| Stress | Find breaking point |
+| Spike | Sudden traffic surge |
+| Soak | Long duration stability |

package/skills/quality/test-master/references/qa-methodology.md

@@ -0,0 +1,247 @@
+# QA Methodology
+
+## Manual Testing Types
+
+### Exploratory Testing
+```markdown
+**Charter**: Explore {feature} with focus on {aspect}
+**Duration**: 60-90 min
+**Mission**: Find defects in {specific functionality}
+
+Test Ideas:
+- Boundary conditions & edge cases
+- Error handling & recovery
+- User workflow variations
+- Integration points
+
+Findings:
+1. [HIGH] {Issue + impact}
+2. [MED] {Issue + impact}
+
+Coverage: {Areas explored} | Risks: {Identified risks}
+```
+
+### Usability Testing
+```markdown
+**Task**: Can users complete {action} intuitively?
+**Metrics**: Time to complete, errors made, satisfaction (1-5)
+**Success**: 80% complete without help in <5 min
+
+Observations:
+- Navigation confusing at {step}
+- Users expect {A} but get {B}
+- Positive: {feature feedback}
+```
+
+### Accessibility Testing (WCAG 2.1 AA)
+```typescript
+test('accessibility compliance', async ({ page }) => {
+  // Keyboard navigation
+  await page.keyboard.press('Tab');
+  expect(['A', 'BUTTON', 'INPUT']).toContain(
+    await page.evaluate(() => document.activeElement.tagName)
+  );
+  
+  // ARIA labels
+  expect(await page.getByRole('button').first().getAttribute('aria-label')).toBeTruthy();
+  
+  // Color contrast (axe-core)
+  const violations = await page.evaluate(async () => {
+    const axe = await import('axe-core');
+    return (await axe.run()).violations;
+  });
+  expect(violations).toHaveLength(0);
+});
+```
+
+### Localization Testing
+```markdown
+**Test**: {Feature} in {language/locale}
+- [ ] Text displays without truncation
+- [ ] Date/time/currency formats correct
+- [ ] Right-to-left layout (Arabic, Hebrew)
+- [ ] Character encoding UTF-8
+- [ ] Sort order respects locale
+```
+
+### Compatibility Matrix
+```markdown
+| Browser | Version | OS | Status |
+|---------|---------|----|----- --|
+| Chrome | Latest | Win/Mac | ✓ |
+| Firefox | Latest | Win/Mac | ✓ |
+| Safari | Latest | macOS/iOS | ✓ |
+| Edge | Latest | Windows | ✓ |
+```
+
+## Test Design Techniques
+
+### Pairwise Testing
+```typescript
+// Test all parameter pairs efficiently
+const pairwiseTests = [
+  { browser: 'chrome', os: 'windows', lang: 'en' },
+  { browser: 'firefox', os: 'mac', lang: 'es' },
+  { browser: 'safari', os: 'windows', lang: 'fr' },
+  // Covers all pairs with minimal tests
+];
+```
+
+### Risk-Based Testing
+```markdown
+| Risk | Probability | Impact | Priority | Test Effort |
+|------|-------------|--------|----------|-------------|
+| Critical | High | High | P0 | Exhaustive |
+| High | Med-High | High | P1 | Comprehensive |
+| Medium | Low-Med | Med | P2 | Standard |
+| Low | Low | Low | P3 | Smoke only |
+```
+
+## Defect Management
+
+### Root Cause Analysis (5 Whys)
+```markdown
+1. Why did defect occur? {User input not validated}
+2. Why wasn't it validated? {Validation logic missing}
+3. Why was it missing? {Requirement unclear}
+4. Why was requirement unclear? {Acceptance criteria incomplete}
+5. Why incomplete? {No QA review in planning}
+
+**Root Cause**: QA not involved in requirements phase
+**Prevention**: Add QA to all planning meetings
+```
+
+### Defect Report Template
+```markdown
+## [CRITICAL] {Defect Title}
+
+**Steps to Reproduce**:
+1. {Step 1}
+2. {Step 2}
+
+**Expected**: {Should happen}
+**Actual**: {Actually happens}
+**Impact**: {Business/user impact}
+**Root Cause**: {Why it happened}
+**Fix**: {Recommended solution}
+```
+
+## Quality Metrics
+
+### Key Calculations
+```typescript
+// Defect Removal Efficiency (target: >95%)
+const dre = (defectsInTesting / (defectsInTesting + defectsInProd)) * 100;
+
+// Defect Leakage (target: <5%)
+const leakage = (defectsInProd / totalDefects) * 100;
+
+// Test Effectiveness (target: >90%)
+const effectiveness = (defectsFoundByTests / totalDefects) * 100;
+
+// Automation ROI
+const roi = (timeSaved - maintenanceCost - developmentCost) / developmentCost;
+```
+
+### Quality Dashboard
+```markdown
+| Metric | Target | Actual | Trend | Status |
+|--------|--------|--------|-------|--------|
+| Coverage | >80% | 87% | ↑ | ✓ |
+| Defect Leakage | <5% | 3% | ↓ | ✓ |
+| Automation | >70% | 68% | ↑ | ⚠ |
+| Critical Defects | 0 | 0 | → | ✓ |
+| MTTR | <48h | 36h | ↓ | ✓ |
+```
+
+## Continuous Testing & Shift-Left
+
+### Shift-Left Activities
+```markdown
+**Early Testing**:
+- Review requirements for testability
+- Create test cases during design
+- TDD: unit tests with code
+- Automated tests in CI pipeline
+- Static analysis on commit
+- Security scanning pre-merge
+
+**Benefits**: 10x cheaper defect fixes, faster feedback
+```
+
+### Feedback Cycle Targets
+```typescript
+const feedbackCycle = {
+  unitTests: '< 5 min',       // On save
+  integration: '< 15 min',    // On commit
+  e2e: '< 30 min',            // On PR
+  regression: '< 2 hours',    // Nightly
+};
+```
+
+## Quality Advocacy
+
+### Quality Gates
+```markdown
+## Production Release Gate
+
+**Must Pass (Blockers)**:
+- [ ] Zero critical defects
+- [ ] Coverage >80%
+- [ ] All P0/P1 tests passing
+- [ ] Performance SLA met
+- [ ] Security scan clean
+- [ ] Accessibility WCAG AA
+
+**Decision**: GO | NO-GO | GO with exceptions
+```
+
+### Team Education Program
+```markdown
+**Week 1-2**: Test fundamentals
+**Week 3-4**: Automation basics
+**Week 5-6**: Advanced topics (perf, security, API)
+**Ongoing**: Best practices, tool updates
+```
+
+## Test Planning
+
+### Test Plan Template
+```markdown
+## Test Plan: {Feature}
+
+**Scope**: {What to test}
+**Types**: Unit, Integration, E2E, Perf, Security
+**Resources**: {Team allocation}
+**Dependencies**: {Prerequisites}
+**Schedule**: {Timeline}
+**Entry Criteria**: {Start conditions}
+**Exit Criteria**: {Completion conditions}
+**Risks**: {Identified risks + mitigation}
+```
+
+### Environment Strategy
+```markdown
+| Env | Purpose | Data | Refresh | Access |
+|-----|---------|------|---------|--------|
+| Dev | Development | Synthetic | On-demand | All |
+| Test | QA testing | Test data | Daily | QA |
+| Stage | Pre-prod | Prod-like | Weekly | Limited |
+| Prod | Live | Real | N/A | Ops |
+```
+
+## Quick Reference
+
+| Testing Type | When | Duration |
+|--------------|------|----------|
+| Exploratory | New features | 60-120 min |
+| Usability | UI changes | 2-4 hours |
+| Accessibility | Every release | 1-2 hours |
+| Localization | Multi-region | 1 day/locale |
+
+| Metric | Excellent | Good | Needs Work |
+|--------|-----------|------|------------|
+| Coverage | >90% | 70-90% | <70% |
+| Leakage | <2% | 2-5% | >5% |
+| Automation | >80% | 60-80% | <60% |
+| MTTR | <24h | 24-48h | >48h |

package/skills/quality/test-master/references/security-testing.md

@@ -0,0 +1,127 @@
+# Security Testing
+
+## Authentication Tests
+
+```typescript
+describe('Authentication Security', () => {
+  it('rejects invalid credentials', async () => {
+    await request(app)
+      .post('/api/login')
+      .send({ email: 'user@test.com', password: 'wrong' })
+      .expect(401);
+  });
+
+  it('rejects expired tokens', async () => {
+    const expiredToken = createExpiredToken();
+    await request(app)
+      .get('/api/protected')
+      .set('Authorization', `Bearer ${expiredToken}`)
+      .expect(401);
+  });
+
+  it('rejects tampered tokens', async () => {
+    const tamperedToken = validToken.slice(0, -5) + 'xxxxx';
+    await request(app)
+      .get('/api/protected')
+      .set('Authorization', `Bearer ${tamperedToken}`)
+      .expect(401);
+  });
+
+  it('enforces rate limiting on login', async () => {
+    for (let i = 0; i < 6; i++) {
+      await request(app)
+        .post('/api/login')
+        .send({ email: 'user@test.com', password: 'wrong' });
+    }
+
+    await request(app)
+      .post('/api/login')
+      .send({ email: 'user@test.com', password: 'correct' })
+      .expect(429);
+  });
+});
+```
+
+## Authorization Tests
+
+```typescript
+describe('Authorization', () => {
+  it('denies access to other users resources', async () => {
+    await request(app)
+      .get('/api/users/other-user-id/data')
+      .set('Authorization', `Bearer ${userAToken}`)
+      .expect(403);
+  });
+
+  it('denies admin routes to regular users', async () => {
+    await request(app)
+      .delete('/api/admin/users/123')
+      .set('Authorization', `Bearer ${regularUserToken}`)
+      .expect(403);
+  });
+});
+```
+
+## Input Validation Tests
+
+```typescript
+describe('Input Validation', () => {
+  it('rejects SQL injection attempts', async () => {
+    await request(app)
+      .get('/api/users')
+      .query({ search: "'; DROP TABLE users; --" })
+      .expect(400);
+  });
+
+  it('rejects XSS in input fields', async () => {
+    const response = await request(app)
+      .post('/api/posts')
+      .send({ title: '<script>alert("xss")</script>' })
+      .expect(201);
+
+    expect(response.body.title).not.toContain('<script>');
+  });
+
+  it('validates file upload types', async () => {
+    await request(app)
+      .post('/api/upload')
+      .attach('file', 'malicious.exe')
+      .expect(400);
+  });
+});
+```
+
+## Security Headers Test
+
+```typescript
+describe('Security Headers', () => {
+  it('sets security headers', async () => {
+    const response = await request(app).get('/');
+
+    expect(response.headers['x-content-type-options']).toBe('nosniff');
+    expect(response.headers['x-frame-options']).toBe('DENY');
+    expect(response.headers['strict-transport-security']).toBeDefined();
+  });
+});
+```
+
+## Security Test Checklist
+
+| Category | Tests |
+|----------|-------|
+| **Auth** | Invalid creds, token expiry, tampering |
+| **Input** | SQL injection, XSS, command injection |
+| **Access** | IDOR, privilege escalation |
+| **Rate Limit** | Brute force, API abuse |
+| **Headers** | CSP, HSTS, X-Frame-Options |
+| **Data** | PII exposure, error messages |
+
+## Quick Reference
+
+| Vulnerability | Test Approach |
+|---------------|---------------|
+| SQL Injection | `'; DROP TABLE--` in inputs |
+| XSS | `<script>alert(1)</script>` |
+| IDOR | Access other user's resources |
+| CSRF | Missing/invalid tokens |
+| Auth Bypass | Missing auth, expired tokens |