frontend-go-live-check 1.5.0 → 1.6.0

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## 1.5.0
 
+- **Your own tests in the same report**: unit tests (Vitest, Jest, Karma or `npm test`) with code coverage, and end-to-end tests (Playwright Test, Cypress) against the production build. A new area: *Tests, user flows and business rules*.
+- **User flows and business rules without code** in `go-live-check/flows.json`: open, fill, select, click, see, url and API checks (status and JSON values), on every screen size. A broken business rule is a blocker.
+- **Forms filled with valid data** and sent: they must save and tell the user (only on this computer or allowed hosts).
+- **Postman collection run in order** with its `pm.test` scripts and the variables carried between requests; `api.variables` for `{{variables}}`.
+- **Load profiles**: `light`, `standard` (50 users, 1 minute) and `stress` (finds the breaking point); `--load <profile>`.
+- **Security**: CORS (which websites may read the API) and the HTTPS certificate and TLS version.
+- **Code quality**: `lint` / `typecheck` scripts, unused and outdated libraries, very long files, copied code.
 - **One folder for everything**: `go-live-check/` holds the settings (`config.json`), the test passwords (`.env`), the API files (`api/`), the design baseline (`baseline/`), the report (`report/`) and a saved sign-in (`session.json`), with its own `.gitignore`. `init` creates it. Projects with the older root files keep working; the README shows how to move.
 - Every section of the HTML report opens and closes (accordion), with **Expand all** and **Collapse all**.
 - The date and time the report was created are at the top of the HTML report, on the PDF and Word cover, and in the page header.

package/README.md

@@ -65,6 +65,7 @@ my-project/
 │   │   ├── postman_collection.json   ← your Postman collection
 │   │   ├── postman_environment.json  ← optional: its environment
 │   │   └── openapi.json              ← or/and your OpenAPI file
+│   ├── flows.json             ← your user journeys and business rules (optional)
 │   ├── baseline/              ← the approved look of every page (commit it)
 │   ├── report/                ← the results: HTML, PDF, Word, zip (Git ignores it)
 │   ├── session.json           ← a saved sign-in, after `login` (Git ignores it)
@@ -75,7 +76,7 @@ my-project/
 
 | Commit | Never commit (already ignored) |
 | --- | --- |
-| `config.json`, `.env.example`, `api/`, `baseline/` | `.env`, `report/`, `session.json` |
+| `config.json`, `.env.example`, `api/`, `flows.json`, `baseline/` | `.env`, `report/`, `session.json` |
 
 <details>
 <summary><b>Set up with an older version?</b></summary>
@@ -192,6 +193,9 @@ The report lists every sign-in method found (*email and password · Google · UA
 
 | | Area | What is checked |
 | :-: | --- | --- |
+| ✅ | **Unit and end-to-end tests** | Runs **your own tests**: Vitest, Jest, Karma or `npm test` with code coverage (low coverage is reported), and your Playwright or Cypress tests against the production build |
+| 🧭 | **User flows and business rules** | Your main journeys and business rules, written **without code** in `go-live-check/flows.json` (open, fill, click, see, check the API answer), on every screen size; a broken business rule blocks going live |
+| 📝 | **Forms with valid data** | Every form is filled with valid test data and sent: it must save and tell the user (only on this computer or allowed test hosts) |
 | 🧭 | **Functionality** | JavaScript errors, console errors, failed requests, broken links, images and anchors, blank pages, buttons covered by something else, unfinished text (`undefined`, `NaN`, `[object Object]`, translation keys, lorem ipsum, TODO), loading spinners that never stop, the production build, the "page not found" page |
 | 🛟 | **Resilience** | Each page opened again with its API calls failing: does it crash, go blank, or tell the user? |
 | 📱 | **Design and responsive layout** | Every page at every screen size: sideways scrolling, text that spills out of its box (a button too small for its label), text on top of other text, content cut off at the screen edge, text cut off inside its box, overlapping buttons, stretched or squashed images, tiny text on phones, right-to-left layout (Arabic, Hebrew…), fonts that fail to load, too many fonts and sizes |
@@ -199,12 +203,12 @@ The report lists every sign-in method found (*email and password · Google · UA
 | ♿ | **Accessibility** | axe-core against WCAG 2.0 / 2.1 / 2.2 A and AA; keyboard-only use: visible focus, no traps, nothing that only a mouse can click; form field types |
 | ⚡ | **Performance** | Size, JavaScript, requests, load time, LCP, layout shift and frozen-page time for every page, against budgets; Lighthouse as a phone and as a desktop |
 | 🔌 | **API calls made by the pages** | Slow, very large, repeated, too many, uncompressed or uncached calls |
-| 📈 | **Load** | 10 users at the same time on the main pages and the app's own read requests |
+| 📈 | **Load** | Profiles: `light` (10 users, every run), `standard` (50 users for a minute, added gradually) and `stress` (adds users until the app slows down or fails: the **breaking point**) |
 | 🔐 | **Sign-in and access** | Every sign-in method found (email, Google, Microsoft, Apple, UAE PASS, OpenID Connect) and its buttons; wrong password, unknown user, empty sign-in; a cancelled sign-in; signed-in pages and APIs opened without signing in; tokens in web storage; every form submitted empty |
-| 🧪 | **API tests** | From your **Postman collection or OpenAPI/Swagger file**: every endpoint with valid and invalid data, without a token, with the wrong role, and with another user's records |
-| 🛡️ | **Security** | Security headers, cookies, private files (`.env`, `.git`), source maps, secrets in the JavaScript or the source, passwords in addresses, outside scripts without integrity, `npm audit` |
+| 🧪 | **API tests** | From your **Postman collection or OpenAPI/Swagger file**: every endpoint with valid and invalid data, without a token, with the wrong role, and with another user's records. Plus the **collection run in order with its own `pm.test` scripts**, the variables carried between requests (sign in → create → read → delete) |
+| 🛡️ | **Security** | Security headers, cookies, CORS (which sites may read the API), the HTTPS certificate and TLS version, private files (`.env`, `.git`), source maps, secrets in the JavaScript or the source, passwords in addresses, outside scripts without integrity, `npm audit` |
 | 🔎 | **SEO and sharing** | Titles, descriptions, headings, language, duplicate titles, favicon, link previews, robots.txt and sitemap.xml |
-| 🧹 | **Code** | TypeScript errors, your own ESLint rules, leftover `console.log` |
+| 🧹 | **Code** | TypeScript errors, your ESLint rules (or your `lint` / `typecheck` scripts), leftover `console.log`, libraries installed but never used, libraries a major version behind, very long files, copied code |
 
 The report's **What was checked** table says exactly what ran on your project, and why anything was skipped.
 
@@ -228,6 +232,44 @@ The report's **What was checked** table says exactly what ran on your project, a
 
 ---
 
+## User flows and business rules (no code)
+
+The tool opens every page by itself, but only your team knows the journeys and the rules. Write them once in **`go-live-check/flows.json`**; every run checks them on desktop and phone, with a picture where a step fails.
+
+```json
+{
+  "flows": [
+    {
+      "name": "A citizen sends a new application",
+      "rule": true,
+      "steps": [
+        { "open": "/applications/new" },
+        { "select": { "Service": "Permit" } },
+        { "fill": { "Description": "Permit for a small shop {unique}" } },
+        { "click": "Submit application" },
+        { "api": { "method": "POST", "path": "/api/applications", "status": 201, "body": { "status": "Submitted" } } },
+        { "url": "/applications" },
+        { "see": "Permit" }
+      ]
+    }
+  ]
+}
+```
+
+| Step | What it does |
+| --- | --- |
+| `open` | Opens an address of the app |
+| `fill`, `select`, `check` | Fills fields found by their label, placeholder or name (`css=…` works too). `"$NAME"` comes from `.env`; `{unique}` is unique to the run |
+| `click`, `press` | Clicks a button or link by its text; presses a key |
+| `see`, `notSee` | A text must (or must not) be on the page |
+| `url` | The address must start with this |
+| `api` | The page called this API, it answered this status, and its JSON answer has these values |
+| `wait` | Waits a moment (ms) |
+
+A flow is signed in with the test user unless `"signedIn": false`. **`"rule": true`** marks a business rule ("a new application is Submitted", "a citizen sees only their own applications"): if it fails, it is a blocker.
+
+---
+
 ## Works with
 
 **Next.js** · **React** (Vite, Create React App) · **Vue** · **Nuxt** · **Angular** · **Svelte / SvelteKit** · **Astro** · **Remix / React Router** · **Gatsby** · **Solid** · **Preact** · **Qwik** · **plain HTML**. Anything else, in any language, works with a start command or `--url`.
@@ -365,7 +407,7 @@ The short name `go-live-check` works too. After `init`, use `npm run go-live`, `
 
 | Option | What it does |
 | --- | --- |
-| `--only pages,security` | Only these areas: `pages`, `lighthouse`, `auth`, `security`, `resilience`, `load`, `api`, `code` |
+| `--only pages,security` | Only these areas: `pages`, `lighthouse`, `auth`, `flows`, `security`, `resilience`, `load`, `api`, `code`, `tests` |
 | `--skip lighthouse,load` | Everything except these |
 | `--api-only` | Only the API tests (backend projects) |
 | `--api <file or URL>` | The Postman collection or OpenAPI/Swagger file (found automatically in the project) |
@@ -376,6 +418,7 @@ The short name `go-live-check` works too. After `init`, use `npm run go-live`, `
 | `--no-lighthouse` · `--no-build` · `--no-export` | Skip Lighthouse · use the existing build · no PDF/Word |
 | `--format pdf` | Only one of the documents |
 | `--update-baseline` | Save the current look of every page as the new design baseline |
+| `--load stress` | `light` (default) · `standard` (50 users for a minute) · `stress` (finds the breaking point) |
 | `--fail-on major` | What fails the command: `blocker` (default) · `major` · `minor` · `never` |
 | `--open` · `--out <folder>` · `--config <file>` · `--quiet` · `--ci` | Open the report · report folder · settings file · less output · pipeline mode |
 
@@ -485,7 +528,11 @@ Hide parts that change on their own (clocks, live data) with `"visualMask": [".c
 | `services` | Commands started first (a backend, a mock API), each ready when its `url` answers |
 | `build`, `start`, `url` | `false` or your own build command · your own start command (`{port}` / `$PORT`) · check a running site |
 | `budgets` | `pageKB` 3000 · `jsKB` 1000 · `requests` 120 · `loadMs` 4000 · `apiMs` 1000 · `apiCalls` 30 |
-| `load` | `{ "users": 10, "seconds": 10, "maxTargets": 8, "hosts": [] }`, or `false` (GET only; this computer or listed hosts) |
+| `load` | `{ "profile": "light" | "standard" | "stress" }` or your own `users`, `seconds`, `rampSeconds`, `hosts`; or `false` (GET only; this computer or listed hosts) |
+| `tests` | `{ "coverage": 60, "unitCommand": "…", "e2eCommand": "…" }`, or `false` to skip your own tests |
+| `flows` | User journeys and business rules (or in `go-live-check/flows.json`) |
+| `formFill` | `{ "hosts": ["test.example.com"] }` to also fill and send forms on a test host, or `false` |
+| `api.variables` | Values for `{{variables}}` in the Postman collection, e.g. `{ "password": "$GO_LIVE_PASSWORD" }` |
 | `keyboard`, `resilience`, `visual`, `evidence`, `formChecks`, `lighthouse`, `discoverRoutes` | All on by default; `false` turns one off |
 | `visualThreshold`, `visualMask`, `baselineDir` | How much may change (0.1%); parts to hide; where the baseline lives |
 | `report` | `organisation`, `classification` (default *Internal*), `preparedFor`, `approvers`: shown in the PDF and Word |
@@ -546,7 +593,7 @@ No other services: nothing is uploaded, and no account is needed.
 <details>
 <summary><b>Does it replace unit and end-to-end tests?</b></summary>
 
-No. It checks what every web app needs before going live, without any test code. Your own tests still cover your business rules.
+It runs them. Your own unit tests (with coverage) and your Playwright or Cypress tests are part of every run, and their results are in the same report and the same verdict. Your journeys and business rules can also be written as flows, without code. Writing the unit tests themselves is still your team's job: only you know what each function must do.
 
 </details>
 
@@ -567,10 +614,10 @@ Security headers, compression and caching usually come from your web server or C
 <details>
 <summary><b>What still needs a person?</b></summary>
 
-- whether the design matches what was intended (the screenshots make this quick);
-- business rules;
-- a full load test before a big launch;
-- a penetration test.
+- whether the design matches what was intended (the screenshots and the visual comparison make this quick);
+- writing the flows and unit tests for your business rules (the tool runs them every time);
+- a load test from proper servers for a very large launch (the `stress` profile finds the breaking point on one machine);
+- a penetration test by a security specialist before a big launch.
 
 </details>
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "frontend-go-live-check",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "description": "Is your frontend ready to go live? One command tests any web frontend (React, Next.js, Vue, Angular, Svelte, plain HTML…): pages, responsive design, accessibility, keyboard, performance and load, API calls, security, SEO, sign-in and APIs from Postman/OpenAPI. Report with evidence, PDF and Word, and a pipeline gate that approves or rejects the merge.",
   "homepage": "https://www.npmjs.com/package/frontend-go-live-check",
   "repository": {

package/schema.json

@@ -169,7 +169,7 @@
         },
         "fields": {
           "type": "object",
-          "description": "Other fields to fill: label \u2192 value."
+          "description": "Other fields to fill: label → value."
         },
         "expect": {
           "type": "string",
@@ -181,7 +181,7 @@
             "session",
             "token"
           ],
-          "description": "form = fill the email/password form \u00b7 session = reuse the session saved by 'frontend-go-live-check login' \u00b7 token = a test token. Default: form when username/password are set, token when token is set, otherwise session."
+          "description": "form = fill the email/password form · session = reuse the session saved by 'frontend-go-live-check login' · token = a test token. Default: form when username/password are set, token when token is set, otherwise session."
         },
         "token": {
           "type": "object",
@@ -193,15 +193,15 @@
             },
             "cookies": {
               "type": "object",
-              "description": "Cookie name \u2192 value."
+              "description": "Cookie name → value."
             },
             "localStorage": {
               "type": "object",
-              "description": "Key \u2192 value, set before the app loads."
+              "description": "Key → value, set before the app loads."
             },
             "sessionStorage": {
               "type": "object",
-              "description": "Key \u2192 value, set before the app loads."
+              "description": "Key → value, set before the app loads."
             }
           }
         },
@@ -210,7 +210,7 @@
           "description": "Where the saved session is kept. Default go-live-check/session.json (never commit it)."
         }
       },
-      "description": "How the tool signs in. Email/password: page + username + password. Google, Microsoft, Apple, UAE PASS\u2026: \"method\": \"session\" and run frontend-go-live-check login once. Pipelines: see ciLogin."
+      "description": "How the tool signs in. Email/password: page + username + password. Google, Microsoft, Apple, UAE PASS…: \"method\": \"session\" and run frontend-go-live-check login once. Pipelines: see ciLogin."
     },
     "lighthouse": {
       "type": "boolean"
@@ -358,6 +358,13 @@
             },
             "seed": {
               "type": "integer"
+            },
+            "variables": {
+              "type": "object",
+              "additionalProperties": {
+                "type": "string"
+              },
+              "description": "Values for {{variables}} in the Postman collection, e.g. { \"password\": \"$GO_LIVE_PASSWORD\" }."
             }
           }
         }
@@ -422,6 +429,227 @@
     "ciLogin": {
       "$ref": "#/properties/login",
       "description": "Used instead of \"login\" in pipelines (no one there to approve a Google or UAE PASS sign-in): a test email/password on the test environment, or a test token from the pipeline's secrets."
+    },
+    "load": {
+      "description": "The load test: false, or a profile and/or your own numbers. GET requests only, on this computer or the hosts listed.",
+      "oneOf": [
+        {
+          "const": false
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "profile": {
+              "enum": [
+                "light",
+                "standard",
+                "stress"
+              ],
+              "description": "light: 10 users for 10 s (default) · standard: 50 users for 60 s, added over 15 s · stress: adds 10 users every 10 s until the app gets slow or fails (the breaking point)"
+            },
+            "users": {
+              "type": "integer",
+              "minimum": 1
+            },
+            "seconds": {
+              "type": "integer",
+              "minimum": 1
+            },
+            "rampSeconds": {
+              "type": "integer",
+              "minimum": 0
+            },
+            "step": {
+              "type": "integer",
+              "minimum": 1,
+              "description": "stress: users added per step"
+            },
+            "maxTargets": {
+              "type": "integer",
+              "minimum": 1
+            },
+            "hosts": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "description": "Other hosts the load test may call (test environments only)."
+            }
+          }
+        }
+      ]
+    },
+    "tests": {
+      "description": "The project's own unit and end-to-end tests. false turns them off.",
+      "oneOf": [
+        {
+          "const": false
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "unit": {
+              "type": "boolean",
+              "default": true
+            },
+            "e2e": {
+              "type": "boolean",
+              "default": true
+            },
+            "coverage": {
+              "type": "number",
+              "minimum": 0,
+              "maximum": 100,
+              "default": 60,
+              "description": "Minimum share of code lines covered by the unit tests (%)."
+            },
+            "unitCommand": {
+              "type": "string",
+              "description": "Your own command for the unit tests (instead of Vitest/Jest/Karma)."
+            },
+            "e2eCommand": {
+              "type": "string",
+              "description": "Your own command for the end-to-end tests. BASE_URL points at the app."
+            }
+          }
+        }
+      ]
+    },
+    "flows": {
+      "description": "User journeys and business rules, written without code (they can also be in go-live-check/flows.json).",
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": [
+          "name",
+          "steps"
+        ],
+        "properties": {
+          "name": {
+            "type": "string"
+          },
+          "rule": {
+            "type": "boolean",
+            "description": "A business rule: if it fails, it blocks going live."
+          },
+          "signedIn": {
+            "type": "boolean",
+            "default": true
+          },
+          "viewports": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "severity": {
+            "enum": [
+              "blocker",
+              "major",
+              "minor",
+              "info"
+            ]
+          },
+          "steps": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "minProperties": 1,
+              "maxProperties": 1,
+              "properties": {
+                "open": {
+                  "type": "string",
+                  "description": "Open this address, e.g. /applications"
+                },
+                "fill": {
+                  "type": "object",
+                  "additionalProperties": {
+                    "type": "string"
+                  },
+                  "description": "Field label, placeholder or name → value. \"$NAME\" comes from .env; {unique} is unique to the run."
+                },
+                "select": {
+                  "type": "object",
+                  "additionalProperties": {
+                    "type": "string"
+                  }
+                },
+                "check": {
+                  "type": "string"
+                },
+                "click": {
+                  "type": "string",
+                  "description": "Button or link text (or css=selector)."
+                },
+                "press": {
+                  "type": "string"
+                },
+                "see": {
+                  "type": "string"
+                },
+                "notSee": {
+                  "type": "string"
+                },
+                "url": {
+                  "type": "string",
+                  "description": "The address must start with this."
+                },
+                "api": {
+                  "type": "object",
+                  "required": [
+                    "path"
+                  ],
+                  "properties": {
+                    "method": {
+                      "type": "string"
+                    },
+                    "path": {
+                      "type": "string",
+                      "description": "e.g. /api/applications or /api/applications/:id"
+                    },
+                    "status": {
+                      "type": "integer"
+                    },
+                    "body": {
+                      "type": "object",
+                      "description": "Values the JSON answer must have."
+                    }
+                  }
+                },
+                "wait": {
+                  "type": "integer"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "formFill": {
+      "description": "Fill every form with valid test data and send it. Writes data: only on this computer or the hosts listed. false turns it off.",
+      "oneOf": [
+        {
+          "const": false
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "hosts": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            },
+            "max": {
+              "type": "integer",
+              "minimum": 1
+            }
+          }
+        }
+      ]
     }
   }
 }