testing-conventionslisted

# Testing Conventions Built test-first (red-green-refactor). Integration tests run against real local database, not mocks, so domain invariants are proven against real data. ## Directory layout (adapt to your project) ``` tests/ unit/ # zero I/O integration/ server-actions/<feature>/<action>.test.ts jobs/<job-name>.test.ts support/ db.ts # resetDb() fixtures/actor.ts # createTestActor() fakes/session.ts # setTestSessionUser() ``` ## Auth-faking tiers Pick the cheapest tier that tests what you're changing: 1. **Unit test authorization decisions** — pure auth helper functions, zero I/O 2. **Integration test full handler, session faked** — `createTestActor()` + `setTestSessionUser()`; mutation and audit log run for real against local DB. Default for mutation tests. 3. **True E2E with real auth** — reserved for login flow and RLS defense-in-depth tests ## DB lifecycle Reset database state before each integration test. Use fixtures to insert exactly what each test needs — don't rely on implicit baseline seed data unless documented. ## Job testing Always test idempotency: invoke the same job twice and assert the second call is a no-op. ## Critical test scenarios 1. Permission denied before any DB mutation 2. Self-service scope denied for another user's record 3. Immutable records cannot be edited in place 4. Money mutation writes audit log row See `docs/TESTING.md` and `.cu