paw-testing-layer

Paw Testing Layer

Overview

Use this as the transversal testing skill for PAW/Forkd. It encodes the PAW-Wiki testing rules and the repo-specific Maven/test habits needed to avoid false confidence.

Read references/testing-rules.md before writing, repairing, or judging tests.

Test Selection

Choose the test type from the behavior under test:

• Business rule or state transition: service test.
• SQL, row mapping, constraints, ordering, pagination, or schema behavior: DAO/persistence test against HSQLDB.
• TP2 JPA mapping, fetch, cascade, dirty checking, or generated SQL behavior: persistence/context test plus SQL/log inspection where useful.
• Route, binding, validation error, security rule, redirect, or JSP model contract: webapp MVC/security test.
• TP final REST resource status/body/header/error contract: API/MVC/JAX-RS resource test.
• SPA stores/composables, routes, forms, errors, and i18n behavior: frontend test if the repo has a frontend test runner; otherwise document the gap and manual/contract verification.
• API cache/static hosting behavior: cache/smoke test for ETag, If-None-Match, 304, and asset cache headers.
• TP final WAR contents and route split: packaging/smoke check.
• JSP escaping, scriptlets, i18n bundle symmetry, or rendered-template contract: template/i18n test.
• Runtime wiring, AOP proxy, scheduler, or app startup behavior: context/integration test or Jetty smoke.

Core Rules

• Tests are blackbox: assert externally observable behavior or final state, not internal calls.
• One test covers one scenario and one action. If the name needs "and", split it.
• Never use Mockito.verify, never, verifyNoInteractions, spy, or hand-rolled equivalents that count whether a dependency method was called.
• Never test private methods, reflection paths, or Class.forName seams. Exercise private logic only through public behavior.
• DAO tests use HSQLDB, shared schema bootstrap, SQL fixtures/direct setup, @Rollback, and DB state assertions.
• Service tests mock DAOs but assert returned state, thrown exceptions, state transitions, or recorded side effects.
• Do not test services that are pure pass-through wrappers; move/test real business behavior where it belongs.
• MVC tests verify status, redirects, model/binding errors, security, and preserved GET state.
• API contract tests verify status, DTO body, Problem Details, media types, auth errors, and headers such as Location, Link, ETag, and CORS-exposed headers.
• API 404 tests must prove /api/* returns JSON/Problem Details, while SPA deep links fall back to index.html.
• Cache tests prove both validator flow (ETag -> If-None-Match -> 304) and static cache policy when cache is implemented.
• Frontend tests cover stores/composables/routes/forms/i18n at the public UI/state contract level, not component internals.
• Frontend tests must not assert component internals, exact CSS classes, source snippets, exact DOM shape, implementation-specific store calls, or framework internals as the target.
• Do not use the object under test to set its own preconditions.
• Cover happy, unhappy, and edge paths as separate tests.
• A green build is not proof of wiki compliance; inspect test style and coverage against the rules.