Jul 10 - Add test suite

2026-07-10 15:49:55 -04:00
parent 512a80837a
commit 7a9814119f
10 changed files with 732 additions and 0 deletions
@@ -0,0 +1,35 @@
+# Tests
+
+Automated test suite (pytest). Runs entirely against an **in-memory SQLite**
+database (`TestingConfig`) — it never touches MySQL, sends mail, or hits the
+network, so it's safe to run anywhere.
+
+## Running
+
+```bash
+pip install -r requirements-dev.txt
+pytest
+```
+
+## Layout
+
+| File | Covers |
+|---|---|
+| `test_score.py` | Inspection score calc — correctness **and** web/API parity (the two hand-mirrored implementations must agree; CLAUDE.md §9 / rule 40). |
+| `test_sla.py` | SLA engine: `sla_status` / `sla_deadline` / `sla_hours_remaining` across every severity tier and boundary. |
+| `test_public_pages.py` | Login-free QR pages (`/f/<token>`, `/f/area/<token>`): rule 74 occupant-safety (no leaked checklist names / scores / descriptions), 404s, and the report-a-problem flow. |
+| `test_models.py` | `User.display_name`, `Issue.handler_label` / `resolved_facility`, public-token minting, and the authenticated area-QR route. |
+
+## How the fixtures work (`conftest.py`)
+
+- Required env vars (`SECRET_KEY`, `DATABASE_URL`, `DIGEST_SECRET`) are set at
+  import top **before** `app`/`config` import, because `config.py` reads them at
+  import time.
+- The Flask app is built **once per session** — `create_app()` can't run twice
+  (the `api_bp` sub-blueprints are registered on a module-level singleton).
+- A **fresh app context + schema** is created per test. The per-test context
+  matters: Flask-Login caches the current user on `g` (bound to the app
+  context), so a shared context would leak an authenticated user between tests.
+- Factory fixtures (`make_user`, `make_facility`, `make_area`, `make_template`,
+  `make_inspection`, `make_issue`) build persisted rows; pass only what you care
+  about. `login(user)` authenticates via the real login route.