Enterprise Testing Strategy & Quality Assurance Guide

This document is the authoritative engineering specification for testing methodologies, test automation frameworks, quality gates, and verification suites across the Debelu platform. Grounded directly in [package.json](file:///c:/Users/frank/OneDrive/Desktop/Chisom/Debelu/New%20Debelu%20Marketplace/package.json), [playwright.config.ts](file:///c:/Users/frank/OneDrive/Desktop/Chisom/Debelu/New%20Debelu%20Marketplace/playwright.config.ts), [loadtest/k6-smoke.js](file:///c:/Users/frank/OneDrive/Desktop/Chisom/Debelu/New%20Debelu%20Marketplace/loadtest/k6-smoke.js), and the 40+ database verification suites in [scripts/](file:///c:/Users/frank/OneDrive/Desktop/Chisom/Debelu/New%20Debelu%20Marketplace/scripts), this guide governs how multi-surface software is validated prior to production release.

1. The Debelu Testing Pyramid

Debelu adopts a multi-layered quality assurance pyramid designed to capture regressions at the lowest possible layer of isolation before code reaches production environments.

mermaid

pyramid
    title Debelu Enterprise Testing Pyramid
    "Load & Stress Tests (k6 at 1k RPS)" : 5
    "End-to-End & a11y Tests (Playwright Multi-Device)" : 15
    "API Contract & Integration Tests (Supertest & CI Containers)" : 25
    "Database Concurrency & RLS Harness (40+ db-*-checks.mjs)" : 30
    "Unit & Component Tests (Vitest + RTL + Jest)" : 100

1.1 Quality Gate Summary Matrix

Testing Layer	Target Workspaces	Primary Tooling	Execution Cadence	Target Thresholds & Pass Criteria
Unit & Component	`apps/storefront` `debelu-marketing` `@debelu/core`	Vitest 4, React Testing Library, `@testing-library/jest-dom`	Pre-commit / Local / CI	100% pass; coverage $\ge 80%$ on critical financial utilities.
Backend Services	`debelu-backend`	Jest 29, ts-jest, Supertest	Pre-commit / Local / CI	100% pass; mock isolation for Paystack and Gemini gateways.
Edge Functions	`supabase/functions`	Vitest (Root runner)	CI on PR	100% pass; validates notification delivery and HMAC webhooks.
Database & RLS	`supabase/migrations` Postgres Cluster	Node.js Test Harness, Bash (`db-flow-tests.sh`)	CI on PR / Pre-deploy	100% pass across 40+ test suites; zero RLS data leaks.
E2E & Accessibility	`apps/storefront`	Playwright 1.62, `@axe-core/playwright`	Nightly / Release CI	Zero WCAG 2.1 AA violations; multi-browser visual regression pass.
Load & Performance	API & Storefront Edge	k6 Load Engine	Pre-launch / Post-major release	p95 Latency $\le 500$ ms at 1k RPS; error rate $< 1.0%$.
Disaster Recovery	Cross-Cloud Systems	`command-center-recovery-drill.mjs`	Monthly SRE Schedule	RTO $\le 1$ hour, RPO $\le 5$ minutes verified against synthetic drills.

2. Frontend Unit & Component Testing (Vitest)

Frontend unit testing utilizes Vitest 4 with JSDOM and React Testing Library, providing fast in-memory execution and native ESM resolution.

2.1 Critical Test Suites (`apps/storefront`)

Cart Calculation Invariants ([cart-total.test.ts](file:///c:/Users/frank/OneDrive/Desktop/Chisom/Debelu/New%20Debelu%20Marketplace/apps/storefront/src/cart-total.test.ts)): Validates that cart item additions, multi-quantity adjustments, discount coupon deductions, and campus delivery fees calculate accurately in Nigerian Kobo without floating-point rounding errors.
Wallet Receipt Generators ([wallet-receipts.test.ts](file:///c:/Users/frank/OneDrive/Desktop/Chisom/Debelu/New%20Debelu%20Marketplace/apps/storefront/src/wallet-receipts.test.ts)): Asserts that downloadable transaction receipts render valid financial metadata, transaction reference numbers, and timestamps.
App Link & Deep-Link Resolution ([appLinks.test.ts](file:///c:/Users/frank/OneDrive/Desktop/Chisom/Debelu/New%20Debelu%20Marketplace/apps/storefront/src/native/appLinks.test.ts)): Validates universal linking regexes, preventing open redirect vulnerabilities and malformed routing.

2.2 Execution Commands

bash

# Run storefront unit tests
npm run test --workspace=@debelu/storefront

# Run marketing site unit tests
npm run test --workspace=debelu-marketing

# Run unit tests with code coverage report
npx vitest run --coverage

3. Backend API & Domain Service Testing (Jest)

Backend tests in debelu-backend validate domain services, perimeter middlewares, and Express route controllers using Jest.

typescript

// debelu-backend/src/services/__tests__/OrderService.test.ts pattern
describe('OrderService.verifyDeliveryPin', () => {
  it('should unlock escrow and transition order to completed on valid PIN', async () => {
    const orderId = '00000000-0000-0000-0000-000000000001';
    const validPin = '582910';
    
    // Executes service method under mock database transaction
    const result = await OrderService.verifyDeliveryCode(orderId, validPin, 'vendor_user_id');
    expect(result.status).toBe('completed');
    expect(result.escrowReleased).toBe(true);
  });

  it('should reject invalid PIN with constant-time comparison failure', async () => {
    await expect(
      OrderService.verifyDeliveryCode('00000000-0000-0000-0000-000000000001', '000000', 'vendor_id')
    ).rejects.toThrow('Invalid delivery confirmation PIN');
  });
});

3.1 Execution Commands

bash

# Execute backend test suite
npm run test --workspace=debelu-backend

4. Supabase Edge Functions Testing

Supabase Edge Functions handle asynchronous notification delivery (deliver-notification), Paystack webhook processing, and background maintenance. They are tested using a root-level Vitest runner:

bash

# Execute edge function unit and integration tests
npm run test:functions

5. End-to-End & Accessibility Testing (Playwright)

Debelu utilizes Playwright 1.62 configured in [playwright.config.ts](file:///c:/Users/frank/OneDrive/Desktop/Chisom/Debelu/New%20Debelu%20Marketplace/playwright.config.ts) to execute automated browser testing across desktop and mobile viewports.

mermaid

graph TD
    Playwright[Playwright Test Runner] --> Desktop[Desktop Browsers: Chromium, Firefox, WebKit]
    Playwright --> Mobile[Mobile Viewports: Pixel 5, iPhone 12, iPhone SE]
    
    Desktop --> E2E[Functional E2E Flows: Browse -> Add to Cart -> Checkout Intent]
    Mobile --> Touch[Touch Gestures & Responsive Campus Navigation]
    
    Playwright --> Axe["Accessibility Auditing: @axe-core/playwright (WCAG 2.1 AA)"]
    Playwright --> Visual[Visual Regression: toHaveScreenshot Max 100px Diff]

5.1 Multi-Device Test Matrix

Desktop Chrome / Firefox / Safari: Validates full desktop navigation, multi-column catalog grids, and vendor management dashboards.
Mobile Chrome (Pixel 5) & Mobile Safari (iPhone 12, iPhone SE): Validates bottom sheet navigation, touch drawer menus, sticky checkout buttons, and mobile keyboard interactions.

5.2 Accessibility Auditing (`@axe-core/playwright`)

All primary customer screens must pass automated accessibility audits conforming to WCAG 2.1 AA standards:

typescript

// tests/e2e/smoke.spec.ts pattern
import { test, expect } from '@playwright/test';
import AxeBuilder from '@axe-core/playwright';

test('storefront homepage passes WCAG 2.1 AA accessibility audit', async ({ page }) => {
  await page.goto('/buy');
  const accessibilityScanResults = await new AxeBuilder({ page })
    .withTags(['wcag2a', 'wcag2aa', 'wcag21a', 'wcag21aa'])
    .analyze();

  expect(accessibilityScanResults.violations).toEqual([]);
});

5.3 Execution Commands

bash

# Run full E2E test suite headlessly
npm run test:e2e

# Run E2E tests in interactive UI mode with time-travel debugger
npm run test:e2e:ui

# Execute dedicated accessibility audit suite
npm run a11y --workspace=@debelu/storefront

6. Database Verification & Concurrency Harness (40+ Suites)

Debelu maintains over 40 specialized database integration scripts in [scripts/](file:///c:/Users/frank/OneDrive/Desktop/Chisom/Debelu/New%20Debelu%20Marketplace/scripts) to validate Row-Level Security, multi-tenant isolation, financial invariants, and concurrency race conditions.

mermaid

mindmap
  root((40+ DB Verification Suites))
    Access & Security
      db-access-tests.mjs
      db-command-table-privilege-checks.mjs
      db-granular-command-capability-checks.mjs
      db-launch-staff-capability-checks.mjs
    Financial Ledger
      db-finance-checks.mjs
      db-order-fee-snapshot-checks.mjs
      db-payout-reconciliation-checks.mjs
      db-reviewed-payout-batch-checks.mjs
      db-reviewed-wallet-refund-checks.mjs
      db-payout-transfer-intent-checks.mjs
    Concurrency & Race Conditions
      db-native-concurrency-tests.mjs
      db-native-return-concurrency-tests.mjs
      db-atomic-return-case-checks.mjs
    Privacy & Compliance
      db-privacy-checks.mjs
      db-privacy-erasure-plan-checks.mjs
      db-privacy-erasure-execution-checks.mjs
      db-subject-privacy-export-checks.mjs
      db-audit-export-checks.mjs
    Campus Governance
      db-campus-governance-checks.mjs
      db-campus-order-checks.mjs
      db-category-governance-checks.mjs

6.1 Concurrency & Race Condition Simulation

scripts/db-native-concurrency-tests.mjs executes parallel asynchronous SQL worker threads competing to purchase the final inventory unit of a listing. It verifies that PostgreSQL row locks (SELECT FOR UPDATE) and atomic decrement triggers prevent inventory overselling under high concurrency.

6.2 Running the Full Database Test Suite in CI

bash

# Shell script used in GitHub Actions to test migrations against throwaway Postgres
bash scripts/db-flow-tests.sh

7. Performance & Load Testing (k6)

Load testing validates platform stability and latency budgets under realistic peak traffic conditions (e.g., flash sales, university registration weeks).

7.1 k6 Smoke & Load Configuration ([`loadtest/k6-smoke.js`](file:///c:/Users/frank/OneDrive/Desktop/Chisom/Debelu/New%20Debelu%20Marketplace/loadtest/k6-smoke.js))

Target Load: Ramps from 0 to 50 concurrent virtual users (VUs) over 1 minute, sustains 50 VUs for 3 minutes, and ramps down. Simulates up to 1,000 requests/second.
SLO Thresholds:
- http_req_duration: p95 $< 500$ ms.
- ttfb (Time to First Byte): p95 $< 300$ ms.
- errors: Failed requests $< 1.0%$.

7.2 Execution Command

bash

# Execute local or remote k6 smoke load test
k6 run loadtest/k6-smoke.js

# Target staging environment with custom base URL
k6 run -e BASE_URL="https://staging.app.debelu.com" loadtest/k6-smoke.js

8. Disaster Recovery & Command Center Drills

As specified in [disaster-recovery-and-bcp.md](file:///c:/Users/frank/OneDrive/Desktop/Chisom/Debelu/New%20Debelu%20Marketplace/docs/operations/disaster-recovery-and-bcp.md), Debelu executes synthetic failure simulations via [scripts/command-center-recovery-drill.mjs](file:///c:/Users/frank/OneDrive/Desktop/Chisom/Debelu/New%20Debelu%20Marketplace/scripts/command-center-recovery-drill.mjs) and [scripts/recovery-drill.test.mjs](file:///c:/Users/frank/OneDrive/Desktop/Chisom/Debelu/New%20Debelu%20Marketplace/scripts/recovery-drill.test.mjs).

bash

# Execute synthetic recovery drill verifying failover playbooks
node scripts/command-center-recovery-drill.mjs
npm run test scripts/recovery-drill.test.mjs

The drill asserts that secondary gateway failover, Point-in-Time Recovery staging, and Cloudflare R2 backup replication adhere to our RTO $\le 1$h and RPO $\le 5$m SLAs.

9. CI/CD Integration & Automated Quality Gates

Every pull request triggers the automated GitHub Actions CI pipeline, enforcing strict sequential quality gates:

mermaid

flowchart TD
    PR[Pull Request Opened] --> Gate1[1. Monorepo Type Check: npm run type-check]
    Gate1 --> Gate2[2. Lint & Code Style: npm run lint]
    Gate2 --> Gate3[3. Unit & Component Tests: npm test]
    Gate3 --> Gate4[4. Database Verification: bash scripts/db-flow-tests.sh]
    Gate4 --> Gate5[5. E2E & Accessibility: Playwright & Axe-Core]
    Gate5 --> Gate6[6. Production Bundle Build: npm run build]
    Gate6 --> Merge[PR Approved & Merge Eligible]

A failure in any single gate halts the deployment pipeline immediately, preventing defective or unverified code from reaching staging or production branches.

10. Document Revision History

Revision	Date	Lead Author	Scope of Changes	Status
`1.0.0`	2026-10-05	Principal QA & Reliability Engineer	Complete enterprise testing guide covering testing pyramid, Vitest, Jest, Playwright E2E, Axe accessibility, 40+ DB checks, k6 load testing, and CI quality gates.	Active Living Standard

Enterprise Testing Strategy & Quality Assurance Guide ​

1. The Debelu Testing Pyramid ​

1.1 Quality Gate Summary Matrix ​

2. Frontend Unit & Component Testing (Vitest) ​

2.1 Critical Test Suites (apps/storefront) ​

2.2 Execution Commands ​

3. Backend API & Domain Service Testing (Jest) ​

3.1 Execution Commands ​

4. Supabase Edge Functions Testing ​

5. End-to-End & Accessibility Testing (Playwright) ​

5.1 Multi-Device Test Matrix ​

5.2 Accessibility Auditing (@axe-core/playwright) ​

5.3 Execution Commands ​

6. Database Verification & Concurrency Harness (40+ Suites) ​

6.1 Concurrency & Race Condition Simulation ​

6.2 Running the Full Database Test Suite in CI ​

7. Performance & Load Testing (k6) ​

7.1 k6 Smoke & Load Configuration ([loadtest/k6-smoke.js](file:///c:/Users/frank/OneDrive/Desktop/Chisom/Debelu/New%20Debelu%20Marketplace/loadtest/k6-smoke.js)) ​

7.2 Execution Command ​

8. Disaster Recovery & Command Center Drills ​

9. CI/CD Integration & Automated Quality Gates ​

10. Document Revision History ​

Enterprise Testing Strategy & Quality Assurance Guide

1. The Debelu Testing Pyramid

1.1 Quality Gate Summary Matrix

2. Frontend Unit & Component Testing (Vitest)

2.1 Critical Test Suites (`apps/storefront`)

2.2 Execution Commands

3. Backend API & Domain Service Testing (Jest)

3.1 Execution Commands

4. Supabase Edge Functions Testing

5. End-to-End & Accessibility Testing (Playwright)

5.1 Multi-Device Test Matrix

5.2 Accessibility Auditing (`@axe-core/playwright`)

5.3 Execution Commands

6. Database Verification & Concurrency Harness (40+ Suites)

6.1 Concurrency & Race Condition Simulation

6.2 Running the Full Database Test Suite in CI

7. Performance & Load Testing (k6)

7.1 k6 Smoke & Load Configuration ([`loadtest/k6-smoke.js`](file:///c:/Users/frank/OneDrive/Desktop/Chisom/Debelu/New%20Debelu%20Marketplace/loadtest/k6-smoke.js))

7.2 Execution Command

8. Disaster Recovery & Command Center Drills

9. CI/CD Integration & Automated Quality Gates

10. Document Revision History