Testing Strategy & Automation
Relevant source files
The following files were used as context for generating this wiki page:
Introduction
The testing strategy for the Monarch Property Management system is a multi-layered framework designed to ensure security, performance, and functional reliability. It encompasses automated End-to-End (E2E) flows, specialized security vulnerability assessments, performance benchmarking, and database-level verification. This strategy ensures that backend hardening, such as Row Level Security (RLS) and optimized indexing, remains effective across the entire application lifecycle.
Automation is integrated through Playwright for browser-based testing, shell scripts for Lighthouse performance audits, and dedicated React components for production readiness checks. These tools allow developers to validate the system from deployment through to ongoing maintenance, focusing heavily on role-based access control (RBAC) and data integrity.
Sources: DEPLOYMENT_GUIDE.md:200-244, src/utils/testUtilities.ts:5-15, scripts/performance-validation.sh:10-25
Automated End-to-End (E2E) Testing
The project utilizes Playwright to automate critical business workflows, specifically the Request for Quotation (RFQ) lifecycle. This involves simulating multiple user roles to verify cross-functional interactions and database state changes.
RFQ Lifecycle Automation
The E2E suite follows a "full lifecycle" pattern where a property manager creates an RFQ, a vendor submits a bid, and the manager subsequently awards a contract.
The sequence above illustrates the automated flow verified in the test suite.
Sources: tests/e2e/rfq-flow.spec.ts:31-118
| Step | Action | Assertion |
|---|---|---|
| Authentication | Sign in as PM/Vendor | URL redirect to /admin/rfqs or dashboard |
| Creation | PM fills RFQ form & adds Lots | RFQ ID exists and is visible in list |
| Bidding | Vendor fills bid form (price/notes) | Success message: "Bid submitted successfully" |
| Awarding | PM selects "Award Contract" | Status text displays "Contract Awarded" |
| Sources: tests/e2e/rfq-flow.spec.ts:34-118 |
Security Testing & Verification
Security testing is prioritized through both database-level verification scripts and frontend dashboards that simulate attack vectors or policy violations.
RLS and Role Enforcement
A significant portion of the testing strategy focuses on Row Level Security (RLS). The testRLSPolicies utility programmatically verifies that vendors cannot see other vendors' profiles or bookings and that audit logs are restricted to administrators.
The logic ensures data isolation at the database layer is reflected in the application's response.
Sources: src/utils/testUtilities.ts:18-53, src/components/admin/SecurityTestingDashboard.tsx:112-145
Database Verification Queries
Post-deployment, a specialized SQL script is used to verify the integrity of the backend hardening migration.
- Indexes: Verifies the existence of 8 performance-critical indexes (e.g.,
idx_vendor_bids_vendor_id). - Functions: Confirms 5 SECURITY DEFINER helper functions (e.g.,
is_admin_user,can_access_room). - Policy Audit: Ensures no RLS policies are granted
TO public, forcingauthenticatedroles.
Sources: scripts/verify_deployment.sql:12-132
Performance Validation
The project employs a dual approach to performance: client-side timing and shell-based Lighthouse audits.
Performance Metrics
The system measures Core Web Vitals and network-level metrics to ensure the application remains responsive under load.
| Metric | Target / Good Threshold | Source |
|---|---|---|
| First Contentful Paint (FCP) | < 1.8s | src/utils/testUtilities.ts |
| DOM Content Loaded | < 3.0s | src/utils/testUtilities.ts |
| Time to First Byte (TTFB) | < 600ms | src/utils/testUtilities.ts |
| Performance Score (Lighthouse) | > 90 | scripts/performance-validation.sh |
| Accessibility Score | 100 | scripts/performance-validation.sh |
| Sources: src/utils/testUtilities.ts:98-124, scripts/performance-validation.sh:65-72 |
Lighthouse Automation
The performance-validation.sh script automates headless Chrome audits for key routes:
- Home (
/) - Dashboard (
/dashboard) - Gallery (
/gallery) - Contact (
/contact)
Sources: scripts/performance-validation.sh:56-62
Integration & Readiness Dashboards
The application includes a FinalIntegrationCheck component and a SecurityTestingDashboard for real-time monitoring of system health in production or staging environments.
Component-Based Health Checks
The FinalIntegrationCheck runs a suite of asynchronous tests categorized into:
- Core: Database connectivity, Supabase Auth session, Storage bucket access.
- Security: Content Security Policy (CSP) headers, input sanitization via DOMPurify.
- Features: Real-time notification channel creation and performance load-time calculation.
Sources: src/components/FinalIntegrationCheck.tsx:50-130
Admin Security Testing Suite
The SecurityTestingDashboard provides a UI for administrators to execute:
- Authentication Tests: Validating that weak passwords are rejected and rate limiting is active.
- Data Protection Tests: Verifying TLS 1.3 usage and PII data minimization in maintenance requests.
- Input Validation: Testing XSS payloads against React's automatic escaping logic.
Sources: src/components/admin/SecurityTestingDashboard.tsx:58-200
Conclusion
The Monarch Property Management testing strategy is a comprehensive framework that bridges the gap between development and production. By combining SQL-based backend verification with automated E2E flows and performance benchmarking, the system ensures that security policies are not only present but actively enforced. This multi-layered approach provides high confidence in the application's stability, specifically regarding sensitive RFQ and financial data.
Sources: DEPLOYMENT_GUIDE.md:313-332, src/utils/testUtilities.ts:250-268