Testing
Status: Scaffolded 2026-09-24
The API is where correctness matters most, so it carries the real test suite. The clients get a smoke test and a release guard. The docs build is its own test. Nothing ships without npm run validate, and each repo's validate includes exactly the tests that are fast and deterministic enough to run on every PR.
API: vitest, supertest, mongodb-memory-server
Tests boot the Express app through buildApp (no listener) and hit it with supertest against a MongoDB started in-process by mongodb-memory-server. No mocks of the database: the same Mongoose models, indexes, and TTL definitions run in tests as in production, so a missing unique index fails a test instead of a member.
Every route file has a test file, and every route test includes, at minimum:
| Case | Expects |
|---|---|
| Happy path | the documented status and response shape |
| Validation error | 400, code: 'validation_error', the field path in details |
| Unauthenticated | 401 on member routes |
| Wrong principal or role | 403, or 404 where existence must not leak |
| Visibility filtering | a list never contains an item the caller may not see |
The last two are the permission boundary and they are not optional. A PR that adds a route without them fails review regardless of coverage. The backend testing page has the layout, the helpers, and the first-run download note.
Web: Playwright smoke, outside validate
test:e2e runs Playwright against a local next start: the home page renders, /places mounts the map container, /login shows the form. It is not in validate because it needs a built app and a browser, which doubles CI time for a check that catches a different class of bug (a dynamic import that broke, a layout that threw on the server). Run it before a web release and after touching the map or the session route handler.
validate for web is Biome, tsc, and next build. The build is a real test: it renders every static route, type-checks route handlers, and fails on a bad metadata export.
Mobile: typecheck and the release guard
There is no unit suite in the scaffold. validate is Biome, tsc --noEmit, and check:prod, the script that fails on localhost, live keys, and private IP ranges in the source tree. tsc over an expo-router app catches most of what a shallow component test would, and the release guard catches the mistake that actually ships to a store. See build and release.
Docs: the build is the test
docusaurus build with onBrokenLinks: 'throw' and a required description on every page means a wrong link, a missing frontmatter field, or a Mermaid diagram that does not parse fails CI. pokedocs check runs the preset's own checks first. There is nothing else to test in a docs repo, and adding a test framework would be decoration.
What is not tested yet
Socket.IO event flows (the /messages namespace has a client in devDependencies, tests land with the messages milestone), the companion SSE stream beyond a stubbed model, and the OSM seed script. These are listed in open questions.