Testing

Unit tests

pnpm test

Vitest (jsdom) over src/**/*.test.ts(x): roles, password rules, email-link checks, redirect safety, components.

End-to-end suites

pnpm test:e2e     # builds first, then runs e2e/*.e2e.test.ts

The production build runs on port 3100 against the local Supabase stack and Mailpit. The suites act like browsers — page requests with a cookie jar, server functions called over their real RPC endpoints, email links taken from Mailpit:

Suite	Covers
auth	Route guards, endpoint protection, generic sign-in errors, open-redirect safety, sign out, seeded users
account	Change password (re-auth, other sessions revoked), sign out everywhere
password-reset	Reset links, same-browser PKCE limit, bad and misused links
users	Roles, invite → accept → set password, resend, role change, remove

Prerequisites: the local stack is running (pnpm db:start) and .env points at it (pnpm env:local). pnpm dev can keep running on port 3000.

• Server-function ids are read from the build (.output/server), so always test a fresh build — test:e2e builds first.
• Each suite resets admin@example.com and deletes the *-e2e@example.com users it created.
• Each suite also asserts that the server logged no [server-fn] failed lines: expected outcomes must never surface as server errors.

CI

.github/workflows/ci.yml runs on every pull request and push to main:

Job	Runs
checks	typecheck, lint, unit tests, app build
e2e	fresh local Supabase in the runner, then pnpm test:e2e (server log uploaded on failure)
docs	pnpm docs:build, including the internal link check

Make all three required status checks for main in the repository’s branch protection settings.