Testing From Zero cheat sheet

• A green test proves only that the cases you wrote worked today. Tests find bugs, they cannot show there are none.
• A test can be wrong (bad expected value) or weak (runs code, checks almost nothing).
• Two weak tests (typeof is number, zero stays zero) passed on subtotal * rate and gave 100% coverage.
• Watch every test go red once, for the right reason. A test never seen failing may be unable to fail.

node --test --test-reporter=spec
# finds *.test.js, *-test.js, *_test.js
# ✖ adds 20% tax to 100
#   20 !== 120

Tip: Shapes are models, not laws. All agree: few E2E tests, and match your tests to where the risk is.

• Test: business rules, edge cases (empty, zero, one, max), error paths, every bug you already had, paths users cannot lose.
• Skip: other people's code (test your use of it), pure wiring, exact styling, private details, generated code.
• Ask: if this fails, will I know something real is broken? If I would just update the test, do not write it.
• Test behaviour, not construction: a test of a private _items array broke on a harmless refactor, the public total() test did not.

• Prefer the real thing, then a fake, then a stub, a mock last. Inject dependencies as arguments.
• Double the edges: network, database, clock, randomness, email. Not your own pure logic.
• A hand-written mock can drift from the real API: the test stays green and production breaks.

it('calls once after quiet', (t) => {
  t.mock.timers.enable(
    { apis: ['setTimeout'] });
  const fn = mock.fn();
  const d = debounce(fn, 300);
  d('a'); d('b'); d('c');
  t.mock.timers.tick(300);
  assert.equal(fn.mock.callCount(), 1);
});

• Always await or return async assertions. A missing await on assert.rejects gave a green test for a false claim.
• Isolation: each test passes alone, shuffled, in parallel. Module-level state (a Set) failed when one test ran alone.
• Find order bugs with -t "name" and --sequence.shuffle. Reset state in beforeEach.

• Query order: getByRole with name, getByLabelText, text, getByTestId last. A failing role query often means a real a11y bug.
• Use userEvent.setup() before render, and await every user.*. Prefer it to fireEvent.
• Vitest has no global afterEach: add afterEach(() => cleanup()) or you get "found multiple elements".
• Skip big snapshots, state and CSS layout (jsdom has no layout).

beforeAll(() => server.listen(
  { onUnhandledRequest: 'error' }));
afterEach(() => { cleanup();
  server.resetHandlers(); });
afterAll(() => server.close());

server.use(http.get(url, () =>
  HttpResponse.json([{ id: 1 }])));

• Test all states: loading, success, empty, error. Use await screen.findByRole(...); waitFor for non-element conditions.
• Forms: validation messages (role="alert", aria-invalid), no request when invalid, exact request body, server error then retry.
• An unhandled request can hide behind your error UI and still pass. Watch for [MSW] Error.

• Integration = two or more of your own real parts. Fake only what you do not own and cannot run cheaply.
• createApp({ db, queue, clock }) returns the app and never calls listen. supertest binds a free port. Real socket: listen(0).
• Assert status, body, stored rows, published messages, and non-effects on failure.
• Use the production database engine. SQLite can pass where Postgres fails.

• Contracts: OpenAPI schema check (ajv) for the provider; consumer-driven (Pact) for known callers. Extra fields are safe, removing one breaks.
• Webhooks: wrong signature is 401, valid is stored, same event twice is stored once. Sign the raw body bytes.
• Queues: fake with the same interface; assert published and not published. Test the worker separately.
• Speed: build once per file, migrate once per run, clean by rollback, small seeds, factories not one big seed.

await page.getByLabel('Todo').fill('x');
await page.getByRole('button',
  { name: 'Add' }).click();
// retries until true. No sleep.
await expect(items).toHaveCount(1);

• One E2E test per business journey (login, pay), not per feature. 5 to 20 is common.
• Locators: role, label, text, test id last. Strict mode errors if more than one match: be specific.
• Auto-waiting: visible, stable, enabled, receives events. Never waitForTimeout or { force: true }.
• Each test gets a fresh context; the server data is yours to isolate. Log in once with storageState and gitignore .auth/.
• page.route mocks third parties and rare errors, not your own API in main journeys. Set trace: 'on-first-retry'.

1. Reproduce: --repeat-each=20, then fewer or more --workers.
2. Open the trace at the first step that differs.
3. Name the cause from the five.
4. Fix the cause, then repeat to prove it.

Watch out: Retries, longer timeouts and silent test.skip hide flakiness. A test that needed a retry gets a ticket.

1. Red: one small failing test, for the right reason.
2. Green: the simplest code, even a fake (return 0).
3. Refactor with all tests green.

fc.assert(fc.property(fc.nat(100000),
  (cents) => {
    assert.equal(
      parseMoney(formatCents(cents)),
      cents);
  }));
// Counterexample: [1]

• Good properties: round trip, idempotent, never crashes.
• A bug fix starts with a failing test that reproduces it.

• Stryker changes code (< to <=). A failing test kills the mutant; a passing run means it survived. Score = killed / total.
• A survivor means a missing test (n <= 0 needed an add('0,5') test) or dead code (a redundant if). Read each one.
• An assertion-free test gave 100% coverage and a 37.5% mutation score. Use coverage to find gaps, never as a target.
• Run mutation on core modules or nightly: cost is mutants times test time.