testing

Write colocated *.test.tsx files using @testing-library/react, wrap routing-aware components in MemoryRouter, and mock the Supabase client with vi.mock before importing the module under test. JSDOM polyfills for ResizeObserver and matchMedia live in the shared setup file.

Use the scripts/with_server.py helper to start one or more servers, wait for the port to be ready, and then run your Playwright script. Always call page.wait_for_load_state('networkidle') before inspecting the DOM on dynamic apps.

Use Vitest unit tests for fast feedback on component logic and callbacks. Use browser proofs via Claude Preview MCP or Playwright when the flow depends on real Supabase auth, RLS policies, network round-trips, or route transitions that JSDOM cannot simulate.

The real Supabase client constructs a session at import time using localStorage, which JSDOM does not expose as expected. Register vi.mock for the Supabase client module before importing the module under test so the mock factory applies at parse time.

Exploratory QA finds functional, visual, and console issues but is not a substitute for load testing, security pentests, or formal accessibility audits. Findings are classified by severity and category, and security concerns should be escalated to specialists.