Skip to content

Tests

The core test suite validates the infrastructure layer of the backend.

This includes:

  • request context resolution
  • permissions
  • policies
  • services
  • audit logging
  • DRF mixins
  • exception handling

These tests ensure that the foundation of the system is stable, predictable, and safe.

Purpose

The core tests exist to:

  • guarantee correctness of shared infrastructure
  • prevent regressions in critical logic
  • validate multi-tenant safety
  • enforce consistent behavior across apps

Because core is used everywhere, failures here can impact the entire system.

Test Structure

Tests are grouped by responsibility:

  • request context
  • permissions
  • policies
  • services
  • mixins
  • exceptions

Each group focuses on one layer of the architecture.

Key Areas Covered

Request Context

Tests verify:

  • org resolution via headers
  • fallback behavior when headers are missing
  • membership validation
  • superuser access
  • customer org resolution

Permissions

Tests ensure:

  • HasCurrentOrg enforces org presence
  • HasCurrentCustomerOrg enforces customer org access
  • internal vs customer user detection
  • correct handling of unauthenticated requests

Policies

Tests validate:

  • role-based capabilities
  • org-level permissions
  • team-level permissions
  • membership-based access rules

These tests confirm that authorization logic behaves as expected.

Services

Tests cover:

  • org membership management
  • team management
  • team membership management
  • audit logging side effects
  • validation rules and constraints

This ensures business logic is correct and consistent.

Mixins

Tests verify:

  • queryset scoping by org
  • automatic org assignment on create
  • created_by / updated_by handling
  • safe behavior when fields are absent

Exceptions

Tests ensure:

  • consistent API error structure
  • correct extraction of detail and field errors
  • DRF compatibility
  • proper formatting of responses

Audit Logging

Tests confirm:

  • audit logs are created for relevant actions
  • correct actor attribution
  • correct change payload structure
  • no logs created for idempotent operations

Testing Strategy

The core test suite follows these principles:

1. Isolation

  • each test validates one specific behavior
  • minimal dependencies between tests

2. Determinism

  • tests do not rely on external systems
  • results are predictable and repeatable

3. Realistic Scenarios

  • tests simulate real-world usage
  • include role-based access scenarios
  • include multi-user and multi-org cases

4. Service-Level Focus

  • most tests target services directly
  • avoids unnecessary coupling to views

Common Patterns

Using fixtures

Tests rely heavily on fixtures such as:

  • users (owner, admin, engineer, etc.)
  • organizations
  • memberships
  • teams

These provide realistic test setups.

Exception testing

Tests verify that:

  • correct exception types are raised
  • correct error conditions are enforced

Example:

  • permission errors
  • validation errors
  • not found errors

Audit verification

Tests often:

  • perform an action
  • query AuditLog
  • assert expected entries exist

What Is Not Covered

The core test suite does not focus on:

  • frontend behavior
  • external integrations
  • UI-specific logic

Those belong to other layers or applications.

Running Tests

Typical commands:

  • run all tests
  • run only core tests
  • run with coverage

(Exact commands depend on project setup)

Best Practices

  • keep tests small and focused
  • test behavior, not implementation details
  • avoid duplication across tests
  • prefer service-level testing over view-level testing
  • include negative and edge cases

Importance of Core Tests

Because the core app provides shared infrastructure:

  • failures here affect all apps
  • regressions can lead to security issues
  • incorrect behavior can cause data leaks across orgs

Maintaining strong test coverage in this layer is critical.

Future Improvements

Potential enhancements:

  • increase coverage metrics
  • add performance-related tests
  • introduce property-based testing
  • add concurrency-related tests
  • extend audit validation scenarios

Summary

The core test suite ensures that:

  • foundational logic is correct
  • permissions and policies are enforced
  • multi-tenant safety is maintained
  • shared infrastructure behaves consistently

It acts as a safety net for the entire backend system.