# Testing

Phase 00 chooses exact tooling.

Prioritize tests for:
- composables
- API services
- auth/session
- route guards
- catalog filtering/search
- pricing/promotion presentation
- quick order/import validation
- cart
- checkout
- payment states
- orders
- permission-aware admin actions
- critical custom domain components

Do not test unchanged Nuxt UI internals.

## Security testing

Per the global AGENTS.md, security-sensitive functionality requires tests.
Do not test only the happy path. Cover:
- unauthorized access
- forbidden access
- invalid input
- boundary values
- duplicate requests
- concurrent requests
- expired credentials
- invalid tokens
- rate limits
- transaction rollback

Frontend tests validate UX and presentation. The backend remains authoritative
for authorization and financial correctness; frontend test failures must never
be treated as a backend security guarantee.

## Definition of done

Tests are part of the definition of done (see AGENTS.md). A feature is not
done until relevant tests exist and pass.