Commit Graph

9 Commits

Author SHA1 Message Date
Ho Ngoc Hai
8a15df0bdb feat(a11y): add axe-core Playwright scorecard for 10 key routes
- Installs @axe-core/playwright at workspace root
- Creates e2e/a11y/scorecard.spec.ts scanning /, /search, /listings/[id],
  /listings/create, /login, /register, /dashboard, /agent/[id],
  /inquiries, /admin/moderation
- API mock layer lets pages render with stubbed JSON so axe sees real DOM
- Critical/serious violations fail the build; moderate/minor are recorded only
- Writes per-route JSON reports to e2e/a11y/reports/ (committed for before/after diffing in PRs)
- Adds dedicated "a11y" Playwright project in playwright.config.ts
- Pre-existing API unit test failures are unrelated to this change

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-04-24 10:41:42 +07:00
Ho Ngoc Hai
26b6b37cee feat(qa): add smoke test suite + post-deploy workflow
Some checks failed
CI / Lint → Typecheck → Test → Build (22) (push) Failing after 12s
Deploy / Build AI Services Image (push) Failing after 10s
Security Scanning / Trivy Scan — API Image (push) Failing after 1m25s
Security Scanning / Trivy Scan — Web Image (push) Failing after 46s
Security Scanning / Trivy Scan — AI Services Image (push) Failing after 43s
Deploy / Deploy to Staging (push) Has been skipped
Deploy / Smoke Test Staging (push) Has been skipped
Deploy / Deploy to Production (push) Has been skipped
Deploy / Smoke Test Production (push) Has been skipped
Security Scanning / Security Gate (push) Failing after 1s
Deploy / Rollback Staging (push) Has been skipped
CI / E2E Tests (push) Has been skipped
CodeQL Analysis / CodeQL (javascript-typescript) (push) Failing after 32s
Deploy / Build API Image (push) Failing after 26s
Deploy / Build Web Image (push) Failing after 10s
E2E Tests / Playwright E2E (push) Failing after 21s
Security Scanning / Dependency Audit (pnpm) (push) Failing after 5s
Security Scanning / Trivy Filesystem Scan (push) Failing after 42s
Deploy / Rollback Production (push) Has been skipped
- e2e/api/smoke.spec.ts — 9 @smoke API tests covering health, auth roundtrip,
  token refresh, listings, search, payments, subscriptions, and inquiries
- e2e/web/smoke.spec.ts — 7 @smoke Web tests covering homepage, login/register
  pages, listings, search, listing detail 404 handling, and console-error check
- playwright.config.ts — smoke-api and smoke-web projects (grep: /@smoke/)
  allowing targeted post-deploy execution without the full suite
- .github/workflows/smoke.yml — workflow_dispatch + workflow_call trigger for
  running only the @smoke subset against staging or production URLs

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-04-21 00:47:40 +07:00
Ho Ngoc Hai
db0fe8b9b7 fix(e2e): unblock E2E test environment — CSP, CORS, and env var fixes
Root causes of web E2E failures:
1. CSP connect-src only included API origin for NODE_ENV=development,
   blocking test mode (NODE_ENV=test) from fetching API data
2. CORS_ORIGINS missing the test web port (3010), so API rejected
   cross-origin requests from the web app
3. NEXT_PUBLIC_API_URL not set in .env.test or playwright config,
   causing web app to default to port 3001 instead of test port 3011
4. Playwright webServer config didn't inherit parent env vars,
   so API server lacked Redis/Typesense/MinIO connection info

Fixes:
- next.config.js: CSP connect-src allows API origins for all non-prod envs
- next.config.js: image remotePatterns allow localhost in test mode
- .env.test: add NEXT_PUBLIC_API_URL and CORS_ORIGINS
- playwright.config.ts: spread process.env into webServer env configs
- e2e.yml: add NEXT_PUBLIC_API_URL, API_PORT, WEB_PORT to GH Actions env
- homepage.spec.ts: update stale assertions to match current UI

Result: 147/202 tests passing (111 API + 36 web), up from 37/91.
Remaining 55 web failures are stale UI assertions needing frontend update.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-04-13 01:55:04 +07:00
Ho Ngoc Hai
25420720e7 fix(api,ci): remove type-only imports for DI and isolate CI ports from dev
- Remove `type` keyword from NestJS injectable class imports across all
  modules to fix runtime DI resolution (330+ handler/listener files)
- Offset CI docker-compose ports (5433/6380/8109/9002) to avoid
  conflicts with running dev containers
- Update .env.test, playwright.config.ts, and e2e workflow to use
  isolated CI ports with configurable overrides
- Fix prisma/seed.ts to use deterministic IDs for Prisma 7 upsert
  compatibility (phoneHash replaced phone as unique index)
- Add dedicated Docker bridge network for CI service containers

Co-Authored-By: Claude Opus 4 (1M context) <noreply@anthropic.com>
2026-04-13 01:40:14 +07:00
Ho Ngoc Hai
4372a9ee12 chore: update package dependencies and Playwright config
Update root, API, and web package.json files with latest dependencies.
Refresh pnpm-lock.yaml and update Playwright configuration.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-04-11 01:40:59 +07:00
Ho Ngoc Hai
a5f260ce67 docs: add K6 endpoints summary and quick start guide
- K6_ENDPOINTS_SUMMARY.md: Quick reference for all API endpoints with request/response shapes
- K6_QUICK_START.md: Practical guide with executable examples for search, auth, listing, and payment load tests
- Includes example K6 scripts, CI integration template, and troubleshooting
- Complete with load test scenarios and reporting options

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-09 01:35:29 +07:00
Ho Ngoc Hai
bac3313873 test(auth,payments,subs): add 58 unit tests for critical auth, payment, and subscription paths
Cover auth handlers (RegisterUser, LoginUser, RefreshToken), TokenService
(token rotation, reuse attack detection), payment callback edge cases
(duplicate/concurrent callbacks, multi-provider), subscription lifecycle
transitions (expire, pastDue, renew), and throttler proxy guard.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-04-08 13:49:19 +07:00
Ho Ngoc Hai
271ad76e6f fix: resolve E2E test failures and API runtime issues for Docker dev environment
- Fix DI issues: circular MCP module dependency, EventBus type import,
  SearchModule provider, CacheService metric counters placement
- Fix Express 5 readonly req.query in SanitizeInputMiddleware
- Fix Typesense client lazy initialization (getter instead of constructor)
- Fix MinIO bucket init error handling (non-fatal on 403)
- Fix missing class-validator decorators on bigint DTO fields (priceVND, amountVND)
- Fix subscription plan 404 (was returning 500 for invalid tier)
- Disable CSRF and raise rate limits in test environment
- Update E2E tests to match actual API response shapes
- Update CI workflow with Redis, Typesense, MinIO services and env vars

All 101 API E2E tests now pass against Docker dev environment.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-04-08 05:44:00 +07:00
Ho Ngoc Hai
9301f44119 feat(e2e): add Playwright E2E testing infrastructure and critical path tests
Set up Playwright with dual-project config (API + Web), auth test fixtures,
16 E2E tests covering registration, login, profile, token refresh, and
homepage rendering. Added GitHub Actions CI workflow for automated E2E runs.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-04-08 01:41:07 +07:00