Testing and Quality¶
Signals¶
Backend tests are configured with pytest/pytest-asyncio and can use testcontainers for a temporary pgvector Postgres. The README says migrations and seed data run during the suite. Frontend exposes build, lint, format, and typecheck scripts. tests/e2e/smoke.sh provides a lightweight end-to-end check.
Coverage strengths¶
- Async backend service and database behavior can be exercised against a realistic database.
- RAG chunking and role filtering are testable without the full UI.
- Frontend typecheck/build catches integration regressions.
Gaps¶
Runbooks do not prove deployed Cloud Run, Firebase auth, GCS IAM, SSE disconnect, or browser upload behavior. Add contract tests for provider adapters, security tests for cross-role access, and deployment smoke tests against a disposable GCP project.
Recommended test matrix¶
| Layer | Example cases |
|---|---|
| Unit | Chunk overlap, role allowlists, SLA calculation, assignment tie-breaks |
| Service | Chat state transitions, malformed LLM payloads, source parsing |
| Database | Migrations, unique IDs, status transitions, pgvector query filters |
| API | Authenticated/unauthenticated routes, ownership, SSE error events |
| Frontend | Role navigation, stream cancellation, upload failures, stale queries |
| E2E | Citizen submission → officer assignment → ATR → citizen tracking |
| Infrastructure | Terraform plan, secret references, Cloud Run health, job retries |
The most important acceptance test is a cross-role RAG test: ingest one document for each access role, query as every role, and assert that restricted source names and text never appear in results or prompts.