53 lines
2.5 KiB
Markdown
53 lines
2.5 KiB
Markdown
# Remote Coverage Review (2026-03-31, Updated)
|
|
|
|
## Scope
|
|
Review current API and E2E test definitions for remote-server-first validation and identify additional high-value coverage.
|
|
|
|
## Current Coverage Strengths
|
|
- Event CRUD and recurrence exception behavior are covered.
|
|
- User lifecycle (register, verify, approve, reset) is covered.
|
|
- ICS and CalDAV interoperability paths are covered.
|
|
- Security smoke items include token leakage, rate limit, password hashing, and CalDAV resource handling.
|
|
|
|
## Coverage Gaps Identified
|
|
|
|
### API Gaps
|
|
- Unauthorized write-path checks were under-specified for event create/update paths.
|
|
- Validation-path checks were missing for:
|
|
- invalid event time range (`end < start`)
|
|
- invalid `preview-occurrences` payloads
|
|
- Single-use token behavior needed an explicit regression check for password reset token reuse.
|
|
- Monthly ordinal recurrence parity needed executable checks (last weekday-of-month behavior).
|
|
- Slug-path link contract in rendered shortcode output needed explicit assertions.
|
|
- Post-removal auth revocation for plugin users needed explicit checks.
|
|
|
|
### E2E Gaps
|
|
- UI shell control presence checks were incomplete (verify/reset/future/theme/occurrence-delete controls).
|
|
- User lifecycle e2e missed explicit “remove user -> auth denied” verification.
|
|
- Event deletion e2e missed explicit not-found checks for deleted records.
|
|
|
|
## New Coverage Added (This Update)
|
|
|
|
### Executable Coverage
|
|
- `compatibility-layer/e2e_wp_emulation.php` now includes:
|
|
- unauthenticated event create denied (`403`)
|
|
- invalid event range returns `422`
|
|
- preview-occurrences valid + invalid-path checks
|
|
- password reset token single-use check (`422` on reuse)
|
|
- remove-user revokes login access
|
|
- monthly ordinal recurrence date assertions
|
|
- shortcode link assertions for `url_slug` pathing
|
|
- `compatibility-layer/ui_e2e_wp_emulation.php` now includes:
|
|
- UI shell control presence checks (verify/reset/future/theme/occurrence delete)
|
|
- deleted-event not-found check
|
|
- remove-user auth denial via `/users/me`
|
|
|
|
### Test Spec Updates
|
|
- `tests/api_test_cases.md` expanded with API-EVT/API-USR/API-ICS additions for the above gaps.
|
|
- `tests/e2e_test_cases.md` expanded with E2E-ADM-008, E2E-UI-003, E2E-CDV-005, E2E-ICS-004.
|
|
- `tests/ui_e2e_cases.md` updated to reflect new automated UI cases.
|
|
|
|
## Remaining High-Value Gaps
|
|
- Diagnostics admin-page/download flow still needs a dedicated authenticated admin-browser or WP-cookie harness test.
|
|
- Remote runner still does not exercise nonce-protected diagnostics download end-to-end.
|