calendar-plugin/tests/remote_coverage_review.md

Remote Coverage Review (2026-03-31, Updated)

Scope

Review current API and E2E test definitions for remote-server-first validation and identify additional high-value coverage.

Current Coverage Strengths

• Event CRUD and recurrence exception behavior are covered.
• User lifecycle (register, verify, approve, reset) is covered.
• ICS and CalDAV interoperability paths are covered.
• Security smoke items include token leakage, rate limit, password hashing, and CalDAV resource handling.

Coverage Gaps Identified

API Gaps

• Unauthorized write-path checks were under-specified for event create/update paths.
• Validation-path checks were missing for:
  • invalid event time range (end < start)
  • invalid preview-occurrences payloads
• Single-use token behavior needed an explicit regression check for password reset token reuse.
• Monthly ordinal recurrence parity needed executable checks (last weekday-of-month behavior).
• Slug-path link contract in rendered shortcode output needed explicit assertions.
• Post-removal auth revocation for plugin users needed explicit checks.

E2E Gaps

• UI shell control presence checks were incomplete (verify/reset/future/theme/occurrence-delete controls).
• User lifecycle e2e missed explicit “remove user -> auth denied” verification.
• Event deletion e2e missed explicit not-found checks for deleted records.

New Coverage Added (This Update)

Executable Coverage

• compatibility-layer/e2e_wp_emulation.php now includes:
  • unauthenticated event create denied (403)
  • invalid event range returns 422
  • preview-occurrences valid + invalid-path checks
  • password reset token single-use check (422 on reuse)
  • remove-user revokes login access
  • monthly ordinal recurrence date assertions
  • shortcode link assertions for url_slug pathing
• compatibility-layer/ui_e2e_wp_emulation.php now includes:
  • UI shell control presence checks (verify/reset/future/theme/occurrence delete)
  • deleted-event not-found check
  • remove-user auth denial via /users/me

Test Spec Updates

• tests/api_test_cases.md expanded with API-EVT/API-USR/API-ICS additions for the above gaps.
• tests/e2e_test_cases.md expanded with E2E-ADM-008, E2E-UI-003, E2E-CDV-005, E2E-ICS-004.
• tests/ui_e2e_cases.md updated to reflect new automated UI cases.

Remaining High-Value Gaps

• Diagnostics admin-page/download flow still needs a dedicated authenticated admin-browser or WP-cookie harness test.
• Remote runner still does not exercise nonce-protected diagnostics download end-to-end.