Test Strategy Document
Parent Document: TEST_PLAN.mdVersion: 1.2 | Date: January 5, 2026
2. Assumptions, Constraints & Risks
2.1 Assumptions
Environmental Assumptions
- Users access via modern browsers (Chrome 90+, Firefox 88+, Safari 14+, Edge 90+)
- Minimum 1 Mbps internet connectivity
- Desktop/laptop with minimum 1366x768 resolution
- Supabase platform maintains 99.9% uptime SLA
Data Assumptions
- CSV files conform to DustRanger format (timestamp, device_id, PM2.5, PM10, TSP, etc.)
- UTF-8 encoding with optional BOM
- Individual files do not exceed 50MB
- Concurrent users during peak: ≤50 users
Testing Assumptions
- QA team has access to Supabase project dashboard
- Test environments mirror production configuration
- Automated tests run in CI/CD on every pull request
2.2 Constraints
Technical Constraints
| Constraint | Impact | Mitigation |
|---|---|---|
| Supabase connection pool (60 max) | Load testing limits | Respect connection limits |
| Google Gemini API (60 req/min) | AI testing frequency | Implement rate limiting |
| Browser memory for PDF generation | Large reports may fail | Optimize rendering |
Resource Constraints
- Development team: 2-3 developers
- QA team: 1-2 engineers
- CI/CD runner minutes: 2,000/month (GitHub Actions free tier)
2.3 Risk Matrix
| Risk ID | Risk | Likelihood | Impact | Mitigation |
|---|---|---|---|---|
| R-001 | Supabase Platform Outage | Low | High | Local Supabase for dev testing |
| R-002 | Test Environment Instability | Medium | High | Infrastructure-as-code |
| R-003 | External API Unavailability | Medium | Medium | Mock API responses |
| R-004 | Performance Degradation | Medium | Medium | Baseline metrics, profiling |
| R-005 | Insufficient Test Coverage | High | Medium | Risk-based prioritization |
| R-006 | Security Vulnerability Discovery | Low | Critical | Early security testing |
3. Testing Approach & Strategy
3.1 Test Pyramid
▲
╱ ╲ Manual/Exploratory/UAT
╱ ╲ [10% of effort]
╱─────╲ ─────────────────────
╱ ╲ E2E Tests (Playwright)
╱─────────╲ [20% of effort]
╱ ╲ ─────────────────────
╱─────────────╲ Integration Tests
╱ ╲ [30% of effort]
╱─────────────────╲ ─────────────────────
╱ ╲ Unit Tests (Vitest)
─────────────────────── [40% of effort]3.2 Test Levels
| Level | Coverage Target | Tools | Frequency |
|---|---|---|---|
| Unit Tests | 85%+ utilities, services | Vitest, RTL | Every commit |
| Integration Tests | 70%+ API interactions | Vitest, Supabase local | Every PR |
| E2E Tests | 75%+ critical journeys | Playwright | Every PR + nightly |
| Performance Tests | Key metrics | Lighthouse CI | Weekly |
| Security Tests | Dependency scanning | npm audit, Snyk | Daily |
3.3 Testing Principles
- Shift-Left Testing: Quality begins during development
- Risk-Based Testing: Prioritize by criticality and complexity
- Continuous Testing: Automated tests in CI/CD pipeline
- Collaborative Testing: Developers, QA, and stakeholders collaborate
3.4 Unit Testing
Scope: Individual functions, React components, utility modules
Example Test Areas:
- CSV parsing logic (
csvParser.ts) - Date formatting utilities (
lib/utils.ts) - Report data aggregation (
reportDataService.ts) - Device timeline segment calculation
- Data gap detection algorithm (threshold: >1 hour)
Coverage Targets:
- Services/utilities: ≥85% line coverage
- React components: ≥70% line coverage
- Business logic: ≥90% line coverage
3.5 Integration Testing
Scope: Component interactions, API integrations, database operations
Example Test Areas:
- Scraper data synchronization
- RLS policy enforcement
- Report generation with aggregated data
- Device timeline chart with data gaps
- Authentication flow
3.6 E2E Testing
Scope: Complete user workflows through browser interactions
Example Scenarios:
- User registration → login → dashboard access
- Data visualization → filtering → export
- Report generation → download → PDF verification
- Multi-site management → device assignment
Browsers: Chrome (primary), Firefox, Webkit
3.7 Performance Testing
Targets:
| Metric | Target |
|---|---|
| Dashboard LCP | <2.5s |
| API Response (Read) | <500ms (p95) |
| PDF Generation | <60s (up to 30 pages) |
| Concurrent Users | 50 without degradation |
3.8 Security Testing
OWASP Top 10 Coverage:
- SQL Injection: Parameterized queries
- Broken Authentication: JWT validation
- Sensitive Data Exposure: RLS enforcement
- XSS: React built-in escaping
- Known Vulnerabilities: npm audit
3.9 Readiness Reviews
| Review | Purpose | Prerequisites |
|---|---|---|
| VRR (Validation Readiness) | Ready for validation testing | Unit coverage met, no P0/P1 defects |
| IRR (Implementation Readiness) | Ready for staging | Validation complete, security tested |
| ORR (Operational Readiness) | Ready for production | UAT signed off, rollback tested |
Related Documents:
- TEST_PLAN.md - Main test plan
- TEST_CASES.md - Detailed test cases
- TEST_SCOPE.md - Feature testing scope