Testing

Testing

Suite	What it covers	Result
PHPUnit (php artisan test)	Cart and checkout (stock locking, idempotency, throttles), auth, bans, personalisation and offers, assistant, A/B, admin gating, prescriptions, security (SQLi, XSS, CSP, CSRF, rate limits), SEO, TOTP against RFC 6238 vectors, roles, e-mailed codes, payments and webhooks, drug interactions, refills, ClamAV	145 passed (973 assertions)
Playwright (npx playwright test)	Every page on desktop and mobile, fly-to-bag, wishlist ↔ bag, guest checkout, body map, assistant, Urdu RTL, A/B, prefetch, admin with two-step sign-in, interaction warnings, sandbox card payment	56 passed
Lighthouse 13	Home, shop, product, body map, FAQ, contact, policies, login, register, prescription, about	Accessibility 100 · Best Practices 100 · SEO 100
Load (node tests/load/run.mjs capacity)	Shop and product pages ~32 req/s; FAQ ~55 req/s; static images ~830 req/s on one XAMPP box	No errors
Responsive sweep	Every page at 320–1920 px (259 combinations)	No sideways scroll
SSR hydration	15 storefront pages, desktop and phone	No hydration errors
Abuse (node tests/load/run.mjs abuse)	25 connections flooding /shop for 20 s	429 after the budget, no 5xx

Running them

php artisan test

# end-to-end: start a test server, then run Playwright
RECAPTCHA_ENABLED=false RATE_LIMIT_ALLOWLIST=127.0.0.1 APP_URL=http://127.0.0.1:8123 php artisan serve --port=8123
npx playwright test

# load and abuse
RATE_LIMIT_ALLOWLIST=127.0.0.1 node tests/load/run.mjs capacity http://localhost/zovita
node tests/load/run.mjs abuse http://localhost/zovita

Writing tests

Feature tests live in tests/Feature. Anything touching checkout, auth, uploads or reCAPTCHA should come with a test. Use Mail::fake(), Storage::fake() and Http::fake() so tests never hit real services.

CI (GitHub Actions) runs on every push to main.