Test Inventory

Bilko —Drop Test Inventory

Status: Partially stale — recount required after Kotlin/Ktor migration and Playwright partitioning Version: 2.1 Last Updated:updated: 2026-05-2102-13 Author:Source: ALAIsrc/drop-app/tests/ Documentation Team

This inventory catalogs implemented tests in Bilko, organized by package and file. It currently contains historical Express/Prisma-era details and must not be used as the source of truth for currentTotal test counts.files: For14 current(7 policy,unit, use1 TEST-STRATEGY.md,integration, E2E-TEST-PLAN.md,1 andperformance, DEMO-TESTING-PLAN.md.1 regression, 3 E2E, 1 setup)

SummaryDirectory Structure

tests/
  setup.ts                              # Global setup (sets NODE_ENV=test)
  unit/
    auth.test.ts                        # Password hashing + JWT tokens
    db.test.ts                          # Database schema validation
    feature-flags.test.ts               # Feature flag system
    middleware.test.ts                   # Rate limiting + error responses
    utils.test.ts                       # Utility functions (randomId, maskBankAccount)
    validation.test.ts                  # Input validation functions
    api-routes.test.ts                  # API routes with DB integration
  integration/
    api-endpoints.test.ts               # Full API endpoint integration tests
  performance/
    api-benchmarks.test.ts              # Performance benchmarks
  regression/
    known-bugs.test.ts                  # Regression tests for fixed bugs
  e2e/
    user-flows.spec.ts                  # Basic user journey E2E
    full-flows.spec.ts                  # Complete feature journey E2E
    input-chaos.spec.ts                 # Malicious/edge-case input E2E

---

Unit Tests (Vitest)

tests/unit/auth.test.ts -- 7 tests

RefreshPassword noteHashing (2026-05-21)4 tests):

quick

filesystem
• hashPassword inventoryproduces foundbcrypt apps/api/src/test/kotlinhash (starts with many$2)
Kotlin
• verifyPassword testvalidates files,correct bcrypt password
• packages/core/testsverifyPassword, rejects wrong password
• verifyPassword does NOT accept SHA-256 hashes (security fix C4)

JWT Token Management (3 tests):

• signToken and apps/e2e/verifyToken round-trip works
• verifyToken rejects invalid tokens
• verifyToken rejects tampered tokens

tests/unit/db.test.ts -- 5 tests.

The

• Creates all 11 expected tables (users, transactions, recipients, merchants, cards, bank_accounts, sessions, notifications, settings, exchange_rates, spending_limits)
• Users table belowdoes NOT have balance column (pass-through model verification)
• Cards table does NOT have card_number or cvv columns (PCI-DSS fix verification). Has last_four and token_ref instead.
• Transaction type constraint only allows remittance and qr_payment
• Foreign key constraints are enforced

tests/unit/feature-flags.test.ts -- 6 tests

• isEnabled returns default when no env var is historicalset
until
• isEnabled regeneratedreads NEXT_PUBLIC_FF_* env vars
• featureGate returns 404-like response when disabled
• featureGate returns null when enabled
• getAllFlags returns complete flag set (8 flags)
• topUpViaCard flag does NOT exist (removed feature)

tests/unit/middleware.test.ts -- 7 tests

Rate Limiting (3 tests):

• Allows requests within limit
• Blocks after limit exceeded
• Resets after window expires

jsonError (2 tests):

• Returns correct JSON format ({error, message, details})
• Includes details array when provided

getClientIp (2 tests):

• Extracts from X-Forwarded-For header (first IP)
• Returns 127.0.0.1 when no header present

tests/unit/utils.test.ts -- 5 tests

randomId (3 tests):

• Generates prefixed IDs with correct format (prefix_<hex16>)
• Generates unique IDs on each call
• Uses the currentprovided tree.prefix

maskBankAccount (2 tests):

• Masks correctly, showing only last 4 characters
• Returns short accounts unchanged

tests/unit/validation.test.ts -- 10 tests

Email Validation (2 tests):

• Accepts valid emails (standard, tag, domain variants)
• Rejects invalid emails (empty, no @, space, null)

Phone Validation (2 tests):

• Accepts international format (+47, +381)
• Rejects invalid numbers (no +, too short, letters, null)

Amount Validation (2 tests):

• Accepts valid positive amounts (including 0.01)
• Rejects negative, zero, NaN, and >2 decimal places

IBAN Validation (2 tests):

• Validates correct IBANs (Norwegian, German)
• Rejects invalid IBANs (empty, too short, bad checksum, null)

Name Validation (6 tests, grouped):

• Accepts valid names (Latin, Bosnian chars, apostrophes, hyphens, umlauts)
• Rejects numbers-only input
• Accepts names with numbers mixed in (has letters)
• Rejects empty and null
• Rejects XSS payloads (<script>, onclick=)
• Rejects special-chars-only input

PIN Validation (2 tests):

• Validates 4-digit PINs
• Rejects invalid PINs (too short, too long, letters, null)

tests/unit/api-routes.test.ts -- 8 test groups

1. DB + Auth Integration -- User creation with bcrypt, password verification, hash uniqueness
2. Exchange Rates Seeded -- 6 NOK rates, queryable for API response
3. Rate Limiting -- Allows within limit, blocks after exceeded, resets after window, cleans expired entries
4. User Registration Flow -- Insert, unique constraint, default values, KYC/role constraints
5. Session Tracking -- Create, retrieve, revocation, expiry, index verification
6. End-to-End User Flow -- Register -> login -> session -> revoke
7. Foreign Key Constraints -- Cannot create orphan sessions, cannot delete user with sessions
8. Utility Functions -- randomId format and uniqueness

Integration Tests (Vitest)

tests/integration/api-endpoints.test.ts -- 20+ tests

Tests actual API route handlers with mocked database and auth.

POST /api/auth/register (5 tests):

• Successfully registers with valid input (201, checks DB)
• Returns 422 for missing email
• Returns 422 for short password
• Returns 422 for missing first name
• Returns 409 for duplicate email
• Returns 400 for invalid JSON body

POST /api/auth/login (5 tests):

• Successfully logs in with valid credentials (200)
• Returns 401 for wrong password
• Returns 401 for non-existent user
• Returns 400 for missing email or password
• Returns 400 for invalid JSON body

GET /api/rates (2 tests):

• Returns all exchange rates (6 currencies)
• Returns empty rates when none seeded

GET /api/rates/[currency] (3 tests):

• Returns rate for valid currency
• Returns 404 for unsupported currency
• Handles case-insensitive codes

POST /api/transactions/remittance (7 tests):

• Successfully creates remittance (201, verifies balance deduction)
• Returns 401 when not authenticated
• Returns 403 when KYC not approved
• Returns 404 when recipient not found
• Returns 402 when insufficient balance
• Returns 400 for amount below/above limits
• Returns 400 for invalid amount (NaN)

POST /api/transactions/qr-payment (8 tests):

• Successfully creates QR payment (201, verifies balance, fee calc)
• Returns 401 when not authenticated
• Returns 404 when merchant not found
• Returns 402 when insufficient balance
• Returns 400 for amount below/above limits
• Returns 400 for missing merchantId
• Returns 400 for invalid JSON body

Performance Tests (Vitest)

tests/performance/api-benchmarks.test.ts -- 8 tests

Test Category Breakdown

packages/core/tests/ — UnitRegression Tests

Pure unit tests for the @bilko/core financial engine. No database, no HTTP. Uses globals: true (no explicit imports of describe/it/expect).

accounting.tests/regression/known-bugs.test.ts —-- 204 testsbug groups

TestsBUG-001: double-entry bookkeeping engine: validateDoubleEntry, createJournalEntry, calculateTrialBalance.

cd apps/api
docker-compose -f ../../docker-compose.test.yml up -d
npm run test:integration

# All tests (from project root — mock + unit + E2E suites)
npm run test

# Core unit tests only
cd packages/core && npx vitest run

# API mock suite only (no DB required)
cd apps/api-express && npx vitest run

# API unit suite only
cd apps/api-express && npx vitest run tests/unit/

# API E2E suite only (mocked services, no DB)
cd apps/api-express && npx vitest run tests/e2e/

# Real DB integration tests (requires docker-compose.test.yml)
docker-compose -f docker-compose.test.yml up -d
cd apps/api-express && npm run test:integration

# Watch mode (re-run on change)
cd packages/core && npx vitest
cd apps/api-express && npx vitest

# Specific file
cd apps/api-express && npx vitest run tests/auth.test.ts
cd apps/api-express && npx vitest run tests/unit/two-factor.test.ts

# With coverage
cd packages/core && npx vitest run --coverage

# Verbose output
npx vitest run --reporter=verbose