QARoom/testing

A small app, and the testing behind it.

QARoom is a little social platform: communities, posts, up and down votes, donations, outbound notifications, and an AI that helps moderate. It exists for one reason: to show how the well-known kinds of software testing fit together, with each kind defending a real part of the app.

First the whole picture, then each kind in plain terms with one real example.

The whole toolkit, at a glance

Every technique in the repo, grouped by the seven kinds below, standing on a foundation that runs underneath every test.

Unit
Vitestfast-check
Integration
PGliteMicrockstenant interleave
End-to-end
Playwrightgolden-journeysmokeStorybook + axe
Contract
PactoasdiffSchemathesisAsyncAPI diff
Load
k6 vs SLOs
Security
EvoMaster fuzzSSRF + HMACrate limiting
AI
DeepEvalDeepTeamPyRITmetamorphic
Underneath every test
static analysisdeterminism (injected clock & ids)model-based (XState · LangGraph)mutation (Stryker)chaos (Chaos Mesh · Litmus)trace assertions (OpenTelemetry · Tracetest)

Seven kinds of testing · one real example each

does one small piece work on its own?

Unit tests

Check a single piece of logic in isolation, with nothing else around it. In QARoom: tallying the up and down votes on a post and getting the score right every time.

votesVitest
do two parts work together?

Integration tests

Check that two pieces actually connect and agree. In QARoom: donations charging an outside payment provider, tested against a stand-in fake of that provider so the real money path is exercised safely.

donationsmock providerreal Postgres
does a whole user journey work?

End-to-end tests

Drive the real running app the way a person would, from start to finish. In QARoom: sign up, join a community, and create a post, all the way through the live system.

sign-up → postPlaywright
do the APIs keep their promises?

Contract tests

Pin down the agreement between two services so one can't quietly break the other. In QARoom: the login tokens that identity issues stay in the exact shape every other service expects.

identityPact
does it stay fast when lots of people use it?

Load tests

Send heavy, realistic traffic and watch the response times hold. In QARoom: the community feed under a crowd, measured against a target it must not cross.

feedk6
can someone abuse it?

Security tests

Try to misuse it on purpose, before anyone else does. In QARoom: outbound webhooks are signed so they can't be forged, and blocked from being tricked into calling internal addresses.

webhookssigning + SSRF guard
does the AI behave?

AI tests

Probe the AI the way only an AI needs probing. In QARoom: the moderation agent flags rule-breaking posts, cites the rule it used, and isn't fooled when the same content is simply reworded.

moderationDeepEvalred-team

See it for yourself

Bring the whole system up locally, every service, the NATS message bus, and the Grafana, Jaeger, and Prometheus dashboards, on a small Kubernetes cluster with one command:

# Docker must be running
pnpm dev        # k3d + Tilt: the full architecture
pnpm dev:down   # tear it all back down

Resource warningThis starts a ~15-pod cluster with its own observability stack, so it is resource-heavy: give Docker at least 8 GB of RAM and 4 CPUs, or not everything will come up. Just want the tests? pnpm install && pnpm test runs the whole suite in seconds, with no Docker at all.

What comes up