cqt-agent/expansion-packs/hubtel-workflow/tasks/auto-e2e-generator.md

CQT Agent

# Auto E2E Test Generator

This task automatically generates comprehensive end-to-end tests by analyzing project structure and inferring user workflows without requiring manual user story input.

## Objective
Generate complete E2E test suites that cover all discoverable user journeys and API workflows in both frontend and backend components.

## Prerequisites
- Project must have a clear structure with identifiable routes/components
- Testing framework must be configured (Vitest, Playwright, Karate, NUnit)
- Access to project source code and configuration files

## Process

### Step 1: Project Structure Analysis
Use the `project-workflow-analyzer.md` utility to:
- Scan frontend routes and components
- Identify API endpoints and controllers
- Map database models and relationships
- Discover authentication and authorization flows
- Analyze navigation patterns and user flows

### Step 2: User Story Extraction
Use the `user-story-extractor.md` utility to:
- Infer user workflows from component interactions
- Extract CRUD operations from API endpoints
- Identify form submission flows
- Map authentication journeys
- Discover data retrieval and display patterns

### Step 3: Comprehensive Test Suite Generation
Based on the analyzed workflows, generate exhaustive test coverage:

#### Frontend E2E Tests (Playwright)
**Authentication Flows - Complete Coverage**:
- **Login Scenarios**: Valid credentials, invalid email, wrong password, empty fields, SQL injection attempts, XSS attempts, password with special characters, case sensitivity, whitespace handling, session timeout, concurrent logins, account lockout after failed attempts, remember me functionality, auto-logout on inactivity
- **Registration Scenarios**: Valid registration, duplicate email, weak passwords, password confirmation mismatch, invalid email formats, special characters in names, long field inputs, required field validation, terms acceptance, email verification flow, expired verification links, already verified accounts
- **Password Reset Scenarios**: Valid email reset, invalid email, expired tokens, used tokens, password complexity validation, confirmation mismatch, account lockout during reset, multiple reset requests
- **Logout Scenarios**: Normal logout, forced logout, session expiration, logout with unsaved changes, logout from multiple tabs

**Navigation Tests - All Paths**:
- **Menu Navigation**: All menu items, nested menus, dropdown interactions, mobile menu toggle, keyboard navigation, accessibility compliance, breadcrumb accuracy, back button functionality, deep linking, URL parameter handling
- **Route Protection**: Authenticated routes, role-based access, permission checks, redirect flows, unauthorized access attempts, expired session handling
- **Error Page Navigation**: 404 handling, 403 forbidden, 500 server errors, network failures, malformed URLs

**Form Interactions - Every Field**:
- **Input Validation**: Required fields, field formats (email, phone, date), character limits, special characters, unicode support, SQL injection prevention, XSS protection, file type validation, file size limits
- **Form Submission**: Valid submissions, server errors, network timeouts, duplicate submissions, partial data loss, auto-save functionality, form state persistence, concurrent editing
- **Dynamic Forms**: Conditional fields, field dependencies, cascading dropdowns, real-time validation, multi-step forms, progress indicators

**Data Display - All Views**:
- **List Views**: Pagination, sorting, filtering, search, empty states, loading states, error states, infinite scroll, bulk operations, row selection, column resizing
- **Detail Views**: Data accuracy, related data loading, edit modes, permission-based field visibility, data refresh, optimistic updates
- **Charts/Graphs**: Data accuracy, responsive design, interactive elements, export functionality, real-time updates

#### Backend E2E Tests (Karate)
**API Workflows - Complete CRUD Coverage**:
- **Create Operations**: Valid data creation, validation errors, duplicate handling, required fields, data type validation, business rule validation, concurrent creation, batch operations, transaction rollback
- **Read Operations**: Single record retrieval, list operations, pagination, filtering, sorting, search, data access permissions, soft-deleted records, related data loading, caching behavior
- **Update Operations**: Valid updates, partial updates, optimistic locking, concurrent updates, validation errors, permission checks, audit trail, cascade updates, version control
- **Delete Operations**: Soft delete, hard delete, cascade delete, dependency checks, permission validation, audit logging, bulk delete, transaction integrity

**Authentication & Authorization**:
- **Token Management**: Token generation, validation, expiration, refresh, revocation, multiple device support, role-based tokens, permission inheritance
- **Session Management**: Session creation, validation, expiration, cleanup, concurrent sessions, session hijacking prevention
- **Access Control**: Role-based access, resource-level permissions, dynamic permissions, permission inheritance, temporary access grants

**Data Integrity & Validation**:
- **Input Validation**: Data type validation, format validation, business rule validation, cross-field validation, conditional validation, custom validators
- **Database Constraints**: Foreign key integrity, unique constraints, check constraints, data consistency, transaction boundaries
- **Concurrency Control**: Optimistic locking, pessimistic locking, deadlock handling, transaction isolation, race condition prevention

#### Cross-Stack Integration Tests - End-to-End Journeys
**Complete User Workflows**:
- **User Onboarding Journey**: Registration → Email verification → Profile completion → First login → Dashboard tour → First action completion
- **E-commerce Flow**: Browse products → Add to cart → Apply coupons → Checkout → Payment → Order confirmation → Status tracking → Delivery confirmation
- **Document Management**: Upload → Metadata entry → Approval workflow → Publication → Access control → Version management → Archival
- **Support Ticket Flow**: Issue creation → Assignment → Status updates → Communication → Resolution → Feedback → Closure

**Error Recovery Scenarios**:
- **Network Failures**: Connection timeouts, intermittent connectivity, offline/online transitions, retry mechanisms, graceful degradation
- **Server Failures**: Service unavailability, database failures, third-party service failures, cascading failures, recovery procedures
- **Data Corruption**: Invalid data states, partial updates, rollback scenarios, data repair, consistency checks

**Performance & Load Testing**:
- **Concurrent Users**: Multiple users performing same actions, resource contention, deadlock scenarios, performance degradation
- **Data Volume**: Large datasets, bulk operations, pagination performance, search performance, memory usage
- **Response Time**: API response times, page load times, database query performance, caching effectiveness

**Security Testing**:
- **Input Security**: SQL injection, XSS attacks, CSRF protection, input sanitization, file upload security
- **Authentication Security**: Brute force protection, session fixation, token security, password policies
- **Authorization Security**: Privilege escalation, access control bypass, data leakage, unauthorized operations

**Accessibility Testing**:
- **WCAG AA Compliance**: Screen reader compatibility, keyboard navigation, color contrast, focus management, alt text, form labels
- **Responsive Design**: Mobile compatibility, tablet views, desktop views, orientation changes, zoom levels
- **Internationalization**: Multiple languages, RTL support, character encoding, date/time formats, currency formats

### Step 4: Test Organization
Structure generated tests with:
- Clear test descriptions and scenarios
- Proper setup and teardown procedures
- Mock data and fixtures
- Environment-specific configurations
- Parallel execution support

### Step 5: Automatic Test Execution & Validation
After generating tests, automatically execute them to ensure they work correctly:

#### Test Execution Pipeline
1. **Syntax Validation**: Verify generated test files have correct syntax
2. **Dependency Check**: Ensure all required test frameworks and dependencies are available
3. **Test Execution**: Run generated tests in controlled environment
4. **Results Analysis**: Analyze test outcomes and identify failures
5. **Actionable Reporting**: Provide clear feedback and remediation steps

#### Execution Process
```bash
# 1. Validate test file syntax
npm run test:validate-syntax
npx playwright test --dry-run
karate.jar --dry-run

# 2. Check test dependencies
npm audit
npx playwright install
java -cp karate.jar com.intuit.karate.Main --version

# 3. Execute tests with detailed reporting
npm run test:unit -- --reporter=json --outputFile=results/unit-results.json
npx playwright test --reporter=json --outputFile=results/e2e-results.json
java -jar karate.jar --output results/api-results.json

# 4. Generate consolidated test report
npm run test:generate-report
```

#### Test Validation Criteria
- **Unit Tests**: Must have >85% code coverage, all tests pass
- **Integration Tests**: All API endpoints respond correctly, database operations work
- **E2E Tests**: All user journeys complete successfully, UI elements function properly
- **Performance Tests**: Response times within acceptable limits, no memory leaks
- **Security Tests**: No vulnerabilities detected, input sanitization working

### Step 6: Failure Analysis & Remediation
Use the `test-failure-analyzer.md` utility to:
- Categorize test failures (syntax, environment, logic, data, timing)
- Provide specific remediation steps for each failure type
- Generate actionable recommendations for the user
- Create repair scripts when possible

### Step 7: Coverage Validation
Ensure generated tests cover:
- All major user workflows
- Critical business processes
- Edge cases and error conditions
- Accessibility requirements (WCAG AA)
- Performance benchmarks

## Implementation Guidelines

### Frontend Test Generation (Playwright)
```typescript
// Auto-generated based on route analysis
describe('User Authentication Flow', () => {
  test('complete user registration and login journey', async ({ page }) => {
    // Registration
    await page.goto('/register');
    await page.fill('[data-testid=email]', 'test@hubtel.com');
    await page.fill('[data-testid=password]', 'SecurePass123!');
    await page.click('[data-testid=register-btn]');
    
    // Email verification (if applicable)
    // Login
    await page.goto('/login');
    await page.fill('[data-testid=email]', 'test@hubtel.com');
    await page.fill('[data-testid=password]', 'SecurePass123!');
    await page.click('[data-testid=login-btn]');
    
    // Verify successful login
    await expect(page.locator('[data-testid=dashboard]')).toBeVisible();
  });
});
```

### Backend Test Generation (Karate)
```gherkin
# Auto-generated based on API endpoint analysis
Feature: User Management API Workflow

Background:
  * url baseUrl
  * def adminToken = call read('classpath:auth/get-admin-token.js')

Scenario: Complete user lifecycle workflow
  # Create user
  Given path 'api/users'
  And header Authorization = 'Bearer ' + adminToken
  And request { email: 'test@hubtel.com', name: 'Test User', role: 'user' }
  When method POST
  Then status 201
  And def userId = response.id
  
  # Get user details
  Given path 'api/users', userId
  When method GET
  Then status 200
  And match response.email == 'test@hubtel.com'
  
  # Update user
  Given path 'api/users', userId
  And request { name: 'Updated Test User' }
  When method PUT
  Then status 200
  
  # Delete user
  Given path 'api/users', userId
  When method DELETE
  Then status 204
```

## Output Structure
Generate tests in organized directories:
```
tests/
├── e2e/
│   ├── frontend/
│   │   ├── auth/
│   │   ├── dashboard/
│   │   ├── forms/
│   │   └── navigation/
│   ├── backend/
│   │   ├── api/
│   │   ├── auth/
│   │   └── integration/
│   └── cross-stack/
│       ├── user-journeys/
│       └── business-workflows/
```

## Quality Assurance
Each generated test must:
- Have clear, descriptive names
- Include proper assertions and validations
- Handle async operations correctly
- Clean up test data appropriately
- Be maintainable and readable
- Follow project coding standards

## Success Criteria
- All major user workflows have corresponding E2E tests
- Tests cover both happy path and error scenarios
- Generated tests pass consistently
- Test coverage meets or exceeds 85% for critical paths
- Tests can be executed in CI/CD pipeline
- Documentation is generated for test maintenance

## Dependencies
- `project-workflow-analyzer.md` - For analyzing project structure
- `user-story-extractor.md` - For inferring user workflows
- `test-framework-detector.md` - For identifying testing setup
- Template files for generating test code
- Access to project source code and documentation