Coverage Gap Test Specifications¶

// tests/api/analytics.test.ts
describe('Analytics API Route', () => {
  describe('GET /api/analytics', () => {
    test('should return analytics data for authenticated user', async () => {
      // Arrange
      const mockUser = { id: 'user-123', role: 'admin' };
      const mockAnalytics = {
        totalJobs: 150,
        completedJobs: 120,
        totalCost: 45.67,
        averageCostPerJob: 0.38
      };

      // Act
      const response = await fetch('/api/analytics', {
        headers: { 'Authorization': 'Bearer valid-token' }
      });

      // Assert
      expect(response.status).toBe(200);
      expect(await response.json()).toEqual(mockAnalytics);
    });

    test('should return 401 for unauthenticated requests', async () => {
      const response = await fetch('/api/analytics');
      expect(response.status).toBe(401);
    });

    test('should filter analytics by date range', async () => {
      const response = await fetch('/api/analytics?from=2024-01-01&to=2024-12-31', {
        headers: { 'Authorization': 'Bearer valid-token' }
      });

      expect(response.status).toBe(200);
      const data = await response.json();
      expect(data.dateRange).toEqual({
        from: '2024-01-01',
        to: '2024-12-31'
      });
    });

    test('should handle database errors gracefully', async () => {
      // Mock database failure
      jest.spyOn(db, 'query').mockRejectedValue(new Error('Connection failed'));

      const response = await fetch('/api/analytics', {
        headers: { 'Authorization': 'Bearer valid-token' }
      });

      expect(response.status).toBe(500);
      expect(await response.json()).toEqual({
        error: 'Failed to fetch analytics data'
      });
    });
  });

  describe('POST /api/analytics/export', () => {
    test('should export analytics data as CSV', async () => {
      const response = await fetch('/api/analytics/export', {
        method: 'POST',
        headers: { 
          'Authorization': 'Bearer valid-token',
          'Content-Type': 'application/json'
        },
        body: JSON.stringify({ format: 'csv' })
      });

      expect(response.status).toBe(200);
      expect(response.headers.get('content-type')).toBe('text/csv');
    });
  });
});

// tests/api/billing.test.ts
describe('Billing API Routes', () => {
  describe('GET /api/billing/portal', () => {
    test('should create Stripe billing portal session', async () => {
      const mockSession = {
        url: 'https://billing.stripe.com/session/xxx'
      };

      const response = await fetch('/api/billing/portal', {
        headers: { 'Authorization': 'Bearer valid-token' }
      });

      expect(response.status).toBe(200);
      expect(await response.json()).toEqual(mockSession);
    });

    test('should require active subscription', async () => {
      // Mock user without subscription
      const response = await fetch('/api/billing/portal', {
        headers: { 'Authorization': 'Bearer valid-token-no-sub' }
      });

      expect(response.status).toBe(403);
      expect(await response.json()).toEqual({
        error: 'Active subscription required'
      });
    });
  });

  describe('POST /api/billing/subscription', () => {
    test('should create new subscription', async () => {
      const response = await fetch('/api/billing/subscription', {
        method: 'POST',
        headers: { 
          'Authorization': 'Bearer valid-token',
          'Content-Type': 'application/json'
        },
        body: JSON.stringify({
          priceId: 'price_123',
          paymentMethodId: 'pm_456'
        })
      });

      expect(response.status).toBe(201);
      const subscription = await response.json();
      expect(subscription.status).toBe('active');
    });

    test('should handle payment failures', async () => {
      const response = await fetch('/api/billing/subscription', {
        method: 'POST',
        headers: { 
          'Authorization': 'Bearer valid-token',
          'Content-Type': 'application/json'
        },
        body: JSON.stringify({
          priceId: 'price_123',
          paymentMethodId: 'pm_invalid'
        })
      });

      expect(response.status).toBe(402);
      expect(await response.json()).toEqual({
        error: 'Payment failed',
        requiresAction: true
      });
    });
  });

  describe('GET /api/billing/usage', () => {
    test('should return current billing period usage', async () => {
      const response = await fetch('/api/billing/usage', {
        headers: { 'Authorization': 'Bearer valid-token' }
      });

      expect(response.status).toBe(200);
      const usage = await response.json();
      expect(usage).toHaveProperty('currentPeriod');
      expect(usage).toHaveProperty('tokensUsed');
      expect(usage).toHaveProperty('costToDate');
      expect(usage).toHaveProperty('limit');
    });

    test('should calculate overage charges', async () => {
      // Mock user exceeding limits
      const response = await fetch('/api/billing/usage', {
        headers: { 'Authorization': 'Bearer over-limit-token' }
      });

      const usage = await response.json();
      expect(usage.overageCharges).toBeGreaterThan(0);
    });
  });
});

// tests/api/content-generate.test.ts
describe('Content Generation API', () => {
  describe('POST /api/content/generate', () => {
    test('should generate content with valid request', async () => {
      const request = {
        type: 'blog',
        topic: 'AI in Healthcare',
        keywords: ['AI', 'healthcare', 'technology'],
        length: 'medium'
      };

      const response = await fetch('/api/content/generate', {
        method: 'POST',
        headers: { 
          'Authorization': 'Bearer valid-token',
          'Content-Type': 'application/json'
        },
        body: JSON.stringify(request)
      });

      expect(response.status).toBe(202);
      const job = await response.json();
      expect(job.id).toBeDefined();
      expect(job.status).toBe('queued');
    });

    test('should validate request parameters', async () => {
      const invalidRequest = {
        type: 'invalid-type',
        topic: '', // Empty topic
      };

      const response = await fetch('/api/content/generate', {
        method: 'POST',
        headers: { 
          'Authorization': 'Bearer valid-token',
          'Content-Type': 'application/json'
        },
        body: JSON.stringify(invalidRequest)
      });

      expect(response.status).toBe(400);
      const error = await response.json();
      expect(error.errors).toContain('Invalid content type');
      expect(error.errors).toContain('Topic is required');
    });

    test('should enforce rate limits', async () => {
      // Make multiple requests quickly
      const promises = Array(10).fill(null).map(() => 
        fetch('/api/content/generate', {
          method: 'POST',
          headers: { 
            'Authorization': 'Bearer valid-token',
            'Content-Type': 'application/json'
          },
          body: JSON.stringify({ type: 'blog', topic: 'Test' })
        })
      );

      const responses = await Promise.all(promises);
      const rateLimited = responses.filter(r => r.status === 429);
      expect(rateLimited.length).toBeGreaterThan(0);
    });

    test('should check user quota', async () => {
      const response = await fetch('/api/content/generate', {
        method: 'POST',
        headers: { 
          'Authorization': 'Bearer quota-exceeded-token',
          'Content-Type': 'application/json'
        },
        body: JSON.stringify({ type: 'blog', topic: 'Test' })
      });

      expect(response.status).toBe(403);
      expect(await response.json()).toEqual({
        error: 'Monthly quota exceeded',
        quotaResetDate: expect.any(String)
      });
    });
  });
});

# tests/test_auth.py
import pytest
from unittest.mock import Mock, patch
from datetime import datetime, timedelta
import jwt
from apps.cpm.auth import (
    authenticate_user,
    create_access_token,
    verify_token,
    check_permissions,
    refresh_token,
    revoke_token
)

class TestAuthentication:

    @pytest.mark.asyncio
    async def test_authenticate_user_valid_credentials(self):
        """Test successful authentication with valid credentials."""
        # Arrange
        username = "test@example.com"
        password = "SecurePassword123!"
        mock_user = {
            "id": "user-123",
            "email": username,
            "password_hash": "$2b$12$..." # bcrypt hash
        }

        with patch('apps.cpm.auth.get_user_by_email') as mock_get_user:
            mock_get_user.return_value = mock_user

            # Act
            result = await authenticate_user(username, password)

            # Assert
            assert result["success"] is True
            assert result["user_id"] == "user-123"
            assert "access_token" in result
            assert "refresh_token" in result

    @pytest.mark.asyncio
    async def test_authenticate_user_invalid_password(self):
        """Test authentication failure with invalid password."""
        # Arrange
        username = "test@example.com"
        password = "WrongPassword"

        # Act
        result = await authenticate_user(username, password)

        # Assert
        assert result["success"] is False
        assert result["error"] == "Invalid credentials"

    @pytest.mark.asyncio
    async def test_authenticate_user_account_locked(self):
        """Test authentication with locked account after failed attempts."""
        # Arrange
        username = "locked@example.com"

        # Simulate multiple failed attempts
        for _ in range(5):
            await authenticate_user(username, "wrong")

        # Act
        result = await authenticate_user(username, "correct")

        # Assert
        assert result["success"] is False
        assert result["error"] == "Account locked"
        assert "unlock_time" in result

    def test_create_access_token(self):
        """Test JWT access token creation."""
        # Arrange
        user_id = "user-123"
        claims = {"role": "admin", "client_id": "client-456"}

        # Act
        token = create_access_token(user_id, claims)

        # Assert
        decoded = jwt.decode(token, options={"verify_signature": False})
        assert decoded["sub"] == user_id
        assert decoded["role"] == "admin"
        assert decoded["client_id"] == "client-456"
        assert "exp" in decoded
        assert "iat" in decoded

    def test_verify_token_valid(self):
        """Test token verification with valid token."""
        # Arrange
        token = create_access_token("user-123", {"role": "user"})

        # Act
        result = verify_token(token)

        # Assert
        assert result["valid"] is True
        assert result["user_id"] == "user-123"
        assert result["role"] == "user"

    def test_verify_token_expired(self):
        """Test token verification with expired token."""
        # Arrange
        expired_token = jwt.encode(
            {
                "sub": "user-123",
                "exp": datetime.utcnow() - timedelta(hours=1)
            },
            "secret",
            algorithm="HS256"
        )

        # Act
        result = verify_token(expired_token)

        # Assert
        assert result["valid"] is False
        assert result["error"] == "Token expired"

    def test_verify_token_invalid_signature(self):
        """Test token verification with tampered token."""
        # Arrange
        token = jwt.encode({"sub": "user-123"}, "wrong-secret", algorithm="HS256")

        # Act
        result = verify_token(token)

        # Assert
        assert result["valid"] is False
        assert result["error"] == "Invalid token signature"

    @pytest.mark.asyncio
    async def test_refresh_token_valid(self):
        """Test token refresh with valid refresh token."""
        # Arrange
        refresh = create_refresh_token("user-123")

        # Act
        result = await refresh_token(refresh)

        # Assert
        assert result["success"] is True
        assert "access_token" in result
        assert result["access_token"] != refresh

    @pytest.mark.asyncio
    async def test_refresh_token_revoked(self):
        """Test token refresh with revoked token."""
        # Arrange
        refresh = create_refresh_token("user-123")
        await revoke_token(refresh)

        # Act
        result = await refresh_token(refresh)

        # Assert
        assert result["success"] is False
        assert result["error"] == "Token has been revoked"

    @pytest.mark.asyncio
    async def test_check_permissions_admin(self):
        """Test permission checking for admin users."""
        # Arrange
        token = create_access_token("user-123", {"role": "admin"})

        # Act
        can_delete = await check_permissions(token, "delete:users")
        can_read = await check_permissions(token, "read:analytics")

        # Assert
        assert can_delete is True
        assert can_read is True

    @pytest.mark.asyncio
    async def test_check_permissions_user(self):
        """Test permission checking for regular users."""
        # Arrange
        token = create_access_token("user-123", {"role": "user"})

        # Act
        can_delete = await check_permissions(token, "delete:users")
        can_read_own = await check_permissions(token, "read:own_content")

        # Assert
        assert can_delete is False
        assert can_read_own is True

    @pytest.mark.asyncio
    async def test_session_management(self):
        """Test session creation and invalidation."""
        # Arrange
        user_id = "user-123"

        # Act
        session = await create_session(user_id)
        is_valid = await validate_session(session["session_id"])
        await invalidate_session(session["session_id"])
        is_valid_after = await validate_session(session["session_id"])

        # Assert
        assert session["session_id"] is not None
        assert is_valid is True
        assert is_valid_after is False

// tests/pages/login.test.tsx
import { render, screen, fireEvent, waitFor } from '@testing-library/react';
import userEvent from '@testing-library/user-event';
import { useRouter } from 'next/navigation';
import LoginPage from '@/app/(auth)/login/page';

jest.mock('next/navigation');

describe('Login Page', () => {
  const mockPush = jest.fn();

  beforeEach(() => {
    (useRouter as jest.Mock).mockReturnValue({
      push: mockPush,
      replace: jest.fn(),
      prefetch: jest.fn(),
    });
  });

  test('renders login form with all fields', () => {
    render(<LoginPage />);

    expect(screen.getByLabelText(/email/i)).toBeInTheDocument();
    expect(screen.getByLabelText(/password/i)).toBeInTheDocument();
    expect(screen.getByRole('button', { name: /sign in/i })).toBeInTheDocument();
    expect(screen.getByText(/forgot password/i)).toBeInTheDocument();
    expect(screen.getByText(/create account/i)).toBeInTheDocument();
  });

  test('validates email format', async () => {
    const user = userEvent.setup();
    render(<LoginPage />);

    const emailInput = screen.getByLabelText(/email/i);
    const submitButton = screen.getByRole('button', { name: /sign in/i });

    await user.type(emailInput, 'invalid-email');
    await user.click(submitButton);

    await waitFor(() => {
      expect(screen.getByText(/invalid email format/i)).toBeInTheDocument();
    });
  });

  test('requires password', async () => {
    const user = userEvent.setup();
    render(<LoginPage />);

    const emailInput = screen.getByLabelText(/email/i);
    const submitButton = screen.getByRole('button', { name: /sign in/i });

    await user.type(emailInput, 'test@example.com');
    await user.click(submitButton);

    await waitFor(() => {
      expect(screen.getByText(/password is required/i)).toBeInTheDocument();
    });
  });

  test('successful login redirects to dashboard', async () => {
    const user = userEvent.setup();
    global.fetch = jest.fn().mockResolvedValue({
      ok: true,
      json: async () => ({ 
        token: 'valid-token',
        user: { id: 'user-123', email: 'test@example.com' }
      })
    });

    render(<LoginPage />);

    await user.type(screen.getByLabelText(/email/i), 'test@example.com');
    await user.type(screen.getByLabelText(/password/i), 'Password123!');
    await user.click(screen.getByRole('button', { name: /sign in/i }));

    await waitFor(() => {
      expect(mockPush).toHaveBeenCalledWith('/dashboard');
    });
  });

  test('displays error message on failed login', async () => {
    const user = userEvent.setup();
    global.fetch = jest.fn().mockResolvedValue({
      ok: false,
      status: 401,
      json: async () => ({ error: 'Invalid credentials' })
    });

    render(<LoginPage />);

    await user.type(screen.getByLabelText(/email/i), 'test@example.com');
    await user.type(screen.getByLabelText(/password/i), 'WrongPassword');
    await user.click(screen.getByRole('button', { name: /sign in/i }));

    await waitFor(() => {
      expect(screen.getByText(/invalid credentials/i)).toBeInTheDocument();
    });
  });

  test('shows loading state during submission', async () => {
    const user = userEvent.setup();
    global.fetch = jest.fn().mockImplementation(() => 
      new Promise(resolve => setTimeout(resolve, 1000))
    );

    render(<LoginPage />);

    await user.type(screen.getByLabelText(/email/i), 'test@example.com');
    await user.type(screen.getByLabelText(/password/i), 'Password123!');
    await user.click(screen.getByRole('button', { name: /sign in/i }));

    expect(screen.getByRole('button', { name: /signing in/i })).toBeDisabled();
  });

  test('handles OAuth login', async () => {
    const user = userEvent.setup();
    render(<LoginPage />);

    const googleButton = screen.getByRole('button', { name: /sign in with google/i });
    await user.click(googleButton);

    expect(window.location.href).toContain('/api/auth/google');
  });

  test('remembers user with remember me checkbox', async () => {
    const user = userEvent.setup();
    render(<LoginPage />);

    const rememberCheckbox = screen.getByRole('checkbox', { name: /remember me/i });
    await user.click(rememberCheckbox);

    expect(rememberCheckbox).toBeChecked();

    // Verify localStorage is set after successful login
    global.fetch = jest.fn().mockResolvedValue({
      ok: true,
      json: async () => ({ token: 'valid-token' })
    });

    await user.type(screen.getByLabelText(/email/i), 'test@example.com');
    await user.type(screen.getByLabelText(/password/i), 'Password123!');
    await user.click(screen.getByRole('button', { name: /sign in/i }));

    await waitFor(() => {
      expect(localStorage.getItem('rememberUser')).toBe('test@example.com');
    });
  });
});

// tests/pages/register.test.tsx
import { render, screen, fireEvent, waitFor } from '@testing-library/react';
import userEvent from '@testing-library/user-event';
import RegisterPage from '@/app/(auth)/register/page';

describe('Registration Page', () => {
  test('validates password strength', async () => {
    const user = userEvent.setup();
    render(<RegisterPage />);

    const passwordInput = screen.getByLabelText(/^password$/i);

    // Weak password
    await user.type(passwordInput, 'weak');
    expect(screen.getByText(/password too weak/i)).toBeInTheDocument();

    // Strong password
    await user.clear(passwordInput);
    await user.type(passwordInput, 'StrongP@ssw0rd!');
    expect(screen.getByText(/password strength: strong/i)).toBeInTheDocument();
  });

  test('validates password confirmation match', async () => {
    const user = userEvent.setup();
    render(<RegisterPage />);

    await user.type(screen.getByLabelText(/^password$/i), 'Password123!');
    await user.type(screen.getByLabelText(/confirm password/i), 'DifferentPassword');
    await user.click(screen.getByRole('button', { name: /create account/i }));

    await waitFor(() => {
      expect(screen.getByText(/passwords do not match/i)).toBeInTheDocument();
    });
  });

  test('accepts terms and conditions', async () => {
    const user = userEvent.setup();
    render(<RegisterPage />);

    const submitButton = screen.getByRole('button', { name: /create account/i });

    // Should be disabled without accepting terms
    expect(submitButton).toBeDisabled();

    const termsCheckbox = screen.getByRole('checkbox', { name: /i agree to the terms/i });
    await user.click(termsCheckbox);

    expect(submitButton).toBeEnabled();
  });

  test('handles registration success', async () => {
    const user = userEvent.setup();
    global.fetch = jest.fn().mockResolvedValue({
      ok: true,
      json: async () => ({ 
        message: 'Registration successful',
        requiresVerification: true
      })
    });

    render(<RegisterPage />);

    await user.type(screen.getByLabelText(/email/i), 'new@example.com');
    await user.type(screen.getByLabelText(/^password$/i), 'Password123!');
    await user.type(screen.getByLabelText(/confirm password/i), 'Password123!');
    await user.click(screen.getByRole('checkbox', { name: /i agree/i }));
    await user.click(screen.getByRole('button', { name: /create account/i }));

    await waitFor(() => {
      expect(screen.getByText(/check your email to verify/i)).toBeInTheDocument();
    });
  });

  test('handles duplicate email error', async () => {
    const user = userEvent.setup();
    global.fetch = jest.fn().mockResolvedValue({
      ok: false,
      status: 409,
      json: async () => ({ error: 'Email already registered' })
    });

    render(<RegisterPage />);

    await user.type(screen.getByLabelText(/email/i), 'existing@example.com');
    await user.type(screen.getByLabelText(/^password$/i), 'Password123!');
    await user.type(screen.getByLabelText(/confirm password/i), 'Password123!');
    await user.click(screen.getByRole('checkbox', { name: /i agree/i }));
    await user.click(screen.getByRole('button', { name: /create account/i }));

    await waitFor(() => {
      expect(screen.getByText(/email already registered/i)).toBeInTheDocument();
    });
  });
});

# tests/test_database_config.py
import pytest
from unittest.mock import patch, MagicMock
import asyncio
from config.database import (
    DatabaseConfig,
    get_connection_pool,
    ensure_connection,
    handle_connection_error,
    migrate_database
)

class TestDatabaseConfiguration:

    @pytest.mark.asyncio
    async def test_connection_pool_creation(self):
        """Test database connection pool initialization."""
        # Arrange
        config = DatabaseConfig(
            host="localhost",
            port=5432,
            database="test_db",
            user="test_user",
            password="test_pass",
            min_connections=5,
            max_connections=20
        )

        # Act
        pool = await get_connection_pool(config)

        # Assert
        assert pool is not None
        assert pool.minsize == 5
        assert pool.maxsize == 20
        assert not pool.closed

        # Cleanup
        await pool.close()

    @pytest.mark.asyncio
    async def test_connection_pool_exhaustion(self):
        """Test behavior when connection pool is exhausted."""
        # Arrange
        config = DatabaseConfig(max_connections=2)
        pool = await get_connection_pool(config)

        # Act - Acquire all connections
        conn1 = await pool.acquire()
        conn2 = await pool.acquire()

        # Try to acquire one more (should timeout)
        with pytest.raises(asyncio.TimeoutError):
            await asyncio.wait_for(pool.acquire(), timeout=1.0)

        # Release and verify
        await pool.release(conn1)
        conn3 = await pool.acquire()  # Should succeed now
        assert conn3 is not None

        # Cleanup
        await pool.release(conn2)
        await pool.release(conn3)
        await pool.close()

    @pytest.mark.asyncio
    async def test_connection_retry_logic(self):
        """Test automatic retry on connection failure."""
        # Arrange
        mock_connect = MagicMock(side_effect=[
            ConnectionError("Connection failed"),
            ConnectionError("Connection failed"),
            MagicMock()  # Success on third try
        ])

        with patch('asyncpg.connect', mock_connect):
            # Act
            conn = await ensure_connection(max_retries=3)

            # Assert
            assert conn is not None
            assert mock_connect.call_count == 3

    @pytest.mark.asyncio
    async def test_connection_health_check(self):
        """Test connection health checking."""
        # Arrange
        pool = await get_connection_pool()

        # Act
        async with pool.acquire() as conn:
            is_healthy = await conn.fetchval("SELECT 1")

        # Assert
        assert is_healthy == 1

        # Cleanup
        await pool.close()

    @pytest.mark.asyncio
    async def test_transaction_rollback(self):
        """Test transaction rollback on error."""
        # Arrange
        pool = await get_connection_pool()

        # Act
        async with pool.acquire() as conn:
            async with conn.transaction():
                await conn.execute("INSERT INTO test_table VALUES (1, 'test')")
                # Force an error
                with pytest.raises(Exception):
                    await conn.execute("INVALID SQL")

            # Verify rollback
            count = await conn.fetchval("SELECT COUNT(*) FROM test_table")

        # Assert
        assert count == 0  # Transaction was rolled back

        # Cleanup
        await pool.close()

    @pytest.mark.asyncio
    async def test_connection_timeout(self):
        """Test connection timeout handling."""
        # Arrange
        config = DatabaseConfig(
            host="non-existent-host",
            connection_timeout=1
        )

        # Act & Assert
        with pytest.raises(asyncio.TimeoutError):
            await get_connection_pool(config)

    @pytest.mark.asyncio
    async def test_migration_execution(self):
        """Test database migration execution."""
        # Arrange
        migrations = [
            "CREATE TABLE IF NOT EXISTS users (id SERIAL PRIMARY KEY)",
            "CREATE TABLE IF NOT EXISTS jobs (id SERIAL PRIMARY KEY)",
        ]

        # Act
        result = await migrate_database(migrations)

        # Assert
        assert result["success"] is True
        assert result["migrations_applied"] == 2

        # Verify tables exist
        pool = await get_connection_pool()
        async with pool.acquire() as conn:
            tables = await conn.fetch(
                "SELECT tablename FROM pg_tables WHERE schemaname = 'public'"
            )
            table_names = [t['tablename'] for t in tables]

        assert 'users' in table_names
        assert 'jobs' in table_names

        # Cleanup
        await pool.close()

# tests/test_settings.py
import pytest
import os
from unittest.mock import patch
from config.settings import (
    Settings,
    validate_settings,
    load_environment,
    get_settings
)

class TestSettings:

    def test_load_settings_from_env(self):
        """Test loading settings from environment variables."""
        # Arrange
        env_vars = {
            "DATABASE_URL": "postgresql://user:pass@localhost/db",
            "REDIS_URL": "redis://localhost:6379",
            "SECRET_KEY": "super-secret-key",
            "DEBUG": "true",
            "ALLOWED_HOSTS": "localhost,example.com",
            "MAX_CONTENT_LENGTH": "10000"
        }

        with patch.dict(os.environ, env_vars):
            # Act
            settings = Settings()

            # Assert
            assert settings.database_url == env_vars["DATABASE_URL"]
            assert settings.redis_url == env_vars["REDIS_URL"]
            assert settings.secret_key == env_vars["SECRET_KEY"]
            assert settings.debug is True
            assert settings.allowed_hosts == ["localhost", "example.com"]
            assert settings.max_content_length == 10000

    def test_required_settings_validation(self):
        """Test validation of required settings."""
        # Arrange - Missing required DATABASE_URL
        env_vars = {
            "REDIS_URL": "redis://localhost:6379",
            "SECRET_KEY": "key"
        }

        with patch.dict(os.environ, env_vars, clear=True):
            # Act & Assert
            with pytest.raises(ValueError, match="DATABASE_URL is required"):
                settings = Settings()
                validate_settings(settings)

    def test_secret_key_strength(self):
        """Test secret key strength validation."""
        # Arrange
        weak_key = "weak"
        strong_key = "a" * 32  # 32 characters minimum

        # Act & Assert
        with patch.dict(os.environ, {"SECRET_KEY": weak_key}):
            with pytest.raises(ValueError, match="Secret key too weak"):
                settings = Settings()
                validate_settings(settings)

        with patch.dict(os.environ, {"SECRET_KEY": strong_key}):
            settings = Settings()
            validate_settings(settings)  # Should not raise

    def test_settings_type_conversion(self):
        """Test automatic type conversion of settings."""
        # Arrange
        env_vars = {
            "DATABASE_URL": "postgresql://localhost/db",
            "SECRET_KEY": "secret",
            "DEBUG": "false",
            "PORT": "8080",
            "MAX_WORKERS": "4",
            "RATE_LIMIT": "100.5"
        }

        with patch.dict(os.environ, env_vars):
            # Act
            settings = Settings()

            # Assert
            assert settings.debug is False  # String to bool
            assert settings.port == 8080  # String to int
            assert settings.max_workers == 4  # String to int
            assert settings.rate_limit == 100.5  # String to float

    def test_settings_defaults(self):
        """Test default values for optional settings."""
        # Arrange - Minimal required settings
        env_vars = {
            "DATABASE_URL": "postgresql://localhost/db",
            "SECRET_KEY": "secret-key-minimum-length-32-chars"
        }

        with patch.dict(os.environ, env_vars, clear=True):
            # Act
            settings = Settings()

            # Assert defaults
            assert settings.debug is False
            assert settings.port == 8000
            assert settings.max_workers == 10
            assert settings.log_level == "INFO"
            assert settings.cors_origins == ["http://localhost:3000"]

    def test_database_url_parsing(self):
        """Test parsing of database URL components."""
        # Arrange
        db_url = "postgresql://user:pass@host:5432/dbname?sslmode=require"

        with patch.dict(os.environ, {"DATABASE_URL": db_url, "SECRET_KEY": "key"}):
            # Act
            settings = Settings()

            # Assert
            assert settings.db_host == "host"
            assert settings.db_port == 5432
            assert settings.db_name == "dbname"
            assert settings.db_user == "user"
            assert settings.db_password == "pass"
            assert settings.db_ssl_mode == "require"

    def test_settings_singleton(self):
        """Test settings singleton pattern."""
        # Act
        settings1 = get_settings()
        settings2 = get_settings()

        # Assert
        assert settings1 is settings2  # Same instance

    def test_reload_settings(self):
        """Test reloading settings after environment change."""
        # Arrange
        original_debug = os.environ.get("DEBUG", "false")

        # Act
        os.environ["DEBUG"] = "true"
        settings1 = get_settings(reload=True)

        os.environ["DEBUG"] = "false"
        settings2 = get_settings(reload=True)

        # Assert
        assert settings1.debug is True
        assert settings2.debug is False

        # Cleanup
        os.environ["DEBUG"] = original_debug

# tests/security/test_sql_injection.py
import pytest
from apps.cpm.database import execute_query

class TestSQLInjectionPrevention:

    @pytest.mark.asyncio
    async def test_parameterized_queries(self):
        """Test that all queries use parameterization."""
        # Attempt SQL injection
        malicious_input = "'; DROP TABLE users; --"

        # This should be safe due to parameterization
        result = await execute_query(
            "SELECT * FROM content WHERE title = $1",
            malicious_input
        )

        # Verify table still exists
        tables = await execute_query(
            "SELECT tablename FROM pg_tables WHERE tablename = 'users'"
        )
        assert len(tables) == 1

    @pytest.mark.asyncio
    async def test_input_sanitization(self):
        """Test input sanitization for user data."""
        inputs = [
            "'; DROP TABLE users; --",
            "1' OR '1'='1",
            "admin'--",
            "' UNION SELECT * FROM passwords --"
        ]

        for malicious_input in inputs:
            # Should sanitize and not execute malicious code
            result = await search_content(malicious_input)
            assert "error" not in result
            assert isinstance(result, list)

// tests/security/xss-prevention.test.ts
describe('XSS Prevention', () => {
  test('sanitizes user input in content generation', () => {
    const maliciousInput = '<script>alert("XSS")</script>';
    const sanitized = sanitizeInput(maliciousInput);

    expect(sanitized).not.toContain('<script>');
    expect(sanitized).toBe('&lt;script&gt;alert("XSS")&lt;/script&gt;');
  });

  test('escapes HTML in API responses', async () => {
    const response = await fetch('/api/content', {
      method: 'POST',
      body: JSON.stringify({
        content: '<img src=x onerror=alert("XSS")>'
      })
    });

    const data = await response.json();
    expect(data.content).not.toContain('onerror=');
  });
});

# tests/performance/test_load.py
import pytest
import asyncio
from locust import HttpUser, task, between

class LoadTest:

    @pytest.mark.performance
    async def test_concurrent_users(self):
        """Test system with 100 concurrent users."""
        async def simulate_user():
            # Simulate user actions
            await login()
            await generate_content()
            await check_status()

        # Create 100 concurrent users
        tasks = [simulate_user() for _ in range(100)]
        results = await asyncio.gather(*tasks)

        # Assert performance metrics
        assert all(r['response_time'] < 1000 for r in results)  # < 1 second
        assert sum(r['success'] for r in results) >= 95  # 95% success rate

class ContentGenerationUser(HttpUser):
    wait_time = between(1, 3)

    @task
    def generate_content(self):
        self.client.post("/api/content/generate", json={
            "type": "blog",
            "topic": "Performance Testing"
        })

    @task
    def check_job_status(self):
        self.client.get("/api/jobs/latest")

# tests/performance/test_memory.py
import pytest
import psutil
import gc
import asyncio

class TestMemoryLeaks:

    @pytest.mark.slow
    async def test_long_running_no_memory_leak(self):
        """Test for memory leaks in long-running operations."""
        process = psutil.Process()
        initial_memory = process.memory_info().rss / 1024 / 1024  # MB

        # Run operations for extended period
        for _ in range(1000):
            await generate_content()
            await process_job()
            gc.collect()

        final_memory = process.memory_info().rss / 1024 / 1024  # MB
        memory_increase = final_memory - initial_memory

        # Should not increase by more than 50MB
        assert memory_increase < 50, f"Memory leak detected: {memory_increase}MB increase"

// tests/e2e/user-journey.test.ts
import { test, expect } from '@playwright/test';

test.describe('Complete User Journey', () => {
  test('new user registration to content generation', async ({ page }) => {
    // 1. Register new account
    await page.goto('/register');
    await page.fill('[name="email"]', 'newuser@example.com');
    await page.fill('[name="password"]', 'SecurePass123!');
    await page.fill('[name="confirmPassword"]', 'SecurePass123!');
    await page.check('[name="acceptTerms"]');
    await page.click('button[type="submit"]');

    // 2. Verify email (mock)
    await page.goto('/verify-email?token=mock-token');
    await expect(page).toHaveURL('/dashboard');

    // 3. Complete onboarding
    await page.fill('[name="companyName"]', 'Test Company');
    await page.selectOption('[name="industry"]', 'technology');
    await page.click('button:has-text("Continue")');

    // 4. Generate first content
    await page.goto('/content/new');
    await page.selectOption('[name="contentType"]', 'blog');
    await page.fill('[name="topic"]', 'AI Innovation');
    await page.fill('[name="keywords"]', 'AI, machine learning, innovation');
    await page.click('button:has-text("Generate")');

    // 5. Wait for generation
    await page.waitForSelector('[data-testid="job-complete"]', { timeout: 30000 });

    // 6. View generated content
    await expect(page.locator('[data-testid="generated-content"]')).toContainText('AI');

    // 7. Download content
    await page.click('button:has-text("Download")');
    const download = await page.waitForEvent('download');
    expect(download.suggestedFilename()).toContain('ai-innovation');
  });
});

# tests/integration/test_service_communication.py
@pytest.mark.integration
async def test_cpm_im_smm_integration():
    """Test integration between CPM, IM, and SMM services."""
    # 1. IM generates prompt
    prompt_response = await im_client.generate_prompt({
        "client_id": "test-client",
        "content_type": "blog",
        "variables": {"topic": "Technology"}
    })

    # 2. CPM processes content with prompt
    content_response = await cpm_client.generate_content({
        "prompt": prompt_response["prompt"],
        "client_id": "test-client"
    })

    # 3. SMM applies strategy
    final_content = await smm_client.apply_strategy({
        "content": content_response["content"],
        "client_id": "test-client"
    })

    # Verify complete flow
    assert prompt_response["success"] is True
    assert content_response["job_id"] is not None
    assert final_content["seo_optimized"] is True
    assert len(final_content["content"]) > 100