SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillsqa/test-strategy

qa/test-strategy

Testing & quality

View repository

Updated 10-15 21:36

About this skill

Testing Strategy and the Test Pyramid

Test Pyramid Principle

          /\
         /  \
        / E2E \          ← ~10%：端到端用户流程【必须编写】
       /--------\
      /  集成测试  \       ← ~20%：组件/服务/API 交互
     /--------------\
    /    单元测试     \    ← ~70%：函数/组件/服务逻辑
   /--------------------\

E2E testing is mandatory

Every project must write E2E tests, covering at minimum:

  • Create flow
  • Edit flow
  • Delete flow
  • List display
  • Core business flows

Frontend vs Backend Test Distribution

Layer Frontend Tests Backend Tests
Unit Tests Component rendering, Hooks, utility functions Service layer, business logic, utility classes
Integration Tests Component interaction, state management, API calls API endpoints, database operations, inter-service calls
E2E Tests UI user flows Complete API flows, cross-service calls

QA Attack Protocol

  • Replay core user paths: Prove that core user paths actually work
  • Capture real payloads and server responses: Verify request payloads, server responses, and schema consistency
  • Attack authentication and authorization: Cover anonymous, authorized, unauthorized, expired, and privilege escalation
  • Attack data boundaries: empty state, pagination, second page, stale data, illegal enum, long input, double submit
  • Attack business consistency: Verify that interface display is consistent with server-side business constants
  • Verify artifact-type features: Verify that core artifacts, records, or states exist, can be displayed, and can continue to be used in downstream flows
  • Mark unverified paths: If core user paths are proven only by Mocks or stub data, they must be marked as unverified and cannot be used as release evidence

Security Testing

Test Type Test Content Example
SQL Injection Parameterized query verification ' OR '1'='1
XSS Output escaping verification <script>alert(1)</script>
CSRF Token verification Cross-site request testing
Authentication Token validity Expired/forged Token
Authorization Permission boundaries Unauthorized access testing
Input validation Boundary values/format Overly long/special characters

Performance Testing

Metric Frontend Target Backend Target
First screen load < 3s -
API P50 - < 100ms
API P99 - < 500ms
Concurrent users - ≥ 100
Memory leak None None