🤖 Testing

rastrillo new ships an app whose tests pass before you have written anything, and a make ci that defines the gate once.

The harness

The scaffold writes internal/<app>test/ — a harness plus example tests. It builds your app the way main.go does and drives it over HTTP, so what a test exercises is what a request exercises: the router, the middleware, the session store, CSRF.

Its post() sends an Origin header, because csrf.Protect is mounted from day one and a test that forgot would 403 confusingly.

Serving without a listener

handler, cleanup, err := rastrillo.Handler(opts)

Handler is Serve minus the listener: the whole framework chrome — /healthz, /api/version, locale-prefix stripping, Options.Wrap — as an http.Handler you can hand to httptest.NewServer. Call the returned cleanup when you are done.

rastrillo.OpenDB is the same corrected SQLite opener Serve uses, exported so a test can open a database with the right pragma order instead of an approximation of it.

make ci

make ci

is vet + fmt + test + rastrillo migration check, and it is the one gate definition. .amadan/ci and .amadan/ci.d/ are executable steps that delegate to it, so the CI runner and your terminal cannot disagree about what passing means.

Keeping migration check in that gate is what stops models and migrations drifting apart between deploys. It touches no database, so it runs anywhere.

Testing a two-user rule

The rule most worth a test is the one in scoping: another user's row must answer 404. Sign in as A, create a row, sign in as B, request it by id, assert 404. examples/notes proves both its declared and hand-written halves with one two-user suite.

Write that test once per owned resource. It is the cheapest insurance against the most expensive bug.

Passkey ceremonies

webauthn/authtest is a fake authenticator, public so your tests can drive a full registration and assertion without hardware. See Passkeys.

The pins test

go test -tags pins ./internal/iconsets/

Build-tagged and deliberately outside the ordinary suite, because it reaches jsdelivr and the npm registry. A check that fails when someone else's CDN has a bad afternoon teaches people to ignore failures. Run it at release — Icons explains what it verifies.

Read this page as markdown — exact, unstyled, and cheap for an agent to fetch.