Executive Summary

Unit Tests: 1,293+ (Vitest/jsdom across 150+ files — verify via bun run test:unit)

Strategy: Pure algorithms get white-box unit tests. I/O-heavy modules are covered by black-box integration and E2E Playwright tests. Every function is verified — the difference is where.

---

Coverage by Layer

✅ White-Box Unit Tests (Vitest — pure logic, no I/O)

File	Tests	What’s Tested
utils/date.test.ts	18	ISO validation, conversions, formatting, leap years
utils/security.test.ts	39	Argon2id, CSPRNG tokens, SHA-256 checksums, timing attacks
utils/error-handling.test.ts	22	AppError class, type guards, message extraction, wrapping
utils/language-utils.test.ts	11	Intl.DisplayNames, 30+ languages, RTL fallbacks
utils/cn.test.ts	6	Tailwind class merging
utils/pluralize.test.ts	5	Pluralization rules
utils/transformers.test.ts	6	Data transformation pipelines
utils/logic-builder.test.ts	5	Query builder logic

File	Tests	What’s Tested
utils/tree-view-adapter.test.ts	14	Tree data structure transforms
utils/navigation.test.ts	3	Navigation utilities
utils/file-uploading.test.ts	11	File upload validation
utils/status-toggle.test.ts	7	Entry status state machine
utils/preview.test.ts	3	Preview message handling
utils/api.test.ts	12	API helper utilities
utils/utils.test.ts	22	General utilities, form data conversion
Total Utility Unit Tests	224	All pure functions across 18+ files

🔵 Black-Box Integration Tests (API layer — real server, real DB)

Module	Covered By	What’s Verified
entry-actions.ts	tests/unit/api/collections.test.ts	CRUD operations, batch mutations, status transitions
media-service.server.ts	tests/unit/api/media-security*.test.ts	Upload, delete, SSRF protection, MIME validation
bulk-download.ts	Integration runner (real filesystem)	TAR.GZ archive creation, streaming, cleanup
cloud-storage.ts	Integration + E2E	S3/R2/Cloudinary upload, URL construction, metadata
media-processing.server.ts	media-performance benchmark	Sharp image processing, EXIF parsing, hashing
media-manipulation.test.ts	11 unit tests (Vitest)	Sharp pipeline: rotate, crop, flip, filters, sepia, circle crop, watermarks, annotations, error handling
collection-utils.server.ts	tests/unit/api/collections.test.ts	Collection path resolution, caching
settings-sync.ts	tests/unit/stores/system.test.ts	Pub/sub synchronization, state transitions
restart-required.ts	tests/unit/stores/system.test.ts	State flag toggling (trivial 23-line module)

🟡 E2E Playwright Tests (full browser — user journeys)

Module	Covered By	What’s Verified
logger.ts (client)	All E2E specs	Console output, error reporting in browser
form.svelte.ts (Form class)	Login/setup E2E flows	Form submission, validation, reset
schemas.ts (Valibot)	Login/setup E2E flows	Validation error display, field-level messages
global-search-index.ts	Collection builder E2E	Search filtering, index population
media-utils.ts	15 unit + Media library E2E	MIME lookup, sanitization, URL construction, validation
sharing.ts	13 unit + Media library E2E	Share link generation, validation, expiry, limits

Module	Covered By	What’s Verified
slim-sniffer.server.ts	12 unit tests	Binary MIME detection (JPEG, PNG, GIF, WebP, SVG, PDF, DOCX, MP4, WebM)
advanced-search.ts	Media library E2E	Filter UI, suggestions, duplicate detection
storage-analytics.ts	Media library E2E	Storage breakdown charts, insights display
version-history.ts	Media library E2E	Version comparison, diff display, restore flow
bulk-download.ts	Integration runner	TAR.GZ archive creation, streaming, cleanup
streaming-upload.ts	Integration (planned)	Multi-GB multipart upload parsing

---

Why Not Unit-Test Everything?

Unit tests excel at pure algorithms — deterministic functions with clear inputs/outputs. They’re fast (milliseconds), parallelizable, and catch logic regressions immediately.

I/O-heavy modules (filesystem, cloud SDKs, database adapters) are verified at the integration and E2E layers because:

1. Real behavior: Mocking @aws-sdk/client-s3 doesn’t prove the upload actually works
2. Security gates: Only integration tests exercise the full middleware chain (Firewall → Auth → RBAC → Handler)
3. Database agnosticism: The same integration suite runs against SQLite, MongoDB, PostgreSQL, and MariaDB
4. No false confidence: A passing unit test with a mocked DB adapter gives zero confidence the real adapter works

---

Running Tests

# All unit tests (pure logic)
bun run test:unit

# Specific utility test
bun run test:unit -- security
bun run test:unit -- date

# Integration tests (API layer)
bun run test:integration

# E2E tests (browser)
bun run test:e2e
```

---

## Related Documentation

- [Testing Strategy: Black-Box vs White-Box](/docs/tests/testing-strategy)
- [Test Status Overview](/docs/tests/test-status)
- [API Test Coverage](/docs/tests/api-testing)
- [E2E Testing Guide](/docs/tests/e2e-testing-guide)