docs/TESTING.md

Testing

The suite uses pytest with pytest-asyncio; network calls (Numbeo, Yahoo, Frankfurter, currency-api) are mocked via respx and monkeypatching — no live requests.

uv sync --group dev          # install test + audit dependencies
uv run pytest                # run the suite
uv run pytest --cov          # run with a coverage report
uv run pytest --cov --cov-report=html   # HTML report in htmlcov/
uv run pip-audit             # scan dependencies for known CVEs

Layers & coverage

Latest run — 152 tests, 100% line coverage, spanning four layers:

Layer	File	Focus
Unit	test_model/fx/currencies/data_sources/tax.py	Model math, EMA blend, lookups, parsing, tax rates
Integration	test_integration.py	Full request → model → render pipeline
Regression	test_regression.py	Pins previously-fixed bugs
Security	test_security.py	Validation, XSS escaping, SSRF resistance
Endpoint	test_app.py, test_tax.py	Routes, validation, degradation

Module	Coverage
app/currencies.py	100%
app/tax.py	100%
app/fx.py	100%
app/model.py	100%
app/data_sources.py	100%
app/main.py	100%
Total	100%

Security

See SECURITY_TEST.md for the security review — findings rated by CVSS band and mapped to the OWASP Top 10. The dependency audit is clean after upgrading python-multipart / starlette / idna / python-dotenv (14 CVEs resolved); pip-audit is wired into the dev group to keep it that way.