Testing & Debugging

# app.py
import json
import os


def write_report(path, rows):
    path.write_text(json.dumps([{"name": n, "age": a} for n, a in rows]))


def get_region():
    return os.environ["APP_REGION"]


def print_summary(total):
    print(f"Total: {total}")


# test_app.py - pytest ships these fixtures, nothing to import or install
import json
import logging

from app import get_region, print_summary, write_report


def test_report_is_written_to_disk(tmp_path):
    """tmp_path: a fresh temporary directory per test, as a pathlib.Path"""
    output = tmp_path / "report.json"
    write_report(output, rows=[("alice", 30)])
    assert json.loads(output.read_text()) == [{"name": "alice", "age": 30}]


def test_region_comes_from_environment(monkeypatch):
    """monkeypatch: set variables or attributes, undone after the test"""
    monkeypatch.setenv("APP_REGION", "us-east-1")
    assert get_region() == "us-east-1"


def test_cli_prints_summary(capsys):
    """capsys: capture whatever the code wrote to stdout/stderr"""
    print_summary(total=42)
    assert "Total: 42" in capsys.readouterr().out


def test_large_order_is_logged(caplog):
    """caplog: assert on log records instead of scraping printed text"""
    with caplog.at_level(logging.WARNING):
        logging.getLogger("orders").warning("Large order detected: %s", 12345)
    assert "Large order detected: 12345" in caplog.text

# conftest.py - fixtures defined here are available to every test file in
# this directory and below, with no import required
import pytest

from myapp.clock import Clock
from myapp.db import Database


@pytest.fixture(scope="session")
def database():
    """scope='session': built once for the entire run (for expensive setup)"""
    db = Database.connect("sqlite:///:memory:")
    yield db
    db.close()


@pytest.fixture
def user(database):
    """Default scope='function': rebuilt fresh for every single test.
    Fixtures can depend on other fixtures, and pytest resolves the order."""
    return database.create_user(name="Alice")


@pytest.fixture(autouse=True)
def frozen_clock():
    """autouse=True: applied to every test in scope without being requested"""
    Clock.freeze("2026-01-01T00:00:00Z")
    yield
    Clock.reset()

# Useful command-line selection while developing:
#   pytest -k "signup"     run only tests whose name matches "signup"
#   pytest -x              stop at the first failure
#   pytest --lf            re-run only the tests that failed last time
#   pytest -m "not slow"   skip tests marked @pytest.mark.slow

# pip install hypothesis
import pytest
from hypothesis import given, strategies as st

from statistics_utils import calculate_average


# Example-based: you pick the inputs, so you only catch the cases you imagined
def test_average_of_known_values():
    assert calculate_average([10, 20, 30]) == 20.0


# Property-based: Hypothesis generates hundreds of inputs looking for a
# counter-example, then shrinks any failure to the smallest one that still fails
@given(st.lists(st.integers(min_value=-10**6, max_value=10**6), min_size=1))
def test_average_lies_between_min_and_max(numbers):
    assert min(numbers) <= calculate_average(numbers) <= max(numbers)


@given(
    st.lists(st.integers(min_value=-1000, max_value=1000), min_size=1),
    st.integers(min_value=-1000, max_value=1000),
)
def test_shifting_every_value_shifts_the_average(numbers, offset):
    shifted = [n + offset for n in numbers]
    # pytest.approx: never compare floating point results with ==
    assert calculate_average(shifted) == pytest.approx(
        calculate_average(numbers) + offset
    )

# Drop min_size=1 and Hypothesis hands you [] on the very first attempts,
# forcing you to decide what an empty input should actually do.

from unittest.mock import Mock, patch
import requests

class WeatherService:
    def get_temperature(self, city):
        response = requests.get(f"https://api.weather.com/{city}")
        return response.json()["temp"]

# Using Mock
def test_weather_service_with_mock():
    service = WeatherService()
    
    # Create a mock response
    mock_response = Mock()
    mock_response.json.return_value = {"temp": 72}
    
    # Patch requests.get to return our mock
    with patch('requests.get', return_value=mock_response) as mock_get:
        temp = service.get_temperature("Houston")
        assert temp == 72

        # Verify the API was called correctly
        mock_get.assert_called_once_with("https://api.weather.com/Houston")

# Using pytest-mock (cleaner syntax)
def test_weather_service_with_pytest_mock(mocker):
    service = WeatherService()
    
    # Stub the response
    mock_get = mocker.patch('requests.get')
    mock_get.return_value.json.return_value = {"temp": 72}
    
    temp = service.get_temperature("Houston")
    assert temp == 72

from unittest.mock import patch

# The single most common mocking mistake: patching the wrong name.
# patch() replaces an attribute on a module, so you must patch the name in
# the module that LOOKS IT UP, not the module that defines it.

# --- myapp/weather.py ---
import requests  # the module object is stored; requests.get is resolved per call

def get_temperature(city):
    return requests.get(f"https://api.weather.com/{city}").json()["temp"]

# Works: the lookup happens at call time, so replacing requests.get is enough
patch("requests.get")


# --- myapp/report.py ---
from requests import get  # the function itself is copied into myapp.report NOW

def fetch_rows(url):
    return get(url).json()

# Does NOT work: myapp.report.get still points at the original function
patch("requests.get")

# Works: patch the copy that myapp.report actually calls
patch("myapp.report.get")


# Also prefer autospec, so a mock rejects calls the real object would reject
with patch("myapp.report.get", autospec=True) as mock_get:
    fetch_rows("https://example.com/rows")
    mock_get.assert_called_once_with("https://example.com/rows")
    # Without autospec, mock_get(1, 2, 3, nonsense=True) would happily pass

import pytest
from sqlalchemy import create_engine, select
from sqlalchemy.exc import IntegrityError
from sqlalchemy.orm import sessionmaker

from myapp.models import Base, User  # your SQLAlchemy declarative models


# Using a test database
@pytest.fixture
def db_session():
    # Create test database
    engine = create_engine("sqlite:///:memory:")
    Base.metadata.create_all(engine)
    Session = sessionmaker(bind=engine)
    session = Session()

    yield session

    # Cleanup
    session.close()
    engine.dispose()


def test_user_repository_creates_user(db_session):
    # Integration test - actually talks to database
    user = User(name="Alice", email="alice@example.com")
    db_session.add(user)
    db_session.commit()

    # Query it back (SQLAlchemy 2.0 style: select() + scalars())
    result = db_session.scalars(
        select(User).where(User.name == "Alice")
    ).first()
    assert result is not None
    assert result.email == "alice@example.com"


def test_user_repository_with_duplicate_email_fails(db_session):
    # Test business logic + database constraints.
    # Requires User.email to be declared with unique=True
    user1 = User(name="Alice", email="test@example.com")
    user2 = User(name="Bob", email="test@example.com")

    db_session.add(user1)
    db_session.commit()

    db_session.add(user2)
    with pytest.raises(IntegrityError):
        db_session.commit()

    # A failed commit leaves the session unusable until it is rolled back
    db_session.rollback()

# API E2E Test (api_client is a pytest fixture wrapping requests or TestClient)
def test_complete_user_signup_flow(api_client):
    # User signs up
    response = api_client.post("/api/signup", json={
        "email": "newuser@example.com",
        "password": "SecurePass123!",
        "name": "New User"
    })
    assert response.status_code == 201
    user_id = response.json()["user_id"]
    
    # User receives confirmation email
    # get_sent_emails() is a test helper that reads the mock email backend
    emails = get_sent_emails()
    assert len(emails) == 1
    assert "newuser@example.com" in emails[0]["to"]
    
    # User logs in
    response = api_client.post("/api/login", json={
        "email": "newuser@example.com",
        "password": "SecurePass123!"
    })
    assert response.status_code == 200
    token = response.json()["token"]
    
    # User accesses protected resource
    response = api_client.get(
        "/api/profile",
        headers={"Authorization": f"Bearer {token}"}
    )
    assert response.status_code == 200
    assert response.json()["name"] == "New User"

# Web UI E2E Test (using Selenium)
from selenium import webdriver
from selenium.webdriver.common.by import By

def test_user_can_complete_checkout(browser):
    # Navigate to product page
    browser.get("https://example.com/products/widget")
    
    # Add to cart
    add_button = browser.find_element(By.ID, "add-to-cart")
    add_button.click()
    
    # Go to checkout
    browser.get("https://example.com/checkout")
    
    # Fill in form
    browser.find_element(By.ID, "email").send_keys("buyer@example.com")
    browser.find_element(By.ID, "card-number").send_keys("4242424242424242")
    
    # Submit order
    browser.find_element(By.ID, "submit-order").click()
    
    # Verify confirmation
    confirmation = browser.find_element(By.CLASS_NAME, "order-confirmation")
    assert "Thank you" in confirmation.text

# Install coverage tool
pip install pytest-cov

# Run tests with coverage
pytest --cov=myapp --cov-report=html

# View detailed HTML report
# Coverage report saved to htmlcov/index.html

# Example output:
# Name                 Stmts   Miss  Cover
# ----------------------------------------
# myapp/__init__.py       10      0   100%
# myapp/models.py         45      3    93%
# myapp/views.py          67     12    82%
# myapp/utils.py          23      0   100%
# ----------------------------------------
# TOTAL                  145     15    90%

# pip install mutmut

# setup.cfg
#   [mutmut]
#   source_paths=myapp

# myapp/discounts.py - fully covered by one test
def apply_discount(price, percent):
    percent = min(percent, 50)  # never discount more than half
    return price - price * (percent / 100)

# tests/test_discounts.py
def test_apply_discount():
    assert apply_discount(100, 10) == 90

# Coverage is happy:
#   Name                 Stmts   Miss  Cover
#   myapp/discounts.py       3      0   100%

# Mutation testing is not:
#   $ mutmut run
#   10/10  killed 9  survived 1
#
#   $ mutmut results
#   myapp.discounts.x_apply_discount__mutmut_6: survived
#
#   $ mutmut show myapp.discounts.x_apply_discount__mutmut_6
#   -    percent = min(percent, 50)
#   +    percent = min(percent, 51)

# The cap is executed by the test but never verified, so changing it breaks
# nothing. That surviving mutant is the missing test:
#   assert apply_discount(100, 90) == 50

# Using Locust for load testing
import random

from locust import HttpUser, task, between


class WebsiteUser(HttpUser):
    wait_time = between(1, 3)  # Wait 1-3 seconds between tasks

    @task(3)  # Run this task 3x more often than other tasks
    def view_products(self):
        self.client.get("/products")

    @task(1)
    def view_product_detail(self):
        product_id = random.randint(1, 100)
        self.client.get(f"/products/{product_id}")

    @task(1)
    def add_to_cart(self):
        self.client.post("/cart", json={
            "product_id": random.randint(1, 100),
            "quantity": 1
        })

# Run with: locust -f loadtest.py --host=https://example.com
# Opens web UI at http://localhost:8089 to configure users and spawn rate

# Test for SQL injection vulnerability
def test_sql_injection_prevention(db):
    # Malicious input attempting SQL injection
    malicious_input = "1' OR '1'='1"

    # Should be safely handled by parameterized queries
    cursor = db.execute(
        "SELECT * FROM users WHERE id = ?",
        (malicious_input,)
    )

    # Note: cursor.rowcount is -1 for SELECT in the DB-API, so assert on
    # the rows themselves, never on rowcount
    assert cursor.fetchall() == []

    # And the table is still intact: the input was treated as data, not SQL
    assert db.execute("SELECT COUNT(*) FROM users").fetchone()[0] > 0


# Test authentication
def test_requires_authentication(client):
    response = client.get("/api/profile")
    assert response.status_code == 401

    response = client.get(
        "/api/profile",
        headers={"Authorization": "Bearer invalid_token"}
    )
    assert response.status_code == 401


# Test rate limiting
def test_rate_limiting(client):
    # Make 100 rapid requests
    responses = [client.post("/api/login") for _ in range(100)]

    # Some should be rate limited
    status_codes = [r.status_code for r in responses]
    assert 429 in status_codes  # Too Many Requests

# TDD Example: Building a shopping cart

# Step 1: RED - Write failing test
def test_empty_cart_has_zero_total():
    cart = ShoppingCart()
    assert cart.total() == 0
# Result: NameError: name 'ShoppingCart' is not defined

# Step 2: GREEN - Make it pass (minimal code)
class ShoppingCart:
    def total(self):
        return 0

# Run test again: PASSES

# Step 3: RED - Next test
from dataclasses import dataclass
from decimal import Decimal

@dataclass
class Item:
    name: str
    price: Decimal  # Decimal, not float: money must not lose cents

def test_cart_with_one_item():
    cart = ShoppingCart()
    cart.add_item(Item("Book", Decimal("10.00")))
    assert cart.total() == Decimal("10.00")
# Result: AttributeError: 'ShoppingCart' object has no attribute 'add_item'

# Step 4: GREEN - Make it pass
class ShoppingCart:
    def __init__(self):
        self.items = []

    def add_item(self, item):
        self.items.append(item)

    def total(self):
        return sum(item.price for item in self.items)

# Run test: PASSES

# Step 5: REFACTOR - Improve without breaking tests
# (Tests stay green throughout refactoring)