Continuous Testing

AuthHub runs automated, tiered tests against the live production API on a schedule. Tests detect regressions, availability issues, and performance degradation within minutes.

5 min

Smoke detection

5 tiers

From smoke to load

External dependencies

Test Tiers

Tier	Name	Frequency	Timeout	Purpose
T0	Smoke	Every 5 min	10s	Health, login, single permission check
T1	Contract	Every 60 min	60s	All endpoints return correct shapes
T2	Scenario	Every 6 hours	120s	Full end-to-end workflows
T3	Regression	Daily 02:00	300s	Complete feature coverage
T4	Load Baseline	Weekly Sun 03:00	600s	Performance regression detection

Architecture

Runs on fga5 using Vitest + systemd timers. No external CI, no SaaS dependencies.

┌─────────────────────────────────────────────────────┐
│  systemd timers (fga5)                              │
│                                                     │
│  smoke.timer ──→ vitest run smoke.test.ts (5min)    │
│  contract.timer → vitest run contracts.test.ts (1h) │
│  scenario.timer → vitest run scenarios.test.ts (6h) │
│  regression.timer → vitest run regression.test.ts   │
└──────────────────────┬──────────────────────────────┘
                       │ HTTP (localhost:3000)
                       ▼
┌─────────────────────────────────────────────────────┐
│  AuthHub API (fga5:3000)                            │
│  SpiceDB · CockroachDB · Redis · Kafka              │
└─────────────────────────────────────────────────────┘
                       │
                       ▼ On failure
┌─────────────────────────────────────────────────────┐
│  Alerting Pipeline                                  │
│  Redis dedup → Brevo email → ops@authhub.cloud      │
└─────────────────────────────────────────────────────┘

Test Tenant

A dedicated tenant (test-continuous-runner) is provisioned exclusively for testing. Tests are idempotent — they create, verify, then clean up their own artifacts. The test tenant is excluded from billing and usage metrics.

Alerting

On Failure

Email sent via Brevo within 60 seconds
Includes: tier, test name, endpoint, error, correlation ID, timestamp
Deduplicated: same test failing 3+ times → suppressed for 1 hour

On Recovery

Recovery email sent when a previously failing test passes
Clears the suppression key in Redis

Correlation

Every test request includes X-Request-ID: uuid. On failure, the alert contains this ID so you can grep server logs instantly: journalctl | grep "request_id"

Coverage Matrix

API Group	T0	T1	T2	T3
Health/Readiness	✓	✓
Auth (login/refresh)	✓	✓	✓
Schema CRUD		✓	✓
Tuples CRUD		✓	✓
Permission Check	✓	✓	✓	✓
AuthZEN Evaluation		✓	✓	✓
COAZ Mappings		✓	✓
Break-Glass		✓	✓
SCIM Users/Groups		✓		✓
WIF Token Exchange		✓
NHI Management		✓	✓	✓
NHI JIT Tokens		✓	✓
NHI Credentials		✓	✓	✓
Governance Signals		✓		✓
DR Readiness		✓		✓

Running Tests

# Run specific tier manually
npm run test:continuous:smoke
npm run test:continuous:contracts
npm run test:continuous:scenarios
npm run test:continuous:regression

# Run all tiers
npm run test:continuous:all

# Check systemd timer status
systemctl list-timers authhub-*