78 lines
4.3 KiB
Markdown
78 lines
4.3 KiB
Markdown
# Claude QA Coverage — Queue North Website
|
|
|
|
```
|
|
Status: Current
|
|
Owner: _null
|
|
Last reviewed: 2026-08-18
|
|
Governs: what each QA pass actually reached
|
|
Review trigger: Any QA round run
|
|
```
|
|
|
|
> Pass by pass, what was reached and what was not. The point of this file is the
|
|
> **Blocked** and **Not run** rows: a pass left out of a report reads exactly like
|
|
> a pass that succeeded, and that is how untested code ships believing it was
|
|
> tested.
|
|
|
|
## Round 0 — 2026-08-18 at `ac6f5d1`
|
|
|
|
Not a round. The table is filled in on the day the template was adopted so that
|
|
the honest state is written down rather than absent, because an absent table
|
|
reads as one nobody got to and this one is a decision.
|
|
|
|
| Pass | Result | Notes |
|
|
| --- | --- | --- |
|
|
| A — First run | **Not run** | Nobody has walked a cold first visit on a real device under a plan |
|
|
| B — Core flow | **Not run** | The two form paths — contact and support — end to end into Zoho. This is the product's entire purpose and it has never been verified from outside |
|
|
| C — Failure paths | **Not run** | Zoho unreachable, reCAPTCHA failing, a duplicate email hitting the 409, an oversized body hitting the 413 |
|
|
| D — Persistence | **Not run** | Container restart with the named volume intact; SQLite surviving it |
|
|
| E — End of loop | **Not run** | A submitted lead actually appearing in the Zoho CRM UI. Nothing on this side can observe that |
|
|
| F — Accessibility | **Not run** | Six known defects are already filed from review rather than testing — #189 to #194 |
|
|
| G — Performance | **Not run** | No numbers exist. Prerendering every route landed at `0.9.3` and its effect has not been measured |
|
|
| H — Abuse and what a stranger can reach | **Not run** | See below — this pass is rewritten for this project |
|
|
|
|
## Pass H, as it applies here
|
|
|
|
The template's pass H is written for a product with accounts. This one has none:
|
|
no login, no session, no roles, no per-user data. Deleting the pass would have
|
|
been wrong anyway, because the *other* half of it — what a stranger can reach and
|
|
exhaust — is the most exposed surface this project has. Rewritten, it is:
|
|
|
|
- Both POST endpoints called directly, off the form, with hand-made payloads
|
|
- The rate limiter actually exercised past `RATE_LIMIT_PER_MINUTE` and the 429
|
|
body checked
|
|
- The honeypot field and the reCAPTCHA score path bypassed deliberately
|
|
- `dist/` inspected for anything secret — `VITE_RECAPTCHA_SITE_KEY` is inlined
|
|
there by design and must be the *site* key, never the secret one
|
|
- The 1 MB body limit and the 30 s request timeout tripped on purpose
|
|
|
|
`scripts/preflight.sh` covers the headers-and-TLS fraction of this and nothing
|
|
else. Its `--auth` checks are deliberately not used: there is no login to
|
|
rate-limit and no account to enumerate.
|
|
|
|
**Pass I — money flowing backwards — was deleted from the plan, not skipped.** No
|
|
money moves through this site. Carrying it as a permanently skipped row is the
|
|
lie this file exists to prevent.
|
|
|
|
## Standing gaps
|
|
|
|
Things no round has ever covered, carried forward until they are. This list
|
|
existing is not a failure; it not existing while the gaps do is.
|
|
|
|
- **There is no automated test suite at all**, and no typecheck. No test runner
|
|
is installed, `package.json` has no `test` script, and the project is plain
|
|
`.jsx` with no TypeScript. `npm run build` is the only gate, and a build proves
|
|
the imports resolve and nothing else. Closing this gap is not currently filed
|
|
as an issue — deliberately, because nobody has decided to do it and filing it
|
|
would put invented work into the denominator. It is recorded here instead,
|
|
which is where a gap nobody has chosen to close belongs.
|
|
- **Nothing has ever verified a lead reaching Zoho end to end.** The forward is
|
|
fire-and-forget by design, so a total failure of it is silent by construction:
|
|
the visitor sees success, SQLite has the row, and the CRM has nothing. The only
|
|
way to catch that is pass E, and pass E needs somebody with a Zoho login.
|
|
- **The lead database has never been backed up or restored.** `backup.sh` and
|
|
`restore-check.sh` exist as of 2026-08-18 and neither has been run against
|
|
production. Filed as an issue in `Batch 15`.
|
|
- **No accessibility testing has ever been done with a screen reader or by
|
|
keyboard alone.** The six filed defects came from reading the markup.
|
|
- **No performance numbers exist for any build, ever.**
|