# FieldOps Cloud Test Coverage Gap Analysis

Date: 2026-06-16

## Current Automated Coverage

Covered by `tests/run.php` and `composer check`:

- Password hashing and password policy.
- Auth hash/verify behavior.
- RBAC permission checks.
- XAMPP path stripping.
- Client/job validation.
- Job search, status filters, detail lookup, checklist, timeline, financials, and workflow stats.
- Quote and invoice validation/calculation/session mapping.
- Schedule week calculation, validation, appointment build, and conflict detection.
- Import schema, aliases, required fields, validation preview, and protocol rules.
- Accounting provider registry and validation.
- Calendar provider registry, sync strategy, and conflict logic.
- LLM provider validation, HTTPS custom endpoint rule, secret masking, and import safety rules.
- SaaS plan catalog, subscription usage, pricing settings, platform admin overview.
- PHP lint across source, tests, public, config, and templates.

Covered by this execution pass:

- MySQL schema and seed import.
- XAMPP route smoke.
- CSRF rejection for non-API POST routes.
- HTTP form-flow checks for clients, jobs, schedule, quotes, invoices, and pricing.
- CSV export formula injection mitigation.
- Browser smoke across mobile/tablet/desktop.
- Production auth smoke with demo disabled, DB-backed role login, and platform-admin isolation.
- Production workflow smoke with demo disabled and DB-backed create/detail/edit persistence for clients, jobs, team members, quotes, invoices, invoice payments, validation failures, schedule booking, import preview/commit/undo, Basic export blocking, tenant-isolation negative checks, support login-as/return, and DB-backed role route matrices for Owner, Manager, Supervisor, Team Member, Trainee, and Platform Admin.
- MySQL tenant-isolation smoke with a disposable database imported from `database/schema.sql`, covering tenant-scoped reads, guarded cross-tenant writes, and quote/invoice child-row delete safety.
- Gate 5 billing/payment truth tests for manual provider defaults, sandbox/live provider readiness gates, signed Stripe-style webhook verification, stale/invalid signature rejection, tenant metadata enforcement, duplicate replay handling, payload-hash conflict rejection, and database-backed platform billing overrides/events.
- Gate 6 integration truth tests for accounting provider contracts, Google/Outlook sync and webhook verification contracts, platform-admin contract-tested statuses, local-only LLM readiness, and LLM redacted import samples.
- Gate 7 deployment-readiness tests for unsafe production blockers, complete production release evidence, health-page deployment hardening visibility, and rollback/runbook expectations.

## Critical Gaps

| Gap | Risk | Recommended test work |
| --- | --- | --- |
| No committed CI install/audit gate | Dependency regressions may return | Add CI install, validate, audit, test, lint, schema import, HTTP smoke, and browser smoke gate |
| No committed controller/HTTP test harness | Route regressions can return | Add PHP HTTP/controller integration tests around `App` and fake requests |
| MySQL-backed repository integration tests are script-based, not CI-gated | Tenant isolation regressions could return if the smoke is not run automatically | Add `tools/mysql-isolation-smoke.php` to CI/release gate and extend it as new tenant-owned modules are added |
| Production role route coverage is browser-light | Role-specific route regressions are now covered, but full browser interaction for each role can still miss UI-only issues | Keep the DB-backed production role route matrix and add selected browser interaction tests for the highest-risk non-owner workflows |
| Limited hosted/browser MySQL coverage | Cross-tenant data leaks in hosted controller wiring could be missed if deployment differs from local/XAMPP | Keep repository-level MySQL smoke and add selected hosted/browser isolation checks before public beta |
| Public REST API not implemented | External API cannot be marketed as live | Keep REST docs marked planned or implement token-authenticated API tests |
| CSV import large-data and durable job coverage incomplete | Upload safety controls now pass, but very large imports and durable long-running import records still need proof | Add generated 500-row/large-file performance fixtures, durable import job persistence checks, and deeper row validation report tests |
| No live OAuth/sync/provider activation tests | Live provider activation cannot be trusted yet | Keep providers disabled until credentials, encrypted token storage, webhook receivers, retry workers, rate limits, and provider-specific contract-to-live tests exist |
| No live payment capture or subscription-state mutation tests | SaaS billing cannot collect money safely yet | Keep payment capture disabled until Checkout/Customer Portal flows, live provider configuration, subscription-state mutation, entitlement transitions, and reconciliation tests exist |
| No full accessibility audit | Usability risk | Add axe or manual WCAG pass after owner-approved tooling |
| No large-data performance tests | Scaling unknown | Add generated datasets for 10k clients, 50k jobs, dense schedules, large CSV |
| Hosted infrastructure values not yet owner-provided | Security/reliability risk | Populate Gate 7 variables in the target host, capture `/platform-admin/health` evidence, run browser/auth/workflow smokes against the hosted URL, and attach backup/restore/monitoring/rollback proof |

## Recommended Next Test Additions

1. `tests/Http/AppRouteTest.php` or equivalent route harness.
2. CI wrapper for `tools/mysql-isolation-smoke.php` and disposable schema import.
3. `tests/Security/CsrfAndRbacTest.php`.
4. `tests/Http/FormFlowTest.php` for clients, jobs, schedule, quotes, invoices, pricing.
5. `tests/Security/CsvExportSafetyTest.php`.
6. Generated large-import performance tests for 500-row/large-file CSV imports and durable import job reporting.
7. `tests/Api/*` after API implementation.
8. Live provider activation tests after owner-approved credentials and encrypted token/key storage are available.
9. Production workflow smoke expansion for portal approval/payment placeholders and selected high-risk role interactions.
10. Selected role-specific browser interaction checks for highest-risk non-owner actions, building on the DB-backed production route matrix.
11. CI command that runs install, validate, audit, test, lint, schema import, HTTP smoke, browser smoke, auth smoke, workflow smoke, and security checks.
12. Hosted deployment smoke against the final production URL with Gate 7 variables populated.

## Coverage Conclusion

The current service-level suite is strong for a prototype, and this pass added runtime/browser execution evidence including production-auth smoke, an expanded DB-backed production workflow smoke with a production role route matrix, Gate 4 multipart upload checks, Gate 5 billing webhook/idempotency tests, Gate 6 accounting/calendar/LLM contract truth tests, Gate 7 deployment-readiness tests, and a dedicated MySQL tenant-isolation smoke. Commercial-grade confidence still requires HTTP/controller tests, CI-gated MySQL checks, selected high-risk role browser interactions, hosted deployment evidence, large-import performance coverage, live-provider activation tests, live-payment activation tests, accessibility, and performance coverage.