<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Security Unit Tests — API Reference

## pytest Commands

```bash
# Run security tests
pytest tests/security/ -v --tb=short

# Run with coverage
pytest tests/security/ --cov=app --cov-report=xml --cov-report=term

# Enforce minimum coverage
coverage report --include="app/auth/*,app/validators/*" --fail-under=90

# Run parametrized tests
pytest tests/security/ -k "sql_injection or xss"

# Generate JUnit XML
pytest tests/security/ --junitxml=results.xml

# Parallel execution
pytest tests/security/ -n auto
```

## Jest Commands

```bash
# Run security tests
npx jest tests/security/ --verbose

# With coverage
npx jest tests/security/ --coverage --collectCoverageFrom="src/security/**"

# Specific test
npx jest tests/security/validation.test.js
```

## Common Security Test Categories

| Category | What to Test |
|----------|-------------|
| Input validation | SQL injection, XSS, path traversal, SSRF payloads |
| Authentication | Token expiry, tampering, algorithm confusion, brute force |
| Authorization | IDOR, privilege escalation, role boundaries |
| Cryptography | Key length, algorithm choice, IV uniqueness |
| Session | Fixation, timeout, concurrent sessions |
| Error handling | No stack traces leaked, generic error messages |

## OWASP Test Payloads

| Type | Examples |
|------|---------|
| SQLi | `' OR 1=1--`, `1 UNION SELECT`, `'; DROP TABLE` |
| XSS | `<script>alert(1)</script>`, `<img onerror=alert(1)>` |
| Path Traversal | `../../etc/passwd`, `..%2f..%2fetc/shadow` |
| SSRF | `http://169.254.169.254/latest/meta-data/` |
| Command Injection | `; whoami`, `$(cat /etc/passwd)`, `` `id` `` |

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | All tests passed |
| 1 | Test failures |
| 2 | Test errors or interruption |
