<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Security Regression Tests — API Reference

## pytest Commands

```bash
# Run regression tests with fail-fast
pytest tests/security/regression/ -v -x --tb=long

# Run by marker
pytest tests/security/regression/ -m "critical" -v

# Run specific finding
pytest tests/security/regression/ -k "CVE_2024 or FINDING_042"

# With JUnit XML output
pytest tests/security/regression/ --junitxml=regression-results.xml

# Coverage on security modules
pytest tests/security/regression/ --cov=app.auth --cov=app.validators
```

## Test Organization

```
tests/security/regression/
├── conftest.py                    # Registry and fixtures
├── test_cve_2024_xxxx.py         # CVE-mapped test
├── test_finding_042_sqli.py      # Finding-mapped test
├── test_finding_051_idor.py      # IDOR regression
└── test_finding_067_xss.py       # XSS regression
```

## Test Markers

```python
# conftest.py
import pytest

def pytest_configure(config):
    config.addinivalue_line("markers", "critical: Critical severity regression")
    config.addinivalue_line("markers", "high: High severity regression")
    config.addinivalue_line("markers", "cve: Tests mapped to CVE")
```

## Regression Test Lifecycle

| Phase | Action |
|-------|--------|
| Finding reported | Create test template from finding |
| Fix implemented | Implement test assertions |
| PR merged | Test runs in CI on every build |
| Refactoring | Test catches if fix regresses |
| Periodic | Audit registry for coverage gaps |

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | All regressions pass |
| 1 | Regression detected — fix has regressed |
| 2 | Test error |
