Testing & QA with Gemini CLI

gemini "@routers/tasks.py @tests/conftest.py Generate pytest tests for the list_tasks endpoint covering:
1. Happy path — user gets back their own tasks
2. Filter by completed=true
3. Filter by priority=low
4. Filter by tag name
5. Unauthenticated request returns 401
6. Invalid priority value returns empty list (not an error)"

import pytest


# ── CHUNK 1: Setup helper ────────────────────────────────────────
# WHAT: Creates a task via the API (not direct DB insert) so the
#       owner_id is always set to the authenticated test user.
# WHY:  Using the API instead of inserting directly ensures we're
#       testing the real code path, not bypassing it.
def create_task(client, headers, **kwargs):
    payload = {"title": "default", **kwargs}
    resp = client.post("/tasks/", json=payload, headers=headers)
    assert resp.status_code == 201, f"Task creation failed: {resp.json()}"
    return resp.json()


# ── CHUNK 2: Happy path ──────────────────────────────────────────
# WHAT: Verifies a user can list their own tasks.
# WHY:  The most basic assertion — if this fails, nothing else matters.
def test_list_tasks_happy_path(client, auth_headers):
    create_task(client, auth_headers, title="Buy groceries", priority="medium")
    create_task(client, auth_headers, title="Write report", priority="high")

    resp = client.get("/tasks/", headers=auth_headers)
    assert resp.status_code == 200
    tasks = resp.json()
    assert isinstance(tasks, list)
    assert len(tasks) >= 2
    titles = [t["title"] for t in tasks]
    assert "Buy groceries" in titles
    assert "Write report" in titles


# ── CHUNK 3: Filter by completed ────────────────────────────────
# WHAT: Verifies ?completed=true only returns completed tasks.
# WHY:  The filter uses SQLAlchemy boolean comparison — worth testing
#       because Python True/False vs SQLite 1/0 can surprise you.
# GOTCHA: We create one completed and one incomplete task, then
#         assert every returned item has completed=True.
def test_filter_completed(client, auth_headers):
    create_task(client, auth_headers, title="Done task")
    incomplete_id = create_task(client, auth_headers, title="Not done")["id"]

    # Mark the first task done
    done_id = client.get("/tasks/", headers=auth_headers).json()[0]["id"]
    client.patch(f"/tasks/{done_id}", json={"completed": True}, headers=auth_headers)

    resp = client.get("/tasks/?completed=true", headers=auth_headers)
    assert resp.status_code == 200
    assert all(t["completed"] is True for t in resp.json())
    # The incomplete task should NOT appear
    ids = [t["id"] for t in resp.json()]
    assert incomplete_id not in ids


# ── CHUNK 4: Filter by priority ──────────────────────────────────
# WHAT: Verifies ?priority=low only returns low-priority tasks.
def test_filter_by_priority_low(client, auth_headers):
    create_task(client, auth_headers, title="Low task", priority="low")
    create_task(client, auth_headers, title="High task", priority="high")

    resp = client.get("/tasks/?priority=low", headers=auth_headers)
    assert resp.status_code == 200
    tasks = resp.json()
    assert len(tasks) >= 1
    assert all(t["priority"] == "low" for t in tasks)


# ── CHUNK 5: Filter by tag ────────────────────────────────────────
# WHAT: Creates a tag, assigns it to a task, then filters by tag name.
# WHY:  This exercises the JOIN between tasks and tags tables —
#       the most complex query in list_tasks.
def test_filter_by_tag(client, auth_headers):
    # Create a tag first
    tag_resp = client.post("/tags/", json={"name": "urgent"}, headers=auth_headers)
    assert tag_resp.status_code == 201
    tag_id = tag_resp.json()["id"]

    # Create a task with that tag
    create_task(client, auth_headers, title="Tagged task", tag_ids=[tag_id])
    create_task(client, auth_headers, title="Untagged task")

    resp = client.get("/tasks/?tag=urgent", headers=auth_headers)
    assert resp.status_code == 200
    tasks = resp.json()
    assert len(tasks) >= 1
    # Every returned task should have the 'urgent' tag
    for task in tasks:
        tag_names = [tg["name"] for tg in task["tags"]]
        assert "urgent" in tag_names


# ── CHUNK 6: Unauthenticated ──────────────────────────────────────
# WHAT: Verifies /tasks/ returns 401 with no token.
# WHY:  Security regression test — must fail if auth is removed.
def test_list_tasks_unauthenticated(client):
    resp = client.get("/tasks/")
    assert resp.status_code == 401


# ── CHUNK 7: Invalid priority value ──────────────────────────────
# WHAT: Passes an unknown priority string — expects an empty list, not 422.
# WHY:  priority is stored as a plain String in models.py, not an Enum.
#       The filter just queries WHERE priority='urgent' and gets zero rows.
#       This documents the current behavior explicitly.
def test_filter_invalid_priority_returns_empty(client, auth_headers):
    create_task(client, auth_headers, title="Real task", priority="medium")

    resp = client.get("/tasks/?priority=urgent", headers=auth_headers)
    assert resp.status_code == 200
    # No tasks have priority='urgent', so result is empty
    assert resp.json() == []

gemini "@routers/tasks.py What error paths does this code have that are not yet covered by @tests/test_tasks.py?"

Looking at routers/tasks.py, I can identify the following error paths
that have no corresponding test in test_tasks.py:

1. create_task — tag_ids references a non-existent tag ID
   Line 36: tags = db.query(models.Tag).filter(models.Tag.id.in_(task.tag_ids)).all()
   If tag_id=9999 is passed, SQLAlchemy silently ignores it (no error raised).
   Currently untested — behavior may be surprising to API consumers.

2. update_task — task belongs to a different user
   Lines 73-78: The 404 guard only checks owner_id == current_user.id.
   If user A tries to PATCH user B's task, they get 404 (correct).
   Not tested — a security regression could silently change this.

3. delete_task — task belongs to a different user
   Same pattern as update_task. Untested cross-user delete.

4. get_task — task exists but belongs to a different user
   Line 58: Returns 404 even if task exists (by design). Not tested.

5. update_task — tag_ids list is empty []
   Passing tag_ids=[] should clear all tags from a task.
   This is a valid use case with no test coverage.

Recommendation: Write tests for items 2, 3, and 4 first — they are
security-relevant. Items 1 and 5 are behavioral edge cases.

gemini "@routers/tasks.py @tests/conftest.py Generate pytest tests for:
1. Updating another user's task returns 404
2. Deleting another user's task returns 404
3. Getting another user's task returns 404
4. Updating a task with tag_ids=[] clears all tags"

import pytest


# ── Helper: create a second user and return their auth headers ────
# WHAT: Registers a new user with a unique email/username and logs in.
# WHY:  Cross-user isolation tests require two separate authenticated users.
@pytest.fixture()
def second_auth_headers(client):
    client.post("/users/register", json={
        "email": "other@example.com",
        "username": "otheruser",
        "password": "otherpass123",
    })
    resp = client.post("/users/login", data={
        "username": "otheruser",
        "password": "otherpass123",
    })
    return {"Authorization": f"Bearer {resp.json()['access_token']}"}


def test_cannot_update_other_users_task(client, auth_headers, second_auth_headers):
    """User A creates a task; User B should get 404 trying to PATCH it."""
    create_resp = client.post(
        "/tasks/", json={"title": "Private task"}, headers=auth_headers
    )
    task_id = create_resp.json()["id"]

    # User B tries to update User A's task
    resp = client.patch(
        f"/tasks/{task_id}", json={"title": "Hijacked"}, headers=second_auth_headers
    )
    assert resp.status_code == 404
    # Verify the original title is unchanged
    verify = client.get(f"/tasks/{task_id}", headers=auth_headers)
    assert verify.json()["title"] == "Private task"


def test_cannot_delete_other_users_task(client, auth_headers, second_auth_headers):
    """User A creates a task; User B should get 404 trying to DELETE it."""
    create_resp = client.post(
        "/tasks/", json={"title": "Do not delete"}, headers=auth_headers
    )
    task_id = create_resp.json()["id"]

    resp = client.delete(f"/tasks/{task_id}", headers=second_auth_headers)
    assert resp.status_code == 404
    # Task should still exist for the owner
    verify = client.get(f"/tasks/{task_id}", headers=auth_headers)
    assert verify.status_code == 200


def test_cannot_read_other_users_task(client, auth_headers, second_auth_headers):
    """User A creates a task; User B should get 404 on GET /{id}."""
    create_resp = client.post(
        "/tasks/", json={"title": "Secret task"}, headers=auth_headers
    )
    task_id = create_resp.json()["id"]

    resp = client.get(f"/tasks/{task_id}", headers=second_auth_headers)
    assert resp.status_code == 404


def test_clear_tags_with_empty_list(client, auth_headers):
    """Passing tag_ids=[] on PATCH should remove all tags from a task."""
    # Create a tag and a task that uses it
    tag_resp = client.post("/tags/", json={"name": "clearme"}, headers=auth_headers)
    tag_id = tag_resp.json()["id"]
    create_resp = client.post(
        "/tasks/", json={"title": "Tagged task", "tag_ids": [tag_id]}, headers=auth_headers
    )
    task_id = create_resp.json()["id"]
    assert len(create_resp.json()["tags"]) == 1

    # Now clear the tags
    resp = client.patch(f"/tasks/{task_id}", json={"tag_ids": []}, headers=auth_headers)
    assert resp.status_code == 200
    assert resp.json()["tags"] == []

cd sample-project/taskflow
pytest tests/ -v 2>&1 | Tee-Object -FilePath test-output.txt

FAILED tests/test_list_tasks.py::test_filter_by_priority_low - AssertionError: assert 3 >= 1
...
E   AssertionError: assert all(t["priority"] == "low" for t in tasks)
E   + where tasks = [{'completed': False, 'id': 1, 'priority': 'high', 'title': 'High task', ...},
                     {'completed': False, 'id': 2, 'priority': 'low',  'title': 'Low task',  ...},
                     {'completed': False, 'id': 3, 'priority': 'medium','title': 'Done task', ...}]

gemini "This pytest output shows test_filter_by_priority_low failing:

FAILED tests/test_list_tasks.py::test_filter_by_priority_low
AssertionError: assert all(t['priority'] == 'low' for t in tasks)
tasks = [high task, low task, medium task — all three returned]

Look at @tests/conftest.py and @tests/test_list_tasks.py and diagnose
why the filter is returning all tasks instead of just low-priority ones."

Root cause: Test database isolation problem.

The conftest.py uses a single SQLite file (test_taskflow.db) and the
db_session fixture does NOT roll back between tests. Tasks created by
earlier tests (test_create_task, test_list_tasks_happy_path) persist
in the database when test_filter_by_priority_low runs.

When you call GET /tasks/?priority=low, the query correctly filters by
priority — but the "High task" and "Medium task" from previous tests
are still in the database under the same user (auth_headers creates
the same testuser every time).

Fix: Add a database rollback or truncation between tests. The cleanest
approach is to use a transaction-per-test pattern:

In conftest.py, change db_session to:

  @pytest.fixture()
  def db_session():
      connection = engine.connect()
      transaction = connection.begin()
      session = TestingSessionLocal(bind=connection)
      try:
          yield session
      finally:
          session.close()
          transaction.rollback()
          connection.close()

This wraps each test in a transaction that gets rolled back afterward,
so each test starts with a clean database.

pip install pytest-cov

cd sample-project/taskflow
pytest tests/ --cov=. --cov-report=term-missing --cov-omit="tests/*,conftest.py"

----------- coverage: platform win32, python 3.12 -----------
Name                    Stmts   Miss  Cover   Missing
-----------------------------------------------------
auth.py                    26     11    58%   36-44, 47, 53-54
database.py                10      1    90%   27
main.py                     8      0   100%
models.py                  17      0   100%
routers/tags.py            18      8    56%   17, 22-29, 32-37
routers/tasks.py           45     12    73%   36-37, 57-62, 81-82, 99-106
routers/users.py           22      9    59%   15-16, 19-22, 35-37, 40-42
schemas.py                  0      0   100%
-----------------------------------------------------
TOTAL                     146     41    72%

gemini "Here's my TaskFlow coverage report:

auth.py         58%  Missing: 36-44, 47, 53-54
routers/tags.py 56%  Missing: 17, 22-29, 32-37

Look at @auth.py and @routers/tags.py. Which uncovered lines are most
important to test from a security perspective? Write pytest tests for
the top 3 gaps."

gemini "@auth.py @tests/conftest.py @routers/users.py Generate pytest tests for:
1. Registration with a duplicate email returns 400
2. Registration with a duplicate username returns 400
3. Login with wrong password returns 401
4. Accessing /tasks/ with a completely fake (not signed) JWT token returns 401
5. Accessing /tasks/ with a valid token for a user that no longer exists returns 401"

import pytest
from datetime import timedelta
from auth import create_access_token


# ── CHUNK 1: Registration errors ─────────────────────────────────
# WHAT: Tests that the uniqueness constraints on email/username work.
# WHY:  routers/users.py lines 15-18 — these are the "Email already
#       registered" and "Username already taken" branches.

def test_register_duplicate_email(client):
    payload = {"email": "dup@example.com", "username": "user1", "password": "pass123"}
    resp1 = client.post("/users/register", json=payload)
    assert resp1.status_code == 201

    # Same email, different username
    resp2 = client.post("/users/register", json={
        "email": "dup@example.com", "username": "user2", "password": "pass456"
    })
    assert resp2.status_code == 400
    assert "Email already registered" in resp2.json()["detail"]


def test_register_duplicate_username(client):
    client.post("/users/register", json={
        "email": "a@example.com", "username": "dupeuser", "password": "pass123"
    })
    resp = client.post("/users/register", json={
        "email": "b@example.com", "username": "dupeuser", "password": "pass456"
    })
    assert resp.status_code == 400
    assert "Username already taken" in resp.json()["detail"]


# ── CHUNK 2: Login failure ────────────────────────────────────────
# WHAT: Tests that wrong credentials return 401.
# WHY:  auth.py verify_password — tests the bcrypt comparison branch
#       where the hash doesn't match.
def test_login_wrong_password(client):
    client.post("/users/register", json={
        "email": "real@example.com", "username": "realuser", "password": "correctpass"
    })
    resp = client.post("/users/login", data={
        "username": "realuser",
        "password": "wrongpass"
    })
    assert resp.status_code == 401
    assert "Incorrect username or password" in resp.json()["detail"]


# ── CHUNK 3: Fake JWT ─────────────────────────────────────────────
# WHAT: Sends a completely forged (not signed by our SECRET_KEY) JWT.
# WHY:  Tests auth.py lines 46-48 — the JWTError catch block.
# GOTCHA: We use a hardcoded fake token. Any string that is not a
#         valid HS256 JWT signed by SECRET_KEY will trigger JWTError.
def test_fake_jwt_rejected(client):
    fake_token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.fake.signature"
    resp = client.get("/tasks/", headers={"Authorization": f"Bearer {fake_token}"})
    assert resp.status_code == 401


# ── CHUNK 4: Valid token for deleted user ─────────────────────────
# WHAT: Creates a user, logs them in, deletes the user from the DB,
#       then tries to use the token.
# WHY:  auth.py lines 53-55 — the "user is None" branch after
#       successful JWT decode. This is the "revoked credential" scenario.
# GOTCHA: We need direct DB access to delete the user without going
#         through the API (there's no DELETE /users endpoint).
def test_valid_token_deleted_user(client, db_session):
    import models
    # Register and log in
    client.post("/users/register", json={
        "email": "gone@example.com", "username": "goneuser", "password": "pass123"
    })
    login_resp = client.post("/users/login", data={
        "username": "goneuser", "password": "pass123"
    })
    token = login_resp.json()["access_token"]

    # Delete the user directly from the test database
    db_session.query(models.User).filter(
        models.User.username == "goneuser"
    ).delete()
    db_session.commit()

    # Token is technically valid (correct signature, not expired)
    # but the user no longer exists
    resp = client.get("/tasks/", headers={"Authorization": f"Bearer {token}"})
    assert resp.status_code == 401

gemini "@tests/test_tasks.py @routers/tasks.py
Suppose a developer accidentally inverted the completed filter:
  query = query.filter(models.Task.completed != completed)
instead of
  query = query.filter(models.Task.completed == completed)

Would any of the current tests catch this bug? If not, write a
mutation test that verifies the filter direction is correct."

Looking at the existing tests: test_filter_by_priority checks the priority
filter but there is no test for the completed filter. The original
test_list_tasks_empty just checks that the list endpoint returns a list.

With the inverted filter (completed != completed), a query for
?completed=true would return incomplete tasks, and vice versa.

NONE of the current 8 tests would catch this mutation.

Here is a mutation test that will catch it:

def test_completed_filter_direction(client, auth_headers):
    """Verifies the completed filter returns the RIGHT tasks, not the inverse."""
    # Create one completed and one incomplete task
    resp1 = client.post("/tasks/", json={"title": "Done"}, headers=auth_headers)
    done_id = resp1.json()["id"]
    resp2 = client.post("/tasks/", json={"title": "Not done"}, headers=auth_headers)
    pending_id = resp2.json()["id"]

    client.patch(f"/tasks/{done_id}", json={"completed": True}, headers=auth_headers)

    # Filter for completed=true — should contain done_id, NOT pending_id
    completed = client.get("/tasks/?completed=true", headers=auth_headers).json()
    completed_ids = [t["id"] for t in completed]
    assert done_id in completed_ids, "Completed task must appear in ?completed=true"
    assert pending_id not in completed_ids, "Pending task must NOT appear in ?completed=true"

    # Filter for completed=false — should contain pending_id, NOT done_id
    pending = client.get("/tasks/?completed=false", headers=auth_headers).json()
    pending_ids = [t["id"] for t in pending]
    assert pending_id in pending_ids, "Pending task must appear in ?completed=false"
    assert done_id not in pending_ids, "Completed task must NOT appear in ?completed=false"