What to test in a backend
🏠The everyday picture
A car factory tests the brakes on their own, then the whole braking system fitted to a car, then takes the finished car for a test drive. Each level catches different problems.
📘What it really is
- The testing pyramid for a backend:
- many unit tests: services and pure functions (business rules, validation schemas), fast and precise;
- some integration tests: a service with a real repository, or several parts together;
- some API tests: real HTTP requests to the app, checking status codes, responses, authentication and errors;
-
a few end-to-end tests: frontend and backend together (Level 6).
-
What matters most to test in a backend:
- business rules and their edge cases;
- validation: bad input is refused;
- permissions: people can't do what they're not allowed to (Module 48). These are the most important tests in many apps;
- error responses: right status codes, no leaked details;
-
anything that's broken before (one bug, one test).
-
Test runners: Node's built-in
node --test(Module 26) works well; Vitest is popular and shares setup with your React tests. Either is fine; this module uses Vitest.
🖱️Try it
Install Vitest in enquiries-api. List, in a TESTING.md, the rules and permissions your API must enforce (for
example "only admins can delete", "closed enquiries can't be closed again", "signed-out requests get 401"). These
are the tests you'll write in this module.
✅Quick check
Which tests should there be most of, and why?
Show the answer
Unit tests: they're fast and pinpoint exactly what broke.
Why are permission tests so important?
Show the answer
A missing permission check lets people see or change data they shouldn't, often without anyone noticing.