test-plan.md

id	test-plan-auth-001
type	test-plan
project	example-app
feature	auth
status	draft
version	0.1.0
owner_role	QA
depends_on	spec-auth-001 tasks-auth-001
satisfies	REQ-001 REQ-007
linked_decisions
last_validated	2026-06-07

Test Plan — example-app · auth

The verification strategy: every REQ acceptance criterion maps to a named test. Gate G5: no requirement ships untested. Each test set has a {#tp-nnn} anchor that tasks.md and traceability.md link to.

Split

Level	Scope
Unit	pure functions (hashing, counter logic)
Integration	route + store + event bus
E2E	<full sign-up → sign-in → lockout journey>

---

TP-001: Registration {#tp-001}

Covers REQ-001. Implemented by T-019.

AC	Test name	Level	Asserts
AC-001.1	auth.register.valid	integration	valid → 201, row created
AC-001.2	auth.register.duplicate	integration	duplicate email → 409
AC-001.3	auth.hash.no_plaintext	unit	stored value ≠ plaintext

TP-007: Login & lockout {#tp-007}

Covers REQ-007. Implemented by T-018.

AC	Test name	Level	Asserts
AC-007.1	auth.login.invalid	unit	invalid → 401, counter++
AC-007.2	auth.lockout.threshold	integration	6 fails/15min → lock + account.locked
AC-007.3	auth.login.while_locked	integration	locked → 423

TP-NNN: <title> {#tp-nnn}

Covers <REQ-*>. Implemented by <T-*>. <AC → test table>

---

Non-functional tests

• Login path p95 latency ≤ 200 ms incl. lockout check (REQ-007).
• <load / security / accessibility tests as applicable>

Traceability rows (emitted to traceability.md)

REQ-001 → AC-001.1 auth.register.valid · AC-001.2 auth.register.duplicate · AC-001.3 auth.hash.no_plaintext
REQ-007 → AC-007.1 auth.login.invalid · AC-007.2 auth.lockout.threshold · AC-007.3 auth.login.while_locked