skills/vitest-testing-patterns/SKILL.md
Write tests using Vitest and React Testing Library. Use when creating unit tests, component tests, integration tests, or mocking dependencies. Activates for test file creation, mock patterns, coverage, and testing best practices.
npx skillsauth add curiositech/windags-skills vitest-testing-patternsInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Write effective tests using Vitest and React Testing Library following project conventions.
If testing authentication flows:
getSession() → test 401/200 responsesuseAuth → test loading/authenticated/unauthenticated statesIf testing async operations:
waitFor() for state changes, mock fetch/axiosuserEvent.setup() + await user.click()vi.useFakeTimers() + vi.advanceTimersByTime()If testing form interactions:
getByRole('textbox') + userEvent.type()getByLabelText() for accessibilityIf testing error boundaries:
If choosing mock strategy:
vi.mock('@/lib/api'))Mock Pollution: Tests affect each other due to shared mock state
vi.clearAllMocks() in beforeEach() or afterEach()Over-Mocking: Mocking too much implementation detail, tests become brittle
Async Race Conditions: Tests fail sporadically due to timing issues
waitFor() or findBy* queries instead of getBy* for async contentQuery Priority Violations: Using low-priority queries when accessible ones exist
getByTestId or querySelector for interactive elementsgetByRole('button'), getByLabelText(), etc.Mock Implementation Drift: Mocks don't match real API changes
Testing a form component with validation and API submission:
// 1. SETUP - Mock dependencies at module level
vi.mock('@/hooks/useAuth', () => ({
useAuth: vi.fn().mockReturnValue({
user: { id: 'user-123' },
isLoading: false,
}),
}));
vi.mock('@/lib/api', () => ({
submitForm: vi.fn(),
}));
// 2. DECISION - Component test with form interaction
describe('ContactForm', () => {
beforeEach(() => {
vi.clearAllMocks(); // Prevent mock pollution
});
it('handles successful form submission', async () => {
// 3. SETUP - Configure mocks for success case
const mockSubmit = vi.mocked(submitForm);
mockSubmit.mockResolvedValue({ success: true });
const user = userEvent.setup();
render(<ContactForm />);
// 4. DECISION - Use accessible queries (getByLabelText vs getByTestId)
await user.type(screen.getByLabelText(/name/i), 'John Doe');
await user.type(screen.getByLabelText(/email/i), '[email protected]');
// 5. ACTION - Submit form
await user.click(screen.getByRole('button', { name: /submit/i }));
// 6. DECISION - Use waitFor for async state changes
await waitFor(() => {
expect(screen.getByText(/success/i)).toBeInTheDocument();
});
// 7. VERIFY - Mock was called with correct data
expect(mockSubmit).toHaveBeenCalledWith({
name: 'John Doe',
email: '[email protected]',
});
});
it('displays validation errors', async () => {
// Expert catches: Test error state, not just happy path
const user = userEvent.setup();
render(<ContactForm />);
// Submit empty form
await user.click(screen.getByRole('button', { name: /submit/i }));
// Verify validation errors appear
expect(screen.getByText(/name is required/i)).toBeInTheDocument();
expect(screen.getByText(/email is required/i)).toBeInTheDocument();
// Verify API was not called with invalid data
expect(submitForm).not.toHaveBeenCalled();
});
});
Novice misses: Testing only happy path, using getByTestId, not cleaning mocks
Expert catches: Error states, accessible queries, mock verification, async handling
waitFor() or findBy* queriesvi.clearAllMocks() in hooks)getByRole() or getByLabelText()toHaveBeenCalledWith() for critical callsact() warnings in test outputuserEvent not fireEvent❌ DO NOT use for:
playwright-testing skill insteadperformance-testing skill insteadopenapi-testing skill insteadvisual-testing skill instead✅ USE this skill for:
tools
Building resilient distributed systems with circuit breakers, retries with full-jitter exponential backoff, retry budgets (per-request 3-attempt + per-client 10% ratio per Google SRE), deadline propagation, and the cascading-failure math (4 layers × 3 retries = 64x amplification). Grounded in Resilience4j, Microsoft Cloud Patterns, AWS Architecture Blog (Marc Brooker), and Google SRE Book.
testing
Designing HTTP cache headers that work correctly across browsers, CDNs, and shared proxies — `Cache-Control` directives per RFC 9111, `stale-while-revalidate` and `stale-if-error` per RFC 5861, the Vary header for varying responses, and surrogate keys for tag-based purging. Grounded in IETF RFCs and Cloudflare/Fastly docs.
development
Use when designing or fixing a Content Security Policy on a real site, choosing between nonce-based and hash-based CSP, adding strict-dynamic, debugging "Refused to execute inline script" errors, deploying CSP in report-only mode first, configuring report-to / report-uri, or auditing an existing policy for unsafe-inline / unsafe-eval / wildcards. Triggers: "CSP blocks legitimate inline script", strict-dynamic, nonce-{RANDOM}, sha256-{HASH}, object-src none, base-uri none, frame-ancestors, Trusted Types, X-Content-Security-Policy obsolete, report-only vs enforced. NOT for general HTTP security headers (HSTS, COOP/COEP), Trusted Types deep dive, CORS configuration, or building a WAF.
tools
Choosing and operating an HTTP API versioning strategy that doesn't break clients — Stripe's date-based pinned versions, the Deprecation/Sunset header pair (RFC 9745 + RFC 8594), URI vs header vs media-type approaches, and the version-transformer pattern. Grounded in Stripe's published architecture and IETF RFCs.