[amar-python]

Summary

Reorganises the test suite into six category folders and adds new test cases to each. It also fixes the defects the new tests found: accessibility issues in the frontend, plus two bugs tracked as #42 (preview parse_failed) and #43 (CORS port). Finally, it fixes the CI database setting that has kept the integration (postgres service) job red on main.

Fixes #42. Fixes #43. Both are already closed, with the test evidence in their comments.

Group	Folder	Moved in	New
Unit	tests/unit/, csv-table-hub-main/src/__tests__/unit/	9 pytest files + 6 vitest files	test_csv_parse.py, test_config_auth.py, test_db_pool.py, preview-contract.test.ts
System	tests/system/	api_coverage, e2e_pipeline, arbitrary_shapes	test_system_api.py: full upload→list→rows→delete→audit lifecycle, typing, duplicates, overwrite, limits, T&E mode
System integration	tests/system_integration/	api_integration, te_loader_integration, parity, environments/	test_sit_frontend_contract.py: live API responses checked against the zod enums parsed from csv.functions.ts, plus API↔PostgreSQL bootstrap and schema checks
Performance	tests/performance/	—	100k-row parse, 20k-row upload, 8 concurrent uploads, p95 read latency, constant query count. PERF_BUDGET_SCALE scales the budgets
Accessibility	tests/accessibility/	—	Playwright + axe-core (WCAG 2.1 A/AA) against the Vite dev server with a mocked API, plus keyboard, focus-trap, heading and 320px-reflow checks
UAT	tests/uat/	issue #4 / #5 acceptance tests	test_uat_user_stories.py: 7 user stories as Given/When/Then, using build/csv/samples

• tests/conftest.py gives every test the marker for its folder (system, sit, performance, accessibility, uat, plus the existing unit). There are new shared fixtures: live_api, registry_cleanup, te_org_cleanup, destructive_enabled.
• docs/TEST_CASES.md is generated by scripts/test_catalogue.py. It lists every test case with ID, file and objective, grouped by category. CI runs --check to keep it current.
• There are new Makefile targets test-unit, test-system, test-sit, test-performance, test-accessibility and test-uat. tests/README.md explains each group.
• The psql-driven SQL suite (tests/suites, tests/framework, run_all_tests.sql) stays where it is, because the Tier S eval and the deploy scripts reference those paths. The catalogue lists it under system integration.

Accessibility fixes (found by the new tests)

• Accessible names added to the unlabeled Select triggers (Rows per page, column type, T&E table, status filter), to the icon-only download menu on the audit page, and to the upload progress bar.
• Contrast fixes: inline <code> chips now use text-foreground; the "ok" count and the error pill now use darker emerald-700 / red-700 text.
• Sonner toast text (light theme, richColors) is darkened in styles.css. All four types were below AA: success 4.29, info 4.35, warning 3.07, error 4.36:1. They are now 5.23 / 6.46 / 6.72 / 5.75:1.
• The test harness now waits for CSS animations to finish before each axe scan. One CI run failed because the dialog was scanned mid-fade-in. Reproduced by freezing the fade at 50ms: 6 color-contrast nodes, versus none once it finishes.

API ↔ frontend fixes

• Frontend rejects /api/csv/preview reason "parse_failed" — T&E table suggestion silently lost #42, preview parse_failed: /api/csv/preview returns reason: "parse_failed" (with a message) when the parser throws. The frontend's csvPreviewResultSchema only allowed empty | header_only | no_columns, so the zod parse threw and the upload flow silently dropped the T&E-table suggestion. The schema now accepts parse_failed and the optional message. Covered by preview-contract.test.ts (vitest) and SIT-17/18.
• Default CORS_ORIGINS omits the frontend dev server port 8080 — browser calls to the API are blocked #43, CORS: the default CORS_ORIGINS now includes http://localhost:8080, the port the Vite dev server actually uses; 5173 and 3000 are kept. env.dev.example, docs/ENV_VARIABLES.md, the README and start-frontend.ps1 (which said 5173) are updated to match. Unit tests check the default, a preflight from :8080, and that unlisted origins are still refused.

CI

• Pre-existing failure fixed: the PostgreSQL test step now uses PGDATABASE=te_mgmt_dev. te_dev is deployed there, so every T&E-mode test was failing on main with relation te_dev.organisations does not exist.
• That job now runs --markers "not accessibility". A new accessibility job runs vitest and the Playwright + axe suite.
• bun.lock is synced. It was missing jsdom and vitest, so bun install --frozen-lockfile failed. package-lock.json is out of sync too; this PR does not touch it.

Test plan

• pytest -m "not accessibility" against a local PG 16 with dev and test deployed: 378 passed (staging/prod deselected locally; CI deploys all four and passes 392/392)
• Frontend rejects /api/csv/preview reason "parse_failed" — T&E table suggestion silently lost #42/Default CORS_ORIGINS omits the frontend dev server port 8080 — browser calls to the API are blocked #43 regression tests fail on the pre-fix source (15268ae~1) and pass with the fix
• scripts/test_report.py --markers "unit or regression or security or snapshot" --strict: 0 skipped
• pytest tests/accessibility: 23 passed, twice in a row locally and in CI
• npx vitest run: 101 passed. tsc --noEmit clean
• make lint (flake8 + bandit) clean. markdownlint clean on the new/changed docs

🤖 Generated with Claude Code

https://claude.ai/code/session_012CS4GeHuWThWvU74AkBL6E