您是否在验收测试或单元测试中测试所有无效电子邮件和密码的组合，以进行登录？

Question

I've written an acceptance test for a login using Codeception, which tests whether a user can:

1. Login with valid credentials

The login with valid credentials opens the page, fills the fields, submits, and checks to see the user is now in the dashboard.

2. Not login with invalid credentials

The login with invalid credentials does the same, but on submit I check for a message saying the username and password combination is incorrect

3. Not login with empty credentials

The login with empty credentials does the same, but on submit I check for messages in elements that appear under the form inputs indicating the field is required.

This seems like an almost acceptable suite of tests for a login (it might not be I really wouldn't know), but then it doesn't test different combinations of invalid usernames (email addresses) and password (minlength of 8 characters), but I'm not sure whether trying to submit an array of potentially invalid emails, and checking the UI is what you want to do in an acceptance test... is it more of a unit test?

Thinking ahead where do you draw the line on acceptance tests as this is a relatively small example, but some of the forms coming up are quite large so if I thought of a 30+ input form what should I be trying to achieve in my acceptance test and what should be spun off to a unit test?

Answer 1

Unit tests and acceptance tests serve different purposes, provide you a different level of detail and usually are written by different people (software engineer and test engineer correspondingly).

In case your login acceptance tests fail you will know that login functionality is not working as intended. In case your unit tests fail you will know what piece of code is not working as intended because it has access to the actual code (eg your password hashing algorithm is not working).

When writing test cases it makes sense to have a look at Equivalence Class Partitioning . For the password, you'll have to check: empty password, 7-character password, 8-character password, password with the length between 0 and 7, password with invalid characters, etc (depends on your requirements).