---
description: Generate security tests with priority ordering
argument-hint: "[project-path: defaults to .]"
allowed-tools: Read, Write, Bash, Grep, Glob
---

Generate tests for security-critical paths, prioritized by risk.

## Steps

1. **Load findings**
   - Read latest from `.vaspera/audit/*.json`
   - Identify files with security findings but no tests
   - Check existing test coverage in `src/__tests__/` or `*.test.ts`

2. **Priority 1: API Routes** (highest risk)
   For each API route without tests:
   ```typescript
   describe('POST /api/resource', () => {
     it('returns 200 for valid authenticated request', async () => {
       // Happy path
     });
     
     it('returns 401 for unauthenticated request', async () => {
       // Auth failure
     });
     
     it('returns 400 for invalid input', async () => {
       // Validation failure
     });
     
     it('returns 500 with safe error for database failure', async () => {
       // Error doesn't leak internal details
     });
   });
   ```

3. **Priority 2: Data Access Layer**
   For database functions without tests:
   ```typescript
   describe('getUserById', () => {
     it('returns user for valid id', async () => {
       // Correct data shape
     });
     
     it('throws NotFoundError for invalid id', async () => {
       // Proper error type
     });
     
     it('does not leak database errors', async () => {
       // Error wrapping
     });
   });
   ```

4. **Priority 3: Critical UI Components**
   For forms and auth-gated views:
   ```typescript
   describe('LoginForm', () => {
     it('validates email format', () => {});
     it('shows error for invalid credentials', () => {});
     it('redirects on success', () => {});
   });
   
   describe('ProtectedPage', () => {
     it('redirects unauthenticated users', () => {});
     it('renders for authenticated users', () => {});
   });
   ```

5. **Priority 4: Utility Functions**
   For security-related utilities:
   ```typescript
   describe('sanitizeInput', () => {
     it('handles null', () => {});
     it('handles undefined', () => {});
     it('handles empty string', () => {});
     it('strips XSS payloads', () => {});
   });
   ```

6. **Write test files**
   - Follow naming: `[filename].test.ts`
   - Place in `src/__tests__/` mirroring module path
   - Use clear descriptions
   - Mock external dependencies
   - NO snapshot tests

7. **Run tests**
   - `npm test` to verify all pass
   - Report: N tests added, X files now covered

8. **Coverage report**
   - If coverage tool available, show delta
   - Identify remaining gaps

## Important

- Focus on SECURITY paths, not general coverage
- Tests should verify auth, validation, and error handling
- Mock external services (database, APIs)
- No flaky tests — deterministic assertions only