# End-to-End Testing Checklist

Run these tests manually after the AI provider refactor. Requires a real AI API key.

---

## Prerequisites

- [ ] `.env` has a valid `AI_API_KEY`, `AI_BASE_URL`, and `AI_MODEL`
- [ ] `APP_ENV=local` for testing
- [ ] PHP dev server running: `php -S localhost:8000 -t public`
- [ ] Database schema applied and MySQL running
- [ ] Test files ready: a small PDF, DOCX, and PPTX with readable text

---

## Quick automated pre-check

```bash
php tests/run.php        # unit + mock AI tests (should be all green)
php tests/e2e-test.php   # config validation + output safety (should be all green)
```

---

## 1. Upload Flow

| # | Test | Steps | Expected |
|---|------|-------|----------|
| 1.1 | Upload PDF — questions only | Upload a text PDF, check "Questions", submit | Questions appear in accordions grouped by category. Copy/download buttons work. |
| 1.2 | Upload DOCX — suggestions only | Upload a DOCX, check "Suggestions", submit | Suggestions appear with confidence badges. Copy/download work. |
| 1.3 | Upload PPTX — both tasks | Upload a PPTX, check both, submit | Both cards appear. Slide numbers preserved in extraction summary. |
| 1.4 | Upload another | Click "Upload another" on results page | Returns to upload form. Fresh CSRF token. |

---

## 2. Config Errors

| # | Test | Expected |
|---|------|----------|
| 2.1 | Set `AI_API_KEY=bad-key` in `.env`, upload | "AI analysis is not configured correctly" or graceful API error. No key shown. |
| 2.2 | Set `AI_MODEL=nonexistent-model`, upload | Provider error → user-friendly message. No raw response shown. |
| 2.3 | Set `AI_BASE_URL=https://invalid.example.com/v1`, upload | "Could not reach the AI service" or graceful error. No DNS details shown. |
| 2.4 | Remove `AI_API_KEY` entirely, upload | "AI analysis is not configured correctly" on first attempt. |

---

## 3. AI Response Handling

| # | Test | Expected |
|---|------|----------|
| 3.1 | Write `AI_BASE_URL=http://localhost:9999/v1` in local env, upload | Should attempt request (HTTP allowed in local). Graceful network error. |
| 3.2 | Write `AI_BASE_URL=http://localhost:9999/v1` with `APP_ENV=production` | "AI analysis is not configured correctly" (non-HTTPS blocked). |

---

## 4. Output Safety — View Page Source After Each

| # | Check | Confirmed |
|---|-------|-----------|
| 4.1 | No raw stack traces appear in HTML | ⬜ |
| 4.2 | No provider response dumps (`choices`, `finish_reason`, `error.type`) appear in HTML | ⬜ |
| 4.3 | No uploaded file paths (`/storage/uploads/`, `C:\`, `/var/`) appear in HTML | ⬜ |
| 4.4 | No API key pattern (`sk-`, `Bearer`) appears in HTML | ⬜ |
| 4.5 | No raw error codes (`HTTP 500`, `cURL error`) appear in HTML | ⬜ |
| 4.6 | AI-generated text is rendered as text, not HTML | ⬜ |
| 4.7 | Copy/download content is safe (no paths, no secrets) | ⬜ |

---

## 5. Partial Results

| # | Test | Steps | Expected |
|---|------|-------|----------|
| 5.1 | Check both tasks, AI returns valid questions but fails suggestions | Hard to trigger manually — verify via mock test: `php tests/e2e-test.php` passes the "one succeeds, other fails" test | Mock test confirms partial flow |

---

## 6. Mobile / Responsive

| # | Test | Expected |
|---|------|----------|
| 6.1 | View upload form at 360×800 | Form fits. No horizontal scroll. |
| 6.2 | View results at 360×800 | Accordions readable. Copy buttons tappable. |
| 6.3 | Upload a file with a 100+ character filename | Filename wraps. No overflow. |
| 6.4 | Tap accordion on mobile | Opens smoothly. Copy icon doesn't toggle accordion. |

---

## 7. Provider-Specific (run for each provider)

### DeepSeek

| # | Check | Confirmed |
|---|-------|-----------|
| 7.1 | Set `AI_PROVIDER=deepseek`, `AI_BASE_URL=https://api.deepseek.com`, `AI_MODEL=deepseek-v4-flash` | ⬜ |
| 7.2 | Upload a document | Questions/suggestions generated |
| 7.3 | Check: `response_format: json_object` is NOT in the request (if you have a proxy/monitor) | ⬜ |
| 7.4 | Check: JSON instruction is prepended to user prompt (if monitor available) | ⬜ |

### OpenAI

| # | Check | Confirmed |
|---|-------|-----------|
| 7.5 | Set `AI_PROVIDER=openai`, `AI_BASE_URL=https://api.openai.com/v1`, `AI_MODEL=gpt-4o` | ⬜ |
| 7.6 | Upload a document | Questions/suggestions generated |
| 7.7 | Check: `response_format: json_object` IS in the request | ⬜ |

---

## 8. Regressions

| # | Check | Confirmed |
|---|-------|-----------|
| 8.1 | No PHP warnings/notices in browser output | ⬜ |
| 8.2 | No PHP warnings in error log (except expected cURL/network errors) | ⬜ |
| 8.3 | `php tests/run.php` — all 46 tests pass | ⬜ |
| 8.4 | `php tests/e2e-test.php` — all tests pass | ⬜ |
| 8.5 | Database `documents` table shows correct status flow: uploaded → text_extracted → analyzed | ⬜ |
| 8.6 | Database `ai_results` table has rows for completed tasks | ⬜ |

---

## Sign-Off

| Date | Tester | Provider | Results |
|------|--------|----------|---------|
|      |        |          |         |
|      |        |          |         |