# Acceptance Tests

This package contains black-box Go tests for the staging API surface.

## Local smoke run

```bash
go test ./tests/acceptance/... -staging-url=https://tapi.hifast.biz
```

Without credentials, tests that require admin/user login or NodeSecret are skipped and unauthenticated error-path checks still run.

## Required secrets

The staging workflow should provide these values through GitHub Actions secrets or environment variables:

- `ACCEPTANCE_ADMIN_EMAIL`
- `ACCEPTANCE_ADMIN_PASSWORD`
- `ACCEPTANCE_USER_EMAIL`
- `ACCEPTANCE_USER_PASSWORD`
- `STAGING_DB_HOST`
- `STAGING_DB_USER`
- `STAGING_DB_PASSWORD`
- `STAGING_DB_NAME`
- `STAGING_REDIS_ADDR`
- `STAGING_REDIS_PASSWORD`
- `STAGING_BASE_URL`

`ACCEPTANCE_NODE_SECRET` is optional. When DB credentials are present, the loader reads NodeSecret from the staging `system` table instead of storing it as a long-lived secret.

## Useful flags

- `-staging-url`: API base URL.
- `-run-id`: run identifier used for QA-owned transient data.
- `-report-path`: write a JSON summary artifact.
- `-seed-sql`: seed SQL path, default `fixtures/seed.sql`.
- `-node-server-id` and `-node-protocol`: node smoke target.

## Fixture rules

Seed data must use a `qa_acceptance_` prefix or the provided `RUN_ID`. Cleanup must only delete QA-prefixed rows and Redis keys. Do not update or delete production-like staging data.