Why Software Testing Is Important for Businesses in 2026

# test_checkout.py — a regression test that protects a revenue-critical flow
# If checkout breaks, the business loses money every minute.
# This test runs on every commit and would have caught the last outage.

import pytest
from checkout import Cart, PaymentGateway, CheckoutService


class FakePaymentGateway(PaymentGateway):
    def charge(self, amount, token):
        if amount <= 0:
            raise ValueError("Amount must be positive")
        return {"status": "succeeded", "charged": amount, "token": token}


def test_checkout_succeeds_for_valid_cart():
    cart = Cart(items=[{"sku": "A1", "price": 500, "qty": 2}])
    service = CheckoutService(payment=FakePaymentGateway())

    result = service.checkout(cart, token="tok_test")

    assert result["status"] == "succeeded"
    assert result["charged"] == 1000


def test_checkout_rejects_empty_cart():
    cart = Cart(items=[])
    service = CheckoutService(payment=FakePaymentGateway())

    with pytest.raises(ValueError):
        service.checkout(cart, token="tok_test")


def test_checkout_handles_zero_amount():
    cart = Cart(items=[{"sku": "FREE", "price": 0, "qty": 1}])
    service = CheckoutService(payment=FakePaymentGateway())

    with pytest.raises(ValueError):
        service.checkout(cart, token="tok_test")


# Why this test matters to the business:
# - It protects the highest-value flow in most companies: checkout.
# - It runs on every commit, so a regression gets caught before release.
# - It covers the edge cases that most outages come from: zero,
#   empty, negative, invalid.
# - It documents expected behaviour for new engineers joining the team.

# .github/workflows/test.yml — CI that blocks a bad release
# A single failing test stops the deploy. That is what "testing culture" means in practice.

name: Test & Build

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt

      - name: Run unit and integration tests
        run: pytest --cov=app --cov-fail-under=80

      - name: Fail the build if coverage drops
        run: |
          echo "Coverage threshold enforced above."

  # What this CI does for the business:
  # - No merge into main without passing tests.
  # - Coverage threshold prevents slow quality drift.
  # - Failures are visible and block deployment automatically.
  # - The process does not depend on an individual engineer's discipline.

  # What "testing culture" actually looks like:
  # - The pipeline is the source of truth.
  # - Leadership respects the pipeline, even under deadline pressure.
  # - Tests are treated as part of the product, not an extra cost.

# test_user_api.py — API tests that protect customer data
# Fast tests that catch the bugs that most often become compliance incidents.

import pytest
from fastapi.testclient import TestClient
from app.main import app
from app.db import reset_database


@pytest.fixture(autouse=True)
def clean_db():
    reset_database()
    yield
    reset_database()


@pytest.fixture
def client():
    return TestClient(app)


def test_create_user_requires_email_and_password(client):
    response = client.post("/users", json={})
    assert response.status_code == 422


def test_create_user_hashes_password(client):
    response = client.post(
        "/users",
        json={"email": "test@example.com", "password": "Password123!"},
    )
    assert response.status_code == 201
    stored = client.get("/users/test@example.com").json()
    assert stored["password_hash"].startswith("$argon2")
    assert stored["password_hash"] != "Password123!"


def test_user_cannot_access_other_user_profile(client):
    client.post(
        "/users",
        json={"email": "a@example.com", "password": "Password123!"},
    )
    client.post(
        "/users",
        json={"email": "b@example.com", "password": "Password123!"},
    )

    a_token = client.post(
        "/login", json={"email": "a@example.com", "password": "Password123!"}
    ).json()["token"]

    response = client.get(
        "/users/b@example.com/profile",
        headers={"Authorization": f"Bearer {a_token}"},
    )

    assert response.status_code == 403


# Why these tests matter to the business:
# - Passwords must never be stored in plain text — this is a compliance rule.
# - Access control must be enforced at the API layer.
# - These bugs, if released, become security incidents and regulatory fines.
# - The tests are fast and run on every commit — cheap insurance against expensive mistakes.