latchd/docs/e2e-testing.md

End-to-end testing

Latchd has two test layers:

• make integration-test builds the binary and exercises metadata, TOML validation, preflight, and the non-authenticating preview path. It does not need PAM credentials, root, a VT, X11, or Wayland.
• make pam-fixture-test installs a unique temporary pam_deny service only when run as root, executes the ignored authentication/password-change fault tests, and removes the service on exit. Non-root runs report SKIP.
• make system-e2e probes the host for PAM, faillock, VT, X11, Wayland, and systemd-logind capabilities. Missing capabilities are reported as SKIP, never as a successful test. Use make system-e2e-strict only in a prepared VM or privileged runner; strict mode fails when a capability is unavailable.

The Docker test image runs the first layer and starts an isolated Xvfb server when available. It does not use host display sockets, host PAM files, or a host VT. The password-change path is covered by FFI/conversation tests in the container, but a real PAM password rotation and login handoff require a disposable VM with a dedicated test account and an explicitly provisioned PAM policy. The container probe intentionally reports those checks as capability information only.

For a local release-style run:

make integration-test
make pam-fixture-test
make docker-test
make system-e2e

For a VM with a real seat, compositor, and logind:

make system-e2e-strict

Do not run strict mode on a normal developer workstation unless the VM's display-manager handoff and test PAM policy are isolated from the host.