high priority low complexity integration pending testing specialist Tier 4

Acceptance Criteria

Integration test: PeriodPresetList renders all seeded presets fetched from the Supabase test project within 3 seconds of widget mount
Integration test: when network is disabled (simulated via interceptor or offline Supabase client), PeriodPresetList still renders stale cached presets
Integration test: selecting a valid DateTimeRange in CustomDateRangePicker and submitting produces a BufdirAggregationRepository.queryRecordCount() call with start_date and end_date parameters matching the selected range exactly
Integration test: seeded test data returns a non-zero record count for the test organisation's seeded date range
Integration test: an empty date range (start == end) results in a zero record count without throwing an exception
Test organisation ID used in the integration test is isolated (test-only UUID) and does not pollute shared Supabase environments
All integration tests can be run in CI with environment variables for Supabase test project URL and anon key

Technical Requirements

frameworks
Flutter
flutter_test
Riverpod (ProviderContainer for integration overrides)
Supabase Flutter SDK
apis
Supabase PostgreSQL 15 (test project)
Supabase Auth (test user token)
data models
activity
annual_summary
bufdir_column_schema
bufdir_export_audit_log
performance requirements
Preset load from Supabase completes within 3 seconds on a standard CI network
Offline cache read completes within 200ms
security requirements
Supabase test project credentials stored in CI environment variables (SUPABASE_TEST_URL, SUPABASE_TEST_ANON_KEY) — never committed to source
RLS on the test project must mirror production RLS policies to validate security boundaries
Test user JWT scoped to the test organisation only
ui components
PeriodPresetList
CustomDateRangePicker

Execution Context

Execution Tier
Tier 4

Tier 4 - 323 tasks

Can start after Tier 3 completes

Implementation Notes

Use a dedicated Supabase test project (separate from staging/prod) to avoid polluting real data. Store seeding and teardown SQL in a test/fixtures/ directory committed to the repo. For offline simulation, override the Supabase HTTP client with an interceptor that returns a network error after the first successful load — this validates the cache layer without requiring device network toggling. Use ProviderContainer overrides to inject the test-project Supabase client into repositories.

Assert repository query parameters by capturing calls via a spy wrapper around BufdirAggregationRepository rather than only asserting UI output — this makes the test more precise. Ensure the integration test file is under integration_test/ (not test/) so it is excluded from unit test runs and only executed explicitly.

Testing Requirements

Integration tests using flutter_test with a real Supabase test project (not mocked). Seed the test database with a known organisation ID, 3 preset configurations, and 10 activity records within a specific date range before running tests. Use a teardown hook to delete seeded data after each test run. Test scenarios: (1) online happy path — presets load and render, (2) offline fallback — disable network, assert stale cache renders, (3) date range selection triggers correct repository query parameters, (4) empty range edge case.

Run via flutter test integration_test/ in CI with Supabase credentials injected as env vars.

Component
Bufdir Aggregation Repository
data low
Epic Risks (3)
high impact medium prob security

Supabase RLS policies for period preset configuration may be missing or incorrectly scoped, causing one organisation's presets to leak to another or write operations to fail silently.

Mitigation & Contingency

Mitigation: Define and review RLS policies for the bufdir_period_presets table in the migration file before any repository code is written. Include an integration test that verifies cross-organisation isolation using two distinct org credentials.

Contingency: If RLS is misconfigured in production, immediately disable the period preset fetch endpoint and fall back to hardcoded global presets until the policy is corrected and redeployed.

medium impact medium prob technical

The activities table may lack a composite index on (organisation_id, activity_date), causing the range count query in BufdirAggregationRepository to perform a full table scan and exceed acceptable response time for large organisations.

Mitigation & Contingency

Mitigation: Add a migration that creates a composite index on (organisation_id, activity_date) as part of this epic. Benchmark the count query against a representative dataset (10 000+ rows) before marking the epic complete.

Contingency: If query latency is unacceptable after indexing, move the count query to a Supabase RPC function that leverages a materialised view or partial index, accepting a slight staleness window.

medium impact medium prob technical

Flutter's native date picker widgets have known accessibility gaps (missing semantic labels, non-standard focus traversal) that may prevent WCAG 2.2 AA compliance out of the box, requiring a custom implementation.

Mitigation & Contingency

Mitigation: Evaluate third-party accessible date picker packages (e.g., table_calendar with custom semantics) against WCAG 2.2 AA criteria before beginning implementation. Document the chosen approach in the epic kick-off.

Contingency: If no package meets accessibility requirements, implement a simple text-field-based date entry with explicit semantic labels and format hints as an accessible fallback, deferring a fully visual calendar to a later iteration.