Writing Tests With Claude Code That Actually Catch Bugs

#testing #claudecode #typescript #webdev

Most developers treat testing as an afterthought. Claude Code can write tests fast -- but fast bad tests are worse than no tests. Here's how to get tests that actually catch bugs.

The Right Prompt Pattern

Bad:

> Write tests for this function

Good:

> Write tests for the createUser function in src/lib/users.ts.
>
> Before writing, read the function and identify:
> 1. All valid inputs
> 2. All invalid inputs and what should happen
> 3. Edge cases
> 4. Side effects (DB writes, emails sent)
>
> Then write tests covering:
> - Happy path
> - Each validation failure (one test per mode)
> - Edge cases
> - Side effect verification
>
> Do NOT test implementation details.
> Test observable behavior: what the caller gets back, what changed in the world.

Behavior vs Implementation Tests

// BAD: tests implementation details
it('calls hashPassword before creating user', async () => {
  const hashSpy = jest.spyOn(bcrypt, 'hash')
  await createUser({ email: 'test@example.com', password: 'pass123' })
  expect(hashSpy).toHaveBeenCalled()  // Who cares HOW it hashes?
})

// GOOD: tests observable behavior
it('stores a hashed password, not plaintext', async () => {
  await createUser({ email: 'test@example.com', password: 'pass123' })
  const user = await db.user.findUnique({ where: { email: 'test@example.com' } })
  expect(user?.passwordHash).not.toBe('pass123')
  expect(user?.passwordHash).toMatch(/^\$2[aby]\$/)
})

The behavior test catches the same bugs but doesn't break when you change the hashing library.

The Coverage Prompt for API Routes

> Write tests for the POST /api/users route.
>
> Required cases:
> - Unauthenticated (401)
> - Valid payload (201 with user object)
> - Missing email (422)
> - Invalid email format (422 with field error)
> - Duplicate email (409)
> - Database error (500 with generic message, NOT DB error details)
>
> For success cases, verify side effects:
> - User exists in DB after creation
> - Welcome email was queued

Security-Focused Test Generation

> Read the file reader implementation in src/tools/file-reader.ts.
>
> Generate security tests. For each, consider what an attacker would try:
> - Path traversal: '../../../etc/passwd'
> - Null bytes: 'file.txt\x00.jpg'
> - Absolute paths outside allowed directory
> - Very long paths (1000+ chars)
>
> Each test should verify malicious input is rejected with a clear error.

The Verification Step

After Claude writes tests, have it verify quality:

> Run the tests. For each passing test, describe:
> - What change to the implementation would make it fail?
> - Why does this test matter?
>
> Fix any failing tests. Report: total, passing, failing.

This forces Claude to reason about test value, not just coverage count.

Testing Streaming AI Routes

async function collectStream(response: Response): Promise<string> {
  const reader = response.body!.getReader()
  const decoder = new TextDecoder()
  let result = ''
  while (true) {
    const { done, value } = await reader.read()
    if (done) break
    result += decoder.decode(value)
  }
  return result
}

it('streams response for valid input', async () => {
  jest.mocked(anthropic.messages.stream).mockReturnValue(mockStream('Hello world'))
  const response = await POST(mockRequest({ prompt: 'Say hello' }))
  expect(response.status).toBe(200)
  const content = await collectStream(response)
  expect(content).toBe('Hello world')
})