Testing & Credentials

Comprehensive guide for testing FlowCampaign functionality, managing credentials securely, and ensuring email deliverability.

Testing Environments

Development Environment

URL: http://localhost:5173 (Frontend), http://localhost:8787 (Backend)
Database: SQLite (local / Drizzle)
Email Provider: Mock SMTP / Sandbox (no actual emails sent)
Features: Full functionality with local data
Purpose: Local development and testing

Staging Environment

URL: https://staging.mails.nssoftwaresolutions.in
Database: SQLite / Cloudflare D1 / Turso
Email Provider: Sandbox mode (emails logged but not sent)
Features: Production-like configuration
Purpose: Pre-production testing and QA

Production Environment

URL: https://mails.nssoftwaresolutions.in
Database: Cloudflare D1 / Turso
Email Provider: ZeptoMail + SMTP (actual email delivery)
Features: Full production deployment
Purpose: Live application for end users

Test Credentials

Default Admin Account

Environment	Email	Password	Role
Development	`admin@flowcampaign.com`	`admin123`	Admin
Staging	`admin@flowcampaign.com`	`StagingAdmin2024!`	Admin
Production	Custom setup required	Custom password	Admin

Test User Accounts

Email	Password	Purpose
`marketing@test.com`	`MarketingTest123!`	Marketing team testing
`developer@test.com`	`DeveloperTest456!`	Developer API testing
`analyst@test.com`	`AnalystTest789!`	Analytics dashboard testing

Testing Workflows

1. Email Provider Testing

Mock SMTP (Development)

# Start mock SMTP server
npm run test:smtp

# View captured emails
# Visit http://localhost:1080

ZeptoMail Sandbox

Use test API key: sandbox_apikey_1234567890
All emails are logged but not delivered
Check logs at: logs/zeptomail-sandbox.log

SMTP Sandbox

Host: smtp.mailtrap.io
Port: 2525
Username: sandbox_username
Password: sandbox_password
Monitor: https://mailtrap.io/inboxes

2. Campaign Testing

Test Campaign Creation

// Create test campaign
const testCampaign = {
  name: "Test Campaign - " + Date.now(),
  subject: "Test Email Subject",
  content: "<h1>Test Email</h1><p>This is a test.</p>",
  audience: {
    type: "test",
    test_emails: ["test@example.com"]
  },
  settings: {
    send_test: true,
    skip_actual_send: true
  }
};

A/B Testing Setup

{
  "test_type": "subject_line",
  "variations": [
    {"subject": "Welcome to our platform!"},
    {"subject": "Get started with our amazing service"}
  ],
  "test_size": 100,
  "winner_criteria": "highest_open_rate",
  "test_duration_hours": 24
}

3. API Testing

Test API Key

# Environment variable
export FLOWCAMPAIGN_API_KEY="test_key_development_123"

# Test endpoint
curl -X GET http://localhost:3000/api/v1/health \
  -H "Authorization: Bearer test_key_development_123"

Postman Collection

Import the Postman collection from:

File: docs/postman/FlowCampaign.postman_collection.json
Environment: docs/postman/FlowCampaign-Dev.postman_environment.json

Automated Tests

# Run unit tests
npm test

# Run integration tests
npm run test:integration

# Run E2E tests
npm run test:e2e

Credential Management

Secure Storage

Environment Variables

# .env file (development)
ZEPTOMAIL_API_KEY=dev_key_1234567890
SMTP_PASSWORD=dev_smtp_password

# Production (encrypted)
ZEPTOMAIL_API_KEY=encrypted:jwe_encrypted_string_here

Cloudflare Secrets (Production)

# Store secrets
wrangler secret put ZEPTOMAIL_API_KEY
wrangler secret put JWT_SECRET

# List secrets
wrangler secret list

Credential Rotation

Automated Rotation Schedule

Credential Type	Rotation Frequency	Automation
API Keys	90 days	Manual
JWT Secrets	180 days	Automated
Database Credentials	365 days	Manual
SMTP Passwords	When compromised	Manual

Rotation Procedure

Prepare New Credentials:

# Generate new API key
openssl rand -base64 32

# Update environment
export NEW_API_KEY=$(openssl rand -base64 32)

Update Configuration:

# Update .env file
sed -i '' "s/old_key_here/$NEW_API_KEY/" .env.production

# Update Cloudflare secrets
echo $NEW_API_KEY | wrangler secret put ZEPTOMAIL_API_KEY

Verify Functionality:

# Test with new credentials
npm run test:credentials

# Monitor for errors
tail -f logs/application.log | grep -i "authentication"

Revoke Old Credentials:

# Revoke old API key
curl -X DELETE https://zeptomail.com/api/v1/keys/old_key_id

Access Control

API Key Scopes

{
  "key_id": "key_123456",
  "name": "Marketing API Key",
  "scopes": [
    "campaigns:read",
    "campaigns:write", 
    "contacts:read",
    "email:send"
  ],
  "restrictions": {
    "rate_limit": "1000/hour",
    "ip_whitelist": ["192.168.1.0/24"],
    "expires_at": "2024-12-31T23:59:59Z"
  }
}

User Role Permissions

Role	Campaigns	Contacts	Templates	Analytics	Settings
Admin	CRUD	CRUD	CRUD	R	CRUD
Manager	CRU	CRU	CRU	R	R
Marketer	CRU	CRU	CRU	R	-
Analyst	R	R	-	R	-
Developer	-	-	-	-	API only

Email Deliverability Testing

Spam Testing

Spam Score Analysis

# Test email with spam analyzer
npm run test:spam -- --email test_email.html

# Expected score: < 5.0 (lower is better)

Common Spam Triggers to Avoid

Subject Line Issues:
- Excessive punctuation (!!!)
- ALL CAPS words
- Spam trigger words: "Free", "Guaranteed", "Winner"
Content Issues:
- Too many images, too little text
- Hidden text (white on white)
- Suspicious links
Technical Issues:
- Missing unsubscribe link
- No physical mailing address
- Invalid DKIM/SPF signatures

Authentication Testing

DKIM Verification

# Check DKIM record
dig -t txt default._domainkey.yourdomain.com

# Expected format:
"v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC..."

SPF Verification

# Check SPF record
dig -t txt yourdomain.com | grep spf

# Expected format:
"v=spf1 include:_spf.google.com include:_spf.zeptomail.com ~all"

DMARC Verification

# Check DMARC record  
dig -t txt _dmarc.yourdomain.com

# Expected format:
"v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com"

Inbox Placement Testing

Test with Multiple Providers

{
  "test_recipients": {
    "gmail": "test@gmail.com",
    "outlook": "test@outlook.com",
    "yahoo": "test@yahoo.com",
    "corporate": "test@company.com"
  },
  "monitor_for": 24,
  "check_folders": ["inbox", "spam", "promotions"]
}

Warm-up Process for New IPs

{
  "day_1": {"volume": 50, "segments": ["engaged_users"]},
  "day_2": {"volume": 100, "segments": ["engaged_users", "active_users"]},
  "day_3": {"volume": 200, "segments": ["all_users"]},
  "day_4_7": {"volume": 500, "segments": ["all_users"]},
  "week_2": {"volume": 1000, "segments": ["all_users"]}
}

Load Testing

Campaign Send Testing

Small Scale Test

# Send 100 test emails
npm run test:load -- --emails 100 --batch-size 10

# Monitor performance
# - API response times
# - Database query times
# - Email provider response times

Medium Scale Test

# Send 10,000 test emails
npm run test:load -- --emails 10000 --batch-size 100 --parallel 5

# Monitor:
# - Memory usage
# - CPU utilization
# - Network bandwidth
# - Queue processing rate

Performance Benchmarks

Metric	Target	Warning	Critical
API Response	< 100ms	100-500ms	> 500ms
Email Send	< 500ms	500-2000ms	> 2000ms
Queue Processing	1000/hr	500-1000/hr	< 500/hr
Database Query	< 50ms	50-200ms	> 200ms

Concurrent User Testing

Simulated Users

// Load test configuration
const loadTestConfig = {
  users: 50,
  duration: '5m',
  scenarios: [
    {
      name: 'Campaign Creation',
      weight: 30,
      flow: ['login', 'create_campaign', 'preview', 'save']
    },
    {
      name: 'Analytics View',
      weight: 40,
      flow: ['login', 'view_dashboard', 'filter_data', 'export']
    },
    {
      name: 'Contact Management',
      weight: 30,
      flow: ['login', 'import_contacts', 'segment', 'tag']
    }
  ]
};

Security Testing

Authentication Testing

Password Policy Testing

# Test weak passwords
curl -X POST http://localhost:3000/api/v1/auth/register \
  -d '{"password": "password123"}'
# Expected: Validation error

# Test strong passwords
curl -X POST http://localhost:3000/api/v1/auth/register \
  -d '{"password": "Str0ngP@ssw0rd2024!"}'
# Expected: Success

Brute Force Protection

# Test rate limiting
for i in {1..101}; do
  curl -X POST http://localhost:3000/api/v1/auth/login \
    -d '{"email": "test@test.com", "password": "wrong"}'
done
# Expected: Rate limited after 100 attempts

Authorization Testing

Role-based Access Control

// Test admin-only endpoint with user role
const userToken = getUserToken('user');
const adminToken = getUserToken('admin');

// Attempt to delete campaign as user
await fetch('/api/v1/campaigns/123', {
  method: 'DELETE',
  headers: { Authorization: `Bearer ${userToken}` }
});
// Expected: 403 Forbidden

// Same request as admin
await fetch('/api/v1/campaigns/123', {
  method: 'DELETE',
  headers: { Authorization: `Bearer ${adminToken}` }
});
// Expected: 200 OK

Data Validation Testing

Input Validation

// Test SQL injection
const maliciousInput = {
  email: "test@example.com'; DROP TABLE users; --",
  name: "<script>alert('xss')</script>"
};

// Test XSS
const xssPayload = {
  content: "<img src=x onerror=alert(1)>"
};

// Test file upload
const maliciousFile = {
  filename: "../../../etc/passwd",
  content: "malicious content"
};

Compliance Testing

Data Export

# Test data export
curl -X GET http://localhost:3000/api/v1/gdpr/export \
  -H "Authorization: Bearer user_token"
# Expected: JSON file with all user data

Data Deletion

# Test right to erasure
curl -X DELETE http://localhost:3000/api/v1/gdpr/delete \
  -H "Authorization: Bearer user_token"
# Expected: All user data deleted

// Test consent tracking
await updateConsent(userId, {
  marketing: true,
  analytics: false,
  necessary: true
});

// Verify consent is respected
const campaigns = await getCampaignsForUser(userId);
// Should only include campaigns user consented to

CAN-SPAM Compliance

Required Elements Testing

<!-- Test email for compliance -->
<html>
<body>
  <!-- Physical address -->
  <div>123 Main St, City, State ZIP</div>
  
  <!-- Unsubscribe link -->
  <a href="{{unsubscribe_url}}">Unsubscribe</a>
  
  <!-- Subject line accuracy -->
  <!-- Subject must match content -->
</body>
</html>

Monitoring & Alerting

Test Monitoring Setup

Health Checks

# Configure health check endpoints
# File: src/health/checks.js
module.exports = [
  {
    name: 'database',
    check: async () => await db.raw('SELECT 1'),
    timeout: 5000
  },
  {
    name: 'email_provider',
    check: async () => await emailProvider.test(),
    timeout: 10000
  },
  {
    name: 'storage',
    check: async () => checkDiskSpace('/uploads'),
    threshold: 1073741824 // 1GB
  }
];

Alert Configuration

{
  "alerts": {
    "high_bounce_rate": {
      "condition": "bounce_rate > 5%",
      "notification": ["email", "slack"],
      "recipients": ["admin@domain.com", "#alerts"]
    },
    "low_delivery_rate": {
      "condition": "delivery_rate < 95%",
      "notification": ["sms", "pagerduty"],
      "severity": "critical"
    },
    "api_errors": {
      "condition": "error_rate > 1% for 5 minutes",
      "notification": ["slack"],
      "severity": "warning"
    }
  }
}

Test Data Management

Sample Data Generation

Campaign Test Data

// Generate test campaigns
const testCampaigns = generateTestData({
  count: 100,
  types: ['newsletter', 'promotion', 'transactional'],
  dateRange: {
    start: '2024-01-01',
    end: '2024-12-31'
  },
  statuses: ['draft', 'scheduled', 'sent', 'cancelled']
});

Contact Test Data

// Generate realistic test contacts
const testContacts = generateContacts({
  count: 10000,
  domains: ['gmail.com', 'yahoo.com', 'company.com'],
  geographicDistribution: {
    'US': 60,
    'UK': 15,
    'IN': 10,
    'Other': 15
  },
  engagementLevels: {
    'high': 20,
    'medium': 50,
    'low': 25,
    'inactive': 5
  }
});

Test Data Cleanup

Automated Cleanup

# Development cleanup script
npm run test:cleanup

# Options
npm run test:cleanup -- --age 7d    # Clean data older than 7 days
npm run test:cleanup -- --type logs # Clean logs only
npm run test:cleanup -- --all       # Clean all test data

Manual Cleanup Commands

# Delete test campaigns
DELETE FROM campaigns WHERE name LIKE 'Test Campaign%';

# Delete test contacts  
DELETE FROM contacts WHERE email LIKE '%@test.com';

# Reset sequences
UPDATE sqlite_sequence SET seq = 0 WHERE name IN ('campaigns', 'contacts');

Testing Checklist

Pre-Deployment Checklist

Post-Deployment Checklist

Testing Tools: Use our testing scripts for automated testing.

Thorough testing ensures FlowCampaign delivers reliable, secure, and high-performance email campaign management.

Testing Environments​

Development Environment​

Staging Environment​

Production Environment​

Test Credentials​

Default Admin Account​

Test User Accounts​

Testing Workflows​

1. Email Provider Testing​

Mock SMTP (Development)​

ZeptoMail Sandbox​

SMTP Sandbox​

2. Campaign Testing​

Test Campaign Creation​

A/B Testing Setup​

3. API Testing​

Test API Key​

Postman Collection​

Automated Tests​

Credential Management​

Secure Storage​

Environment Variables​

Cloudflare Secrets (Production)​

Credential Rotation​

Automated Rotation Schedule​

Rotation Procedure​

Access Control​

API Key Scopes​

User Role Permissions​

Email Deliverability Testing​

Spam Testing​

Spam Score Analysis​

Common Spam Triggers to Avoid​

Authentication Testing​

DKIM Verification​

SPF Verification​

DMARC Verification​

Inbox Placement Testing​

Test with Multiple Providers​

Warm-up Process for New IPs​

Load Testing​

Campaign Send Testing​

Small Scale Test​

Medium Scale Test​

Performance Benchmarks​

Concurrent User Testing​

Simulated Users​

Security Testing​

Authentication Testing​

Password Policy Testing​

Brute Force Protection​

Authorization Testing​

Role-based Access Control​

Data Validation Testing​

Input Validation​

Compliance Testing​

GDPR Compliance Testing​

Data Export​

Data Deletion​

Consent Management​

CAN-SPAM Compliance​

Required Elements Testing​

Monitoring & Alerting​

Test Monitoring Setup​

Health Checks​

Alert Configuration​

Test Data Management​

Sample Data Generation​

Campaign Test Data​

Contact Test Data​

Test Data Cleanup​

Automated Cleanup​

Manual Cleanup Commands​

Testing Checklist​

Pre-Deployment Checklist​

Post-Deployment Checklist​

Testing Environments

Development Environment

Staging Environment

Production Environment

Test Credentials

Default Admin Account

Test User Accounts

Testing Workflows

1. Email Provider Testing

Mock SMTP (Development)

ZeptoMail Sandbox

SMTP Sandbox

2. Campaign Testing

Test Campaign Creation

A/B Testing Setup

3. API Testing

Test API Key

Postman Collection

Automated Tests

Credential Management

Secure Storage

Environment Variables

Cloudflare Secrets (Production)

Credential Rotation

Automated Rotation Schedule

Rotation Procedure

Access Control

API Key Scopes

User Role Permissions

Email Deliverability Testing

Spam Testing

Spam Score Analysis

Common Spam Triggers to Avoid

Authentication Testing

DKIM Verification

SPF Verification

DMARC Verification

Inbox Placement Testing

Test with Multiple Providers

Warm-up Process for New IPs

Load Testing

Campaign Send Testing

Small Scale Test

Medium Scale Test

Performance Benchmarks

Concurrent User Testing

Simulated Users

Security Testing

Authentication Testing

Password Policy Testing

Brute Force Protection

Authorization Testing

Role-based Access Control

Data Validation Testing

Input Validation

Compliance Testing

GDPR Compliance Testing

Data Export

Data Deletion

Consent Management

CAN-SPAM Compliance

Required Elements Testing

Monitoring & Alerting

Test Monitoring Setup

Health Checks

Alert Configuration

Test Data Management

Sample Data Generation

Campaign Test Data

Contact Test Data

Test Data Cleanup

Automated Cleanup

Manual Cleanup Commands

Testing Checklist

Pre-Deployment Checklist

Post-Deployment Checklist