# 16. TESTING AND DEPLOYMENT GUIDE
## Current Testing State

### E2E Auth Flow Test (PASSED - 2026-04-01)
We have successfully executed the complete Identity & Onboarding E2E test inside the `sf_api` container.

#### Prerequisites Configuration
Before the test run, SSoT configuration values were injected into `system.system_parameters`:
- `auth_remember_me_days`: 30
- `auth_refresh_default_days`: 1
- `auth_password_strict`: True

#### Executed Scenarios & Results

1. **LITE REGISTRATION TEST** - **PASSED**
   - Successfully registered `test_architect@example.com` with a complex password.
   - Database confirmed `is_active=False` for both User and Twin Person.

2. **EMAIL VERIFICATION TEST** - **PASSED**
   - Token retrieved from `identity.verification_tokens`.
   - Endpoint `POST /auth/verify-email` processed the token.
   - Fixed an architectural bug where `is_active` was not updated correctly upon token validation. It now updates the status to `True` successfully.

3. **REMEMBER ME / COOKIE TEST** - **PASSED**
   - Performed `POST /auth/login` with `remember_me=true`.
   - Fixed missing `Set-Cookie` header logic. The API now correctly returns `refresh_token` as an `HttpOnly`, `Secure`, `SameSite=lax` cookie with `Max-Age` aligned to SSoT (30 days).

4. **SOFT DELETE / ANONYMIZATION TEST** - **PASSED**
   - Verified that `AuthService.soft_delete_user` anonymizes the email prefixing with `deleted_`.
   - Record `is_active` set to `False` and `is_deleted` set to `True`.

### Deployment Checklist (API)
- [x] Database Sync Engine verifies SSoT variables.
- [x] SSoT configurations drive `auth_service` parameters.
- [x] Hybrid authentication token delivery works per specification.