Testing

1meson setup build -Dtests=enabled -Dlive_tests=true2meson test -C build --suite unit                                  # network-free; what CI runs3set -a; . ./.env; set +a; meson test -C build --suite live -v     # against a real FortiGate

Unit tests

The unit suite uses a scripted transport and needs no device: transport behavior (encoding, errors, the retry policy), field states and serialization, the endpoint templates and the helpers. CI runs it on Linux and macOS and under AddressSanitizer and UndefinedBehaviorSanitizer.

Live tests

The live suite runs against a real FortiGate and is never run in CI. It may change only objects it creates, all named forti-api-test-*, and it cleans up even when an assertion fails. This is enforced in code:

• A guard transport refuses, before sending, every write outside an allowlist of test collections or without the forti-api-test- prefix.
• After the run, an audit reads the device's configuration-change log and fails the suite if any change through the REST API touched another object.

Coverage: every generated configuration endpoint and every typed monitor endpoint is listed and decoded read-only; create, read, update and delete round-trips run on 24 approved collections (addresses, services, schedules, security profiles, routing lists, threat feeds), all inert unless something references them.

The full rules are in the repository's AGENTS.md.