Tested Application Step 5: The Backend Suite

Write the backend tests: the security properties first, then your custom validation, then the awkward edges. Use parametrize wherever you find yourself copying a test and changing one value. Keep fixtures minimal, building only what the test needs. Then deliberately break each rule in the application and confirm exactly the expected test fails, and only that one. If breaking one rule fails six tests, those tests are coupled to implementation and should be looked at.