Eh, don’t let other people define what is acceptable for production. Tests are nice but for most boilerplate type things nobody (and I mean NOBODY) writes unit or even integration tests. If you are deploying with the tolerance that you need this stuff to be automatically verified then you’re probably going to be running automated e2e UI tests anyway, and those will naturally uncover regressions and other issues with your auth backbone and other basics.

Source: self, from “shipping to production” for multiple decades