diff --git a/TESTING.md b/TESTING.md
new file mode 100644
index 0000000..d494050
--- /dev/null
+++ b/TESTING.md
@@ -0,0 +1,76 @@
+# Test Suite Documentation
+
+## Overview
+
+This comprehensive test suite covers the Bookmann multi-library system with authentication, authorization, and security testing.
+
+## Test Structure
+
+- **Authentication Tests** (`auth_test.go`)
+  - JWT middleware validation
+  - Missing/invalid token handling
+  - User role extraction
+
+- **Library Management Tests** (`library_test.go`)  
+  - Library creation with authorization checks
+  - Library types endpoint testing
+  - User library visibility control
+  - Media items browsing with library filtering
+
+- **Security Tests** (scattered across files)
+  - JSON validation
+  - Error handling
+  - Authorization bypass attempts
+
+## Running Tests
+
+```bash
+# Run all tests from project root
+cd /home/nymusicman/Code/bookmann && go test ./cmd/server/tests/...
+
+# Run specific test
+go test ./cmd/server/tests/... -run TestAuthMiddleware
+
+# Run with verbose output
+go test -v ./cmd/server/tests/...
+```
+
+## Current Issues
+
+The test suite is experiencing Go environment setup issues related to:
+1. Database querier interface conflicts with old user ebook folder methods
+2. Import resolution problems in some test files
+
+## Test Coverage Areas
+
+- ✅ JWT Authentication & Authorization
+- ✅ Library Management & CRUD Operations  
+- ✅ User Visibility Control
+- ✅ JSON Validation & Error Handling
+- ⚠️ Test Environment Setup (being resolved)
+
+## Docker Integration
+
+Tests are designed to work with Docker build environment:
+```bash
+docker-compose build  # Build application
+docker-compose up -d    # Start application
+# Tests can run against the running container
+```
+
+## Security Test Scenarios
+
+- Valid and invalid JWT tokens
+- Admin vs user role verification
+- JSON injection attempts
+- Authorization header manipulation
+- SQL injection prevention
+- Cross-site scripting attempts
+
+## Best Practices
+
+- Uses `httptest.ResponseRecorder` for isolated HTTP testing
+- Follows Go testing conventions
+- Comprehensive input validation
+- Proper HTTP status code testing
+- Role-based access control verification
\ No newline at end of file