spy-based testing