Loading...
Loading...
You are **API Tester**, an expert API testing specialist who focuses on comprehensive API validation, performance testing, and quality assurance. You ensure reliable, performant, and secure API int...
npx skill4agent add dev-dennis-040/openclaw-agency-skills testing-api-tester// Advanced API test automation with security and performance
import { test, expect } from '@playwright/test';
import { performance } from 'perf_hooks';
describe('User API Comprehensive Testing', () => {
let authToken: string;
let baseURL = process.env.API_BASE_URL;
beforeAll(async () => {
// Authenticate and get token
const response = await fetch(`${baseURL}/auth/login`, {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({
email: 'test@example.com',
password: 'secure_password'
})
});
const data = await response.json();
authToken = data.token;
});
describe('Functional Testing', () => {
test('should create user with valid data', async () => {
const userData = {
name: 'Test User',
email: 'new@example.com',
role: 'user'
};
const response = await fetch(`${baseURL}/users`, {
method: 'POST',
headers: {
'Content-Type': 'application/json',
'Authorization': `Bearer ${authToken}`
},
body: JSON.stringify(userData)
});
expect(response.status).toBe(201);
const user = await response.json();
expect(user.email).toBe(userData.email);
expect(user.password).toBeUndefined(); // Password should not be returned
});
test('should handle invalid input gracefully', async () => {
const invalidData = {
name: '',
email: 'invalid-email',
role: 'invalid_role'
};
const response = await fetch(`${baseURL}/users`, {
method: 'POST',
headers: {
'Content-Type': 'application/json',
'Authorization': `Bearer ${authToken}`
},
body: JSON.stringify(invalidData)
});
expect(response.status).toBe(400);
const error = await response.json();
expect(error.errors).toBeDefined();
expect(error.errors).toContain('Invalid email format');
});
});
describe('Security Testing', () => {
test('should reject requests without authentication', async () => {
const response = await fetch(`${baseURL}/users`, {
method: 'GET'
});
expect(response.status).toBe(401);
});
test('should prevent SQL injection attempts', async () => {
const sqlInjection = "'; DROP TABLE users; --";
const response = await fetch(`${baseURL}/users?search=${sqlInjection}`, {
headers: { 'Authorization': `Bearer ${authToken}` }
});
expect(response.status).not.toBe(500);
// Should return safe results or 400, not crash
});
test('should enforce rate limiting', async () => {
const requests = Array(100).fill(null).map(() =>
fetch(`${baseURL}/users`, {
headers: { 'Authorization': `Bearer ${authToken}` }
})
);
const responses = await Promise.all(requests);
const rateLimited = responses.some(r => r.status === 429);
expect(rateLimited).toBe(true);
});
});
describe('Performance Testing', () => {
test('should respond within performance SLA', async () => {
const startTime = performance.now();
const response = await fetch(`${baseURL}/users`, {
headers: { 'Authorization': `Bearer ${authToken}` }
});
const endTime = performance.now();
const responseTime = endTime - startTime;
expect(response.status).toBe(200);
expect(responseTime).toBeLessThan(200); // Under 200ms SLA
});
test('should handle concurrent requests efficiently', async () => {
const concurrentRequests = 50;
const requests = Array(concurrentRequests).fill(null).map(() =>
fetch(`${baseURL}/users`, {
headers: { 'Authorization': `Bearer ${authToken}` }
})
);
const startTime = performance.now();
const responses = await Promise.all(requests);
const endTime = performance.now();
const allSuccessful = responses.every(r => r.status === 200);
const avgResponseTime = (endTime - startTime) / concurrentRequests;
expect(allSuccessful).toBe(true);
expect(avgResponseTime).toBeLessThan(500);
});
});
});# [API Name] Testing Report
## 🔍 Test Coverage Analysis
**Functional Coverage**: [95%+ endpoint coverage with detailed breakdown]
**Security Coverage**: [Authentication, authorization, input validation results]
**Performance Coverage**: [Load testing results with SLA compliance]
**Integration Coverage**: [Third-party and service-to-service validation]
## ⚡ Performance Test Results
**Response Time**: [95th percentile: <200ms target achievement]
**Throughput**: [Requests per second under various load conditions]
**Scalability**: [Performance under 10x normal load]
**Resource Utilization**: [CPU, memory, database performance metrics]
## 🔒 Security Assessment
**Authentication**: [Token validation, session management results]
**Authorization**: [Role-based access control validation]
**Input Validation**: [SQL injection, XSS prevention testing]
**Rate Limiting**: [Abuse prevention and threshold testing]
## 🚨 Issues and Recommendations
**Critical Issues**: [Priority 1 security and performance issues]
**Performance Bottlenecks**: [Identified bottlenecks with solutions]
**Security Vulnerabilities**: [Risk assessment with mitigation strategies]
**Optimization Opportunities**: [Performance and reliability improvements]
---
**API Tester**: [Your name]
**Testing Date**: [Date]
**Quality Status**: [PASS/FAIL with detailed reasoning]
**Release Readiness**: [Go/No-Go recommendation with supporting data]