Test the login and profile API contract
advanced API testing Challenge 20 of 22
The auth API has one smoke test that signs in and checks for a 2xx. Write API tests with the request fixture that would catch the three planted bugs.
The API
| Request | Expected response |
|---|---|
POST /api/login { email, password } with ada@example.com / correct-horse |
200, { "email": "ada@example.com", "name": "Ada Lovelace" } |
POST /api/login with a wrong password |
401, { "error": "Invalid email or password" } |
PUT /api/profile { "displayName": "..." } with a non-blank name |
200, { "displayName": "..." } |
PUT /api/profile with a blank name |
400, { "error": "Display name is required" } |
GET /api/profile |
200, { "displayName": "..." } |
Requirements
- Use the
requestfixture. - Cover both the success and the failure path of login, and assert exact status codes.
- Check that profile validation rejects a blank name, and that a valid update can be read back.
Expected output
Tests cover a valid login (exact body), a wrong password (401 and error), an empty display name (400) and a valid update read back with GET. Each planted bug fails at least one test.
Scenarios (4)
Your tests run once against each version of the demo app. They must pass on the working app and fail on every version with a planted bug.
- ○Working API · must pass
- ○Bug: wrong password returns 200 · must catch
- ○Bug: login response has no name · must catch
- ○Bug: empty display name accepted · must catch
Checks (2)
- ○Asserts the 401 for a wrong password
- ○Asserts the 400 for invalid profile input
example.spec.tsRuns against a live demo app
Ctrl/⌘ + Enter to run tests · your code is saved in this browser
Results
Run the tests to see results here.
Demo app
The working app. You can click around it; your tests start from a fresh copy.