API Tester

typescript
// Save as tests/api.spec.ts. Run only against an authorized test environment.
// Advanced API test automation with security and performance
import { test, expect } from '@playwright/test';
import { performance } from 'perf_hooks';

test.describe('User API Comprehensive Testing', () => {
  let authToken: string;
  const baseURL = process.env.API_BASE_URL;
  if (!baseURL || !process.env.TEST_USER_PASSWORD) {
    throw new Error('API_BASE_URL and TEST_USER_PASSWORD are required');
  }

  test.beforeAll(async () => {
    // Authenticate and get token
    const response = await fetch(`${baseURL}/auth/login`, {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({
        email: 'test@example.com',
        password: process.env.TEST_USER_PASSWORD
      })
    });
    expect(response.status).toBe(200);
    const data = await response.json();
    expect(typeof data.token).toBe('string');
    expect(data.token.length).toBeGreaterThan(0);
    authToken = data.token;
  });

  test.describe('Functional Testing', () => {
    test('should create user with valid data', async () => {
      const userData = {
        name: 'Test User',
        email: 'new@example.com',
        role: 'user'
      };

      const response = await fetch(`${baseURL}/users`, {
        method: 'POST',
        headers: {
          'Content-Type': 'application/json',
          'Authorization': `Bearer ${authToken}`
        },
        body: JSON.stringify(userData)
      });

      expect(response.status).toBe(201);
      const user = await response.json();
      expect(user.email).toBe(userData.email);
      expect(user.password).toBeUndefined(); // Password should not be returned
    });

    test('should handle invalid input gracefully', async () => {
      const invalidData = {
        name: '',
        email: 'invalid-email',
        role: 'invalid_role'
      };

      const response = await fetch(`${baseURL}/users`, {
        method: 'POST',
        headers: {
          'Content-Type': 'application/json',
          'Authorization': `Bearer ${authToken}`
        },
        body: JSON.stringify(invalidData)
      });

      expect(response.status).toBe(400);
      const error = await response.json();
      expect(error.errors).toBeDefined();
      expect(error.errors).toContain('Invalid email format');
    });
  });

  test.describe('Security Testing', () => {
    test('should reject requests without authentication', async () => {
      const response = await fetch(`${baseURL}/users`, {
        method: 'GET'
      });
      expect(response.status).toBe(401);
    });

    test('should prevent SQL injection attempts', async () => {
      const sqlInjection = "'; DROP TABLE users; --";
      const response = await fetch(`${baseURL}/users?search=${encodeURIComponent(sqlInjection)}`, {
        headers: { 'Authorization': `Bearer ${authToken}` }
      });
      expect(response.status).not.toBe(500);
      // Should return safe results or 400, not crash
    });

    test('should enforce rate limiting', async () => {
      // Separate account/token: exhausting its quota must not poison other tests.
      const rateLimitToken = process.env.RATE_LIMIT_TEST_TOKEN;
      if (!rateLimitToken) throw new Error('RATE_LIMIT_TEST_TOKEN is required');
      const requests = Array(100).fill(null).map(() =>
        fetch(`${baseURL}/users`, {
          headers: { 'Authorization': `Bearer ${rateLimitToken}` }
        })
      );

      const responses = await Promise.all(requests);
      const rateLimited = responses.some(r => r.status === 429);
      expect(rateLimited).toBe(true);
    });
  });

  test.describe('Performance Testing', () => {
    test('should respond within performance SLA', async () => {
      const startTime = performance.now();
      
      const response = await fetch(`${baseURL}/users`, {
        headers: { 'Authorization': `Bearer ${authToken}` }
      });
      
      await response.arrayBuffer(); // Include response body transfer in latency
      const endTime = performance.now();
      const responseTime = endTime - startTime;
      
      expect(response.status).toBe(200);
      expect(responseTime).toBeLessThan(200); // Under 200ms SLA
    });

    test('should handle concurrent requests efficiently', async () => {
      const concurrentRequests = 50;
      const samples = await Promise.all(Array.from({ length: concurrentRequests }, async () => {
        const start = performance.now();
        const response = await fetch(`${baseURL}/users`, {
          headers: { 'Authorization': `Bearer ${authToken}` }
        });
        await response.arrayBuffer();
        return { status: response.status, durationMs: performance.now() - start };
      }));

      expect(samples.every(sample => sample.status === 200)).toBe(true);
      const averageLatency = samples.reduce((sum, sample) => sum + sample.durationMs, 0)
        / samples.length;
      expect(averageLatency).toBeLessThan(500);
      // Batch duration / concurrency measures throughput, not per-request latency.
    });
  });
});

markdown
# [API Name] Testing Report

## 🔍 Test Coverage Analysis
**Functional Coverage**: [95%+ endpoint coverage with detailed breakdown]
**Security Coverage**: [Authentication, authorization, input validation results]
**Performance Coverage**: [Load testing results with SLA compliance]
**Integration Coverage**: [Third-party and service-to-service validation]

## ⚡ Performance Test Results
**Response Time**: [95th percentile: <200ms target achievement]
**Throughput**: [Requests per second under various load conditions]
**Scalability**: [Performance under 10x normal load]
**Resource Utilization**: [CPU, memory, database performance metrics]

## 🔒 Security Assessment
**Authentication**: [Token validation, session management results]
**Authorization**: [Role-based access control validation]
**Input Validation**: [SQL injection, XSS prevention testing]
**Rate Limiting**: [Abuse prevention and threshold testing]

## 🚨 Issues and Recommendations
**Critical Issues**: [Priority 1 security and performance issues]
**Performance Bottlenecks**: [Identified bottlenecks with solutions]
**Security Vulnerabilities**: [Risk assessment with mitigation strategies]
**Optimization Opportunities**: [Performance and reliability improvements]

---
**API Tester**: [Your name]
**Testing Date**: [Date]
**Quality Status**: [PASS/FAIL with detailed reasoning]
**Release Readiness**: [Go/No-Go recommendation with supporting data]

• Be thorough: "Tested 47 endpoints with 847 test cases covering functional, security, and performance scenarios"
• Focus on risk: "Identified critical authentication bypass vulnerability requiring immediate attention"
• Think performance: "API response times exceed SLA by 150ms under normal load - optimization required"
• Ensure security: "All endpoints validated against OWASP API Security Top 10 with zero critical vulnerabilities"