145 lines
4.4 KiB
Markdown
145 lines
4.4 KiB
Markdown
# API Integration Tests
|
|
|
|
This directory contains integration tests for the Attune API service.
|
|
|
|
## Test Files
|
|
|
|
- `webhook_api_tests.rs` - Basic webhook management and receiver endpoint tests (8 tests)
|
|
- `webhook_security_tests.rs` - Comprehensive webhook security feature tests (17 tests)
|
|
|
|
## Prerequisites
|
|
|
|
Before running tests, ensure:
|
|
|
|
1. **PostgreSQL is running** on `localhost:5432` (or set `DATABASE_URL`)
|
|
2. **Database migrations are applied**: `sqlx migrate run`
|
|
3. **Test user exists** (username: `test_user`, password: `test_password`)
|
|
|
|
### Quick Setup
|
|
|
|
```bash
|
|
# Set database URL
|
|
export DATABASE_URL="postgresql://postgres:postgres@localhost:5432/attune"
|
|
|
|
# Run migrations
|
|
sqlx migrate run
|
|
|
|
# Create test user (run from psql or create via API)
|
|
# The test user is created automatically when you run the API for the first time
|
|
# Or create manually:
|
|
psql $DATABASE_URL -c "
|
|
INSERT INTO attune.identity (username, email, password_hash, enabled)
|
|
VALUES ('test_user', 'test@example.com',
|
|
crypt('test_password', gen_salt('bf')), true)
|
|
ON CONFLICT (username) DO NOTHING;
|
|
"
|
|
```
|
|
|
|
## Running Tests
|
|
|
|
All tests are marked with `#[ignore]` because they require a database connection.
|
|
|
|
### Run all API integration tests
|
|
```bash
|
|
cargo test -p attune-api --test '*' -- --ignored
|
|
```
|
|
|
|
### Run webhook API tests only
|
|
```bash
|
|
cargo test -p attune-api --test webhook_api_tests -- --ignored
|
|
```
|
|
|
|
### Run webhook security tests only
|
|
```bash
|
|
cargo test -p attune-api --test webhook_security_tests -- --ignored
|
|
```
|
|
|
|
### Run a specific test
|
|
```bash
|
|
cargo test -p attune-api --test webhook_security_tests test_webhook_hmac_sha256_valid -- --ignored --nocapture
|
|
```
|
|
|
|
### Run tests with output
|
|
```bash
|
|
cargo test -p attune-api --test webhook_security_tests -- --ignored --nocapture
|
|
```
|
|
|
|
## Test Categories
|
|
|
|
### Basic Webhook Tests (`webhook_api_tests.rs`)
|
|
- Webhook enable/disable/regenerate operations
|
|
- Webhook receiver with valid/invalid keys
|
|
- Authentication enforcement
|
|
- Disabled webhook handling
|
|
|
|
### Security Feature Tests (`webhook_security_tests.rs`)
|
|
|
|
#### HMAC Signature Tests
|
|
- `test_webhook_hmac_sha256_valid` - SHA256 signature validation
|
|
- `test_webhook_hmac_sha512_valid` - SHA512 signature validation
|
|
- `test_webhook_hmac_invalid_signature` - Invalid signature rejection
|
|
- `test_webhook_hmac_missing_signature` - Missing signature rejection
|
|
- `test_webhook_hmac_wrong_secret` - Wrong secret rejection
|
|
|
|
#### Rate Limiting Tests
|
|
- `test_webhook_rate_limit_enforced` - Rate limit enforcement
|
|
- `test_webhook_rate_limit_disabled` - No rate limit when disabled
|
|
|
|
#### IP Whitelisting Tests
|
|
- `test_webhook_ip_whitelist_allowed` - Allowed IPs pass
|
|
- `test_webhook_ip_whitelist_blocked` - Blocked IPs rejected
|
|
|
|
#### Payload Size Tests
|
|
- `test_webhook_payload_size_limit_enforced` - Size limit enforcement
|
|
- `test_webhook_payload_size_within_limit` - Valid size acceptance
|
|
|
|
#### Event Logging Tests
|
|
- `test_webhook_event_logging_success` - Success logging
|
|
- `test_webhook_event_logging_failure` - Failure logging
|
|
|
|
#### Combined Security Tests
|
|
- `test_webhook_all_security_features_pass` - All features enabled
|
|
- `test_webhook_multiple_security_failures` - Multiple failures
|
|
|
|
#### Error Scenarios
|
|
- `test_webhook_malformed_json` - Invalid JSON handling
|
|
- `test_webhook_empty_payload` - Empty payload handling
|
|
|
|
## Troubleshooting
|
|
|
|
### "Failed to connect to database"
|
|
- Ensure PostgreSQL is running: `pg_isready -h localhost -p 5432`
|
|
- Check `DATABASE_URL` is set correctly
|
|
- Test connection: `psql $DATABASE_URL -c "SELECT 1"`
|
|
|
|
### "Trigger not found" or table errors
|
|
- Run migrations: `sqlx migrate run`
|
|
- Check schema exists: `psql $DATABASE_URL -c "\dn"`
|
|
|
|
### "Authentication required" errors
|
|
- Ensure test user exists with correct credentials
|
|
- Check `JWT_SECRET` environment variable is set
|
|
|
|
### Tests timeout
|
|
- Increase timeout with: `cargo test -- --ignored --test-threads=1`
|
|
- Check database performance
|
|
- Reduce concurrent test execution
|
|
|
|
### Rate limit tests fail
|
|
- Clear webhook event logs between runs
|
|
- Ensure tests run in isolation: `cargo test -- --ignored --test-threads=1`
|
|
|
|
## Documentation
|
|
|
|
For comprehensive test documentation, see:
|
|
- `docs/webhook-testing.md` - Full test suite documentation
|
|
- `docs/webhook-manual-testing.md` - Manual testing guide
|
|
- `docs/webhook-system-architecture.md` - Webhook system architecture
|
|
|
|
## CI/CD
|
|
|
|
These tests are designed to run in CI with:
|
|
- PostgreSQL service container
|
|
- Automatic migration application
|
|
- Test user creation script
|
|
- Parallel test execution (where safe) |