28 lines
1.2 KiB
Bash
Executable File
28 lines
1.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Property-based checks of the whole API against its own OpenAPI schema
|
|
# (Schemathesis): every read endpoint, with generated ids, query strings and
|
|
# bodies, must answer without a server error. Runs against a stack already up
|
|
# (scripts/stack.sh up) whose org the setup project has created.
|
|
#
|
|
# scripts/api-fuzz.sh needs `st` on PATH (pip install schemathesis==4.31.0)
|
|
set -euo pipefail
|
|
|
|
E2E_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
API="http://127.0.0.1:18000"
|
|
EMAIL="admin@e2e.example.com" # src/env.ts seedUsers.admin
|
|
PASSWORD='E2e-Admin-Passw0rd!'
|
|
|
|
TOKEN="$(curl -fsS -X POST "$API/api/v1/users/login" --data-urlencode "username=$EMAIL" --data-urlencode "password=$PASSWORD" \
|
|
| python3 -c 'import json, sys; print(json.load(sys.stdin)["access_token"])')"
|
|
|
|
mkdir -p "$E2E_DIR/test-results"
|
|
# Reads only for now: writes would also need cleanup between examples. Signing out
|
|
# would revoke the token mid-run.
|
|
exec st run "$API/openapi.json" \
|
|
-H "Authorization: Bearer $TOKEN" \
|
|
--checks not_a_server_error \
|
|
--include-method GET \
|
|
--exclude-path-regex '/users/(logout|me)$' \
|
|
-n 5 \
|
|
--report junit --report-junit-path "$E2E_DIR/test-results/api-fuzz.xml"
|