qa/api-testing

API 接口测试方法论

参考开源实践：Supertest、REST Assured、Postman/Newman、HTTPie、Testcontainers

适用场景

• 后端 API 端点需要功能验证
• 需要测试接口边界值、错误处理、权限控制
• 需要验证 API 契约（请求/响应 schema 一致性）
• 需要覆盖认证、授权、越权等安全场景
• 需要测试完整业务流程的 API 链路

测试类型矩阵

1. RESTful API 测试

1.1 Node.js (Supertest + Jest/Vitest)

// tests/api/users.test.ts
import request from 'supertest';
import { app } from '../../src/app';

describe('User API', () => {
  describe('POST /api/users', () => {
    it('creates user with valid data', async () => {
      const res = await request(app)
        .post('/api/users')
        .send({ name: 'Alice', email: '[email protected]' })
        .expect(201)
        .expect('Content-Type', /json/);

      expect(res.body.success).toBe(true);
      expect(res.body.data).toMatchObject({ name: 'Alice', email: '[email protected]' });
      expect(res.body.data.id).toBeDefined();
    });

    it('rejects empty name with 400', async () => {
      const res = await request(app)
        .post('/api/users')
        .send({ name: '', email: '[email protected]' })
        .expect(400);

      expect(res.body.error.code).toBe('VALIDATION_ERROR');
    });

    it('rejects duplicate email with 409', async () => {
      await request(app).post('/api/users').send({ name: 'A', email: '[email protected]' });
      const res = await request(app)
        .post('/api/users')
        .send({ name: 'B', email: '[email protected]' })
        .expect(409);

      expect(res.body.error.code).toBe('CONFLICT');
    });
  });
});