Arquitectura de Testing de APIs: De Monolitos a Microservicios

// user-service.test.js
import { describe, it, expect, beforeAll, afterAll } from '@jest/globals';
import request from 'supertest';
import { createApp } from '../src/app.js';
import { MockAuthService } from './mocks/auth-service.js';
import { MockDatabaseClient } from './mocks/database.js';

describe('User Service API', () => {
  let app;
  let mockAuth;
  let mockDb;

  beforeAll(async () => {
    // Inicializar mocks
    mockAuth = new MockAuthService();
    mockDb = new MockDatabaseClient();

    // Crear app con dependencias mockeadas
    app = await createApp({
      authService: mockAuth,
      database: mockDb
    });

    // Insertar datos de prueba
    await mockDb.seed({
      users: [
        { id: '1', email: 'user@example.com', role: 'admin' },
        { id: '2', email: 'user2@example.com', role: 'user' }
      ]
    });
  });

  afterAll(async () => {
    await mockDb.cleanup();
  });

  describe('GET /api/users/:id', () => {
    it('should return user when authenticated', async () => {
      // Configurar mock de autenticación
      mockAuth.setValidToken('valid-token-123');

      const response = await request(app)
        .get('/api/users/1')
        .set('Authorization', 'Bearer valid-token-123')
        .expect(200);

      expect(response.body).toMatchObject({
        id: '1',
        email: 'user@example.com',
        role: 'admin'
      });

      // Verificar que el servicio de auth fue llamado
      expect(mockAuth.validateToken).toHaveBeenCalledWith('valid-token-123');
    });

    it('should return 401 when token is invalid', async () => {
      mockAuth.setInvalidToken();

      await request(app)
        .get('/api/users/1')
        .set('Authorization', 'Bearer invalid-token')
        .expect(401);
    });

    it('should return 404 when user does not exist', async () => {
      mockAuth.setValidToken('valid-token-123');

      await request(app)
        .get('/api/users/999')
        .set('Authorization', 'Bearer valid-token-123')
        .expect(404);
    });
  });

  describe('POST /api/users', () => {
    it('should create user with valid data', async () => {
      mockAuth.setValidToken('admin-token');
      mockAuth.setRole('admin');

      const newUser = {
        email: 'newuser@example.com',
        password: 'SecureP@ss123!',
        role: 'user'
      };

      const response = await request(app)
        .post('/api/users')
        .set('Authorization', 'Bearer admin-token')
        .send(newUser)
        .expect(201);

      expect(response.body).toMatchObject({
        email: 'newuser@example.com',
        role: 'user'
      });
      expect(response.body.password).toBeUndefined(); // No debe devolver password
    });

    it('should validate email format', async () => {
      mockAuth.setValidToken('admin-token');
      mockAuth.setRole('admin');

      await request(app)
        .post('/api/users')
        .set('Authorization', 'Bearer admin-token')
        .send({
          email: 'invalid-email',
          password: 'SecureP@ss123!'
        })
        .expect(400)
        .expect((res) => {
          expect(res.body.errors).toContainEqual(
            expect.objectContaining({
              field: 'email',
              message: expect.stringContaining('valid email')
            })
          );
        });
    });
  });
});

import { buildSchema } from 'graphql';
import { describe, it, expect } from '@jest/globals';
import fs from 'fs';

describe('GraphQL Schema Validation', () => {
  it('should have valid schema syntax', () => {
    const schemaString = fs.readFileSync('./schema.graphql' (como se discute en [API Testing Mastery: From REST to Contract Testing](/blog/api-testing-mastery)), 'utf8');

    expect(() => {
      buildSchema(schemaString);
    }).not.toThrow();
  });

  it('should define required types', () => {
    const schema = buildSchema(
      fs.readFileSync('./schema.graphql' (como se discute en [OWASP ZAP Automation: Security Scanning in CI/CD](/blog/owasp-zap-automation)), 'utf8')
    );

    const typeMap = schema.getTypeMap();

    // Verificar que existen tipos principales
    expect(typeMap).toHaveProperty('User');
    expect(typeMap).toHaveProperty('Order');
    expect(typeMap).toHaveProperty('Product');
    expect(typeMap).toHaveProperty('Query');
    expect(typeMap).toHaveProperty('Mutation');
  });
});

import WebSocket from 'ws';
import { describe, it, expect, beforeAll, afterAll } from '@jest/globals';

describe('WebSocket API', () => {
  let wsServer;
  let baseUrl;

  beforeAll(async () => {
    wsServer = await startWebSocketServer();
    baseUrl = `ws://localhost:${wsServer.port}`;
  });

  afterAll(async () => {
    await wsServer.close();
  });

  it('should establish connection and authenticate', (done) => {
    const ws = new WebSocket(`${baseUrl}/ws`);

    ws.on('open', () => {
      // Enviar mensaje de autenticación
      ws.send(JSON.stringify({
        type: 'auth',
        token: 'valid-token-123'
      }));
    });

    ws.on('message', (data) => {
      const message = JSON.parse(data.toString());

      if (message.type === 'auth_success') {
        expect(message.userId).toBe('user-123');
        ws.close();
        done();
      }
    });

    ws.on('error', done);
  });

  it('should receive real-time updates', (done) => {
    const ws = new WebSocket(`${baseUrl}/ws`);
    const receivedMessages = [];

    ws.on('open', () => {
      ws.send(JSON.stringify({
        type: 'auth',
        token: 'valid-token-123'
      }));
    });

    ws.on('message', (data) => {
      const message = JSON.parse(data.toString());
      receivedMessages.push(message);

      if (message.type === 'auth_success') {
        // Suscribirse a actualizaciones
        ws.send(JSON.stringify({
          type: 'subscribe',
          channel: 'orders'
        }));
      }

      if (message.type === 'order_update') {
        expect(message.data).toHaveProperty('orderId');
        expect(message.data).toHaveProperty('status');
        ws.close();
        done();
      }
    });

    // Disparar una actualización de orden desde otro cliente
    setTimeout(() => {
      triggerOrderUpdate('order-123', 'shipped');
    }, 100);
  });

  it('should enforce rate limiting', async () => {
    const ws = new WebSocket(`${baseUrl}/ws`);

    await new Promise((resolve) => {
      ws.on('open', resolve);
    });

    // Autenticar primero
    ws.send(JSON.stringify({
      type: 'auth',
      token: 'valid-token-123'
    }));

    await new Promise((resolve) => {
      ws.on('message', (data) => {
        const message = JSON.parse(data.toString());
        if (message.type === 'auth_success') resolve();
      });
    });

    // Enviar muchos mensajes rápidamente
    for (let i = 0; i < 100; i++) {
      ws.send(JSON.stringify({
        type: 'ping',
        id: i
      }));
    }

    // Debería recibir error de rate limit
    await new Promise((resolve) => {
      ws.on('message', (data) => {
        const message = JSON.parse(data.toString());
        if (message.type === 'rate_limit_exceeded') {
          expect(message.retryAfter).toBeGreaterThan(0);
          ws.close();
          resolve();
        }
      });
    });
  });
});

describe('API Versioning', () => {
  describe('V1 API', () => {
    it('should return data in v1 format', async () => {
      const response = await fetch('http://localhost:3000/api/v1/users/123');
      const user = await response.json();

      // Formato V1: estructura plana
      expect(user).toMatchObject({
        id: '123',
        name: 'John Doe',
        email: 'john@example.com'
      });
    });
  });

  describe('V2 API', () => {
    it('should return data in v2 format with nested structure', async () => {
      const response = await fetch('http://localhost:3000/api/v2/users/123');
      const user = await response.json();

      // Formato V2: estructura anidada con perfil
      expect(user).toMatchObject({
        id: '123',
        profile: {
          firstName: 'John',
          lastName: 'Doe'
        },
        contact: {
          email: 'john@example.com'
        }
      });
    });

    it('should include new fields not in v1', async () => {
      const response = await fetch('http://localhost:3000/api/v2/users/123');
      const user = await response.json();

      expect(user).toHaveProperty('metadata');
      expect(user).toHaveProperty('preferences');
      expect(user).toHaveProperty('createdAt');
      expect(user).toHaveProperty('updatedAt');
    });
  });

  describe('Version deprecation', () => {
    it('should include deprecation headers in v1 responses', async () => {
      const response = await fetch('http://localhost:3000/api/v1/users/123');

      expect(response.headers.get('Deprecation')).toBe('true');
      expect(response.headers.get('Sunset')).toBeTruthy();
      expect(response.headers.get('Link')).toContain('api/v2');
    });
  });
});

describe('API Breaking Changes', () => {
  it('should maintain backward compatibility in v1', async () => {
    // Código de cliente antiguo esperando formato v1
    const response = await fetch('http://localhost:3000/api/v1/orders/456');
    const order = await response.json();

    // El contrato V1 debe mantenerse
    expect(order).toHaveProperty('customerId');
    expect(order).toHaveProperty('items');
    expect(order).toHaveProperty('totalAmount');
    expect(typeof order.totalAmount).toBe('number');
  });

  it('should document breaking changes in v2', async () => {
    const response = await fetch('http://localhost:3000/api/v2/orders/456');
    const order = await response.json();

    // Cambios incompatibles de V2:
    // - customerId renombrado a customer.id
    // - totalAmount cambiado a objeto money
    expect(order).not.toHaveProperty('customerId');
    expect(order).toHaveProperty('customer');
    expect(order.customer).toHaveProperty('id');

    expect(typeof order.totalAmount).toBe('object');
    expect(order.totalAmount).toHaveProperty('amount');
    expect(order.totalAmount).toHaveProperty('currency');
  });
});