John O'Keefe
983980d07a
Three follow-ups from the smoke run, all additive: 1. Status asserts: bruno_gen.go parses each doc's documented success status (## Response (2NN), 'Success is **201**', '**204 No Content**') and emits a runtime tests script (expect(res.status).to.eql(N)) on 148 of 191 mirrors. GETs default to 200 (uniform across this API); mutating verbs stay assert-less unless documented — no guessed asserts. Verified live: asserts execute and fail loudly (deliberate 999 probe), pass on real responses. 2. OpenAPI: the same -update run now also writes docs/developer/openapi.yaml (141 paths, tags from docs areas, security schemes per auth label, request examples literal, no invented schemas — the docs site remains the shape reference). Verify mode fails when the file is missing. 3. Scenarios: 7 safe negative scenarios rebuilt (auth registration matrix 409/403/400, invalid-uuid 400, unknown 404 x2, invalid range 400) — all no-mutation, repeatable, run via bru: 7/7 tests pass. These replace a fraction of the deleted broken suite; mutations- heavy scenarios stay out until a design for setup chains exists. created_at RFC3339 deliberately NOT done — it is the one item that would break things (Android parses current formats; plan reserves it as a compat decision).bru run of mutating mirrors also proven to touch live data (a 'To Read' collection was created and deleted in testing); only id-less GET mirrors and negative scenarios are safe for blanket runs. make test green; generation idempotent (byte-identical re-runs); no stray smoke rows in users.
39 lines
779 B
YAML
39 lines
779 B
YAML
info:
|
|
name: Register - Weak Password (400)
|
|
type: http
|
|
seq: 3
|
|
|
|
http:
|
|
method: POST
|
|
url: '{{base_url}}/api/auth/register'
|
|
auth: inherit
|
|
body:
|
|
type: json
|
|
data: |-
|
|
{
|
|
"email": "smoke-weak-attempts@tests.bookhoard.internal",
|
|
"username": "smokeweakattempts",
|
|
"password": "weak"
|
|
}
|
|
settings:
|
|
encodeUrl: true
|
|
timeout: 0
|
|
followRedirects: true
|
|
maxRedirects: 5
|
|
|
|
runtime:
|
|
scripts:
|
|
- type: tests
|
|
code: |-
|
|
test("status is 400", function() {
|
|
expect(res.status).to.eql(400);
|
|
});
|
|
|
|
docs:
|
|
content: |-
|
|
# Register - Weak Password (400)
|
|
|
|
Passwords below the configured complexity rules (see
|
|
GET /api/auth/password-rules) must be rejected with 400. Repeats safely.
|
|
type: text/markdown
|