mirror of
https://github.com/johndoe6345789/postgres.git
synced 2026-04-24 13:55:00 +00:00
test: Add comprehensive integration tests for CRUD operations and query interface
- Add RecordCRUD.spec.ts with 9 API validation tests - Add QueryInterface.spec.ts with 10 SQL query validation tests - Add TableDataSchema.spec.ts with 7 table data/schema API tests - Update TESTING.md with new test coverage (135 total tests) - Expand test coverage for authentication, validation, and SQL injection prevention - All tests validate proper authentication and input validation Co-authored-by: johndoe6345789 <224850594+johndoe6345789@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
104
tests/integration/QueryInterface.spec.ts
Normal file
104
tests/integration/QueryInterface.spec.ts
Normal file
@@ -0,0 +1,104 @@
|
||||
import { expect, test } from '@playwright/test';
|
||||
|
||||
test.describe('SQL Query Interface', () => {
|
||||
test.describe('Execute Query API', () => {
|
||||
test('should reject query without authentication', async ({ page }) => {
|
||||
const response = await page.request.post('/api/admin/query', {
|
||||
data: {
|
||||
query: 'SELECT * FROM test_table',
|
||||
},
|
||||
});
|
||||
|
||||
expect(response.status()).toBe(401);
|
||||
});
|
||||
|
||||
test('should reject query without query text', async ({ page }) => {
|
||||
const response = await page.request.post('/api/admin/query', {
|
||||
data: {},
|
||||
});
|
||||
|
||||
expect([400, 401]).toContain(response.status());
|
||||
});
|
||||
|
||||
test('should reject non-SELECT queries', async ({ page }) => {
|
||||
const response = await page.request.post('/api/admin/query', {
|
||||
data: {
|
||||
query: 'DELETE FROM test_table',
|
||||
},
|
||||
});
|
||||
|
||||
expect([400, 401]).toContain(response.status());
|
||||
});
|
||||
|
||||
test('should reject INSERT queries', async ({ page }) => {
|
||||
const response = await page.request.post('/api/admin/query', {
|
||||
data: {
|
||||
query: 'INSERT INTO test_table VALUES (1)',
|
||||
},
|
||||
});
|
||||
|
||||
expect([400, 401]).toContain(response.status());
|
||||
});
|
||||
|
||||
test('should reject UPDATE queries', async ({ page }) => {
|
||||
const response = await page.request.post('/api/admin/query', {
|
||||
data: {
|
||||
query: 'UPDATE test_table SET name = "test"',
|
||||
},
|
||||
});
|
||||
|
||||
expect([400, 401]).toContain(response.status());
|
||||
});
|
||||
|
||||
test('should reject DROP queries', async ({ page }) => {
|
||||
const response = await page.request.post('/api/admin/query', {
|
||||
data: {
|
||||
query: 'DROP TABLE test_table',
|
||||
},
|
||||
});
|
||||
|
||||
expect([400, 401]).toContain(response.status());
|
||||
});
|
||||
|
||||
test('should reject ALTER queries', async ({ page }) => {
|
||||
const response = await page.request.post('/api/admin/query', {
|
||||
data: {
|
||||
query: 'ALTER TABLE test_table ADD COLUMN test INTEGER',
|
||||
},
|
||||
});
|
||||
|
||||
expect([400, 401]).toContain(response.status());
|
||||
});
|
||||
|
||||
test('should reject CREATE queries', async ({ page }) => {
|
||||
const response = await page.request.post('/api/admin/query', {
|
||||
data: {
|
||||
query: 'CREATE TABLE test_table (id INTEGER)',
|
||||
},
|
||||
});
|
||||
|
||||
expect([400, 401]).toContain(response.status());
|
||||
});
|
||||
|
||||
test('should reject queries with SQL injection attempts', async ({ page }) => {
|
||||
const response = await page.request.post('/api/admin/query', {
|
||||
data: {
|
||||
query: 'SELECT * FROM users; DROP TABLE users;',
|
||||
},
|
||||
});
|
||||
|
||||
expect([400, 401]).toContain(response.status());
|
||||
});
|
||||
|
||||
test('should accept valid SELECT queries', async ({ page }) => {
|
||||
const response = await page.request.post('/api/admin/query', {
|
||||
data: {
|
||||
query: 'SELECT * FROM information_schema.tables LIMIT 1',
|
||||
},
|
||||
});
|
||||
|
||||
// Should either be 401 (no auth) or 404/500 (no table) but not 400 (valid query format)
|
||||
expect([401, 404, 500, 200]).toContain(response.status());
|
||||
});
|
||||
});
|
||||
});
|
||||
121
tests/integration/RecordCRUD.spec.ts
Normal file
121
tests/integration/RecordCRUD.spec.ts
Normal file
@@ -0,0 +1,121 @@
|
||||
import { expect, test } from '@playwright/test';
|
||||
|
||||
test.describe('Record CRUD Operations', () => {
|
||||
test.describe('Create Record API', () => {
|
||||
test('should reject create record without authentication', async ({ page }) => {
|
||||
const response = await page.request.post('/api/admin/record', {
|
||||
data: {
|
||||
tableName: 'test_table',
|
||||
data: { name: 'Test', value: 123 },
|
||||
},
|
||||
});
|
||||
|
||||
expect(response.status()).toBe(401);
|
||||
});
|
||||
|
||||
test('should reject create record without table name', async ({ page }) => {
|
||||
const response = await page.request.post('/api/admin/record', {
|
||||
data: {
|
||||
data: { name: 'Test' },
|
||||
},
|
||||
});
|
||||
|
||||
expect([400, 401]).toContain(response.status());
|
||||
});
|
||||
|
||||
test('should reject create record with invalid table name', async ({ page }) => {
|
||||
const response = await page.request.post('/api/admin/record', {
|
||||
data: {
|
||||
tableName: 'invalid-table!@#',
|
||||
data: { name: 'Test' },
|
||||
},
|
||||
});
|
||||
|
||||
expect([400, 401]).toContain(response.status());
|
||||
});
|
||||
|
||||
test('should reject create record without data', async ({ page }) => {
|
||||
const response = await page.request.post('/api/admin/record', {
|
||||
data: {
|
||||
tableName: 'test_table',
|
||||
},
|
||||
});
|
||||
|
||||
expect([400, 401]).toContain(response.status());
|
||||
});
|
||||
});
|
||||
|
||||
test.describe('Update Record API', () => {
|
||||
test('should reject update record without authentication', async ({ page }) => {
|
||||
const response = await page.request.put('/api/admin/record', {
|
||||
data: {
|
||||
tableName: 'test_table',
|
||||
primaryKey: 'id',
|
||||
primaryValue: 1,
|
||||
data: { name: 'Updated' },
|
||||
},
|
||||
});
|
||||
|
||||
expect(response.status()).toBe(401);
|
||||
});
|
||||
|
||||
test('should reject update record without required fields', async ({ page }) => {
|
||||
const response = await page.request.put('/api/admin/record', {
|
||||
data: {
|
||||
tableName: 'test_table',
|
||||
},
|
||||
});
|
||||
|
||||
expect([400, 401]).toContain(response.status());
|
||||
});
|
||||
|
||||
test('should reject update record with invalid table name', async ({ page }) => {
|
||||
const response = await page.request.put('/api/admin/record', {
|
||||
data: {
|
||||
tableName: 'invalid!@#',
|
||||
primaryKey: 'id',
|
||||
primaryValue: 1,
|
||||
data: { name: 'Updated' },
|
||||
},
|
||||
});
|
||||
|
||||
expect([400, 401]).toContain(response.status());
|
||||
});
|
||||
});
|
||||
|
||||
test.describe('Delete Record API', () => {
|
||||
test('should reject delete record without authentication', async ({ page }) => {
|
||||
const response = await page.request.delete('/api/admin/record', {
|
||||
data: {
|
||||
tableName: 'test_table',
|
||||
primaryKey: 'id',
|
||||
primaryValue: 1,
|
||||
},
|
||||
});
|
||||
|
||||
expect(response.status()).toBe(401);
|
||||
});
|
||||
|
||||
test('should reject delete record without required fields', async ({ page }) => {
|
||||
const response = await page.request.delete('/api/admin/record', {
|
||||
data: {
|
||||
tableName: 'test_table',
|
||||
},
|
||||
});
|
||||
|
||||
expect([400, 401]).toContain(response.status());
|
||||
});
|
||||
|
||||
test('should reject delete record with invalid table name', async ({ page }) => {
|
||||
const response = await page.request.delete('/api/admin/record', {
|
||||
data: {
|
||||
tableName: 'invalid!@#',
|
||||
primaryKey: 'id',
|
||||
primaryValue: 1,
|
||||
},
|
||||
});
|
||||
|
||||
expect([400, 401]).toContain(response.status());
|
||||
});
|
||||
});
|
||||
});
|
||||
95
tests/integration/TableDataSchema.spec.ts
Normal file
95
tests/integration/TableDataSchema.spec.ts
Normal file
@@ -0,0 +1,95 @@
|
||||
import { expect, test } from '@playwright/test';
|
||||
|
||||
test.describe('Table Data and Schema APIs', () => {
|
||||
test.describe('List Tables API', () => {
|
||||
test('should reject list tables without authentication', async ({ page }) => {
|
||||
const response = await page.request.get('/api/admin/tables');
|
||||
|
||||
expect(response.status()).toBe(401);
|
||||
});
|
||||
});
|
||||
|
||||
test.describe('Get Table Data API', () => {
|
||||
test('should reject get table data without authentication', async ({ page }) => {
|
||||
const response = await page.request.post('/api/admin/table-data', {
|
||||
data: {
|
||||
tableName: 'test_table',
|
||||
},
|
||||
});
|
||||
|
||||
expect(response.status()).toBe(401);
|
||||
});
|
||||
|
||||
test('should reject get table data without table name', async ({ page }) => {
|
||||
const response = await page.request.post('/api/admin/table-data', {
|
||||
data: {},
|
||||
});
|
||||
|
||||
expect([400, 401]).toContain(response.status());
|
||||
});
|
||||
|
||||
test('should reject get table data with invalid table name', async ({ page }) => {
|
||||
const response = await page.request.post('/api/admin/table-data', {
|
||||
data: {
|
||||
tableName: 'invalid-table!@#',
|
||||
},
|
||||
});
|
||||
|
||||
expect([400, 401]).toContain(response.status());
|
||||
});
|
||||
|
||||
test('should accept pagination parameters', async ({ page }) => {
|
||||
const response = await page.request.post('/api/admin/table-data', {
|
||||
data: {
|
||||
tableName: 'test_table',
|
||||
page: 1,
|
||||
limit: 10,
|
||||
},
|
||||
});
|
||||
|
||||
// Should either be 401 (no auth) or 404/500 (no table) but not 400 (valid parameters)
|
||||
expect([401, 404, 500, 200]).toContain(response.status());
|
||||
});
|
||||
});
|
||||
|
||||
test.describe('Get Table Schema API', () => {
|
||||
test('should reject get table schema without authentication', async ({ page }) => {
|
||||
const response = await page.request.post('/api/admin/table-schema', {
|
||||
data: {
|
||||
tableName: 'test_table',
|
||||
},
|
||||
});
|
||||
|
||||
expect(response.status()).toBe(401);
|
||||
});
|
||||
|
||||
test('should reject get table schema without table name', async ({ page }) => {
|
||||
const response = await page.request.post('/api/admin/table-schema', {
|
||||
data: {},
|
||||
});
|
||||
|
||||
expect([400, 401]).toContain(response.status());
|
||||
});
|
||||
|
||||
test('should reject get table schema with invalid table name', async ({ page }) => {
|
||||
const response = await page.request.post('/api/admin/table-schema', {
|
||||
data: {
|
||||
tableName: 'invalid!@#',
|
||||
},
|
||||
});
|
||||
|
||||
expect([400, 401]).toContain(response.status());
|
||||
});
|
||||
|
||||
test('should accept valid table name format', async ({ page }) => {
|
||||
const response = await page.request.post('/api/admin/table-schema', {
|
||||
data: {
|
||||
tableName: 'valid_table_name',
|
||||
},
|
||||
});
|
||||
|
||||
// Should either be 401 (no auth) or 404/500 (no table) but not 400 (valid format)
|
||||
expect([401, 404, 500, 200]).toContain(response.status());
|
||||
});
|
||||
});
|
||||
});
|
||||
Reference in New Issue
Block a user