test: add cross-endpoint integration and error-handling suites #62

ilia · 2026-07-14T17:23:34-05:00

ilia commented

2026-07-14 17:23:34 -05:00

Summary

Implements the two suites tests/API_TEST_PLAN.md documented but never actually wrote: test_api_integration.py (workflows spanning multiple endpoints) and test_api_errors.py (404/401/403/422 consistency sweeps + injection-style/large-payload input handling).
Workflows covered: create person -> identify face -> verify it drops out of the unidentified queue; tag a photo -> search by tag -> untag; favorite a photo -> search favorites -> unfavorite; bulk-add/remove favorites (including idempotency); grant a role a new feature permission and confirm access unlocks immediately for an already-authenticated user.
Error sweeps covered: 404s across people/photos/faces/users/videos/tags, 401s across several protected endpoints + a malformed bearer token, 403s across four admin-only endpoints, 422s for wrong-typed/missing fields, SQL-injection-style and <script> input stored as literal data (not executed / doesn't corrupt tables), and large payloads (500 bogus IDs, 200 review decisions) handled without crashing.
Along the way: found that GET /api/v1/faces/unidentified has no auth dependency, unlike its sibling routes. Didn't fix it (out of scope / not asked), just captured it as a passing, clearly-commented test so it's a visible, deliberate change if/when auth is added there.

Test plan

Ran locally against local Postgres (venv + Docker): 207 passed, same 8 pre-existing unrelated failures as before this change (test_api_faces.py encoding-size drift, test_api_jobs.py SSE-auth mismatch, test_api_photos.py message-text drift) — 0 new failures, 0 regressions.

## Summary - Implements the two suites `tests/API_TEST_PLAN.md` documented but never actually wrote: `test_api_integration.py` (workflows spanning multiple endpoints) and `test_api_errors.py` (404/401/403/422 consistency sweeps + injection-style/large-payload input handling). - Workflows covered: create person -> identify face -> verify it drops out of the unidentified queue; tag a photo -> search by tag -> untag; favorite a photo -> search favorites -> unfavorite; bulk-add/remove favorites (including idempotency); grant a role a new feature permission and confirm access unlocks immediately for an already-authenticated user. - Error sweeps covered: 404s across people/photos/faces/users/videos/tags, 401s across several protected endpoints + a malformed bearer token, 403s across four admin-only endpoints, 422s for wrong-typed/missing fields, SQL-injection-style and `<script>` input stored as literal data (not executed / doesn't corrupt tables), and large payloads (500 bogus IDs, 200 review decisions) handled without crashing. - Along the way: found that `GET /api/v1/faces/unidentified` has no auth dependency, unlike its sibling routes. Didn't fix it (out of scope / not asked), just captured it as a passing, clearly-commented test so it's a visible, deliberate change if/when auth is added there. ## Test plan - [x] Ran locally against local Postgres (venv + Docker): 207 passed, same 8 pre-existing unrelated failures as before this change (test_api_faces.py encoding-size drift, test_api_jobs.py SSE-auth mismatch, test_api_photos.py message-text drift) — 0 new failures, 0 regressions.

ilia added 1 commit 2026-07-14 17:23:34 -05:00

test: add cross-endpoint integration and error-handling suites

CI / skip-ci-check (pull_request) Successful in 4s

Details

CI / docker-ci (pull_request) Successful in 5s

Details

CI / secret-scan (pull_request) Successful in 11s

Details

CI / e2e (pull_request) Successful in 26s

Details

5303580107

Adds test_api_integration.py (person identification, tag+search,
favorites+search, bulk favorites, and role-permission-grant workflows
chained across multiple endpoints) and test_api_errors.py (404/401/403/422
consistency sweeps, SQL-injection/XSS-style input handling, large-payload
handling) per the two suites the existing tests/API_TEST_PLAN.md already
documented but never implemented.

Along the way, found and documented (via a passing test, not a fix) that
GET /api/v1/faces/unidentified has no auth dependency, unlike its sibling
routes.

ilia merged commit 05b908241d into dev

2026-07-14 17:24:37 -05:00

ilia referenced this issue from a commit

2026-07-14 17:24:38 -05:00

Merge pull request 'test: add cross-endpoint integration and error-handling suites' (#62) from test/backend-integration-error-suites into dev

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: ilia/punimtag#62