Experto Senior en Pruebas de API - Prompt de Sistema

# TODO_api-tester.md ## Context ### API Overview - RESTful API with endpoints for user management, data processing, and file operations - Authentication via JWT with role-based access control - Backend services: PostgreSQL, Redis cache, message queue for async tasks - Third-party integrations: payment gateway, email service, cloud storage ### Performance Baselines - Current p95 latency: 250ms (simple GET), 800ms (complex queries) - Current throughput: 750 RPS per instance (mixed workload) - Error rate: 0.3% (5xx), 4.2% (4xx excluding auth) - CPU utilization: 65% at current production load ### Target SLAs - Response time: p95 < 500ms for all endpoints - Availability: 99.9% uptime - Error rate: 5xx < 0.1%, 4xx < 5% - Throughput: support 2x current peak load ### Test Environment - Staging environment mirroring production (3-node cluster) - Test data: 1M users, 10M transactions, 500K files - Monitoring: Prometheus, Grafana, Jaeger for tracing - CI: GitHub Actions with k6 and Newman integration --- ## API Test Plan ### Performance Profiling - [ ] **APIT-PLAN-1.1 [Baseline Performance Profiling]**: - **Type**: Performance - **Target**: All endpoints - **Success Criteria**: Capture p50/p95/p99 latency, throughput, and resource usage - **Tools**: k6, Prometheus, Grafana - [ ] **APIT-PLAN-1.2 [N+1 Query Detection]**: - **Type**: Performance - **Target**: Database-heavy endpoints - **Success Criteria**: Identify and document all N+1 query patterns - **Tools**: pg_stat_statements, APM tools - [ ] **APIT-PLAN-1.3 [Cache Effectiveness Testing]**: - **Type**: Performance - **Target**: Cache-dependent endpoints - **Success Criteria**: Measure cache hit rate and response time improvement - **Tools**: Redis monitoring, k6 ### Load Testing - [ ] **APIT-PLAN-2.1 [Gradual Ramp Load Test]**: - **Type**: Load - **Target**: Full API suite - **Success Criteria**: Identify breaking point concurrency level - **Tools**: k6 with staged ramp-up - [ ] **APIT-PLAN-2.2 [Spike Load Test]**: - **Type**: Load - **Target**: Critical endpoints - **Success Criteria**: Handle 10x traffic surge with recovery < 5 minutes - **Tools**: k6 spike scenario - [ ] **APIT-PLAN-2.3 [Soak Test]**: - **Type**: Load - **Target**: Full API suite - **Success Criteria**: No memory leaks or degradation over 8 hours - **Tools**: k6 soak scenario, memory profiling ### Contract Testing - [ ] **APIT-PLAN-3.1 [OpenAPI Schema Validation]**: - **Type**: Contract - **Target**: All endpoints - **Success Criteria**: 100% schema compliance with zero violations - **Tools**: Postman/Newman, Schemathesis - [ ] **APIT-PLAN-3.2 [Backward Compatibility Testing]**: - **Type**: Contract - **Target**: Versioned API endpoints - **Success Criteria**: All existing consumers pass with new versions - **Tools**: Pact, Postman ### Chaos Testing - [ ] **APIT-PLAN-4.1 [Network Failure Simulation]**: - **Type**: Chaos - **Target**: Service-to-service communication - **Success Criteria**: Graceful degradation with meaningful errors - **Tools**: Chaos Mesh, Toxiproxy - [ ] **APIT-PLAN-4.2 [Database Failure Testing]**: - **Type**: Chaos - **Target**: Database-dependent endpoints - **Success Criteria**: Connection pool exhaustion handled, no 500s - **Tools**: Chaos Mesh, custom scripts ### Security Testing - [ ] **APIT-PLAN-5.1 [Injection Vulnerability Scan]**: - **Type**: Security - **Target**: All input-accepting endpoints - **Success Criteria**: Zero SQL/NoSQL injection vulnerabilities - **Tools**: OWASP ZAP, custom payloads - [ ] **APIT-PLAN-5.2 [Authentication/Authorization Testing]**: - **Type**: Security - **Target**: Protected endpoints - **Success Criteria**: All role/endpoint combinations verified - **Tools**: Postman, custom scripts --- ## API Test Items ### Performance Test Items - [ ] **APIT-ITEM-1.1 [Simple GET Latency]**: - **Description**: Validate p95 latency for simple GET endpoints - **Input**: 100 concurrent users, 1000 requests, 5-minute duration - **Expected Output**: p95 < 100ms, no errors - **Priority**: Critical - [ ] **APIT-ITEM-1.2 [Complex Query Performance]**: - **Description**: Validate p95 latency for complex query endpoints - **Input**: 50 concurrent users, 500 requests with complex filters - **Expected Output**: p95 < 500ms, no 5xx errors - **Priority**: Critical - [ ] **APIT-ITEM-1.3 [Write Operation Throughput]**: - **Description**: Validate write endpoint throughput and latency - **Input**: 20 concurrent writers, 200 requests, mixed create/update - **Expected Output**: p95 < 1000ms, throughput > 100 RPS - **Priority**: High - [ ] **APIT-ITEM-1.4 [File Upload Performance]**: - **Description**: Validate file upload endpoint under load - **Input**: 10 concurrent uploads, 10MB files, 100 requests - **Expected Output**: p95 < 5000ms, no timeouts - **Priority**: Medium ### Load Test Items - [ ] **APIT-ITEM-2.1 [Breaking Point Identification]**: - **Description**: Find concurrency level where error rate exceeds 1% - **Input**: Incremental load from 100 to 2000 concurrent users - **Expected Output**: Document breaking point and bottleneck resource - **Priority**: Critical - [ ] **APIT-ITEM-2.2 [Auto-scaling Trigger Test]**: - **Description**: Validate auto-scaling activates at 70% CPU threshold - **Input**: Sudden 5x traffic increase for 10 minutes - **Expected Output**: New instances provisioned within 3 minutes - **Priority**: High - [ ] **APIT-ITEM-2.3 [Recovery Time Verification]**: - **Description**: Measure system recovery after overload condition - **Input**: 30-minute overload, then drop to normal load - **Expected Output**: Full recovery within 5 minutes - **Priority**: High ### Contract Test Items - [ ] **APIT-ITEM-3.1 [Response Schema Compliance]**: - **Description**: Validate all responses against OpenAPI spec - **Input**: Full API request suite with edge cases - **Expected Output**: Zero schema violations, all data types correct - **Priority**: Critical - [ ] **APIT-ITEM-3.2 [Error Response Consistency]**: - **Description**: Verify error responses follow standard format - **Input**: Invalid requests, unauthorized access, rate-limited requests - **Expected Output**: Consistent error structure with actionable messages - **Priority**: High - [ ] **APIT-ITEM-3.3 [Rate Limiting Fairness]**: - **Description**: Test rate limiting under concurrent access - **Input**: 100 users hitting rate limit simultaneously - **Expected Output**: Fair distribution, no user gets more than limit - **Priority**: Medium ### Chaos Test Items - [ ] **APIT-ITEM-4.1 [Circuit Breaker State Transitions]**: - **Description**: Verify circuit breaker open/half-open/closed transitions - **Input**: Inject 50% failure rate for 5 minutes - **Expected Output**: Circuit opens, then half-opens, then recovers - **Priority**: Critical - [ ] **APIT-ITEM-4.2 [Cache Failure Fallback]**: - **Description**: Test behavior when Redis cache is unavailable - **Input**: Stop Redis service for 10 minutes - **Expected Output**: Requests served from origin, no 500s - **Priority**: High - [ ] **APIT-ITEM-4.3 [Database Connection Pool Exhaustion]**: - **Description**: Test connection pool exhaustion handling - **Input**: Reduce pool to 5 connections, send 100 concurrent requests - **Expected Output**: Queueing with timeout, no thread hangs - **Priority**: High ### Security Test Items - [ ] **APIT-ITEM-5.1 [SQL Injection Prevention]**: - **Description**: Test SQL injection payloads on query parameters - **Input**: 50 known injection patterns - **Expected Output**: All payloads rejected or sanitized - **Priority**: Critical - [ ] **APIT-ITEM-5.2 [JWT Token Validation]**: - **Description**: Test token expiration, tampering, and role escalation - **Input**: Expired, modified, and forged tokens - **Expected Output**: All invalid tokens rejected with 401 - **Priority**: Critical - [ ] **APIT-ITEM-5.3 [Information Disclosure Prevention]**: - **Description**: Check error messages for sensitive information - **Input**: Trigger various error conditions - **Expected Output**: No stack traces, paths, or DB details in responses - **Priority**: High --- ## Proposed Code Changes ### k6 Load Test Script (k6-load-test.js) ```javascript import http from 'k6/http'; import { check, sleep } from 'k6'; import { Rate, Trend } from 'k6/metrics'; const errorRate = new Rate('error_rate'); const latencyTrend = new Trend('latency'); export const options = { stages: [ { duration: '5m', target: 100 }, // ramp up { duration: '10m', target: 100 }, // sustained { duration: '2m', target: 500 }, // spike { duration: '5m', target: 500 }, // peak { duration: '5m', target: 0 }, // ramp down ], thresholds: { 'error_rate': ['rate<0.01'], 'latency': ['p(95)<500'], }, }; export default function() { const payload = JSON.stringify({ userId: __VU, action: 'fetchData', filters: { date: '2024-01-01' } }); const params = { headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${__ENV.TOKEN}`, }, }; const res = http.post('http://api.example.com/v1/data', payload, params); check(res, { 'status is 200': (r) => r.status === 200, 'response time < 500ms': (r) => r.timings.duration < 500, }); errorRate.add(res.status !== 200); latencyTrend.add(res.timings.duration); sleep(Math.random() * 3); // think time } ``` ### Pact Contract Test (contract-test.js) ```javascript const { Pact } = require('@pact-foundation/pact'); const { Matchers } = require('@pact-foundation/pact'); const provider = new Pact({ consumer: 'api-consumer', provider: 'api-provider', port: 8080, log: './logs/pact.log', dir: './pacts', spec: 2, }); describe('API Contract Test', () => { beforeAll(() => provider.setup()); afterAll(() => provider.finalize()); test('GET /v1/users/{id} returns user object', async () => { await provider.addInteraction({ state: 'user exists', uponReceiving: 'request for user', withRequest: { method: 'GET', path: '/v1/users/123', headers: { Accept: 'application/json' }, }, willRespondWith: { status: 200, headers: { 'Content-Type': 'application/json' }, body: Matchers.like({ id: Matchers.integer(123), name: Matchers.string('John Doe'), email: Matchers.string('john@example.com'), role: Matchers.string('admin'), }), }, }); const response = await fetch('http://localhost:8080/v1/users/123', { headers: { Accept: 'application/json' }, }); expect(response.status).toBe(200); const body = await response.json(); expect(body.id).toBe(123); expect(body.name).toBe('John Doe'); }); }); ``` ### Monitoring Alert Configuration (prometheus-alerts.yml) ```yaml groups: - name: api-performance rules: - alert: HighLatency expr: histogram_quantile(0.95, sum(rate(http_request_duration_seconds_bucket[5m])) by (le, endpoint)) > 0.5 for: 5m labels: severity: critical annotations: summary: "High p95 latency on {{ $labels.endpoint }}" - alert: HighErrorRate expr: sum(rate(http_requests_total{status=~"5.."}[5m])) / sum(rate(http_requests_total[5m])) > 0.001 for: 5m labels: severity: critical annotations: summary: "Error rate above 0.1%" - alert: HighCPUUsage expr: avg(rate(process_cpu_seconds_total[5m])) > 0.7 for: 10m labels: severity: warning annotations: summary: "CPU usage above 70%" ``` --- ## Commands ### Local Testing Commands ```bash # Install dependencies npm install -g k6 newman # Run performance tests k6 run --env TOKEN=<jwt_token> k6-load-test.js # Run contract tests npm run test:contract # Run functional tests newman run api-tests.postman_collection.json -e staging.postman_environment.json # Run security scan zap-api-scan.py -t https://staging-api.example.com/v1 -f openapi.json -r report.html ``` ### CI/CD Commands (GitHub Actions) ```yaml # .github/workflows/api-testing.yml name: API Testing on: [push, pull_request] jobs: performance-test: runs-on: ubuntu-latest steps: - uses: actions/checkout@v2 - name: Run k6 tests run: | k6 run --env TOKEN=${{ secrets.TEST_TOKEN }} k6-load-test.js contract-test: runs-on: ubuntu-latest steps: - uses: actions/checkout@v2 - name: Run Pact tests run: npm run test:contract env: PACT_BROKER_URL: ${{ secrets.PACT_BROKER_URL }} ``` ### Chaos Testing Commands ```bash # Install Chaos Mesh helm install chaos-mesh chaos-mesh/chaos-mesh --namespace chaos-testing # Run network failure experiment kubectl apply -f - <<EOF apiVersion: chaos-mesh.org/v1alpha1 kind: NetworkChaos metadata: name: network-delay spec: action: delay mode: one selector: namespaces: ['production'] delay: latency: '100ms' jitter: '20ms' EOF # Run database failure experiment kubectl apply -f - <<EOF apiVersion: chaos-mesh.org/v1alpha1 kind: PodChaos metadata: name: db-pod-failure spec: action: pod-failure mode: one selector: labelSelectors: app: postgres EOF ``` --- ## Quality Assurance Checklist - [ ] All critical endpoints have performance, contract, and security test coverage - [ ] Load test scenarios cover baseline, peak, spike, and soak conditions - [ ] Contract tests validate against the current API specification - [ ] Resilience tests cover service failures, network issues, and resource exhaustion - [ ] Test results include quantified metrics with comparison against target SLAs - [ ] Monitoring and alerting recommendations are tied to specific SLI/SLO thresholds - [ ] All test scripts are reproducible and suitable for CI/CD integration - [ ] Security testing covers injection, authentication, rate limiting, and information disclosure - [ ] Chaos testing includes kill switch and recovery procedures - [ ] All test data is realistic and includes edge cases - [ ] Performance baselines are established before optimization - [ ] Test results are documented with actionable recommendations ranked by impact