mockforge_bench/conformance/
spec_driven.rs

1//! Spec-driven conformance testing
2//!
3//! Analyzes the user's OpenAPI spec to determine which features their API uses,
4//! then generates k6 conformance tests against their real endpoints.
5
6use super::generator::ConformanceConfig;
7use super::schema_validator::SchemaValidatorGenerator;
8use super::spec::ConformanceFeature;
9use crate::error::Result;
10use crate::request_gen::RequestGenerator;
11use crate::spec_parser::ApiOperation;
12use openapiv3::{
13    OpenAPI, Operation, Parameter, ParameterSchemaOrContent, ReferenceOr, RequestBody, Response,
14    Schema, SchemaKind, SecurityScheme, StringFormat, Type, VariantOrUnknownOrEmpty,
15};
16use std::collections::HashSet;
17
18/// Resolve `$ref` references against the OpenAPI components
19mod ref_resolver {
20    use super::*;
21
22    pub fn resolve_parameter<'a>(
23        param_ref: &'a ReferenceOr<Parameter>,
24        spec: &'a OpenAPI,
25    ) -> Option<&'a Parameter> {
26        match param_ref {
27            ReferenceOr::Item(param) => Some(param),
28            ReferenceOr::Reference { reference } => {
29                let name = reference.strip_prefix("#/components/parameters/")?;
30                let components = spec.components.as_ref()?;
31                match components.parameters.get(name)? {
32                    ReferenceOr::Item(param) => Some(param),
33                    ReferenceOr::Reference {
34                        reference: inner_ref,
35                    } => {
36                        // One level of recursive resolution
37                        let inner_name = inner_ref.strip_prefix("#/components/parameters/")?;
38                        match components.parameters.get(inner_name)? {
39                            ReferenceOr::Item(param) => Some(param),
40                            ReferenceOr::Reference { .. } => None,
41                        }
42                    }
43                }
44            }
45        }
46    }
47
48    pub fn resolve_request_body<'a>(
49        body_ref: &'a ReferenceOr<RequestBody>,
50        spec: &'a OpenAPI,
51    ) -> Option<&'a RequestBody> {
52        match body_ref {
53            ReferenceOr::Item(body) => Some(body),
54            ReferenceOr::Reference { reference } => {
55                let name = reference.strip_prefix("#/components/requestBodies/")?;
56                let components = spec.components.as_ref()?;
57                match components.request_bodies.get(name)? {
58                    ReferenceOr::Item(body) => Some(body),
59                    ReferenceOr::Reference {
60                        reference: inner_ref,
61                    } => {
62                        // One level of recursive resolution
63                        let inner_name = inner_ref.strip_prefix("#/components/requestBodies/")?;
64                        match components.request_bodies.get(inner_name)? {
65                            ReferenceOr::Item(body) => Some(body),
66                            ReferenceOr::Reference { .. } => None,
67                        }
68                    }
69                }
70            }
71        }
72    }
73
74    pub fn resolve_schema<'a>(
75        schema_ref: &'a ReferenceOr<Schema>,
76        spec: &'a OpenAPI,
77    ) -> Option<&'a Schema> {
78        resolve_schema_with_visited(schema_ref, spec, &mut HashSet::new())
79    }
80
81    fn resolve_schema_with_visited<'a>(
82        schema_ref: &'a ReferenceOr<Schema>,
83        spec: &'a OpenAPI,
84        visited: &mut HashSet<String>,
85    ) -> Option<&'a Schema> {
86        match schema_ref {
87            ReferenceOr::Item(schema) => Some(schema),
88            ReferenceOr::Reference { reference } => {
89                if !visited.insert(reference.clone()) {
90                    return None; // Cycle detected
91                }
92                let name = reference.strip_prefix("#/components/schemas/")?;
93                let components = spec.components.as_ref()?;
94                let nested = components.schemas.get(name)?;
95                resolve_schema_with_visited(nested, spec, visited)
96            }
97        }
98    }
99
100    /// Resolve a boxed schema reference (used by array items and object properties)
101    pub fn resolve_boxed_schema<'a>(
102        schema_ref: &'a ReferenceOr<Box<Schema>>,
103        spec: &'a OpenAPI,
104    ) -> Option<&'a Schema> {
105        match schema_ref {
106            ReferenceOr::Item(schema) => Some(schema.as_ref()),
107            ReferenceOr::Reference { reference } => {
108                // Delegate to the regular schema resolver
109                let name = reference.strip_prefix("#/components/schemas/")?;
110                let components = spec.components.as_ref()?;
111                let nested = components.schemas.get(name)?;
112                resolve_schema_with_visited(nested, spec, &mut HashSet::new())
113            }
114        }
115    }
116
117    pub fn resolve_response<'a>(
118        resp_ref: &'a ReferenceOr<Response>,
119        spec: &'a OpenAPI,
120    ) -> Option<&'a Response> {
121        match resp_ref {
122            ReferenceOr::Item(resp) => Some(resp),
123            ReferenceOr::Reference { reference } => {
124                let name = reference.strip_prefix("#/components/responses/")?;
125                let components = spec.components.as_ref()?;
126                match components.responses.get(name)? {
127                    ReferenceOr::Item(resp) => Some(resp),
128                    ReferenceOr::Reference {
129                        reference: inner_ref,
130                    } => {
131                        // One level of recursive resolution
132                        let inner_name = inner_ref.strip_prefix("#/components/responses/")?;
133                        match components.responses.get(inner_name)? {
134                            ReferenceOr::Item(resp) => Some(resp),
135                            ReferenceOr::Reference { .. } => None,
136                        }
137                    }
138                }
139            }
140        }
141    }
142}
143
144/// Resolved security scheme details for an operation
145#[derive(Debug, Clone)]
146pub enum SecuritySchemeInfo {
147    /// HTTP Bearer token
148    Bearer,
149    /// HTTP Basic auth
150    Basic,
151    /// API Key in header, query, or cookie
152    ApiKey {
153        location: ApiKeyLocation,
154        name: String,
155    },
156}
157
158/// Where an API key is transmitted
159#[derive(Debug, Clone, PartialEq)]
160pub enum ApiKeyLocation {
161    Header,
162    Query,
163    Cookie,
164}
165
166/// An API operation annotated with the conformance features it exercises
167#[derive(Debug, Clone)]
168pub struct AnnotatedOperation {
169    pub path: String,
170    pub method: String,
171    pub features: Vec<ConformanceFeature>,
172    pub request_body_content_type: Option<String>,
173    pub sample_body: Option<String>,
174    pub query_params: Vec<(String, String)>,
175    pub header_params: Vec<(String, String)>,
176    pub path_params: Vec<(String, String)>,
177    /// Response schema for validation (JSON string of the schema)
178    pub response_schema: Option<Schema>,
179    /// Security scheme details resolved from the OpenAPI spec
180    pub security_schemes: Vec<SecuritySchemeInfo>,
181}
182
183/// Generates spec-driven conformance k6 scripts
184pub struct SpecDrivenConformanceGenerator {
185    config: ConformanceConfig,
186    operations: Vec<AnnotatedOperation>,
187}
188
189impl SpecDrivenConformanceGenerator {
190    pub fn new(config: ConformanceConfig, operations: Vec<AnnotatedOperation>) -> Self {
191        Self { config, operations }
192    }
193
194    /// Annotate a list of API operations with conformance features
195    pub fn annotate_operations(
196        operations: &[ApiOperation],
197        spec: &OpenAPI,
198    ) -> Vec<AnnotatedOperation> {
199        operations.iter().map(|op| Self::annotate_operation(op, spec)).collect()
200    }
201
202    /// Analyze an operation and determine which conformance features it exercises
203    fn annotate_operation(op: &ApiOperation, spec: &OpenAPI) -> AnnotatedOperation {
204        let mut features = Vec::new();
205        let mut query_params = Vec::new();
206        let mut header_params = Vec::new();
207        let mut path_params = Vec::new();
208
209        // Detect HTTP method feature
210        match op.method.to_uppercase().as_str() {
211            "GET" => features.push(ConformanceFeature::MethodGet),
212            "POST" => features.push(ConformanceFeature::MethodPost),
213            "PUT" => features.push(ConformanceFeature::MethodPut),
214            "PATCH" => features.push(ConformanceFeature::MethodPatch),
215            "DELETE" => features.push(ConformanceFeature::MethodDelete),
216            "HEAD" => features.push(ConformanceFeature::MethodHead),
217            "OPTIONS" => features.push(ConformanceFeature::MethodOptions),
218            _ => {}
219        }
220
221        // Detect parameter features (resolves $ref)
222        for param_ref in &op.operation.parameters {
223            if let Some(param) = ref_resolver::resolve_parameter(param_ref, spec) {
224                Self::annotate_parameter(
225                    param,
226                    spec,
227                    &mut features,
228                    &mut query_params,
229                    &mut header_params,
230                    &mut path_params,
231                );
232            }
233        }
234
235        // Detect path parameters from the path template itself
236        for segment in op.path.split('/') {
237            if segment.starts_with('{') && segment.ends_with('}') {
238                let name = &segment[1..segment.len() - 1];
239                // Only add if not already found from parameters
240                if !path_params.iter().any(|(n, _)| n == name) {
241                    path_params.push((name.to_string(), "test-value".to_string()));
242                    // Determine type from path params we didn't already handle
243                    if !features.contains(&ConformanceFeature::PathParamString)
244                        && !features.contains(&ConformanceFeature::PathParamInteger)
245                    {
246                        features.push(ConformanceFeature::PathParamString);
247                    }
248                }
249            }
250        }
251
252        // Detect request body features (resolves $ref)
253        let mut request_body_content_type = None;
254        let mut sample_body = None;
255
256        let resolved_body = op
257            .operation
258            .request_body
259            .as_ref()
260            .and_then(|b| ref_resolver::resolve_request_body(b, spec));
261
262        if let Some(body) = resolved_body {
263            for (content_type, _media) in &body.content {
264                match content_type.as_str() {
265                    "application/json" => {
266                        features.push(ConformanceFeature::BodyJson);
267                        request_body_content_type = Some("application/json".to_string());
268                        // Generate sample body from schema
269                        if let Ok(template) = RequestGenerator::generate_template(op) {
270                            if let Some(body_val) = &template.body {
271                                sample_body = Some(body_val.to_string());
272                            }
273                        }
274                    }
275                    "application/x-www-form-urlencoded" => {
276                        features.push(ConformanceFeature::BodyFormUrlencoded);
277                        request_body_content_type =
278                            Some("application/x-www-form-urlencoded".to_string());
279                    }
280                    "multipart/form-data" => {
281                        features.push(ConformanceFeature::BodyMultipart);
282                        request_body_content_type = Some("multipart/form-data".to_string());
283                    }
284                    _ => {}
285                }
286            }
287
288            // Detect schema features in request body (resolves $ref in schema)
289            if let Some(media) = body.content.get("application/json") {
290                if let Some(schema_ref) = &media.schema {
291                    if let Some(schema) = ref_resolver::resolve_schema(schema_ref, spec) {
292                        Self::annotate_schema(schema, spec, &mut features);
293                    }
294                }
295            }
296        }
297
298        // Detect response code features
299        Self::annotate_responses(&op.operation, spec, &mut features);
300
301        // Extract response schema for validation (resolves $ref)
302        let response_schema = Self::extract_response_schema(&op.operation, spec);
303        if response_schema.is_some() {
304            features.push(ConformanceFeature::ResponseValidation);
305        }
306
307        // Detect content negotiation (response with multiple content types)
308        Self::annotate_content_negotiation(&op.operation, spec, &mut features);
309
310        // Detect security features and resolve scheme details
311        let mut security_schemes = Vec::new();
312        Self::annotate_security(&op.operation, spec, &mut features, &mut security_schemes);
313
314        // Deduplicate features
315        features.sort_by_key(|f| f.check_name());
316        features.dedup_by_key(|f| f.check_name());
317
318        AnnotatedOperation {
319            path: op.path.clone(),
320            method: op.method.to_uppercase(),
321            features,
322            request_body_content_type,
323            sample_body,
324            query_params,
325            header_params,
326            path_params,
327            response_schema,
328            security_schemes,
329        }
330    }
331
332    /// Annotate parameter features
333    fn annotate_parameter(
334        param: &Parameter,
335        spec: &OpenAPI,
336        features: &mut Vec<ConformanceFeature>,
337        query_params: &mut Vec<(String, String)>,
338        header_params: &mut Vec<(String, String)>,
339        path_params: &mut Vec<(String, String)>,
340    ) {
341        let (location, data) = match param {
342            Parameter::Query { parameter_data, .. } => ("query", parameter_data),
343            Parameter::Path { parameter_data, .. } => ("path", parameter_data),
344            Parameter::Header { parameter_data, .. } => ("header", parameter_data),
345            Parameter::Cookie { .. } => {
346                features.push(ConformanceFeature::CookieParam);
347                return;
348            }
349        };
350
351        // Detect type from schema
352        let is_integer = Self::param_schema_is_integer(data, spec);
353        let is_array = Self::param_schema_is_array(data, spec);
354
355        // Generate sample value
356        let sample = if is_integer {
357            "42".to_string()
358        } else if is_array {
359            "a,b".to_string()
360        } else {
361            "test-value".to_string()
362        };
363
364        match location {
365            "path" => {
366                if is_integer {
367                    features.push(ConformanceFeature::PathParamInteger);
368                } else {
369                    features.push(ConformanceFeature::PathParamString);
370                }
371                path_params.push((data.name.clone(), sample));
372            }
373            "query" => {
374                if is_array {
375                    features.push(ConformanceFeature::QueryParamArray);
376                } else if is_integer {
377                    features.push(ConformanceFeature::QueryParamInteger);
378                } else {
379                    features.push(ConformanceFeature::QueryParamString);
380                }
381                query_params.push((data.name.clone(), sample));
382            }
383            "header" => {
384                features.push(ConformanceFeature::HeaderParam);
385                header_params.push((data.name.clone(), sample));
386            }
387            _ => {}
388        }
389
390        // Check for constraint features on the parameter (resolves $ref)
391        if let ParameterSchemaOrContent::Schema(schema_ref) = &data.format {
392            if let Some(schema) = ref_resolver::resolve_schema(schema_ref, spec) {
393                Self::annotate_schema(schema, spec, features);
394            }
395        }
396
397        // Required/optional
398        if data.required {
399            features.push(ConformanceFeature::ConstraintRequired);
400        } else {
401            features.push(ConformanceFeature::ConstraintOptional);
402        }
403    }
404
405    fn param_schema_is_integer(data: &openapiv3::ParameterData, spec: &OpenAPI) -> bool {
406        if let ParameterSchemaOrContent::Schema(schema_ref) = &data.format {
407            if let Some(schema) = ref_resolver::resolve_schema(schema_ref, spec) {
408                return matches!(&schema.schema_kind, SchemaKind::Type(Type::Integer(_)));
409            }
410        }
411        false
412    }
413
414    fn param_schema_is_array(data: &openapiv3::ParameterData, spec: &OpenAPI) -> bool {
415        if let ParameterSchemaOrContent::Schema(schema_ref) = &data.format {
416            if let Some(schema) = ref_resolver::resolve_schema(schema_ref, spec) {
417                return matches!(&schema.schema_kind, SchemaKind::Type(Type::Array(_)));
418            }
419        }
420        false
421    }
422
423    /// Annotate schema-level features (types, composition, formats, constraints)
424    fn annotate_schema(schema: &Schema, spec: &OpenAPI, features: &mut Vec<ConformanceFeature>) {
425        match &schema.schema_kind {
426            SchemaKind::Type(Type::String(s)) => {
427                features.push(ConformanceFeature::SchemaString);
428                // Check format
429                match &s.format {
430                    VariantOrUnknownOrEmpty::Item(StringFormat::Date) => {
431                        features.push(ConformanceFeature::FormatDate);
432                    }
433                    VariantOrUnknownOrEmpty::Item(StringFormat::DateTime) => {
434                        features.push(ConformanceFeature::FormatDateTime);
435                    }
436                    VariantOrUnknownOrEmpty::Unknown(fmt) => match fmt.as_str() {
437                        "email" => features.push(ConformanceFeature::FormatEmail),
438                        "uuid" => features.push(ConformanceFeature::FormatUuid),
439                        "uri" | "url" => features.push(ConformanceFeature::FormatUri),
440                        "ipv4" => features.push(ConformanceFeature::FormatIpv4),
441                        "ipv6" => features.push(ConformanceFeature::FormatIpv6),
442                        _ => {}
443                    },
444                    _ => {}
445                }
446                // Check constraints
447                if s.pattern.is_some() {
448                    features.push(ConformanceFeature::ConstraintPattern);
449                }
450                if !s.enumeration.is_empty() {
451                    features.push(ConformanceFeature::ConstraintEnum);
452                }
453                if s.min_length.is_some() || s.max_length.is_some() {
454                    features.push(ConformanceFeature::ConstraintMinMax);
455                }
456            }
457            SchemaKind::Type(Type::Integer(i)) => {
458                features.push(ConformanceFeature::SchemaInteger);
459                if i.minimum.is_some() || i.maximum.is_some() {
460                    features.push(ConformanceFeature::ConstraintMinMax);
461                }
462                if !i.enumeration.is_empty() {
463                    features.push(ConformanceFeature::ConstraintEnum);
464                }
465            }
466            SchemaKind::Type(Type::Number(n)) => {
467                features.push(ConformanceFeature::SchemaNumber);
468                if n.minimum.is_some() || n.maximum.is_some() {
469                    features.push(ConformanceFeature::ConstraintMinMax);
470                }
471            }
472            SchemaKind::Type(Type::Boolean(_)) => {
473                features.push(ConformanceFeature::SchemaBoolean);
474            }
475            SchemaKind::Type(Type::Array(arr)) => {
476                features.push(ConformanceFeature::SchemaArray);
477                if let Some(item_ref) = &arr.items {
478                    if let Some(item_schema) = ref_resolver::resolve_boxed_schema(item_ref, spec) {
479                        Self::annotate_schema(item_schema, spec, features);
480                    }
481                }
482            }
483            SchemaKind::Type(Type::Object(obj)) => {
484                features.push(ConformanceFeature::SchemaObject);
485                // Check required fields
486                if !obj.required.is_empty() {
487                    features.push(ConformanceFeature::ConstraintRequired);
488                }
489                // Walk properties (resolves $ref)
490                for (_name, prop_ref) in &obj.properties {
491                    if let Some(prop_schema) = ref_resolver::resolve_boxed_schema(prop_ref, spec) {
492                        Self::annotate_schema(prop_schema, spec, features);
493                    }
494                }
495            }
496            SchemaKind::OneOf { .. } => {
497                features.push(ConformanceFeature::CompositionOneOf);
498            }
499            SchemaKind::AnyOf { .. } => {
500                features.push(ConformanceFeature::CompositionAnyOf);
501            }
502            SchemaKind::AllOf { .. } => {
503                features.push(ConformanceFeature::CompositionAllOf);
504            }
505            _ => {}
506        }
507    }
508
509    /// Detect response code features (resolves $ref in responses)
510    fn annotate_responses(
511        operation: &Operation,
512        spec: &OpenAPI,
513        features: &mut Vec<ConformanceFeature>,
514    ) {
515        for (status_code, resp_ref) in &operation.responses.responses {
516            // Only count features for responses that actually resolve
517            if ref_resolver::resolve_response(resp_ref, spec).is_some() {
518                match status_code {
519                    openapiv3::StatusCode::Code(200) => {
520                        features.push(ConformanceFeature::Response200)
521                    }
522                    openapiv3::StatusCode::Code(201) => {
523                        features.push(ConformanceFeature::Response201)
524                    }
525                    openapiv3::StatusCode::Code(204) => {
526                        features.push(ConformanceFeature::Response204)
527                    }
528                    openapiv3::StatusCode::Code(400) => {
529                        features.push(ConformanceFeature::Response400)
530                    }
531                    openapiv3::StatusCode::Code(404) => {
532                        features.push(ConformanceFeature::Response404)
533                    }
534                    _ => {}
535                }
536            }
537        }
538    }
539
540    /// Extract the response schema for the primary success response (200 or 201)
541    /// Resolves $ref for both the response and the schema within it.
542    fn extract_response_schema(operation: &Operation, spec: &OpenAPI) -> Option<Schema> {
543        // Try 200 first, then 201
544        for code in [200u16, 201] {
545            if let Some(resp_ref) =
546                operation.responses.responses.get(&openapiv3::StatusCode::Code(code))
547            {
548                if let Some(response) = ref_resolver::resolve_response(resp_ref, spec) {
549                    if let Some(media) = response.content.get("application/json") {
550                        if let Some(schema_ref) = &media.schema {
551                            if let Some(schema) = ref_resolver::resolve_schema(schema_ref, spec) {
552                                return Some(schema.clone());
553                            }
554                        }
555                    }
556                }
557            }
558        }
559        None
560    }
561
562    /// Detect content negotiation: response supports multiple content types
563    fn annotate_content_negotiation(
564        operation: &Operation,
565        spec: &OpenAPI,
566        features: &mut Vec<ConformanceFeature>,
567    ) {
568        for (_status_code, resp_ref) in &operation.responses.responses {
569            if let Some(response) = ref_resolver::resolve_response(resp_ref, spec) {
570                if response.content.len() > 1 {
571                    features.push(ConformanceFeature::ContentNegotiation);
572                    return; // Only need to detect once per operation
573                }
574            }
575        }
576    }
577
578    /// Detect security scheme features.
579    /// Checks operation-level security first, falling back to global security requirements.
580    /// Resolves scheme names against SecurityScheme definitions in components.
581    fn annotate_security(
582        operation: &Operation,
583        spec: &OpenAPI,
584        features: &mut Vec<ConformanceFeature>,
585        security_schemes: &mut Vec<SecuritySchemeInfo>,
586    ) {
587        // Use operation-level security if present, otherwise fall back to global
588        let security_reqs = operation.security.as_ref().or(spec.security.as_ref());
589
590        if let Some(security) = security_reqs {
591            for security_req in security {
592                for scheme_name in security_req.keys() {
593                    // Try to resolve the scheme from components for accurate type detection
594                    if let Some(resolved) = Self::resolve_security_scheme(scheme_name, spec) {
595                        match resolved {
596                            SecurityScheme::HTTP { ref scheme, .. } => {
597                                if scheme.eq_ignore_ascii_case("bearer") {
598                                    features.push(ConformanceFeature::SecurityBearer);
599                                    security_schemes.push(SecuritySchemeInfo::Bearer);
600                                } else if scheme.eq_ignore_ascii_case("basic") {
601                                    features.push(ConformanceFeature::SecurityBasic);
602                                    security_schemes.push(SecuritySchemeInfo::Basic);
603                                }
604                            }
605                            SecurityScheme::APIKey { location, name, .. } => {
606                                features.push(ConformanceFeature::SecurityApiKey);
607                                let loc = match location {
608                                    openapiv3::APIKeyLocation::Query => ApiKeyLocation::Query,
609                                    openapiv3::APIKeyLocation::Header => ApiKeyLocation::Header,
610                                    openapiv3::APIKeyLocation::Cookie => ApiKeyLocation::Cookie,
611                                };
612                                security_schemes.push(SecuritySchemeInfo::ApiKey {
613                                    location: loc,
614                                    name: name.clone(),
615                                });
616                            }
617                            // OAuth2 and OpenIDConnect don't map to our current feature set
618                            _ => {}
619                        }
620                    } else {
621                        // Fallback: heuristic name matching for unresolvable schemes
622                        let name_lower = scheme_name.to_lowercase();
623                        if name_lower.contains("bearer") || name_lower.contains("jwt") {
624                            features.push(ConformanceFeature::SecurityBearer);
625                            security_schemes.push(SecuritySchemeInfo::Bearer);
626                        } else if name_lower.contains("api") && name_lower.contains("key") {
627                            features.push(ConformanceFeature::SecurityApiKey);
628                            security_schemes.push(SecuritySchemeInfo::ApiKey {
629                                location: ApiKeyLocation::Header,
630                                name: "X-API-Key".to_string(),
631                            });
632                        } else if name_lower.contains("basic") {
633                            features.push(ConformanceFeature::SecurityBasic);
634                            security_schemes.push(SecuritySchemeInfo::Basic);
635                        }
636                    }
637                }
638            }
639        }
640    }
641
642    /// Resolve a security scheme name to its SecurityScheme definition
643    fn resolve_security_scheme<'a>(name: &str, spec: &'a OpenAPI) -> Option<&'a SecurityScheme> {
644        let components = spec.components.as_ref()?;
645        match components.security_schemes.get(name)? {
646            ReferenceOr::Item(scheme) => Some(scheme),
647            ReferenceOr::Reference { .. } => None,
648        }
649    }
650
651    /// Returns the number of operations being tested
652    pub fn operation_count(&self) -> usize {
653        self.operations.len()
654    }
655
656    /// Generate the k6 conformance script.
657    /// Returns (script, check_count) where check_count is the number of unique checks emitted.
658    pub fn generate(&self) -> Result<(String, usize)> {
659        let mut script = String::with_capacity(16384);
660
661        // Imports
662        script.push_str("import http from 'k6/http';\n");
663        script.push_str("import { check, group } from 'k6';\n");
664        if self.config.request_delay_ms > 0 {
665            script.push_str("import { sleep } from 'k6';\n");
666        }
667        script.push('\n');
668
669        // Tell k6 that all HTTP status codes are "expected" in conformance mode.
670        // Without this, k6 counts 4xx responses (e.g. intentional 404 tests) as
671        // http_req_failed errors, producing a misleading error rate percentage.
672        script.push_str(
673            "http.setResponseCallback(http.expectedStatuses({ min: 100, max: 599 }));\n\n",
674        );
675
676        // Options
677        script.push_str("export const options = {\n");
678        script.push_str("  vus: 1,\n");
679        script.push_str("  iterations: 1,\n");
680        if self.config.skip_tls_verify {
681            script.push_str("  insecureSkipTLSVerify: true,\n");
682        }
683        script.push_str("  thresholds: {\n");
684        script.push_str("    checks: ['rate>0'],\n");
685        script.push_str("  },\n");
686        script.push_str("};\n\n");
687
688        // Base URL (includes base_path if configured)
689        script.push_str(&format!("const BASE_URL = '{}';\n\n", self.config.effective_base_url()));
690        script.push_str("const JSON_HEADERS = { 'Content-Type': 'application/json' };\n\n");
691
692        // Failure detail collector — logs req/res info for failed checks via console.log
693        // (k6's handleSummary runs in a separate JS context, so we can't use module-level arrays)
694        script.push_str("function __captureFailure(checkName, res, expected) {\n");
695        script.push_str("  let bodyStr = '';\n");
696        script.push_str("  try { bodyStr = res.body ? res.body.substring(0, 2000) : ''; } catch(e) { bodyStr = '<unreadable>'; }\n");
697        script.push_str("  let reqHeaders = {};\n");
698        script.push_str(
699            "  if (res.request && res.request.headers) { reqHeaders = res.request.headers; }\n",
700        );
701        script.push_str("  let reqBody = '';\n");
702        script.push_str("  if (res.request && res.request.body) { try { reqBody = res.request.body.substring(0, 2000); } catch(e) {} }\n");
703        script.push_str("  console.log('MOCKFORGE_FAILURE:' + JSON.stringify({\n");
704        script.push_str("    check: checkName,\n");
705        script.push_str("    request: {\n");
706        script.push_str("      method: res.request ? res.request.method : 'unknown',\n");
707        script.push_str("      url: res.request ? res.request.url : res.url || 'unknown',\n");
708        script.push_str("      headers: reqHeaders,\n");
709        script.push_str("      body: reqBody,\n");
710        script.push_str("    },\n");
711        script.push_str("    response: {\n");
712        script.push_str("      status: res.status,\n");
713        script.push_str("      headers: res.headers ? Object.fromEntries(Object.entries(res.headers).slice(0, 20)) : {},\n");
714        script.push_str("      body: bodyStr,\n");
715        script.push_str("    },\n");
716        script.push_str("    expected: expected,\n");
717        script.push_str("  }));\n");
718        script.push_str("}\n\n");
719
720        // Default function
721        script.push_str("export default function () {\n");
722
723        if self.config.has_cookie_header() {
724            script.push_str(
725                "  // Clear cookie jar to prevent server Set-Cookie from duplicating custom Cookie header\n",
726            );
727            script.push_str("  http.cookieJar().clear(BASE_URL);\n\n");
728        }
729
730        // Group operations by category
731        let mut category_ops: std::collections::BTreeMap<
732            &'static str,
733            Vec<(&AnnotatedOperation, &ConformanceFeature)>,
734        > = std::collections::BTreeMap::new();
735
736        for op in &self.operations {
737            for feature in &op.features {
738                let category = feature.category();
739                if self.config.should_include_category(category) {
740                    category_ops.entry(category).or_default().push((op, feature));
741                }
742            }
743        }
744
745        // Emit grouped tests
746        let mut total_checks = 0usize;
747        for (category, ops) in &category_ops {
748            script.push_str(&format!("  group('{}', function () {{\n", category));
749
750            if self.config.all_operations {
751                // All-operations mode: test every operation, using path-qualified check names
752                let mut emitted_checks: HashSet<String> = HashSet::new();
753                for (op, feature) in ops {
754                    let qualified = format!("{}:{}", feature.check_name(), op.path);
755                    if emitted_checks.insert(qualified.clone()) {
756                        self.emit_check_named(&mut script, op, feature, &qualified);
757                        total_checks += 1;
758                    }
759                }
760            } else {
761                // Default: one representative operation per feature, with path-qualified
762                // check names so failures identify which endpoint was tested.
763                let mut emitted_features: HashSet<&str> = HashSet::new();
764                for (op, feature) in ops {
765                    if emitted_features.insert(feature.check_name()) {
766                        let qualified = format!("{}:{}", feature.check_name(), op.path);
767                        self.emit_check_named(&mut script, op, feature, &qualified);
768                        total_checks += 1;
769                    }
770                }
771            }
772
773            script.push_str("  });\n\n");
774        }
775
776        // Custom checks from YAML file
777        if let Some(custom_group) = self.config.generate_custom_group()? {
778            script.push_str(&custom_group);
779        }
780
781        script.push_str("}\n\n");
782
783        // handleSummary
784        self.generate_handle_summary(&mut script);
785
786        Ok((script, total_checks))
787    }
788
789    /// Emit a single k6 check for an operation + feature with a custom check name
790    fn emit_check_named(
791        &self,
792        script: &mut String,
793        op: &AnnotatedOperation,
794        feature: &ConformanceFeature,
795        check_name: &str,
796    ) {
797        // Escape single quotes in check name since it's embedded in JS single-quoted strings
798        let check_name = check_name.replace('\'', "\\'");
799        let check_name = check_name.as_str();
800
801        script.push_str("    {\n");
802
803        // Build the URL path with parameters substituted
804        let mut url_path = op.path.clone();
805        for (name, value) in &op.path_params {
806            url_path = url_path.replace(&format!("{{{}}}", name), value);
807        }
808
809        // Build query string
810        if !op.query_params.is_empty() {
811            let qs: Vec<String> =
812                op.query_params.iter().map(|(k, v)| format!("{}={}", k, v)).collect();
813            url_path = format!("{}?{}", url_path, qs.join("&"));
814        }
815
816        let full_url = format!("${{BASE_URL}}{}", url_path);
817
818        // Build effective headers: merge spec-derived headers with custom headers.
819        // Custom headers override spec-derived ones with the same name.
820        let mut effective_headers = self.effective_headers(&op.header_params);
821
822        // For non-default response code checks, add header to tell the mock server
823        // which status code to return (the server defaults to the first declared status)
824        if matches!(feature, ConformanceFeature::Response400 | ConformanceFeature::Response404) {
825            let expected_code = match feature {
826                ConformanceFeature::Response400 => "400",
827                ConformanceFeature::Response404 => "404",
828                _ => unreachable!(),
829            };
830            effective_headers
831                .push(("X-Mockforge-Response-Status".to_string(), expected_code.to_string()));
832        }
833
834        // For security checks AND for all requests on endpoints with security requirements,
835        // inject auth credentials so the server doesn't reject with 401.
836        // Only inject if the user hasn't already provided the header via --custom-headers.
837        let needs_auth = matches!(
838            feature,
839            ConformanceFeature::SecurityBearer
840                | ConformanceFeature::SecurityBasic
841                | ConformanceFeature::SecurityApiKey
842        ) || !op.security_schemes.is_empty();
843
844        if needs_auth {
845            self.inject_security_headers(&op.security_schemes, &mut effective_headers);
846        }
847
848        let has_headers = !effective_headers.is_empty();
849        let headers_obj = if has_headers {
850            Self::format_headers(&effective_headers)
851        } else {
852            String::new()
853        };
854
855        // Determine HTTP method and emit request
856        match op.method.as_str() {
857            "GET" => {
858                if has_headers {
859                    script.push_str(&format!(
860                        "      let res = http.get(`{}`, {{ headers: {} }});\n",
861                        full_url, headers_obj
862                    ));
863                } else {
864                    script.push_str(&format!("      let res = http.get(`{}`);\n", full_url));
865                }
866            }
867            "POST" => {
868                self.emit_request_with_body(script, "post", &full_url, op, &effective_headers);
869            }
870            "PUT" => {
871                self.emit_request_with_body(script, "put", &full_url, op, &effective_headers);
872            }
873            "PATCH" => {
874                self.emit_request_with_body(script, "patch", &full_url, op, &effective_headers);
875            }
876            "DELETE" => {
877                if has_headers {
878                    script.push_str(&format!(
879                        "      let res = http.del(`{}`, null, {{ headers: {} }});\n",
880                        full_url, headers_obj
881                    ));
882                } else {
883                    script.push_str(&format!("      let res = http.del(`{}`);\n", full_url));
884                }
885            }
886            "HEAD" => {
887                if has_headers {
888                    script.push_str(&format!(
889                        "      let res = http.head(`{}`, {{ headers: {} }});\n",
890                        full_url, headers_obj
891                    ));
892                } else {
893                    script.push_str(&format!("      let res = http.head(`{}`);\n", full_url));
894                }
895            }
896            "OPTIONS" => {
897                if has_headers {
898                    script.push_str(&format!(
899                        "      let res = http.options(`{}`, null, {{ headers: {} }});\n",
900                        full_url, headers_obj
901                    ));
902                } else {
903                    script.push_str(&format!("      let res = http.options(`{}`);\n", full_url));
904                }
905            }
906            _ => {
907                if has_headers {
908                    script.push_str(&format!(
909                        "      let res = http.get(`{}`, {{ headers: {} }});\n",
910                        full_url, headers_obj
911                    ));
912                } else {
913                    script.push_str(&format!("      let res = http.get(`{}`);\n", full_url));
914                }
915            }
916        }
917
918        // Check: emit assertion based on feature type, with failure detail capture
919        if matches!(
920            feature,
921            ConformanceFeature::Response200
922                | ConformanceFeature::Response201
923                | ConformanceFeature::Response204
924                | ConformanceFeature::Response400
925                | ConformanceFeature::Response404
926        ) {
927            let expected_code = match feature {
928                ConformanceFeature::Response200 => 200,
929                ConformanceFeature::Response201 => 201,
930                ConformanceFeature::Response204 => 204,
931                ConformanceFeature::Response400 => 400,
932                ConformanceFeature::Response404 => 404,
933                _ => 200,
934            };
935            script.push_str(&format!(
936                "      {{ let ok = check(res, {{ '{}': (r) => r.status === {} }}); if (!ok) __captureFailure('{}', res, 'status === {}'); }}\n",
937                check_name, expected_code, check_name, expected_code
938            ));
939        } else if matches!(feature, ConformanceFeature::ResponseValidation) {
940            // Response schema validation — validate the response body against the schema
941            if let Some(schema) = &op.response_schema {
942                let validation_js = SchemaValidatorGenerator::generate_validation(schema);
943                script.push_str(&format!(
944                    "      try {{ let body = res.json(); {{ let ok = check(res, {{ '{}': (r) => ( {} ) }}); if (!ok) __captureFailure('{}', res, 'schema validation'); }} }} catch(e) {{ check(res, {{ '{}': () => false }}); __captureFailure('{}', res, 'JSON parse failed: ' + e.message); }}\n",
945                    check_name, validation_js, check_name, check_name, check_name
946                ));
947            }
948        } else if matches!(
949            feature,
950            ConformanceFeature::SecurityBearer
951                | ConformanceFeature::SecurityBasic
952                | ConformanceFeature::SecurityApiKey
953        ) {
954            // Security checks verify the server accepts the auth credentials (not 401/403)
955            script.push_str(&format!(
956                "      {{ let ok = check(res, {{ '{}': (r) => r.status >= 200 && r.status < 400 }}); if (!ok) __captureFailure('{}', res, 'status >= 200 && status < 400 (auth accepted)'); }}\n",
957                check_name, check_name
958            ));
959        } else {
960            script.push_str(&format!(
961                "      {{ let ok = check(res, {{ '{}': (r) => r.status >= 200 && r.status < 500 }}); if (!ok) __captureFailure('{}', res, 'status >= 200 && status < 500'); }}\n",
962                check_name, check_name
963            ));
964        }
965
966        // Clear cookie jar after each request to prevent Set-Cookie leaking
967        let has_cookie = self.config.has_cookie_header()
968            || effective_headers.iter().any(|(h, _)| h.eq_ignore_ascii_case("Cookie"));
969        if has_cookie {
970            script.push_str("      http.cookieJar().clear(BASE_URL);\n");
971        }
972
973        script.push_str("    }\n");
974
975        // Rate-limit delay between checks (to avoid 429 from target API)
976        if self.config.request_delay_ms > 0 {
977            script.push_str(&format!(
978                "    sleep({:.3});\n",
979                self.config.request_delay_ms as f64 / 1000.0
980            ));
981        }
982    }
983
984    /// Emit an HTTP request with a body
985    fn emit_request_with_body(
986        &self,
987        script: &mut String,
988        method: &str,
989        url: &str,
990        op: &AnnotatedOperation,
991        effective_headers: &[(String, String)],
992    ) {
993        if let Some(body) = &op.sample_body {
994            let escaped_body = body.replace('\'', "\\'");
995            let headers = if !effective_headers.is_empty() {
996                format!(
997                    "Object.assign({{}}, JSON_HEADERS, {})",
998                    Self::format_headers(effective_headers)
999                )
1000            } else {
1001                "JSON_HEADERS".to_string()
1002            };
1003            script.push_str(&format!(
1004                "      let res = http.{}(`{}`, '{}', {{ headers: {} }});\n",
1005                method, url, escaped_body, headers
1006            ));
1007        } else if !effective_headers.is_empty() {
1008            script.push_str(&format!(
1009                "      let res = http.{}(`{}`, null, {{ headers: {} }});\n",
1010                method,
1011                url,
1012                Self::format_headers(effective_headers)
1013            ));
1014        } else {
1015            script.push_str(&format!("      let res = http.{}(`{}`, null);\n", method, url));
1016        }
1017    }
1018
1019    /// Build effective headers by merging spec-derived headers with custom headers.
1020    /// Custom headers override spec-derived ones with the same name (case-insensitive).
1021    /// Custom headers not in the spec are appended.
1022    fn effective_headers(&self, spec_headers: &[(String, String)]) -> Vec<(String, String)> {
1023        let custom = &self.config.custom_headers;
1024        if custom.is_empty() {
1025            return spec_headers.to_vec();
1026        }
1027
1028        let mut result: Vec<(String, String)> = Vec::new();
1029
1030        // Start with spec headers, replacing values if a custom header matches
1031        for (name, value) in spec_headers {
1032            if let Some((_, custom_val)) =
1033                custom.iter().find(|(cn, _)| cn.eq_ignore_ascii_case(name))
1034            {
1035                result.push((name.clone(), custom_val.clone()));
1036            } else {
1037                result.push((name.clone(), value.clone()));
1038            }
1039        }
1040
1041        // Append custom headers that aren't already in spec headers
1042        for (name, value) in custom {
1043            if !spec_headers.iter().any(|(sn, _)| sn.eq_ignore_ascii_case(name)) {
1044                result.push((name.clone(), value.clone()));
1045            }
1046        }
1047
1048        result
1049    }
1050
1051    /// Inject security headers based on resolved security scheme details.
1052    /// Respects user-provided custom headers (won't overwrite if already set).
1053    fn inject_security_headers(
1054        &self,
1055        schemes: &[SecuritySchemeInfo],
1056        headers: &mut Vec<(String, String)>,
1057    ) {
1058        let mut to_add: Vec<(String, String)> = Vec::new();
1059
1060        let has_header = |name: &str, headers: &[(String, String)]| {
1061            headers.iter().any(|(h, _)| h.eq_ignore_ascii_case(name))
1062                || self.config.custom_headers.iter().any(|(h, _)| h.eq_ignore_ascii_case(name))
1063        };
1064
1065        for scheme in schemes {
1066            match scheme {
1067                SecuritySchemeInfo::Bearer => {
1068                    if !has_header("Authorization", headers) {
1069                        // MockForge mock server accepts any Bearer token
1070                        to_add.push((
1071                            "Authorization".to_string(),
1072                            "Bearer mockforge-conformance-test-token".to_string(),
1073                        ));
1074                    }
1075                }
1076                SecuritySchemeInfo::Basic => {
1077                    if !has_header("Authorization", headers) {
1078                        let creds = self.config.basic_auth.as_deref().unwrap_or("test:test");
1079                        use base64::Engine;
1080                        let encoded =
1081                            base64::engine::general_purpose::STANDARD.encode(creds.as_bytes());
1082                        to_add.push(("Authorization".to_string(), format!("Basic {}", encoded)));
1083                    }
1084                }
1085                SecuritySchemeInfo::ApiKey { location, name } => match location {
1086                    ApiKeyLocation::Header => {
1087                        if !has_header(name, headers) {
1088                            let key = self
1089                                .config
1090                                .api_key
1091                                .as_deref()
1092                                .unwrap_or("mockforge-conformance-test-key");
1093                            to_add.push((name.clone(), key.to_string()));
1094                        }
1095                    }
1096                    ApiKeyLocation::Cookie => {
1097                        if !has_header("Cookie", headers) {
1098                            to_add.push((
1099                                "Cookie".to_string(),
1100                                format!("{}=mockforge-conformance-test-session", name),
1101                            ));
1102                        }
1103                    }
1104                    ApiKeyLocation::Query => {
1105                        // Query params are handled via URL, not headers — skip here
1106                    }
1107                },
1108            }
1109        }
1110
1111        headers.extend(to_add);
1112    }
1113
1114    /// Format header params as a JS object literal
1115    fn format_headers(headers: &[(String, String)]) -> String {
1116        let entries: Vec<String> = headers
1117            .iter()
1118            .map(|(k, v)| format!("'{}': '{}'", k, v.replace('\'', "\\'")))
1119            .collect();
1120        format!("{{ {} }}", entries.join(", "))
1121    }
1122
1123    /// handleSummary — same format as reference mode for report compatibility
1124    fn generate_handle_summary(&self, script: &mut String) {
1125        // Use absolute path for report output so k6 writes where the CLI expects
1126        let report_path = match &self.config.output_dir {
1127            Some(dir) => {
1128                let abs = std::fs::canonicalize(dir)
1129                    .unwrap_or_else(|_| dir.clone())
1130                    .join("conformance-report.json");
1131                abs.to_string_lossy().to_string()
1132            }
1133            None => "conformance-report.json".to_string(),
1134        };
1135
1136        script.push_str("export function handleSummary(data) {\n");
1137        script.push_str("  let checks = {};\n");
1138        script.push_str("  if (data.metrics && data.metrics.checks) {\n");
1139        script.push_str("    checks.overall_pass_rate = data.metrics.checks.values.rate;\n");
1140        script.push_str("  }\n");
1141        script.push_str("  let checkResults = {};\n");
1142        script.push_str("  function walkGroups(group) {\n");
1143        script.push_str("    if (group.checks) {\n");
1144        script.push_str("      for (let checkObj of group.checks) {\n");
1145        script.push_str("        checkResults[checkObj.name] = {\n");
1146        script.push_str("          passes: checkObj.passes,\n");
1147        script.push_str("          fails: checkObj.fails,\n");
1148        script.push_str("        };\n");
1149        script.push_str("      }\n");
1150        script.push_str("    }\n");
1151        script.push_str("    if (group.groups) {\n");
1152        script.push_str("      for (let subGroup of group.groups) {\n");
1153        script.push_str("        walkGroups(subGroup);\n");
1154        script.push_str("      }\n");
1155        script.push_str("    }\n");
1156        script.push_str("  }\n");
1157        script.push_str("  if (data.root_group) {\n");
1158        script.push_str("    walkGroups(data.root_group);\n");
1159        script.push_str("  }\n");
1160        script.push_str("  return {\n");
1161        script.push_str(&format!(
1162            "    '{}': JSON.stringify({{ checks: checkResults, overall: checks }}, null, 2),\n",
1163            report_path
1164        ));
1165        script.push_str("    stdout: textSummary(data, { indent: '  ', enableColors: true }),\n");
1166        script.push_str("  };\n");
1167        script.push_str("}\n\n");
1168        script.push_str("function textSummary(data, opts) {\n");
1169        script.push_str("  return JSON.stringify(data, null, 2);\n");
1170        script.push_str("}\n");
1171    }
1172}
1173
1174#[cfg(test)]
1175mod tests {
1176    use super::*;
1177    use openapiv3::{
1178        Operation, ParameterData, ParameterSchemaOrContent, PathStyle, Response, Schema,
1179        SchemaData, SchemaKind, StringType, Type,
1180    };
1181
1182    fn make_op(method: &str, path: &str, operation: Operation) -> ApiOperation {
1183        ApiOperation {
1184            method: method.to_string(),
1185            path: path.to_string(),
1186            operation,
1187            operation_id: None,
1188        }
1189    }
1190
1191    fn empty_spec() -> OpenAPI {
1192        OpenAPI::default()
1193    }
1194
1195    #[test]
1196    fn test_annotate_get_with_path_param() {
1197        let mut op = Operation::default();
1198        op.parameters.push(ReferenceOr::Item(Parameter::Path {
1199            parameter_data: ParameterData {
1200                name: "id".to_string(),
1201                description: None,
1202                required: true,
1203                deprecated: None,
1204                format: ParameterSchemaOrContent::Schema(ReferenceOr::Item(Schema {
1205                    schema_data: SchemaData::default(),
1206                    schema_kind: SchemaKind::Type(Type::String(StringType::default())),
1207                })),
1208                example: None,
1209                examples: Default::default(),
1210                explode: None,
1211                extensions: Default::default(),
1212            },
1213            style: PathStyle::Simple,
1214        }));
1215
1216        let api_op = make_op("get", "/users/{id}", op);
1217        let annotated = SpecDrivenConformanceGenerator::annotate_operation(&api_op, &empty_spec());
1218
1219        assert!(annotated.features.contains(&ConformanceFeature::MethodGet));
1220        assert!(annotated.features.contains(&ConformanceFeature::PathParamString));
1221        assert!(annotated.features.contains(&ConformanceFeature::ConstraintRequired));
1222        assert_eq!(annotated.path_params.len(), 1);
1223        assert_eq!(annotated.path_params[0].0, "id");
1224    }
1225
1226    #[test]
1227    fn test_annotate_post_with_json_body() {
1228        let mut op = Operation::default();
1229        let mut body = openapiv3::RequestBody {
1230            required: true,
1231            ..Default::default()
1232        };
1233        body.content
1234            .insert("application/json".to_string(), openapiv3::MediaType::default());
1235        op.request_body = Some(ReferenceOr::Item(body));
1236
1237        let api_op = make_op("post", "/items", op);
1238        let annotated = SpecDrivenConformanceGenerator::annotate_operation(&api_op, &empty_spec());
1239
1240        assert!(annotated.features.contains(&ConformanceFeature::MethodPost));
1241        assert!(annotated.features.contains(&ConformanceFeature::BodyJson));
1242    }
1243
1244    #[test]
1245    fn test_annotate_response_codes() {
1246        let mut op = Operation::default();
1247        op.responses
1248            .responses
1249            .insert(openapiv3::StatusCode::Code(200), ReferenceOr::Item(Response::default()));
1250        op.responses
1251            .responses
1252            .insert(openapiv3::StatusCode::Code(404), ReferenceOr::Item(Response::default()));
1253
1254        let api_op = make_op("get", "/items", op);
1255        let annotated = SpecDrivenConformanceGenerator::annotate_operation(&api_op, &empty_spec());
1256
1257        assert!(annotated.features.contains(&ConformanceFeature::Response200));
1258        assert!(annotated.features.contains(&ConformanceFeature::Response404));
1259    }
1260
1261    #[test]
1262    fn test_generate_spec_driven_script() {
1263        let config = ConformanceConfig {
1264            target_url: "http://localhost:3000".to_string(),
1265            api_key: None,
1266            basic_auth: None,
1267            skip_tls_verify: false,
1268            categories: None,
1269            base_path: None,
1270            custom_headers: vec![],
1271            output_dir: None,
1272            all_operations: false,
1273            custom_checks_file: None,
1274            request_delay_ms: 0,
1275        };
1276
1277        let operations = vec![AnnotatedOperation {
1278            path: "/users/{id}".to_string(),
1279            method: "GET".to_string(),
1280            features: vec![
1281                ConformanceFeature::MethodGet,
1282                ConformanceFeature::PathParamString,
1283            ],
1284            request_body_content_type: None,
1285            sample_body: None,
1286            query_params: vec![],
1287            header_params: vec![],
1288            path_params: vec![("id".to_string(), "test-value".to_string())],
1289            response_schema: None,
1290            security_schemes: vec![],
1291        }];
1292
1293        let gen = SpecDrivenConformanceGenerator::new(config, operations);
1294        let (script, _check_count) = gen.generate().unwrap();
1295
1296        assert!(script.contains("import http from 'k6/http'"));
1297        assert!(script.contains("/users/test-value"));
1298        assert!(script.contains("param:path:string"));
1299        assert!(script.contains("method:GET"));
1300        assert!(script.contains("handleSummary"));
1301    }
1302
1303    #[test]
1304    fn test_generate_with_category_filter() {
1305        let config = ConformanceConfig {
1306            target_url: "http://localhost:3000".to_string(),
1307            api_key: None,
1308            basic_auth: None,
1309            skip_tls_verify: false,
1310            categories: Some(vec!["Parameters".to_string()]),
1311            base_path: None,
1312            custom_headers: vec![],
1313            output_dir: None,
1314            all_operations: false,
1315            custom_checks_file: None,
1316            request_delay_ms: 0,
1317        };
1318
1319        let operations = vec![AnnotatedOperation {
1320            path: "/users/{id}".to_string(),
1321            method: "GET".to_string(),
1322            features: vec![
1323                ConformanceFeature::MethodGet,
1324                ConformanceFeature::PathParamString,
1325            ],
1326            request_body_content_type: None,
1327            sample_body: None,
1328            query_params: vec![],
1329            header_params: vec![],
1330            path_params: vec![("id".to_string(), "1".to_string())],
1331            response_schema: None,
1332            security_schemes: vec![],
1333        }];
1334
1335        let gen = SpecDrivenConformanceGenerator::new(config, operations);
1336        let (script, _check_count) = gen.generate().unwrap();
1337
1338        assert!(script.contains("group('Parameters'"));
1339        assert!(!script.contains("group('HTTP Methods'"));
1340    }
1341
1342    #[test]
1343    fn test_annotate_response_validation() {
1344        use openapiv3::ObjectType;
1345
1346        // Operation with a 200 response that has a JSON schema
1347        let mut op = Operation::default();
1348        let mut response = Response::default();
1349        let mut media = openapiv3::MediaType::default();
1350        let mut obj_type = ObjectType::default();
1351        obj_type.properties.insert(
1352            "name".to_string(),
1353            ReferenceOr::Item(Box::new(Schema {
1354                schema_data: SchemaData::default(),
1355                schema_kind: SchemaKind::Type(Type::String(StringType::default())),
1356            })),
1357        );
1358        obj_type.required = vec!["name".to_string()];
1359        media.schema = Some(ReferenceOr::Item(Schema {
1360            schema_data: SchemaData::default(),
1361            schema_kind: SchemaKind::Type(Type::Object(obj_type)),
1362        }));
1363        response.content.insert("application/json".to_string(), media);
1364        op.responses
1365            .responses
1366            .insert(openapiv3::StatusCode::Code(200), ReferenceOr::Item(response));
1367
1368        let api_op = make_op("get", "/users", op);
1369        let annotated = SpecDrivenConformanceGenerator::annotate_operation(&api_op, &empty_spec());
1370
1371        assert!(
1372            annotated.features.contains(&ConformanceFeature::ResponseValidation),
1373            "Should detect ResponseValidation when response has a JSON schema"
1374        );
1375        assert!(annotated.response_schema.is_some(), "Should extract the response schema");
1376
1377        // Verify generated script includes schema validation with try-catch
1378        let config = ConformanceConfig {
1379            target_url: "http://localhost:3000".to_string(),
1380            api_key: None,
1381            basic_auth: None,
1382            skip_tls_verify: false,
1383            categories: None,
1384            base_path: None,
1385            custom_headers: vec![],
1386            output_dir: None,
1387            all_operations: false,
1388            custom_checks_file: None,
1389            request_delay_ms: 0,
1390        };
1391        let gen = SpecDrivenConformanceGenerator::new(config, vec![annotated]);
1392        let (script, _check_count) = gen.generate().unwrap();
1393
1394        assert!(
1395            script.contains("response:schema:validation"),
1396            "Script should contain the validation check name"
1397        );
1398        assert!(script.contains("try {"), "Script should wrap validation in try-catch");
1399        assert!(script.contains("res.json()"), "Script should parse response as JSON");
1400    }
1401
1402    #[test]
1403    fn test_annotate_global_security() {
1404        // Spec with global security requirement, operation without its own security
1405        let op = Operation::default();
1406        let mut spec = OpenAPI::default();
1407        let mut global_req = openapiv3::SecurityRequirement::new();
1408        global_req.insert("bearerAuth".to_string(), vec![]);
1409        spec.security = Some(vec![global_req]);
1410        // Define the security scheme in components
1411        let mut components = openapiv3::Components::default();
1412        components.security_schemes.insert(
1413            "bearerAuth".to_string(),
1414            ReferenceOr::Item(SecurityScheme::HTTP {
1415                scheme: "bearer".to_string(),
1416                bearer_format: Some("JWT".to_string()),
1417                description: None,
1418                extensions: Default::default(),
1419            }),
1420        );
1421        spec.components = Some(components);
1422
1423        let api_op = make_op("get", "/protected", op);
1424        let annotated = SpecDrivenConformanceGenerator::annotate_operation(&api_op, &spec);
1425
1426        assert!(
1427            annotated.features.contains(&ConformanceFeature::SecurityBearer),
1428            "Should detect SecurityBearer from global security + components"
1429        );
1430    }
1431
1432    #[test]
1433    fn test_annotate_security_scheme_resolution() {
1434        // Test that security scheme type is resolved from components, not just name heuristic
1435        let mut op = Operation::default();
1436        // Use a generic name that wouldn't match name heuristics
1437        let mut req = openapiv3::SecurityRequirement::new();
1438        req.insert("myAuth".to_string(), vec![]);
1439        op.security = Some(vec![req]);
1440
1441        let mut spec = OpenAPI::default();
1442        let mut components = openapiv3::Components::default();
1443        components.security_schemes.insert(
1444            "myAuth".to_string(),
1445            ReferenceOr::Item(SecurityScheme::APIKey {
1446                location: openapiv3::APIKeyLocation::Header,
1447                name: "X-API-Key".to_string(),
1448                description: None,
1449                extensions: Default::default(),
1450            }),
1451        );
1452        spec.components = Some(components);
1453
1454        let api_op = make_op("get", "/data", op);
1455        let annotated = SpecDrivenConformanceGenerator::annotate_operation(&api_op, &spec);
1456
1457        assert!(
1458            annotated.features.contains(&ConformanceFeature::SecurityApiKey),
1459            "Should detect SecurityApiKey from SecurityScheme::APIKey, not name heuristic"
1460        );
1461    }
1462
1463    #[test]
1464    fn test_annotate_content_negotiation() {
1465        let mut op = Operation::default();
1466        let mut response = Response::default();
1467        // Response with multiple content types
1468        response
1469            .content
1470            .insert("application/json".to_string(), openapiv3::MediaType::default());
1471        response
1472            .content
1473            .insert("application/xml".to_string(), openapiv3::MediaType::default());
1474        op.responses
1475            .responses
1476            .insert(openapiv3::StatusCode::Code(200), ReferenceOr::Item(response));
1477
1478        let api_op = make_op("get", "/items", op);
1479        let annotated = SpecDrivenConformanceGenerator::annotate_operation(&api_op, &empty_spec());
1480
1481        assert!(
1482            annotated.features.contains(&ConformanceFeature::ContentNegotiation),
1483            "Should detect ContentNegotiation when response has multiple content types"
1484        );
1485    }
1486
1487    #[test]
1488    fn test_no_content_negotiation_for_single_type() {
1489        let mut op = Operation::default();
1490        let mut response = Response::default();
1491        response
1492            .content
1493            .insert("application/json".to_string(), openapiv3::MediaType::default());
1494        op.responses
1495            .responses
1496            .insert(openapiv3::StatusCode::Code(200), ReferenceOr::Item(response));
1497
1498        let api_op = make_op("get", "/items", op);
1499        let annotated = SpecDrivenConformanceGenerator::annotate_operation(&api_op, &empty_spec());
1500
1501        assert!(
1502            !annotated.features.contains(&ConformanceFeature::ContentNegotiation),
1503            "Should NOT detect ContentNegotiation for a single content type"
1504        );
1505    }
1506
1507    #[test]
1508    fn test_spec_driven_with_base_path() {
1509        let annotated = AnnotatedOperation {
1510            path: "/users".to_string(),
1511            method: "GET".to_string(),
1512            features: vec![ConformanceFeature::MethodGet],
1513            path_params: vec![],
1514            query_params: vec![],
1515            header_params: vec![],
1516            request_body_content_type: None,
1517            sample_body: None,
1518            response_schema: None,
1519            security_schemes: vec![],
1520        };
1521        let config = ConformanceConfig {
1522            target_url: "https://192.168.2.86/".to_string(),
1523            api_key: None,
1524            basic_auth: None,
1525            skip_tls_verify: true,
1526            categories: None,
1527            base_path: Some("/api".to_string()),
1528            custom_headers: vec![],
1529            output_dir: None,
1530            all_operations: false,
1531            custom_checks_file: None,
1532            request_delay_ms: 0,
1533        };
1534        let gen = SpecDrivenConformanceGenerator::new(config, vec![annotated]);
1535        let (script, _check_count) = gen.generate().unwrap();
1536
1537        assert!(
1538            script.contains("const BASE_URL = 'https://192.168.2.86/api'"),
1539            "BASE_URL should include the base_path. Got: {}",
1540            script.lines().find(|l| l.contains("BASE_URL")).unwrap_or("not found")
1541        );
1542    }
1543
1544    #[test]
1545    fn test_spec_driven_with_custom_headers() {
1546        let annotated = AnnotatedOperation {
1547            path: "/users".to_string(),
1548            method: "GET".to_string(),
1549            features: vec![ConformanceFeature::MethodGet],
1550            path_params: vec![],
1551            query_params: vec![],
1552            header_params: vec![
1553                ("X-Avi-Tenant".to_string(), "test-value".to_string()),
1554                ("X-CSRFToken".to_string(), "test-value".to_string()),
1555            ],
1556            request_body_content_type: None,
1557            sample_body: None,
1558            response_schema: None,
1559            security_schemes: vec![],
1560        };
1561        let config = ConformanceConfig {
1562            target_url: "https://192.168.2.86/".to_string(),
1563            api_key: None,
1564            basic_auth: None,
1565            skip_tls_verify: true,
1566            categories: None,
1567            base_path: Some("/api".to_string()),
1568            custom_headers: vec![
1569                ("X-Avi-Tenant".to_string(), "admin".to_string()),
1570                ("X-CSRFToken".to_string(), "real-csrf-token".to_string()),
1571                ("Cookie".to_string(), "sessionid=abc123".to_string()),
1572            ],
1573            output_dir: None,
1574            all_operations: false,
1575            custom_checks_file: None,
1576            request_delay_ms: 0,
1577        };
1578        let gen = SpecDrivenConformanceGenerator::new(config, vec![annotated]);
1579        let (script, _check_count) = gen.generate().unwrap();
1580
1581        // Custom headers should override spec-derived test-value placeholders
1582        assert!(
1583            script.contains("'X-Avi-Tenant': 'admin'"),
1584            "Should use custom value for X-Avi-Tenant, not test-value"
1585        );
1586        assert!(
1587            script.contains("'X-CSRFToken': 'real-csrf-token'"),
1588            "Should use custom value for X-CSRFToken, not test-value"
1589        );
1590        // Custom headers not in spec should be appended
1591        assert!(
1592            script.contains("'Cookie': 'sessionid=abc123'"),
1593            "Should include Cookie header from custom_headers"
1594        );
1595        // test-value should NOT appear
1596        assert!(
1597            !script.contains("'test-value'"),
1598            "test-value placeholders should be replaced by custom values"
1599        );
1600    }
1601
1602    #[test]
1603    fn test_effective_headers_merging() {
1604        let config = ConformanceConfig {
1605            target_url: "http://localhost".to_string(),
1606            api_key: None,
1607            basic_auth: None,
1608            skip_tls_verify: false,
1609            categories: None,
1610            base_path: None,
1611            custom_headers: vec![
1612                ("X-Auth".to_string(), "real-token".to_string()),
1613                ("Cookie".to_string(), "session=abc".to_string()),
1614            ],
1615            output_dir: None,
1616            all_operations: false,
1617            custom_checks_file: None,
1618            request_delay_ms: 0,
1619        };
1620        let gen = SpecDrivenConformanceGenerator::new(config, vec![]);
1621
1622        // Spec headers with a matching custom header
1623        let spec_headers = vec![
1624            ("X-Auth".to_string(), "test-value".to_string()),
1625            ("X-Other".to_string(), "keep-this".to_string()),
1626        ];
1627        let effective = gen.effective_headers(&spec_headers);
1628
1629        // X-Auth should be overridden
1630        assert_eq!(effective[0], ("X-Auth".to_string(), "real-token".to_string()));
1631        // X-Other should be kept as-is
1632        assert_eq!(effective[1], ("X-Other".to_string(), "keep-this".to_string()));
1633        // Cookie should be appended
1634        assert_eq!(effective[2], ("Cookie".to_string(), "session=abc".to_string()));
1635    }
1636}
mockforge_bench/conformance/spec_driven.rs

mockforge_bench/conformance/
spec_driven.rs
