CodePark/ questions / HTTP / API tests with supertest
START PRACTICINGPRACTICE
Backend question · Backend testing › HTTP / API tests with supertest

Beyond checking for a successful status, what should API tests for a POST /orders endpoint cover?

Test every promise the endpoint makes (its contract), not only the happy path.

  • Validation: missing or badly formed fields give 400 with a useful error body. If you use whitelist, unknown fields are rejected or stripped.
  • Auth: 401 without credentials. 403 for a user who is not allowed to order for that account.
  • Success: 201, the new id or a Location header, the right response shape, and no internal or sensitive fields.
  • Side effects: the order really exists in the database afterwards, and the event or job was published.
  • Business errors: out-of-stock or duplicate requests return the right status, such as 409 or 422. They leave no half-written data behind.
  • Server errors: a 500 doesn't leak a stack trace.

Write each case as a separate test. Then a failure points at exactly one rule.

  • Validation errors return 400 with a clear error body.
  • Auth returns 401 when not logged in and 403 when not allowed.
  • Success returns the right status and shape, with no leaked fields.
  • Check side effects in the database and on the queue.
  • Business errors return the correct status and leave no partial writes.