Baran Doğanbaş

@api
Feature: Booking API
  CRUD lifecycle of a booking via RESTful Booker, including token-based auth
  and what the API does when the token is missing.

  # …

  # The token is the only thing standing between the public internet and someone
  # else's reservation, so its absence is asserted rather than assumed.
  Scenario: A write without a token is refused
    Given a booking exists with a total price of 150
    When I try to update the booking without a token
    Then the request should be refused as forbidden
    And the booking total price should still be 150

import { expect } from '@playwright/test';
import { createBdd } from 'playwright-bdd';
import { test, type World } from '../../fixtures/fixtures';
// …

When('I try to update the booking without a token', async ({ booker, world }) => {
  const id = fromWorld(world.bookingId, 'bookingId', 'Given a booking exists');
  world.lastResponse = await booker.updateBookingUnauthenticated(id, { totalprice: 1 });
});

Then('the request should be refused as forbidden', async ({ world }) => {
  const response = fromWorld(
    world.lastResponse,
    'lastResponse',
    'When I try to update the booking without a token',
  );
  expect(response.status(), await responseDetail(response)).toBe(403);
});

Then('the booking total price should still be {int}', async ({ booker, world }, price: number) => {
  const id = fromWorld(world.bookingId, 'bookingId', 'Given a booking exists');
  await expectTotalPrice(booker, id, price);
});

// …

async function expectTotalPrice(booker: BookerClient, id: number, price: number): Promise<void> {
  const response = await booker.getBooking(id);
  expect(response.status()).toBe(200);

  const body = (await response.json()) as Booking;
  expect(body.totalprice).toBe(price);
}

/** Puts the response body in the failure message, so a red run needs no re-run to diagnose. */
async function responseDetail(response: {
  status(): number;
  text(): Promise<string>;
}): Promise<string> {
  return `unexpected status ${response.status()}, body: ${(await response.text()).slice(0, 300)}`;
}

/** Typed wrapper over Playwright's `request`. Nothing here asserts, which is what makes the retry safe. */
export class BookerClient {
  constructor(private readonly request: APIRequestContext) {}

  /**
   * The only retried request in the suite. It is a precondition rather than a subject
   * under test, and it is where a sandbox cold start turns a healthy run red.
   */
  async requestToken(): Promise<string> {
    const attempts = env.api.tokenRetries;
    const failures: string[] = [];

    for (let attempt = 1; attempt <= attempts; attempt++) {
      try {
        const response = await this.request.post('/auth', {
          data: env.api.credentials,
          timeout: env.api.timeout,
        });

        if (response.ok()) {
          const body = (await response.json()) as { token?: string; reason?: string };
          if (body.token) return body.token;
          failures.push(`attempt ${attempt}: 200 but no token (reason: ${body.reason ?? 'none'})`);
        } else {
          failures.push(`attempt ${attempt}: HTTP ${response.status()}`);
        }
      } catch (error) {
        failures.push(`attempt ${attempt}: ${(error as Error).message}`);
      }

      if (attempt < attempts) {
        // Linear backoff: a cold-starting dyno needs seconds, not milliseconds.
        await new Promise((resolve) => setTimeout(resolve, attempt * 1_000));
      }
    }

    throw new Error(
      `Could not obtain an auth token from ${env.api.baseURL} after ${attempts} attempts:\n` +
        failures.map((line) => `  ${line}`).join('\n'),
    );
  }

  // …

  /**
   * Its own method rather than an optional token argument: with an optional argument an
   * undefined token would silently turn an authorized test into this one.
   */
  updateBookingUnauthenticated(id: number, patch: Partial<Booking>): Promise<APIResponse> {
    return this.request.patch(`/booking/${id}`, { data: patch, timeout: env.api.timeout });
  }

  // …
}