@assertrx/dino 1.0.9 → 1.0.11

package/skills/generating-tests-from-code/reference/auth-analysis.md

@@ -0,0 +1,220 @@
+# Authentication Analysis Reference
+
+## Auth Detection Patterns by Framework
+
+### Express (Node.js)
+
+**JWT Authentication:**
+```javascript
+// Look for: passport, jsonwebtoken, express-jwt, middleware patterns
+const jwt = require('jsonwebtoken');
+app.use('/api', authenticateToken);  // Global auth middleware
+
+function authenticateToken(req, res, next) {
+  const token = req.headers['authorization']?.split(' ')[1];
+  jwt.verify(token, process.env.SECRET, (err, user) => { /* ... */ });
+}
+```
+**Detection:** Search for `jsonwebtoken`, `passport-jwt`, `express-jwt`, `Authorization` header parsing.
+
+**Session Authentication:**
+```javascript
+// Look for: express-session, passport with session strategy
+app.use(session({ secret: '...', resave: false }));
+app.use(passport.initialize());
+app.use(passport.session());
+```
+**Detection:** Search for `express-session`, `passport.session()`, `req.session`.
+
+**API Key:**
+```javascript
+// Look for: custom middleware checking headers or query params
+app.use((req, res, next) => {
+  const apiKey = req.headers['x-api-key'];
+  if (!apiKey || !validKeys.includes(apiKey)) return res.status(401).json({});
+});
+```
+**Detection:** Search for `x-api-key`, `apikey`, `api_key` in middleware.
+
+### NestJS
+
+**Guards (JWT):**
+```typescript
+// Look for: @UseGuards, AuthGuard, JwtAuthGuard
+@UseGuards(JwtAuthGuard)
+@Controller('users')
+export class UsersController { /* ... */ }
+
+// Or per-route
+@UseGuards(AuthGuard('jwt'))
+@Get('profile')
+getProfile() { /* ... */ }
+```
+**Detection:** Search for `@UseGuards`, `AuthGuard`, `JwtStrategy`, `@nestjs/passport`.
+
+**Public Routes:**
+```typescript
+// Look for: @Public(), @SkipAuth(), or custom decorators
+@Public()
+@Get('health')
+healthCheck() { /* ... */ }
+```
+**Detection:** Search for `@Public`, `@SkipAuth`, `SetMetadata('isPublic', true)`.
+
+### Spring Boot (Java)
+
+**Spring Security:**
+```java
+// Look for: SecurityFilterChain, WebSecurityConfigurerAdapter
+@Bean
+public SecurityFilterChain filterChain(HttpSecurity http) {
+    http.authorizeHttpRequests(auth -> auth
+        .requestMatchers("/api/public/**").permitAll()
+        .requestMatchers("/api/admin/**").hasRole("ADMIN")
+        .anyRequest().authenticated()
+    );
+}
+```
+**Detection:** Search for `SecurityFilterChain`, `@EnableWebSecurity`, `authorizeHttpRequests`, `antMatchers`.
+
+**JWT in Spring:**
+```java
+// Look for: OncePerRequestFilter, JWT token parsing
+@Component
+public class JwtAuthFilter extends OncePerRequestFilter {
+    protected void doFilterInternal(request, response, chain) {
+        String token = request.getHeader("Authorization");
+        // verify token
+    }
+}
+```
+**Detection:** Search for `JwtAuthFilter`, `OncePerRequestFilter`, `@PreAuthorize`.
+
+### FastAPI (Python)
+
+**OAuth2/JWT:**
+```python
+# Look for: Depends(), OAuth2PasswordBearer, HTTPBearer
+oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token")
+
+@app.get("/users/me")
+async def read_users_me(token: str = Depends(oauth2_scheme)):
+    user = decode_token(token)
+    return user
+```
+**Detection:** Search for `Depends(`, `OAuth2PasswordBearer`, `HTTPBearer`, `Security(`.
+
+**API Key:**
+```python
+api_key_header = APIKeyHeader(name="X-API-Key")
+
+@app.get("/data")
+async def get_data(api_key: str = Depends(api_key_header)):
+    pass
+```
+**Detection:** Search for `APIKeyHeader`, `APIKeyQuery`, `APIKeyCookie`.
+
+### Django REST Framework (Python)
+
+**Permission Classes:**
+```python
+# Look for: permission_classes, authentication_classes
+class UserViewSet(viewsets.ModelViewSet):
+    authentication_classes = [TokenAuthentication, SessionAuthentication]
+    permission_classes = [IsAuthenticated]
+```
+**Detection:** Search for `permission_classes`, `authentication_classes`, `IsAuthenticated`, `AllowAny`, `TokenAuthentication`, `JWTAuthentication`.
+
+---
+
+## k6 Auth Setup Generation
+
+### JWT Token Flow
+
+```javascript
+export function setup() {
+  const loginRes = http.post(`${BASE_URL}/auth/login`,
+    JSON.stringify({
+      username: __ENV.TEST_USERNAME || 'testuser',
+      password: __ENV.TEST_PASSWORD || 'testpass',
+    }),
+    { headers: { 'Content-Type': 'application/json' } }
+  );
+
+  check(loginRes, { 'login successful': (r) => r.status === 200 });
+  const token = loginRes.json('access_token');
+  return { token };
+}
+
+export default function (data) {
+  const headers = {
+    'Content-Type': 'application/json',
+    'Authorization': `Bearer ${data.token}`,
+  };
+  // Use headers in all requests
+}
+```
+
+### Session/Cookie Flow
+
+```javascript
+export default function () {
+  // Login (cookies auto-stored in VU cookie jar)
+  const loginRes = http.post(`${BASE_URL}/login`, {
+    username: 'testuser',
+    password: 'testpass',
+  });
+  check(loginRes, { 'logged in': (r) => r.status === 200 || r.status === 302 });
+
+  // Subsequent requests include session cookie automatically
+  http.get(`${BASE_URL}/dashboard`);
+}
+```
+
+### API Key Flow
+
+```javascript
+const API_KEY = __ENV.API_KEY || 'test-api-key';
+
+export default function () {
+  http.get(`${BASE_URL}/data`, {
+    headers: { 'X-API-Key': API_KEY },
+  });
+}
+```
+
+### OAuth2 Client Credentials Flow
+
+```javascript
+import encoding from 'k6/encoding';
+
+export function setup() {
+  const res = http.post(`${AUTH_URL}/oauth/token`,
+    'grant_type=client_credentials&scope=read write',
+    {
+      headers: {
+        'Content-Type': 'application/x-www-form-urlencoded',
+        'Authorization': `Basic ${encoding.b64encode(`${CLIENT_ID}:${CLIENT_SECRET}`)}`,
+      },
+    }
+  );
+  return { token: res.json('access_token') };
+}
+```
+
+## Identifying Protected vs Public Endpoints
+
+Build a table of endpoints with their auth requirements:
+
+| Endpoint | Method | Auth Required | Auth Type | Notes |
+|----------|--------|---------------|-----------|-------|
+| `/health` | GET | No | - | Health check |
+| `/auth/login` | POST | No | - | Login endpoint |
+| `/api/users` | GET | Yes | JWT Bearer | List users |
+| `/api/admin/settings` | GET | Yes | JWT + Admin Role | Admin only |
+
+Use this table to:
+1. Generate `setup()` with appropriate login flow
+2. Test public endpoints without auth
+3. Group protected endpoints under authenticated scenarios
+4. Test authorization (access control) with different user roles

package/skills/generating-tests-from-code/reference/framework-patterns.md

@@ -0,0 +1,242 @@
+# Framework Route Analysis Patterns
+
+## Express (Node.js)
+
+### Where to Find Routes
+
+```
+src/routes/         — Route files
+src/app.js          — Main app with app.use() mounts
+src/index.js        — Entry point
+src/controllers/    — Controller functions
+```
+
+### Route Patterns
+
+```javascript
+// Direct route definition
+app.get('/users', getUsers);
+app.post('/users', createUser);
+app.put('/users/:id', updateUser);
+app.delete('/users/:id', deleteUser);
+
+// Router module
+const router = express.Router();
+router.get('/', listItems);
+router.post('/', createItem);
+router.get('/:id', getItem);
+
+// Mount point
+app.use('/api/items', router);
+// → Full paths: GET /api/items, POST /api/items, GET /api/items/:id
+```
+
+### Extracting Info
+
+- **URL params:** `:id`, `:userId` → dynamic path segments
+- **Query params:** Look for `req.query.page`, `req.query.limit`
+- **Body:** Look for `req.body.name`, `req.body.email` or validation schemas
+- **Middleware:** `app.use(auth)`, `router.use(validateBody)` → auth/validation requirements
+
+---
+
+## NestJS
+
+### Where to Find Routes
+
+```
+src/modules/*/       — Feature modules
+  *.controller.ts    — Controllers with decorators
+  *.service.ts       — Business logic
+  *.dto.ts           — Request/Response DTOs
+  *.module.ts        — Module definitions
+src/app.module.ts    — Root module
+```
+
+### Route Patterns
+
+```typescript
+@Controller('users')         // Base path: /users
+export class UsersController {
+  @Get()                     // GET /users
+  findAll() {}
+
+  @Get(':id')                // GET /users/:id
+  findOne(@Param('id') id: string) {}
+
+  @Post()                    // POST /users
+  create(@Body() dto: CreateUserDto) {}
+
+  @Put(':id')                // PUT /users/:id
+  update(@Param('id') id: string, @Body() dto: UpdateUserDto) {}
+
+  @Delete(':id')             // DELETE /users/:id
+  remove(@Param('id') id: string) {}
+}
+```
+
+### Extracting Info
+
+- **Path prefix:** `@Controller('prefix')` decorator
+- **Global prefix:** Check `app.setGlobalPrefix('api')` in main.ts
+- **DTOs:** `CreateUserDto`, `UpdateUserDto` → request body shape
+- **Params:** `@Param()`, `@Query()`, `@Body()` decorators
+- **Guards:** `@UseGuards()` → authentication requirements
+- **Pipes:** `@UsePipes(ValidationPipe)` → validation rules
+
+---
+
+## Spring Boot (Java)
+
+### Where to Find Routes
+
+```
+src/main/java/**/controller/    — Controller classes
+src/main/java/**/config/        — Security config
+src/main/resources/             — application.yml (context path)
+```
+
+### Route Patterns
+
+```java
+@RestController
+@RequestMapping("/api/users")      // Base path
+public class UserController {
+
+    @GetMapping                     // GET /api/users
+    public List<User> findAll() {}
+
+    @GetMapping("/{id}")            // GET /api/users/{id}
+    public User findById(@PathVariable Long id) {}
+
+    @PostMapping                    // POST /api/users
+    public User create(@RequestBody @Valid CreateUserRequest req) {}
+
+    @PutMapping("/{id}")            // PUT /api/users/{id}
+    public User update(@PathVariable Long id, @RequestBody UpdateUserRequest req) {}
+
+    @DeleteMapping("/{id}")         // DELETE /api/users/{id}
+    public void delete(@PathVariable Long id) {}
+}
+```
+
+### Extracting Info
+
+- **Context path:** Check `server.servlet.context-path` in application.yml
+- **Path prefix:** `@RequestMapping` on class
+- **Request body:** `@RequestBody` with DTO class → field types
+- **Path vars:** `@PathVariable` → dynamic segments
+- **Query params:** `@RequestParam` → query parameters
+- **Validation:** `@Valid`, `@NotNull`, `@Size` annotations
+- **Security:** `@PreAuthorize`, `SecurityFilterChain` → auth requirements
+
+---
+
+## FastAPI (Python)
+
+### Where to Find Routes
+
+```
+app/main.py          — Main app with app.include_router()
+app/routers/         — Router modules
+app/models/          — Pydantic models
+app/dependencies.py  — Shared dependencies
+```
+
+### Route Patterns
+
+```python
+router = APIRouter(prefix="/users", tags=["users"])
+
+@router.get("/")                    # GET /users
+async def list_users(
+    skip: int = 0,                  # Query param
+    limit: int = 100,               # Query param
+):
+    pass
+
+@router.get("/{user_id}")          # GET /users/{user_id}
+async def get_user(user_id: int):  # Path param (typed)
+    pass
+
+@router.post("/", status_code=201) # POST /users
+async def create_user(user: UserCreate):  # Body from Pydantic model
+    pass
+
+@router.put("/{user_id}")         # PUT /users/{user_id}
+async def update_user(user_id: int, user: UserUpdate):
+    pass
+```
+
+### Extracting Info
+
+- **Router prefix:** `APIRouter(prefix="/prefix")`
+- **App mount:** `app.include_router(router, prefix="/api")`
+- **Pydantic models:** Define request/response shapes with types
+- **Dependencies:** `Depends()` → auth, DB session, etc.
+- **Status codes:** `status_code=201` → expected response codes
+- **Response model:** `response_model=UserResponse` → response shape
+
+---
+
+## Django REST Framework (Python)
+
+### Where to Find Routes
+
+```
+project/urls.py         — Root URL configuration
+app/urls.py             — App URL patterns
+app/views.py            — View classes/functions
+app/serializers.py      — Request/Response serializers
+app/permissions.py      — Permission classes
+```
+
+### Route Patterns
+
+```python
+# urls.py with ViewSet + Router
+router = DefaultRouter()
+router.register(r'users', UserViewSet)
+urlpatterns = [path('api/', include(router.urls))]
+# → GET/POST /api/users/
+# → GET/PUT/PATCH/DELETE /api/users/{pk}/
+
+# ViewSet
+class UserViewSet(viewsets.ModelViewSet):
+    queryset = User.objects.all()
+    serializer_class = UserSerializer
+    permission_classes = [IsAuthenticated]
+
+    @action(detail=False, methods=['get'])
+    def me(self, request):    # GET /api/users/me/
+        pass
+
+# Function-based views
+@api_view(['GET', 'POST'])
+@permission_classes([AllowAny])
+def user_list(request):
+    pass
+```
+
+### Extracting Info
+
+- **URL patterns:** `path()`, `re_path()`, `router.register()`
+- **Serializers:** Define request/response shapes
+- **Permissions:** `permission_classes` → auth requirements
+- **ViewSet actions:** Standard CRUD + custom `@action` methods
+- **Pagination:** Check `DEFAULT_PAGINATION_CLASS` in settings
+
+---
+
+## Common Analysis Steps
+
+For any framework:
+
+1. **Find the entry point** (main app file)
+2. **Trace route registration** (how routes are mounted)
+3. **List all endpoints** with methods and paths
+4. **Check for global prefix** (e.g., `/api/v1`)
+5. **Identify auth middleware** (global vs per-route)
+6. **Extract request shapes** from DTOs/models/schemas
+7. **Note response codes** for checks
+8. **Find validation rules** for generating valid test data

package/skills/generating-tests-from-openapi/SKILL.md

@@ -0,0 +1,234 @@
+---
+name: generating-tests-from-openapi
+description: Use when generating k6 load test scripts from OpenAPI specification files (YAML or JSON). Use when the user has an OpenAPI spec, API specification, or wants to create k6 tests from API documentation defined in OpenAPI 3.0 or 3.1 format.
+---
+
+# Generating k6 Tests from OpenAPI
+
+Generate k6 load test scripts by parsing OpenAPI specification files (YAML format). Extracts endpoints, parameters, request bodies, and security schemes to create comprehensive test suites.
+
+## Workflow
+
+### Step 1: Parse OpenAPI Spec
+
+Read the OpenAPI YAML file and extract:
+- API info (title, version, base URL)
+- All paths and operations
+- Request parameters, bodies, and response schemas
+- Security definitions and requirements
+
+### Step 2: Security Scheme Analysis (Prerequisite)
+
+**Before generating test scripts, analyze security requirements.**
+
+1. **Extract security definitions** from `components.securitySchemes`:
+   - OAuth2 flows (authorization_code, client_credentials, password)
+   - API Key (header, query, cookie)
+   - HTTP Bearer / Basic Auth
+   - OpenID Connect
+
+2. **Map per-endpoint security:**
+   - Check global `security` array
+   - Check per-operation `security` overrides
+   - Identify public endpoints (empty security array `security: []`)
+
+3. **Generate k6 auth setup:**
+   - Create `setup()` function matching the required auth flow
+   - Configure token/key handling for requests
+
+See [reference/openapi-auth-mapping.md](reference/openapi-auth-mapping.md) for mapping security schemes to k6 code.
+
+### Step 3: Endpoint Extraction
+
+For each path and operation, extract:
+
+```yaml
+paths:
+  /users:
+    get:                          # HTTP method
+      operationId: listUsers      # Operation identifier
+      tags: [Users]               # Grouping
+      parameters:                 # Query/header/path params
+        - name: page
+          in: query
+          schema:
+            type: integer
+      security:                   # Per-operation security
+        - bearerAuth: []
+      responses:
+        '200':
+          description: Success
+```
+
+Map to k6:
+- **Path + method** → HTTP request
+- **Parameters** → URL params, query string, headers
+- **Request body** → `http.post()` body
+- **Tags** → k6 groups
+- **Security** → Auth headers
+
+### Step 4: Generate Request Bodies
+
+Convert schema definitions to example values:
+
+| Schema Type | Example Value |
+|------------|---------------|
+| `string` | `"test-string"` |
+| `string (email)` | `"test@example.com"` |
+| `string (date-time)` | `"2024-01-01T00:00:00Z"` |
+| `string (uuid)` | `"550e8400-e29b-41d4-a716-446655440000"` |
+| `integer` | `1` |
+| `number` | `1.0` |
+| `boolean` | `true` |
+| `array` | `[<item_example>]` |
+| `object` | `{<property_examples>}` |
+| `enum` | First enum value |
+
+Use `example` or `default` values from the spec when available.
+
+See [reference/openapi-parsing.md](reference/openapi-parsing.md) for detailed parsing logic.
+
+### Step 5: Script Generation
+
+Organize the generated script by API tags:
+
+```javascript
+import http from 'k6/http';
+import { check, group, sleep } from 'k6';
+
+const BASE_URL = __ENV.BASE_URL || 'https://api.example.com';
+
+export const options = {
+  scenarios: {
+    api_test: {
+      executor: 'ramping-vus',
+      startVUs: 0,
+      stages: [
+        { duration: '2m', target: 10 },
+        { duration: '5m', target: 10 },
+        { duration: '1m', target: 0 },
+      ],
+    },
+  },
+  thresholds: {
+    http_req_duration: ['p(95)<500'],
+    http_req_failed: ['rate<0.01'],
+  },
+};
+
+export function setup() {
+  // Auth flow based on security scheme
+}
+
+export default function (data) {
+  const headers = {
+    'Content-Type': 'application/json',
+    'Authorization': `Bearer ${data.token}`,
+  };
+
+  group('Users', () => {
+    // GET /users
+    const listRes = http.get(`${BASE_URL}/users?page=1&limit=10`, {
+      headers, tags: { name: 'ListUsers' },
+    });
+    check(listRes, { 'list users 200': (r) => r.status === 200 });
+
+    // POST /users
+    const createRes = http.post(`${BASE_URL}/users`,
+      JSON.stringify({ name: 'Test User', email: 'test@example.com' }),
+      { headers, tags: { name: 'CreateUser' } }
+    );
+    check(createRes, { 'create user 201': (r) => r.status === 201 });
+
+    // GET /users/{id}
+    const userId = createRes.json('id') || 1;
+    const getRes = http.get(`${BASE_URL}/users/${userId}`, {
+      headers, tags: { name: 'GetUser' },
+    });
+    check(getRes, { 'get user 200': (r) => r.status === 200 });
+  });
+
+  sleep(1);
+}
+```
+
+### Step 6: Configure Scenarios
+
+Based on endpoint characteristics:
+- **Read-heavy endpoints** (GET list) → Higher rate
+- **Write endpoints** (POST, PUT) → Lower rate
+- **Admin endpoints** → Separate scenario or excluded
+- **Public endpoints** → No auth scenario
+
+## OpenAPI Spec Quick Reference
+
+```yaml
+openapi: '3.1.0'
+info:
+  title: My API
+  version: '1.0.0'
+servers:
+  - url: https://api.example.com/v1
+security:
+  - bearerAuth: []               # Global security
+components:
+  securitySchemes:
+    bearerAuth:
+      type: http
+      scheme: bearer
+    apiKey:
+      type: apiKey
+      in: header
+      name: X-API-Key
+  schemas:
+    User:
+      type: object
+      required: [name, email]
+      properties:
+        id:
+          type: integer
+        name:
+          type: string
+        email:
+          type: string
+          format: email
+paths:
+  /users:
+    get:
+      tags: [Users]
+      parameters:
+        - name: page
+          in: query
+          schema: { type: integer, default: 1 }
+      responses:
+        '200':
+          description: User list
+    post:
+      tags: [Users]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/User'
+      responses:
+        '201':
+          description: Created
+  /users/{id}:
+    get:
+      tags: [Users]
+      parameters:
+        - name: id
+          in: path
+          required: true
+          schema: { type: integer }
+      responses:
+        '200':
+          description: User details
+```
+
+## Related Skills
+
+- For HTTP/gRPC/WebSocket API patterns: `/k6:generating-api-load-tests`
+- For scenario and threshold design: `/k6:designing-test-scenarios`
+- For code-based test generation: `/k6:generating-tests-from-code`