@suiflex/suitest-mcp 0.1.0

package/python/suitest_lifecycle/paths.py

@@ -0,0 +1,90 @@
+"""``suitest-output/`` directory layout.
+
+Mirrors the TestSprite ``testsprite_tests/`` folder (PRD + plan + ``TCxxx.py``
+at top level, ``tmp/`` for code-summary / config snapshot / results / report)
+but rooted at a single ``suitest-output/`` tree so a repo stays clean::
+
+    suitest-output/
+      backend/  (or frontend/)
+        standard_prd.json
+        suitest_backend_test_plan.json
+        TC001_*.py ...
+        tmp/
+          code_summary.json
+          config.snapshot.json
+          test_results.json
+          raw_report.md
+      tcm/                 ← source-of-truth mirror (cases.json, runs.json)
+      reports/             ← summary.{md,json,html}
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from pathlib import Path
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from suitest_lifecycle.models import Mode
+
+
+@dataclass(frozen=True)
+class Paths:
+    root: Path
+    mode_dir: Path
+    tmp_dir: Path
+    tcm_dir: Path
+    reports_dir: Path
+    mode: Mode
+
+    @property
+    def prd_json(self) -> Path:
+        return self.mode_dir / "standard_prd.json"
+
+    @property
+    def test_plan_json(self) -> Path:
+        return self.mode_dir / f"suitest_{self.mode.value}_test_plan.json"
+
+    @property
+    def code_summary_json(self) -> Path:
+        return self.tmp_dir / "code_summary.json"
+
+    @property
+    def config_snapshot_json(self) -> Path:
+        return self.tmp_dir / "config.snapshot.json"
+
+    @property
+    def test_results_json(self) -> Path:
+        return self.tmp_dir / "test_results.json"
+
+    @property
+    def raw_report_md(self) -> Path:
+        return self.tmp_dir / "raw_report.md"
+
+    @property
+    def tcm_cases_json(self) -> Path:
+        return self.tcm_dir / "cases.json"
+
+    @property
+    def tcm_runs_json(self) -> Path:
+        return self.tcm_dir / "runs.json"
+
+    def test_file(self, filename: str) -> Path:
+        return self.mode_dir / filename
+
+    def ensure(self) -> None:
+        for d in (self.mode_dir, self.tmp_dir, self.tcm_dir, self.reports_dir):
+            d.mkdir(parents=True, exist_ok=True)
+
+
+def build_paths(output_dir: Path, mode: Mode) -> Paths:
+    root = Path(output_dir)
+    mode_dir = root / mode.value
+    return Paths(
+        root=root,
+        mode_dir=mode_dir,
+        tmp_dir=mode_dir / "tmp",
+        tcm_dir=root / "tcm",
+        reports_dir=root / "reports",
+        mode=mode,
+    )

package/python/suitest_lifecycle/plan.py

@@ -0,0 +1,366 @@
+"""Deterministic backend test-plan generator (ZERO tier, no LLM).
+
+Turns discovered endpoints into real, source-traceable test cases following the
+same archetypes TestSprite emits: public probes, auth happy/invalid paths,
+"protected endpoint rejects anonymous" 401s, and authenticated CRUD. Every case
+carries a ``source_ref`` ("POST /api/products") so it can be traced back to the
+endpoint that justified it — no dummy tests.
+"""
+
+from __future__ import annotations
+
+from suitest_lifecycle.models import CodeSummary, Endpoint, PlanCase, PlanStep, Priority
+
+
+def _slug(method: str, path: str) -> str:
+    cleaned = (
+        path.strip("/")
+        .replace("/", "_")
+        .replace(":", "")
+        .replace("{", "")
+        .replace("}", "")
+        .replace("-", "_")
+    )
+    return f"{method.lower()}_{cleaned}".strip("_")
+
+
+def _is_login(ep: Endpoint) -> bool:
+    return ep.method == "POST" and ep.path.rstrip("/").endswith("login")
+
+
+def _has_id_param(ep: Endpoint) -> bool:
+    return ":" in ep.path or "{" in ep.path
+
+
+def _resource(ep: Endpoint) -> str:
+    parts = [p for p in ep.path.strip("/").split("/") if p and not p.startswith(":") and p != "api"]
+    return parts[-1] if parts else "resource"
+
+
+def _case(
+    cid: str,
+    title: str,
+    description: str,
+    category: str,
+    priority: Priority,
+    source_ref: str,
+    steps: list[tuple[str, str]],
+) -> PlanCase:
+    return PlanCase(
+        id=cid,
+        title=title,
+        description=description,
+        category=category,
+        priority=priority,
+        source_ref=source_ref,
+        steps=[PlanStep(type=t, description=d) for t, d in steps],
+    )
+
+
+def generate_backend_plan(summary: CodeSummary) -> list[PlanCase]:
+    cases: list[PlanCase] = []
+    counter = 0
+    seen_unauth_resource: set[str] = set()
+
+    def next_id() -> str:
+        nonlocal counter
+        counter += 1
+        return f"TC{counter:03d}"
+
+    for ep in summary.endpoints:
+        ref = f"{ep.method} {ep.path}"
+
+        # Public probe (health / any public GET)
+        if ep.method == "GET" and not ep.auth_required and "health" in ep.path:
+            cases.append(
+                _case(
+                    next_id(),
+                    f"{_slug('get', ep.path)}_returns_service_status_without_authentication",
+                    f"GET {ep.path} returns 200 with a JSON status body and requires no auth.",
+                    "Health",
+                    Priority.HIGH,
+                    ref,
+                    [
+                        ("action", f"Send GET {ep.path} with no Authorization header"),
+                        ("assertion", "Expect HTTP 200 and a JSON object"),
+                    ],
+                )
+            )
+            continue
+
+        # Auth: login
+        if _is_login(ep):
+            cases.append(
+                _case(
+                    next_id(),
+                    f"{_slug('post', ep.path)}_with_valid_credentials_returns_token",
+                    f"POST {ep.path} with valid credentials returns 200 and a bearer token.",
+                    "Auth",
+                    Priority.HIGH,
+                    ref,
+                    [
+                        ("action", f"Send POST {ep.path} with valid username/password"),
+                        ("assertion", "Expect HTTP 200 and a token field in the response"),
+                    ],
+                )
+            )
+            cases.append(
+                _case(
+                    next_id(),
+                    f"{_slug('post', ep.path)}_with_invalid_credentials_returns_401",
+                    f"POST {ep.path} with wrong credentials returns 401.",
+                    "Auth",
+                    Priority.HIGH,
+                    ref,
+                    [
+                        ("action", f"Send POST {ep.path} with an invalid password"),
+                        ("assertion", "Expect HTTP 401"),
+                    ],
+                )
+            )
+            cases.append(
+                _case(
+                    next_id(),
+                    f"{_slug('post', ep.path)}_with_missing_credentials_returns_validation_error",
+                    f"POST {ep.path} with an empty body returns a 400/422 validation error.",
+                    "Auth",
+                    Priority.MEDIUM,
+                    ref,
+                    [
+                        ("action", f"Send POST {ep.path} with an empty JSON body"),
+                        ("assertion", "Expect HTTP 400/422 and a validation error body"),
+                    ],
+                )
+            )
+            continue
+
+        # Protected endpoint: emit anonymous-rejection + invalid-token cases once
+        # per resource (negative auth coverage without exploding the plan).
+        if ep.auth_required:
+            res = _resource(ep)
+            if res not in seen_unauth_resource:
+                seen_unauth_resource.add(res)
+                anon_ep = ep
+                cases.append(
+                    _case(
+                        next_id(),
+                        f"{_slug(anon_ep.method.lower(), anon_ep.path)}_requires_authentication",
+                        f"{anon_ep.method} {anon_ep.path} without a token returns 401.",
+                        res.title(),
+                        Priority.HIGH,
+                        f"{anon_ep.method} {anon_ep.path}",
+                        [
+                            (
+                                "action",
+                                f"Send {anon_ep.method} {anon_ep.path} with no Authorization header",
+                            ),
+                            ("assertion", "Expect HTTP 401"),
+                        ],
+                    )
+                )
+                cases.append(
+                    _case(
+                        next_id(),
+                        f"{_slug(anon_ep.method.lower(), anon_ep.path)}_with_invalid_token_returns_401",
+                        f"{anon_ep.method} {anon_ep.path} with a malformed bearer token returns 401.",
+                        res.title(),
+                        Priority.MEDIUM,
+                        f"{anon_ep.method} {anon_ep.path}",
+                        [
+                            (
+                                "action",
+                                f"Send {anon_ep.method} {anon_ep.path} with Authorization: Bearer <garbage>",
+                            ),
+                            ("assertion", "Expect HTTP 401"),
+                        ],
+                    )
+                )
+
+        # Authenticated happy paths by method
+        res = _resource(ep)
+        category = res.title()
+        if ep.method == "GET" and ep.path.rstrip("/").endswith("me"):
+            cases.append(
+                _case(
+                    next_id(),
+                    f"{_slug('get', ep.path)}_with_valid_token_returns_profile",
+                    f"GET {ep.path} with a valid token returns the current user profile.",
+                    "Auth",
+                    Priority.HIGH,
+                    ref,
+                    [
+                        ("action", "Log in to obtain a token"),
+                        ("action", f"Send GET {ep.path} with Authorization: Bearer <token>"),
+                        ("assertion", "Expect HTTP 200 and a user object"),
+                    ],
+                )
+            )
+        elif ep.method == "GET" and _has_id_param(ep):
+            cases.append(
+                _case(
+                    next_id(),
+                    f"{_slug('get', ep.path)}_with_valid_id_returns_resource",
+                    f"GET {ep.path} with a valid id returns 200 and the {res} record.",
+                    category,
+                    Priority.MEDIUM,
+                    ref,
+                    [
+                        ("action", "Log in and create a record to read"),
+                        ("action", f"Send authenticated GET {ep.path}"),
+                        ("assertion", "Expect HTTP 200 and the record body"),
+                    ],
+                )
+            )
+            cases.append(
+                _case(
+                    next_id(),
+                    f"{_slug('get', ep.path)}_with_unknown_id_returns_404",
+                    f"GET {ep.path} with a nonexistent id returns 404.",
+                    category,
+                    Priority.MEDIUM,
+                    ref,
+                    [
+                        ("action", "Log in to obtain a token"),
+                        (
+                            "action",
+                            f"Send authenticated GET {ep.path} with an id that does not exist",
+                        ),
+                        ("assertion", "Expect HTTP 404"),
+                    ],
+                )
+            )
+        elif ep.method == "GET":
+            cases.append(
+                _case(
+                    next_id(),
+                    f"{_slug('get', ep.path)}_with_valid_token_returns_list",
+                    f"GET {ep.path} with a valid token returns 200 and a collection.",
+                    category,
+                    Priority.MEDIUM,
+                    ref,
+                    [
+                        ("action", "Log in to obtain a token"),
+                        ("action", f"Send authenticated GET {ep.path}"),
+                        ("assertion", "Expect HTTP 200 and a JSON array/list"),
+                    ],
+                )
+            )
+        elif ep.method == "POST":
+            cases.append(
+                _case(
+                    next_id(),
+                    f"{_slug('post', ep.path)}_with_valid_data_creates_resource",
+                    f"POST {ep.path} with valid data creates a {res} and returns 2xx.",
+                    category,
+                    Priority.HIGH,
+                    ref,
+                    [
+                        ("action", "Log in to obtain a token"),
+                        ("action", f"Send authenticated POST {ep.path} with a valid payload"),
+                        ("assertion", "Expect HTTP 200/201 and the created record"),
+                    ],
+                )
+            )
+            cases.append(
+                _case(
+                    next_id(),
+                    f"{_slug('post', ep.path)}_with_missing_required_field_returns_validation_error",
+                    f"POST {ep.path} with an empty body returns a 400/422 validation error.",
+                    category,
+                    Priority.MEDIUM,
+                    ref,
+                    [
+                        ("action", "Log in to obtain a token"),
+                        ("action", f"Send authenticated POST {ep.path} with an empty JSON body"),
+                        ("assertion", "Expect HTTP 400/422 and a validation error body"),
+                    ],
+                )
+            )
+            cases.append(
+                _case(
+                    next_id(),
+                    f"{_slug('post', ep.path)}_with_duplicate_unique_field_returns_conflict",
+                    f"POST {ep.path} twice with the same unique field returns a 409 conflict.",
+                    category,
+                    Priority.MEDIUM,
+                    ref,
+                    [
+                        ("action", f"Log in and create a {res} with a unique payload"),
+                        ("action", f"Send the exact same POST {ep.path} payload again"),
+                        ("assertion", "Expect HTTP 409 (conflict on the unique field)"),
+                    ],
+                )
+            )
+        elif ep.method == "PUT" or ep.method == "PATCH":
+            cases.append(
+                _case(
+                    next_id(),
+                    f"{_slug(ep.method.lower(), ep.path)}_with_valid_data_updates_resource",
+                    f"{ep.method} {ep.path} updates an existing {res} and returns 200.",
+                    category,
+                    Priority.MEDIUM,
+                    ref,
+                    [
+                        ("action", "Log in and create a record to update"),
+                        ("action", f"Send authenticated {ep.method} {ep.path} with updated fields"),
+                        ("assertion", "Expect HTTP 200 and the updated record"),
+                    ],
+                )
+            )
+            cases.append(
+                _case(
+                    next_id(),
+                    f"{_slug(ep.method.lower(), ep.path)}_with_unknown_id_returns_404",
+                    f"{ep.method} {ep.path} against a nonexistent id returns 404.",
+                    category,
+                    Priority.MEDIUM,
+                    ref,
+                    [
+                        ("action", "Log in to obtain a token"),
+                        (
+                            "action",
+                            f"Send authenticated {ep.method} {ep.path} with an id that does not exist",
+                        ),
+                        ("assertion", "Expect HTTP 404"),
+                    ],
+                )
+            )
+        elif ep.method == "DELETE":
+            cases.append(
+                _case(
+                    next_id(),
+                    f"{_slug('delete', ep.path)}_with_valid_id_deletes_resource",
+                    f"DELETE {ep.path} removes an existing {res} and returns 200.",
+                    category,
+                    Priority.MEDIUM,
+                    ref,
+                    [
+                        ("action", "Log in and create a record to delete"),
+                        ("action", f"Send authenticated DELETE {ep.path}"),
+                        ("assertion", "Expect HTTP 200"),
+                    ],
+                )
+            )
+            cases.append(
+                _case(
+                    next_id(),
+                    f"{_slug('delete', ep.path)}_with_unknown_id_returns_404",
+                    f"DELETE {ep.path} against a nonexistent id returns 404.",
+                    category,
+                    Priority.MEDIUM,
+                    ref,
+                    [
+                        ("action", "Log in to obtain a token"),
+                        (
+                            "action",
+                            f"Send authenticated DELETE {ep.path} with an id that does not exist",
+                        ),
+                        ("assertion", "Expect HTTP 404"),
+                    ],
+                )
+            )
+
+    return cases
+
+
+__all__ = ["generate_backend_plan"]