ai-qakit 1.0.0

package/templates/.claude/commands/qakit/feature/enrich-api.md

@@ -0,0 +1,352 @@
+# Enrich Feature with API Specification
+
+Parse OpenAPI/Swagger specification to extract API contracts, validation rules, and error codes for comprehensive API test coverage.
+
+## Usage
+
+```
+/qakit:feature/enrich-api <feature-file> <api-spec-file>
+```
+
+## Examples
+
+```
+# From OpenAPI 3.0 file
+/qakit:feature/enrich-api docs/features/AUTH-001.md api/openapi.yaml
+
+# From Swagger 2.0 file
+/qakit:feature/enrich-api docs/features/AUTH-001.md api/swagger.json
+
+# From specific endpoint path
+/qakit:feature/enrich-api docs/features/AUTH-001.md api/openapi.yaml --path /auth/login
+```
+
+## Supported Formats
+
+| Format | Extensions | Version |
+|--------|------------|---------|
+| OpenAPI | `.yaml`, `.yml`, `.json` | 3.0, 3.1 |
+| Swagger | `.yaml`, `.yml`, `.json` | 2.0 |
+
+## Instructions
+
+### 1. Parse API Specification
+
+Read and parse the API spec file:
+
+```
+Parsing API specification: api/openapi.yaml
+Format: OpenAPI 3.0.3
+Base URL: https://api.example.com/v1
+
+Found endpoints related to feature:
+- POST /auth/login
+- POST /auth/logout
+- POST /auth/refresh
+- GET /auth/me
+```
+
+### 2. Extract Endpoint Details
+
+For each relevant endpoint, extract:
+
+```markdown
+## Endpoint: POST /auth/login
+
+### Basic Info
+| Field | Value |
+|-------|-------|
+| Method | POST |
+| Path | /auth/login |
+| Summary | User login |
+| Tags | Authentication |
+| Security | None (public) |
+
+### Request
+**Content-Type:** application/json
+
+**Body Schema:**
+| Field | Type | Required | Validation |
+|-------|------|----------|------------|
+| email | string | Yes | format: email, maxLength: 255 |
+| password | string | Yes | minLength: 8, maxLength: 128 |
+| rememberMe | boolean | No | default: false |
+
+**Example:**
+```json
+{
+  "email": "user@example.com",
+  "password": "SecurePass123!",
+  "rememberMe": true
+}
+```
+
+### Response
+**Success (200):**
+| Field | Type | Description |
+|-------|------|-------------|
+| accessToken | string | JWT access token |
+| refreshToken | string | JWT refresh token |
+| expiresIn | integer | Token expiry in seconds |
+| user | object | User profile |
+
+**Error Responses:**
+| Code | Description | When |
+|------|-------------|------|
+| 400 | Bad Request | Invalid input format |
+| 401 | Unauthorized | Wrong credentials |
+| 403 | Forbidden | Account locked |
+| 422 | Unprocessable | Validation failed |
+| 429 | Too Many Requests | Rate limit exceeded |
+| 500 | Server Error | Internal error |
+```
+
+### 3. Generate API Test Scenarios
+
+From extracted API details, generate test scenarios:
+
+```markdown
+## API Test Scenarios (Generated from OpenAPI)
+
+### Endpoint: POST /auth/login
+
+#### Happy Path Tests
+| ID | Scenario | Expected |
+|----|----------|----------|
+| AC-API-001 | Valid email and password | 200 + tokens |
+| AC-API-002 | Valid with rememberMe=true | 200 + longer expiry |
+| AC-API-003 | Valid with rememberMe=false | 200 + standard expiry |
+
+#### Validation Tests (from schema)
+| ID | Scenario | Field | Invalid Value | Expected |
+|----|----------|-------|---------------|----------|
+| AC-API-010 | Missing email | email | (empty) | 400/422 |
+| AC-API-011 | Invalid email format | email | "not-an-email" | 400/422 |
+| AC-API-012 | Email too long | email | 256 chars | 400/422 |
+| AC-API-013 | Missing password | password | (empty) | 400/422 |
+| AC-API-014 | Password too short | password | "abc" | 400/422 |
+| AC-API-015 | Password too long | password | 129 chars | 400/422 |
+
+#### Error Response Tests
+| ID | Scenario | Expected Code | Expected Body |
+|----|----------|---------------|---------------|
+| AC-API-020 | Wrong password | 401 | error message |
+| AC-API-021 | Non-existent user | 401 | error message |
+| AC-API-022 | Locked account | 403 | locked message |
+| AC-API-023 | Rate limit exceeded | 429 | retry-after header |
+
+#### Security Tests
+| ID | Scenario | Expected |
+|----|----------|----------|
+| AC-API-030 | SQL injection in email | 400 (rejected) |
+| AC-API-031 | XSS in email | 400 (sanitized) |
+| AC-API-032 | Missing Content-Type | 415 |
+| AC-API-033 | Invalid JSON body | 400 |
+
+#### Boundary Tests (from schema constraints)
+| ID | Field | Test | Value | Expected |
+|----|-------|------|-------|----------|
+| AC-API-040 | email | min valid | 5 chars | 200 |
+| AC-API-041 | email | max valid | 255 chars | 200 |
+| AC-API-042 | email | over max | 256 chars | 400 |
+| AC-API-043 | password | min valid | 8 chars | 200 |
+| AC-API-044 | password | under min | 7 chars | 400 |
+| AC-API-045 | password | max valid | 128 chars | 200 |
+| AC-API-046 | password | over max | 129 chars | 400 |
+```
+
+### 4. Extract Authentication Requirements
+
+```markdown
+## Authentication Analysis
+
+### Security Schemes
+| Scheme | Type | Location | Required For |
+|--------|------|----------|--------------|
+| BearerAuth | JWT | Header (Authorization) | Protected endpoints |
+| ApiKey | API Key | Header (X-API-Key) | All endpoints |
+
+### Protected Endpoints
+| Endpoint | Auth Required | Scopes |
+|----------|---------------|--------|
+| GET /auth/me | Yes | user:read |
+| POST /auth/logout | Yes | - |
+| POST /auth/refresh | Yes (refresh token) | - |
+
+### Auth Test Scenarios
+| ID | Scenario | Expected |
+|----|----------|----------|
+| AC-AUTH-001 | Access protected without token | 401 |
+| AC-AUTH-002 | Access with expired token | 401 |
+| AC-AUTH-003 | Access with invalid token | 401 |
+| AC-AUTH-004 | Access with wrong scope | 403 |
+| AC-AUTH-005 | Access with valid token | 200 |
+```
+
+### 5. Generate Test Data from Schema
+
+```markdown
+## Test Data (Generated from Schema)
+
+### Valid Data
+```json
+{
+  "validLogin": {
+    "email": "test.user@example.com",
+    "password": "ValidPass123!"
+  },
+  "validLoginWithRemember": {
+    "email": "test.user@example.com",
+    "password": "ValidPass123!",
+    "rememberMe": true
+  }
+}
+```
+
+### Invalid Data (Boundary)
+```json
+{
+  "emailTooLong": {
+    "email": "a]@example.com", // 256 chars
+    "password": "ValidPass123!"
+  },
+  "passwordTooShort": {
+    "email": "test@example.com",
+    "password": "Short1!" // 7 chars
+  }
+}
+```
+
+### Invalid Data (Format)
+```json
+{
+  "invalidEmailFormat": {
+    "email": "not-an-email",
+    "password": "ValidPass123!"
+  },
+  "sqlInjection": {
+    "email": "' OR '1'='1",
+    "password": "ValidPass123!"
+  }
+}
+```
+```
+
+### 6. Update Feature Spec
+
+Add API contract information to feature file:
+
+```markdown
+## API Contract (from OpenAPI)
+
+### Endpoints
+| Method | Path | Description | Auth |
+|--------|------|-------------|------|
+| POST | /auth/login | User login | No |
+| POST | /auth/logout | User logout | Yes |
+| POST | /auth/refresh | Refresh token | Yes |
+| GET | /auth/me | Get current user | Yes |
+
+### Request Schema: POST /auth/login
+| Field | Type | Required | Validation |
+|-------|------|----------|------------|
+| email | string | Yes | email format, max 255 |
+| password | string | Yes | min 8, max 128 |
+| rememberMe | boolean | No | default false |
+
+### Response Codes
+| Code | Meaning | Test Scenario |
+|------|---------|---------------|
+| 200 | Success | Valid credentials |
+| 400 | Bad Request | Invalid format |
+| 401 | Unauthorized | Wrong credentials |
+| 403 | Forbidden | Account locked |
+| 422 | Validation Error | Schema violation |
+| 429 | Rate Limited | Too many attempts |
+
+---
+
+## API Test Scenarios (Generated)
+
+### Validation Tests
+| ID | Scenario | Expected |
+|----|----------|----------|
+| AC-API-001 | Missing email | 400/422 |
+| AC-API-002 | Invalid email format | 400/422 |
+| AC-API-003 | Password too short | 400/422 |
+...
+
+### Error Handling Tests
+| ID | Scenario | Expected |
+|----|----------|----------|
+| AC-API-010 | Wrong password | 401 |
+| AC-API-011 | Locked account | 403 |
+...
+
+### Security Tests
+| ID | Scenario | Expected |
+|----|----------|----------|
+| AC-API-020 | SQL injection | 400 |
+| AC-API-021 | XSS payload | 400 |
+...
+```
+
+## Output
+
+Updates the feature spec file with:
+1. API Contract section (endpoints, schemas)
+2. API Test Scenarios (validation, error, security)
+3. Test Data (valid, invalid, boundary)
+4. Authentication requirements
+
+## Common OpenAPI Patterns to Test
+
+### From Schema Constraints
+| Constraint | Test Type |
+|------------|-----------|
+| `required` | Missing field test |
+| `minLength` | Boundary test (min-1, min) |
+| `maxLength` | Boundary test (max, max+1) |
+| `minimum` | Boundary test (min-1, min) |
+| `maximum` | Boundary test (max, max+1) |
+| `pattern` | Regex validation test |
+| `enum` | Valid/invalid enum values |
+| `format: email` | Email format validation |
+| `format: date` | Date format validation |
+| `format: uuid` | UUID format validation |
+
+### From Response Codes
+| Code | Test Scenario |
+|------|---------------|
+| 200 | Happy path |
+| 201 | Resource created |
+| 204 | No content (delete) |
+| 400 | Bad request format |
+| 401 | Missing/invalid auth |
+| 403 | Insufficient permissions |
+| 404 | Resource not found |
+| 409 | Conflict (duplicate) |
+| 422 | Validation error |
+| 429 | Rate limit |
+| 500 | Server error |
+
+## Quality Checklist
+
+After enrichment:
+- [ ] All endpoints documented
+- [ ] Request schemas extracted
+- [ ] Response codes mapped to tests
+- [ ] Validation rules → test scenarios
+- [ ] Authentication requirements noted
+- [ ] Test data generated from schema
+- [ ] Security tests included
+
+## Tips
+
+1. **Keep spec updated** - Sync when API changes
+2. **Focus on relevant endpoints** - Use `--path` to filter
+3. **Check error responses** - Often undocumented but important
+4. **Test all status codes** - Each code = test scenario
+5. **Use schema for test data** - Generate valid/invalid from constraints
+
+$ARGUMENTS

package/templates/.claude/commands/qakit/feature/enrich-tests.md

@@ -0,0 +1,243 @@
+# Enrich Feature with Related Tests
+
+Analyze existing test cases from related features to identify patterns and missing scenarios.
+
+## Usage
+
+```
+/qakit:feature/enrich-tests <feature-file> [test-directory]
+```
+
+## Examples
+
+```
+# Auto-detect related tests
+/qakit:feature/enrich-tests docs/features/AUTH-001.md
+
+# Specify test directory
+/qakit:feature/enrich-tests docs/features/AUTH-001.md tests/test-cases/auth/
+
+# Multiple directories
+/qakit:feature/enrich-tests docs/features/CHECKOUT-001.md tests/test-cases/cart/ tests/test-cases/payment/
+```
+
+## Instructions
+
+### 1. Identify Related Test Files
+
+If no directory specified, search for related tests:
+
+```
+Searching for related test cases...
+
+Found related tests:
+- tests/test-cases/auth/WEB-LOGIN-001.md (Login - similar feature)
+- tests/test-cases/auth/WEB-REGISTER-001.md (Registration - same module)
+- tests/test-cases/auth/WEB-LOGOUT-001.md (Logout - related flow)
+- tests/test-cases/user/WEB-PROFILE-001.md (Profile - uses auth)
+
+Analyzing 4 test files...
+```
+
+Search patterns:
+- Same module (e.g., `auth/` for AUTH-001)
+- Similar feature names
+- Referenced in feature spec
+- Common user flows
+
+### 2. Analyze Test Patterns
+
+Extract patterns from existing tests:
+
+#### Test Categories Found
+```markdown
+## Test Pattern Analysis
+
+### Categories Used
+| Category | Count | Examples |
+|----------|-------|----------|
+| Functional | 15 | Valid login, Invalid login |
+| Validation | 8 | Email format, Password strength |
+| Error Handling | 6 | Wrong password, Account locked |
+| Security | 4 | Session timeout, CSRF protection |
+| Edge Cases | 5 | Empty fields, Special characters |
+| Accessibility | 2 | Keyboard nav, Screen reader |
+
+### Common Test Patterns
+1. **Happy Path** - Valid input → Expected success
+2. **Validation** - Invalid input → Error message
+3. **Boundary** - Min/max values → Correct handling
+4. **Security** - Attack vectors → Proper protection
+5. **State** - Different states → Correct behavior
+```
+
+#### Reusable Scenarios
+```markdown
+### Reusable Scenarios from Related Tests
+
+From WEB-REGISTER-001 (Registration):
+- Email validation pattern (same as login)
+- Password strength validation
+- Form submission flow
+- Success/error message display
+
+From WEB-LOGOUT-001 (Logout):
+- Session handling
+- Redirect after action
+- Remember me interaction
+
+From WEB-PROFILE-001 (Profile):
+- Authentication required
+- Session persistence
+- User data display
+```
+
+### 3. Identify Missing Scenarios
+
+Compare feature spec with existing test patterns:
+
+```markdown
+## Gap Analysis
+
+### Scenarios in Related Tests but Missing in Feature Spec
+
+| Scenario | Found In | Applicable? | Priority |
+|----------|----------|-------------|----------|
+| SQL injection in email field | WEB-REGISTER-001 | ✅ Yes | P1 |
+| XSS in error messages | WEB-REGISTER-001 | ✅ Yes | P1 |
+| Session fixation attack | WEB-LOGOUT-001 | ✅ Yes | P1 |
+| Concurrent login handling | WEB-PROFILE-001 | ✅ Yes | P2 |
+| Browser back button after login | WEB-LOGOUT-001 | ✅ Yes | P2 |
+| Auto-logout on inactivity | WEB-PROFILE-001 | ✅ Yes | P2 |
+| Login with different browsers | WEB-REGISTER-001 | ✅ Yes | P3 |
+
+### Recommended Additions
+Based on patterns from 4 related test files, recommend adding:
+
+1. **Security Tests** (from registration tests)
+   - AC-SEC-001: Verify SQL injection prevention in email field
+   - AC-SEC-002: Verify XSS prevention in error messages
+   - AC-SEC-003: Verify CSRF token validation
+
+2. **Session Tests** (from logout tests)
+   - AC-SES-001: Verify session created on successful login
+   - AC-SES-002: Verify session invalidated on logout
+   - AC-SES-003: Verify session timeout after inactivity
+
+3. **Edge Cases** (from profile tests)
+   - AC-EDGE-001: Verify behavior with browser back button
+   - AC-EDGE-002: Verify concurrent login from multiple devices
+   - AC-EDGE-003: Verify login after password change
+```
+
+### 4. Suggest Test Data Patterns
+
+Extract test data patterns from related tests:
+
+```markdown
+## Test Data Patterns
+
+### Valid Data Patterns (from related tests)
+| Field | Pattern | Examples |
+|-------|---------|----------|
+| Email | Standard format | user@example.com, test.user@domain.co |
+| Password | Strong password | Example@123, Test!Pass456 |
+
+### Invalid Data Patterns (from related tests)
+| Field | Pattern | Examples |
+|-------|---------|----------|
+| Email - No @ | missing-at.com | |
+| Email - No domain | user@ | |
+| Email - Special chars | user<script>@test.com | |
+| Password - Too short | abc | |
+| Password - No special | Password123 | |
+| Password - SQL injection | ' OR '1'='1 | |
+
+### Boundary Values (from related tests)
+| Field | Min | Max | Boundary Tests |
+|-------|-----|-----|----------------|
+| Email | 5 chars | 255 chars | 4, 5, 254, 255, 256 |
+| Password | 8 chars | 128 chars | 7, 8, 127, 128, 129 |
+```
+
+### 5. Update Feature Spec
+
+Add enrichment data to feature file:
+
+```markdown
+## Related Test Analysis
+
+### Source Tests Analyzed
+| Test File | Relevance | Patterns Extracted |
+|-----------|-----------|-------------------|
+| WEB-LOGIN-001.md | Direct | Validation, Error handling |
+| WEB-REGISTER-001.md | High | Security, Form patterns |
+| WEB-LOGOUT-001.md | Medium | Session handling |
+
+### Patterns Applied
+- Form validation pattern from registration
+- Security test pattern from registration
+- Session handling from logout
+
+---
+
+## Additional Acceptance Criteria (from Related Tests)
+
+### Security (from WEB-REGISTER-001)
+| ID | Criteria | Type | Priority |
+|----|----------|------|----------|
+| AC-SEC-001 | WHEN SQL injection attempted THEN system SHALL reject and log | Security | P1 |
+| AC-SEC-002 | WHEN XSS payload in input THEN system SHALL sanitize | Security | P1 |
+
+### Session (from WEB-LOGOUT-001)
+| ID | Criteria | Type | Priority |
+|----|----------|------|----------|
+| AC-SES-001 | WHEN login successful THEN system SHALL create secure session | Session | P0 |
+| AC-SES-002 | WHEN inactive for 30 mins THEN system SHALL auto-logout | Session | P1 |
+
+### Edge Cases (from WEB-PROFILE-001)
+| ID | Criteria | Type | Priority |
+|----|----------|------|----------|
+| AC-EDGE-001 | WHEN browser back after login THEN system SHALL maintain session | Edge | P2 |
+| AC-EDGE-002 | WHEN concurrent login THEN system SHALL handle per policy | Edge | P2 |
+
+---
+
+## Suggested Test Data (from Related Tests)
+
+### Reuse from WEB-REGISTER-001
+- Invalid email patterns
+- SQL injection payloads
+- XSS test strings
+
+### Reuse from WEB-LOGOUT-001
+- Session token formats
+- Timeout scenarios
+```
+
+## Output
+
+Updates the feature spec file with:
+1. Related test analysis summary
+2. Additional acceptance criteria from patterns
+3. Suggested test data
+4. Gap analysis results
+
+## Quality Checklist
+
+After enrichment:
+- [ ] Related tests identified and analyzed
+- [ ] Common patterns extracted
+- [ ] Missing scenarios identified
+- [ ] Security tests considered
+- [ ] Edge cases from related features added
+- [ ] Test data patterns documented
+
+## Tips
+
+1. **Start broad** - Let AI find related tests automatically first
+2. **Include similar modules** - Tests from same module often share patterns
+3. **Check security tests** - Security patterns are highly reusable
+4. **Review edge cases** - Edge cases from one feature often apply to others
+
+$ARGUMENTS