api-tests-coverage 1.0.0 → 1.0.1

package/dist/dashboard/dist/reports/security-coverage.json

@@ -0,0 +1,299 @@
+{
+  "total": 27,
+  "covered": 7,
+  "percentage": 23.08,
+  "scanFindings": 0,
+  "categorySummary": {
+    "authentication": {
+      "total": 1,
+      "covered": 1
+    },
+    "authorization": {
+      "total": 13,
+      "covered": 0
+    },
+    "input-validation": {
+      "total": 11,
+      "covered": 5
+    },
+    "cryptography": {
+      "total": 1,
+      "covered": 0
+    },
+    "session-management": {
+      "total": 0,
+      "covered": 0
+    }
+  },
+  "controls": [
+    {
+      "id": "authentication:bearerAuth",
+      "category": "authentication",
+      "description": "Authentication via security scheme \"bearerAuth\" (http/bearer)",
+      "covered": true,
+      "matchedTests": [
+        "returns 401 when no token",
+        "returns 401 when no token provided",
+        "returns 401 for invalid token",
+        "returns 401 without auth"
+      ],
+      "coveredByScanReport": false
+    },
+    {
+      "id": "cryptography:https",
+      "category": "cryptography",
+      "description": "API servers include non-HTTPS URLs – cryptographic transport security may be missing",
+      "covered": false,
+      "matchedTests": [],
+      "coveredByScanReport": false
+    },
+    {
+      "id": "authorization:get:/wallets",
+      "category": "authorization",
+      "description": "Authorization check for GET /wallets",
+      "endpoint": "GET /wallets",
+      "covered": false,
+      "matchedTests": [],
+      "coveredByScanReport": false
+    },
+    {
+      "id": "authorization:post:/wallets",
+      "category": "authorization",
+      "description": "Authorization check for POST /wallets",
+      "endpoint": "POST /wallets",
+      "covered": false,
+      "matchedTests": [],
+      "coveredByScanReport": false
+    },
+    {
+      "id": "input-validation:post:/wallets",
+      "category": "input-validation",
+      "description": "Input validation for POST /wallets",
+      "endpoint": "POST /wallets",
+      "covered": true,
+      "matchedTests": [
+        "returns 400 when currency is missing",
+        "returns 400 for unsupported currency",
+        "returns 422 for insufficient funds",
+        "returns 401 for invalid token",
+        "returns 400 for invalid currency",
+        "returns 422 with insufficient funds"
+      ],
+      "coveredByScanReport": false
+    },
+    {
+      "id": "authorization:get:/wallets/{id}",
+      "category": "authorization",
+      "description": "Authorization check for GET /wallets/{id}",
+      "endpoint": "GET /wallets/{id}",
+      "covered": false,
+      "matchedTests": [],
+      "coveredByScanReport": false
+    },
+    {
+      "id": "input-validation:get:/wallets/{id}",
+      "category": "input-validation",
+      "description": "Input validation for GET /wallets/{id}",
+      "endpoint": "GET /wallets/{id}",
+      "covered": true,
+      "matchedTests": [
+        "returns 422 for insufficient funds",
+        "returns 400 for invalid currency",
+        "returns 422 with insufficient funds"
+      ],
+      "coveredByScanReport": false
+    },
+    {
+      "id": "authorization:delete:/wallets/{id}",
+      "category": "authorization",
+      "description": "Authorization check for DELETE /wallets/{id}",
+      "endpoint": "DELETE /wallets/{id}",
+      "covered": false,
+      "matchedTests": [],
+      "coveredByScanReport": false
+    },
+    {
+      "id": "input-validation:delete:/wallets/{id}",
+      "category": "input-validation",
+      "description": "Input validation for DELETE /wallets/{id}",
+      "endpoint": "DELETE /wallets/{id}",
+      "covered": true,
+      "matchedTests": [
+        "returns 422 for insufficient funds",
+        "returns 400 for invalid currency",
+        "returns 422 with insufficient funds"
+      ],
+      "coveredByScanReport": false
+    },
+    {
+      "id": "authorization:patch:/wallets/{id}/freeze",
+      "category": "authorization",
+      "description": "Authorization check for PATCH /wallets/{id}/freeze",
+      "endpoint": "PATCH /wallets/{id}/freeze",
+      "covered": false,
+      "matchedTests": [],
+      "coveredByScanReport": false
+    },
+    {
+      "id": "input-validation:patch:/wallets/{id}/freeze",
+      "category": "input-validation",
+      "description": "Input validation for PATCH /wallets/{id}/freeze",
+      "endpoint": "PATCH /wallets/{id}/freeze",
+      "covered": false,
+      "matchedTests": [],
+      "coveredByScanReport": false
+    },
+    {
+      "id": "authorization:patch:/wallets/{id}/unfreeze",
+      "category": "authorization",
+      "description": "Authorization check for PATCH /wallets/{id}/unfreeze",
+      "endpoint": "PATCH /wallets/{id}/unfreeze",
+      "covered": false,
+      "matchedTests": [],
+      "coveredByScanReport": false
+    },
+    {
+      "id": "input-validation:patch:/wallets/{id}/unfreeze",
+      "category": "input-validation",
+      "description": "Input validation for PATCH /wallets/{id}/unfreeze",
+      "endpoint": "PATCH /wallets/{id}/unfreeze",
+      "covered": false,
+      "matchedTests": [],
+      "coveredByScanReport": false
+    },
+    {
+      "id": "authorization:post:/wallets/{id}/fund",
+      "category": "authorization",
+      "description": "Authorization check for POST /wallets/{id}/fund",
+      "endpoint": "POST /wallets/{id}/fund",
+      "covered": false,
+      "matchedTests": [],
+      "coveredByScanReport": false
+    },
+    {
+      "id": "input-validation:post:/wallets/{id}/fund",
+      "category": "input-validation",
+      "description": "Input validation for POST /wallets/{id}/fund",
+      "endpoint": "POST /wallets/{id}/fund",
+      "covered": false,
+      "matchedTests": [],
+      "coveredByScanReport": false
+    },
+    {
+      "id": "authorization:post:/wallets/{id}/debit",
+      "category": "authorization",
+      "description": "Authorization check for POST /wallets/{id}/debit",
+      "endpoint": "POST /wallets/{id}/debit",
+      "covered": false,
+      "matchedTests": [],
+      "coveredByScanReport": false
+    },
+    {
+      "id": "input-validation:post:/wallets/{id}/debit",
+      "category": "input-validation",
+      "description": "Input validation for POST /wallets/{id}/debit",
+      "endpoint": "POST /wallets/{id}/debit",
+      "covered": false,
+      "matchedTests": [],
+      "coveredByScanReport": false
+    },
+    {
+      "id": "authorization:post:/wallets/{id}/transfer",
+      "category": "authorization",
+      "description": "Authorization check for POST /wallets/{id}/transfer",
+      "endpoint": "POST /wallets/{id}/transfer",
+      "covered": false,
+      "matchedTests": [],
+      "coveredByScanReport": false
+    },
+    {
+      "id": "input-validation:post:/wallets/{id}/transfer",
+      "category": "input-validation",
+      "description": "Input validation for POST /wallets/{id}/transfer",
+      "endpoint": "POST /wallets/{id}/transfer",
+      "covered": false,
+      "matchedTests": [],
+      "coveredByScanReport": false
+    },
+    {
+      "id": "authorization:post:/payments",
+      "category": "authorization",
+      "description": "Authorization check for POST /payments",
+      "endpoint": "POST /payments",
+      "covered": false,
+      "matchedTests": [],
+      "coveredByScanReport": false
+    },
+    {
+      "id": "input-validation:post:/payments",
+      "category": "input-validation",
+      "description": "Input validation for POST /payments",
+      "endpoint": "POST /payments",
+      "covered": true,
+      "matchedTests": [
+        "returns 400 for missing required fields",
+        "returns 422 for invalid (non-existent) wallet",
+        "returns 422 when refunding a non-completed payment"
+      ],
+      "coveredByScanReport": false
+    },
+    {
+      "id": "authorization:get:/payments/{id}",
+      "category": "authorization",
+      "description": "Authorization check for GET /payments/{id}",
+      "endpoint": "GET /payments/{id}",
+      "covered": false,
+      "matchedTests": [],
+      "coveredByScanReport": false
+    },
+    {
+      "id": "input-validation:get:/payments/{id}",
+      "category": "input-validation",
+      "description": "Input validation for GET /payments/{id}",
+      "endpoint": "GET /payments/{id}",
+      "covered": true,
+      "matchedTests": [
+        "returns 422 when refunding a non-completed payment"
+      ],
+      "coveredByScanReport": false
+    },
+    {
+      "id": "authorization:post:/payments/{id}/refund",
+      "category": "authorization",
+      "description": "Authorization check for POST /payments/{id}/refund",
+      "endpoint": "POST /payments/{id}/refund",
+      "covered": false,
+      "matchedTests": [],
+      "coveredByScanReport": false
+    },
+    {
+      "id": "input-validation:post:/payments/{id}/refund",
+      "category": "input-validation",
+      "description": "Input validation for POST /payments/{id}/refund",
+      "endpoint": "POST /payments/{id}/refund",
+      "covered": false,
+      "matchedTests": [],
+      "coveredByScanReport": false
+    },
+    {
+      "id": "authorization:get:/transactions",
+      "category": "authorization",
+      "description": "Authorization check for GET /transactions",
+      "endpoint": "GET /transactions",
+      "covered": false,
+      "matchedTests": [],
+      "coveredByScanReport": false
+    },
+    {
+      "id": "authentication:JWT",
+      "category": "authentication",
+      "description": "JWT token signature and expiry validation",
+      "covered": true,
+      "matchedTests": [
+        "returns 401 for expired JWT",
+        "returns 401 for invalid JWT signature"
+      ],
+      "coveredByScanReport": false
+    }
+  ]
+}

package/dist/dashboard/dist/vite.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" aria-hidden="true" role="img" class="iconify iconify--logos" width="31.88" height="32" preserveAspectRatio="xMidYMid meet" viewBox="0 0 256 257"><defs><linearGradient id="IconifyId1813088fe1fbc01fb466" x1="-.828%" x2="57.636%" y1="7.652%" y2="78.411%"><stop offset="0%" stop-color="#41D1FF"></stop><stop offset="100%" stop-color="#BD34FE"></stop></linearGradient><linearGradient id="IconifyId1813088fe1fbc01fb467" x1="43.376%" x2="50.316%" y1="2.242%" y2="89.03%"><stop offset="0%" stop-color="#FFEA83"></stop><stop offset="8.333%" stop-color="#FFDD35"></stop><stop offset="100%" stop-color="#FFA800"></stop></linearGradient></defs><path fill="url(#IconifyId1813088fe1fbc01fb466)" d="M255.153 37.938L134.897 252.976c-2.483 4.44-8.862 4.466-11.382.048L.875 37.958c-2.746-4.814 1.371-10.646 6.827-9.67l120.385 21.517a6.537 6.537 0 0 0 2.322-.004l117.867-21.483c5.438-.991 9.574 4.796 6.877 9.62Z"></path><path fill="url(#IconifyId1813088fe1fbc01fb467)" d="M185.432.063L96.44 17.501a3.268 3.268 0 0 0-2.634 3.014l-5.474 92.456a3.268 3.268 0 0 0 3.997 3.378l24.777-5.718c2.318-.535 4.413 1.507 3.936 3.838l-7.361 36.047c-.495 2.426 1.782 4.5 4.151 3.78l15.304-4.649c2.372-.72 4.652 1.36 4.15 3.788l-11.698 56.621c-.732 3.542 3.979 5.473 5.943 2.437l1.313-2.028l72.516-144.72c1.215-2.423-.88-5.186-3.54-4.672l-25.505 4.922c-2.396.462-4.435-1.77-3.759-4.114l16.646-57.705c.677-2.35-1.37-4.583-3.769-4.113Z"></path></svg>

package/dist/dashboard/index.html

@@ -0,0 +1,14 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <link rel="icon" type="image/svg+xml" href="/vite.svg" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>API Coverage Analyzer Dashboard</title>
+    <script type="module" crossorigin src="/assets/index-B2mS1bcV.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-DBTGeaha.css">
+  </head>
+  <body>
+    <div id="root"></div>
+  </body>
+</html>

package/dist/dashboard/reports/business-coverage.json

@@ -0,0 +1,201 @@
+{
+  "total": 9,
+  "covered": 8,
+  "percentage": 88.89,
+  "uncoveredRules": [
+    {
+      "id": "daily-limit",
+      "description": "Daily transaction limit is $10,000"
+    }
+  ],
+  "rules": [
+    {
+      "id": "min-fund-amount",
+      "description": "Minimum funding amount is $1",
+      "endpoints": [
+        "POST /wallets/{walletId}/fund"
+      ],
+      "covered": true,
+      "testFiles": [
+        "tests/blackbox/payments.blackbox.test.ts",
+        "tests/blackbox/wallets.blackbox.test.ts",
+        "tests/integration/wallets.integration.test.ts"
+      ],
+      "matchedTests": [
+        "returns 400 for missing required fields",
+        "returns 400 when currency is missing",
+        "returns 400 for unsupported currency",
+        "funds exactly $1 (minimum amount)",
+        "returns 400 for invalid currency"
+      ],
+      "scenarios": []
+    },
+    {
+      "id": "insufficient-funds",
+      "description": "Debit cannot exceed balance",
+      "endpoints": [
+        "POST /wallets/{walletId}/debit"
+      ],
+      "covered": true,
+      "testFiles": [
+        "tests/blackbox/payments.blackbox.test.ts",
+        "tests/blackbox/wallets.blackbox.test.ts",
+        "tests/integration/wallets.integration.test.ts",
+        "tests/unit/riskService.test.ts",
+        "tests/unit/walletService.test.ts"
+      ],
+      "matchedTests": [
+        "returns 422 for invalid (non-existent) wallet",
+        "returns 422 when refunding a non-completed payment",
+        "returns 422 for insufficient funds",
+        "debits exactly the full balance",
+        "returns 422 with insufficient funds",
+        "passes when balance >= amount",
+        "throws for insufficient funds",
+        "adds to balance and returns transaction",
+        "reduces balance",
+        "fails with INSUFFICIENT_FUNDS when balance too low"
+      ],
+      "scenarios": []
+    },
+    {
+      "id": "frozen-wallet-reject",
+      "description": "Frozen wallets reject all transactions",
+      "endpoints": [
+        "POST /wallets/{walletId}/debit",
+        "POST /wallets/{walletId}/fund",
+        "POST /wallets/{walletId}/transfer"
+      ],
+      "covered": true,
+      "testFiles": [
+        "tests/blackbox/wallets.blackbox.test.ts",
+        "tests/integration/wallets.integration.test.ts",
+        "tests/unit/riskService.test.ts",
+        "tests/unit/walletService.test.ts"
+      ],
+      "matchedTests": [
+        "full lifecycle: create, fund, debit, transfer, freeze, unfreeze, delete",
+        "freezes a wallet",
+        "unfreezes a wallet",
+        "throws for frozen wallet",
+        "freeze changes status to frozen",
+        "unfreeze changes status back to active",
+        "freeze throws RiskError on closed wallet"
+      ],
+      "scenarios": []
+    },
+    {
+      "id": "daily-limit",
+      "description": "Daily transaction limit is $10,000",
+      "endpoints": [
+        "POST /wallets/{walletId}/debit",
+        "POST /wallets/{walletId}/transfer"
+      ],
+      "covered": false,
+      "testFiles": [],
+      "matchedTests": [],
+      "scenarios": []
+    },
+    {
+      "id": "transfer-same-currency",
+      "description": "Transfer requires matching currencies",
+      "endpoints": [
+        "POST /wallets/{walletId}/transfer"
+      ],
+      "covered": true,
+      "testFiles": [
+        "tests/blackbox/payments.blackbox.test.ts",
+        "tests/blackbox/wallets.blackbox.test.ts",
+        "tests/integration/wallets.integration.test.ts"
+      ],
+      "matchedTests": [
+        "returns 422 for invalid (non-existent) wallet",
+        "returns 422 when refunding a non-completed payment",
+        "returns 400 when currency is missing",
+        "returns 400 for unsupported currency",
+        "returns 422 for insufficient funds",
+        "returns 400 for invalid currency",
+        "returns 422 with insufficient funds"
+      ],
+      "scenarios": []
+    },
+    {
+      "id": "refund-window",
+      "description": "Refund allowed only within 30 days",
+      "endpoints": [
+        "POST /payments/{paymentId}/refund"
+      ],
+      "covered": true,
+      "testFiles": [
+        "tests/blackbox/payments.blackbox.test.ts",
+        "tests/blackbox/wallets.blackbox.test.ts",
+        "tests/integration/payments.integration.test.ts",
+        "tests/integration/wallets.integration.test.ts"
+      ],
+      "matchedTests": [
+        "returns 422 for invalid (non-existent) wallet",
+        "refunds a completed payment",
+        "returns 422 when refunding a non-completed payment",
+        "returns 422 for insufficient funds",
+        "refunds a completed payment",
+        "returns 422 with insufficient funds"
+      ],
+      "scenarios": []
+    },
+    {
+      "id": "fraud-check",
+      "description": "Payments require fraud check approval",
+      "endpoints": [
+        "POST /payments"
+      ],
+      "covered": true,
+      "testFiles": [
+        "tests/unit/paymentService.test.ts",
+        "tests/wiremock/fraudEngine.wiremock.test.ts"
+      ],
+      "matchedTests": [
+        "returns completed payment when fraud approved and processor succeeds",
+        "returns failed payment when fraud engine blocks",
+        "fraud check returns approved: true",
+        "fraud check returns approved: false with reason",
+        "fraud engine returns 503 → error thrown",
+        "fraud engine connection error → error thrown"
+      ],
+      "scenarios": []
+    },
+    {
+      "id": "idempotency",
+      "description": "Duplicate requests with same key return same result",
+      "endpoints": [
+        "POST /payments"
+      ],
+      "covered": true,
+      "testFiles": [
+        "tests/blackbox/payments.blackbox.test.ts",
+        "tests/integration/payments.integration.test.ts"
+      ],
+      "matchedTests": [
+        "creates payment with idempotency key",
+        "returns same payment id for duplicate key",
+        "returns same payment for duplicate idempotency key"
+      ],
+      "scenarios": []
+    },
+    {
+      "id": "unique-email",
+      "description": "Unique email required for all user accounts",
+      "endpoints": [
+        "POST /api/users"
+      ],
+      "covered": true,
+      "testFiles": [
+        "tests/integration/users.integration.test.ts"
+      ],
+      "matchedTests": [
+        "returns 409 for duplicate email",
+        "rejects registration with existing email"
+      ],
+      "scenarios": []
+    }
+  ]
+}