qa360 2.1.7 → 2.2.0

package/examples/pom-demo/pack.yml

@@ -0,0 +1,60 @@
+# QA360 Pack with Page Objects
+# Demonstrates importing Page Objects from TypeScript files
+
+name: pom-demo
+version: 1.0.0
+description: "Demo pack using Page Objects from external files"
+
+gates:
+  ui:
+    enabled: true
+    config:
+      # Reference to Page Objects directory
+      pageObjects:
+        directory: ./pages
+        baseUrl: https://demoqa.com
+        pattern: '**/*.page.ts'
+
+      baseURL: https://demoqa.com
+      scenarios:
+        - name: login-with-pom
+          description: "Login flow using Page Objects"
+          pageObject: LoginPage  # Reference to page class
+          steps:
+            - action: navigate
+              usePage: true  # Use page's URL
+            - action: waitForReady
+            - action: fillSelector
+              selector: usernameInput  # Reference selector from page
+              value: "testuser"
+            - action: fillSelector
+              selector: passwordInput
+              value: "Test@123"
+            - action: clickSelector
+              selector: submitButton
+            - action: waitForSelector
+              selector: successMessage
+              timeout: 5000
+
+        - name: dashboard-navigation
+          description: "Navigate to dashboard after login"
+          pageObject: DashboardPage
+          steps:
+            - action: navigate
+              usePage: true
+            - action: assertVisible
+              selector: header
+            - action: assertText
+              selector: welcomeMessage
+              contains: "Welcome"
+
+    budgets:
+      max_failures: 1
+      timeout_ms: 30000
+
+metadata:
+  author: QA360 Team
+  tags:
+    - demo
+    - pom
+    - page-objects

package/examples/pom-demo/pages/DashboardPage.page.ts

@@ -0,0 +1,73 @@
+/**
+ * Example Page Object - Dashboard Page
+ */
+
+import { PlaywrightBasePage } from 'qa360-core/pom';
+import type { Page } from '@playwright/test';
+
+/**
+ * Dashboard Page Object
+ *
+ * Handles dashboard page interactions.
+ */
+export class DashboardPage extends PlaywrightBasePage {
+  readonly name = 'dashboard';
+  readonly url = '/dashboard';
+
+  readonly selectors = {
+    header: '.dashboard-header',
+    userMenu: '#user-menu',
+    logoutButton: '#logout',
+    welcomeMessage: '.welcome-message',
+    statsCards: '.stat-card',
+  };
+
+  constructor(page: Page, baseUrl: string = 'https://demoqa.com') {
+    super(page, baseUrl);
+  }
+
+  /**
+   * Wait for dashboard to be ready
+   */
+  async waitForReady(): Promise<void> {
+    await this.page.waitForLoadState('networkidle');
+    await this.waitFor('header');
+  }
+
+  /**
+   * Check if dashboard is displayed
+   */
+  async isDisplayed(): Promise<boolean> {
+    return await this.isVisible('header');
+  }
+
+  /**
+   * Get welcome message
+   */
+  async getWelcomeMessage(): Promise<string> {
+    return await this.text('welcomeMessage');
+  }
+
+  /**
+   * Get stats count
+   */
+  async getStatsCount(): Promise<number> {
+    const cards = await this.page.locator(this.selectors.statsCards).count();
+    return cards;
+  }
+
+  /**
+   * Logout
+   */
+  async logout(): Promise<void> {
+    await this.click('userMenu');
+    await this.click('logoutButton');
+  }
+
+  /**
+   * Check if user is logged in
+   */
+  async isLoggedIn(): Promise<boolean> {
+    return await this.isVisible('userMenu');
+  }
+}

package/examples/pom-demo/pages/LoginPage.page.ts

@@ -0,0 +1,76 @@
+/**
+ * Example Page Object - Login Page
+ *
+ * Demonstrates how to create a Page Object for QA360.
+ */
+
+import { PlaywrightBasePage } from 'qa360-core/pom';
+import type { Page } from '@playwright/test';
+
+/**
+ * Login Page Object
+ *
+ * Handles login page interactions.
+ */
+export class LoginPage extends PlaywrightBasePage {
+  readonly name = 'login';
+  readonly url = '/login';
+
+  readonly selectors = {
+    usernameInput: '#userName',
+    passwordInput: '#password',
+    submitButton: '#login',
+    errorMessage: '.error-message',
+    successMessage: '.success-message',
+  };
+
+  constructor(page: Page, baseUrl: string = 'https://demoqa.com') {
+    super(page, baseUrl);
+  }
+
+  /**
+   * Wait for login page to be ready
+   */
+  async waitForReady(): Promise<void> {
+    await this.page.waitForLoadState('networkidle');
+    await this.waitFor('usernameInput');
+  }
+
+  /**
+   * Check if login page is displayed
+   */
+  async isDisplayed(): Promise<boolean> {
+    return await this.isVisible('usernameInput');
+  }
+
+  /**
+   * Login with username and password
+   */
+  async login(username: string, password: string): Promise<void> {
+    await this.fill('usernameInput', username);
+    await this.fill('passwordInput', password);
+    await this.click('submitButton');
+  }
+
+  /**
+   * Get error message text
+   */
+  async getErrorMessage(): Promise<string> {
+    return await this.text('errorMessage');
+  }
+
+  /**
+   * Get success message text
+   */
+  async getSuccessMessage(): Promise<string> {
+    return await this.text('successMessage');
+  }
+
+  /**
+   * Check if login was successful
+   */
+  async isLoginSuccessful(): Promise<boolean> {
+    const msg = await this.getSuccessMessage();
+    return msg.length > 0;
+  }
+}

package/examples/proofs/e2e-playwright-proof.json

@@ -0,0 +1,75 @@
+{
+  "spec": "qa360.proof.v1",
+  "run": {
+    "id": "660e9511-f3ac-52e5-b827-557766551111",
+    "startedAt": "2025-10-26T14:20:00Z",
+    "finishedAt": "2025-10-26T14:22:15Z",
+    "environment": {
+      "os": "darwin",
+      "node": "20.19.0",
+      "arch": "arm64",
+      "ci": false
+    },
+    "packHash": "sha256-b2c3d4e5f6a78901234567890123456789012345678901234567890123456bcd",
+    "ciContext": {
+      "provider": null
+    }
+  },
+  "artifacts": [
+    {
+      "name": "ui-report.html",
+      "sha256": "sha256-2345678901bcdef2345678901bcdef2345678901bcdef2345678901bcdef234",
+      "size": 45678,
+      "path": ".qa360/artifacts/ui-report.html"
+    },
+    {
+      "name": "screenshot-homepage.png",
+      "sha256": "sha256-3456789012cdef3456789012cdef3456789012cdef3456789012cdef34567890",
+      "size": 234567,
+      "path": ".qa360/artifacts/screenshot-homepage.png"
+    },
+    {
+      "name": "screenshot-login.png",
+      "sha256": "sha256-456789013def456789013def456789013def456789013def456789013def4567",
+      "size": 198765,
+      "path": ".qa360/artifacts/screenshot-login.png"
+    }
+  ],
+  "results": {
+    "trustScore": 85,
+    "gates": [
+      {
+        "name": "ui",
+        "status": "pass",
+        "metrics": {
+          "buttons_tested": 12,
+          "forms_tested": 3,
+          "links_tested": 45,
+          "coverage": 0.78
+        }
+      },
+      {
+        "name": "a11y",
+        "status": "pass",
+        "metrics": {
+          "violations": 2,
+          "wcag_level": "AA",
+          "score": 92
+        }
+      }
+    ]
+  },
+  "signing": {
+    "algo": "ed25519",
+    "signerId": "local@qa360",
+    "timestamp": {
+      "type": "none",
+      "token": null
+    },
+    "identity": {
+      "type": "none",
+      "evidence": null
+    }
+  },
+  "signature": "VGhpcyBpcyBhbm90aGVyIGZha2Ugc2lnbmF0dXJlIGZvciBQbGF5d3JpZ2h0IGV4YW1wbGUuCg=="
+}

package/examples/proofs/httpbin-proof.json

@@ -0,0 +1,69 @@
+{
+  "spec": "qa360.proof.v1",
+  "run": {
+    "id": "550e8400-e29b-41d4-a716-446655440000",
+    "startedAt": "2025-10-26T12:34:56Z",
+    "finishedAt": "2025-10-26T12:35:42Z",
+    "environment": {
+      "os": "linux",
+      "node": "20.19.0",
+      "arch": "x64",
+      "ci": false
+    },
+    "packHash": "sha256-a1b2c3d4e5f6789012345678901234567890123456789012345678901234abcd",
+    "ciContext": {
+      "provider": null
+    }
+  },
+  "artifacts": [
+    {
+      "name": "api-report.html",
+      "sha256": "sha256-1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",
+      "size": 12345,
+      "path": ".qa360/artifacts/api-report.html"
+    },
+    {
+      "name": "api-report.json",
+      "sha256": "sha256-abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890",
+      "size": 5678,
+      "path": ".qa360/artifacts/api-report.json"
+    }
+  ],
+  "results": {
+    "trustScore": 92,
+    "gates": [
+      {
+        "name": "api_smoke",
+        "status": "pass",
+        "metrics": {
+          "total_requests": 10,
+          "success_rate": 1.0,
+          "p95_ms": 142,
+          "p99_ms": 280
+        }
+      },
+      {
+        "name": "perf",
+        "status": "pass",
+        "metrics": {
+          "p95_ms": 142,
+          "p99_ms": 280,
+          "throughput_rps": 100
+        }
+      }
+    ]
+  },
+  "signing": {
+    "algo": "ed25519",
+    "signerId": "local@qa360",
+    "timestamp": {
+      "type": "none",
+      "token": null
+    },
+    "identity": {
+      "type": "none",
+      "evidence": null
+    }
+  },
+  "signature": "SGVsbG8gV29ybGQhIFRoaXMgaXMgYSBmYWtlIHNpZ25hdHVyZSBmb3IgZGVtbyBwdXJwb3Nlcy4K=="
+}

package/examples/proofs/multi-adapter-proof.json

@@ -0,0 +1,117 @@
+{
+  "spec": "qa360.proof.v1",
+  "run": {
+    "id": "770fa622-g4bd-63f6-c938-668877662222",
+    "startedAt": "2025-10-26T16:00:00Z",
+    "finishedAt": "2025-10-26T16:08:30Z",
+    "environment": {
+      "os": "windows",
+      "node": "22.0.0",
+      "arch": "x64",
+      "ci": true
+    },
+    "packHash": "sha256-c3d4e5f6a7b89012345678901234567890123456789012345678901234567cde",
+    "ciContext": {
+      "provider": "github-actions"
+    }
+  },
+  "artifacts": [
+    {
+      "name": "full-report.html",
+      "sha256": "sha256-4567890123def4567890123def4567890123def4567890123def4567890123de",
+      "size": 123456,
+      "path": ".qa360/artifacts/full-report.html"
+    },
+    {
+      "name": "sast-findings.json",
+      "sha256": "sha256-567890134ef567890134ef567890134ef567890134ef567890134ef56789012",
+      "size": 34567,
+      "path": ".qa360/artifacts/sast-findings.json"
+    },
+    {
+      "name": "dast-report.html",
+      "sha256": "sha256-67890145f67890145f67890145f67890145f67890145f67890145f678901234",
+      "size": 56789,
+      "path": ".qa360/artifacts/dast-report.html"
+    },
+    {
+      "name": "perf-metrics.json",
+      "sha256": "sha256-7890156g7890156g7890156g7890156g7890156g7890156g7890156g78901234",
+      "size": 12345,
+      "path": ".qa360/artifacts/perf-metrics.json"
+    }
+  ],
+  "results": {
+    "trustScore": 87,
+    "gates": [
+      {
+        "name": "api_smoke",
+        "status": "pass",
+        "metrics": {
+          "success_rate": 0.997,
+          "p95_ms": 142
+        }
+      },
+      {
+        "name": "ui",
+        "status": "pass",
+        "metrics": {
+          "coverage": 0.82
+        }
+      },
+      {
+        "name": "perf",
+        "status": "pass",
+        "metrics": {
+          "p95_ms": 142,
+          "p99_ms": 280
+        }
+      },
+      {
+        "name": "sast",
+        "status": "pass",
+        "metrics": {
+          "high_severity": 0,
+          "medium_severity": 3
+        }
+      },
+      {
+        "name": "dast",
+        "status": "pass",
+        "metrics": {
+          "high_severity": 0,
+          "medium_severity": 2
+        }
+      },
+      {
+        "name": "a11y",
+        "status": "pass",
+        "metrics": {
+          "score": 94,
+          "violations": 1
+        }
+      },
+      {
+        "name": "security",
+        "status": "pass",
+        "metrics": {
+          "secrets_found": 0,
+          "vulnerabilities": 0
+        }
+      }
+    ]
+  },
+  "signing": {
+    "algo": "ed25519",
+    "signerId": "ci-bot@qa360",
+    "timestamp": {
+      "type": "none",
+      "token": null
+    },
+    "identity": {
+      "type": "none",
+      "evidence": null
+    }
+  },
+  "signature": "TXVsdGktYWRhcHRlciBmYWtlIHNpZ25hdHVyZSBmb3IgZGVtb25zdHJhdGlvbiBwdXJwb3Nlcy4K"
+}

package/examples/proofs/test-proof.json

@@ -0,0 +1,26 @@
+{
+  "spec": "qa360.proof.v1",
+  "run": {
+    "id": "test-run-1761436040170",
+    "started_at": "2025-10-25T23:47:20.170Z",
+    "finished_at": "2025-10-25T23:47:20.171Z",
+    "pack_hash": "sha256-0000000000000000000000000000000000000000000000000000000000000000"
+  },
+  "artifacts": [],
+  "results": {
+    "trust_score": 100,
+    "gates": [
+      {
+        "name": "test",
+        "status": "pass"
+      }
+    ]
+  },
+  "signing": {
+    "signer": "test@qa360",
+    "algorithm": "Ed25519",
+    "timestamp": "2025-10-25T23:47:20.171Z",
+    "public_key": "test-public-key"
+  },
+  "signature": "test-signature-00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
+}

package/examples/restful-api-dev/README.md

@@ -0,0 +1,102 @@
+# RESTful API Dev - QA360 Test Examples
+
+Test packs for testing the public REST API at https://restful-api.dev
+
+## 📦 Available Test Packs
+
+### 1. `restful-api-basic.yml` - Basic API Tests
+Tests 4 fundamental endpoints of the API:
+- List all objects
+- Get single objects by ID
+- Query multiple objects
+
+**Run:**
+```bash
+qa360 run examples/restful-api-dev/restful-api-basic.yml
+```
+
+**Expected results:**
+- ✅ 4/4 endpoints pass
+- ⏱️ Duration: ~1.5s
+- 🎯 Trust Score: 100%
+
+---
+
+### 2. `restful-api-advanced.yml` - Advanced Tests with Error Cases
+Tests 6 endpoints including error handling:
+- Multiple object reads
+- Query parameters
+- 404 error case (non-existent ID)
+
+**Run:**
+```bash
+qa360 run examples/restful-api-dev/restful-api-advanced.yml
+```
+
+**Expected results:**
+- ✅ 6/6 endpoints pass (including 404 test)
+- ⏱️ Duration: ~1.8s
+- 🎯 Trust Score: 100%
+
+---
+
+## 🚀 Quick Start
+
+### 1. Run basic tests
+```bash
+cd /path/to/QA360
+qa360 run examples/restful-api-dev/restful-api-basic.yml
+```
+
+### 2. Verify the cryptographic proof
+```bash
+qa360 verify .qa360/runs
+```
+
+### 3. Check test history
+```bash
+qa360 history list
+```
+
+---
+
+## 📊 What Gets Tested
+
+| Endpoint | Method | Expected Status | Description |
+|----------|--------|----------------|-------------|
+| `/objects` | GET | 200 | List all objects in database |
+| `/objects/1` | GET | 200 | Get object with ID 1 |
+| `/objects/4` | GET | 200 | Get iPhone 11 object |
+| `/objects/7` | GET | 200 | Get MacBook Pro object |
+| `/objects?id=1&id=2` | GET | 200 | Query multiple objects by IDs |
+| `/objects/999999` | GET | 404 | Test error handling for non-existent ID |
+
+---
+
+## 🔐 Cryptographic Proofs
+
+After each run, QA360 generates:
+- **Signed proof bundle** (Ed25519 signature)
+- **Evidence vault entry** (SQLite database)
+- **Verifiable proof** that can be independently verified
+
+---
+
+## 🎯 Performance Budgets
+
+- **Basic tests**: P95 < 2000ms
+- **Advanced tests**: P95 < 3000ms
+
+Typical response times: 250-350ms per endpoint
+
+---
+
+## 📝 API Documentation
+
+API documentation: https://restful-api.dev
+
+This is a free REST API for testing and prototyping. It provides:
+- Objects with IDs, names, and data
+- Full CRUD operations
+- Query parameters support
+- Realistic response times

package/examples/restful-api-dev/restful-api-advanced.yml

@@ -0,0 +1,29 @@
+version: 1
+name: restful-api-dev-crud-tests
+description: Complete CRUD test suite for restful-api.dev
+
+gates:
+  - api_smoke
+
+targets:
+  api:
+    baseUrl: https://api.restful-api.dev
+    smoke:
+      # READ operations
+      - "GET /objects -> 200"
+      - "GET /objects/1 -> 200"
+      - "GET /objects/2 -> 200"
+      - "GET /objects/3 -> 200"
+
+      # Query by IDs
+      - "GET /objects?id=1&id=2 -> 200"
+
+      # Edge cases - Test 404 error handling
+      - "GET /objects/999999 -> 404"
+
+budgets:
+  perf_p95_ms: 3000
+
+execution:
+  timeout: 15000
+  max_retries: 2

package/examples/restful-api-dev/restful-api-basic.yml

@@ -0,0 +1,29 @@
+version: 1
+name: restful-api-dev-tests
+description: Test suite for restful-api.dev - Practice REST API
+
+gates:
+  - api_smoke
+
+targets:
+  api:
+    baseUrl: https://api.restful-api.dev
+    smoke:
+      # GET - List all objects
+      - "GET /objects -> 200"
+
+      # GET - Single object (iPhone 11 - ID 4)
+      - "GET /objects/4 -> 200"
+
+      # GET - Single object (Apple MacBook Pro 16 - ID 7)
+      - "GET /objects/7 -> 200"
+
+      # GET - Multiple objects by IDs
+      - "GET /objects?id=3&id=5&id=10 -> 200"
+
+budgets:
+  perf_p95_ms: 2000
+
+execution:
+  timeout: 10000
+  max_retries: 2