Market API

Complete the end-to-end shopping flow manually using a REST client (Postman, Insomnia, or curl). Document each step and verify responses.

• Register a new account and capture the api_key
• List all products and find 3 different categories
• Add 2 different products to the basket
• Verify the basket GET shows exactly those 2 items
• Place the order and record the order_number
• Verify the basket is empty after the order
• Verify the product stock decreased by ordered quantity
• Update the order status to delivered

Explore all the ways stock validation can be violated. Try to find edge cases the system handles (or doesn't handle).

• Find a product with stock = 0 and try to add it to the basket
• Set a product's stock to 5, add 3 to basket, then try to add 3 more
• Add the maximum stock amount to basket — verify it allows it
• Add stock + 1 — verify the error message is helpful
• Place an order, then try to add the same product quantity that should now be depleted
• Create a product with stock=0 and verify it appears but cannot be added to basket

Verify that the API correctly isolates data between users. Attempt cross-user data access and confirm it is properly blocked.

• Register two accounts — capture both API keys
• Create products with User A's key, verify User B cannot see them
• Use User B's key to GET User A's product ID directly — expect 404
• Try to update/delete User A's product using User B's key — expect 404
• Add items to User A's basket — verify User B's basket is empty
• Place an order as User A — verify it doesn't appear in User B's orders

Thoroughly test the product filter endpoint with all parameter combinations, ensuring accurate filtering and sorting behavior.

• Filter by each temperature_zone value and verify only correct products returned
• Filter by invalid temperature_zone — expect 400
• Filter by weighted=true — all returned products must have weighted=true
• Combine category + temperature_zone filters
• Filter by multiple categories: category=Dairy,Meat
• Test sort=asc — verify alphabetical order (A→Z)
• Test sort=desc — verify reverse alphabetical order (Z→A)
• Filter by a category that doesn't exist — expect empty array, not error

Write an automated test script that covers the full positive flow: register → get products → add to basket → place order → verify order.

• Auto-generate unique test credentials (e.g., timestamp-based username)
• Register and extract api_key from response
• GET products and select the first one with stock > 0
• Add 1 unit to basket and verify 201 response
• GET basket and assert item count = 1
• POST /api/orders and assert order_number matches /^O\d{5}$/
• Assert total_amount equals product price × quantity
• Assert basket is empty after order

Build a complete test suite covering Create, Read, Update, Delete for the products API with both positive and negative cases.

• Setup: register and reset data before suite runs
• Test POST with only required fields → expect 201
• Test POST with all fields including details JSONB → expect 201
• Test POST missing product_name → expect 400
• Test POST with invalid temperature_zone → expect 400
• Test PUT partial update: only change price → other fields unchanged
• Test DELETE → product disappears from GET all
• Test DELETE nonexistent ID → expect 404
• Test GET with invalid API key → expect 401
• Teardown: POST /api/reset to restore catalog

Write automation that targets basket edge-cases, particularly around quantity merging, stock limits, and concurrent additions.

• Add product A (qty=2), add same product again (qty=3) → basket qty=5
• Add product with qty=0 → expect 400
• Add product with qty=-1 → expect 400
• Add product with qty exceeding stock → expect 400 with helpful message
• Add product with exact stock amount → expect 201
• Add product with stock+1 after item is in basket → expect 400
• Clear basket → GET basket → verify empty array
• Remove specific product → verify only that product is removed

Verify the price snapshot behavior — a placed order's items must retain the price at the time of purchase, even if the product is later modified or deleted.

• Create a product with price=10.00
• Add it to basket and place order — record order item's price_at_purchase
• Update product price to 99.99
• Fetch the order — verify price_at_purchase is still 10.00
• Delete the product entirely
• Fetch the order — verify order items still show product data
• Automate this as a regression test

Probe the authentication system for common vulnerabilities and verify security controls are in place.

• Attempt to register with SQL injection in username: admin'; DROP TABLE users;--
• Attempt XSS in username field: <script>alert(1)</script>
• Try brute-force: 10 incorrect login attempts — verify system behaviour
• Attempt to access GET /api/profile without any auth → expect 401
• Modify the JWT token payload (decode, change userId, re-encode) → expect 401
• Use an expired JWT if possible → expect 401
• Try registering with an empty string password ""

Build a complete, shareable Postman collection for the Market API with environment variables, pre-request scripts, and test scripts.

• Create environment variables: base_url, api_key, product_id, order_id
• Add register request with test script to extract and save api_key
• Add a pre-request script that calls POST /api/reset before product tests
• Add test assertions for status codes on every request
• Add test assertions for response body shape (required fields present)
• Chain requests: create product → save ID → use in basket → place order → save order ID
• Add a negative test folder with expected error scenarios
• Export collection and document how to import and run it