QuickBite — Food Delivery Mobile App

// Postman Test Script — TC-API-ORDER-001 const body = pm.response.json(); pm.test("Status 201 Created", () => pm.response.to.have.status(201)); pm.test("Response time < 2000ms", () => pm.expect(pm.response.responseTime).to.be.below(2000)); pm.test("Order ID format QB-XXXXXX", () => { pm.expect(body.orderId).to.match(/^QB-\d{6}$/); }); pm.test("Estimated delivery time present", () => { pm.expect(body).to.have.property("estimatedDeliveryMinutes"); pm.expect(body.estimatedDeliveryMinutes).to.be.above(0).and.below(120); }); pm.test("Cart cleared after order", () => { pm.expect(body.cartCleared).to.be.true; }); // Save orderId for downstream tests pm.environment.set("lastOrderId", body.orderId);

-- TC-DB-001: Verify user created đúng sau registration SELECT u.id, u.email, u.name, u.is_verified, u.created_at, u.password_hash FROM users u WHERE u.email = 'new@test.com'; -- Expected: -- is_verified = false (chưa confirm OTP) -- password_hash NOT NULL và có prefix '$2b$' (bcrypt) -- password_hash KHÔNG PHẢI plaintext 'Test123!' -- created_at trong vòng 60 giây -- TC-DB-002: Verify OTP record created và có expiry SELECT otp_code, expires_at, is_used FROM otp_verifications WHERE user_id = '<userId>' ORDER BY created_at DESC LIMIT 1; -- Expected: expires_at = created_at + 10 minutes, is_used = false -- TC-DB-003: Verify ORDER transaction integrity (ACID) -- Sau khi order thành công: BEGIN; SELECT * FROM orders WHERE order_id = 'QB-123456'; -- status = 'confirmed', total_amount đúng SELECT * FROM order_items WHERE order_id = 'QB-123456'; -- Đủ items, quantity đúng, price snapshot đúng tại thời điểm order SELECT * FROM payments WHERE order_id = 'QB-123456'; -- status = 'succeeded', stripe_payment_intent_id NOT NULL ROLLBACK; -- TC-DB-004: Race condition test — 2 users order món cuối cùng -- Setup: Set menu item quantity = 1 UPDATE menu_items SET stock_quantity = 1 WHERE id = '<itemId>'; -- Sau khi 2 concurrent order requests: -- Expected: Chỉ 1 order thành công, 1 order nhận 409 "Hết hàng" -- stock_quantity = 0 (không phải -1) → check pessimistic locking -- TC-DB-005: Verify no PII in logs SELECT message FROM audit_logs WHERE message ILIKE '%password%' OR message ILIKE '%card_number%' OR message ILIKE '%cvv%'; -- Expected: 0 rows — no sensitive data in logs

// k6 load test — tests/performance/sprint3-load.js import http from 'k6/http'; import { check, sleep } from 'k6'; import { Rate, Trend } from 'k6/metrics'; const errorRate = new Rate('errors'); const restaurantLoadTime = new Trend('restaurant_load_time'); export const options = { stages: [ { duration: '1m', target: 50 }, // Ramp-up { duration: '3m', target: 200 }, // Peak load { duration: '1m', target: 200 }, // Sustain { duration: '1m', target: 0 }, // Ramp-down ], thresholds: { 'http_req_duration{endpoint:restaurants}': ['p(90)<2000'], 'http_req_duration{endpoint:menu}': ['p(90)<1500'], 'http_req_duration{endpoint:checkout}': ['p(90)<3000'], 'http_req_failed': ['rate<0.01'], // < 1% errors 'errors': ['rate<0.01'], }, }; const BASE_URL = 'https://staging.quickbite.app/api/v1'; export function setup() { // Login and return shared token for all VUs const res = http.post(`${BASE_URL}/auth/login`, JSON.stringify({ email: 'perf_test@quickbite.app', password: 'PerfTest123!' }), { headers: { 'Content-Type': 'application/json' } }); return { token: res.json('accessToken') }; } export default function(data) { const headers = { 'Authorization': `Bearer ${data.token}`, 'Content-Type': 'application/json', }; // Scenario 1: Browse restaurants (most common action) const restRes = http.get( `${BASE_URL}/restaurants?lat=10.762&lon=106.660&radius=5`, { headers, tags: { endpoint: 'restaurants' } } ); check(restRes, { 'restaurants status 200': r => r.status === 200, 'has restaurants array': r => r.json('restaurants').length > 0, }) || errorRate.add(1); restaurantLoadTime.add(restRes.timings.duration); sleep(2); // Scenario 2: View menu const menuRes = http.get( `${BASE_URL}/restaurants/1/menu`, { headers, tags: { endpoint: 'menu' } } ); check(menuRes, { 'menu status 200': r => r.status === 200 }) || errorRate.add(1); sleep(1); }

// Detox E2E — e2e/auth/registration.test.ts import { device, element, by, expect } from 'detox'; describe('User Registration', () => { beforeAll(async () => { await device.launchApp({ newInstance: true }); }); beforeEach(async () => { await device.reloadReactNative(); }); it('TC-AUTH-001: should register successfully and navigate to OTP screen', async () => { // Navigate to Register screen await element(by.id('register-link')).tap(); // Fill in registration form await element(by.id('name-input')).typeText('Test User'); await element(by.id('email-input')).typeText('newuser@test.com'); await element(by.id('password-input')).typeText('Test123!'); // Submit await element(by.id('register-button')).tap(); // Assert OTP screen appeared await expect(element(by.id('otp-screen'))).toBeVisible(); await expect(element(by.text('OTP đã gửi tới newuser@test.com'))).toBeVisible(); }); it('TC-AUTH-004: should show error for invalid email format', async () => { await element(by.id('register-link')).tap(); await element(by.id('email-input')).typeText('notanemail'); await element(by.id('name-input')).tap(); // trigger blur on email await expect(element(by.text('Email không hợp lệ'))).toBeVisible(); await expect(element(by.id('register-button'))).not.toBeEnabled(); }); it('TC-AUTH-005: should show duplicate email error', async () => { await element(by.id('register-link')).tap(); await element(by.id('name-input')).typeText('Existing User'); await element(by.id('email-input')).typeText('existing@test.com'); // pre-seeded await element(by.id('password-input')).typeText('Test123!'); await element(by.id('register-button')).tap(); await expect(element(by.text('Email này đã được đăng ký. Đăng nhập?'))).toBeVisible(); }); }); describe('Order Checkout', () => { beforeAll(async () => { await device.launchApp({ newInstance: true }); await loginAsTestUser(); // helper function await addItemToCart('Phở bò đặc biệt', 1); // helper function }); it('TC-ORDER-015: should prevent double order on double tap', async () => { await element(by.id('cart-button')).tap(); await element(by.id('checkout-button')).tap(); // Select address and payment await element(by.id('address-1')).tap(); await element(by.id('pay-visa')).tap(); await fillStripeTestCard(); // helper // Double tap place order very fast await element(by.id('place-order-btn')).multiTap(2); // Should see only ONE confirmation await expect(element(by.id('order-confirmation-screen'))).toBeVisible(); // Verify in API only 1 order created const orderId = await element(by.id('order-id')).getAttributes(); expect(orderId).toMatch(/^QB-\d{6}$/); }); });