Writing BDD-Style Webservice Tests with Karate and Java

src/test
├── java
│   └── feature
│       └── user
│           └── UserManagementTest.java
└── resources
    ├── feature
    │   ├── security
    │   │   └── user-login.feature
    │   └── user
    │       └── user-management.feature
    └── karate-config.js

package feature.user;

import org.junit.runner.RunWith;

import com.intuit.karate.junit4.Karate;

@RunWith(Karate.class)
public class UserManagementTest {}

function() {
	return {
		baseUrl: 'http://localhost:9000'
	}
}

Feature: User management

Background:
* url baseUrl

Scenario: List existing users

Given path '/user'
When method GET
Then status 200
And match $ == []

Scenario: Create and receive new user

Given path '/user'
And request {id:'', name:'Fred', age:22, password:'abc123'}
When method POST
Then status 200
And match response == {id:'#uuid', name:'Fred', age:22, password:'abc123'}
And def user = response

Given path '/user/'+user.id
When method GET
Then status 200
And match $ == {id:'#(user.id)', name:'#(user.name)', age:#(user.age), password:'#(user.password)'}

Feature: User management

Background:
* url baseUrl

Scenario Outline: Create multiple users and verify their id, name and age

Given path '/user'
And request {id:'', name:'<name>', age: <age>}
When method POST
Then status 200
And match $ == {id:'#uuid', name: '<name>', age: <age>}
And def user = response

Given path '/user/'+user.id
When method GET
And status 200
And match $ == {id:'#(user.id)', name:'#(user.name)', age:#(user.age)}

Examples:
| name  | age |
| Tim   | 42  |
| Liz   | 16  |
| Selma | 65  |
| Ted   | 12  |
| Luise | 19  |

Feature: User management

Background:
* url baseUrl

Scenario: Login user

Given path '/user/login'
And request {id: '#(id)', password:'#(password)'}
When method POST
Then status 200
And match $ == {authToken:'#notnull'}
And def authToken = $.authToken

Feature: User management

Background:
* url baseUrl

Scenario: Create and login user

Given path '/user'
And request {id:'', name:'Eleonore', age:31, password:'foobar'}
When method POST
Then status 200
And def user = response

Given path '/user/secured/date'
When method GET
Then status 403

Given path '/user/secured/date'
And def userLogin = call read('classpath:feature/security/user-login.feature') {id:'#(user.id)', password:'#(user.password)'}
And header Auth-Token = userLogin.authToken
When method GET
Then status 200
And match $ == {date:'#notnull'}

Feature: User management

Background:
* url baseUrl

Scenario: Remove all users
Given path '/user'
When method DELETE
Then status 200
And assert responseTime < 1000

Given path '/user'
When method GET
Then status 200
And match $ == []
And assert responseTime < 1000

<dependency>
    <groupId>org.eclipse.jetty</groupId>
    <artifactId>jetty-server</artifactId>
    <version>${jetty.version}</version>
</dependency>
<dependency>
    <groupId>org.eclipse.jetty</groupId>
    <artifactId>jetty-servlet</artifactId>
    <version>${jetty.version}</version>
</dependency>
<dependency>
    <groupId>org.glassfish.jersey.core</groupId>
    <artifactId>jersey-server</artifactId>
    <version>${jersey.version}</version>
</dependency>
<dependency>
    <groupId>org.glassfish.jersey.containers</groupId>
    <artifactId>jersey-container-servlet-core</artifactId>
    <version>${jersey.version}</version>
</dependency>
<dependency>
    <groupId>org.glassfish.jersey.containers</groupId>
    <artifactId>jersey-container-jetty-http</artifactId>
    <version>${jersey.version}</version>
    <exclusions>
        <exclusion>
            <groupId>org.eclipse.jetty</groupId>
            <artifactId>jetty-util</artifactId>
        </exclusion>
    </exclusions>
</dependency>
<dependency>
    <groupId>org.glassfish.jersey.media</groupId>
    <artifactId>jersey-media-moxy</artifactId>
    <version>${jersey.version}</version>
</dependency>

package com.hascode.tutorial;

import javax.xml.bind.annotation.XmlRootElement;

@XmlRootElement
public class User {
    private String name;
    private String id;
    private int age;
    private String password;
}

package com.hascode.tutorial;

import java.math.BigInteger;
import java.security.SecureRandom;
import java.util.Collection;
import java.util.Map;
import java.util.UUID;
import java.util.concurrent.ConcurrentHashMap;

import javax.ws.rs.Consumes;
import javax.ws.rs.DELETE;
import javax.ws.rs.GET;
import javax.ws.rs.POST;
import javax.ws.rs.Path;
import javax.ws.rs.PathParam;
import javax.ws.rs.Produces;
import javax.ws.rs.core.GenericEntity;
import javax.ws.rs.core.MediaType;
import javax.ws.rs.core.Response;
import javax.xml.bind.annotation.XmlRootElement;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

@Path("/user")
public class UserResource {
    private static final Logger LOG = LoggerFactory.getLogger(UserResource.class);

    private static final Map<String, User> USER_STORE = new ConcurrentHashMap<>();
    private static final Map<String, String> TOKEN_TO_USERID = new ConcurrentHashMap<>();

    @XmlRootElement
    static class Credential {
        private String id;
        private String password;

        public String getId() {
            return id;
        }

        public void setId(String id) {
            this.id = id;
        }

        public String getPassword() {
            return password;
        }

        public void setPassword(String password) {
            this.password = password;
        }
    }

    @GET
    @Produces(MediaType.APPLICATION_JSON)
    public Response getAll() {
        Collection<User> users = USER_STORE.values();
        LOG.info("{} users found", users.size());

        return Response.ok(new GenericEntity<Collection<User>>(users) {
        }).build();
    }

    @Path("/{userId}")
    @GET
    @Produces(MediaType.APPLICATION_JSON)
    public Response getUserById(@PathParam("userId") String userId) {
        LOG.info("fetching user by user-id: {}", userId);
        return Response.ok(USER_STORE.get(userId)).build();
    }

    @POST
    @Consumes(MediaType.APPLICATION_JSON)
    @Produces(MediaType.APPLICATION_JSON)
    public Response save(User user) {
        user.setId(UUID.randomUUID().toString().toUpperCase());
        USER_STORE.put(user.getId(), user);

        LOG.info("new user {} saved", user);
        return Response.ok(user).build();
    }

    @DELETE
    public Response purgeUsers() {
        LOG.info("removing all {} users", USER_STORE.size());
        USER_STORE.clear();
        return Response.ok().build();
    }

    @POST
    @Path("/login")
    public Response login(Credential credential) {
        LOG.info("login user with id: '{}' and password '{}'", credential.getId(), credential.getPassword());
        if (validCredential(credential)) {
            LOG.info("login for user-id '{}' successful", credential.id);
            String authToken = authorize(credential);
            return Response.ok("{\"authToken\":\"" + authToken + "\"}").build();
        }
        return Response.status(401).build();
    }

    private String authorize(Credential credential) {
        String code = new BigInteger(130, new SecureRandom()).toString(20);
        TOKEN_TO_USERID.put(code, credential.getId());
        return code;
    }

    private boolean validCredential(Credential credential) {
        if (!USER_STORE.containsKey(credential.getId())) {
            LOG.warn("no user with id {} known", credential.getId());
            return false;
        }
        if (!USER_STORE.get(credential.id).getPassword().equals(credential.getPassword())) {
            LOG.warn("credentials are invalid");
            return false;
        }

        LOG.info("credentials are valid");
        return true;
    }

    @Path("/secured")
    public SecuredResource getSecuredResource() {
        return new SecuredResource(TOKEN_TO_USERID);
    }
}

package com.hascode.tutorial;

import java.time.LocalDateTime;
import java.time.format.DateTimeFormatter;
import java.util.Map;

import javax.ws.rs.GET;
import javax.ws.rs.HeaderParam;
import javax.ws.rs.Path;
import javax.ws.rs.Produces;
import javax.ws.rs.core.MediaType;
import javax.ws.rs.core.Response;
import javax.ws.rs.core.Response.Status;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

public class SecuredResource {
    private static final Logger LOG = LoggerFactory.getLogger(SecuredResource.class);

    private final Map<String, String> tokenToUserid;

    public SecuredResource(Map<String, String> tokenToUserid) {
        this.tokenToUserid = tokenToUserid;
    }

    @GET
    @Path("/date")
    @Produces(MediaType.APPLICATION_JSON)
    public Response getDate(@HeaderParam("Auth-Token") String authToken) {
        LOG.info("trying to access secured resource with authToken '{}'", authToken);
        if (!authorized(authToken)) {
            LOG.warn("not authorized");
            return Response.status(Status.FORBIDDEN).build();
        }
        return Response.ok(String.format("{\"date\":\"%s\"}",
                LocalDateTime.now().format(DateTimeFormatter.ofPattern("yyyy-MM-dd")))).build();
    }

    private boolean authorized(String authToken) {
        if (authToken == null || authToken.isEmpty()) {
            LOG.warn("no auth-token given");
            return false;
        }
        if (!tokenToUserid.containsKey(authToken)) {
            LOG.warn("invalid auth-token given");
            return false;
        }
        return true;
    }
}

package com.hascode.tutorial;

import org.eclipse.jetty.server.Server;
import org.eclipse.jetty.servlet.ServletContextHandler;
import org.eclipse.jetty.servlet.ServletHolder;

public class App {
    private Server jettyServer;

    public App() {
        ServletContextHandler context = new ServletContextHandler(ServletContextHandler.SESSIONS);
        context.setContextPath("/");

        jettyServer = new Server(9000);
        jettyServer.setHandler(context);

        ServletHolder jerseyServlet = context.addServlet(org.glassfish.jersey.servlet.ServletContainer.class, "/*");
        jerseyServlet.setInitParameter("jersey.config.server.provider.classnames",
                UserResource.class.getCanonicalName());
        jerseyServlet.setInitOrder(0);
    }

    public void start() throws Exception {
        jettyServer.start();
    }

    public void stop() throws Exception {
        try {
            jettyServer.stop();
        } finally {
            jettyServer.destroy();
        }
    }

    public static void main(String[] args) throws Exception {
        new App().run();
    }

    private void run() throws Exception {
        try {
            jettyServer.start();
            jettyServer.join();
        } finally {
            jettyServer.destroy();
        }
    }

}

org.eclipse.jetty.util.log.class=org.eclipse.jetty.util.log.StdErrLog
org.eclipse.jetty.LEVEL=OFF
com.hascode.LEVEL=INFO

src/main
├── java
│   └── com
│       └── hascode
│           └── tutorial
│               ├── App.java
│               ├── SecuredResource.java
│               ├── User.java
│               └── UserResource.java
└── resources
    └── jetty-logging.properties

mvn exec:java -Dexec.mainClass=com.hascode.tutorial.App