Automated tests when using middleware validation

[lindeberg]

This question is perhaps not exclusive to this package but in general with this kind of middleware validation design.

In short - is it an issue that the mutation/query-method itself does not do the validation?

So, when simply calling the method with invalid inputs it goes through. And the validation has to be tested seperately.

[sergeyshaykhullin]

Same thing as you will instantiate new controller directly and pass to its method something... Invalid

That is because you want to test not only method itself, but full pipeline instead: mvc action filters, hotchocolate middleware, asp net core request middleware, masstransit events, etc

It is integration testing and some frameworks has testing support:
https://www.nuget.org/packages/Microsoft.AspNetCore.Mvc.Testing
https://www.nuget.org/packages/MassTransit.TestFramework/7.2.0-develop.65

HotChocolate also can execute full pipeline for integration testing. From parsing, procrssing to serializing response. Here is an example:

AppAny.HotChocolate.FluentValidation/tests/AppAny.HotChocolate.FluentValidation.Tests/MultipleInputs.cs

Line 15 in 162703e

var executor = await TestSetup.CreateRequestExecutor(builder =>

[lindeberg]

Yeah same issue in controller actions.

I'm not so sure I want to test the full pipeline. Do you then mean something like this? It seems like it becomes much more difficult and might not be pragmatic. I'm very new to HotChoclate and trying to figure out a lot about testing.

[sergeyshaykhullin]

Yes, this guide is what you want

If you want to unit test your buisness logic - just create models you want and run your operation. Unit tests should be framework independant, all external dependencies should be mocked

If you want to test, that not only your buisness code is working fine, but also... Routing, validation, redirecting, file uploading, using external services like redis or kafka - you want to write integration tests

You can test:

• That UpdatePassword logic is working, updating password, etc.
• That your validator has correct rules
• That hotchocolate executes validation and runs update mutation, returning correct results

[sergeyshaykhullin]

To write unit tests you should excract all your buisness code from HotChocolate resolvers to somewhere else - services, entities etc and test them separately

[lindeberg]

I think there are many ways to define unit and integration test. Another term for what I am doing here I think is "Subcutaneous Test" (maybe I understand it wrong but whatever), which is a type of integration test, and I find it valuable because it is so simple. This snapshot thing seems not. But I guess that's not the only way? I'll give it a shot.

Realized this discussion turned into more of the philosophy of automated testing in general.

On the original question - the common view is that it is nothing weird about the mutation/query-method not handling validation itself but trusting it to have happened in the pipeline? Not sure I understand why. I realize that's how authentication/authorization works as well. But to me that's different. The method might actually fail if the input isn't validated before calling it. Same is usually not true for auth.

[sergeyshaykhullin]

Hmm, yes, it is not weird. If you are testing only resolvers(just a method call, it has no magic) - no one will call validation for you and prevent execution