Allow clients to assert the webTestClient response status

[ivangfr]

Hi! I have a Spring Boot that exposes a GraphQL API, and it's secured with LDAP. Now, I am implementing some test cases using HttpGraphQlTester.

The problem I am facing is when I inform invalid credentials.

For instance, let's suppose that a valid user has the username app-user and password 123.

All good when I call

GraphQlTester.Response response = tester
        .mutate()
        .headers(headers -> headers.setBasicAuth("app-user", "123"))
        .build()
        .document({...})
        .execute();

I get 200 and the response;

The same happens when I do not inform the credentials

GraphQlTester.Response response = tester
        .document({...})
        .execute();

I get 200 and the error in my response;

However, when informing invalid credentials

GraphQlTester.Response response = tester
        .mutate()
        .headers(headers -> headers.setBasicAuth("app-user-2", "123"))
        .build()
        .document({...})
        .execute();

I get 401 and the test fails.

Checking the library code, I've seen that we are asserting the webClientTest response to be .expectStatus().isOk().

final class WebTestClientTransport implements GraphQlTransport {
	...
	@Override
	public Mono<GraphQlResponse> execute(GraphQlRequest request) {

		Map<String, Object> responseMap = this.webTestClient.post()
				.contentType(MediaType.APPLICATION_JSON)
				.accept(MediaType.APPLICATION_JSON)
				.bodyValue(request.toMap())
				.exchange()
				.expectStatus().isOk()
				.expectHeader().contentTypeCompatibleWith(MediaType.APPLICATION_JSON)
				.expectBody(MAP_TYPE)
				.returnResult()
				.getResponseBody();
		...
	}
	...
}

Is it (or would it be) possible to not assert inside the library and let the clients assert in their test cases?

Best regards,

[bclozel]

Valid GraphQL responses must have the expected content-type and, have a 200 OK response status and a valid response body. If you're trying to test cases where transport-specific features are involved, using a WebTestClient is more appropriate.

[rstoyanchev]

Indeed the 401 occurs at the transport level before it even gets to the GraphQL handler, and using a regular HTTP request with an HTTP test client is a good fit for the scenario.