import requests
import time

# UI 测试（慢）
def test_ui_add_to_cart():
    driver = webdriver.Chrome()
    driver.get("https://example.com")
    driver.find_element(By.ID, "login").click()
    # ... 10+ 步操作
    # 耗时：10-30 秒

# API 测试（快）
def test_api_add_to_cart():
    response = requests.post("https://api.example.com/cart/add", json={
        "product_id": 123,
        "quantity": 1
    }, headers={"Authorization": "Bearer token"})
    assert response.status_code == 200
    # 耗时：100-500 毫秒

# 速度对比：API 测试快 20-60 倍

# 前端还没开发，但 API 已经可以测试
def test_user_registration_api():
    """测试用户注册 API"""
    response = requests.post("https://api.example.com/register", json={
        "username": "testuser",
        "email": "test@example.com",
        "password": "password123"
    })
    
    # 验证响应
    assert response.status_code == 201
    assert "user_id" in response.json()
    assert "token" in response.json()
    
    # 验证数据库
    user = db.query(f"SELECT * FROM users WHERE email = 'test@example.com'")
    assert user is not None
    assert user.username == "testuser"

# 前端开发时，API 已经测试通过 ✅

def test_get_product():
    """测试获取商品详情"""
    response = requests.get("https://api.example.com/products/123")
    
    assert response.status_code == 200
    assert response.json()["id"] == 123
    assert response.json()["name"] == "iPhone 15"
    assert response.json()["price"] == 5999

def test_create_order():
    """测试创建订单"""
    response = requests.post("https://api.example.com/orders", json={
        "product_id": 123,
        "quantity": 1,
        "address": "北京市朝阳区xxx"
    }, headers={"Authorization": "Bearer token"})
    
    assert response.status_code == 201
    assert "order_id" in response.json()
    assert response.json()["status"] == "pending"

import pytest
import requests

BASE_URL = "https://api.example.com"

class TestProductAPI:

    @pytest.fixture(scope="class")
    def auth_token(self):
        """获取认证 token"""
        response = requests.post(f"{BASE_URL}/login", json={
            "email": "test@example.com",
            "password": "password123"
        })
        return response.json()["token"]

    def test_get_products(self, auth_token):
        """测试获取商品列表"""
        response = requests.get(
            f"{BASE_URL}/products",
            headers={"Authorization": f"Bearer {auth_token}"}
        )

        assert response.status_code == 200
        assert "products" in response.json()
        assert len(response.json()["products"]) > 0

    def test_get_product_by_id(self, auth_token):
        """测试获取商品详情"""
        response = requests.get(
            f"{BASE_URL}/products/123",
            headers={"Authorization": f"Bearer {auth_token}"}
        )

        assert response.status_code == 200
        product = response.json()
        assert product["id"] == 123
        assert "name" in product
        assert "price" in product

    def test_create_product(self, auth_token):
        """测试创建商品"""
        response = requests.post(
            f"{BASE_URL}/products",
            json={
                "name": "Test Product",
                "price": 99.99,
                "stock": 100
            },
            headers={"Authorization": f"Bearer {auth_token}"}
        )

        assert response.status_code == 201
        product = response.json()
        assert product["name"] == "Test Product"
        assert product["price"] == 99.99

    def test_update_product(self, auth_token):
        """测试更新商品"""
        response = requests.put(
            f"{BASE_URL}/products/123",
            json={"price": 199.99},
            headers={"Authorization": f"Bearer {auth_token}"}
        )

        assert response.status_code == 200
        product = response.json()
        assert product["price"] == 199.99

    def test_delete_product(self, auth_token):
        """测试删除商品"""
        response = requests.delete(
            f"{BASE_URL}/products/123",
            headers={"Authorization": f"Bearer {auth_token}"}
        )

        assert response.status_code == 204

def test_create_order_with_valid_data():
    """
    测试用例：使用有效数据创建订单

    前置条件：
    - 用户已登录
    - 商品库存充足

    测试步骤：
    1. 发送创建订单请求
    2. 验证响应状态码为 201
    3. 验证订单 ID 存在
    4. 验证订单状态为 pending
    5. 验证库存扣减

    预期结果：
    - 订单创建成功
    - 库存正确扣减
    """
    # 步骤 1
    response = requests.post(f"{BASE_URL}/orders", json={
        "product_id": 123,
        "quantity": 1
    }, headers={"Authorization": f"Bearer {token}"})

    # 步骤 2
    assert response.status_code == 201

    # 步骤 3
    order = response.json()
    assert "order_id" in order

    # 步骤 4
    assert order["status"] == "pending"

    # 步骤 5
    product = requests.get(f"{BASE_URL}/products/123").json()
    assert product["stock"] == initial_stock - 1

@pytest.mark.parametrize("product_id,expected_status", [
    (123, 200),  # 存在的商品
    (999, 404),  # 不存在的商品
    (-1, 400),   # 无效的 ID
    ("abc", 400),  # 非数字 ID
])
def test_get_product_by_id(product_id, expected_status):
    """测试获取商品详情（数据驱动）"""
    response = requests.get(f"{BASE_URL}/products/{product_id}")
    assert response.status_code == expected_status

from locust import HttpUser, task, between

class APIUser(HttpUser):
    wait_time = between(1, 3)
    
    @task
    def get_products(self):
        self.client.get("/products")
    
    @task
    def search_products(self):
        self.client.get("/products/search?q=iPhone")

# 运行：locust -f test_api_performance.py --users 1000 --spawn-rate 10
# 目标：
# - 响应时间 P95 < 500ms
# - 吞吐量 > 1000 TPS
# - 错误率 < 0.1%

def test_unauthorized_access():
    """测试未授权访问"""
    response = requests.get("https://api.example.com/orders")
    assert response.status_code == 401

def test_sql_injection():
    """测试 SQL 注入"""
    response = requests.get(
        "https://api.example.com/products/search",
        params={"q": "'; DROP TABLE products; --"}
    )
    assert response.status_code == 200
    assert "error" not in response.json()

def test_xss():
    """测试 XSS 攻击"""
    response = requests.post("https://api.example.com/comments", json={
        "content": "<script>alert('XSS')</script>"
    }, headers={"Authorization": "Bearer token"})
    
    # 验证内容被转义
    comment = response.json()
    assert "<script>" not in comment["content"]
    assert "&lt;script&gt;" in comment["content"]

import requests
from openapi_spec_validator import validate_spec

def test_api_contract():
    """测试 API 契约"""
    # 获取 OpenAPI 规范
    spec = requests.get("https://api.example.com/openapi.json").json()
    
    # 验证规范有效性
    validate_spec(spec)
    
    # 验证实际响应符合规范
    response = requests.get("https://api.example.com/products/123")
    
    # 验证响应格式
    assert "id" in response.json()
    assert "name" in response.json()
    assert "price" in response.json()
    assert isinstance(response.json()["id"], int)
    assert isinstance(response.json()["name"], str)
    assert isinstance(response.json()["price"], (int, float))

def test_payment_integration():
    """测试支付集成"""
    # 1. 创建订单
    order_response = requests.post("https://api.example.com/orders", json={
        "product_id": 123,
        "quantity": 1
    }, headers={"Authorization": "Bearer token"})
    
    order_id = order_response.json()["order_id"]
    
    # 2. 调用支付 API
    payment_response = requests.post(
        f"https://api.example.com/orders/{order_id}/pay",
        json={"payment_method": "wechat"},
        headers={"Authorization": "Bearer token"}
    )
    
    assert payment_response.status_code == 200
    
    # 3. 验证订单状态
    order = requests.get(
        f"https://api.example.com/orders/{order_id}",
        headers={"Authorization": "Bearer token"}
    ).json()
    
    assert order["status"] == "paid"
    
    # 4. 验证库存扣减
    product = requests.get("https://api.example.com/products/123").json()
    assert product["stock"] == initial_stock - 1

import pytest

@pytest.fixture(scope="function")
def test_user():
    """创建测试用户"""
    response = requests.post("https://api.example.com/register", json={
        "username": f"testuser_{uuid.uuid4()}",
        "email": f"test_{uuid.uuid4()}@example.com",
        "password": "password123"
    })
    
    user = response.json()
    yield user
    
    # 测试结束后删除用户
    requests.delete(
        f"https://api.example.com/users/{user['user_id']}",
        headers={"Authorization": f"Bearer {user['token']}"}
    )

def test_create_order(test_user):
    """测试创建订单"""
    response = requests.post("https://api.example.com/orders", json={
        "product_id": 123,
        "quantity": 1
    }, headers={"Authorization": f"Bearer {test_user['token']}"})
    
    assert response.status_code == 201

# 使用 Mock 模拟第三方服务
from unittest.mock import patch, Mock

@patch('payment_service.wechat_pay')
def test_wechat_payment(mock_wechat_pay):
    """测试微信支付"""
    # 模拟微信支付成功
    mock_wechat_pay.return_value = {
        "success": True,
        "transaction_id": "wx123456789"
    }
    
    response = requests.post("https://api.example.com/orders/123/pay", json={
        "payment_method": "wechat"
    }, headers={"Authorization": "Bearer token"})
    
    assert response.status_code == 200
    assert response.json()["payment_status"] == "success"

# 测试多个 API 版本
@pytest.mark.parametrize("version", ["v1", "v2", "v3"])
def test_get_products_all_versions(version):
    """测试所有版本的获取商品 API"""
    response = requests.get(f"https://api.example.com/{version}/products")
    
    assert response.status_code == 200
    assert "products" in response.json()
    
    # v1 和 v2 返回数组，v3 返回对象
    if version in ["v1", "v2"]:
        assert isinstance(response.json()["products"], list)
    else:
        assert isinstance(response.json()["products"], dict)