API Testing with Postman and Newman from CI/CD
Tags: webdev, testing, devops, graphql
Published: 2021-12-06 08:50:47

I`ll show you how to use **Postman** to test protected GraphQL API and run test collection using **Newman** from GithubActions!

>**Note:** This article is part of [opensource fullstack app](https://github.com/damikun/trouble-training)

## Postman as GraphQL IDE?

[Postman](https://www.postman.com/) is a well-known tool that helps you test your APIs.

Postman supports:
- REST
- WebSockets
- GraphQL

**Not yet**, but I see the possibility of it becoming a powerfool tool for GraphQL.

## Import GraphQL SDL

This has to be done manually! (Unfortunately) Postman does not support schema introspection.

![Postman copy SDL schema](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hiqfs7km9dk86pj7ijlv.png)

## Pre-requests scripts

The `Pre-Request` and `Tests` can be found in several scopes. 

![Postman tets vs script](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zt8f1omp5brxqdasleyy.png)

**Scope is just place, where you can find them**. 
- Scope level Collection
- Section level Folder
- Scope level Request

## Is there a initial script?

Postman does **not** have *init* script that runs once on startup! You can workaround this and implement it using variables!

![Postman init scsript](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/osp5801rcqqzzgqtk4yd.png)

## How to sign-in with OAuth?

This depends on whether you are doing the tests manually or automated

If you run heedless from `CI/CD` you need to write scripts and that can be difficult with some `oidc` providers who have strict rules and check all security aspects. 

For testing purposes, you can define a specific oidc `client_id:Postman`. You can simply protect it with `ResourceOwnerPassword` and create a test user for it.

![Oauth grant flow](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4tw7kqq2av4ix1eq5i0d.png) Image from [Okta](developer.okta.com)

The `ResourceOwnerPassword` is fully secured in this scenario:
- You have a special client (oidc client) and you need `Secret` to use it.
- The test user still needs to provide his `name` and `password`.
- Will only be activated under a specific flag
- Will not be used publicly
- Can be restricted to a specific origin

## Request access token
To request a new token, you must make an `asynchronous` call to the oidc token endpoint.

![Logical Flow](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mbiqhmiprxgjqxmddbik.png)

![Requesting token using password resource owner](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8juk9gh96qjsp70ky1hf.png)

`Pre-scripts`:

1) Check if you have the token from the previous run 
2) Validate the lifetime of the token.
 - Token is valid - > uses the existing one 
 - Token has expired - > requests a new one

![Postman async helper](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/i1ypss6dyyzqo3ssano8.png)

The `OAuth_Token_Exchange` triggers the request with the function `pm.sendRequest(...)`.

![Postman request access token from oidc](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/x9u1x3g3t3q9e9rtpsee.png)

## Validation of the GraphQL response

GraphQL returns `json` and you need to create a helper script to validate it. This script validates property by property with the option to ignore some.

![Validate GraphQL response](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/yzo47biaqlhp4x0z9if3.png)

## Export test collection

For that you need to export the collection and the variables and use exported data in headless `ci/cd` runner.

*Export collection:*
![Export postman collection](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/u75w8h1egan1lo0ybb3w.png)

*Export enviroment:*
![Export postman enviroment](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9i8pdbkdezv8zjhfafx4.png)

## Newman headless runner

Newman is CLI runner for postman collections. You can find it on [Github](https://github.com/postmanlabs/newman).

Install with: `npm install -g newman`.

Run test collection from console (terminal):

![Export postman enviroment](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fuh7aujxmj36t54l53aw.png)

(We use the `--insecure` flag because we use untrusted developer certificates).

This is an example of the output

![Export postman enviroment](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gmznt9cbbn8i804vsc21.png)

## Integration in Build and CI/CD

The demo application uses `Nuke` for build automation.

Nuke is a console application that contains all build logic defined as `Targets` and allows you to run cross-platform and generate `.yaml` for `CI/CD` pipelines.

Let us place `Newman` in front of the `Cypress` tests.

![E2E example](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pkjqaxo4cqmxd2c0wyoj.png)

To better understand what `Target_E2E_Tests` is. Let us take a look at the whole pipeline and the dependencies between the different targets.

Targets define named operation with specific actions.

![Nuke build plan](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zv9cj3khpkgmke69vwoh.png)

## Github-Action run:

![Nuke build plan](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4wxy9cjcxiknxbgs352d.png)

## Repository
You can find the full source code of the app, including identity, distributed logging, tracing and monitoring, in the open source 

Github repo:
https://github.com/damikun/trouble-training

Newman sources sub-link (under postman folder):
https://github.com/damikun/trouble-training/tree/main/Src/Tests