测试工程师

# 测试工程师 (API Tester) > 专注于全面 API 验证、功能测试和质量保证的测试专家。 ## 📖 简介 **测试工程师**（代号 Leo）是一个智能 QA 测试 Agent，专为后端 API 和微服务系统的质量保障而设计。它覆盖功能正确性、性能基准和安全合规三大维度，通过自动化的测试框架和持续的监控体系，确保系统间可靠、高性能和安全的集成。 --- ## ✨ 核心能力 ### ✅ 功能测试 - 基于 OpenAPI/Swagger 规范的端点全覆盖测试 - Happy Path、Error Path、边界条件自动化验证 - 参数化测试矩阵（正常值、空值、越界值、特殊字符、注入用例） - 状态流转和业务链路集成测试 - 幂等性、分页、文件上传等专项测试 ### ⚡ 性能测试 - 并发负载测试（k6 / Artillery） - P50/P95/P99 响应时延基准测量 - 长时间持续负载与资源泄漏检测 - 突发流量弹性伸缩验证 - 大数据量场景下的查询与排序性能 ### 🔒 安全测试 - OWASP API Security Top 10 合规检查 - SQL 注入、XSS、命令注入输入验证 - 认证绕过与越权访问（IDOR）检测 - Token 过期与角色权限测试 - 速率限制与暴力破解防护验证 ### 📊 报告与监控 - HTML 格式测试报告（含失败详情与截图） - 测试覆盖率 API 矩阵 - 性能基准趋势图表 - 持续集成告警集成（Slack / Email） --- ## 🚀 快速开始 ### 前提条件 - Node.js 18+ - Playwright 测试框架 - 目标 API 的 OpenAPI 规范文件或端点文档 ### 安装 ```bash # 安装 Playwright npm install @playwright/test # 安装 k6（性能测试） brew install k6 ``` ### 基本用法 1. **配置测试目标**：在 `config/api-targets.json` 中定义被测 API 端点 2. **生成测试用例**：Agent 根据 OpenAPI 规范自动生成测试用例 3. **执行测试套件**： ```bash npx playwright test --config=playwright.config.ts ``` 4. **查看报告**： ```bash npx playwright show-report test-results/report ``` ### 示例：API 功能测试 ```typescript import { test, expect } from '@playwright/test'; const BASE_URL = 'https://api.example.com/v1'; test('GET /users - 返回用户列表', async ({ request }) => { const response = await request.get(`${BASE_URL}/users`, { headers: { 'Authorization': `Bearer ${process.env.API_TOKEN}` } }); expect(response.status()).toBe(200); const body = await response.json(); expect(Array.isArray(body.data)).toBeTruthy(); expect(body.pagination.total).toBeGreaterThan(0); }); test('POST /users - 创建用户（参数校验）', async ({ request }) => { // 缺少必填字段 const res = await request.post(`${BASE_URL}/users`, { data: { name: 'Leo' }, // 缺少 email headers: { 'Authorization': `Bearer ${process.env.API_TOKEN}` } }); expect(res.status()).toBe(422); const body = await res.json(); expect(body.errors).toContainEqual( expect.objectContaining({ field: 'email' }) ); }); ``` --- ## 🧪 测试策略 | 阶段 | 活动 | 工具/方法 | |------|------|-----------| | **API 发现** | 审查 OpenAPI 规范，识别端点与契约 | Swagger Editor, OpenAPI Diff | | **策略制定** | 设计测试矩阵，优先级排序 | 风险矩阵分析 | | **自动化实施** | 编写 Playwright 测试用例 | Playwright Test | | **性能验证** | 负载测试，基准对比 | k6, Artillery | | **安全审计** | OWASP 检查项逐一验证 | OWASP ZAP, 手动测试 | | **持续监控** | 冒烟测试，健康检查 | CI/CD Pipeline | --- ## 🏗️ 项目结构 ``` api-tester/ ├── agent.json # Agent 配置 ├── ROLE.md # 角色定义 ├── HEARTBEAT.md # 心跳与健康检查 ├── POLICIES.md # 策略与规则 ├── README.md # 本文件 ├── tests/ │ ├── functional/ # 功能测试用例 │ ├── performance/ # 性能测试脚本 │ └── security/ # 安全测试用例 ├── reports/ # 测试报告输出 ├── config/ │ ├── api-targets.json # API 端点配置 │ └── test-data.json # 测试数据集 └── scripts/ ├── run-all.sh # 全量测试执行脚本 └── smoke-test.sh # 冒烟测试脚本 ``` --- ## 🔗 集成 CI/CD **GitHub Actions 示例配置**： ```yaml name: API Tests on: [push, pull_request] jobs: test: runs-on: ubuntu-latest steps: - uses: actions/checkout@v3 - uses: actions/setup-node@v3 with: node-version: 18 - run: npm ci - run: npx playwright install --with-deps - run: npx playwright test - uses: actions/upload-artifact@v3 if: always() with: name: test-results path: test-results/ ``` --- ## 📋 质量门禁 | 指标 | 目标 | |------|------| | 功能测试通过率 | 100% | | P95 响应时间 | < 200ms | | 错误率 | < 0.1% | | API 测试覆盖率 | > 90% | | 高危安全漏洞 | 0 | --- ## ⚠️ 使用限制 - 本 Agent 专注于 API 层测试，不覆盖 UI 视觉回归 - 性能测试需在隔离的测试环境执行，避免影响生产 - 安全测试建议获得授权后进行，遵循负责任的披露原则 --- ## 📄 许可证 MIT License Copyright (c) 2024 Markus Builder Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. --- *基于 [agency-agents-zh](https://github.com/jnMetaCode/agency-agents-zh) (MIT License) 构建*