@@ -48,36 +48,3 @@ there's a lot of the state space you just can't explore without context: modern
48full of pointer-like structures, whether they're URLs or database
48full of pointer-like structures, whether they're URLs or database
49keys/uuids, and servant-quickcheck requires that you be able to generate
49keys/uuids, and servant-quickcheck requires that you be able to generate
50these without context via Arbitrary.
50these without context via Arbitrary.
54−- add some "starter" values to the store
55− - there may be a JWT that's established outside the servant app, for instance.
56−- `class Extras a where extras :: Gen [a]`
57− - default implementation `pure []`
58− - selectively allow some types to create values we haven't seen from the api.
59− `newtype FirstName = FirstName Text`, say.
60−- break down each response type into its components
62− - `data Foo = FBar Bar | FBaz Baz`
63− - an endpoint `foo` that returns a `Foo`
64− - and an endpoint `bar` that takes a `Bar`
65− - I should be able to call `foo` to get a `Foo`, and if it happens to be an `FBar Bar`, I
66− should be able to use that `Bar` to call `bar`.
67−- better handling of properties to be verified
68− - some properties should always hold (no 500s): this already works.
69− - to-do: there may be some other properties that hold contextually
70− - healthcheck should be 200
71− - test complex permissions/ownership/delegation logic - should never be able to
72− get access to something you don't own or haven't been delegated access to.
74−## other possible applications
77− - if you run the checker for a while and `hpc` suggests you still have bad coverage,
78− your api is designed in a way that requires external manipulation and may be improvable.
81− - we can generate "big-enough" call sequences, then save the database & a sample call for each
82− endpoint that takes long enough to be a reasonable test.
83− - from this we can generate tests that a given call on that setup never gets slower.