Back to Repositories

Testing Document Verification API Endpoints in DocuSeal

This test suite validates the Tools API functionality in a DocuSeal application, focusing on document verification endpoints and secure file handling. The tests ensure proper authentication, file processing, and cryptographic verification of documents.

Test Coverage Overview

The test suite provides comprehensive coverage of the Tools API verification endpoint, specifically focusing on document authentication and checksum validation.

Tests document verification workflow
Validates checksum verification process
Covers file upload and processing
Tests authentication token handling

Implementation Analysis

The implementation uses RSpec request specs to test the API endpoints, incorporating factory-based test data generation and secure certificate handling. The testing approach utilizes Rails’ ActiveStorage for file handling and includes cryptographic verification of document integrity.

Uses factory_bot for test data generation
Implements ActiveStorage for file management
Incorporates SHA256 digest verification

Technical Details

The test suite leverages several key technical components:

RSpec request testing framework
ActiveStorage for file handling
Base64 encoding for file transfer
SHA256 for cryptographic verification
JWT-based authentication tokens

Best Practices Demonstrated

The test implementation showcases several testing best practices including proper setup of test data, isolation of test cases, and comprehensive verification of API responses.

Isolated test environment setup
Proper test data cleanup
Comprehensive assertion checking
Clear test case organization

docusealco/docuseal

spec/requests/tools_spec.rb

            
# frozen_string_literal: true

require 'rails_helper'

describe 'Tools API', type: :request do
  let(:account) { create(:account) }
  let(:author) { create(:user, account:) }
  let(:file_path) { Rails.root.join('spec/fixtures/sample-document.pdf') }

  before do
    create(:encrypted_config, key: EncryptedConfig::ESIGN_CERTS_KEY,
                              value: GenerateCertificate.call.transform_values(&:to_pem))
  end

  describe 'POST /api/tools/verify' do
    it 'returns a verification result' do
      template = create(:template, account:, author:)
      submission = create(:submission, :with_submitters, :with_events, template:, created_by_user: author)
      blob = ActiveStorage::Blob.create_and_upload!(
        io: file_path.open,
        filename: 'sample-document.pdf',
        content_type: 'application/pdf'
      )
      create(:completed_document, submitter: submission.submitters.first,
                                  sha256: Base64.urlsafe_encode64(Digest::SHA256.digest(blob.download)))

      ActiveStorage::Attachment.create!(
        blob:,
        name: :documents,
        record: submission.submitters.first
      )

      post '/api/tools/verify', headers: { 'x-auth-token': author.access_token.token }, params: {
        file: Base64.encode64(File.read(file_path))
      }.to_json

      expect(response).to have_http_status(:ok)
      expect(response.parsed_body['checksum_status']).to eq('verified')
    end
  end
end