Incident Acknowledgement API — QA Automation

Tests + mock server for the F24 Incident Acknowledgement API. Covers business rules, edge cases, and spec gaps.

Quick Start

pip install -r requirements.txt
python src/mock_server.py          # runs on :4000

# in another terminal
pytest tests/ -v                   # 24 tests passing (1 skipped — idempotency is a spec gap)

What's Here

File	What it does
tests/	24 pytest tests + 1 skipped across 7 files
src/mock_server.py	Flask server that simulates the API
openapi.yaml	The OpenAPI spec from the assignment
TEST_STRATEGY.md	Test priorities, CI breakdown
FINDINGS.md	Spec gaps and issues I found
test_happy_path.py	OPEN and IN_PROGRESS succeed
test_state_transitions.py	RESOLVED, CANCELLED, ACKNOWLEDGED → 409
test_validation.py	Comment boundaries, invalid ID format
test_auth_tenant.py	Missing/invalid auth, tenant mismatch
test_idempotency.py	Skipped — not in OpenAPI spec (documented gap)
test_audit.py	Audit events for success and failure
test_spec.py	Spec validity, schema compliance

How the Mock Server Works

The mock strictly follows the OpenAPI spec (openapi.yaml) — it only implements behavior described in the spec.

• OPEN and IN_PROGRESS incidents → can be acknowledged
• RESOLVED, CANCELLED, ACKNOWLEDGED → get 409 (INVALID_STATE_TRANSITION)
• Auth via Bearer token, tenant isolation via X-Tenant-Id header
• Comments max 500 chars (422 if exceeded)
• Successful acknowledgements return an audit event (per the response schema)
• Every attempt is audit logged (accessible via GET /.../audit-log)

Assumptions I Made

1. X-Tenant-Id is validated server-side against the user's real tenant (the spec doesn't specify how this works)
2. Audit log is chronological, newest last
3. The mock behaves like the real API would — see FINDINGS.md for where the spec is vague

Limitations

• Mock is single-threaded (no concurrency tests)
• No persistence — state resets on restart
• Auth is hardcoded tokens, not real JWT
• Tests reset mock state before each run (clean slate per test)