1.3 KiB
Contract Testing
Fixtures cover HTTP responses, authenticated WebSocket events, errors, permissions, version negotiation, reconnects, and server-owned state transitions. Fixtures are deterministic, synthetic, and secret-free. Every new contract must include at least one valid fixture and a negative case where validation rules are important.
The current realtime envelope is deliberately transport-neutral: the server may
deliver it over an authenticated WebSocket or a future compatible transport, but
the event identity and payload rules remain the same. event_id is the stable
deduplication key for at-least-once delivery.
Browser clients authenticate the WebSocket with the first text frame described
by realtime-auth-frame.json. Session tokens are sent in that frame rather
than in a URL query parameter. The server closes the connection when the frame
is missing, malformed, or invalid, and sends connection.ready only after
successful validation.
The restored-session contract has Draft 2020-12 validation for both credential replacement states, missing fields, wrong types, and unexpected properties:
uv run --with jsonschema==4.26.0 python tests/session_contract.py
This isolated validation dependency is tooling only, not an application dependency.