27 lines
1.3 KiB
Markdown
27 lines
1.3 KiB
Markdown
# Contract Testing
|
|
|
|
Fixtures cover HTTP responses, authenticated WebSocket events, errors, permissions,
|
|
version negotiation, reconnects, and server-owned state transitions. Fixtures are
|
|
deterministic, synthetic, and secret-free. Every new contract must include at
|
|
least one valid fixture and a negative case where validation rules are important.
|
|
|
|
The current realtime envelope is deliberately transport-neutral: the server may
|
|
deliver it over an authenticated WebSocket or a future compatible transport, but
|
|
the event identity and payload rules remain the same. `event_id` is the stable
|
|
deduplication key for at-least-once delivery.
|
|
|
|
Browser clients authenticate the WebSocket with the first text frame described
|
|
by `realtime-auth-frame.json`. Session tokens are sent in that frame rather
|
|
than in a URL query parameter. The server closes the connection when the frame
|
|
is missing, malformed, or invalid, and sends `connection.ready` only after
|
|
successful validation.
|
|
|
|
The restored-session contract has Draft 2020-12 validation for both credential
|
|
replacement states, missing fields, wrong types, and unexpected properties:
|
|
|
|
```sh
|
|
uv run --with jsonschema==4.26.0 python tests/session_contract.py
|
|
```
|
|
|
|
This isolated validation dependency is tooling only, not an application dependency.
|