Release 3.7.0 (#196)

README.md

@@ -5,10 +5,10 @@
 
 ## What's New? ##
 
-  * The latest version ([Tcases 3.6.3](ReleaseNotes.md#363)) is now available at the Maven Central Repository.
+  * The latest version ([Tcases 3.7.0](ReleaseNotes.md#370)) is now available at the Maven Central Repository.
     See [*How To Download Tcases*](HowToDownload.md) for download instructions.
 
-  * Tcases 3.6.3 provides improvements to Tcases for OpenAPI. See the [release notes](ReleaseNotes.md#363) for details.
+  * Tcases 3.7.0 provides improvements to Tcases for OpenAPI. See the [release notes](ReleaseNotes.md#370) for details.
 
   * Having trouble with Tcases? Check out [these tips](./Troubleshooting-FAQs.md).
 

ReleaseNotes.md

@@ -1,5 +1,21 @@
 # Release Notes #
 
+## 3.7.0 ##
+
+This release provides the following improvements to Tcases for OpenAPI.
+
+  * **Generated tests support request authorization** [[115](https://github.com/Cornutum/tcases/issues/115)]
+
+    Tcases for OpenAPI now handles information in OpenAPI definitions about the [security
+    schemes](https://spec.openapis.org/oas/v3.0.2#security-scheme-object) required by API requests. Some types of security
+    schemes are not yet supported -- see [*OpenAPI tips*](tcases-openapi/README.md#openapi-tips) for details.
+
+    Because security requirements are now included in generated input models and request test definitions, the
+    `RestAssuredTestCaseWriter` can create tests that apply the required authorization credentials to request invocations. Note
+    that values for authorization credentials do not appear in the OpenAPI definition and must be injected at runtime when
+    generated tests execute. See [*Define credentials for request authorization*](tcases-openapi/Running-Api-Test-Cases.md#define-credentials-for-request-authorization)
+    for details.
+
 ## 3.6.3 ##
 
 This release provides the following improvements to Tcases for OpenAPI.

pom.xml

@@ -7,7 +7,7 @@
   <groupId>org.cornutum.tcases</groupId>
   <artifactId>tcases</artifactId>
   <packaging>pom</packaging>
-  <version>3.7.0-SNAPSHOT</version>
+  <version>3.7.0</version>
 
   <name>Tcases</name>
   <description>Generates test cases from system input space models</description>

tcases-ant/pom.xml

@@ -7,7 +7,7 @@
   <parent>
     <groupId>org.cornutum.tcases</groupId>
     <artifactId>tcases</artifactId>
-    <version>3.7.0-SNAPSHOT</version>
+    <version>3.7.0</version>
   </parent>
 
   <artifactId>tcases-ant</artifactId>

tcases-cli/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.cornutum.tcases</groupId>
         <artifactId>tcases</artifactId>
-        <version>3.7.0-SNAPSHOT</version>
+        <version>3.7.0</version>
     </parent>
 
     <artifactId>tcases-cli</artifactId>

tcases-io/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.cornutum.tcases</groupId>
         <artifactId>tcases</artifactId>
-        <version>3.7.0-SNAPSHOT</version>
+        <version>3.7.0</version>
     </parent>
 
     <artifactId>tcases-io</artifactId>

tcases-lib/pom.xml

@@ -7,7 +7,7 @@
   <parent>
     <groupId>org.cornutum.tcases</groupId>
     <artifactId>tcases</artifactId>
-    <version>3.7.0-SNAPSHOT</version>
+    <version>3.7.0</version>
   </parent>
 
   <artifactId>tcases-lib</artifactId>

tcases-maven-plugin/pom.xml

@@ -7,7 +7,7 @@
   <parent>
     <groupId>org.cornutum.tcases</groupId>
     <artifactId>tcases</artifactId>
-    <version>3.7.0-SNAPSHOT</version>
+    <version>3.7.0</version>
   </parent>
 
   <artifactId>tcases-maven-plugin</artifactId>

tcases-moco/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.cornutum.tcases</groupId>
         <artifactId>tcases</artifactId>
-        <version>3.7.0-SNAPSHOT</version>
+        <version>3.7.0</version>
     </parent>
 
     <artifactId>tcases-moco</artifactId>

tcases-openapi/README.md

@@ -166,7 +166,7 @@ execute all API requests against an actual API server, applying a comprehensive
 the expected responses. Bam! Job done!
 
 But is this even possible? Yes, it is -- mostly.
-For details, see [*Running API Test Cases*](Running-Api-Test-Cases.md).
+For details, see [*Running API Test Cases*](Running-Api-Test-Cases.md#running-api-test-cases).
 
 
 ## Why Tcases for OpenAPI? ##
@@ -438,7 +438,13 @@ for Tcases for OpenAPI.
 
 To use Tcases for OpenAPI effectively, there are some things to keep in mind when you're building your OpenAPI definition.
 
-  1. **Use Version 3.** Tcases for OpenAPI is based on the specification for [OpenAPI Version 3.0.2](https://swagger.io/specification/). Earlier Version 2.X specs are not supported.
+  1. **Use Version 3.** Tcases for OpenAPI is based on the specification for [OpenAPI Version 3.0.2](https://spec.openapis.org/oas/v3.0.2). Earlier Version 2.X specs are not supported.
+
+  1. **Some security schemes not supported.** Tcases for OpenAPI currently supports the following request [security schemes](https://spec.openapis.org/oas/v3.0.2#security-scheme-object) -- other schemes are ignored.
+
+     * API key
+     * HTTP Basic authentication
+     * HTTP Bearer authentication
 
   1. **Avoid type-ambiguous schemas.** A schema that does not define a `type` keyword can validate multiple types of instances. But Tcases for OpenAPI expects you to be more explicit about which instance types are valid. Here's how to do that.
 

tcases-openapi/Request-Test-Definition.md

@@ -29,7 +29,9 @@ A `RequestCase` object defines the inputs for a test case that invokes a specifi
 | version       | string |                  | The version of the OpenAPI definition that defines this request |
 | parameters    | \[[`ParamData`](#paramdata)\] |     | The parameter values for this request |
 | body          | [`MessageData`](#messagedata) |   | The body value for this request |
+| auth          |\[[`AuthDef`](#authDef)\] |   | The authentication inputs required to authorize this request |
 | invalidInput  | string |                  | If defined, a failure response is expected for this request and this string describes the invalid input |
+| authFailure   | boolean |                 | If true, an authorization failure is expected for this request |
 
 ## `ParamData` ##
 
@@ -62,3 +64,35 @@ A `DataValue` object specifies the type, format, and value of a request input da
 | type          | string  | :registered:    | The type of this data value |
 | value         | JSON value | :registered: | The JSON representation of this data value |
 | format        | string |                  | The format of this data value |
+
+## `AuthDef` ##
+
+An `AuthDef` object describes a required authentication input: one of [`ApiKeyDef`](#apiKeyDef), [`HttpBasicDef`](#httpBasicDef), or [`HttpBearerDef`](#httpBearerDef).
+
+## `ApiKeyDef` ##
+
+An `ApiKeyDef` object specifies that an API key is required to authorize the request.
+
+| Field         | Type |                            | Description |
+| ---           | ---  | ---                        | ---         |
+| type          | string  | :registered:            | "apiKey" |
+| location      | string | :registered:             | The location of the key value |
+| name          | string | :registered:             | The name of this key value |
+
+## `HttpBasicDef` ##
+
+An `HttpBasicDef` object specifies that an HTTP Basic authorization header is required.
+
+| Field         | Type |                            | Description |
+| ---           | ---  | ---                        | ---         |
+| type          | string | :registered:             | "http" |
+| scheme        | string | :registered:             | "basic" |
+
+## `HttpBearerDef` ##
+
+An `HttpBearerDef` object specifies that an HTTP Bearer authorization header is required.
+
+| Field         | Type |                            | Description |
+| ---           | ---  | ---                        | ---         |
+| type          | string | :registered:             | "http" |
+| scheme        | string | :registered:             | "bearer" |

tcases-openapi/Running-Api-Test-Cases.md

@@ -13,7 +13,8 @@
     - [Example: Create tests from examples](#example-create-tests-from-examples)
     - [Understanding the TestWriter API](#understanding-the-testwriter-api)    
   - [Running generated tests](#running-generated-tests)
-    - [Override the default API server](#override-the-default-api-server)    
+    - [Override the default API server](#override-the-default-api-server)
+    - [Define credentials for request authorization](#define-credentials-for-request-authorization)
   - [Generating request inputs](#generating-request-inputs)
     - [Instead of input descriptions...](#instead-of-input-descriptions)
     - [Get actual input values...](#get-actual-input-values)
@@ -343,6 +344,37 @@ be defined in the `mvn` command. This setting overrides any API server specified
 mvn test -Dtest=SwaggerPetstoreTest -DtcasesApiServer=http://localhost
 ```
 
+### Define credentials for request authorization ###
+
+Execution of API requests may be subject to security requirements specified in the OpenAPI definition. To satisfy such requirements, you
+must define the necessary authorization credentials when you run the tests.
+
+For Java tests, authorization credentials are defined using Java system properties. These settings can
+be defined in the `java` command that you run, either directly or via your IDE. Similarly, if you run tests using Maven, these settings can
+be defined in the `mvn` command.
+
+Depending on the security scheme, different settings are required. The following security schemes are supported.
+
+  * API key
+
+    ```
+    # Run the 'SwaggerPetstoreTest', using an API key to authenticate test requests.
+    mvn test -Dtest=SwaggerPetstoreTest -DtcasesApiKey=F81D4FAE-7DEC-11D0-A765-00A0C91E6BF6
+    ```
+
+  * HTTP Basic authentication
+
+    ```
+    # Run the 'SwaggerPetstoreTest', using a user id and password to authenticate test requests.
+    mvn test -Dtest=SwaggerPetstoreTest -DtcasesApiUser=myUserId -DtcasesApiPassword=myLittleSecret
+    ```
+
+  * HTTP Bearer authentication
+
+    ```
+    # Run the 'SwaggerPetstoreTest', using a bearer token to authenticate test requests.
+    mvn test -Dtest=SwaggerPetstoreTest -DtcasesApiBearer=eyJ0eXAi.eyJtZXNz.-yIVBD5b
+    ```
 
 ## Generating request inputs ##
 

tcases-openapi/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.cornutum.tcases</groupId>
         <artifactId>tcases</artifactId>
-        <version>3.7.0-SNAPSHOT</version>
+        <version>3.7.0</version>
     </parent>
 
     <artifactId>tcases-openapi</artifactId>
@@ -63,7 +63,7 @@
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <project.build.date>${maven.build.timestamp}</project.build.date>
         <maven.build.timestamp.format>yyyy-MM-dd</maven.build.timestamp.format>
-        <tcases.maven.version>3.5.0</tcases.maven.version>
+        <tcases.maven.version>3.7.0</tcases.maven.version>
     </properties>
 
     <build>

tcases-rest-assured/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.cornutum.tcases</groupId>
         <artifactId>tcases</artifactId>
-        <version>3.7.0-SNAPSHOT</version>
+        <version>3.7.0</version>
     </parent>
 
     <artifactId>tcases-rest-assured</artifactId>

tcases-shell/pom.xml

@@ -7,7 +7,7 @@
   <parent>
     <groupId>org.cornutum.tcases</groupId>
     <artifactId>tcases</artifactId>
-    <version>3.7.0-SNAPSHOT</version>
+    <version>3.7.0</version>
   </parent>
 
   <artifactId>tcases-shell</artifactId>