Skip to main content

Leave API Testing Guide

Summary​

Testing should separate direct contracts, compatibility routing, dependencies, Workflow behavior, consumers, and negative/security boundaries using synthetic tenant-isolated data.

Audience​

QA, developers, architects, security reviewers, and release engineers.

Overview​

Source-confirmed scenarios​

  • Requests: valid create; reversed dates; pre-joining date; zero effective days; missing employee/tenant; Attendance conflict; approved-Leave overlap.
  • Decisions: direct approval; rejection with/without reason; terminal-state transition; approval-time Attendance conflict; workflow-managed direct decision blocked.
  • Cancellation: Pending self-cancel on compatibility surface; authorized Approved cancellation; balance reversal; invalid/unauthorized scope.
  • Balances: list, save, delete, missing record, normalized negative components, and current lack of sufficiency enforcement.
  • Types/policies: type upsert/list, active/paid/half-day/carry-forward metadata, policy list, exclusions, and stored-but-unenforced fields.
  • Calendar: Holiday CRUD, weekly-off read/replace, absence of date-range filtering, and Attendance ownership overlap.
  • Workflow: start, approve/reject completion, duplicate callback, state mismatch, managed restriction, dependency failure.
  • Routing: direct, compatibility, shadow, cutover ownership, rollback, and ESS composition.

Test layers​

Contract tests validate exact methods/routes/DTOs/status bodies. Application integration tests exercise validation and state/balance transitions. Gateway tests verify ownership without duplicating service tests. Dependency tests isolate Attendance and Workflow behavior. Consumer tests cover outbox-to-Payroll/Notification separately. Negative/security tests verify tenant isolation, missing identity, self/team/admin scope, and trusted callback boundaries.

The existing smoke script covers direct/compatibility lifecycles, Attendance conflict, Employee sync, optional Workflow, and routing modes. No formal Leave-specific .NET test project was found. Never run mutation tests against production.

Source References​

  • microservices/scripts/smoke-leave.ps1
  • microservices/src/leave-service/Api/LeaveEndpoints.cs
  • microservices/src/leave-service/Application/LeaveWorkflows.cs

See Also​

Keywords​

  • Leave API
  • Leave API Testing Guide
  • Integration

Revision Information​

  • Status: Draft
  • Last reviewed: 2026-07-15
  • Review cycle: Quarterly