ljwx-health/ljwx-boot/scripts/test-data-factory/recipes/device_binding_v2_test.yaml

# Test Data Factory Recipe - Device Binding V2 API Test
# Version: v2.0
# Purpose: Test Phase 0-3 device binding flow with signature verification
# Use case: E2E validation of device binding approval workflow

version: v2
name: "device-binding-v2-test"

# Run configuration
run:
  customer_id: 5                    # Tenant ID
  run_tag: "device-binding-v2"      # Run tag for traceability
  timezone: "Asia/Shanghai"         # Timezone for timestamps
  org_id: 10                        # Default organization ID

# Test scenario configuration
scenario:
  name: "Device Binding V2 Flow Test"
  description: "Test complete device binding flow with signature verification, approval, and unbind"

  # Test data
  test_users:
    - user_id: 100
      user_name: "test_user_001"
      org_id: 10
    - user_id: 101
      user_name: "test_user_002"
      org_id: 10
    - user_id: 102
      user_name: "test_user_003"
      org_id: 10

  test_devices:
    - device_sn: "CRFTQ000000001"
      device_model: "HUAWEI WATCH GT 4"
      device_brand: "HUAWEI"
      device_secret: "test_secret_001"  # For HMAC-SHA256 signature
    - device_sn: "CRFTQ000000002"
      device_model: "HUAWEI WATCH GT 4"
      device_brand: "HUAWEI"
      device_secret: "test_secret_002"
    - device_sn: "CRFTQ000000003"
      device_model: "HUAWEI WATCH GT 4"
      device_brand: "HUAWEI"
      device_secret: "test_secret_003"

# Test cases
test_cases:
  # P0-1: Request Binding with Signature Verification
  - id: "TC001"
    name: "Request Device Binding with Valid Signature"
    description: "Test P0-1: Request binding with HMAC-SHA256 signature verification"
    steps:
      - action: "get_challenge"
        api: "device_binding_v2.get_challenge"
        params:
          deviceSn: "CRFTQ000000001"
        save_response:
          challenge: "data.challenge"

      - action: "calculate_signature"
        description: "Calculate HMAC-SHA256(deviceSecret, challenge + deviceSn)"
        # signature = HMAC-SHA256("test_secret_001", challenge + "CRFTQ000000001")

      - action: "request_binding"
        api: "device_binding_v2.request_binding"
        params:
          deviceSn: "CRFTQ000000001"
          challenge: "${challenge}"
          signature: "${calculated_signature}"
          userId: 100
        save_response:
          request_id: "data.requestId"
          approval_id: "data.approvalId"
        assertions:
          - "response.code == 200"
          - "response.data.status == 'PENDING'"

  # P1-1: Query Approval Status
  - id: "TC002"
    name: "Query Binding Approval Status"
    description: "Test P1-1: Query approval status with exponential backoff"
    steps:
      - action: "query_status"
        api: "device_binding_v2.query_status"
        params:
          requestId: "${request_id}"
        assertions:
          - "response.code == 200"
          - "response.data.status in ['PENDING', 'APPROVED', 'REJECTED']"

  # P1-2: Approve Binding
  - id: "TC003"
    name: "Approve Device Binding"
    description: "Test P1-2: Admin approves device binding request"
    steps:
      - action: "approve"
        api: "device_binding_v2.approve"
        params:
          approvalId: "${approval_id}"
          comments: "Approved for testing"
        save_response:
          bind_id: "data.bindId"
        assertions:
          - "response.code == 200"
          - "response.data.success == true"

  # P1-2: Reject Binding
  - id: "TC004"
    name: "Reject Device Binding"
    description: "Test P1-2: Admin rejects device binding request"
    setup:
      - action: "request_binding"
        api: "device_binding_v2.request_binding"
        params:
          deviceSn: "CRFTQ000000002"
          userId: 101
        save_response:
          approval_id_2: "data.approvalId"
    steps:
      - action: "reject"
        api: "device_binding_v2.reject"
        params:
          approvalId: "${approval_id_2}"
          reason: "Device not authorized for this user"
        assertions:
          - "response.code == 200"
          - "response.data.success == true"

  # P2-1: Batch Approve
  - id: "TC005"
    name: "Batch Approve Multiple Bindings"
    description: "Test P2-1: Batch approve 3 device binding requests"
    setup:
      - action: "request_multiple_bindings"
        description: "Create 3 pending approval requests"
        save_response:
          approval_ids: "data.approvalIds"  # Array of approval IDs
    steps:
      - action: "batch_approve"
        api: "device_binding_v2.batch_approve"
        params:
          approvalIds: "${approval_ids}"
          comments: "Batch approved for testing"
        assertions:
          - "response.code == 200"
          - "response.data.successCount == 3"
          - "response.data.failedCount == 0"

  # P3-3: Batch Approve with Confirm Token
  - id: "TC006"
    name: "Batch Approve with Confirm Token"
    description: "Test P3-3: Two-step batch approval with confirm token"
    setup:
      - action: "request_multiple_bindings"
        description: "Create 2 pending approval requests"
        save_response:
          approval_ids_batch: "data.approvalIds"
    steps:
      - action: "generate_confirm_token"
        api: "device_binding_v2.generate_confirm_token"
        params:
          approvalIds: "${approval_ids_batch}"
        save_response:
          confirm_token: "data.confirmToken"
        assertions:
          - "response.code == 200"
          - "response.data.expiresIn == 300"

      - action: "batch_approve_with_confirm"
        api: "device_binding_v2.batch_approve_with_confirm"
        params:
          approvalIds: "${approval_ids_batch}"
          actionType: "APPROVE"
          comments: "Confirmed batch approval"
          confirmToken: "${confirm_token}"
        assertions:
          - "response.code == 200"
          - "response.data.successCount == 2"

  # P2-2: User Self-Unbind
  - id: "TC007"
    name: "User Self-Unbind Device"
    description: "Test P2-2: User unbinds their own device"
    steps:
      - action: "user_unbind"
        api: "device_binding_v2.user_unbind"
        params:
          deviceSn: "CRFTQ000000001"
          reason: "Switching to new device"
        assertions:
          - "response.code == 200"
          - "response.data.success == true"

  # P2-2: Admin Force Unbind
  - id: "TC008"
    name: "Admin Force Unbind Device"
    description: "Test P2-2: Admin force unbinds device from user"
    steps:
      - action: "admin_force_unbind"
        api: "device_binding_v2.admin_force_unbind"
        params:
          deviceSn: "CRFTQ000000002"
          reason: "Device reported lost"
          notifyUser: true
        assertions:
          - "response.code == 200"
          - "response.data.success == true"

  # P3-2: SSE Event Stream (Manual Test)
  - id: "TC009"
    name: "SSE Real-time Event Stream"
    description: "Test P3-2: Verify SSE connection and event delivery"
    manual: true
    notes: |
      This test requires manual verification:
      1. Open SSE connection: GET /api/v2/device/bind-events/stream
      2. Request a device binding in another session
      3. Verify event received: binding_status_change
      4. Approve the binding
      5. Verify event received: approval_result
      6. Connection should auto-reconnect on disconnect

# Expected results
expected_results:
  total_test_cases: 9
  automated_tests: 8
  manual_tests: 1
  critical_paths:
    - "Request → Query → Approve → Unbind"
    - "Request → Reject"
    - "Batch Approve"
    - "Batch Approve with Confirm Token"

# Performance benchmarks
performance:
  request_binding_p95: "< 200ms"
  query_status_p95: "< 100ms"
  approve_p95: "< 150ms"
  batch_approve_p95: "< 500ms"
  sse_connection_timeout: "30 minutes"
  sse_event_latency: "< 100ms"

# Notes
notes: |
  - All tests require valid SaToken authentication
  - Device secrets must be pre-configured in device key service
  - Confirm tokens expire after 5 minutes
  - SSE connections timeout after 30 minutes
  - Use exponential backoff for status polling (10s → 120s)