[PM-22263] [PM-29849] Initial PoC of seeder API (#6424)

We want to reduce the amount of business critical test data in the company. One way of doing that is to generate test data on demand prior to client side testing.

Clients will request a scene to be set up with a JSON body set of options, specific to a given scene. Successful seed requests will be responded to with a mangleMap which maps magic strings present in the request to the mangled, non-colliding versions inserted into the database. This way, the server is solely responsible for understanding uniqueness requirements in the database. scenes also are able to return custom data, depending on the scene. For example, user creation would benefit from a return value of the userId for further test setup on the client side.

Clients will indicate they are running tests by including a unique header, x-play-id which specifies a unique testing context. The server uses this PlayId as the seed for any mangling that occurs. This allows the client to decide it will reuse a given PlayId if the test context builds on top of previously executed tests. When a given context is no longer needed, the API user will delete all test data associated with the PlayId by calling a delete endpoint.

---------

Co-authored-by: Matt Gibson <mgibson@bitwarden.com>

test/SeederApi.IntegrationTest/HttpClientExtensions.cs

@@ -0,0 +1,40 @@
+using System.Diagnostics.CodeAnalysis;
+using System.Text.Json;
+
+namespace Bit.SeederApi.IntegrationTest;
+
+public static class HttpClientExtensions
+{
+    /// <summary>
+    /// Sends a POST request with JSON content and attaches the x-play-id header.
+    /// </summary>
+    /// <typeparam name="TValue">The type of the value to serialize.</typeparam>
+    /// <param name="client">The HTTP client.</param>
+    /// <param name="requestUri">The URI the request is sent to.</param>
+    /// <param name="value">The value to serialize.</param>
+    /// <param name="playId">The play ID to attach as x-play-id header.</param>
+    /// <param name="options">Options to control the behavior during serialization.</param>
+    /// <param name="cancellationToken">A cancellation token that can be used to cancel the operation.</param>
+    /// <returns>The task object representing the asynchronous operation.</returns>
+    public static Task<HttpResponseMessage> PostAsJsonAsync<TValue>(
+        this HttpClient client,
+        [StringSyntax(StringSyntaxAttribute.Uri)] string? requestUri,
+        TValue value,
+        string playId,
+        JsonSerializerOptions? options = null,
+        CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(client);
+
+        if (string.IsNullOrWhiteSpace(playId))
+        {
+            throw new ArgumentException("Play ID cannot be null or whitespace.", nameof(playId));
+        }
+
+        var content = JsonContent.Create(value, mediaType: null, options);
+        content.Headers.Remove("x-play-id");
+        content.Headers.Add("x-play-id", playId);
+
+        return client.PostAsync(requestUri, content, cancellationToken);
+    }
+}

test/SeederApi.IntegrationTest/QueryControllerTest.cs

@@ -0,0 +1,75 @@
+using System.Net;
+using Bit.SeederApi.Models.Request;
+using Xunit;
+
+namespace Bit.SeederApi.IntegrationTest;
+
+public class QueryControllerTests : IClassFixture<SeederApiApplicationFactory>, IAsyncLifetime
+{
+    private readonly HttpClient _client;
+    private readonly SeederApiApplicationFactory _factory;
+
+    public QueryControllerTests(SeederApiApplicationFactory factory)
+    {
+        _factory = factory;
+        _client = _factory.CreateClient();
+    }
+
+    public Task InitializeAsync()
+    {
+        return Task.CompletedTask;
+    }
+
+    public Task DisposeAsync()
+    {
+        _client.Dispose();
+        return Task.CompletedTask;
+    }
+
+    [Fact]
+    public async Task QueryEndpoint_WithValidQueryAndArguments_ReturnsOk()
+    {
+        var testEmail = $"emergency-test-{Guid.NewGuid()}@bitwarden.com";
+
+        var response = await _client.PostAsJsonAsync("/query", new QueryRequestModel
+        {
+            Template = "EmergencyAccessInviteQuery",
+            Arguments = System.Text.Json.JsonSerializer.SerializeToElement(new { email = testEmail })
+        });
+
+        response.EnsureSuccessStatusCode();
+        var result = await response.Content.ReadAsStringAsync();
+
+        Assert.NotNull(result);
+
+        var urls = System.Text.Json.JsonSerializer.Deserialize<List<string>>(result);
+        Assert.NotNull(urls);
+        // For a non-existent email, we expect an empty list
+        Assert.Empty(urls);
+    }
+
+    [Fact]
+    public async Task QueryEndpoint_WithInvalidQueryName_ReturnsNotFound()
+    {
+        var response = await _client.PostAsJsonAsync("/query", new QueryRequestModel
+        {
+            Template = "NonExistentQuery",
+            Arguments = System.Text.Json.JsonSerializer.SerializeToElement(new { email = "test@example.com" })
+        });
+
+        Assert.Equal(HttpStatusCode.NotFound, response.StatusCode);
+    }
+
+    [Fact]
+    public async Task QueryEndpoint_WithMissingRequiredField_ReturnsBadRequest()
+    {
+        // EmergencyAccessInviteQuery requires 'email' field
+        var response = await _client.PostAsJsonAsync("/query", new QueryRequestModel
+        {
+            Template = "EmergencyAccessInviteQuery",
+            Arguments = System.Text.Json.JsonSerializer.SerializeToElement(new { wrongField = "value" })
+        });
+
+        Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
+    }
+}

test/SeederApi.IntegrationTest/SeedControllerTest.cs

@@ -0,0 +1,222 @@
+using System.Net;
+using Bit.SeederApi.Models.Request;
+using Bit.SeederApi.Models.Response;
+using Xunit;
+
+namespace Bit.SeederApi.IntegrationTest;
+
+public class SeedControllerTests : IClassFixture<SeederApiApplicationFactory>, IAsyncLifetime
+{
+    private readonly HttpClient _client;
+    private readonly SeederApiApplicationFactory _factory;
+
+    public SeedControllerTests(SeederApiApplicationFactory factory)
+    {
+        _factory = factory;
+        _client = _factory.CreateClient();
+    }
+
+    public Task InitializeAsync()
+    {
+        return Task.CompletedTask;
+    }
+
+    public async Task DisposeAsync()
+    {
+        // Clean up any seeded data after each test
+        await _client.DeleteAsync("/seed");
+        _client.Dispose();
+    }
+
+    [Fact]
+    public async Task SeedEndpoint_WithValidScene_ReturnsOk()
+    {
+        var testEmail = $"seed-test-{Guid.NewGuid()}@bitwarden.com";
+        var playId = Guid.NewGuid().ToString();
+
+        var response = await _client.PostAsJsonAsync("/seed", new SeedRequestModel
+        {
+            Template = "SingleUserScene",
+            Arguments = System.Text.Json.JsonSerializer.SerializeToElement(new { email = testEmail })
+        }, playId);
+
+        response.EnsureSuccessStatusCode();
+        var result = await response.Content.ReadFromJsonAsync<SceneResponseModel>();
+
+        Assert.NotNull(result);
+        Assert.NotNull(result.MangleMap);
+        Assert.Null(result.Result);
+    }
+
+    [Fact]
+    public async Task SeedEndpoint_WithInvalidSceneName_ReturnsNotFound()
+    {
+        var response = await _client.PostAsJsonAsync("/seed", new SeedRequestModel
+        {
+            Template = "NonExistentScene",
+            Arguments = System.Text.Json.JsonSerializer.SerializeToElement(new { email = "test@example.com" })
+        });
+
+        Assert.Equal(HttpStatusCode.NotFound, response.StatusCode);
+    }
+
+    [Fact]
+    public async Task SeedEndpoint_WithMissingRequiredField_ReturnsBadRequest()
+    {
+        // SingleUserScene requires 'email' field
+        var response = await _client.PostAsJsonAsync("/seed", new SeedRequestModel
+        {
+            Template = "SingleUserScene",
+            Arguments = System.Text.Json.JsonSerializer.SerializeToElement(new { wrongField = "value" })
+        });
+
+        Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
+    }
+
+    [Fact]
+    public async Task DeleteEndpoint_WithValidPlayId_ReturnsOk()
+    {
+        var testEmail = $"delete-test-{Guid.NewGuid()}@bitwarden.com";
+        var playId = Guid.NewGuid().ToString();
+
+        var seedResponse = await _client.PostAsJsonAsync("/seed", new SeedRequestModel
+        {
+            Template = "SingleUserScene",
+            Arguments = System.Text.Json.JsonSerializer.SerializeToElement(new { email = testEmail })
+        }, playId);
+
+        seedResponse.EnsureSuccessStatusCode();
+        var seedResult = await seedResponse.Content.ReadFromJsonAsync<SceneResponseModel>();
+        Assert.NotNull(seedResult);
+
+        var deleteResponse = await _client.DeleteAsync($"/seed/{playId}");
+        deleteResponse.EnsureSuccessStatusCode();
+    }
+
+    [Fact]
+    public async Task DeleteEndpoint_WithInvalidPlayId_ReturnsOk()
+    {
+        // DestroyRecipe is idempotent - returns null for non-existent play IDs
+        var nonExistentPlayId = Guid.NewGuid().ToString();
+        var response = await _client.DeleteAsync($"/seed/{nonExistentPlayId}");
+
+        response.EnsureSuccessStatusCode();
+        var content = await response.Content.ReadAsStringAsync();
+        Assert.Equal($$"""{"playId":"{{nonExistentPlayId}}"}""", content);
+    }
+
+    [Fact]
+    public async Task DeleteBatchEndpoint_WithValidPlayIds_ReturnsOk()
+    {
+        // Create multiple seeds with different play IDs
+        var playIds = new List<string>();
+        for (var i = 0; i < 3; i++)
+        {
+            var playId = Guid.NewGuid().ToString();
+            playIds.Add(playId);
+
+            var testEmail = $"batch-test-{Guid.NewGuid()}@bitwarden.com";
+            var seedResponse = await _client.PostAsJsonAsync("/seed", new SeedRequestModel
+            {
+                Template = "SingleUserScene",
+                Arguments = System.Text.Json.JsonSerializer.SerializeToElement(new { email = testEmail })
+            }, playId);
+
+            seedResponse.EnsureSuccessStatusCode();
+            var seedResult = await seedResponse.Content.ReadFromJsonAsync<SceneResponseModel>();
+            Assert.NotNull(seedResult);
+        }
+
+        // Delete them in batch
+        var request = new HttpRequestMessage(HttpMethod.Delete, "/seed/batch")
+        {
+            Content = JsonContent.Create(playIds)
+        };
+        var deleteResponse = await _client.SendAsync(request);
+        deleteResponse.EnsureSuccessStatusCode();
+
+        var result = await deleteResponse.Content.ReadFromJsonAsync<BatchDeleteResponse>();
+        Assert.NotNull(result);
+        Assert.Equal("Batch delete completed successfully", result.Message);
+    }
+
+    [Fact]
+    public async Task DeleteBatchEndpoint_WithSomeInvalidIds_ReturnsOk()
+    {
+        // DestroyRecipe is idempotent - batch delete succeeds even with non-existent IDs
+        // Create one valid seed with a play ID
+        var validPlayId = Guid.NewGuid().ToString();
+        var testEmail = $"batch-partial-test-{Guid.NewGuid()}@bitwarden.com";
+
+        var seedResponse = await _client.PostAsJsonAsync("/seed", new SeedRequestModel
+        {
+            Template = "SingleUserScene",
+            Arguments = System.Text.Json.JsonSerializer.SerializeToElement(new { email = testEmail })
+        }, validPlayId);
+
+        seedResponse.EnsureSuccessStatusCode();
+        var seedResult = await seedResponse.Content.ReadFromJsonAsync<SceneResponseModel>();
+        Assert.NotNull(seedResult);
+
+        // Try to delete with mix of valid and invalid IDs
+        var playIds = new List<string> { validPlayId, Guid.NewGuid().ToString(), Guid.NewGuid().ToString() };
+        var request = new HttpRequestMessage(HttpMethod.Delete, "/seed/batch")
+        {
+            Content = JsonContent.Create(playIds)
+        };
+        var deleteResponse = await _client.SendAsync(request);
+
+        deleteResponse.EnsureSuccessStatusCode();
+        var result = await deleteResponse.Content.ReadFromJsonAsync<BatchDeleteResponse>();
+        Assert.NotNull(result);
+        Assert.Equal("Batch delete completed successfully", result.Message);
+    }
+
+    [Fact]
+    public async Task DeleteAllEndpoint_DeletesAllSeededData()
+    {
+        // Create multiple seeds
+        for (var i = 0; i < 2; i++)
+        {
+            var playId = Guid.NewGuid().ToString();
+            var testEmail = $"deleteall-test-{Guid.NewGuid()}@bitwarden.com";
+
+            var seedResponse = await _client.PostAsJsonAsync("/seed", new SeedRequestModel
+            {
+                Template = "SingleUserScene",
+                Arguments = System.Text.Json.JsonSerializer.SerializeToElement(new { email = testEmail })
+            }, playId);
+
+            seedResponse.EnsureSuccessStatusCode();
+        }
+
+        // Delete all
+        var deleteResponse = await _client.DeleteAsync("/seed");
+        Assert.Equal(HttpStatusCode.NoContent, deleteResponse.StatusCode);
+    }
+
+    [Fact]
+    public async Task SeedEndpoint_VerifyResponseContainsMangleMapAndResult()
+    {
+        var testEmail = $"verify-response-{Guid.NewGuid()}@bitwarden.com";
+        var playId = Guid.NewGuid().ToString();
+
+        var response = await _client.PostAsJsonAsync("/seed", new SeedRequestModel
+        {
+            Template = "SingleUserScene",
+            Arguments = System.Text.Json.JsonSerializer.SerializeToElement(new { email = testEmail })
+        }, playId);
+
+        response.EnsureSuccessStatusCode();
+        var jsonString = await response.Content.ReadAsStringAsync();
+
+        // Verify the response contains MangleMap and Result fields
+        Assert.Contains("mangleMap", jsonString, StringComparison.OrdinalIgnoreCase);
+        Assert.Contains("result", jsonString, StringComparison.OrdinalIgnoreCase);
+    }
+
+    private class BatchDeleteResponse
+    {
+        public string? Message { get; set; }
+    }
+}

test/SeederApi.IntegrationTest/SeederApi.IntegrationTest.csproj

@@ -0,0 +1,29 @@
+<Project Sdk="Microsoft.NET.Sdk.Web">
+  <PropertyGroup>
+    <IsPackable>false</IsPackable>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="$(MicrosoftNetTestSdkVersion)" />
+    <PackageReference Include="xunit" Version="$(XUnitVersion)" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="$(XUnitRunnerVisualStudioVersion)">
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+      <PrivateAssets>all</PrivateAssets>
+    </PackageReference>
+    <PackageReference Include="coverlet.collector" Version="$(CoverletCollectorVersion)">
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+      <PrivateAssets>all</PrivateAssets>
+    </PackageReference>
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\..\util\SeederApi\SeederApi.csproj" />
+    <ProjectReference Include="..\..\util\Seeder\Seeder.csproj" />
+    <ProjectReference Include="..\IntegrationTestCommon\IntegrationTestCommon.csproj" />
+
+    <Content Include="..\..\util\SeederApi\appsettings.*.json">
+      <Link>%(RecursiveDir)%(Filename)%(Extension)</Link>
+      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
+    </Content>
+  </ItemGroup>
+</Project>

test/SeederApi.IntegrationTest/SeederApiApplicationFactory.cs

@@ -0,0 +1,18 @@
+using Bit.Core.Services;
+using Bit.IntegrationTestCommon;
+using Bit.IntegrationTestCommon.Factories;
+
+namespace Bit.SeederApi.IntegrationTest;
+
+public class SeederApiApplicationFactory : WebApplicationFactoryBase<Startup>
+{
+    public SeederApiApplicationFactory()
+    {
+        TestDatabase = new SqliteTestDatabase();
+        _configureTestServices.Add(serviceCollection =>
+        {
+            serviceCollection.AddSingleton<IPlayIdService, NeverPlayIdServices>();
+            serviceCollection.AddHttpContextAccessor();
+        });
+    }
+}