by
Kashaf Fatima 22i-2415
Safi ur Rehman 22i-2534
Amna Noor 22i-1529
Software Reengineering
Risk Analysis & Testing
Submitted to Nigar Azhar Butt
Date: 07/12/2025
1
Contents
1 Risk Analysis 3
1.1 Risk Matrix 3
2 Testing Strategy 3
2.1 Tools Used 3
3 Testing Evidence 3
3.1 Integration Test Results 3
4 Validations 6
5 Test Cases 6
6 Screenshot 11
2
1 Risk Analysis
This section outlines the key risks identified during the re-engineering process and the
mitigation strategies implemented.
1.1 Risk Matrix
Category Risk Description Probability Impact Mitigation
Data Data corruption/loss during Medium High Custom ETL script with
Integrity migration from flat files to validation; Backup procedures.
MongoDB.
Security Unauthorized API access. Low High Authentication checks;
Environment variables for DB
credentials.
Availability Server crash due to unhandled Low High Global error handling
exceptions. middleware; Stateless
architecture.
Performance Slow response times with large Low Medium Database Indexing;
datasets. Asynchronous [Link] I/O.
2 Testing Strategy
The project follows a "Test Pyramid" approach, emphasizing automated integration testing
for reliability.
2.1 Tools Used
• Jest: JavaScript Testing Framework.
• Supertest: HTTP assertion library for testing Express routes.
3 Testing Evidence
The following section provides evidence of successful test execution.
3.1 Integration Test Results
The integration tests validated the core API functionality: Inventory retrieval, Authentication
security, and Data Creation.
3
Test Case Documentation
1. Authentication Tests
• POST /api/login with Invalid Credentials
o Test Objective: Ensure that the system rejects invalid login credentials.
o Test Case ID: TC001
o Test Steps: Send invalid username and password in the request body.
o Expected Result: The system returns status code 401 Unauthorized.
o Test Data:
▪ Username: invalid_user
▪ Password: wrong_password
o Outcome: The login failed as expected, and the response status code was 401.
• POST /api/login with Valid Credentials
o Test Objective: Ensure that the system accepts valid login credentials.
o Test Case ID: TC002
o Test Steps: Send valid username and password for a test employee.
o Expected Result: The system returns status code 200 OK and includes user
data in the response.
o Test Data:
▪ Username: test_admin
▪ Password: password123
o Outcome: Login succeeded, returning the expected employee details in the
response.
2. Item Management Tests
• POST /api/items to Create a New Item
o Test Objective: Verify the creation of a new item.
o Test Case ID: TC003
o Test Steps: Send item data in the request body to create a new item.
o Expected Result: The system returns status code 200 OK with the created
item's details.
o Test Data:
▪ Item ID: 99999
▪ Item Name: Test Item
▪ Price: 10.5
▪ Amount: 100
o Outcome: New item created successfully with the expected properties.
• PUT /api/items/:id to Update an Existing Item
o Test Objective: Verify that the system correctly updates an existing item.
o Test Case ID: TC004
o Test Steps: Send updated item data for an existing item.
o Expected Result: The system returns status code 200 OK and the updated item
details.
4
o Test Data:
▪ Item ID: 99999
▪ Item Name: Updated Test Item
▪ Price: 20.0
▪ Amount: 150
o Outcome: Item updated successfully, and the response matches the updated
data.
3. User Management Tests
• POST /api/users to Create a New User
o Test Objective: Verify that a new user can be successfully created.
o Test Case ID: TC005
o Test Steps: Send user data to create a new user.
o Expected Result: The system returns status code 200 OK and the created user
details.
o Test Data:
▪ Phone: 1234567890
o Outcome: User created successfully with the expected phone number.
4. Transaction Tests (Rent/Return)
• POST /api/rent to Rent an Item
o Test Objective: Verify that an item can be successfully rented.
o Test Case ID: TC006
o Test Steps: Send rent request for an item and verify user rental data.
o Expected Result: The system returns status code 200 OK, and the item rental
is reflected in the user and item data.
o Test Data:
▪ Phone: 1234567890
▪ Item ID: 99999
▪ Return Date: 2025-12-31
o Outcome: Item rented successfully with the expected changes in the user’s
rental data and item amount.
• POST /api/return to Return an Item
o Test Objective: Verify that an item can be successfully returned.
o Test Case ID: TC007
o Test Steps: Send return request for an item and verify user rental data.
o Expected Result: The system returns status code 200 OK, and the item return
is reflected in the user and item data.
o Test Data:
▪ Phone: 1234567890
▪ Item ID: 99999
5
o Outcome: Item returned successfully with the expected changes in the user’s
rental status and item amount.
5. Error Handling Tests
• GET /api/users/:id for Non-existent User
o Test Objective: Verify that requesting a non-existent user returns a 404 error.
o Test Case ID: TC008
o Test Steps: Send a GET request for a non-existent user ID.
o Expected Result: The system returns status code 404 Not Found.
o Test Data:
▪ User ID: 9999999999
o Outcome: The system correctly returned a 404 error for the non-existent
user.
4 Validations
• Auth Test: Confirmed that the system rejects invalid usernames/passwords,
returning the expected 401 status code.
• Data Persistence Test: Verified that items created via API are retrievable by sending
a GET request for /api/items.
• Error Handling Test: Verified that requesting non-existent resources (like a non-
existent user) returns appropriate HTTP 404 status codes.
5 Test Cases
const request = require('supertest');
const express = require('express');
const mongoose = require('mongoose');
const apiRoutes = require('../routes/api');
const bodyParser = require('body-parser');
require('dotenv').config();
const app = express();
[Link]([Link]());
[Link]('/api', apiRoutes);
beforeAll(async () => {
await [Link]([Link].MONGODB_URI);
}, 30000);
afterAll(async () => {
await [Link]();
}, 30000);
6
describe('API Endpoints', () => {
test('GET /api/items should return list of items', async () => {
const res = await request(app).get('/api/items');
expect([Link]).toEqual(200);
expect([Link]([Link])).toBeTruthy();
});
test('POST /api/login should fail with invalid credentials', async () => {
const res = await request(app)
.post('/api/login')
.send({
username: 'invalid_user',
password: 'wrong_password'
});
expect([Link]).toEqual(401);
});
// --- Authentication Tests ---
test('POST /api/login should succeed with valid credentials', async () => {
// Create a test employee
const Employee = require('../models/Employee');
const testEmployee = {
username: 'test_admin',
name: 'Test Admin',
position: 'Admin',
password: 'password123'
};
await [Link]({ username: [Link] });
await new Employee(testEmployee).save();
const res = await request(app)
.post('/api/login')
.send({
username: [Link],
password: [Link]
});
expect([Link]).toEqual(200);
expect([Link]).toBe(true);
expect([Link]).toEqual([Link]);
// Cleanup
await [Link]({ username: [Link] });
});
// --- Item Management Tests ---
7
let testItemId = 99999;
test('POST /api/items should create a new item', async () => {
await [Link]('Item').deleteOne({ itemId: testItemId });
const res = await request(app)
.post('/api/items')
.send({
itemId: testItemId,
itemName: 'Test Item',
price: 10.5,
amount: 100
});
expect([Link]).toEqual(200);
expect([Link]).toEqual('Test Item');
}, 30000);
test('PUT /api/items/:id should update an existing item', async () => {
const updatedData = {
itemName: 'Updated Test Item',
price: 20.0,
amount: 150
};
const res = await request(app)
.put(`/api/items/${testItemId}`)
.send(updatedData);
expect([Link]).toEqual(200);
expect([Link]).toEqual([Link]);
expect([Link]).toEqual([Link]);
// Verify in DB
const item = await [Link]('Item').findOne({ itemId: testItemId });
expect([Link]).toEqual(150);
});
test('PUT /api/items/:id should return null for non-existent item', async () => {
const res = await request(app)
.put('/api/items/888888') // Non-existent ID
.send({ price: 50 });
// Depending on implementation, valid mongo null response might be 200 with null body or 404
// The current route returns `[Link](updatedItem)`, which sends null if not found.
expect([Link]).toEqual(200);
expect([Link]).toBeNull();
});
8
// --- User Management Tests ---
const testUserPhone = 1234567890;
test('POST /api/users should create a new user', async () => {
await [Link]('User').deleteOne({ phone: testUserPhone });
const res = await request(app)
.post('/api/users')
.send({ phone: testUserPhone });
expect([Link]).toEqual(200);
expect([Link]).toEqual(testUserPhone);
expect([Link]).toEqual([]);
});
// --- Transaction Tests (Rent/Return) ---
test('POST /api/rent should successfully rent an item', async () => {
// Ensure user and item exist (reusing from previous tests)
const returnDate = '2025-12-31';
const res = await request(app)
.post('/api/rent')
.send({
phone: testUserPhone,
itemId: testItemId,
returnDate: returnDate
});
expect([Link]).toEqual(200);
expect([Link]).toBe(true);
// Verify user rentals
const user = await [Link]('User').findOne({ phone: testUserPhone });
expect([Link]).toHaveLength(1);
expect([Link][0].itemId).toEqual(testItemId);
expect([Link][0].isReturned).toBe(false);
// Verify item amount decreased (Started at 150 from update test -> should be 149)
const item = await [Link]('Item').findOne({ itemId: testItemId });
expect([Link]).toEqual(149);
});
test('POST /api/rent should fail if user not found', async () => {
const res = await request(app)
.post('/api/rent')
9
.send({
phone: 0, // Invalid phone
itemId: testItemId,
returnDate: '2025-01-01'
});
expect([Link]).toEqual(404);
expect([Link]).toEqual('User not found');
});
test('POST /api/rent should fail if item out of stock', async () => {
// Create an out-of-stock item
const oosItemId = 77777;
const Item = [Link]('Item');
await [Link]({ itemId: oosItemId });
await new Item({ itemId: oosItemId, itemName: 'OOS Item', price: 10, amount: 0 }).save();
const res = await request(app)
.post('/api/rent')
.send({
phone: testUserPhone,
itemId: oosItemId,
returnDate: '2025-01-01'
});
expect([Link]).toEqual(400);
expect([Link]).toEqual('Item not available');
// Cleanup
await [Link]({ itemId: oosItemId });
});
test('POST /api/return should successfully return an item', async () => {
const res = await request(app)
.post('/api/return')
.send({
phone: testUserPhone,
itemId: testItemId
});
expect([Link]).toEqual(200);
expect([Link]).toBe(true);
// Verify rental status
const user = await [Link]('User').findOne({ phone: testUserPhone });
const rental = [Link](r => [Link] === testItemId);
expect([Link]).toBe(true);
10
// Verify item amount increased (Back to 150)
const item = await [Link]('Item').findOne({ itemId: testItemId });
expect([Link]).toEqual(150);
});
test('GET /api/users/9999 should return 404 for non-existent user', async () => {
const res = await request(app).get('/api/users/9999999999');
expect([Link]).toEqual(404);
});
});
6 Screenshot
11