Movie REST API - API Regression & Access Control
An independently developed Flask API and pytest regression suite covering authorization, malformed imports, private playlists, pagination, and data exports.
API regression suite
- 24
- cases passed
- 89.3%
- statement coverage
- Role & token boundaries
- Malformed CSV / JSON
- Private playlist isolation
- Pagination & exports
Project verification · 6 September 2026
Verified 6 September 2026
Test scope & results
Original API and tests executed in an isolated copy with a dedicated test database.
- pytest suite
24 passed
22 test functions expand to 24 collected cases through parameterization.
- Statement coverage
89.28%
1,041 / 1,166 statements in the Flask API module.
- Branch coverage
66.91%
186 / 278 branches; separate from statement coverage.
Verification boundaries
- These results cover local API regression, not production load testing or an external security audit.
Summary
Project context
Individual academic project implementing both a movie-data REST API and its automated regression suite, using isolated SQLite databases, synthetic CSV inputs, and Flask's test client.
Problem / goal
The API needed consistent behavior for administrators and regular users, reliable imports, and private-resource isolation even when inputs or account states changed.
My role
Sole developer of the REST API and automated regression suite.
My contributions
- Developed reusable pytest fixtures and isolated database setup for repeatable regression testing.
- Tested token invalidation after account deactivation, administrator-only operations, and cross-user playlist restrictions.
- Covered invalid encodings, missing CSV columns, malformed JSON, repeated imports, pagination, and parameter boundaries.
- Verified persisted records and JSON, CSV, and image exports alongside HTTP responses.
Technical approach
- Build preconditions with fixtures, issue HTTP requests, and assert response contracts and database state.
- Exercise positive, negative, authorization, and regression scenarios, including a person with both cast and crew roles.
- Measure statement and branch coverage separately to keep the headline metric precise.
Key features
- JWT and role-based access checks
- Private-resource isolation
- CSV validation and replacement semantics
- Search, pagination, and reporting regression tests
Impact / results
- All 24 collected pytest cases passed on 6 September 2026 without modifying the original API or tests.
- API module statement coverage: 1,041 / 1,166 statements, or 89.28%.
- API module branch coverage: 186 / 278 branches, or 66.91%.
What I learned
- Authorization tests need to cover state changes after login.
- Database assertions reveal regressions that response status codes alone can miss.