22GraphQL & gRPC Testing

22.1 GraphQL essentials

• Single endpoint — usually /graphql. Always POST, body = JSON with query + variables.
• Client asks for exactly the fields it needs — no over/under fetching.
• 3 operation types: query (read), mutation (write), subscription (WebSocket stream).
• Schema — strongly typed; introspectable.

// Request
POST /graphql
Content-Type: application/json
{
  "query": "query GetUser($id: ID!) { user(id: $id) { id name email orders { id total } } }",
  "variables": { "id": "u_123" }
}

// Response
{
  "data": {
    "user": {
      "id": "u_123",
      "name": "Alice",
      "email": "alice@test.com",
      "orders": [{ "id": "o_1", "total": 99.0 }]
    }
  }
}

22.2 Testing GraphQL with Playwright

test('GraphQL — fetch user with orders', async ({ request }) => {
  const r = await request.post('/graphql', {
    data: {
      query: `query($id: ID!){ user(id: $id){ id name orders { id total } } }`,
      variables: { id: 'u_123' },
    },
    headers: { Authorization: `Bearer ${token}` },
  });
  expect(r.status()).toBe(200);
  const body = await r.json();
  expect(body.errors).toBeUndefined();
  expect(body.data.user.email).toBe('alice@test.com');
  expect(body.data.user.orders.length).toBeGreaterThan(0);
});

22.3 GraphQL test patterns

• Field selection asymmetry — ask for a small subset to confirm a field works; ask for everything to detect new required fields the server forces.
• Mutation + immediate read — POST a mutation, then query the resource and verify state.
• Variable validation — pass invalid types/missing variables to confirm schema validation returns errors.
• Persisted queries — production GraphQL APIs often only allow whitelisted query hashes for security. Tests need to send the hash + params.
• Subscriptions — open WebSocket, subscribe, trigger event via another API, assert payload.

22.4 Introspection + breaking-change detection

// Introspection query — fetches the whole schema
{ "query": "{ __schema { types { name fields { name type { name } } } } }" }

// Production tools to diff schema between releases:
npx graphql-inspector diff schema-old.graphql schema-new.graphql
// Flags removed fields, type changes — gates breaking changes in CI

22.5 gRPC essentials

• Binary protocol over HTTP/2; payloads are Protobuf (efficient binary).
• 4 RPC types: unary (req → res), server streaming, client streaming, bidirectional streaming.
• Schema = .proto file; both client + server generate code from it.
• Used heavily in microservices (Google, internal services).

// users.proto
syntax = "proto3";
service Users {
  rpc GetUser(GetUserRequest) returns (User);
  rpc ListUsers(ListUsersRequest) returns (stream User);   // server-streaming
}
message GetUserRequest { string id = 1; }
message User { string id = 1; string email = 2; }

22.6 Testing gRPC — tools

grpcurl — CLI equivalent of curl

grpcurl -plaintext -d '{"id": "u_123"}' \
  localhost:50051 users.Users/GetUser

# List methods on a server with reflection enabled
grpcurl -plaintext localhost:50051 list users.Users

Node test via grpc-js

import * as grpc from '@grpc/grpc-js';
import * as protoLoader from '@grpc/proto-loader';

const def = protoLoader.loadSync('users.proto');
const proto: any = grpc.loadPackageDefinition(def).users;
const client = new proto.Users('localhost:50051', grpc.credentials.createInsecure());

test('gRPC GetUser', (done) => {
  client.GetUser({ id: 'u_123' }, (err: any, res: any) => {
    expect(err).toBeNull();
    expect(res.email).toBe('alice@test.com');
    done();
  });
});

ghz — gRPC load tester

ghz --insecure --proto users.proto --call users.Users/GetUser \
  -d '{"id":"u_123"}' -c 50 -n 10000 localhost:50051

22.7 When each is used