QA AUTOMATION PROJECT

Full-Stack QA Automation Project

Web Application · Authentication · UI Automation · API Testing · Database Validation

PROJECT OVERVIEW

Application Under Test

I developed a full-stack web application as an Application Under Test (AUT) to demonstrate practical software testing and QA automation.

I designed and implemented independent test automation frameworks using Selenium WebDriver (Java), Playwright (JavaScript), Jest, and Apache JMeter to validate UI, API, database, authentication, accessibility, and performance workflows.

The project also includes structured test documentation, defect investigation, regression coverage, and CI/CD integration.

Project Goals

Build and test a realistic full-stack application using professional QA practices, multi-layer automation, traceability, defect management, and continuous integration.

SYSTEM DESIGN

Application Architecture

The application combines a server-rendered portfolio interface with a React authentication client, both connected to a shared Node.js / Express backend, session-based authentication, and PostgreSQL.

CLIENT

User / Browser

Portfolio Pages · Authentication Pages

HTTP / HTTPS · Session Cookie
↓
FRONTEND LAYER

Portfolio Frontend

EJS · Bootstrap · HTML · CSS · JavaScript

Authentication Frontend

React · Login · Register · Account · Admin

Page Requests · Fetch API
↓
APPLICATION SERVER

Node.js / Express.js

Portfolio · APIs · Authentication · Sessions

↓
APPLICATION & SECURITY LAYER

Routing & APIs

Page Routes · Contact API · Authentication API

Request Processing

Validation · Processing · Response Handling

Authentication & Sessions

express-session · connect-pg-simple · Session Cookie

Authorization & Security

User / Admin RBAC · bcrypt Password Hashing

Data Access · Parameterized SQL Queries
↓
DATABASE

PostgreSQL

Messages · Users · Session Store

CLOUD DEPLOYMENT

Deployment Architecture

The production application is deployed as a Railway service and connects to Railway PostgreSQL through the private network. Public application traffic uses HTTPS, while application data and session storage are persisted in PostgreSQL.

CLIENT

Public User / Browser

Portfolio · Authentication

HTTPS
↓
PUBLIC ACCESS

Railway Public Domain

Public Application Endpoint

HTTPS Request
↓
APPLICATION SERVICE

Node.js / Express

EJS Portfolio · React Auth Build

Backend Services

REST APIs · Sessions · Authentication · RBAC

Private Database Connection · DATABASE_URL
↓
PRIVATE CONNECTIVITY

Railway Private Network

Application-to-Database Traffic

↓
DATABASE

Railway PostgreSQL

Messages · Users · Session Store

APPLICATION TECHNOLOGIES

Technology Stack

Technologies used to build, secure, persist, deploy, and run the full-stack Application Under Test.

PORTFOLIO FRONTEND

Web Interface

HTML · CSS · Bootstrap · JavaScript · Fetch API

AUTH FRONTEND

Authentication UI

React · Login · Register · Account · Admin

TEMPLATING

Server-Side Views

EJS

BACKEND

Application Server

Node.js · Express.js

AUTHENTICATION

Sessions & Authentication

express-session · connect-pg-simple

AUTHORIZATION & SECURITY

Access & Password Protection

User / Admin RBAC · bcrypt

MIDDLEWARE

Request Parsing

body-parser

DATABASE

Data Persistence

PostgreSQL · SQL · pg

CONFIGURATION

Environment Configuration

dotenv · DATABASE_URL · SESSION_SECRET · NODE_ENV

DEVELOPMENT

Runtime & Tooling

npm · nodemon

VERSION CONTROL

Source Control

Git · GitHub

DEPLOYMENT & CI

Cloud & Automation

Railway · GitHub Actions

QUALITY ENGINEERING

QA & Testing Stack

Tools, frameworks, and testing practices used across unit, UI, API, database, accessibility, performance, cross-browser, and CI/CD testing.

UNIT TESTING

Jest

Contact Validation · Authentication Validation

UI AUTOMATION

Selenium WebDriver

Java · TestNG · Maven · Page Object Model

END-TO-END AUTOMATION

Playwright

JavaScript · UI · API · Database · Authentication

ACCESSIBILITY TESTING

axe-core

WCAG-Oriented Scans · Color Contrast · Accessible Names · Semantics · Keyboard Focus

API TESTING

REST Assured · Postman · Ajv

HTTP Validation · Authentication APIs · JSON Schema Validation

DATABASE TESTING

PostgreSQL

SQL · JDBC · pg · Data Integrity · Backend Validation

PERFORMANCE TESTING

Apache JMeter

Smoke · Baseline · Load · Stress

CROSS-BROWSER TESTING

Browser Coverage

Selenium: Chrome · Firefox · Edge
Playwright: Chromium · Firefox · WebKit

TEST DESIGN

Coverage Techniques

Smoke · Regression · Positive · Negative · EP · BVA

TEST REPORTING

Automation Results

Allure · TestNG · HTML Reports · CI Artifacts

TEST DATA

Data Management

Generated Test Data · Boundary Data · Database Cleanup

CI/CD TEST EXECUTION

GitHub Actions

Automated Regression · PostgreSQL Service · Test Artifacts

TEST STRATEGY

Test Strategy & Coverage

Multi-layer testing strategy covering isolated business logic, browser workflows, APIs, authentication and authorization, database behavior, accessibility, performance, and regression risk.

UNIT LAYER

Jest Validation Testing

  • Contact form validation
  • Authentication input validation
  • Required and whitespace-only field handling
  • Email and password validation rules
  • Isolated execution without browser or database dependencies
UI LAYER

Functional & UI Testing

  • Page navigation and user workflows
  • Contact form submission and validation
  • Registration, login, logout, and Account workflows
  • Guest, user, and admin access behavior
  • Cross-browser regression coverage
API LAYER

API & HTTP Validation

  • Status and contact endpoint validation
  • Authentication API request and response validation
  • HTTP status codes and exact response messages
  • 401 unauthenticated and 403 forbidden behavior
  • JSON Schema and negative-request validation
AUTH & SESSION LAYER

Authentication & Authorization

  • Registration and authenticated session creation
  • Session persistence across page refresh
  • Logout and session invalidation
  • Protected Account access
  • User / Admin role-based access control
DATA LAYER

Backend & Database Validation

  • Contact message persistence
  • User record creation and role verification
  • Password hash verification
  • Session-related database cleanup
  • UI/API-to-database consistency
ACCESSIBILITY LAYER

Automated Accessibility Validation

  • axe-core page scans
  • Color-contrast validation
  • Accessible names and required semantics
  • Keyboard focus and Enter activation
  • Focused-state regression coverage
PERFORMANCE LAYER

Performance & Reliability

  • Response time measurement
  • Baseline performance testing
  • Load testing
  • Stress testing
  • Application stability under load
REGRESSION & CI

Automated Regression Execution

  • UI, API, database, and accessibility regression
  • Chromium, Firefox, and WebKit Playwright execution
  • GitHub Actions continuous integration
  • PostgreSQL service integration in CI
  • Automated test reports and execution artifacts

API VALIDATION

API Coverage & Endpoints

Application APIs are validated for request handling, response content, status codes, validation errors, authentication state, authorization, database persistence, and API contract behavior.

GET

/api/status

Verifies that the application backend is available and returns the expected service status.

  • Expected status: 200 OK
  • Exact response validation
  • Required properties and data types
  • JSON Schema validation
POST

/contact

Processes validated contact form submissions and persists message data in PostgreSQL.

  • Valid submission: 200 OK
  • Missing or invalid input: 400 Bad Request
  • Exact success and error messages
  • JSON Schema validation
  • Database persistence verification
POST

Registration & Login

Validates account creation, credential handling, login behavior, and authenticated session creation.

  • /api/auth/register — successful registration: 201 Created
  • Normalized duplicate email: 409 Conflict
  • Client-supplied admin role is not accepted
  • /api/auth/login — successful login: 200 OK
  • Invalid credentials return the same generic 401 response
  • Password and password hash are not exposed in API responses
GET / POST

Session Lifecycle

Verifies authenticated identity state and confirms that logout invalidates the active server session.

  • GET /api/auth/me — authenticated user: 200 OK
  • Unauthenticated request: 401 Unauthorized
  • POST /api/auth/logout — successful logout: 200 OK
  • Session is invalid after logout
  • Authenticated state is verified through the real session cookie
GET

/api/auth/admin

Validates authentication and role-based authorization for the protected Admin API.

  • Guest request: 401 Unauthorized
  • Authenticated user role: 403 Forbidden
  • Authenticated admin role: 200 OK
  • User / Admin RBAC validation
AUTOMATION

API Test Coverage

API behavior is validated across Java and JavaScript automation frameworks using direct HTTP requests and backend assertions.

  • REST Assured API automation
  • Playwright API testing
  • Ajv and JSON Schema validation
  • Positive and negative scenarios
  • Database and session-state verification where applicable

DATABASE VALIDATION

Database Testing

PostgreSQL validation covers contact-message persistence, authentication user records, role data, password hashing, session-backed authentication, and UI/API-to-database consistency.

DATABASE SCHEMA

messages

id SERIAL PRIMARY KEY
name VARCHAR(255)
email VARCHAR(255)
message TEXT
created_at TIMESTAMPTZ
AUTHENTICATION DATA

users

id Primary Key
email Account Email
password_hash bcrypt Hash
role user / admin
created_at Created Timestamp
SESSION STORAGE

Server-Side Sessions

  • PostgreSQL-backed session storage
  • Managed through connect-pg-simple
  • Session cookie identifies the active server session
  • Only the authenticated user ID is stored in session data
  • Logout invalidates the authenticated session
DATA VALIDATION

UI / API → Database

  • Contact message persistence and stored-value verification
  • User record creation after registration
  • Normalized email and default-role verification
  • Password hash verification without plaintext storage
  • User / Admin role verification
  • Parameterized SQL queries in automated database checks
  • Test-owned user and session cleanup after execution

TEST AUTOMATION

Automation & Test Artifacts

Explore the Jest unit tests, automation frameworks, API tests, performance tests, and test results created for this project.

Unit · UI · API · Database · Accessibility · Performance · Cross-Browser · CI/CD

View Automation Details