<![CDATA[MSME e-commerce applications rely on REST APIs as the contract between back-end systems and mobile clients; the two most damaging defect classes at this layer are cross-tenant data leakage (broken object-level authorization, BOLA) and violations of business rules guarding financial integrity. This case study evaluates in-framework feature testing of the REST API of a Laravel 13 MSME e-commerce ERP platform exposing 57 API operations secured with Sanctum token authentication and role-based access control. The method is a four-concern test design (nominal, validation, authentication-authorization, business rules) executed by PHPUnit against an in-memory SQLite database, measured through operation coverage and assertion classification. The results show that 85 test cases with 229 assertions achieve 100% operation coverage (57/57) at a median execution time of 4.3 seconds; 37 of 102 status assertions (36.3%) are refusal assertions that anchor cross-tenant isolation at 404, mass-assignment rejection, post-logout token revocation, refusal of illegal state transitions, and stock-restoration idempotency under sequential duplicate rejection. The measurement process also uncovered and corrected a defect in static coverage extraction. The study concludes that such a suite constitutes low-cost, domain-specific regression oracles rather than evidence of absence of defects; mutation testing and a comparison with automated testing tools remain future work.]]>
Copyrights © 2026
