My role
- Tested the projects module through the UI and API, including role-based access to allowed and forbidden operations.
- Built a Python utility that provisioned realistic project data through APIs described by the OpenAPI specification.
- Used Chrome DevTools and Grafana to investigate long load times, UI freezes and excessive network requests.
- Started structured QA documentation and helped the second QA engineer begin using Postman and writing automated tests.
Technical challenges
- A useful project dataset required many dependent records: customer, project, team members, roles, budget, rates, tasks and time entries. Creating them manually took several hours.
- Generated records had to remain logically consistent even though their values changed on every run, and IDs returned by one API call were required by the next.
- Project permissions crossed UI and API boundaries, so I tested the same endpoints with different accounts and tokens rather than relying on hidden buttons alone.
My approach
I wrote a Python utility that authenticated against the backend and built a project through a sequence of dependent API calls. It reused returned IDs to connect customers, projects, team members, roles, budgets, tasks, rates and time entries. Each run produced different values while keeping the relationships valid. This reduced my repeated setup from roughly 5–6 hours, sometimes longer, to about 10 minutes.
For RBAC coverage, I created users with different roles and called the same project endpoints with each account or token, checking both permitted and rejected operations. This exposed an authorization gap where a restricted role could still retrieve data that the UI hid from it by calling a specific endpoint directly. Developers closed the gap, and I verified the fix by retesting with the same role.
For performance work, I used the DevTools network view and Grafana to document duplicate requests, missing caching and inefficient loading behavior. Some actions generated as many as 50 similar requests. Developers later removed redundant calls, introduced caching and reworked endpoint and frontend behavior.
Results
- The generator remained my test-data utility throughout the assignment, reducing each realistic project setup from roughly 5–6 hours or more to about 10 minutes.
- API-level RBAC testing uncovered access that the UI concealed but the backend still allowed for a restricted role. Developers closed the gap and the fix was retested successfully.
- After the request and loading redesign, assigning a task fell from roughly 45 seconds to under one second in my retest. The redesigned behavior was released internally.
- The second QA engineer adopted Postman and began contributing automated tests with my guidance.
Stack
More case studies