What is API security testing and what vulnerabilities do you test for?

@Test
public void testIDORVulnerability() {
    // User 1 should NOT be able to access User 2's orders
    given()
        .header("Authorization", "Bearer " + user1Token)
        .when()
        .get("/api/users/2/orders")  // accessing user 2 as user 1
        .then()
        .statusCode(403); // Must be 403, NOT 200
}

@Test
public void testWeakPassword() {
    given()
        .body("{ \"username\": \"admin\", \"password\": \"123\" }")
        .contentType(ContentType.JSON)
        .when()
        .post("/api/auth/login")
        .then()
        .statusCode(400) // Should reject weak passwords
        .body("error", containsString("Password too weak"));
}

@Test
public void testBruteForceProtection() {
    // After 5 failed attempts, should get 429
    for (int i = 0; i < 5; i++) {
        given().body("{ \"username\": \"admin\", \"password\": \"wrong\" + i }")
               .contentType(ContentType.JSON)
               .when().post("/api/auth/login");
    }

    given().body("{ \"username\": \"admin\", \"password\": \"wrong6\" }")
           .contentType(ContentType.JSON)
           .when().post("/api/auth/login")
           .then().statusCode(429); // Too Many Requests
}

@Test
public void testNoSensitiveDataExposed() {
    Response response = given()
                            .when()
                            .get("/api/users/1");

    String body = response.getBody().asString();

    // Sensitive fields should NOT appear in response
    assertFalse(body.contains("password"), "Password should not be in response");
    assertFalse(body.contains("credit_card"), "Credit card should not be in response");
    assertFalse(body.contains("ssn"), "SSN should not be in response");
}

@Test
public void testSQLInjectionInQueryParam() {
    given()
        .queryParam("id", "1 OR 1=1")
        .when()
        .get("/api/users")
        .then()
        .statusCode(anyOf(equalTo(400), equalTo(404)))
        // Should NOT return all users due to SQL injection
        .statusCode(not(200));
}

@Test
public void testSQLInjectionInBody() {
    given()
        .body("{ \"username\": \"admin'' OR ''1''=''1\", \"password\": \"x\" }")
        .contentType(ContentType.JSON)
        .when()
        .post("/api/auth/login")
        .then()
        .statusCode(anyOf(equalTo(400), equalTo(401)))
        .statusCode(not(200)); // Must NOT succeed
}

@Test
public void testPasswordResetRateLimited() {
    for (int i = 0; i < 10; i++) {
        given().body("{ \"email\": \"user@test.com\" }")
               .contentType(ContentType.JSON)
               .when().post("/api/auth/forgot-password");
    }

    given().body("{ \"email\": \"user@test.com\" }")
           .contentType(ContentType.JSON)
           .when().post("/api/auth/forgot-password")
           .then().statusCode(429);
}

@Test
public void testMassAssignmentProtection() {
    // User should NOT be able to set themselves as admin
    given()
        .header("Authorization", "Bearer " + userToken)
        .body("{ \"name\": \"John\", \"role\": \"admin\", \"is_admin\": true }")
        .contentType(ContentType.JSON)
        .when()
        .put("/api/users/profile")
        .then()
        .statusCode(200)
        // Role should remain 'user', not 'admin'
        .body("role", not(equalTo("admin")));
}