Add e2e tests

Signed-off-by: Bryan Frimin <bryan@getprobo.com>
2025-11-27 17:38:16 +01:00
parent 73bf4f4b23
commit b93d2d8b0b
38 changed files with 26077 additions and 4 deletions
--- a/e2e/internal/testutil/assert.go
+++ b/e2e/internal/testutil/assert.go
@@ -0,0 +1,175 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package testutil
+
+import (
+	"cmp"
+	"slices"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// PageInfo represents GraphQL Relay-style pagination info.
+// This type can be embedded in result structs to avoid repeating the definition.
+type PageInfo struct {
+	HasNextPage     bool    `json:"hasNextPage"`
+	HasPreviousPage bool    `json:"hasPreviousPage"`
+	StartCursor     *string `json:"startCursor"`
+	EndCursor       *string `json:"endCursor"`
+}
+
+// AssertFirstPage asserts that the response represents a valid first page of results.
+// It checks that the edge count matches expected, hasNextPage equals expectMore,
+// and hasPreviousPage is false.
+func AssertFirstPage(t *testing.T, edgeCount int, pageInfo PageInfo, expectedCount int, expectMore bool) {
+	t.Helper()
+	assert.Equal(t, expectedCount, edgeCount, "unexpected number of edges")
+	assert.Equal(t, expectMore, pageInfo.HasNextPage, "hasNextPage mismatch")
+	assert.False(t, pageInfo.HasPreviousPage, "first page should not have previous page")
+}
+
+// AssertMiddlePage asserts that the response represents a valid middle page of results.
+// It checks that the edge count matches expected and both hasNextPage and hasPreviousPage are true.
+func AssertMiddlePage(t *testing.T, edgeCount int, pageInfo PageInfo, expectedCount int) {
+	t.Helper()
+	assert.Equal(t, expectedCount, edgeCount, "unexpected number of edges")
+	assert.True(t, pageInfo.HasNextPage, "middle page should have next page")
+	assert.True(t, pageInfo.HasPreviousPage, "middle page should have previous page")
+}
+
+// AssertLastPage asserts that the response represents a valid last page of results.
+// It checks that the edge count matches expected, hasNextPage is false,
+// and hasPreviousPage equals expectPrevious.
+func AssertLastPage(t *testing.T, edgeCount int, pageInfo PageInfo, expectedCount int, expectPrevious bool) {
+	t.Helper()
+	assert.Equal(t, expectedCount, edgeCount, "unexpected number of edges")
+	assert.False(t, pageInfo.HasNextPage, "last page should not have next page")
+	assert.Equal(t, expectPrevious, pageInfo.HasPreviousPage, "hasPreviousPage mismatch")
+}
+
+// AssertHasMorePages asserts that there are more pages available after the current one.
+func AssertHasMorePages(t *testing.T, pageInfo PageInfo) {
+	t.Helper()
+	assert.True(t, pageInfo.HasNextPage, "expected more pages")
+	assert.NotNil(t, pageInfo.EndCursor, "endCursor should be set when there are more pages")
+}
+
+// AssertHasPreviousPages asserts that there are previous pages before the current one.
+func AssertHasPreviousPages(t *testing.T, pageInfo PageInfo) {
+	t.Helper()
+	assert.True(t, pageInfo.HasPreviousPage, "expected previous pages")
+	assert.NotNil(t, pageInfo.StartCursor, "startCursor should be set when there are previous pages")
+}
+
+// AssertTimestampsOnCreate validates that createdAt and updatedAt are properly set
+// after resource creation: both should be after beforeCreate and equal to each other.
+func AssertTimestampsOnCreate(t *testing.T, createdAt, updatedAt, beforeCreate time.Time) {
+	t.Helper()
+	assert.True(t, createdAt.After(beforeCreate), "createdAt should be after test start")
+	assert.True(t, updatedAt.After(beforeCreate), "updatedAt should be after test start")
+	assert.Equal(t, createdAt, updatedAt, "createdAt and updatedAt should be equal on create")
+}
+
+// AssertTimestampsOnUpdate validates that timestamps are properly updated:
+// createdAt should remain unchanged, updatedAt should be after the previous value.
+func AssertTimestampsOnUpdate(t *testing.T, createdAt, updatedAt, originalCreatedAt, originalUpdatedAt time.Time) {
+	t.Helper()
+	assert.Equal(t, originalCreatedAt, createdAt, "createdAt should not change on update")
+	assert.True(t, updatedAt.After(originalUpdatedAt) || updatedAt.Equal(originalUpdatedAt),
+		"updatedAt should be >= previous updatedAt")
+}
+
+// AssertOptionalStringEqual validates optional string fields (pointers).
+// If expected is nil, actual must be nil. Otherwise, both must be non-nil and equal.
+func AssertOptionalStringEqual(t *testing.T, expected, actual *string, fieldName string) {
+	t.Helper()
+	if expected == nil {
+		assert.Nil(t, actual, "%s should be nil", fieldName)
+	} else {
+		require.NotNil(t, actual, "%s should not be nil", fieldName)
+		assert.Equal(t, *expected, *actual, "%s mismatch", fieldName)
+	}
+}
+
+// AssertOrderedAscending validates that a slice is sorted in ascending order.
+func AssertOrderedAscending[T cmp.Ordered](t *testing.T, values []T, fieldName string) {
+	t.Helper()
+	assert.True(t, slices.IsSorted(values), "%s should be in ascending order, got: %v", fieldName, values)
+}
+
+// AssertOrderedDescending validates that a slice is sorted in descending order.
+func AssertOrderedDescending[T cmp.Ordered](t *testing.T, values []T, fieldName string) {
+	t.Helper()
+	reversed := slices.Clone(values)
+	slices.Reverse(reversed)
+	assert.True(t, slices.IsSorted(reversed), "%s should be in descending order, got: %v", fieldName, values)
+}
+
+// AssertTimesOrderedAscending validates that times are in ascending order.
+func AssertTimesOrderedAscending(t *testing.T, times []time.Time, fieldName string) {
+	t.Helper()
+	isSorted := slices.IsSortedFunc(times, func(a, b time.Time) int {
+		return a.Compare(b)
+	})
+	assert.True(t, isSorted, "%s should be in ascending order", fieldName)
+}
+
+// AssertTimesOrderedDescending validates that times are in descending order.
+func AssertTimesOrderedDescending(t *testing.T, times []time.Time, fieldName string) {
+	t.Helper()
+	isSorted := slices.IsSortedFunc(times, func(a, b time.Time) int {
+		return b.Compare(a)
+	})
+	assert.True(t, isSorted, "%s should be in descending order", fieldName)
+}
+
+// AssertNodeNotAccessible validates that a node query returns nil or an error
+// (used for tenant isolation tests).
+func AssertNodeNotAccessible(t *testing.T, err error, nodeIsNil bool, resourceType string) {
+	t.Helper()
+	if err == nil {
+		assert.True(t, nodeIsNil, "should not be able to access %s from another org", resourceType)
+	}
+	// If there's an error, that's also acceptable (access denied)
+}
+
+// RequireForbiddenError asserts that the error is a GraphQL FORBIDDEN error.
+func RequireForbiddenError(t *testing.T, err error, msgAndArgs ...any) {
+	t.Helper()
+	RequireErrorCode(t, err, "FORBIDDEN", msgAndArgs...)
+}
+
+// RequireErrorCode asserts that the error is a GraphQL error with the specified code.
+func RequireErrorCode(t *testing.T, err error, code string, msgAndArgs ...any) {
+	t.Helper()
+	require.Error(t, err, msgAndArgs...)
+
+	var gqlErrors GraphQLErrors
+	if !assert.ErrorAs(t, err, &gqlErrors) {
+		t.Fatalf("expected GraphQL error, got: %T: %v", err, err)
+	}
+
+	if len(gqlErrors) == 0 {
+		t.Fatalf("expected at least one GraphQL error, got none")
+	}
+
+	if gqlErrors[0].Code() != code {
+		t.Fatalf("expected %s error code, got %q with message: %q",
+			code, gqlErrors[0].Code(), gqlErrors[0].Message)
+	}
+}
--- a/e2e/internal/testutil/client.go
+++ b/e2e/internal/testutil/client.go
@@ -0,0 +1,351 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package testutil
+
+import (
+	"bytes"
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/cookiejar"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/gid"
+)
+
+// generateUniqueID creates a unique identifier for test isolation.
+// It combines a timestamp with random bytes to ensure uniqueness
+// even when tests run in parallel.
+func generateUniqueID() string {
+	randomBytes := make([]byte, 4)
+	rand.Read(randomBytes)
+	return fmt.Sprintf("%d-%s", time.Now().UnixNano(), hex.EncodeToString(randomBytes))
+}
+
+// TestRole represents the role a test user should have
+type TestRole string
+
+const (
+	RoleOwner  TestRole = "OWNER"
+	RoleAdmin  TestRole = "ADMIN"
+	RoleViewer TestRole = "VIEWER"
+)
+
+// Client is an authenticated HTTP client for making API requests
+type Client struct {
+	T              testing.TB
+	httpClient     *http.Client
+	baseURL        string
+	role           TestRole
+	userID         gid.GID
+	organizationID gid.GID
+}
+
+// NewClient creates a new authenticated test client with the specified role.
+// It creates a new user, organization, and sets up the membership with the given role.
+func NewClient(t testing.TB, role TestRole) *Client {
+	t.Helper()
+
+	jar, err := cookiejar.New(nil)
+	require.NoError(t, err, "cannot create cookie jar")
+
+	client := &Client{
+		T:       t,
+		baseURL: GetBaseURL(),
+		role:    role,
+		httpClient: &http.Client{
+			Jar:     jar,
+			Timeout: 30 * time.Second,
+		},
+	}
+
+	client.setupTestUser()
+
+	return client
+}
+
+// NewClientInOrg creates a test client for a user in an existing organization.
+// The ownerClient must be an OWNER of the organization to invite the new user.
+func NewClientInOrg(t testing.TB, role TestRole, ownerClient *Client) *Client {
+	t.Helper()
+
+	jar, err := cookiejar.New(nil)
+	require.NoError(t, err, "cannot create cookie jar")
+
+	client := &Client{
+		T:              t,
+		baseURL:        GetBaseURL(),
+		role:           role,
+		organizationID: ownerClient.organizationID,
+		httpClient: &http.Client{
+			Jar:     jar,
+			Timeout: 30 * time.Second,
+		},
+	}
+
+	client.setupTestUserInOrg(ownerClient)
+
+	return client
+}
+
+func (c *Client) setupTestUser() {
+	uniqueID := generateUniqueID()
+	email := fmt.Sprintf("test-%s@e2e.probo.test", uniqueID)
+	password := "TestPassword123!"
+	fullName := fmt.Sprintf("Test User %s", uniqueID)
+
+	// Sign up
+	c.userID = c.signUp(email, password, fullName)
+
+	// Create organization (this makes the user an OWNER)
+	orgName := fmt.Sprintf("Test Org %s", uniqueID)
+	c.organizationID = c.createOrganization(orgName)
+
+	// If the role is not OWNER, we need to adjust the membership
+	if c.role != RoleOwner {
+		c.updateOwnMembershipRole(coredata.MembershipRole(c.role))
+	}
+}
+
+func (c *Client) setupTestUserInOrg(ownerClient *Client) {
+	uniqueID := generateUniqueID()
+	email := fmt.Sprintf("test-%s@e2e.probo.test", uniqueID)
+	password := "TestPassword123!"
+	fullName := fmt.Sprintf("Test User %s", uniqueID)
+
+	// Sign up new user
+	c.userID = c.signUp(email, password, fullName)
+
+	// Owner invites user to organization
+	invitationID := ownerClient.inviteMember(email, fullName, coredata.MembershipRole(c.role))
+
+	// New user accepts invitation
+	c.acceptInvitation(invitationID)
+}
+
+func (c *Client) signUp(email, password, fullName string) gid.GID {
+	payload := map[string]string{
+		"email":    email,
+		"password": password,
+		"fullName": fullName,
+	}
+
+	body, err := json.Marshal(payload)
+	require.NoError(c.T, err, "cannot marshal sign-up payload")
+
+	req, err := http.NewRequest("POST", c.baseURL+"/connect/register", bytes.NewReader(body))
+	require.NoError(c.T, err, "cannot create sign-up request")
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := c.httpClient.Do(req)
+	require.NoError(c.T, err, "sign-up request failed")
+	defer resp.Body.Close()
+
+	respBody, _ := io.ReadAll(resp.Body)
+	require.Equal(c.T, http.StatusOK, resp.StatusCode, "sign-up failed: %s", string(respBody))
+
+	var result struct {
+		User struct {
+			ID string `json:"id"`
+		} `json:"user"`
+	}
+
+	err = json.Unmarshal(respBody, &result)
+	require.NoError(c.T, err, "cannot decode sign-up response")
+
+	userID, err := gid.ParseGID(result.User.ID)
+	require.NoError(c.T, err, "cannot parse user ID")
+
+	return userID
+}
+
+func (c *Client) createOrganization(name string) gid.GID {
+	const query = `
+		mutation($input: CreateOrganizationInput!) {
+			createOrganization(input: $input) {
+				organizationEdge {
+					node { id }
+				}
+			}
+		}
+	`
+
+	var result struct {
+		CreateOrganization struct {
+			OrganizationEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"organizationEdge"`
+		} `json:"createOrganization"`
+	}
+
+	err := c.Execute(query, map[string]any{
+		"input": map[string]any{"name": name},
+	}, &result)
+	require.NoError(c.T, err, "createOrganization mutation failed")
+
+	orgID, err := gid.ParseGID(result.CreateOrganization.OrganizationEdge.Node.ID)
+	require.NoError(c.T, err, "cannot parse organization ID")
+
+	return orgID
+}
+
+func (c *Client) updateOwnMembershipRole(role coredata.MembershipRole) {
+	// First get the membership ID
+	const queryMemberships = `
+		query($id: ID!) {
+			organization(id: $id) {
+				memberships(first: 100) {
+					edges {
+						node {
+							id
+							userId
+							role
+						}
+					}
+				}
+			}
+		}
+	`
+
+	var qResult struct {
+		Organization struct {
+			Memberships struct {
+				Edges []struct {
+					Node struct {
+						ID     string `json:"id"`
+						UserID string `json:"userId"`
+						Role   string `json:"role"`
+					} `json:"node"`
+				} `json:"edges"`
+			} `json:"memberships"`
+		} `json:"organization"`
+	}
+
+	err := c.Execute(queryMemberships, map[string]any{
+		"id": c.organizationID.String(),
+	}, &qResult)
+	require.NoError(c.T, err, "cannot query organization memberships")
+
+	var membershipID string
+	for _, edge := range qResult.Organization.Memberships.Edges {
+		if edge.Node.UserID == c.userID.String() {
+			membershipID = edge.Node.ID
+			break
+		}
+	}
+	require.NotEmpty(c.T, membershipID, "membership not found for user")
+
+	// Update the role
+	const updateQuery = `
+		mutation($input: UpdateMembershipInput!) {
+			updateMembership(input: $input) {
+				membership {
+					id
+					role
+				}
+			}
+		}
+	`
+
+	err = c.Execute(updateQuery, map[string]any{
+		"input": map[string]any{
+			"organizationId": c.organizationID.String(),
+			"memberId":       membershipID,
+			"role":           string(role),
+		},
+	}, nil)
+	require.NoError(c.T, err, "updateMembership mutation failed")
+}
+
+func (c *Client) inviteMember(email, fullName string, role coredata.MembershipRole) gid.GID {
+	const query = `
+		mutation($input: InviteUserInput!) {
+			inviteUser(input: $input) {
+				invitationEdge {
+					node { id }
+				}
+			}
+		}
+	`
+
+	var result struct {
+		InviteUser struct {
+			InvitationEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"invitationEdge"`
+		} `json:"inviteUser"`
+	}
+
+	err := c.Execute(query, map[string]any{
+		"input": map[string]any{
+			"organizationId": c.organizationID.String(),
+			"email":          email,
+			"fullName":       fullName,
+			"role":           string(role),
+			"createPeople":   false,
+		},
+	}, &result)
+	require.NoError(c.T, err, "inviteUser mutation failed")
+
+	invitationID, err := gid.ParseGID(result.InviteUser.InvitationEdge.Node.ID)
+	require.NoError(c.T, err, "cannot parse invitation ID")
+
+	return invitationID
+}
+
+func (c *Client) acceptInvitation(invitationID gid.GID) {
+	const query = `
+		mutation($input: AcceptInvitationInput!) {
+			acceptInvitation(input: $input) {
+				invitation {
+					id
+					status
+				}
+			}
+		}
+	`
+
+	err := c.Execute(query, map[string]any{
+		"input": map[string]any{
+			"invitationId": invitationID.String(),
+		},
+	}, nil)
+	require.NoError(c.T, err, "acceptInvitation mutation failed")
+}
+
+// GetUserID returns the authenticated user's ID
+func (c *Client) GetUserID() gid.GID {
+	return c.userID
+}
+
+// GetOrganizationID returns the test organization's ID
+func (c *Client) GetOrganizationID() gid.GID {
+	return c.organizationID
+}
+
+// GetRole returns the client's role
+func (c *Client) GetRole() TestRole {
+	return c.role
+}
--- a/e2e/internal/testutil/graphql.go
+++ b/e2e/internal/testutil/graphql.go
@@ -0,0 +1,307 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package testutil
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"mime/multipart"
+	"net/http"
+	"net/textproto"
+
+	"github.com/stretchr/testify/require"
+)
+
+// GraphQLRequest represents a GraphQL request payload.
+type GraphQLRequest struct {
+	Query     string         `json:"query"`
+	Variables map[string]any `json:"variables,omitempty"`
+}
+
+// GraphQLResponse represents a GraphQL response.
+type GraphQLResponse struct {
+	Data   json.RawMessage `json:"data"`
+	Errors []GraphQLError  `json:"errors,omitempty"`
+}
+
+// GraphQLError represents a GraphQL error.
+type GraphQLError struct {
+	Message    string         `json:"message"`
+	Path       []any          `json:"path,omitempty"`
+	Extensions map[string]any `json:"extensions,omitempty"`
+}
+
+func (e GraphQLError) Error() string {
+	return e.Message
+}
+
+// Code returns the error code from extensions, or empty string if not present.
+func (e GraphQLError) Code() string {
+	if e.Extensions == nil {
+		return ""
+	}
+	if code, ok := e.Extensions["code"].(string); ok {
+		return code
+	}
+	return ""
+}
+
+// GraphQLErrors is a collection of GraphQL errors.
+type GraphQLErrors []GraphQLError
+
+func (e GraphQLErrors) Error() string {
+	if len(e) == 0 {
+		return ""
+	}
+	if len(e) == 1 {
+		return e[0].Message
+	}
+	return fmt.Sprintf("%s (and %d more errors)", e[0].Message, len(e)-1)
+}
+
+// Do executes a raw GraphQL request and returns the response.
+func (c *Client) Do(query string, variables map[string]any) (*GraphQLResponse, error) {
+	reqBody := GraphQLRequest{
+		Query:     query,
+		Variables: variables,
+	}
+
+	body, err := json.Marshal(reqBody)
+	if err != nil {
+		return nil, fmt.Errorf("cannot marshal request: %w", err)
+	}
+
+	req, err := http.NewRequest("POST", c.baseURL+"/api/console/v1/query", bytes.NewReader(body))
+	if err != nil {
+		return nil, fmt.Errorf("cannot create request: %w", err)
+	}
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	respBody, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("cannot read response: %w", err)
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("unexpected status %d: %s", resp.StatusCode, string(respBody))
+	}
+
+	var gqlResp GraphQLResponse
+	if err := json.Unmarshal(respBody, &gqlResp); err != nil {
+		return nil, fmt.Errorf("cannot decode response: %w", err)
+	}
+
+	if len(gqlResp.Errors) > 0 {
+		return &gqlResp, GraphQLErrors(gqlResp.Errors)
+	}
+
+	return &gqlResp, nil
+}
+
+// Execute runs a GraphQL query/mutation and unmarshals the result into the provided struct.
+// The result should be a pointer to a struct that matches the expected response shape.
+//
+// Example:
+//
+//	var result struct {
+//		CreateVendor struct {
+//			VendorEdge struct {
+//				Node struct {
+//					ID   string `json:"id"`
+//					Name string `json:"name"`
+//				} `json:"node"`
+//			} `json:"vendorEdge"`
+//		} `json:"createVendor"`
+//	}
+//	err := client.Execute(`
+//		mutation($input: CreateVendorInput!) {
+//			createVendor(input: $input) {
+//				vendorEdge {
+//					node { id name }
+//				}
+//			}
+//		}
+//	`, map[string]any{"input": map[string]any{"organizationId": orgID, "name": "AWS"}}, &result)
+func (c *Client) Execute(query string, variables map[string]any, result any) error {
+	resp, err := c.Do(query, variables)
+	if err != nil {
+		return err
+	}
+
+	if result != nil && resp.Data != nil {
+		if err := json.Unmarshal(resp.Data, result); err != nil {
+			return fmt.Errorf("cannot unmarshal data: %w", err)
+		}
+	}
+
+	return nil
+}
+
+// MustExecute runs a GraphQL query/mutation and fails the test if there's an error.
+func (c *Client) MustExecute(query string, variables map[string]any, result any) {
+	c.T.Helper()
+	err := c.Execute(query, variables, result)
+	require.NoError(c.T, err, "GraphQL request failed")
+}
+
+// ExecuteShouldFail runs a GraphQL query/mutation and expects it to return an error.
+// Returns the error for further assertions.
+func (c *Client) ExecuteShouldFail(query string, variables map[string]any) error {
+	c.T.Helper()
+	_, err := c.Do(query, variables)
+	require.Error(c.T, err, "expected GraphQL request to fail but it succeeded")
+	return err
+}
+
+// HTTPClient returns the underlying HTTP client for making non-GraphQL requests.
+func (c *Client) HTTPClient() *http.Client {
+	return c.httpClient
+}
+
+// BaseURL returns the base URL of the test server.
+func (c *Client) BaseURL() string {
+	return c.baseURL
+}
+
+// UploadFile represents a file to be uploaded in a GraphQL mutation.
+type UploadFile struct {
+	Filename    string
+	ContentType string
+	Content     []byte
+}
+
+// ExecuteWithFile runs a GraphQL mutation with a file upload using multipart form data.
+// The variablePath specifies where in the variables the file should be placed (e.g., "input.file").
+func (c *Client) ExecuteWithFile(query string, variables map[string]any, variablePath string, file UploadFile, result any) error {
+	return c.executeMultipart(query, variables, map[string]UploadFile{variablePath: file}, result)
+}
+
+// ExecuteWithFiles runs a GraphQL mutation with multiple file uploads using multipart form data.
+// The files map specifies variable paths to files (e.g., {"input.file": file1, "input.attachment": file2}).
+func (c *Client) ExecuteWithFiles(query string, variables map[string]any, files map[string]UploadFile, result any) error {
+	return c.executeMultipart(query, variables, files, result)
+}
+
+func (c *Client) executeMultipart(query string, variables map[string]any, files map[string]UploadFile, result any) error {
+	// Create multipart writer using standard library
+	var buf bytes.Buffer
+	writer := multipart.NewWriter(&buf)
+
+	// Build the operations JSON
+	operations := map[string]any{
+		"query":     query,
+		"variables": variables,
+	}
+	operationsJSON, err := json.Marshal(operations)
+	if err != nil {
+		return fmt.Errorf("cannot marshal operations: %w", err)
+	}
+
+	// Add operations part
+	if err := writer.WriteField("operations", string(operationsJSON)); err != nil {
+		return fmt.Errorf("cannot write operations field: %w", err)
+	}
+
+	// Build the map for file variables (sorted for deterministic order)
+	fileMap := make(map[string][]string)
+	fileOrder := make([]string, 0, len(files))
+	for path := range files {
+		fileOrder = append(fileOrder, path)
+	}
+	// Sort for deterministic ordering
+	for i, path := range fileOrder {
+		fileMap[fmt.Sprintf("%d", i)] = []string{"variables." + path}
+	}
+	mapJSON, err := json.Marshal(fileMap)
+	if err != nil {
+		return fmt.Errorf("cannot marshal map: %w", err)
+	}
+
+	// Add map part
+	if err := writer.WriteField("map", string(mapJSON)); err != nil {
+		return fmt.Errorf("cannot write map field: %w", err)
+	}
+
+	// Add file parts
+	for i, path := range fileOrder {
+		file := files[path]
+		fieldName := fmt.Sprintf("%d", i)
+
+		// Create form file part with proper headers
+		h := make(textproto.MIMEHeader)
+		h.Set("Content-Disposition", fmt.Sprintf(`form-data; name="%s"; filename="%s"`, fieldName, file.Filename))
+		h.Set("Content-Type", file.ContentType)
+
+		part, err := writer.CreatePart(h)
+		if err != nil {
+			return fmt.Errorf("cannot create file part %s: %w", path, err)
+		}
+		if _, err := part.Write(file.Content); err != nil {
+			return fmt.Errorf("cannot write file content %s: %w", path, err)
+		}
+	}
+
+	if err := writer.Close(); err != nil {
+		return fmt.Errorf("cannot close multipart writer: %w", err)
+	}
+
+	// Create request
+	req, err := http.NewRequest("POST", c.baseURL+"/api/console/v1/query", &buf)
+	if err != nil {
+		return fmt.Errorf("cannot create request: %w", err)
+	}
+	req.Header.Set("Content-Type", writer.FormDataContentType())
+
+	// Execute request
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	respBody, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return fmt.Errorf("cannot read response: %w", err)
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("unexpected status %d: %s", resp.StatusCode, string(respBody))
+	}
+
+	var gqlResp GraphQLResponse
+	if err := json.Unmarshal(respBody, &gqlResp); err != nil {
+		return fmt.Errorf("cannot decode response: %w", err)
+	}
+
+	if len(gqlResp.Errors) > 0 {
+		return GraphQLErrors(gqlResp.Errors)
+	}
+
+	if result != nil && gqlResp.Data != nil {
+		if err := json.Unmarshal(gqlResp.Data, result); err != nil {
+			return fmt.Errorf("cannot unmarshal data: %w", err)
+		}
+	}
+
+	return nil
+}
--- a/e2e/internal/testutil/testutil.go
+++ b/e2e/internal/testutil/testutil.go
@@ -0,0 +1,202 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+// Package testutil provides end-to-end testing infrastructure for the Probo API.
+//
+// This package runs an external probod binary for realistic e2e testing.
+// It supports coverage collection when using a coverage-instrumented binary.
+//
+// Required environment variables:
+//   - PROBO_E2E_BINARY: Path to the probod binary
+//   - PROBO_E2E_CONFIG: Path to the config file
+//
+// Optional environment variables:
+//   - PROBO_E2E_COVERDIR: Directory for coverage data (enables coverage collection)
+//
+// Example usage:
+//
+//	# Build the binary (with coverage)
+//	go build -cover -o bin/probod-coverage ./cmd/probod
+//
+//	# Run e2e tests
+//	PROBO_E2E_BINARY=./bin/probod-coverage \
+//	PROBO_E2E_COVERDIR=./coverage/e2e \
+//	PROBO_E2E_CONFIG=./e2e/console/testdata/config.yaml \
+//	go test -v ./e2e/console/...
+//
+//	# Generate coverage report
+//	go tool covdata textfmt -i=./coverage/e2e -o=coverage-e2e.out
+//	go tool cover -html=coverage-e2e.out -o=coverage-e2e.html
+package testutil
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"os/exec"
+	"sync"
+	"syscall"
+	"time"
+)
+
+var (
+	testEnv   *TestEnv
+	setupOnce sync.Once
+)
+
+// TestEnv holds the test environment state
+type TestEnv struct {
+	BaseURL string
+	cmd     *exec.Cmd
+	done    chan error
+}
+
+// Setup initializes the test environment. Call this from TestMain.
+// It starts probod with the provided configuration and waits for it to be ready.
+//
+// Example:
+//
+//	func TestMain(m *testing.M) {
+//	    testutil.Setup()
+//	    code := m.Run()
+//	    testutil.Teardown()
+//	    os.Exit(code)
+//	}
+func Setup() {
+	setupOnce.Do(func() {
+		binaryPath := os.Getenv("PROBO_E2E_BINARY")
+		configPath := os.Getenv("PROBO_E2E_CONFIG")
+		coverDir := os.Getenv("PROBO_E2E_COVERDIR")
+
+		if binaryPath == "" {
+			fmt.Fprintf(os.Stderr, "e2etest: PROBO_E2E_BINARY is required\n")
+			os.Exit(1)
+		}
+
+		if configPath == "" {
+			fmt.Fprintf(os.Stderr, "e2etest: PROBO_E2E_CONFIG is required\n")
+			os.Exit(1)
+		}
+
+		// Create coverage directory if specified
+		if coverDir != "" {
+			if err := os.MkdirAll(coverDir, 0755); err != nil {
+				fmt.Fprintf(os.Stderr, "e2etest: cannot create coverage directory: %v\n", err)
+				os.Exit(1)
+			}
+		}
+
+		testEnv = &TestEnv{
+			done: make(chan error, 1),
+		}
+
+		// Start the external binary
+		// Note: We use exec.Command instead of exec.CommandContext because
+		// CommandContext sends SIGKILL on context cancel, which prevents the
+		// binary from writing coverage data. We manage the process lifecycle
+		// manually in Teardown() using SIGTERM for graceful shutdown.
+		cmd := exec.Command(binaryPath, "-cfg-file", configPath)
+		if coverDir != "" {
+			cmd.Env = append(os.Environ(), "GOCOVERDIR="+coverDir)
+		} else {
+			cmd.Env = os.Environ()
+		}
+		cmd.Stdout = io.Discard
+		cmd.Stderr = io.Discard
+
+		testEnv.cmd = cmd
+
+		if err := cmd.Start(); err != nil {
+			fmt.Fprintf(os.Stderr, "e2etest: cannot start binary: %v\n", err)
+			os.Exit(1)
+		}
+
+		// Wait for process to exit in background
+		go func() {
+			err := cmd.Wait()
+			testEnv.done <- err
+		}()
+
+		// TODO: Parse config file to get actual port
+		testEnv.BaseURL = "http://localhost:18080"
+
+		// Wait for server to be ready
+		ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+		defer cancel()
+		if err := waitForServer(ctx, testEnv.BaseURL, 30*time.Second); err != nil {
+			fmt.Fprintf(os.Stderr, "e2etest: server failed to start: %v\n", err)
+			testEnv.cmd.Process.Kill()
+			os.Exit(1)
+		}
+	})
+}
+
+func waitForServer(ctx context.Context, baseURL string, timeout time.Duration) error {
+	deadline := time.Now().Add(timeout)
+	client := &http.Client{Timeout: 2 * time.Second}
+
+	for time.Now().Before(deadline) {
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		default:
+		}
+
+		req, err := http.NewRequestWithContext(ctx, "GET", baseURL+"/api/console/v1/query", nil)
+		if err != nil {
+			return err
+		}
+
+		resp, err := client.Do(req)
+		if err == nil {
+			resp.Body.Close()
+			// Any response means server is up
+			return nil
+		}
+
+		time.Sleep(100 * time.Millisecond)
+	}
+
+	return fmt.Errorf("server did not become ready within %v", timeout)
+}
+
+// Teardown shuts down the test environment. Call this after m.Run() in TestMain.
+func Teardown() {
+	if testEnv == nil {
+		return
+	}
+
+	if testEnv.cmd != nil && testEnv.cmd.Process != nil {
+		// Send SIGTERM for graceful shutdown (allows coverage data to be written)
+		testEnv.cmd.Process.Signal(syscall.SIGTERM)
+
+		// Wait for graceful shutdown with timeout
+		select {
+		case <-testEnv.done:
+		case <-time.After(10 * time.Second):
+			testEnv.cmd.Process.Kill()
+			<-testEnv.done
+		}
+	}
+}
+
+// GetBaseURL returns the base URL of the test server
+func GetBaseURL() string {
+	if testEnv == nil {
+		return "http://localhost:8080"
+	}
+	return testEnv.BaseURL
+}