What is a "story"?

I got asked today by my Boss, "what is a story?" so i gave him a 5 minute overview, then i realised i could share this.

Simply put a story is a very short (should fit on an description of a piece of functionality.
A story serves several purposes.
It is used to estimate and identify areas of risk during initial release planning and ongoing through development.
A story is always written from the business perspective, and is normally based on an action (e.g. display search results, search stock).
A story is testable through the UI if application is UI based.
Our Stories are written using the form: "As an X I want to Y so I can Z"
Stories answer these questions:

• Who is 'doing' the story (As an X).
• What action is being taken (I want to Y).
• What business need is the story hitting? (so I can Z).

They are at first very high level and i've found that initial story cards are almost always revised and rewritten. They are usually rewritten to lower levels of granularity so that at development time they are testable.

They are small enough that it only takes one iteration to complete. If they are too complex, they are expanded into narratives.
Stories can be either functional or non-functional, E.g. performance should be a story.

ThoughtWorks write the stories on ThoughtWorks branded index cards which are 147mm wide and 104mm high which are bigger than the index cards we could get from our stationers. (Who stocks these size cards? Viking have them on-line, but staples have them in store only. They are called 6x4 index cards by both)

They write on the cards to ensure the story is kept to a small size, this helps the customer "see" what they are saying. The cards are usually kept visible on a board. a Kanban board.

In Agile projects, it's common practice to share the project status via "big visible charts" on a wall in the project room (or elsewhere if a room is not available).

Kanban is a Japanese word which loosely translated, means card or sign. In a "Lean" production system, Kanban is a method which uses standard units or lot sizes (our story cards). The methodology dictates that a new card is only "pulled" into the system when the work represented by a card that is "in Play" is completed.

It works really well. I was away from the project for a couple of days to deal with recruitment. When i returned to the meeting i was able to jump straight in after reading the board for few minutes and attending the morning meeting.

Testers - Thou Shall Not Cut Code!

okay, so its been a while since my last post, and we have some very frustrating times, i'll try to remember them now.

One of our 500lb gorillas is the fact that Fitnesse out of the box comes with limited functionality. By that i mean if you want to pull a value from a database and assert that it is being displayed in the users browser (via selenium) then you have to write your own Java class. As i said before we are a team of dedicated web testers, and while we are very technical testers, we are not Java programmers. So we looked round for some possible solutions to our dilemma.

First up is Anubhava’s Generic Fixture. Anubhava has had the same thoughts as me, but has the skills to actually put the idea into fruition. His generic fixture allows the fitnesse scriptee to write in DSL without writing a single line of Java, eureka!

i tried using the generic fixture for connecting to the DB. However we use Oracle 10G and our connection string details two nodes. In the examples Anubhava gives, the fixture accepts the usual server, port, dbname, user, password strings.

I thought i would share this with any other visitors who may use generic fixture and use similar JDBC connection strings to us. OracleDataSource will accept a url, so i amened Anubhavas example fitnesse tables to

| Generic Fixture | oracle.jdbc.pool.OracleDataSource |
| setDriverType | thin |
| setURL | jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS_LIST =(ADDRESS=(PROTOCOL=TCP)(HOST=node1)(PORT=1521))(ADDRESS=(PROTOCOL=TCP)(HOST=node2)(PORT=1521)))(CONNECT_DATA =(SERVICE_NAME=WEB)))
| setUser | db_user |
| setPassword | db_user_password |
| conn=getConnection |

and we can now connect to our DB, and script without writing Java.

Next up is Gojko Adzic's DbFit another fixture for fitnesse, and comes with some examples for .net and Java and Oracle.

A little bit more of a learning curve with this one, but still within the realms of what we can manage as testers. We can use DbFit with the WebTest fixture and again accomplish a lot without writing any Java.

I guess i should point out here that its not just writing the Java, its where to store it (CVS), compiling the code, keeping it up to date, making sure we are using the right versions of drivers (ojdbc14), that we have the right environment variables set-up and so on. All of a sudden the line between the bounds of a tester and developer have become so blurred. Well okay, maybe i wouldn't just test the "happy path" :-)

Automate This

A big bucket of rambley nonsense about automating web testing

Okay, so we have been trying to grapple with FitNesse and Selenium to produce automated "acceptance" tests for our continuous integration development.

Before we brought ThoughtWorks in i had already been looking at automated test tools. There are lots of tools out there, some very simple (yet effective) and other very complicated.

Some of these tools profess to be web testing tools, while others claim to be able to test anything. Having said that any tool that requires me to purchase an add-on or plug-in to achieve automated testing is going to get shot down straight away. Testing is core to what i do I'm a tester, so far as i'm concerned testing is not an add on.

I thought i would get my thoughts on automation down, so should the wheels of the fabled bus ever get chance to put my mothers under-cracker warnings to the test my ramblings can be copy and pasted into someone else' documentation.

During the usual testing activities we aim to undertake the following test activities:

1) Functionality Testing
2) Usability testing
3) GUI\Interface testing
4) Browser Compatibility testing
5) Performance testing
6) Security testing

The list isn't in any particular order and none is implied. But any seasoned tester will recognise that i'm talking about the upper right hand side of the V model, wheras FitNesse has traditionaly been used further down.

1) Functionality Testing:

It isn't immediately obvious what functional testing means when talking about web testing. If you are sat in front of a static html page, that is merely a funnel into a web application you are fairly limited in the amount of functional testing you can do. All web pages can be functionally tested for working includes (css, images, etc.) testing all the links, forms, images,JavaScript and cookies. All the individual elements that are used to make up a web page. Lets take a more in depth look at this.

Link checking:

Once aspect of functional testing of web pages, checks links for broken or malformed types of:

• Outgoing links
• Internal links.
• named anchors.
  
• links used to send email (mailto).

If its possible (its not always possible to get access the the disc) test for orphaned objects. Note that i didn't mention things like SEO within the context of functionality testing or links, because i see that as being non functional testing of a link. I also didn't mention that the link was tagged appropriately for disabled users, because again this is covered later on. What should be covered is that the link is tagged appropriately for whichever analytic packages is being used by the website.

Test forms:
Forms were previously essential for submitting user information, but thanks to web 2.0 they are starting to disappear. Nevertheless, they still need to be tested for

• input validations (where applied).
• default values of fields (where set).
• constraints (sting length, numerical, alpha etc).

I haven't mentioned the error handling for the actual submission be cause that is the responsibility of the functionality within url the form points at, and not the form itself.

Cookies:
Testing Cookies, can be a right PITA. Thankfully firefox and its numerous wonderful plugins like web developer and firebug have made our life a lot easier. Cookie testing normally covers:

• cookies enabled
• cookies disabled
• cookies deleted
• cookies set
• cookies read
• cookies updated
  

We often visually inspect the cookie to make sure the developer hasn't done something incredibly stupid like store the username and password in the cookie in plain text.

Database testing:
Data consistency is very important in web application. Check for data integrity and errors while you edit, delete, modify the forms or do any DB related functionality.
Check if all the database queries are executing correctly, data is retrieved correctly and also updated correctly. More on database testing could be load on DB, we will address this in web load or performance testing below.

2) Usability Testing:

Test for navigation:
Navigation means how the user surfs the web pages, different controls like buttons, boxes or how user using the links on the pages to surf different pages.
Usability testing includes:
Web site should be easy to use. Instructions should be provided clearly. Check if the provided instructions are correct means whether they satisfy purpose.
Main menu should be provided on each page. It should be consistent.

Content checking:
Content should be logical and easy to understand. Check for spelling errors. Use of dark colors annoys users and should not be used in site theme. You can follow some standards that are used for web page and content building. These are common accepted standards like as I mentioned above about annoying colours, fonts, frames etc.
Content should be meaningful. All the anchor text links should be working properly. Images should be placed properly with proper sizes.
These are some basic standards that should be followed in web development. Your task is to validate all for UI testing

Other user information for user help:
Like search option, sitemap, help files etc. Sitemap should be present with all the links in web sites with proper tree view of navigation. Check for all links on the sitemap.
“Search in the site” option will help users to find content pages they are looking for easily and quickly. These are all optional items and if present should be validated.

3) Interface Testing:
The main interfaces are:

Web server and application server interface
Application server and Database server interface.

Check if all the interactions between these servers are executed properly. Errors are handled properly. If database or web server returns any error message for any query by application server then application server should catch and display these error messages appropriately to users. Check what happens if user interrupts any transaction in-between? Check what happens if connection to web server is reset in between?

4) Compatibility Testing:
Compatibility of your web site is very important testing aspect. See which compatibility test to be executed:

• Browser compatibility
• Operating system compatibility
• Mobile browsing
• Printing options

Browser compatibility:
In my web-testing career I have experienced this as most influencing part on web site testing.
Some applications are very dependent on browsers. Different browsers have different configurations and settings that your web page should be compatible with. Your web site coding should be cross browser platform compatible. If you are using java scripts or AJAX calls for UI functionality, performing security checks or validations then give more stress on browser compatibility testing of your web application.
Test web application on different browsers like Internet explorer, Firefox, Netscape navigator, AOL, Safari, Opera browsers with different versions.

OS compatibility:
Some functionality in your web application is may not be compatible with all operating systems.
We Test our web application on different operating systems like Windows, MAC, Linux with different OS flavors. What can work in MSIE7 on Windows XP with service pack three, will fail onMSIE7 Windows Vista Home, but work on MSIE7 with Windows Vista Office Premium.

Mobile browsing:
This is a tough one. We get thousands of visitors a day using mobile devices, and even games consoles to view our site.

Printing options:
If you are giving page-printing options then make sure fonts, page alignment, page graphics getting printed properly. Pages should be fit to paper size or as per the size mentioned in printing option.

5) Performance testing:
Web application should sustain to heavy load. Web performance testing should include:
Web Load Testing
Web Stress Testing

Test application performance on different internet connection speed.
In web load testing test if many users are accessing or requesting the same page. Can system sustain in peak load times? Site should handle many simultaneous user requests, large input data from users, Simultaneous connection to DB, heavy load on specific pages etc.

Stress testing: Generally stress means stretching the system beyond its specification limits. Web stress testing is performed to break the site by giving stress and checked how system reacts to stress and how system recovers from crashes.
Stress is generally given on input fields, login and sign up areas.

In web performance testing web site functionality on different operating systems, different hardware platforms is checked for software, hardware memory leakage errors,

6) Security Testing:

Following are some test cases for web security testing:

• Test by pasting internal url directly into browser address bar without login. Internal pages should not open.
• If you are logged in using username and password and browsing internal pages then try changing url options directly. I.e. If you are checking some publisher site statistics with publisher site ID= 123. Try directly changing the url site ID parameter to different site ID which is not related to logged in user. Access should denied for this user to view others stats.
• Try some invalid inputs in input fields like login username, password, input text boxes. Check the system reaction on all invalid inputs.
• Web directories or files should not be accessible directly unless given download option.
• Test the CAPTCHA for automates scripts logins.
• Test if SSL is used for security measures. If used proper message should get displayed when user switch from non-secure http:// pages to secure https:// pages and vice versa.
• All transactions, error messages, security breach attempts should get logged in log files somewhere on web server.

Creating FitNesse tests

Okay, so we are still having problems with CruiseControl (it falls over after n builds) but meanwhile i need to start creating tests in Fitnesse.

The ThoughtWorks consultant has already started, but i just reviewed the work and i'm less than impressed.

I want each page to contain some prose that describes what's being tested and why.

The structure of a requirement should follow a basic syntax. We should have a basic description of what is needed from a business perspective:

As a [role] I want [requirement] so that [business value].

And the tests should line up by defining an Acceptance criteria, basically we define what "done" looks like:

Given [context] when [action] then [outcome]

The Acceptance criteria should be written jointly by BA and QA, and the acceptance tests map directly to acceptance criteria.

So on each page (a test) i want a preamble (the story), the requirement and the acceptance criteria.

The Fit table (the actual test) can then sit directly under the prose for the acceptance criteria.

That way, each page (each test) is the requirement, the test and the test results.

Integrating Fitnesse with CruiseControl

So like i said in earlier posts we are implementing FitNesse on our java development projects (well to be precise just one) with help from ThoughtWorks so we can run automated acceptance tests.

We are still at the bashing the stick on the ground and making a lot of noise stage (so far as my Space odyssey metaphor goes), and we are not yet 100% convinced of the value of FitNesse within our organisation. The way it has been set-up so far, makes it unmaintainable, hard to navigate and it feels a bit flaky. Sure FitNesse is great where the requirements are a little thin on the ground, but i think there is an absolute requirement for process and procedure when it comes to building a suite of tests in FitNesse if it is ever going to have longevity. That is not slur on FitNesse, but i have yet to see any one describe how they build a suite that has some structure.

So today we are trying to get FitNesse and CruiseControl working together.
The dev team have used CruiseControl in the past, but it doesnt work properly (some issue with forking) and depending on how we look at cobertura we either have 27% coverage or 35% coverage of Unit test so there is some way for them to go. I hope can integrate the FitNesse Tests with the current build process and gain an extra layer of testing.

One thing as a tester i dislike about FitNesse is that lacks a lot (does it have any) of the reporting features you see on other test tools. So i will spend this afternoon looking at some free (as in beer) reporting tools. I also cant see how you do test selection, or report on test coverage....

Fitnesse for dummies?

We pride ourselves on our technical prowess, by we i mean my team and I and by team i mean the greater QA team at work.

As testers we are often thought of as not being technical and in some institutions it is actively discouraged. However being a technical tester is dependent on the domain you work in.

In our domain we need to be holistic on our approach to testing, we need to be multidisciplinary with skills in Linux, Apache, Jboss, J2EE and Oracle. We work for a large website so we all need to understand headers, HTTP, cookies, dynamic HTML/Json.

So it was with some surprise (read, it caught us out) that we found ourselves staring at FitNesse (the Acceptance Testing Framework) like the apes staring at the monolith at the start of 2001: A Space Odyssey (1968). We understand its importance, and we can see the benefits, but how do we turn it on? what makes it go?

Well a few hours later and to our horror we have installed JDK and eclipse and we are coding in java. But this doesn't really sit well at all, testers writing tests in java? who will test our tests?

Worse than this, we don't have Java coding skills across the team (nor do we want them) so what can we do?

A few googles later and we can see that we are not the only people that think this sucks. For every test case we write in Fitnesse we ill have to write a corresponding fixture (read some java code). Until i run across Anubhava's Tech Blog and his post Introducing Generic Fixture for FitNesse. Here he talks of the same problem of having write java code for every test. His solution is rather neat, the GenericFixture.

I followed his examples and hit a few dead ends, so i emailed Anubhava and after a few question from him discovered that what i believed to be the GenricFixture.jar was in fact a 700Kb web page (an error message from sourceforge). With the proper jar downloaded from sourceforge we are off and running, and can now write tests without cutting a single line of java, but wait that's not all...

Something was still unsettling about the whole deal, and that was the fact that FitNesse allows users to create tests using natural language.

here is a simple example in fitness

users opens the URL	http://www.google.co.uk
page has the title		Google
page has an element named	q		true
page has an element named	btnG		true
user types	chocolate	into	q	field
user clicks on the button named	btnG
page loads in less than	5	seconds
page has the title		chocolate - Google Search
user clicks on the link named	Chocolate - Wikipedia, the free encyclopedia
page loads in less than	5	seconds
page has the title		Chocolate - Wikipedia, the free encyclopedia

and here is the same example in selenease

open	http://www.google.co.uk
assertTitle	Google
type	q	chocolate
clickAtAndWait	btnG
assertTitle	chocolate - Google Search
clickAtAndWait	link=Chocolate - Wikipedia, the free encyclopedia
assertTitle	Chocolate - Wikipedia, the free encyclopedia

As you can see the FitNesse example is easily read and understood whereas the selenim version requires the user to understand the selenium syntax (selenease).

Our friend Anubhava (above) had hit upon the same problem, and implemented a Domain Specific Language (DLS) adepter for the GenricFixture, so problem solved, for now...

Running Selenium with proxy exceptions

The way we have our QA environment set-up we use a DNS server this allows us to mimic the live environment (the customer facing server names are the same as in the production environment). It sounds ideal however it isn't without problems. We cant set-up a banner server in our environment (because we use a third party banner service) nor can we set-up a WA server (we use multiple WA vendors) so we have to use proxy exceptions that excludes everything from going through the proxy that exists in inside the QA environment.

This obviously means we can end up with a pretty big proxy exceptions list in our browser. Firefox isn't a problem as there are a couple of plug ins available that can manage multiple proxy settings. However IE requires us to use a hand crafted batch file to update registry settings. Not really a problem, and we are comfortable with how it works. It rarely catches us out.

Now when we cam to automate our tests with selenium we ran into a problem. We needed to tell selenium to use our corporate proxy so it can proxy request to the outside world, and when selenium starts the browser it tell the browser to use a particular PAC file that is generated at test run time. The PAC file is quite simple and tells the browser to use Selenium for anything that lies within the SUT else go external. sound's great except that it doesn't work.
We read a few forum posts, and blog posts and scratched our heads. Finally we opened the Selenium source code and found that we could in fact pass in a list of hosts to apply to the proxy exceptions list. We were feeling pretty jaded are spending hours of google time on it, why its not documented clearly anywhere i don't know.

Okay, so our startup command for selenium looked like this

java -Dhttp.proxyHost=proxy.ourdomain.co.uk -Dhttp.proxyPort=8080 -jar selenium-server.jar –avoidProxy

To add proxy avoidance you specify the hosts you want to avoid through the proxy and delimit with the pipe character |, but we then found we had to delimit the pipe character with the caret ^

-Dhttp.nonProxyHosts=*www.ourdomain.co.uk*^|*search.ourdomain.co.uk*

So our new selenium startup string looked like this

java -Dhttp.proxyHost=proxy.ourdomain.co.uk -Dhttp.proxyPort=8080 -Dhttp.nonProxyHosts=*www.ourdomain.co.uk*^|*search.ourdomain.co.uk* -jar selenium-server.jar –avoidProxy

This means that if the request is for anything other than www. or search . on our domain, selenium forwards it through our corporate proxy.