Supercheck LogoSupercheck

Custom Test

Write custom Node.js test scriptsEdit

Write custom test scripts for advanced scenarios that don't fit into browser, API, or database categories. Custom tests run in isolated Kubernetes jobs using gVisor and the Playwright, HTTP, data, and database packages included in the runner.

Create Test

  1. Go to Create → Custom Test
  2. Write TypeScript/JavaScript code
  3. Run and debug
  4. Save when passing

Example

Set API_URL to a test API you control that persists posts and supports POST /posts, GET /posts/:id, and DELETE /posts/:id. Public mock APIs that simulate writes cannot verify this workflow.

import { expect, test } from '@playwright/test';

const API_URL = getVariable('API_URL');

// Use serial mode to share state (createdId) between tests
test.describe.serial('posts CRUD', () => {
  let createdId: number | undefined;

  test('creates a post', async ({ request }) => {
    const response = await request.post(API_URL + '/posts', {
      data: { title: 'Playwright', body: 'API example', userId: 1 },
    });

    expect(response.status()).toBe(201);
    const json = await response.json();
    createdId = json.id;
    expect(json).toMatchObject({ title: 'Playwright', body: 'API example' });
  });

  test('fetches the created post', async ({ request }) => {
    // Skip if creation failed
    test.skip(!createdId, 'create step failed');
    
    const response = await request.get(API_URL + '/posts/' + createdId);
    expect(response.ok()).toBeTruthy();
    const json = await response.json();
    expect(json.id).toBe(createdId);
  });

  // Cleanup after all tests in this group
  test.afterAll(async ({ request }) => {
    if (!createdId) return;
    await request.delete(API_URL + '/posts/' + createdId);
  });
});

Features

  • Sandboxed TypeScript and JavaScript execution
  • Approved packages including Playwright, Axios, Zod, date-fns, Faker, and supported database drivers
  • Access to variables with getVariable()
  • Access to secrets with getSecret()
  • Custom assertions and complex logic

Use Cases

  • Multi-step workflows — Create, update, delete sequences
  • Data validation — Complex business logic checks
  • Integration tests — Multiple services in one test
  • API and database workflows — Exercise supported services with approved clients

Server-side script validation checks syntax, script limits, and runner compatibility. It is feedback for submitted scripts, not a security boundary; runtime isolation is provided by gVisor and Kubernetes policy. The execution filesystem has a read-only root, while /tmp and shared memory are writable. Use readFile() and getFile() to access injected files portably. Public TCP egress is available for test targets; private and cluster destinations are blocked.

On this page