test(security): add comprehensive security tests

- Test password complexity requirements - Test account lockout mechanism - Test rate limiting functionality - Test JWT expiration (1 hour) - Test refresh token expiration (7 days) - Test password requirements list - Verify transaction manager and error handler types - All tests passing
2026-01-29 09:23:34 -05:00
parent 311361a2ed
commit 1e04ef4861
6 changed files with 528 additions and 20 deletions
@@ -0,0 +1,85 @@
+{
+  "meta": {
+    "name": "Logout User",
+    "type": "http",
+    "seq": 1,
+    "auth": "Inherit"
+  },
+  "request": {
+    "method": "POST",
+    "header": [
+      {
+        "name": "Content-Type",
+        "value": "application/json"
+      }
+    ],
+    "body": {
+      "type": "json",
+      "json": {
+        "refresh_token": "{{refreshToken}}"
+      }
+    },
+    "url": {
+      "raw": "{{baseUrl}}/api/auth/logout",
+      "host": ["{{baseUrl}}"],
+      "path": ["api", "auth", "logout"]
+    },
+    "description": "Logs out the user by revoking their refresh token. If no refresh token is provided, the request succeeds but no token is revoked."
+  },
+  "response": [
+    {
+      "name": "Success Response",
+      "originalRequest": {
+        "method": "POST",
+        "header": [],
+        "body": {
+          "type": "json",
+          "json": {
+            "refresh_token": "valid-refresh-token-uuid"
+          }
+        },
+        "url": {
+          "raw": "{{baseUrl}}/api/auth/logout",
+          "host": ["{{baseUrl}}"],
+          "path": ["api", "auth", "logout"]
+        }
+      },
+      "status": 200,
+      "code": 200,
+      "header": [
+        {
+          "name": "content-type",
+          "value": "application/json"
+        }
+      ],
+      "body": "{\n  \"message\": \"logged out successfully\"\n}",
+      "description": "Successfully logged out and refresh token revoked."
+    },
+    {
+      "name": "Logout Without Refresh Token",
+      "originalRequest": {
+        "method": "POST",
+        "header": [],
+        "body": {
+          "type": "json",
+          "json": {}
+        },
+        "url": {
+          "raw": "{{baseUrl}}/api/auth/logout",
+          "host": ["{{baseUrl}}"],
+          "path": ["api", "auth", "logout"]
+        }
+      },
+      "status": 200,
+      "code": 200,
+      "header": [
+        {
+          "name": "content-type",
+          "value": "application/json"
+        }
+      ],
+      "body": "{\n  \"message\": \"logged out successfully\"\n}",
+      "description": "Logout succeeds even without a refresh token."
+    }
+  ]
+}
@@ -0,0 +1,87 @@
+{
+  "meta": {
+    "name": "Refresh Access Token",
+    "type": "http",
+    "seq": 1,
+    "auth": "Inherit"
+  },
+  "request": {
+    "method": "POST",
+    "header": [
+      {
+        "name": "Content-Type",
+        "value": "application/json"
+      }
+    ],
+    "body": {
+      "type": "json",
+      "json": {
+        "refresh_token": "{{refreshToken}}"
+      }
+    },
+    "url": {
+      "raw": "{{baseUrl}}/api/auth/refresh",
+      "host": ["{{baseUrl}}"],
+      "path": ["api", "auth", "refresh"]
+    },
+    "description": "Refreshes an access token using a valid refresh token. Returns a new access token with 1-hour expiration."
+  },
+  "response": [
+    {
+      "name": "Success Response",
+      "originalRequest": {
+        "method": "POST",
+        "header": [],
+        "body": {
+          "type": "json",
+          "json": {
+            "refresh_token": "valid-refresh-token-uuid"
+          }
+        },
+        "url": {
+          "raw": "{{baseUrl}}/api/auth/refresh",
+          "host": ["{{baseUrl}}"],
+          "path": ["api", "auth", "refresh"]
+        }
+      },
+      "status": 200,
+      "code": 200,
+      "header": [
+        {
+          "name": "content-type",
+          "value": "application/json"
+        }
+      ],
+      "body": "{\n  \"access_token\": \"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...\",\n  \"token_type\": \"Bearer\",\n  \"expires_in\": 3600\n}",
+      "description": "Returns a new access token that expires in 1 hour (3600 seconds)."
+    },
+    {
+      "name": "Invalid Refresh Token",
+      "originalRequest": {
+        "method": "POST",
+        "header": [],
+        "body": {
+          "type": "json",
+          "json": {
+            "refresh_token": "invalid-token"
+          }
+        },
+        "url": {
+          "raw": "{{baseUrl}}/api/auth/refresh",
+          "host": ["{{baseUrl}}"],
+          "path": ["api", "auth", "refresh"]
+        }
+      },
+      "status": 401,
+      "code": 401,
+      "header": [
+        {
+          "name": "content-type",
+          "value": "application/json"
+        }
+      ],
+      "body": "{\n  \"error\": \"invalid or expired refresh token\"\n}",
+      "description": "Returned when the refresh token is invalid, expired, or has been revoked."
+    }
+  ]
+}