docs: add Carousel dashboard implementation plan
This commit is contained in:
@@ -1,53 +0,0 @@
|
||||
meta {
|
||||
name: Delete Account
|
||||
type: http
|
||||
seq: 4
|
||||
}
|
||||
|
||||
delete {
|
||||
url: {{base_url}}/api/auth/account
|
||||
body: none
|
||||
auth: inherit
|
||||
}
|
||||
|
||||
settings {
|
||||
encodeUrl: true
|
||||
timeout: 0
|
||||
}
|
||||
|
||||
docs {
|
||||
## Delete Account
|
||||
|
||||
Permanently deletes user account and all associated data.
|
||||
|
||||
**Method:** DELETE
|
||||
|
||||
**Endpoint:** /api/auth/account
|
||||
|
||||
**Authentication:** Required
|
||||
|
||||
**Usage:**
|
||||
- **Self-deletion**: DELETE /api/auth/account (no parameters)
|
||||
- **Admin deletion**: DELETE /api/auth/account?user_id={uuid} (admin only)
|
||||
|
||||
**Query Parameters (Admin only):**
|
||||
- `user_id` (string): UUID of user account to delete
|
||||
|
||||
**Response:**
|
||||
- `message` (string): Success message
|
||||
|
||||
**Status Codes:**
|
||||
- 200: Success
|
||||
- 400: Bad Request (invalid user_id or attempting to delete last admin)
|
||||
- 401: Unauthorized
|
||||
- 403: Forbidden (admin access required for user_id parameter)
|
||||
- 404: Not Found (user does not exist)
|
||||
|
||||
**Protection Rules:**
|
||||
- Regular users can only delete their own account
|
||||
- Admins can delete any account including other users
|
||||
- Cannot delete the last admin account in the system
|
||||
- Admin role required to use user_id parameter
|
||||
|
||||
**Warning:** This action cannot be undone and will permanently delete all user data including media items, ratings, and progress.
|
||||
}
|
||||
@@ -1,54 +0,0 @@
|
||||
meta {
|
||||
name: Delete User Account (Admin)
|
||||
type: http
|
||||
seq: 6
|
||||
}
|
||||
|
||||
delete {
|
||||
url: {{base_url}}/api/auth/account?user_id={{user_id}}
|
||||
body: none
|
||||
auth: inherit
|
||||
}
|
||||
|
||||
settings {
|
||||
encodeUrl: true
|
||||
timeout: 0
|
||||
}
|
||||
|
||||
docs {
|
||||
## Delete User Account (Admin)
|
||||
|
||||
Allows administrators to delete any user account by specifying user_id parameter.
|
||||
|
||||
**Method:** DELETE
|
||||
|
||||
**Endpoint:** /api/auth/account?user_id={user_id}
|
||||
|
||||
**Authentication:** Required (Admin only)
|
||||
|
||||
**Query Parameters:**
|
||||
- `user_id` (string, required for admin): UUID of the user account to delete
|
||||
|
||||
**Usage Examples:**
|
||||
- **Self-deletion**: DELETE /api/auth/account (no user_id parameter)
|
||||
- **Admin deletion**: DELETE /api/auth/account?user_id=550e8400-e29b-41d4-a716-446655440000
|
||||
|
||||
**Response:**
|
||||
- `message` (string): Success message indicating which account was deleted
|
||||
|
||||
**Status Codes:**
|
||||
- 200: Success
|
||||
- 400: Bad Request (invalid user_id or attempting to delete last admin)
|
||||
- 401: Unauthorized
|
||||
- 403: Forbidden (admin access required for user_id parameter)
|
||||
- 404: Not Found (user does not exist)
|
||||
|
||||
**Admin Protection Rules:**
|
||||
- Regular users can only delete their own account (no user_id parameter allowed)
|
||||
- Admins can delete any account including their own
|
||||
- Cannot delete the last admin account in the system
|
||||
- Admin role required to use user_id parameter
|
||||
|
||||
**Variables:**
|
||||
- `user_id`: Set this to the UUID of the user you want to delete
|
||||
}
|
||||
@@ -1,99 +0,0 @@
|
||||
meta {
|
||||
name: List Users
|
||||
type: http
|
||||
seq: 5
|
||||
}
|
||||
|
||||
get {
|
||||
url: {{base_url}}/api/auth/users
|
||||
body: none
|
||||
auth: inherit
|
||||
}
|
||||
|
||||
settings {
|
||||
encodeUrl: true
|
||||
timeout: 0
|
||||
}
|
||||
|
||||
docs {
|
||||
## List Users
|
||||
|
||||
Retrieves a list of all users with complete user information.
|
||||
|
||||
**Method:** GET
|
||||
|
||||
**Endpoint:** /api/auth/users
|
||||
|
||||
**Authentication:** Required (Admin only)
|
||||
|
||||
**Response:** Array of user objects with complete information:
|
||||
- `id` (string): User ID (UUID)
|
||||
- `email` (string): Email address
|
||||
- `username` (string): Username
|
||||
- `first_name` (string): First name (empty if not set)
|
||||
- `last_name` (string): Last name (empty if not set)
|
||||
- `role` (string): User role ("user" or "admin")
|
||||
- `theme` (string): Theme preference (empty if default)
|
||||
- `max_devices` (integer): Maximum number of devices allowed
|
||||
- `device_count` (integer): Current number of registered devices
|
||||
- `created_at` (string): Creation timestamp (ISO 8601)
|
||||
- `updated_at` (string): Last update timestamp (ISO 8601)
|
||||
|
||||
**Status Codes:**
|
||||
- 200: Success
|
||||
- 401: Unauthorized
|
||||
- 403: Forbidden (admin access required)
|
||||
|
||||
**Features:**
|
||||
- Admin-only endpoint with complete user information
|
||||
- Returns first_name, last_name, role, theme fields
|
||||
- Includes device limits and current device count
|
||||
- Useful for user management interfaces
|
||||
}
|
||||
|
||||
get {
|
||||
url: {{base_url}}/api/auth/users
|
||||
body: none
|
||||
auth: inherit
|
||||
}
|
||||
|
||||
settings {
|
||||
encodeUrl: true
|
||||
timeout: 0
|
||||
}
|
||||
|
||||
docs {
|
||||
## List Users (Admin)
|
||||
|
||||
Retrieves a list of all users with complete user information.
|
||||
|
||||
**Method:** GET
|
||||
|
||||
**Endpoint:** /api/auth/users
|
||||
|
||||
**Authentication:** Required (Admin only)
|
||||
|
||||
**Response:** Array of user objects with complete information:
|
||||
- `id` (string): User ID (UUID)
|
||||
- `email` (string): Email address
|
||||
- `username` (string): Username
|
||||
- `first_name` (string): First name (empty if not set)
|
||||
- `last_name` (string): Last name (empty if not set)
|
||||
- `role` (string): User role ("user" or "admin")
|
||||
- `theme` (string): Theme preference (empty if default)
|
||||
- `max_devices` (integer): Maximum number of devices allowed
|
||||
- `device_count` (integer): Current number of registered devices
|
||||
- `created_at` (string): Creation timestamp (ISO 8601)
|
||||
- `updated_at` (string): Last update timestamp (ISO 8601)
|
||||
|
||||
**Status Codes:**
|
||||
- 200: Success
|
||||
- 401: Unauthorized
|
||||
- 403: Forbidden (admin access required)
|
||||
|
||||
**Enhanced Features:**
|
||||
- Now admin-only endpoint (moved from public to protected admin group)
|
||||
- Returns complete user profile information including names and role
|
||||
- Includes device limits and current device count for monitoring
|
||||
- Useful for comprehensive admin user management
|
||||
}
|
||||
@@ -1,87 +0,0 @@
|
||||
meta {
|
||||
name: Register Admin User
|
||||
type: http
|
||||
seq: 4
|
||||
}
|
||||
|
||||
post {
|
||||
url: {{base_url}}/api/auth/register
|
||||
body: json
|
||||
auth: inherit
|
||||
}
|
||||
|
||||
body:json {
|
||||
{
|
||||
"email": "maxdevices@example.com",
|
||||
"username": "maxdevicesuser",
|
||||
"password": "Test@Pass123!",
|
||||
"first_name": "Test",
|
||||
"last_name": "User",
|
||||
"role": "admin"
|
||||
}
|
||||
}
|
||||
|
||||
script:post-response {
|
||||
function onResponse(res) {
|
||||
let data = res.getBody();
|
||||
return bru.setEnvVar("token", data.token, { persist: true });
|
||||
}
|
||||
onResponse(res);
|
||||
|
||||
}
|
||||
|
||||
// Test admin user aligns with Go integration tests
|
||||
// Email: maxdevices@example.com used in device cap tests
|
||||
// See TEST_DATA.md for shared test data documentation
|
||||
|
||||
settings {
|
||||
encodeUrl: true
|
||||
timeout: 0
|
||||
}
|
||||
|
||||
docs {
|
||||
## Register Admin User
|
||||
|
||||
Creates a new admin user account with role-based restrictions.
|
||||
|
||||
**Method:** POST
|
||||
|
||||
**Endpoint:** /api/auth/register
|
||||
|
||||
**Request Body:**
|
||||
- `email` (string): Email address
|
||||
- `username` (string): Username
|
||||
- `password` (string): Password
|
||||
- `first_name` (string, optional): First name
|
||||
- `last_name` (string, optional): Last name
|
||||
- `role` (string): Must be "admin"
|
||||
|
||||
**Response:**
|
||||
- `token` (string): JWT token with admin role
|
||||
- `user` (object): User details
|
||||
- `id` (string): User ID
|
||||
- `email` (string): Email
|
||||
- `username` (string): Username
|
||||
- `theme` (string): User theme preference
|
||||
- `first_name` (string, optional): First name
|
||||
- `last_name` (string, optional): Last name
|
||||
- `role` (string): User role ("admin")
|
||||
|
||||
**Status Codes:**
|
||||
- 201: Created
|
||||
- 400: Invalid input data
|
||||
- 403: Forbidden - admin creation restrictions apply
|
||||
- 409: User exists
|
||||
|
||||
**Role Restrictions:**
|
||||
- **First User**: Anyone can create first admin (auto-assigned)
|
||||
- **Existing Admins Present**: Only authenticated admins can create new admin accounts
|
||||
- **Unauthenticated Users**: Cannot create admin accounts if any admin exists
|
||||
- **Security**: Requires admin authentication for subsequent admin creation
|
||||
|
||||
**Usage Notes:**
|
||||
- Use this request only when specifically creating admin accounts
|
||||
- For regular user creation, use "Register User" request
|
||||
- Admin token will have elevated privileges for administrative operations
|
||||
|
||||
}
|
||||
@@ -1,32 +0,0 @@
|
||||
meta {
|
||||
name: Update User Max Devices - Exceeds Maximum
|
||||
type: http
|
||||
seq: 3
|
||||
}
|
||||
|
||||
put {
|
||||
url: {{base_url}}/api/auth/users/{{user_id}}/max-devices
|
||||
body: {
|
||||
max_devices: 101
|
||||
}
|
||||
auth: inherit
|
||||
}
|
||||
|
||||
settings {
|
||||
encodeUrl: true
|
||||
timeout: 0
|
||||
}
|
||||
|
||||
vars {
|
||||
user_id: 123e4567-e89b-12d3-a456-426614174000
|
||||
max_devices: 101
|
||||
}
|
||||
|
||||
docs {
|
||||
## Update User Max Devices - Invalid (Exceeds Maximum)
|
||||
|
||||
Attempts to set max_devices to 101 (above maximum of 100).
|
||||
|
||||
**Expected:** 400 Bad Request
|
||||
**Response:** `{"error": "validation error"}`
|
||||
}
|
||||
@@ -1,32 +0,0 @@
|
||||
meta {
|
||||
name: Update User Max Devices - Invalid Max Devices
|
||||
type: http
|
||||
seq: 2
|
||||
}
|
||||
|
||||
put {
|
||||
url: {{base_url}}/api/auth/users/{{user_id}}/max-devices
|
||||
body: {
|
||||
max_devices: 0
|
||||
}
|
||||
auth: inherit
|
||||
}
|
||||
|
||||
settings {
|
||||
encodeUrl: true
|
||||
timeout: 0
|
||||
}
|
||||
|
||||
vars {
|
||||
user_id: 123e4567-e89b-12d3-a456-426614174000
|
||||
max_devices: 0
|
||||
}
|
||||
|
||||
docs {
|
||||
## Update User Max Devices - Invalid (Zero)
|
||||
|
||||
Attempts to set max_devices to 0 (below minimum).
|
||||
|
||||
**Expected:** 400 Bad Request
|
||||
**Response:** `{"error": "validation error"}`
|
||||
}
|
||||
@@ -1,27 +0,0 @@
|
||||
meta {
|
||||
name: Update User Max Devices - Missing ID
|
||||
type: http
|
||||
seq: 4
|
||||
}
|
||||
|
||||
put {
|
||||
url: {{base_url}}/api/auth/users//max-devices
|
||||
body: {
|
||||
max_devices: 10
|
||||
}
|
||||
auth: inherit
|
||||
}
|
||||
|
||||
settings {
|
||||
encodeUrl: true
|
||||
timeout: 0
|
||||
}
|
||||
|
||||
docs {
|
||||
## Update User Max Devices - Missing User ID
|
||||
|
||||
Attempts to update max devices without providing user ID.
|
||||
|
||||
**Expected:** 400 Bad Request
|
||||
**Response:** `{"error": "user id required"}`
|
||||
}
|
||||
@@ -1,32 +0,0 @@
|
||||
meta {
|
||||
name: Update User Max Devices - Success
|
||||
type: http
|
||||
seq: 1
|
||||
}
|
||||
|
||||
put {
|
||||
url: {{base_url}}/api/auth/users/{{user_id}}/max-devices
|
||||
body: {
|
||||
max_devices: 5
|
||||
}
|
||||
auth: inherit
|
||||
}
|
||||
|
||||
settings {
|
||||
encodeUrl: true
|
||||
timeout: 0
|
||||
}
|
||||
|
||||
vars {
|
||||
user_id: 123e4567-e89b-12d3-a456-426614174000
|
||||
max_devices: 5
|
||||
}
|
||||
|
||||
docs {
|
||||
## Update User Max Devices - Success Case
|
||||
|
||||
Successfully updates a user's max devices limit to 5.
|
||||
|
||||
**Expected:** 200 OK
|
||||
**Response:** `{"message": "max devices updated"}`
|
||||
}
|
||||
@@ -1,95 +0,0 @@
|
||||
meta {
|
||||
name: Update User Max Devices
|
||||
type: http
|
||||
seq: 6
|
||||
}
|
||||
|
||||
put {
|
||||
url: {{base_url}}/api/auth/users/{{user_id}}/max-devices
|
||||
body: {
|
||||
max_devices: {{max_devices}}
|
||||
}
|
||||
auth: inherit
|
||||
}
|
||||
|
||||
settings {
|
||||
encodeUrl: true
|
||||
timeout: 0
|
||||
}
|
||||
|
||||
docs {
|
||||
## Update User Max Devices (Admin)
|
||||
|
||||
Updates the maximum number of devices a user can register.
|
||||
|
||||
**Method:** PUT
|
||||
|
||||
**Endpoint:** /api/auth/users/:id/max-devices
|
||||
|
||||
**Authentication:** Required (Admin only)
|
||||
|
||||
**URL Parameters:**
|
||||
- `id` (string): User ID (UUID)
|
||||
|
||||
**Request Body:**
|
||||
```json
|
||||
{
|
||||
"max_devices": 10
|
||||
}
|
||||
```
|
||||
- `max_devices` (integer, required): Maximum devices (1-100)
|
||||
|
||||
**Response:**
|
||||
```json
|
||||
{
|
||||
"message": "max devices updated"
|
||||
}
|
||||
```
|
||||
|
||||
**Status Codes:**
|
||||
- 200: Success
|
||||
- 400: Invalid request (missing id, invalid max_devices, out of range)
|
||||
- 401: Unauthorized
|
||||
- 403: Forbidden (admin access required)
|
||||
- 500: Internal server error
|
||||
|
||||
**Validation:**
|
||||
- `max_devices` must be between 1 and 100
|
||||
- User ID must be a valid UUID
|
||||
- User must exist
|
||||
|
||||
**Features:**
|
||||
- Admin-only endpoint for managing user device quotas
|
||||
- Allows per-user device limits (default: 10)
|
||||
- Prevents excessive device registrations per user
|
||||
- Useful for multi-tenant or managed deployments
|
||||
|
||||
**Examples:**
|
||||
|
||||
Set max devices to 5:
|
||||
```json
|
||||
{
|
||||
"max_devices": 5
|
||||
}
|
||||
```
|
||||
|
||||
Set max devices to 50 (premium user):
|
||||
```json
|
||||
{
|
||||
"max_devices": 50
|
||||
}
|
||||
```
|
||||
|
||||
Set max devices to 1 (restricted user):
|
||||
```json
|
||||
{
|
||||
"max_devices": 1
|
||||
}
|
||||
```
|
||||
|
||||
**Use Cases:**
|
||||
- Restrict free-tier users to 5 devices
|
||||
- Allow premium users up to 100 devices
|
||||
- Reduce device cap for suspicious accounts
|
||||
- Implement tiered device limits per user plan
|
||||
}
|
||||
Reference in New Issue
Block a user