docs: add Carousel dashboard implementation plan
This commit is contained in:
@@ -1,50 +0,0 @@
|
||||
meta {
|
||||
name: Login User
|
||||
type: http
|
||||
seq: 1
|
||||
}
|
||||
|
||||
post {
|
||||
url: {{base_url}}/api/auth/login
|
||||
body: json
|
||||
}
|
||||
|
||||
body:json {
|
||||
{
|
||||
"login": "testuser@example.com",
|
||||
"password": "Test@Pass123!"
|
||||
}
|
||||
}
|
||||
|
||||
settings {
|
||||
encodeUrl: true
|
||||
timeout: 0
|
||||
}
|
||||
|
||||
docs {
|
||||
## Login User
|
||||
|
||||
Authenticates a user with email/username and password.
|
||||
|
||||
**Method:** POST
|
||||
|
||||
**Endpoint:** /api/auth/login
|
||||
|
||||
**Request Body:**
|
||||
- `login` (string): Email or username
|
||||
- `password` (string): Password
|
||||
|
||||
**Response:**
|
||||
- `token` (string): JWT token
|
||||
- `user` (object): User details
|
||||
- `id` (string): User ID
|
||||
- `email` (string): Email
|
||||
- `username` (string): Username
|
||||
- `theme` (string): User theme preference
|
||||
- `first_name` (string): First name
|
||||
- `last_name` (string): Last name
|
||||
|
||||
**Status Codes:**
|
||||
- 200: Success
|
||||
- 401: Invalid credentials
|
||||
}
|
||||
@@ -1,57 +0,0 @@
|
||||
meta {
|
||||
name: Logout User
|
||||
type: http
|
||||
seq: 1
|
||||
}
|
||||
|
||||
post {
|
||||
url: {{base_url}}/api/auth/logout
|
||||
body: json
|
||||
auth: inherit
|
||||
}
|
||||
|
||||
headers {
|
||||
Content-Type: application/json
|
||||
}
|
||||
|
||||
body:json {
|
||||
{
|
||||
"refresh_token": "{{refresh_token}}"
|
||||
}
|
||||
}
|
||||
|
||||
settings {
|
||||
encodeUrl: true
|
||||
timeout: 0
|
||||
}
|
||||
|
||||
docs {
|
||||
## Logout User
|
||||
|
||||
Logs out the user by revoking their refresh token. If no refresh token is provided, the request succeeds but no token is revoked.
|
||||
|
||||
**Method:** POST
|
||||
|
||||
**Endpoint:** /api/auth/logout
|
||||
|
||||
**Authentication:** Bearer token (optional)
|
||||
|
||||
**Request Body:**
|
||||
- `refresh_token` (string, optional): Refresh token to revoke
|
||||
|
||||
**Response:**
|
||||
- `message` (string): Success message
|
||||
|
||||
**Status Codes:**
|
||||
- 200: Success - user logged out (token revoked if provided)
|
||||
- 401: Unauthorized
|
||||
|
||||
**Example Response:**
|
||||
```json
|
||||
{
|
||||
"message": "logged out successfully"
|
||||
}
|
||||
```
|
||||
|
||||
**Note:** The access token will expire naturally after 1 hour. The refresh token is immediately revoked on logout, preventing future token refreshes.
|
||||
}
|
||||
@@ -1,68 +0,0 @@
|
||||
meta {
|
||||
name: Refresh Access Token
|
||||
type: http
|
||||
seq: 1
|
||||
}
|
||||
|
||||
post {
|
||||
url: {{base_url}}/api/auth/refresh
|
||||
body: json
|
||||
auth: inherit
|
||||
}
|
||||
|
||||
headers {
|
||||
Content-Type: application/json
|
||||
}
|
||||
|
||||
body:json {
|
||||
{
|
||||
"refresh_token": "{{refresh_token}}"
|
||||
}
|
||||
}
|
||||
|
||||
settings {
|
||||
encodeUrl: true
|
||||
timeout: 0
|
||||
}
|
||||
|
||||
docs {
|
||||
## Refresh Access Token
|
||||
|
||||
Refreshes an access token using a valid refresh token. Returns a new access token with 1-hour expiration.
|
||||
|
||||
**Method:** POST
|
||||
|
||||
**Endpoint:** /api/auth/refresh
|
||||
|
||||
**Authentication:** Not required (refresh token is in request body)
|
||||
|
||||
**Request Body:**
|
||||
- `refresh_token` (string): Valid refresh token UUID
|
||||
|
||||
**Response:**
|
||||
- `access_token` (string): New JWT access token (1 hour expiration)
|
||||
- `token_type` (string): Token type (usually "Bearer")
|
||||
- `expires_in` (number): Token lifetime in seconds (3600)
|
||||
|
||||
**Status Codes:**
|
||||
- 200: Success - new access token generated
|
||||
- 401: Unauthorized - invalid or expired refresh token
|
||||
|
||||
**Example Response (Success):**
|
||||
```json
|
||||
{
|
||||
"access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
|
||||
"token_type": "Bearer",
|
||||
"expires_in": 3600
|
||||
}
|
||||
```
|
||||
|
||||
**Example Response (Invalid Token):**
|
||||
```json
|
||||
{
|
||||
"error": "invalid or expired refresh token"
|
||||
}
|
||||
```
|
||||
|
||||
**Note:** Access tokens expire after 1 hour. Use the refresh token to obtain a new access token without requiring the user to log in again.
|
||||
}
|
||||
@@ -1,90 +0,0 @@
|
||||
meta {
|
||||
name: Register User
|
||||
type: http
|
||||
seq: 2
|
||||
}
|
||||
|
||||
post {
|
||||
url: {{base_url}}/api/auth/register
|
||||
body: json
|
||||
auth: inherit
|
||||
}
|
||||
|
||||
body:json {
|
||||
{
|
||||
"email": "testuser@example.com",
|
||||
"username": "testuser",
|
||||
"password": "Test@Pass123!",
|
||||
"first_name": "Test",
|
||||
"last_name": "User"
|
||||
}
|
||||
}
|
||||
|
||||
// Test user aligns with Go integration tests
|
||||
// See TEST_DATA.md for shared test data documentation
|
||||
|
||||
script:post-response {
|
||||
function onResponse(res) {
|
||||
let data = res.getBody();
|
||||
// If successful registration, set token environment variable
|
||||
if (res.getStatus() === 201 || res.getStatus() === 200) {
|
||||
if (data && data.access_token) {
|
||||
|
||||
return bru.setEnvVar("token", data.access_token, { persist: true });
|
||||
}
|
||||
}
|
||||
}
|
||||
onResponse(res);
|
||||
}
|
||||
|
||||
settings {
|
||||
encodeUrl: true
|
||||
timeout: 0
|
||||
}
|
||||
|
||||
docs {
|
||||
## Register User
|
||||
|
||||
Creates a new user account with role-based restrictions.
|
||||
|
||||
**Method:** POST
|
||||
|
||||
**Endpoint:** /api/auth/register
|
||||
|
||||
**Request Body:**
|
||||
- `email` (string): Email address
|
||||
- `username` (string): Username
|
||||
- `password` (string): Password
|
||||
- `first_name` (string, optional): First name
|
||||
- `last_name` (string, optional): Last name
|
||||
- `role` (string): User role ("user" or "admin")
|
||||
|
||||
**Response:**
|
||||
- `token` (string): JWT token
|
||||
- `user` (object): User details
|
||||
- `id` (string): User ID
|
||||
- `email` (string): Email
|
||||
- `username` (string): Username
|
||||
- `theme` (string): User theme preference
|
||||
- `first_name` (string, optional): First name
|
||||
- `last_name` (string, optional): Last name
|
||||
- `role` (string): User role ("user" or "admin")
|
||||
|
||||
**Status Codes:**
|
||||
- 201: Created
|
||||
- 400: Invalid input data
|
||||
- 403: Forbidden - role-based restrictions apply
|
||||
- 409: User exists
|
||||
|
||||
**Role Restrictions:**
|
||||
- **First User**: Automatically gets admin role regardless of request
|
||||
- **Existing Admins Present**: Only authenticated admins can create new admin accounts
|
||||
- **No Admins Yet**: Anyone can create first admin (auto-assigned)
|
||||
- **Regular User Creation**: Anyone can create regular user accounts
|
||||
- **Unauthenticated Users**: Can only create first admin, not subsequent admins
|
||||
|
||||
**Examples:**
|
||||
- First admin creation: `{"email": "admin@example.com", "username": "admin", "password": "password123", "role": "admin"}`
|
||||
- Regular user creation: `{"email": "user@example.com", "username": "user", "password": "password123", "role": "user"}`
|
||||
|
||||
}
|
||||
Reference in New Issue
Block a user