Add after-response scripts to automatically save access and refresh tokens to Bruno environment variables after successful authentication. This eliminates manual token copying during testing.
Changes:
- Refresh Token.yml: Add script to save tokens from refresh response
- Register User.yml: Add script to save tokens from registration response
- Move all files from bruno-yaml/* to bruno/*
- Maintains existing directory structure within categories
- Updates bruno/user/auth files with OAuth2 refresh token flow
- Updates bruno/user/profile files for user profile management
- Adds bruno/dashboard/ directory with dashboard API tests
- Preserves all existing test scenarios and OpenCollection YAML format
- No functional changes - file reorganization only
- Remove 'auth: inherit' from POST request configuration
- Remove post-response script that set token environment variable
- Clean up documentation formatting
This simplifies the login request configuration as authentication
will now be handled via HTTP-only cookies instead of bearer tokens.
System Settings Bruno Tests (new):
- bruno/system/get-scan-settings.bru
- bruno/system/update-scan-settings.bru
- Test GET endpoint for retrieving system scan settings
- Test PUT endpoint for updating system scan settings
- Include admin authentication requirements
- Document response structures
List Users Bruno Test (update):
- bruno/user/admin/List Users.bru
- Add max_devices to response documentation
- Add device_count to response documentation
- Update feature descriptions
These Bruno tests provide API contract verification for the new
system settings endpoints and document the enhanced user list response.
- Convert all existing .bru files from JSON to Bruno DSL format
- Remove obsolete files (conflicts/api.bru, kobo/Kobo Initialization.bru)
- Update auth configuration to use 'inherit' instead of explicit bearer tokens
- Add comprehensive documentation to all test files
- Improve test scripts with proper assertions and error handling
- Update Login User.bru to use testuser@example.com
- Update Register User.bru to use testuser@example.com
- Update Register Admin User.bru to use maxdevices@example.com
- Standardize password to Test@Pass123! across all tests
- Add TEST_DATA.md documenting shared test credentials
- Update bruno.json with documentation reference
- Add comments linking to TEST_DATA.md for cross-reference
This alignment makes it easier to verify test failures between
Bruno API tests and Go integration tests using identical credentials.
- Fix device registration API test parameters
- Update admin user registration test with proper fields
- Ensure API tests match current endpoint behavior
- Improve API documentation accuracy
- Update User Max Devices - Complete API documentation
- Update User Max Devices - Success test case
- Update User Max Devices - Invalid Zero test case
- Update User Max Devices - Exceeds Maximum test case
- Update User Max Devices - Missing ID test case
- Include validation rules and example payloads
- Document all status codes and error responses
- Remove all ebook-specific API requests (15 files deleted)
- Rename Scan Ebooks.bru to Scan Media Items.bru
- Update API paths from /api/ebooks to /api/media-items
- Update base URL and environment configuration
- Maintain all existing media-items, library, auth, and progress tests
Aligns Bruno collection with unified media-items API architecture
Standardize all Bruno environment variables to use snake_case convention
(aligned with Go naming practices) and remove duplicate camelCase variants.
Changes:
- Environment file cleanup:
- Remove: baseUrl, ebookid, fakebookid, libraryId, mediaItemId, isVisible, refreshToken
- Standardize: fakebookid → fake_book_id, isVisible → is_visible, refreshToken → refresh_token
- All variables now use consistent snake_case format
- Update all Bruno requests to use standardized variables:
- ebooks: {{ebookid}} → {{ebook_id}}
- library: {{libraryId}} → {{library_id}}
- media-items: {{mediaItemId}} → {{media_item_id}}
- visibility: {{isVisible}} → {{is_visible}}
- auth: {{refreshToken}} → {{refresh_token}}
Benefits:
- Single source of truth for each variable
- Consistent with Go naming conventions
- No ambiguity about which variable name to use
- Cleaner, more maintainable codebase
- Test password complexity requirements
- Test account lockout mechanism
- Test rate limiting functionality
- Test JWT expiration (1 hour)
- Test refresh token expiration (7 days)
- Test password requirements list
- Verify transaction manager and error handler types
- All tests passing
- Fix database authentication error by exposing actual database error messages
- Update error handling to follow pgx v5 standards with detailed error reporting
- Restore token environment variable management in Register User.bru for subsequent requests
- Enable proper debugging of database connection issues during user registration
The registration API now provides detailed error messages instead of generic 'failed to check existing users'
when database connection or authentication fails, making debugging easier.
- Add role-based restrictions to POST /api/auth/register endpoint
- Only admins can create admin accounts if any admin already exists
- First user automatically gets admin role regardless of request
- Regular users can only create user accounts, not admin accounts
- Unauthenticated users can only create first admin, not subsequent admins
- Reorganize Bruno collection into logical subfolders (auth/, admin/, profile/)
- Update documentation to reflect new registration restrictions and security rules
BREAKING CHANGES:
- /api/auth/register now enforces role-based creation restrictions
- Bruno collection reorganized with subfolder structure
- Create separate admin folder for admin-only operations
- Move admin endpoints (Create/Update/Delete Ebook, Scanner, Folder Management) to /bruno/admin/
- Add admin dashboard, profile, and library page requests
- Add Register Admin User request with explicit admin role
- Update Register User request to include role field
- Remove empty scanner folder structure
API organization:
- Admin requests: /bruno/admin/ (require admin role)
- User requests: /bruno/user/ (available to all authenticated users)
- Environment: Single {{token}} variable works for both roles
- Update README.md with admin system documentation
- Add admin setup instructions and role permissions
- Update API endpoint documentation with access requirements
- Update Bruno collection to reflect admin-only operations
- Document shared library concept and security model
- Add comprehensive admin setup guide
- Move migrations/ to database/schema/ for clarity on database schema definitions
- Move sqlc.yaml to internal/database/ to group with database code
- Move static/ to cmd/server/static/ to co-locate with server
- Update all configuration files and documentation
- Follow Go project conventions for better organization
- Add /preferences route and preferences.html template for user settings
- Implement username, email, password, and theme update functionality
- Add account deletion feature with confirmation
- Add navigation link to preferences from dashboard
- Create API endpoints:
- PUT /api/user/username - Update username
- PUT /api/user/email - Update email address
- PUT /api/user/password - Change password with verification
- DELETE /api/user/account - Delete user account
- Add database queries for user updates and account deletion
- Create Bruno API testing files for all user preference endpoints
- Add proper validation, error handling, and security checks
The auth folder now contains user management endpoints beyond just authentication:
- User registration/login (auth)
- Profile management (user)
- Theme settings (user preferences)
- Ebook folder management (user settings)
Renaming to 'user' better reflects the expanded scope covering user accounts, preferences, and settings management.
john-okeefe