# Authentication API Tests
# Test basic authentication functionality
# Test public endpoint (no auth required)
GET http://localhost:3000/api/public
HTTP 200
[Asserts]
body contains "This is a public route"
# Test login with default admin credentials
POST http://localhost:3000/api/login
Content-Type: application/json
{
"username": "admin",
"password": "admin123"
}
HTTP 200
[Captures]
admin_token: jsonpath "$.token"
[Asserts]
jsonpath "$.token" exists
jsonpath "$.username" == "admin"
jsonpath "$.role" == "admin"
# Test login with invalid credentials
POST http://localhost:3000/api/login
Content-Type: application/json
{
"username": "admin",
"password": "wrongpassword"
}
HTTP 401
# Test login with missing username (API defaults to admin user)
POST http://localhost:3000/api/login
Content-Type: application/json
{
"password": "admin123"
}
HTTP 200
[Asserts]
jsonpath "$.username" == "admin"
jsonpath "$.role" == "admin"
# Test protected route with valid token
GET http://localhost:3000/api/protected
Authorization: Bearer {{admin_token}}
HTTP 200
[Asserts]
body contains "Welcome admin!"
body contains "This is a protected route"
# Test protected route without token
GET http://localhost:3000/api/protected
HTTP 401
# Test admin route with admin token
GET http://localhost:3000/api/admin
Authorization: Bearer {{admin_token}}
HTTP 200
[Asserts]
body contains "Admin area"
body contains "Welcome admin"