prisma_auth 0.2.1

# User Management API Tests
# Test user registration, listing, and deletion

# First, login as admin to get authentication token
POST http://localhost:3000/api/login
Content-Type: application/json
{
  "username": "admin",
  "password": "admin123"
}

HTTP 200
[Captures]
admin_token: jsonpath "$.token"

# Clean up any existing test user first
DELETE http://localhost:3000/api/users/testuser
Authorization: Bearer {{admin_token}}

# Test registering a new user (admin only)
POST http://localhost:3000/api/register
Content-Type: application/json
Authorization: Bearer {{admin_token}}
{
  "username": "testuser",
  "password": "testpass123",
  "role": "user"
}

HTTP 200
[Asserts]
jsonpath "$.username" == "testuser"
jsonpath "$.role" == "user"

# Test registering a user without admin token
POST http://localhost:3000/api/register
Content-Type: application/json
{
  "username": "unauthorized",
  "password": "testpass123",
  "role": "user"
}

HTTP 401

# Test registering a user with missing required fields
POST http://localhost:3000/api/register
Content-Type: application/json
Authorization: Bearer {{admin_token}}
{
  "username": "testuser2"
}

HTTP 422

# Test listing all users (admin only)
GET http://localhost:3000/api/users
Authorization: Bearer {{admin_token}}

HTTP 200
[Asserts]
jsonpath "$" isCollection
jsonpath "$[?(@.username == 'admin')]" exists
jsonpath "$[?(@.username == 'testuser')]" exists

# Test listing users without admin token - first need to login as regular user
POST http://localhost:3000/api/login
Content-Type: application/json
{
  "username": "testuser",
  "password": "testpass123"
}

HTTP 200
[Captures]
user_token: jsonpath "$.token"

# Try to list users with regular user token
GET http://localhost:3000/api/users
Authorization: Bearer {{user_token}}

HTTP 403

# Test deleting a user (admin only)
DELETE http://localhost:3000/api/users/testuser
Authorization: Bearer {{admin_token}}

HTTP 200

# Verify user was deleted by trying to login
POST http://localhost:3000/api/login
Content-Type: application/json
{
  "username": "testuser",
  "password": "testpass123"
}

HTTP 401

# Test admin trying to delete themselves (should fail)
DELETE http://localhost:3000/api/users/admin
Authorization: Bearer {{admin_token}}

HTTP 400

# Test deleting non-existent user
DELETE http://localhost:3000/api/users/nonexistent
Authorization: Bearer {{admin_token}}

HTTP 500