migrants-nt-sec/AuthTests.md

Authentication API Testing Guide

This document provides instructions for testing the authentication system using Postman, including examples of API calls and how to use the authentication tokens with protected endpoints.

Prerequisites

1. Ensure you've run database migrations and seeders:

php artisan migrate
php artisan db:seed

2. The system has created two test users:
   • Admin User: admin@example.com / Admin123!
   • Regular User: user@example.com (password was auto-generated)

Postman Collection Setup

1. Create a new Postman Collection called "Person Management API"
2. Set up environment variables:
   • base_url: Your API base URL (e.g., http://localhost:8000/api)
   • admin_token: Will store the admin authentication token
   • user_token: Will store the regular user authentication token

Test Scenarios

1. Authentication Flow

1.1 Admin Login

Request:

• Method: POST
• URL: {{base_url}}/login
• Headers:
  • Content-Type: application/json
  • Accept: application/json
• Body (raw JSON):

{
    "email": "admin@example.com",
    "password": "Admin123!",
    "device_name": "postman"
}

Postman Test Script:

// Parse response
var jsonData = pm.response.json();

// Test response structure
pm.test("Status code is 200", function () {
    pm.response.to.have.status(200);
});

pm.test("Response has correct structure", function () {
    pm.expect(jsonData.success).to.eql(true);
    pm.expect(jsonData.data).to.have.property('token');
    pm.expect(jsonData.data.user).to.have.property('is_admin');
    pm.expect(jsonData.data.user.is_admin).to.eql(true);
});

// Save token to environment variable
if (jsonData.data && jsonData.data.token) {
    pm.environment.set("admin_token", jsonData.data.token);
}

1.2 Get Admin Profile

Request:

• Method: GET
• URL: {{base_url}}/user
• Headers:
  • Accept: application/json
  • Authorization: Bearer {{admin_token}}

Postman Test Script:

var jsonData = pm.response.json();

pm.test("Status code is 200", function () {
    pm.response.to.have.status(200);
});

pm.test("User is admin", function () {
    pm.expect(jsonData.data.user.is_admin).to.eql(true);
});

1.3 Register a New User (Admin Only)

Request:

• Method: POST
• URL: {{base_url}}/register
• Headers:
  • Content-Type: application/json
  • Accept: application/json
  • Authorization: Bearer {{admin_token}}
• Body (raw JSON):

{
    "name": "New Test User",
    "email": "newuser@example.com",
    "password": "Password123!",
    "is_admin": false
}

Postman Test Script:

var jsonData = pm.response.json();

pm.test("Status code is 201", function () {
    pm.response.to.have.status(201);
});

pm.test("User created successfully", function () {
    pm.expect(jsonData.success).to.eql(true);
    pm.expect(jsonData.message).to.eql("User created successfully");
});

1.4 Login as New User

Request:

• Method: POST
• URL: {{base_url}}/login
• Headers:
  • Content-Type: application/json
  • Accept: application/json
• Body (raw JSON):

{
    "email": "newuser@example.com",
    "password": "Password123!",
    "device_name": "postman"
}

Postman Test Script:

var jsonData = pm.response.json();

pm.test("Status code is 200", function () {
    pm.response.to.have.status(200);
});

// Save token to environment variable
if (jsonData.data && jsonData.data.token) {
    pm.environment.set("user_token", jsonData.data.token);
}

1.5 Regular User Cannot Register New Users

Request:

• Method: POST
• URL: {{base_url}}/register
• Headers:
  • Content-Type: application/json
  • Accept: application/json
  • Authorization: Bearer {{user_token}}
• Body (raw JSON):

{
    "name": "Another User",
    "email": "another@example.com",
    "password": "Password123!",
    "is_admin": false
}

Postman Test Script:

pm.test("Status code is 403 (Forbidden)", function () {
    pm.response.to.have.status(403);
});

1.6 Logout Admin

Request:

• Method: POST
• URL: {{base_url}}/logout
• Headers:
  • Accept: application/json
  • Authorization: Bearer {{admin_token}}

Postman Test Script:

var jsonData = pm.response.json();

pm.test("Status code is 200", function () {
    pm.response.to.have.status(200);
});

pm.test("Logged out successfully", function () {
    pm.expect(jsonData.success).to.eql(true);
    pm.expect(jsonData.message).to.eql("Logged out successfully");
});

// Clear token from environment
pm.environment.unset("admin_token");

2. Accessing Protected API Endpoints

2.1 Trying to Access Protected Endpoint Without Token

Request:

• Method: GET
• URL: {{base_url}}/persons
• Headers:
  • Accept: application/json

Postman Test Script:

pm.test("Status code is 401 (Unauthorized)", function () {
    pm.response.to.have.status(401);
});

2.2 Accessing Protected Endpoint With Token

Request:

• Method: GET
• URL: {{base_url}}/persons
• Headers:
  • Accept: application/json
  • Authorization: Bearer {{user_token}}

Postman Test Script:

var jsonData = pm.response.json();

pm.test("Status code is 200", function () {
    pm.response.to.have.status(200);
});

pm.test("Response has correct structure", function () {
    pm.expect(jsonData.success).to.eql(true);
    pm.expect(jsonData).to.have.property('data');
});

Automated Testing Sequence

To create an automated test sequence in Postman:

1. Create a folder for "Authentication Tests" in your collection
2. Add all the test requests above to this folder
3. Right-click on the folder and select "Run"
4. In the Collection Runner, deselect any requests you don't want to run
5. Click "Run" to execute the tests in sequence

Using PostmanTestAPI.json Collection

A complete Postman collection has been provided in this repository. To use it:

1. In Postman, click on "Import"
2. Upload or paste the contents of PostmanTestAPI.json
3. Create an environment with the variable base_url set to your API URL
4. Run the collection

Automated Test Script

You can also run the tests using Newman (Postman's command-line runner):

# Install Newman
npm install -g newman

# Run the collection
newman run PostmanTestAPI.json -e environment.json

Security Best Practices Implemented

1. Token-based Authentication: Using Laravel Sanctum for secure API tokens
2. Password Hashing: All passwords are hashed using bcrypt
3. Role-based Access Control: Admin-specific endpoints protected
4. Token Abilities: Tokens are created with specific abilities based on user role
5. Token Revocation: Tokens can be revoked on logout
6. Request Validation: All inputs are validated before processing