Edouard Vanbelle
55 lines
2.6 KiB
Plaintext
55 lines
2.6 KiB
Plaintext
# =============================================================
|
|
# OxiCloud — Baseline: second-user fixture (bob)
|
|
# =============================================================
|
|
# (Re)creates the `bob` user so the Group O cross-user
|
|
# isolation scenarios (and Group C's C4 admin-reads-another-
|
|
# user case) have a real second principal to test against.
|
|
#
|
|
# Run-order: this file runs AFTER `external_users.hurl`, which
|
|
# deletes bob at its end, and AFTER `permissions.hurl`, which
|
|
# creates+uses bob via the admin API. By the time this file
|
|
# runs, bob may or may not exist — the anti-enumeration
|
|
# registration endpoint returns 200 either way, so this is
|
|
# safe in both states. The login step that follows is the
|
|
# actual existence assertion: if bob can log in, downstream
|
|
# bob-dependent tests (nc_admin_views_other_user.hurl here
|
|
# and test_nc_cross_user_isolation.sh in the webdav suite)
|
|
# will work.
|
|
#
|
|
# Bob's credentials are hardcoded fixtures (not env-driven) so
|
|
# downstream test files don't need to coordinate via test.env.
|
|
# Bob's password is unique per fixture; no overlap with admin.
|
|
# =============================================================
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# Step 1 — Register bob via the email-anti-enumeration flow.
|
|
# ─────────────────────────────────────────────────────────────
|
|
POST {{base_url}}/api/auth/register
|
|
Content-Type: application/json
|
|
{
|
|
"username": "bob",
|
|
"email": "bob@example.com",
|
|
"password": "BobPassword1!"
|
|
}
|
|
|
|
HTTP 200
|
|
[Asserts]
|
|
jsonpath "$.message" contains "request received"
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# Step 2 — Confirm bob can log in (proves registration
|
|
# actually landed the account — the anti-enum response
|
|
# alone wouldn't tell us).
|
|
# ─────────────────────────────────────────────────────────────
|
|
POST {{base_url}}/api/auth/login
|
|
Content-Type: application/json
|
|
{ "username": "bob", "password": "BobPassword1!" }
|
|
|
|
HTTP 200
|
|
[Asserts]
|
|
jsonpath "$.access_token" exists
|
|
jsonpath "$.user.full.user.username" == "bob"
|
|
jsonpath "$.user.full.user.email" == "bob@example.com"
|