Edouard Vanbelle
ac24a0eda1
- login via (username or email) + password
- hurl test to cover the feature
85 lines
4.6 KiB
Plaintext
85 lines
4.6 KiB
Plaintext
# =============================================================
|
|
# OxiCloud — login dispatcher (PR 17)
|
|
# =============================================================
|
|
# After PR 17 the `username` field on /api/auth/login accepts BOTH
|
|
# a username (no `@`) and an email address. The server dispatches
|
|
# on `@`-in-input: with `@` → email lookup, without → username
|
|
# lookup. The two namespaces are provably disjoint (PR 16 forbids
|
|
# `@` in usernames), so this is unambiguous.
|
|
# =============================================================
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# Case 1 — Login by username (the classic path).
|
|
# ─────────────────────────────────────────────────────────────
|
|
POST {{base_url}}/api/auth/login
|
|
Content-Type: application/json
|
|
{ "username": "{{username}}", "password": "{{password}}" }
|
|
|
|
HTTP 200
|
|
[Asserts]
|
|
jsonpath "$.access_token" exists
|
|
jsonpath "$.user.email" == "{{email}}"
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# Case 2 — Login by email (new path).
|
|
# The same DTO field, different lookup branch because
|
|
# the input contains `@`.
|
|
# ─────────────────────────────────────────────────────────────
|
|
POST {{base_url}}/api/auth/login
|
|
Content-Type: application/json
|
|
{ "username": "{{email}}", "password": "{{password}}" }
|
|
|
|
HTTP 200
|
|
[Asserts]
|
|
jsonpath "$.access_token" exists
|
|
jsonpath "$.user.email" == "{{email}}"
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# Case 3 — Wrong password on the username path → uniform 403.
|
|
# Anti-enumeration: same error shape as unknown-user.
|
|
# ─────────────────────────────────────────────────────────────
|
|
POST {{base_url}}/api/auth/login
|
|
Content-Type: application/json
|
|
{ "username": "{{username}}", "password": "definitely-wrong" }
|
|
|
|
HTTP 403
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# Case 4 — Wrong password on the email path → uniform 403.
|
|
# Same as Case 3 but with the email path. The error
|
|
# shape is identical regardless of which branch fired.
|
|
# ─────────────────────────────────────────────────────────────
|
|
POST {{base_url}}/api/auth/login
|
|
Content-Type: application/json
|
|
{ "username": "{{email}}", "password": "definitely-wrong" }
|
|
|
|
HTTP 403
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# Case 5 — Unknown username → uniform 403, audit reason
|
|
# `unknown_user`. The visible response is identical
|
|
# to wrong-password (Case 3) so a probing attacker
|
|
# can't distinguish "user exists" from "user doesn't".
|
|
# ─────────────────────────────────────────────────────────────
|
|
POST {{base_url}}/api/auth/login
|
|
Content-Type: application/json
|
|
{ "username": "ghost-user-that-doesnt-exist", "password": "{{password}}" }
|
|
|
|
HTTP 403
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# Case 6 — Unknown email → uniform 403, same anti-enumeration
|
|
# guarantee as Case 5 but exercising the email branch.
|
|
# ─────────────────────────────────────────────────────────────
|
|
POST {{base_url}}/api/auth/login
|
|
Content-Type: application/json
|
|
{ "username": "ghost@nowhere.invalid", "password": "{{password}}" }
|
|
|
|
HTTP 403
|