dmitryprg-ai/api-testing

API Testing

Test API endpoints that require authorization.

Configuration: .cursor/config/project.config.json

Why Two Auth Levels

The API uses layered security: nginx handles Basic Auth for all requests (keeping the site private), while the application handles Session Auth for user-specific data. Health endpoint is exempt from session auth so monitoring tools can check availability without logging in.

| Level | Scope | Source | |-------|-------|--------| | Basic Auth | All requests (nginx layer) | Config: auth.basic_auth_file | | Session Auth | API endpoints except /health | Login via /api/auth/login |

Quick Start

# Get a session
bash ${CLAUDE_SKILL_DIR}/scripts/get-session.sh

# Test any endpoint
bash ${CLAUDE_SKILL_DIR}/scripts/test-endpoint.sh /api/endpoint?param=value

Manual Process

# 1. Read config
CONFIG=".cursor/config/project.config.json"
SITE_URL=$(jq -r .site_url "$CONFIG")
SECRETS_DIR=$(jq -r .auth.secrets_dir "$CONFIG")
TEST_EMAIL=$(jq -r .auth.test_user_email "$CONFIG")

# 2. Get Basic Auth
BASIC_AUTH=$(jq -r '.user + ":" + .pass' "$SECRETS_DIR/$(jq -r .auth.basic_auth_file "$CONFIG")")

# 3. Login to get session
PASSWORD=$(jq -r .password "$SECRETS_DIR/$(jq -r .auth.test_user_file "$CONFIG")" | base64 -d)
curl -c /tmp/session.txt -u "$BASIC_AUTH" \
  -H "Content-Type: application/json" \
  -d '{"email":"'"$TEST_EMAIL"'","password":"'"$PASSWORD"'"}' \
  "$SITE_URL/api/auth/login"

# 4. Use session for requests
curl -b /tmp/session.txt -u "$BASIC_AUTH" "$SITE_URL/api/endpoint"

Important

• Never hardcode passwords in scripts or output — they change and leak
• Clean up after testing: rm /tmp/session.txt
• Test user has admin access to all endpoints
• Health endpoint only needs Basic Auth (no session required)