144 lines
4.2 KiB
Bash
Executable file
144 lines
4.2 KiB
Bash
Executable file
#!/bin/bash
|
|
# Password Recovery Feature Test Script
|
|
# Updated for port 6500
|
|
|
|
BASE_URL="http://10.0.10.30:6500"
|
|
EMAIL="recoverytest@example.com"
|
|
USERNAME="recoverytest"
|
|
PASSWORD="SecurePassword123!"
|
|
RECOVERY_PHRASE="my-mothers-maiden-name-smith"
|
|
WRONG_PHRASE="wrong-phrase"
|
|
|
|
echo "🧪 Password Recovery Feature Test"
|
|
echo "================================="
|
|
echo ""
|
|
|
|
# Test 1: Health check
|
|
echo "1. Health check..."
|
|
HEALTH=$(curl -s -w "\nHTTP Status: %{http_code}\n" $BASE_URL/health)
|
|
echo "$HEALTH"
|
|
echo ""
|
|
|
|
# Test 2: Register user with recovery phrase
|
|
echo "2. Register user with recovery phrase..."
|
|
REGISTER=$(curl -s -w "\nHTTP Status: %{http_code}\n" -X POST $BASE_URL/api/auth/register \
|
|
-H "Content-Type: application/json" \
|
|
-d "{
|
|
\"email\": \"$EMAIL\",
|
|
\"username\": \"$USERNAME\",
|
|
\"password\": \"$PASSWORD\",
|
|
\"recovery_phrase\": \"$RECOVERY_PHRASE\"
|
|
}")
|
|
echo "$REGISTER"
|
|
echo ""
|
|
|
|
# Test 3: Login to get token
|
|
echo "3. Login to get access token..."
|
|
LOGIN_RESPONSE=$(curl -s -X POST $BASE_URL/api/auth/login \
|
|
-H "Content-Type: application/json" \
|
|
-d "{
|
|
\"email\": \"$EMAIL\",
|
|
\"password\": \"$PASSWORD\"
|
|
}")
|
|
|
|
echo "$LOGIN_RESPONSE" | jq .
|
|
|
|
# Extract access token
|
|
ACCESS_TOKEN=$(echo "$LOGIN_RESPONSE" | jq -r '.access_token // empty')
|
|
|
|
if [ -z "$ACCESS_TOKEN" ] || [ "$ACCESS_TOKEN" = "null" ]; then
|
|
echo "❌ Failed to get access token"
|
|
exit 1
|
|
fi
|
|
|
|
echo "✅ Access token obtained"
|
|
echo ""
|
|
|
|
# Test 4: Verify recovery phrase (should succeed)
|
|
echo "4. Verify recovery phrase (correct phrase)..."
|
|
VERIFY=$(curl -s -w "\nHTTP Status: %{http_code}\n" -X POST $BASE_URL/api/auth/recovery/verify \
|
|
-H "Content-Type: application/json" \
|
|
-d "{
|
|
\"email\": \"$EMAIL\",
|
|
\"recovery_phrase\": \"$RECOVERY_PHRASE\"
|
|
}")
|
|
echo "$VERIFY"
|
|
echo ""
|
|
|
|
# Test 5: Verify recovery phrase (wrong phrase, should fail)
|
|
echo "5. Verify recovery phrase (wrong phrase - should fail)..."
|
|
WRONG_VERIFY=$(curl -s -w "\nHTTP Status: %{http_code}\n" -X POST $BASE_URL/api/auth/recovery/verify \
|
|
-H "Content-Type: application/json" \
|
|
-d "{
|
|
\"email\": \"$EMAIL\",
|
|
\"recovery_phrase\": \"$WRONG_PHRASE\"
|
|
}")
|
|
echo "$WRONG_VERIFY"
|
|
echo ""
|
|
|
|
# Test 6: Reset password with recovery phrase
|
|
echo "6. Reset password with recovery phrase..."
|
|
NEW_PASSWORD="NewSecurePassword456!"
|
|
RESET=$(curl -s -w "\nHTTP Status: %{http_code}\n" -X POST $BASE_URL/api/auth/recovery/reset-password \
|
|
-H "Content-Type: application/json" \
|
|
-d "{
|
|
\"email\": \"$EMAIL\",
|
|
\"recovery_phrase\": \"$RECOVERY_PHRASE\",
|
|
\"new_password\": \"$NEW_PASSWORD\"
|
|
}")
|
|
echo "$RESET"
|
|
echo ""
|
|
|
|
# Test 7: Login with old password (should fail)
|
|
echo "7. Login with OLD password (should fail)..."
|
|
OLD_LOGIN=$(curl -s -w "\nHTTP Status: %{http_code}\n" -X POST $BASE_URL/api/auth/login \
|
|
-H "Content-Type: application/json" \
|
|
-d "{
|
|
\"email\": \"$EMAIL\",
|
|
\"password\": \"$PASSWORD\"
|
|
}")
|
|
echo "$OLD_LOGIN"
|
|
echo ""
|
|
|
|
# Test 8: Login with new password (should succeed)
|
|
echo "8. Login with NEW password (should succeed)..."
|
|
NEW_LOGIN=$(curl -s -X POST $BASE_URL/api/auth/login \
|
|
-H "Content-Type: application/json" \
|
|
-d "{
|
|
\"email\": \"$EMAIL\",
|
|
\"password\": \"$NEW_PASSWORD\"
|
|
}")
|
|
|
|
echo "$NEW_LOGIN" | jq .
|
|
|
|
# Extract new access token
|
|
NEW_ACCESS_TOKEN=$(echo "$NEW_LOGIN" | jq -r '.access_token // empty')
|
|
|
|
if [ -z "$NEW_ACCESS_TOKEN" ] || [ "$NEW_ACCESS_TOKEN" = "null" ]; then
|
|
echo "❌ Failed to login with new password"
|
|
exit 1
|
|
fi
|
|
|
|
echo "✅ Login with new password successful"
|
|
echo ""
|
|
|
|
# Test 9: Try to use old access token (should fail - token invalidated)
|
|
echo "9. Try to use OLD access token (should fail - token was invalidated)..."
|
|
PROFILE=$(curl -s -w "\nHTTP Status: %{http_code}\n" -X GET $BASE_URL/api/users/me \
|
|
-H "Authorization: Bearer $ACCESS_TOKEN")
|
|
echo "$PROFILE"
|
|
echo ""
|
|
|
|
# Test 10: Setup new recovery phrase (protected endpoint)
|
|
echo "10. Setup new recovery phrase (protected endpoint)..."
|
|
SETUP=$(curl -s -w "\nHTTP Status: %{http_code}\n" -X POST $BASE_URL/api/auth/recovery/setup \
|
|
-H "Content-Type: application/json" \
|
|
-H "Authorization: Bearer $NEW_ACCESS_TOKEN" \
|
|
-d "{
|
|
\"recovery_phrase\": \"my-new-recovery-phrase\",
|
|
\"current_password\": \"$NEW_PASSWORD\"
|
|
}")
|
|
echo "$SETUP"
|
|
echo ""
|
|
|
|
echo "✅ All tests complete!"
|