api-testing

分类: 测试与安全 | 上传者: dmitryprg-ai | 下载: 0 | 版本: v1.0（最新）

Test API endpoints with proper authorization including Basic Auth and session cookies. Use when testing curl requests, checking API responses, getting 401 Unauthorized, session expired errors, or verifying endpoint behavior after changes.

更新日志: Source: GitHub https://github.com/dmitryprg-ai/cursor-develop-autorules

目录结构

当前层级: .claude/skills/api-testing/

📁 evals/
- 📄 evals.json 888 B
📁 scripts/
- 📄 get-session.sh 930 B
- 📄 test-endpoint.sh 441 B
📄 SKILL.md 2.1 KB

SKILL.md

---
name: api-testing
description: "Test API endpoints with proper authorization including Basic Auth and session cookies. Use when testing curl requests, checking API responses, getting 401 Unauthorized, session expired errors, or verifying endpoint behavior after changes."
allowed-tools: Bash, Read
model: sonnet
user-invocable: true
---

# API Testing

Test API endpoints that require authorization.

**Configuration:** `.cursor/config/project.config.json`

## Why Two Auth Levels

The API uses layered security: nginx handles Basic Auth for all requests (keeping the site private), while the application handles Session Auth for user-specific data. Health endpoint is exempt from session auth so monitoring tools can check availability without logging in.

| Level | Scope | Source |
|-------|-------|--------|
| **Basic Auth** | All requests (nginx layer) | Config: `auth.basic_auth_file` |
| **Session Auth** | API endpoints except /health | Login via `/api/auth/login` |

## Quick Start

```bash
# Get a session
bash ${CLAUDE_SKILL_DIR}/scripts/get-session.sh

# Test any endpoint
bash ${CLAUDE_SKILL_DIR}/scripts/test-endpoint.sh /api/endpoint?param=value
```

## Manual Process

```bash
# 1. Read config
CONFIG=".cursor/config/project.config.json"
SITE_URL=$(jq -r .site_url "$CONFIG")
SECRETS_DIR=$(jq -r .auth.secrets_dir "$CONFIG")
TEST_EMAIL=$(jq -r .auth.test_user_email "$CONFIG")

# 2. Get Basic Auth
BASIC_AUTH=$(jq -r '.user + ":" + .pass' "$SECRETS_DIR/$(jq -r .auth.basic_auth_file "$CONFIG")")

# 3. Login to get session
PASSWORD=$(jq -r .password "$SECRETS_DIR/$(jq -r .auth.test_user_file "$CONFIG")" | base64 -d)
curl -c /tmp/session.txt -u "$BASIC_AUTH" \
  -H "Content-Type: application/json" \
  -d '{"email":"'"$TEST_EMAIL"'","password":"'"$PASSWORD"'"}' \
  "$SITE_URL/api/auth/login"

# 4. Use session for requests
curl -b /tmp/session.txt -u "$BASIC_AUTH" "$SITE_URL/api/endpoint"
```

## Important

- Never hardcode passwords in scripts or output — they change and leak
- Clean up after testing: `rm /tmp/session.txt`
- Test user has admin access to all endpoints
- Health endpoint only needs Basic Auth (no session required)

登录后下载/点赞/收藏 ❤ 6 | ★ 0

api-testing

目录结构

SKILL.md

举报内容

提示