tests/test_access_roles_api.sh

#!/bin/bash

# Test script for Access Roles API endpoints
# Make sure the SCM server is running before executing this script

BASE_URL="http://localhost:8000"
AUTH_TOKEN="your_jwt_token_here"  # Replace with actual JWT token

echo "=== Access Roles API Test Script ==="
echo "Base URL: $BASE_URL"
echo

# Function to make API calls with proper headers
api_call() {
    local method=$1
    local endpoint=$2
    local data=$3
    
    echo ">>> $method $endpoint"
    if [ -n "$data" ]; then
        curl -s -X $method \
            -H "Content-Type: application/json" \
            -H "Authorization: Bearer $AUTH_TOKEN" \
            -d "$data" \
            "$BASE_URL$endpoint" | jq '.'
    else
        curl -s -X $method \
            -H "Authorization: Bearer $AUTH_TOKEN" \
            "$BASE_URL$endpoint" | jq '.'
    fi
    echo
}

# 1. Test Health Check
echo "=== 1. Health Check ==="
api_call "GET" "/health"

# 2. Test Get Base Roles
echo "=== 2. Get Base Roles ==="
api_call "GET" "/access-roles/base-roles"

# 3. Test Create Access Role
echo "=== 3. Create Access Role ==="
CREATE_DATA='{
    "role_id": "role_api_test_manager",
    "role_name": "API Test Manager",
    "description": "Test role created via API",
    "permissions": {
        "inventory": ["view", "create"],
        "orders": ["view", "create"],
        "suppliers": ["view"],
        "catalogues": ["view"],
        "reports": ["view"],
        "settings": ["view"],
        "goods_receipts": ["view", "create"],
        "merchant_setting": ["view"],
        "merchant": ["view"],
        "stock": ["view", "create"]
    },
    "is_base_role": false,
    "is_active": true
}'
api_call "POST" "/access-roles/create" "$CREATE_DATA"

# 4. Test Get Access Role (full)
echo "=== 4. Get Access Role (full) ==="
GET_DATA='{
    "role_id": "role_api_test_manager"
}'
api_call "POST" "/access-roles/get" "$GET_DATA"

# 5. Test Get Access Role (with projection)
echo "=== 5. Get Access Role (with projection) ==="
GET_PROJECTION_DATA='{
    "role_id": "role_api_test_manager",
    "projection_list": ["role_id", "role_name", "description", "is_active", "created_at"]
}'
api_call "POST" "/access-roles/get" "$GET_PROJECTION_DATA"

# 6. Test List Access Roles (full)
echo "=== 6. List Access Roles (full) ==="
LIST_DATA='{
    "filters": {
        "is_active": true
    },
    "skip": 0,
    "limit": 10
}'
api_call "POST" "/access-roles/list" "$LIST_DATA"

# 7. Test List Access Roles (with projection)
echo "=== 7. List Access Roles (with projection) ==="
LIST_PROJECTION_DATA='{
    "filters": {
        "is_base_role": true
    },
    "skip": 0,
    "limit": 5,
    "projection_list": ["role_id", "role_name", "is_base_role", "is_active"]
}'
api_call "POST" "/access-roles/list" "$LIST_PROJECTION_DATA"

# 8. Test Update Access Role
echo "=== 8. Update Access Role ==="
UPDATE_DATA='{
    "role_name": "Updated API Test Manager",
    "description": "Updated test role description via API",
    "permissions": {
        "inventory": ["view", "create", "update"],
        "orders": ["view", "create", "update"],
        "suppliers": ["view", "create"],
        "catalogues": ["view"],
        "reports": ["view", "export"],
        "settings": ["view"],
        "goods_receipts": ["view", "create", "update"],
        "merchant_setting": ["view"],
        "merchant": ["view"],
        "stock": ["view", "create", "update"]
    }
}'
api_call "POST" "/access-roles/update?role_id=role_api_test_manager" "$UPDATE_DATA"

# 9. Test Delete Access Role (should fail for base role)
echo "=== 9. Test Delete Base Role (should fail) ==="
DELETE_BASE_DATA='{
    "role_id": "role_super_admin"
}'
api_call "POST" "/access-roles/delete" "$DELETE_BASE_DATA"

# 10. Test Delete Access Role (custom role)
echo "=== 10. Delete Custom Access Role ==="
DELETE_DATA='{
    "role_id": "role_api_test_manager"
}'
api_call "POST" "/access-roles/delete" "$DELETE_DATA"

# 11. Verify deletion
echo "=== 11. Verify Deletion (should return 404) ==="
VERIFY_DATA='{
    "role_id": "role_api_test_manager"
}'
api_call "POST" "/access-roles/get" "$VERIFY_DATA"

echo "=== API Test Completed ==="