requests.http

@baseURL=http://localhost:3000/api/v1

###
# Register a new admin user
POST {{baseURL}}/auth/register
Content-Type: application/json

{
  "email": "admin@example.com",
  "password": "securePass123"
}

###
# Login with admin credentials
# @name adminLogin
@adminRefreshToken={{adminLogin.response.body.$.refresh_token}}
POST {{baseURL}}/auth/login
Content-Type: application/json

{
  "email": "admin@example.com",
  "password": "securePass123"
}

###
# Refresh admin access token
# Uses refresh_token from the login response
# @name adminRefresh
@adminAccessToken={{adminRefresh.response.body.$.access_token}}
@adminRefreshToken={{adminRefresh.response.body.$.refresh_token}}
POST {{baseURL}}/auth/refresh
Content-Type: application/json

{
  "refresh_token": "{{adminRefreshToken}}"
}

###
# Logout admin (revokes refresh token)
POST {{baseURL}}/auth/logout
Content-Type: application/json

{
  "refresh_token": "{{adminRefreshToken}}"
}

###
# Register a new user
# @name register
@email={{register.request.body.$.email}}
@userID={{register.response.body.$.id}}
POST {{baseURL}}/auth/register
Content-Type: application/json

{
  "email": "user{{$randomInt 10 100}}@example.com",
  "password": "securePass123"
}

###
# Login with user credentials
# @name login
@accessToken={{login.response.body.$.access_token}}
@refreshToken={{login.response.body.$.refresh_token}}
POST {{baseURL}}/auth/login
Content-Type: application/json

{
  "email": "{{email}}",
  "password": "securePass123"
}

###
# Refresh user access token
# Uses refresh_token from the login response
# @name userRefresh
@accessToken={{userRefresh.response.body.$.access_token}}
@refreshToken={{userRefresh.response.body.$.refresh_token}}
POST {{baseURL}}/auth/refresh
Content-Type: application/json

{
  "refresh_token": "{{refreshToken}}"
}

###
# Logout user (revokes refresh token)
POST {{baseURL}}/auth/logout
Content-Type: application/json

{
  "refresh_token": "{{refreshToken}}"
}

###
# Change password (requires authentication)
POST {{baseURL}}/auth/change-password
Content-Type: application/json
Authorization: Bearer {{accessToken}}

{
  "old_password": "securePass123",
  "new_password": "newStrongPass456"
}

###
# List all users (admin only)
# Requires admin JWT token in Authorization header
# Optional query parameters: status (pending/active/blocked), role (admin/user), limit, offset
GET {{baseURL}}/users?status=pending
Authorization: Bearer {{adminAccessToken}}

###
# Search active users by name (authenticated users)
# Requires authentication JWT token in Authorization header
# Query params: name=<prefix>, limit, offset
GET {{baseURL}}/users/search?name=user
Authorization: Bearer {{accessToken}}

###
# Update user status/role (admin only)
# Requires admin JWT token in Authorization header
PATCH {{baseURL}}/users/{{userID}}
Content-Type: application/json
Authorization: Bearer {{adminAccessToken}}

{
  "status": "active",
  "role": "user"
}

###
# Example: Activate a pending user
PATCH {{baseURL}}/users/2
Content-Type: application/json
Authorization: Bearer {{adminAccessToken}}

{
  "status": "active"
}

###
# Example: Block a user
PATCH {{baseURL}}/users/3
Content-Type: application/json
Authorization: Bearer {{adminAccessToken}}

{
  "status": "blocked"
}

###
# Example: Promote user to admin
PATCH {{baseURL}}/users/4
Content-Type: application/json
Authorization: Bearer {{adminAccessToken}}

{
  "role": "admin"
}

###
# List all projects (authenticated users)
# Optional query parameters: limit (max 100), offset
GET {{baseURL}}/projects?limit=20&offset=0
Authorization: Bearer {{accessToken}}

###
# Get project by ID (authenticated users)
# Returns detailed information about a specific project
GET {{baseURL}}/projects/my-new-project
Authorization: Bearer {{accessToken}}

###
# Create a new project (admin only)
# Requires admin JWT token in Authorization header
POST {{baseURL}}/projects
Content-Type: application/json
Authorization: Bearer {{adminAccessToken}}

{
  "name": "My New Project",
  "repo_url": "https://bitbucket.org/company/repo.git"
}

###
# Update a project (admin only)
# Requires admin JWT token in Authorization header
# All fields are optional - only provided fields will be updated
PATCH {{baseURL}}/projects/my-new-project
Content-Type: application/json
Authorization: Bearer {{adminAccessToken}}

{
  "name": "Updated Project Name",
  "repo_url": "https://bitbucket.org/company/new-repo.git"
}

###
# Update only the project name (admin only)
PATCH {{baseURL}}/projects/my-new-project
Content-Type: application/json
Authorization: Bearer {{adminAccessToken}}

{
  "name": "New Project Name"
}

###
# Update only the repository URL (admin only)
PATCH {{baseURL}}/projects/my-new-project
Content-Type: application/json
Authorization: Bearer {{adminAccessToken}}

{
  "repo_url": "https://bitbucket.org/company/updated-repo.git"
}

###
# Delete a project (admin only)
# WARNING: This permanently deletes the project and all associated tasks, comments, and attachments
DELETE {{baseURL}}/projects/my-new-project
Authorization: Bearer {{adminAccessToken}}

###
# Tasks API

###
# List all tasks (authenticated users)
# Optional query parameters: project, author, assignee, statuses, priorities, sort, limit, offset
GET {{baseURL}}/tasks?limit=20&offset=0
Authorization: Bearer {{accessToken}}

###
# List tasks with filters
# Filter by project, status, priority, author, assignee, and date ranges
GET {{baseURL}}/tasks?project=my-new-project&statuses=New,Open,In%20Progress&priorities=Major,Critical&sort=-priority
Authorization: Bearer {{accessToken}}

###
# Get my tasks (tasks assigned to or created by current user)
# Returns tasks sorted by created_at descending
GET {{baseURL}}/tasks/me
Authorization: Bearer {{accessToken}}

###
# Get task by ID
GET {{baseURL}}/tasks/{{taskId}}
Authorization: Bearer {{accessToken}}

###
# Create a new task
# POST to /tasks
# @name createTask
@taskId={{createTask.response.body.$.id}}
POST {{baseURL}}/tasks
Content-Type: application/json
Authorization: Bearer {{accessToken}}

{
  "project_slug": "my-new-project",
  "title": "Implement user authentication",
  "description": "# Overview\nAdd JWT-based authentication to the API.\n\n## Requirements\n- Login endpoint\n- Token validation middleware",
  "priority": "Major",
  "due_date": "2026-04-20",
  "assignee_id": {{userID}}
}

###
# Create a task with minimal data
# @name createTask
@taskId={{createTask.response.body.$.id}}
POST {{baseURL}}/tasks
Content-Type: application/json
Authorization: Bearer {{accessToken}}

{
  "project_slug": "my-new-project",
  "title": "Fix bug in task numbering"
}

###
# Update a task
PATCH {{baseURL}}/tasks/{{taskId}}
Content-Type: application/json
Authorization: Bearer {{accessToken}}

{
  "title": "Implement user authentication (Updated)",
  "description": "# Overview\nAdd JWT-based authentication to the API.\n\n## Requirements\n- Login endpoint\n- Token validation middleware\n- Logout endpoint",
  "priority": "Critical",
  "status": "In Progress",
  "assignee_id": 1,
  "due_date": "2026-04-18"
}

###
# Update only the status of a task
PATCH {{baseURL}}/tasks/{{taskId}}
Content-Type: application/json
Authorization: Bearer {{accessToken}}

{
  "status": "Resolved"
}

###
# Update only the due date (set to NULL to clear)
PATCH {{baseURL}}/tasks/{{taskId}}
Content-Type: application/json
Authorization: Bearer {{accessToken}}

{
  "due_date": ""
}

###
# Delete a task (soft delete)
DELETE {{baseURL}}/tasks/{{taskId}}
Authorization: Bearer {{accessToken}}

###
# Comments API

###
# Create a new comment on a task
# @name createComment
POST {{baseURL}}/tasks/{{taskId}}/comments
Content-Type: application/json
Authorization: Bearer {{accessToken}}

{
  "content": "This is a comment on the task"
}

###
# Create another comment on the same task
POST {{baseURL}}/tasks/{{taskId}}/comments
Content-Type: application/json
Authorization: Bearer {{accessToken}}

{
  "content": "Another comment with more details about the task"
}

###
# Update a comment
# Requires comment ID from createComment response
@commentId={{createComment.response.body.$.id}}
PUT {{baseURL}}/tasks/{{taskId}}/comments/{{commentId}}
Content-Type: application/json
Authorization: Bearer {{accessToken}}

{
  "content": "Updated comment content"
}

###
# Delete a comment
# Requires comment ID from createComment response
DELETE {{baseURL}}/tasks/{{taskId}}/comments/{{commentId}}
Authorization: Bearer {{accessToken}}

###
# Get task with comments (comments are included in task details)
GET {{baseURL}}/tasks/{{taskId}}
Authorization: Bearer {{accessToken}}

###
# Attachments API

###
# Initialize an attachment upload
# @name initAttachmentUpload
@attachmentId={{initAttachmentUpload.response.body.$.id}}
@uploadURL={{initAttachmentUpload.response.body.$.upload_url}}
POST {{baseURL}}/tasks/{{taskId}}/attachments
Content-Type: application/json
Authorization: Bearer {{accessToken}}

{
  "file_name": "LICENSE",
  "size_bytes": 11358
}

###
# Upload file using presigned URL
# Note: Use the upload_url from the initAttachmentUpload response
PUT {{uploadURL}}
Content-Type: application/octet-stream

< ./LICENSE

###
# Confirm attachment upload
# Required after uploading - commits the attachment
PUT {{baseURL}}/tasks/{{taskId}}/attachments/{{attachmentId}}/confirm
Authorization: Bearer {{accessToken}}

###
# Get attachment download URL
# @name getDownloadURL
@downloadURL={{getDownloadURL.response.body.$.download_url}}
GET {{baseURL}}/tasks/{{taskId}}/attachments/{{attachmentId}}/download
Authorization: Bearer {{accessToken}}

###
# Download file using presigned URL
# Note: Use the download_url from the download response
GET {{downloadURL}}

###
# Delete an attachment
# Requires attachment ID from initAttachmentUpload response
DELETE {{baseURL}}/tasks/{{taskId}}/attachments/{{attachmentId}}
Authorization: Bearer {{accessToken}}

###
# BitBucket Webhook Push Event (fixes #2)
# Public endpoint — no JWT auth required
# Secret key: mysecret
POST {{baseURL}}/webhooks/bitbucket/push
Content-Type: application/json
X-Hub-Signature-256: sha256=b591780f12804490e0e8b437be235dcbb6ccc2ac9087053f2b3116bf09c5a692

{
  "push": {
    "changes": [
      {
        "commits": [
          {
            "hash": "a1b2c3d4e5f6789012345678901234567890abcdef",
            "message": "Fix login redirect loop\n\nfixes #2",
            "author": {"nickname": "dev1"},
            "date": "2026-06-25T10:00:00+00:00"
          }
        ]
      }
    ]
  },
  "repository": {
    "full_name": "my-org/my-repo"
  },
  "actor": {"nickname": "dev1"}
}

###
# BitBucket Webhook Push Event (bare mention #1)
# Public endpoint — no JWT auth required
# Secret key: mysecret
POST {{baseURL}}/webhooks/bitbucket/push
Content-Type: application/json
X-Hub-Signature-256: sha256=c8d3e58153ab0c75626df9ef241dd1240d748a922592fb05e17909ae658b088b

{
  "push": {
    "changes": [
      {
        "commits": [
          {
            "hash": "f0e0d0c0b0a09080706050403020100000000000",
            "message": "Refactored related code\n\nsee #1",
            "author": {"nickname": "dev1"},
            "date": "2026-06-25T11:00:00+00:00"
          }
        ]
      }
    ]
  },
  "repository": {
    "full_name": "my-org/my-repo"
  },
  "actor": {"nickname": "dev1"}
}