type: collection.insomnia.rest/5.0 schema_version: "5.1" name: NOÉ meta: id: wrk_a54ac8b0b52c441fbdae6d05fba98420 created: 1770073795843 modified: 1770073795843 description: "" collection: - name: Endpoints & Filtrage meta: id: fld_18d8b8a9ffd74acc9cc9037f61f606eb created: 1753422688262 modified: 1759185410892 sortKey: -1753422238091 description: "" children: - name: Projets meta: id: fld_5c20086b9c6940eab181e3f2d7645853 created: 1753423284462 modified: 1759184295693 sortKey: -1753423836774 description: "" children: - name: LIST meta: id: fld_1cda7af7cc9d44bb9f329b0bed96cf5a created: 1753423836674 modified: 1759171331092 sortKey: -1753422806075 description: "" children: - url: "{{ _['Base API Endpoint'] }}/projects/public" name: Projets publics (sans auth) meta: id: req_be02bdd1f9e041739ef68bf505d65ed4 created: 1753423500723 modified: 1753429522373 isPrivate: false description: "" sortKey: -1753423861690 method: GET authentication: type: none settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/projects" name: Simple meta: id: req_015a118bb7f24a488bf8410ee5f07c10 created: 1759171500000 modified: 1759184051917 isPrivate: false description: Tous les projets sans filtre sortKey: -1753424564400 method: GET settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/projects" name: Par nom ($regex) meta: id: req_009cfe1c0d1442b2a2918535141f3537 created: 1759171510000 modified: 1759184122200 isPrivate: false description: Filtrage avec $regex sur le nom sortKey: 0 method: GET parameters: - name: filter value: '{"name": {"$regex": "test", "$options": "i"}}' disabled: false settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/projects" name: Créés après une date ($gt) meta: id: req_a59c48aad35546128c8077bef48b0900 created: 1759171520000 modified: 1759171520000 isPrivate: false description: "" sortKey: 0 method: GET parameters: - name: filter value: '{"createdAt": {"$gt": "2025-01-01"}}' settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/projects" name: Par liste d'IDs ($in) meta: id: req_048644e16b624269a69ebb56e05b1864 created: 1759171530000 modified: 1759171530000 isPrivate: false description: "" sortKey: 0 method: GET parameters: - name: filter value: '{"_id": {"$in": ["{{ _.ProjectID }}", "68831872fcb40efc458b257e"]}}' settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/projects" name: Avec sort, skip, limit meta: id: req_ead50010496e4a24add28a6f1229df22 created: 1759171540000 modified: 1759184258357 isPrivate: false description: "" sortKey: -876711930845 method: GET parameters: - name: sort value: +createdAt,-name - name: skip value: "10" - name: limit value: "5" settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - name: Encadrant·es meta: id: fld_2a21ad7c4ff648b5b3babacaff5563e4 created: 1753423836674 modified: 1753424437500 sortKey: -1753422806082 description: "" children: - name: LIST meta: id: fld_84adcd2511f74d4dae2e062f53e0aff6 created: 1753423836674 modified: 1759171334771 sortKey: -1753422806075 description: "" children: - url: "{{ _['Base API Endpoint'] }}/projects/{{ _.ProjectID }}/stewards" name: Simple meta: id: req_6d42d0d875c04b72a2708b28f6951b39 created: 1759171550000 modified: 1759184232131 isPrivate: false description: "" sortKey: -100 method: GET settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/projects/{{ _.ProjectID }}/stewards" name: Par prénom ($regex) meta: id: req_11a8aca75e99445b9c122456af95b7b4 created: 1759171560000 modified: 1759184248436 isPrivate: false description: "" sortKey: -50 method: GET parameters: - name: filter value: '{"firstName": {"$regex": "Jules"}}' settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/projects/{{ _.ProjectID }}/stewards" name: Créés après une date ($gt) meta: id: req_4b0183e831904b1b8b80044313b404c0 created: 1759171570000 modified: 1759171570000 isPrivate: false description: "" sortKey: 0 method: GET parameters: - name: filter value: '{"createdAt": {"$gt": "2025-01-01"}}' settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/projects/{{ _.ProjectID }}/stewards" name: Avec sort, skip, limit meta: id: req_2e5250f451144ddab0038b9271994840 created: 1759171580000 modified: 1759184250165 isPrivate: false description: "" sortKey: -75 method: GET parameters: - name: sort value: +createdAt,-firstName - name: skip value: "5" - name: limit value: "10" settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - name: Requêtes complexes ($and / $or / $regex) meta: id: fld_2d5309024dbd4ea79f935ce1f5aa1a28 created: 1759171590000 modified: 1759185592280 sortKey: -1753423836874 description: Exemples de combinaisons de filtres avec $and et $or children: - url: "{{ _['Base API Endpoint'] }}/projects" name: $and meta: id: req_039f0a46b72b47ffac772812f39b4ec6 created: 1759171600000 modified: 1759171600000 isPrivate: false description: "" sortKey: 0 method: GET parameters: - name: filter value: '{"$and": [{"createdAt": {"$gt": "2025-01-01"}}, {"name": {"$regex": "Atelier"}}]}' settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/projects" name: $or meta: id: req_c467bdec04974b9eac976b1a9e549b5f created: 1759171610000 modified: 1759171610000 isPrivate: false description: "" sortKey: 0 method: GET parameters: - name: filter value: '{"$or": [{"name": {"$regex": "Atelier"}}, {"name": {"$regex": "Stage"}}]}' settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/projects" name: $regex ne contenant pas "..." meta: id: req_50258c9210ce448ba29fcf9097177883 created: 1759185511496 modified: 1759185614694 isPrivate: false description: "" sortKey: -100 method: GET parameters: - name: filter value: '{"name": {"$not": {"$regex": "test"}}}' settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/projects" name: $regex avec options (i = case insensitive, g = general, ...) meta: id: req_a84505eabe6847c6895088dec2e25e74 created: 1759185641326 modified: 1759185655480 isPrivate: false description: "" sortKey: -87.5 method: GET parameters: - name: filter value: '{"name": {"$not": {"$regex": "test", "$options": "ig"}}}' settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - name: Activités meta: id: fld_bc309cf827984811bba40daf60a73847 created: 1759171700000 modified: 1759171700000 sortKey: -1753422806090 description: "" children: - name: LIST meta: id: fld_5530f14b83fd4ab2ae527ea108161d57 created: 1759171701000 modified: 1759171701000 sortKey: -1753422806070 description: "" children: - url: "{{ _['Base API Endpoint'] }}/projects/{{ _.ProjectID }}/activities" name: Avec sort, skip, limit meta: id: req_1b2aa1b62b1e4d339f2881de35e3661a created: 1759172925746 modified: 1759184252984 isPrivate: false description: "" sortKey: -50 method: GET parameters: - name: sort value: +createdAt,-name - name: skip value: "2" - name: limit value: "5" settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/projects/{{ _.ProjectID }}/activities" name: Créées après une date ($gt) meta: id: req_96a6874c1d0245ec9780f26f98027ceb created: 1759172925746 modified: 1759172925746 isPrivate: false description: "" sortKey: 0 method: GET parameters: - name: filter value: '{"createdAt": {"$gt": "2025-01-01"}}' settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/projects/{{ _.ProjectID }}/activities" name: Simple meta: id: req_a05032b1d2ee414a8883805781b95ded created: 1759172925746 modified: 1759184172121 isPrivate: false description: "" sortKey: -100 method: GET settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/projects/{{ _.ProjectID }}/activities" name: Par nom ($regex) meta: id: req_ad9bf92741fd48b5bd42ca5ede8a18a2 created: 1759172925746 modified: 1759184219698 isPrivate: false description: "" sortKey: 0 method: GET parameters: - name: filter value: '{"name": {"$regex": "Yoga"}}' settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - name: Catégories meta: id: fld_d8678f3d243d43d28c4c22ccb01a9bcf created: 1759171710000 modified: 1759184279652 sortKey: 0 description: "" children: - name: LIST meta: id: fld_d235b98f8aed4564af06b9033f203260 created: 1759171711000 modified: 1759171711000 sortKey: 0 description: "" children: - url: "{{ _['Base API Endpoint'] }}/projects/{{ _.ProjectID }}/categories" name: Avec sort, skip, limit meta: id: req_3f78af944f894647b5ef97abb9386b33 created: 1759172925746 modified: 1759172925746 isPrivate: false description: "" sortKey: 0 method: GET parameters: - name: sort value: +name - name: limit value: "10" settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/projects/{{ _.ProjectID }}/categories" name: Simple meta: id: req_42a0fa2cd433463ebcede4d5e5fbfa76 created: 1759172925746 modified: 1759172925746 isPrivate: false description: "" sortKey: 0 method: GET settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/projects/{{ _.ProjectID }}/categories" name: Par nom ($regex) meta: id: req_89ebba3859ea4de59a8e789cbe720748 created: 1759172925746 modified: 1759172925746 isPrivate: false description: "" sortKey: 0 method: GET parameters: - name: filter value: '{"name": {"$regex": "Sport"}}' settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - name: Espaces meta: id: fld_385e79bce40347f584155e4df4c6cafb created: 1759171720000 modified: 1759185377458 sortKey: 0 description: "" children: - name: LIST meta: id: fld_e28c0b0755be4f91b65c437b068f6de9 created: 1759171721000 modified: 1759171721000 sortKey: 0 description: "" children: - url: "{{ _['Base API Endpoint'] }}/projects/{{ _.ProjectID }}/places" name: Simple meta: id: req_54fe70a268cd4f8198e61cd4cea850d2 created: 1759172925746 modified: 1759185385130 isPrivate: false description: "" sortKey: -100 method: GET settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/projects/{{ _.ProjectID }}/places" name: Par ville ($regex) meta: id: req_e118750b45d841f3bcb97aea3e1a5a85 created: 1759172925746 modified: 1759185395720 isPrivate: false description: "" sortKey: -50 method: GET parameters: - name: filter value: '{"name": {"$regex": "Salle"}}' settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/projects/{{ _.ProjectID }}/places" name: Avec sort, skip, limit meta: id: req_fde7c37c4814453a8f9c3ad2ff49ac8c created: 1759172925746 modified: 1759172925746 isPrivate: false description: "" sortKey: 0 method: GET parameters: - name: sort value: -createdAt - name: skip value: "1" - name: limit value: "3" settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - name: Sessions meta: id: fld_0c263b5432ca4694be6c553af9cd877c created: 1759171730000 modified: 1759184276920 sortKey: 0 description: "" children: - name: LIST meta: id: fld_92c2c923a8bb42dfaa6530c0f383ac22 created: 1759171731000 modified: 1759171731000 sortKey: 0 description: "" children: - url: "{{ _['Base API Endpoint'] }}/projects/{{ _.ProjectID }}/sessions" name: Avec sort, skip, limit meta: id: req_0ace17d77bb743a690737b68473936f4 created: 1759172925746 modified: 1759172925746 isPrivate: false description: "" sortKey: 0 method: GET parameters: - name: sort value: +date - name: limit value: "20" settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/projects/{{ _.ProjectID }}/sessions" name: Par date ($gt) meta: id: req_2d08ddfdfe1e42d5a29cbf198107d1d1 created: 1759172925746 modified: 1759184475807 isPrivate: false description: "" sortKey: 0 method: GET parameters: - name: filter value: '{"date": {"$gt": "2025-01-01"}}' settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/projects/{{ _.ProjectID }}/sessions" name: Simple meta: id: req_fdd194f221c04808aa54fd6275818bd6 created: 1759172925746 modified: 1759184449197 isPrivate: false description: "" sortKey: -100 method: GET settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - name: Inscriptions meta: id: fld_2ed850565d064525bfea1abf4794ed16 created: 1759171740000 modified: 1759184281041 sortKey: 0 description: "" children: - name: LIST meta: id: fld_97e7c18064ee4ffd9b6541b49daee766 created: 1759171741000 modified: 1759171741000 sortKey: 0 description: "" children: - url: "{{ _['Base API Endpoint'] }}/projects/{{ _.ProjectID }}/registrations" name: Simple meta: id: req_44fe54427f0c488daa0db5744c42720f created: 1759172925746 modified: 1759185350610 isPrivate: false description: "" sortKey: -100 method: GET settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/projects/{{ _.ProjectID }}/registrations" name: Avec sort, skip, limit meta: id: req_57ac2656e35d41fe89721050607eb4c3 created: 1759172925746 modified: 1759172925746 isPrivate: false description: "" sortKey: 0 method: GET parameters: - name: sort value: -createdAt - name: skip value: "2" - name: limit value: "5" settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/projects/{{ _.ProjectID }}/registrations" name: Par user ($eq) meta: id: req_f2b20522da0e46f1867a58fbd519d7b4 created: 1759172925746 modified: 1759185329268 isPrivate: false description: "" sortKey: 0 method: GET parameters: - name: filter value: '{"user": "{{ _.UserID }}"}' settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true authentication: type: apikey key: Authorization value: JWT {{ _['JWT token'] }} disabled: false addTo: header - name: Security Tests meta: id: fld_cc584afb294b4a2db80bd84a555e59b8 created: 1757073600000 modified: 1757073600000 sortKey: -1757073600000 description: Security test suite for enumeration prevention and rate limiting children: - name: 4. User Lookup Tests meta: id: fld_2a6e7f687fc64026aa3a3c2819aab450 created: 1757073600000 modified: 1757073600000 sortKey: -70 description: Test user lookup for privacy protection children: - url: "{{ _['Base API Endpoint'] }}/users/{{ _['Second User Email'] }}" name: 4.2 Lookup Other User meta: id: req_17c6510141b84c3b942153f22161b330 created: 1757073600000 modified: 1757073600000 isPrivate: false description: Should return only basic info (firstName, lastName, email) sortKey: -90 method: GET headers: - name: Content-Type value: application/json authentication: type: apikey key: Authorization value: JWT {{ _['JWT token'] }} disabled: false addTo: header settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/users/{{ _['Non-Existent Email'] }}" name: 4.4 Rate Limiting meta: id: req_5d15d60d93d1418b98380f220fb82d49 created: 1757073600000 modified: 1757073600000 isPrivate: false description: Send 22 times to test rate limiting (21 per 30 minutes per user) sortKey: -70 method: GET headers: - name: Content-Type value: application/json authentication: type: apikey key: Authorization value: JWT {{ _['JWT token'] }} disabled: false addTo: header settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/users/{{ _['Non-Existent Email'] }}" name: 4.3 Lookup Non-Existent User meta: id: req_71bc4aa40379460faef694d3ccb04a6a created: 1757073600000 modified: 1757073600000 isPrivate: false description: Should return 404 with generic error message sortKey: -80 method: GET headers: - name: Content-Type value: application/json authentication: type: apikey key: Authorization value: JWT {{ _['JWT token'] }} disabled: false addTo: header settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/users/{{ _['Valid User Email'] }}" name: 4.1 Lookup Own Profile meta: id: req_8447e6cbf3a543e8a1e4c9d8fe0fd864 created: 1757073600000 modified: 1770075557378 isPrivate: false description: Should return full profile sortKey: -100 method: GET headers: - name: Content-Type value: application/json authentication: type: apikey key: Authorization value: JWT {{ _['JWT token'] }} disabled: false addTo: header settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - name: 1. Authentication Tests meta: id: fld_2b38336516194b4ba28dc4ccd5d3fbf5 created: 1757073600000 modified: 1757073600000 sortKey: -100 description: Test authentication endpoints for enumeration prevention and rate limiting children: - url: "{{ _['Base API Endpoint'] }}/auth/authenticate" name: 1.3 Wrong Password meta: id: req_19065df9953843f4afc98f7421709474 created: 1757073600000 modified: 1770074205087 isPrivate: false description: Verify wrong password returns same error as non-existent user sortKey: -80 method: POST body: mimeType: application/json text: |- { "email": "{{ _['Valid User Email'] }}", "password": "{{ _['Wrong Password'] }}" } headers: - name: Content-Type value: application/json authentication: type: none settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/auth/authenticate" name: 1.1 Successful Login meta: id: req_48395154d6f14959819f94623b85c4b5 created: 1757073600000 modified: 1770074196078 isPrivate: false description: Verify valid credentials return JWT token sortKey: -100 method: POST body: mimeType: application/json text: |- { "email": "{{ _['Valid User Email'] }}", "password": "{{ _['Valid User Password'] }}" } headers: - name: Content-Type value: application/json authentication: type: none settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/auth/authenticate" name: 1.4 Brute Force Protection meta: id: req_85d1c01d233a460595a1817eb3994259 created: 1757073600000 modified: 1770074208814 isPrivate: false description: Send 7+ times to test rate limiting (7 attempts per 15 minutes) sortKey: -70 method: POST body: mimeType: application/json text: |- { "email": "{{ _['Non-Existent Email'] }}", "password": "{{ _['Wrong Password'] }}" } headers: - name: Content-Type value: application/json authentication: type: none settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/auth/authenticate" name: 1.2 Non-Existent User meta: id: req_f639faed9b7f48dbaf290bfe0399b96c created: 1757073600000 modified: 1770074201585 isPrivate: false description: Verify non-existent user returns 401 (not 404) to prevent enumeration sortKey: -90 method: POST body: mimeType: application/json text: |- { "email": "{{ _['Non-Existent Email'] }}", "password": "{{ _['Wrong Password'] }}" } headers: - name: Content-Type value: application/json authentication: type: none settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - name: 2. Password Reset Tests meta: id: fld_554b2ef26da44216996b19b61bf9df50 created: 1757073600000 modified: 1757073600000 sortKey: -90 description: Test password reset for enumeration prevention children: - url: "{{ _['Base API Endpoint'] }}/auth/password/sendResetEmail" name: 2.1 Valid Password Reset meta: id: req_2fcf3653c8a44961bf16e5506dd7916c created: 1757073600000 modified: 1770074222273 isPrivate: false description: Request password reset for valid user sortKey: -100 method: POST body: mimeType: application/json text: |- { "email": "{{ _['Valid User Email'] }}", "url": "{{ _['Redirect URL'] }}" } headers: - name: Content-Type value: application/json authentication: type: none settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/auth/password/sendResetEmail" name: 2.2 Non-Existent User meta: id: req_5310d2da75aa4b5ba845b4579847addf created: 1757073600000 modified: 1770074227345 isPrivate: false description: Should return 200 OK (same as valid) to prevent enumeration sortKey: -90 method: POST body: mimeType: application/json text: |- { "email": "{{ _['Non-Existent Email'] }}", "url": "{{ _['Redirect URL'] }}" } headers: - name: Content-Type value: application/json authentication: type: none settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/auth/password/sendResetEmail" name: 2.3 Malicious Redirect URL meta: id: req_7b1688c107d544bb892c398f285c86fe created: 1757073600000 modified: 1770074230341 isPrivate: false description: Should block external redirect URLs sortKey: -80 method: POST body: mimeType: application/json text: |- { "email": "{{ _['Valid User Email'] }}", "url": "{{ _['Malicious URL'] }}" } headers: - name: Content-Type value: application/json authentication: type: none settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/auth/password/sendResetEmail" name: 2.4 Rate Limiting meta: id: req_a1f0ac8875e645589562946d488d1f83 created: 1757073600000 modified: 1770074234554 isPrivate: false description: Send 5 times to test rate limiting (4 per hour per email) sortKey: -70 method: POST body: mimeType: application/json text: |- { "email": "{{ _['Valid User Email'] }}", "url": "{{ _['Redirect URL'] }}" } headers: - name: Content-Type value: application/json authentication: type: none settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - name: 3. Invitation Tests meta: id: fld_a3148cc0e5a148a39ef33dacb6c4a387 created: 1757073600000 modified: 1757073600000 sortKey: -80 description: Test invitation endpoint for security children: - url: "{{ _['Base API Endpoint'] }}/projects/{{ _['ProjectID'] }}/registrations/sendInvitationEmail" name: 3.4 Invalid Email Format meta: id: req_613fc539be464367a028445cb489b6f2 created: 1757073600000 modified: 1770075252674 isPrivate: false description: Should return 422 validation error sortKey: -70 method: POST body: mimeType: application/json text: |- { "user": { "email": "not-an-email", "firstName": "Test", "lastName": "User" }, "role": "contrib" } headers: - name: Content-Type value: application/json authentication: type: apikey key: Authorization value: JWT {{ _['JWT token'] }} disabled: false addTo: header settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/projects/{{ _['ProjectID'] }}/registrations/sendInvitationEmail" name: 3.5 Rate Limiting meta: id: req_b893908bfc5d475aaeae2ac1539e87c8 created: 1757073600000 modified: 1770075244761 isPrivate: false description: Send 21 times to test rate limiting (20 per hour per project) sortKey: -60 method: POST body: mimeType: application/json text: |- { "user": { "email": "{{ _['Non-Existent Email'] }}", "firstName": "Test", "lastName": "User" }, "role": "contrib" } headers: - name: Content-Type value: application/json authentication: type: apikey key: Authorization value: JWT {{ _['JWT token'] }} disabled: false addTo: header settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/projects/{{ _['ProjectID'] }}/registrations/sendInvitationEmail" name: 3.1 Invite Existing User meta: id: req_d51264dd6b534d97a6403e48a1168423 created: 1757073600000 modified: 1770075261576 isPrivate: false description: Invite user with existing account (no email should be sent) sortKey: -100 method: POST body: mimeType: application/json text: |- { "user": { "email": "{{ _['Valid User Email'] }}", "firstName": "Test", "lastName": "User" }, "role": "contrib" } headers: - name: Content-Type value: application/json authentication: type: apikey key: Authorization value: JWT {{ _['JWT token'] }} disabled: false addTo: header settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/projects/{{ _['ProjectID'] }}/registrations/sendInvitationEmail" name: 3.2 Invite New User meta: id: req_d53adde797194a72b25c3e8eab5c4972 created: 1757073600000 modified: 1770075259004 isPrivate: false description: Invite new user (email should be sent) sortKey: -90 method: POST body: mimeType: application/json text: |- { "user": { "email": "{{ _['Non-Existent Email'] }}", "firstName": "New", "lastName": "User" }, "role": "contrib" } headers: - name: Content-Type value: application/json authentication: type: apikey key: Authorization value: JWT {{ _['JWT token'] }} disabled: false addTo: header settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - name: HelloAsso Ticketing Tests meta: id: fld_d7ec1bba48ab45d6a9f7be310bb4b170 created: 1757951539250 modified: 1757958973727 sortKey: -1757951532196 description: "" children: - url: "{{ _['Base API Endpoint'] }}/projects/test-nouveau-systeme-hello-asso/ticketing/onHelloAssoOrde\ r" name: "onHelloAssoOrder : Order avec 1 ticket valide" meta: id: req_102bb97568a6470dbe4c841a01f0684b created: 1757951539252 modified: 1759168405842 isPrivate: false description: "" sortKey: -1757958985775.25 method: POST body: mimeType: text/plain text: >- { "data": { "payer": { "email": "jules.lecuir@outlook.fr", "country": "FRA", "firstName": "Jules", "lastName": "Lecuir" }, "items": [ { "name": "Billet test prix libre 1", "user": { "firstName": "Jules", "lastName": "Lecuir" }, "priceCategory": "Pwyw", "minAmount": 0, "options": [ { "name": "Option obligatoire sur tous tarifs", "amount": 0, "priceCategory": "Free", "isRequired": true, "customFields": [], "optionId": 16259438 } ], "ticketUrl": "https://www.helloasso.com/associations/assemblee-virtuelle/evenements/test-billetterie-noe/ticket?ticketId=148144319&ag=148144319", "qrCode": "MTQ4MTQ0MzE5OjYzODkzNTYyMzMzNzc3OTIwNw==", "tierId": 16259237, "id": 148144319, "amount": 0, "type": "Registration", "initialAmount": 0, "state": "Processed" } ], "amount": { "total": 0, "vat": 0, "discount": 0 }, "id": 148144319, "date": "2025-09-15T19:45:33.7779207+02:00", "formSlug": "test-billetterie-noe", "formType": "Event", "organizationName": "Assemblée Virtuelle", "organizationSlug": "assemblee-virtuelle", "organizationType": "Association1901Rig", "organizationIsUnderColucheLaw": false, "meta": { "createdAt": "2025-09-15T19:45:33.7779207+02:00", "updatedAt": "2025-09-15T19:45:34.3434065+02:00" }, "isAnonymous": false, "isAmountHidden": false }, "eventType": "Order" } headers: - name: Content-Type value: application/json settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/projects/test-nouveau-systeme-hello-asso/ticketing/check/148144319" name: "check : Ticket valide (OK ou conflit si déjà ajouté)" meta: id: req_997de93799464e069c7a0de74af28025 created: 1757951539254 modified: 1757960141398 isPrivate: false description: "" sortKey: -1757951532245 method: POST headers: - name: Content-Type value: application/json authentication: type: apikey key: Authorization value: JWT {{ _['JWT token'] }} disabled: false addTo: header settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/projects/test-nouveau-systeme-hello-asso/ticketing/onHelloAssoOrde\ r" name: "onHelloAssoOrder : Order avec plusieurs tickets valides" meta: id: req_a5e20c1e16b944b5ad79aa63d8955c93 created: 1757958652823 modified: 1757959072706 isPrivate: false description: "" sortKey: -1757958985944 method: POST body: mimeType: text/plain text: >- { "data": { "payer": { "email": "jules.lecuir@outlook.fr", "country": "FRA", "firstName": "Jules", "lastName": "Lecuir" }, "items": [ { "name": "Billet test prix libre 1", "user": { "firstName": "Jules", "lastName": "Lecuir" }, "priceCategory": "Pwyw", "minAmount": 0, "options": [ { "name": "Option obligatoire sur tous tarifs", "amount": 0, "priceCategory": "Free", "isRequired": true, "customFields": [], "optionId": 16259438 } ], "ticketUrl": "https://www.helloasso.com/associations/assemblee-virtuelle/evenements/test-billetterie-noe/ticket?ticketId=148144319&ag=148144319", "qrCode": "MTQ4MTQ0MzE5OjYzODkzNTYyMzMzNzc3OTIwNw==", "tierId": 16259237, "id": 148144319, "amount": 0, "type": "Registration", "initialAmount": 0, "state": "Processed" }, { "name": "Billet test prix libre 2 quantité limitée ", "user": { "firstName": "Jules", "lastName": "Lecuir" }, "priceCategory": "Pwyw", "minAmount": 0, "options": [ { "name": "Option obligatoire sur tous tarifs", "amount": 0, "priceCategory": "Free", "isRequired": true, "customFields": [], "optionId": 16259438 } ], "ticketUrl": "https://www.helloasso.com/associations/assemblee-virtuelle/evenements/test-billetterie-noe/ticket?ticketId=148144321&ag=148144319", "qrCode": "MTQ4MTQ0MzIxOjYzODkzNTYyMzMzNzc3OTIwNw==", "tierId": 16259238, "id": 148144321, "amount": 0, "type": "Registration", "initialAmount": 0, "state": "Processed" }, { "name": "Billet test gratuit", "user": { "firstName": "Jules", "lastName": "Lecuir" }, "priceCategory": "Free", "options": [ { "name": "Option obligatoire sur tous tarifs", "amount": 0, "priceCategory": "Free", "isRequired": true, "customFields": [], "optionId": 16259438 } ], "ticketUrl": "https://www.helloasso.com/associations/assemblee-virtuelle/evenements/test-billetterie-noe/ticket?ticketId=148144323&ag=148144319", "qrCode": "MTQ4MTQ0MzIzOjYzODkzNTYyMzMzNzc3OTIwNw==", "tierId": 16259463, "id": 148144323, "amount": 0, "type": "Registration", "initialAmount": 0, "state": "Processed" } ], "amount": { "total": 0, "vat": 0, "discount": 0 }, "id": 148144319, "date": "2025-09-15T19:45:33.7779207+02:00", "formSlug": "test-billetterie-noe", "formType": "Event", "organizationName": "Assemblée Virtuelle", "organizationSlug": "assemblee-virtuelle", "organizationType": "Association1901Rig", "organizationIsUnderColucheLaw": false, "meta": { "createdAt": "2025-09-15T19:45:33.7779207+02:00", "updatedAt": "2025-09-15T19:45:34.3434065+02:00" }, "isAnonymous": false, "isAmountHidden": false }, "eventType": "Order" } headers: - name: Content-Type value: application/json settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/projects/test-nouveau-systeme-hello-asso/ticketing/onHelloAssoOrde\ r" name: "onHelloAssoOrder : JSON Invalide" meta: id: req_14884dafa0b8423583bf6b0f518c716c created: 1757958752125 modified: 1757959242946 isPrivate: false description: "" sortKey: -1757951532257.5 method: POST body: mimeType: text/plain text: >- { "data: { "payer": { "email": "jules.lecuir@outlook.fr", "country": "FRA", "firstName": "Jules", "lastName": "Lecuir" }, "items": [ { "name": "Billet test prix libre 1", "user": { "firstName": "Jules", "lastName": "Lecuir" }, "priceCategory": "Pwyw", "minAmount": 0, "options": [ { "name": "Option obligatoire sur tous tarifs", "amount": 0, "priceCategory": "Free", "isRequired": true, "customFields": [], "optionId": 16259438 } ], "ticketUrl": "https://www.helloasso.com/associations/assemblee-virtuelle/evenements/test-billetterie-noe/ticket?ticketId=148144319&ag=148144319", "qrCode": "MTQ4MTQ0MzE5OjYzODkzNTYyMzMzNzc3OTIwNw==", "tierId": 16259237, "id": 148144319, "amount": 0, "type": "Registration", "initialAmount": 0, "state": "Processed" } ], "amount": { "total": 0, "vat": 0, "discount": 0 }, "id": 148144319, "date": "2025-09-15T19:45:33.7779207+02:00", "formSlug": "test-billetterie-noe", "formType": "Event", "organizationName": "Assemblée Virtuelle", "organizationSlug": "assemblee-virtuelle", "organizationType": "Association1901Rig", "organizationIsUnderColucheLaw": false, "meta": { "createdAt": "2025-09-15T19:45:33.7779207+02:00", "updatedAt": "2025-09-15T19:45:34.3434065+02:00" }, "isAnonymous": false, "isAmountHidden": false }, "eventType": "Order" } headers: - name: Content-Type value: application/json settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/projects/test-nouveau-systeme-hello-asso/ticketing/onHelloAssoOrde\ r" name: "onHelloAssoOrder : Ticket d'une autre billetterie" meta: id: req_f5ca32a7cf914cb4a7871529312ccfb4 created: 1757958884877 modified: 1757958898544 isPrivate: false description: "" sortKey: -1757951532251.25 method: POST body: mimeType: text/plain text: >- { "data": { "payer": { "email": "jules.lecuir@outlook.fr", "country": "FRA", "firstName": "Jules", "lastName": "Lecuir" }, "items": [ { "name": "Billet test prix libre 1", "user": { "firstName": "Jules", "lastName": "Lecuir" }, "priceCategory": "Pwyw", "minAmount": 0, "options": [ { "name": "Option obligatoire sur tous tarifs", "amount": 0, "priceCategory": "Free", "isRequired": true, "customFields": [], "optionId": 16259438 } ], "ticketUrl": "https://www.helloasso.com/associations/assemblee-virtuelle/evenements/test-billetterie-noe/ticket?ticketId=148144319&ag=148144319", "qrCode": "MTQ4MTQ0MzE5OjYzODkzNTYyMzMzNzc3OTIwNw==", "tierId": 16259237, "id": 148144319, "amount": 0, "type": "Registration", "initialAmount": 0, "state": "Processed" } ], "amount": { "total": 0, "vat": 0, "discount": 0 }, "id": 148144319, "date": "2025-09-15T19:45:33.7779207+02:00", "formSlug": "test-billetterie-noe-autre", "formType": "Event", "organizationName": "Assemblée Virtuelle", "organizationSlug": "assemblee-virtuelle", "organizationType": "Association1901Rig", "organizationIsUnderColucheLaw": false, "meta": { "createdAt": "2025-09-15T19:45:33.7779207+02:00", "updatedAt": "2025-09-15T19:45:34.3434065+02:00" }, "isAnonymous": false, "isAmountHidden": false }, "eventType": "Order" } headers: - name: Content-Type value: application/json settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/projects/test-nouveau-systeme-hello-asso/ticketing/onHelloAssoOrde\ r" name: "onHelloAssoOrder : Ticket d'une autre orga " meta: id: req_08342f446e3b4637b03bb06147524fd6 created: 1757958920605 modified: 1757958932913 isPrivate: false description: "" sortKey: -1757951532248.125 method: POST body: mimeType: text/plain text: >- { "data": { "payer": { "email": "jules.lecuir@outlook.fr", "country": "FRA", "firstName": "Jules", "lastName": "Lecuir" }, "items": [ { "name": "Billet test prix libre 1", "user": { "firstName": "Jules", "lastName": "Lecuir" }, "priceCategory": "Pwyw", "minAmount": 0, "options": [ { "name": "Option obligatoire sur tous tarifs", "amount": 0, "priceCategory": "Free", "isRequired": true, "customFields": [], "optionId": 16259438 } ], "ticketUrl": "https://www.helloasso.com/associations/assemblee-virtuelle/evenements/test-billetterie-noe/ticket?ticketId=148144319&ag=148144319", "qrCode": "MTQ4MTQ0MzE5OjYzODkzNTYyMzMzNzc3OTIwNw==", "tierId": 16259237, "id": 148144319, "amount": 0, "type": "Registration", "initialAmount": 0, "state": "Processed" } ], "amount": { "total": 0, "vat": 0, "discount": 0 }, "id": 148144319, "date": "2025-09-15T19:45:33.7779207+02:00", "formSlug": "test-billetterie-noe", "formType": "Event", "organizationName": "Assemblée Virtuelle", "organizationSlug": "assemblee-virtuelle-autre", "organizationType": "Association1901Rig", "organizationIsUnderColucheLaw": false, "meta": { "createdAt": "2025-09-15T19:45:33.7779207+02:00", "updatedAt": "2025-09-15T19:45:34.3434065+02:00" }, "isAnonymous": false, "isAmountHidden": false }, "eventType": "Order" } headers: - name: Content-Type value: application/json settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true - url: "{{ _['Base API Endpoint'] }}/projects/test-nouveau-systeme-hello-asso/ticketing/check/148144314" name: "check : Ticket invalide" meta: id: req_5031af72c25a494d9aa81c8f71dee8ab created: 1757959087597 modified: 1757960094135 isPrivate: false description: "" sortKey: -1755688048242.5 method: POST headers: - name: Content-Type value: application/json authentication: type: apikey key: Authorization value: JWT {{ _['JWT token'] }} disabled: false addTo: header settings: renderRequestBody: true encodeUrl: true followRedirects: global cookies: send: true store: true rebuildPath: true cookieJar: name: Default Jar meta: id: jar_4be7922d70524f1fbf2fca8bff25f154 created: 1753422238160 modified: 1753422238160 environments: name: NOÉ meta: id: env_a67819a7b1f34a15b84cf09e370a8415 created: 1753422238158 modified: 1770075606234 isPrivate: false data: Base API Endpoint: http://localhost:4000 JWT token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY5ODEyZmRhNDZlNmQ3NzExNGNiZGI0NSIsImlhdCI6MTc3MDA3NDI4MSwiZXhwIjoxODAzNzcwMjgxfQ.wvHrVLjgwRKWxmYGuPaE8wVAvybn1WwPDasIjYElPK4 ProjectID: 6981315da9e9b77b387336d1 ActivityID: 68831872fcb40efc458b2580 CategoryID: 68831872fcb40efc458b2581 PlaceID: 68831872fcb40efc458b2582 SessionID: 68831872fcb40efc458b2583 RegistrationID: 68831872fcb40efc458b2584 UserID: 615c3230256f4f00677a9bc6 Valid User Email: test-env@test.com Valid User Password: TestPassword123! Wrong Password: WrongPassword123! Non-Existent Email: nonexistent@example.com Second User Email: julos@julos.fr Redirect URL: http://localhost:3000/resetpassword Malicious URL: http://malicious-site.com/resetpassword