Scrum4Me/scripts

API Test Scripts

test-api.sh

Runs curl-based tests against all 7 Scrum4Me API endpoints. Covers happy paths, auth (401), demo-block (403), and input validation (400).

Prerequisites

What	How
Database seeded	npx prisma db seed
Dev server running	npm run dev
curl installed	curl --version

Step 1 — Get a token for lars

1. Open http://localhost:3000 in your browser
2. Log in as lars / scrum4me123
3. Go to Settings → API Tokens
4. Click New token, give it any label
5. Copy the token — it is shown only once

Open scripts/test-api.sh and paste it into TOKEN="".

Step 2 — Find your IDs

You need four IDs. The easiest way is to use the API itself:

# 1. Get PRODUCT_ID — run this after setting TOKEN
curl -s -H "Authorization: Bearer <TOKEN>" http://localhost:3000/api/products | grep -o '"id":"[^"]*"' | head -1

# 2. SPRINT_ID — look in the database or the UI (Sprint → copy ID from the URL)
# 3. STORY_ID  — open a story in the Sprint Board, copy the ID from the URL or the activity log
# 4. TASK_ID   — open a task, copy its ID

Or query the database directly:

# With psql / Neon CLI:
SELECT id FROM "Sprint" WHERE status = 'ACTIVE' LIMIT 1;
SELECT id FROM "Story"  WHERE status = 'IN_SPRINT' LIMIT 1;
SELECT id FROM "Task"   WHERE story_id = '<story-id>' LIMIT 1;

Paste the four values into the variables at the top of test-api.sh.

Step 3 — (Optional) Get a demo token for 403 tests

The 403 demo-block tests are skipped unless you set DEMO_TOKEN.

1. Log out, log in as demo / demo1234
2. Go to Settings → API Tokens, create a token
3. Paste it into DEMO_TOKEN="" in test-api.sh

Step 4 — Run

bash scripts/test-api.sh

Expected output when all IDs are set and a demo token is provided:

============================================================
  Scrum4Me API Test Suite
  Base URL : http://localhost:3000
  Token    : scrum4me... (lars)
  Demo     : demo1234... (403 tests active)
============================================================

── GET /api/products ──────────────────────────────────────────────
  PASS  TC-P-09  happy path (lars)
  PASS  TC-P-01  no token → 401
  PASS  TC-P-02  invalid token → 401

── GET /api/products/:id/next-story ───────────────────────────────
  PASS  TC-NS-08  happy path (lars, 200 or 404 both valid)
  PASS  TC-NS-01  no token → 401
  ...

============================================================
  Results: 30 passed, 0 failed
============================================================

Notes

• product_id is required for POST /api/todos. The Zod schema enforces z.string().min(1). Sending a todo without a product_id returns 400.
• TC-NS-08 accepts both 200 and 404. After a fresh seed lars has no active sprint, so 404 is the expected response unless you create a sprint and add stories to it.
• Reorder test (TC-RO-10) uses a single task ID. A reorder with one element is valid (sort_order is updated to 1).
• The todos happy-path test appends $(date +%s) to the title to avoid duplicate-title issues on repeated runs.