test: expand coverage and add scoped API collection

collection/README.md

@@ -0,0 +1,37 @@
+# Kernel API — Bruno Collection
+
+This collection contains only the API operations used by the Kernel frontend,
+along with the saved responses available for those operations.
+
+## Open the collection
+
+1. Install and open Bruno.
+2. Choose **Open Collection**.
+3. Select this `collection` directory.
+4. Select the **development** environment.
+
+## Included requests
+
+- Authentication: register, login, OTP request, refresh token, forgot password,
+  change password, and logout.
+- Account: current account, profile and username updates, and email verification.
+- Roles: list, create, details, update, and delete.
+- Permissions: list.
+- Users: list, create, details, update, delete, status, system-admin, password,
+  roles, and workspaces.
+- Workspaces: list, used as options when assigning a user to workspaces.
+
+The frontend refreshes an expired access token through `/auth/refresh-token`,
+so that request is included even though it is handled by the shared API client
+rather than a feature page.
+
+## First run
+
+Run the login request with a local test account. Its post-response script stores
+the returned access token as `access_token` in the active environment. The
+remaining authenticated requests use that token.
+
+Saved response files sit beside each request and are named after their HTTP
+status code.
+
+Do not store real passwords or access tokens in this shared collection.

collection/account/folder.bru

@@ -0,0 +1,4 @@
+meta {
+  name: Account
+  seq: 1
+}

collection/account/me/200.json

@@ -0,0 +1,12 @@
+{
+  "email": "user@example.com",
+  "first_name": "علی",
+  "id": "2dc56d6f-6b5a-4e0d-9b0b-9a1c9d7f8d41",
+  "is_system_admin": true,
+  "last_name": "رضایی",
+  "mobile": "09123456789",
+  "permissions": ["users.read", "users.create", "users.update"],
+  "personnel_code": "EMP-1001",
+  "status": "active",
+  "username": "user"
+}

collection/account/me/401.json

@@ -0,0 +1,3 @@
+{
+  "message": "احراز هویت شما معتبر نیست یا منقضی شده است."
+}

collection/account/me/index.bru

@@ -0,0 +1,42 @@
+meta {
+  name: Me
+  type: http
+  seq: 1
+}
+
+get {
+  url: {{base_url}}/account/me
+  body: none
+  auth: bearer
+}
+
+auth:bearer {
+  token: {{access_token}}
+}
+
+headers {
+  Accept: application/json
+}
+
+docs {
+  ## Purpose
+
+  Returns the profile of the currently authenticated user.
+
+  ## Authentication
+
+  Requires a valid access token.
+
+  ## Behavior
+
+  - Returns the authenticated user's profile, including `personnel_code` and `is_system_admin`.
+  - `is_system_admin` indicates whether the user has the global `SYSTEM_ADMIN` capability.
+  - An authenticated `SYSTEM_ADMIN` can use every service without assigned role permissions.
+  - No per-user language preference is returned; the system language applies to every user.
+  - No request body or query parameters are required.
+
+  ## Response
+
+  - `200 OK` — User profile returned successfully.
+  - `401 Unauthorized` — The access token is missing, invalid, or expired.
+}

collection/account/request-email-verification/200.json

@@ -0,0 +1,4 @@
+{
+  "expires_in": 120,
+  "remaining_seconds": 120
+}

collection/account/request-email-verification/400.json

@@ -0,0 +1,6 @@
+{
+  "cause": {
+    "email": "آدرس ایمیل معتبر نیست."
+  },
+  "message": "اطلاعات ارسال‌شده معتبر نیست."
+}

collection/account/request-email-verification/401.json

@@ -0,0 +1,3 @@
+{
+  "message": "احراز هویت شما معتبر نیست یا منقضی شده است."
+}

collection/account/request-email-verification/429.json

@@ -0,0 +1,3 @@
+{
+  "message": "تعداد درخواست‌ها بیش از حد مجاز است. لطفاً کمی بعد دوباره تلاش کنید."
+}

collection/account/request-email-verification/index.bru

@@ -0,0 +1,50 @@
+meta {
+  name: Request Email Verification
+  type: http
+  seq: 4
+}
+
+post {
+  url: {{base_url}}/account/request-email-verification
+  body: json
+  auth: bearer
+}
+
+auth:bearer {
+  token: {{access_token}}
+}
+
+headers {
+  Content-Type: application/json
+  Accept: application/json
+}
+
+body:json {
+  {
+    "email": "user@example.com"
+  }
+}
+
+docs {
+  ## Purpose
+
+  Sends a verification code to an email address before assigning it to the authenticated user.
+
+  ## Authentication
+
+  Requires a valid access token.
+
+  ## Behavior
+
+  - Sends a verification code to the provided email address.
+  - The current profile email remains unchanged until verification succeeds.
+  - The same flow is used for both setting an email for the first time and changing an existing email.
+  - Repeated requests may be rate limited.
+
+  ## Response
+
+  - `200 OK` — Verification code sent successfully.
+  - `400 Bad Request` — The email is invalid or cannot be used.
+  - `401 Unauthorized` — The access token is missing, invalid, or expired.
+  - `429 Too Many Requests` — The request rate limit has been exceeded.
+}

collection/account/update-profile/200.json

@@ -0,0 +1,12 @@
+{
+  "email": "user@example.com",
+  "first_name": "علی",
+  "id": "2dc56d6f-6b5a-4e0d-9b0b-9a1c9d7f8d41",
+  "is_system_admin": true,
+  "last_name": "رضایی",
+  "mobile": "09123456789",
+  "permissions": ["users.read", "users.create", "users.update"],
+  "personnel_code": "EMP-1001",
+  "status": "active",
+  "username": "user"
+}

collection/account/update-profile/400.json

@@ -0,0 +1,8 @@
+{
+  "cause": {
+    "first_name": "نام معتبر نیست.",
+    "last_name": "نام خانوادگی معتبر نیست.",
+    "personnel_code": "کد پرسنلی معتبر نیست یا قبلاً ثبت شده است."
+  },
+  "message": "اطلاعات ارسال‌شده معتبر نیست."
+}

collection/account/update-profile/401.json

@@ -0,0 +1,3 @@
+{
+  "message": "احراز هویت شما معتبر نیست یا منقضی شده است."
+}

collection/account/update-profile/index.bru

@@ -0,0 +1,55 @@
+meta {
+  name: Update Profile
+  type: http
+  seq: 2
+}
+
+patch {
+  url: {{base_url}}/account/update-profile
+  body: json
+  auth: bearer
+}
+
+auth:bearer {
+  token: {{access_token}}
+}
+
+headers {
+  Content-Type: application/json
+  Accept: application/json
+}
+
+body:json {
+  {
+    "first_name": "علی",
+    "last_name": "رضایی",
+    "personnel_code": "EMP-1001"
+  }
+}
+
+docs {
+  ## Purpose
+
+  Partially updates the basic profile information of the authenticated user.
+
+  ## Authentication
+
+  Requires a valid access token.
+
+  ## Behavior
+
+  - Only fields included in the request body are updated.
+  - Omitted fields remain unchanged.
+  - At least one supported field must be provided.
+  - Supported fields are `first_name`, `last_name`, and `personnel_code`.
+  - `personnel_code` must remain unique when changed.
+  - Users do not have individual language preferences.
+  - Username and email are managed through their dedicated endpoints.
+  - Avatar management is not included until the file system contract is defined.
+
+  ## Response
+
+  - `200 OK` — Profile updated successfully.
+  - `400 Bad Request` — The request body is empty or contains invalid values.
+  - `401 Unauthorized` — The access token is missing, invalid, or expired.
+}

collection/account/update-username/200.json

@@ -0,0 +1,12 @@
+{
+  "email": "user@example.com",
+  "first_name": "علی",
+  "id": "2dc56d6f-6b5a-4e0d-9b0b-9a1c9d7f8d41",
+  "is_system_admin": true,
+  "last_name": "رضایی",
+  "mobile": "09123456789",
+  "permissions": ["users.read", "users.create", "users.update"],
+  "personnel_code": "EMP-1001",
+  "status": "active",
+  "username": "user"
+}

collection/account/update-username/400.json

@@ -0,0 +1,6 @@
+{
+  "cause": {
+    "username": "این نام کاربری قبلاً استفاده شده است."
+  },
+  "message": "اطلاعات ارسال‌شده معتبر نیست."
+}

collection/account/update-username/401.json

@@ -0,0 +1,3 @@
+{
+  "message": "احراز هویت شما معتبر نیست یا منقضی شده است."
+}

collection/account/update-username/index.bru

@@ -0,0 +1,47 @@
+meta {
+  name: Update Username
+  type: http
+  seq: 3
+}
+
+post {
+  url: {{base_url}}/account/update-username
+  body: json
+  auth: bearer
+}
+
+auth:bearer {
+  token: {{access_token}}
+}
+
+headers {
+  Content-Type: application/json
+  Accept: application/json
+}
+
+body:json {
+  {
+    "username": "user"
+  }
+}
+
+docs {
+  ## Purpose
+
+  Updates the username of the authenticated user.
+
+  ## Authentication
+
+  Requires a valid access token.
+
+  ## Behavior
+
+  - Updates the username of the authenticated user.
+  - The username must be unique.
+
+  ## Response
+
+  - `200 OK` — Username updated successfully.
+  - `400 Bad Request` — The username is invalid or already in use.
+  - `401 Unauthorized` — The access token is missing, invalid, or expired.
+}

collection/account/verify-email/400.json

@@ -0,0 +1,7 @@
+{
+  "cause": {
+    "email": "آدرس ایمیل معتبر نیست.",
+    "otp": "کد تأیید معتبر نیست یا منقضی شده است."
+  },
+  "message": "اطلاعات ارسال‌شده معتبر نیست."
+}

collection/account/verify-email/401.json

@@ -0,0 +1,3 @@
+{
+  "message": "احراز هویت شما معتبر نیست یا منقضی شده است."
+}

collection/account/verify-email/index.bru

@@ -0,0 +1,52 @@
+meta {
+  name: Verify Email
+  type: http
+  seq: 5
+}
+
+post {
+  url: {{base_url}}/account/verify-email
+  body: json
+  auth: bearer
+}
+
+auth:bearer {
+  token: {{access_token}}
+}
+
+headers {
+  Content-Type: application/json
+  Accept: application/json
+}
+
+body:json {
+  {
+    "email": "user@example.com",
+    "otp": "123456"
+  }
+}
+
+docs {
+  ## Purpose
+
+  Verifies an email address and assigns it to the authenticated user.
+
+  ## Authentication
+
+  Requires a valid access token.
+
+  ## Behavior
+
+  - Verifies the code previously sent to the provided email address.
+  - The email must match the address used in the verification request.
+  - If the user has no email, the verified email is added to the profile.
+  - If the user already has an email, it is replaced only after successful verification.
+  - The existing profile email remains unchanged when verification fails.
+  - The email is stored only after verification succeeds.
+
+  ## Response
+
+  - `200 OK` — Email verified and assigned successfully with no response body.
+  - `400 Bad Request` — The request is invalid or the verification code is invalid or expired.
+  - `401 Unauthorized` — The access token is missing, invalid, or expired.
+}