259 lines
12 KiB
JSON
259 lines
12 KiB
JSON
{
|
|
"info": {
|
|
"name": "Notifications — click-action flow",
|
|
"description": "End-to-end test of the push-notification click-action mechanism: get an OAuth2 token, fetch a user's Gotify client_token from the notifications service, send a push with action_code/click_object_id_value (or a raw click_url), then read the message back directly from Gotify to confirm the click.url resolved correctly.\n\nRun folders top to bottom. Requests that produce a token/id set it into a collection variable automatically (see each request's Tests tab) so later requests don't need manual copy-pasting.\n\nImport `notifications-staging.postman_environment.json` alongside this collection and select it before running.",
|
|
"schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
|
|
},
|
|
"variable": [
|
|
{ "key": "notifications_base_url", "value": "https://notifications-staging.gooyal.ir" },
|
|
{ "key": "gotify_base_url", "value": "" },
|
|
{ "key": "oauth2_token_url", "value": "" },
|
|
{ "key": "client_id", "value": "" },
|
|
{ "key": "client_secret", "value": "" },
|
|
{ "key": "app_scopes", "value": "notifications.application.push:submit_message" },
|
|
{ "key": "user_scopes", "value": "notifications.push:get_client_token" },
|
|
{ "key": "user_username", "value": "" },
|
|
{ "key": "user_password", "value": "" },
|
|
{ "key": "app_access_token", "value": "" },
|
|
{ "key": "user_access_token", "value": "" },
|
|
{ "key": "user_uuid", "value": "" },
|
|
{ "key": "client_token", "value": "" },
|
|
{ "key": "application_token", "value": "" },
|
|
{ "key": "gotify_since", "value": "0" }
|
|
],
|
|
"item": [
|
|
{
|
|
"name": "1. Auth",
|
|
"item": [
|
|
{
|
|
"name": "Get app access token (client_credentials)",
|
|
"request": {
|
|
"method": "POST",
|
|
"header": [
|
|
{ "key": "Content-Type", "value": "application/x-www-form-urlencoded" }
|
|
],
|
|
"url": { "raw": "{{oauth2_token_url}}", "host": ["{{oauth2_token_url}}"] },
|
|
"body": {
|
|
"mode": "urlencoded",
|
|
"urlencoded": [
|
|
{ "key": "grant_type", "value": "client_credentials" },
|
|
{ "key": "client_id", "value": "{{client_id}}" },
|
|
{ "key": "client_secret", "value": "{{client_secret}}" },
|
|
{ "key": "scope", "value": "{{app_scopes}}" }
|
|
]
|
|
},
|
|
"description": "This is the credential a PRODUCER service (chat/promotions/advertising) uses server-to-server to call the push endpoint. Fill in oauth2_token_url/client_id/client_secret from the producer application's OAuth2 client registered against the Gooyal accounts service. On success, the Tests script below stores the token as {{app_access_token}}."
|
|
},
|
|
"event": [
|
|
{
|
|
"listen": "test",
|
|
"script": {
|
|
"exec": [
|
|
"if (pm.response.code === 200) {",
|
|
" const json = pm.response.json();",
|
|
" pm.collectionVariables.set('app_access_token', json.access_token);",
|
|
" pm.test('got app access_token', () => pm.expect(json.access_token).to.be.a('string'));",
|
|
"} else {",
|
|
" pm.test('token request failed: ' + pm.response.code, () => pm.expect.fail(pm.response.text()));",
|
|
"}"
|
|
]
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"name": "Get user access token (password grant)",
|
|
"request": {
|
|
"method": "POST",
|
|
"header": [
|
|
{ "key": "Content-Type", "value": "application/x-www-form-urlencoded" }
|
|
],
|
|
"url": { "raw": "{{oauth2_token_url}}", "host": ["{{oauth2_token_url}}"] },
|
|
"body": {
|
|
"mode": "urlencoded",
|
|
"urlencoded": [
|
|
{ "key": "grant_type", "value": "password" },
|
|
{ "key": "username", "value": "{{user_username}}" },
|
|
{ "key": "password", "value": "{{user_password}}" },
|
|
{ "key": "client_id", "value": "{{client_id}}" },
|
|
{ "key": "client_secret", "value": "{{client_secret}}" },
|
|
{ "key": "scope", "value": "{{user_scopes}}" }
|
|
]
|
|
},
|
|
"description": "This is a REAL logged-in Gooyal user's own token — what the mobile/web frontend would carry. Swap for whatever grant your accounts service actually issues client tokens with (this assumes password grant for a quick staging test; use authorization_code in the real app). On success, stores {{user_access_token}}."
|
|
},
|
|
"event": [
|
|
{
|
|
"listen": "test",
|
|
"script": {
|
|
"exec": [
|
|
"if (pm.response.code === 200) {",
|
|
" const json = pm.response.json();",
|
|
" pm.collectionVariables.set('user_access_token', json.access_token);",
|
|
" pm.test('got user access_token', () => pm.expect(json.access_token).to.be.a('string'));",
|
|
"} else {",
|
|
" pm.test('token request failed: ' + pm.response.code, () => pm.expect.fail(pm.response.text()));",
|
|
"}"
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"name": "2. Notifications service",
|
|
"item": [
|
|
{
|
|
"name": "Get my push_user (client_token)",
|
|
"request": {
|
|
"method": "GET",
|
|
"header": [
|
|
{ "key": "Authorization", "value": "Bearer {{user_access_token}}" }
|
|
],
|
|
"url": {
|
|
"raw": "{{notifications_base_url}}/push/user/push_user/",
|
|
"host": ["{{notifications_base_url}}"],
|
|
"path": ["push", "user", "push_user", ""]
|
|
},
|
|
"description": "Called AS THE LOGGED-IN USER (user_access_token, not app_access_token). Lazily provisions the user's Gotify identity on first call. Returns client_token (frontend uses this to read its own messages from Gotify) and application_token (backend-only — a producer service shouldn't leak this to a client; see notes in the notifications docs). Also captures user_uuid for the send-push request below."
|
|
},
|
|
"event": [
|
|
{
|
|
"listen": "test",
|
|
"script": {
|
|
"exec": [
|
|
"if (pm.response.code === 200) {",
|
|
" const json = pm.response.json();",
|
|
" pm.collectionVariables.set('user_uuid', json.user);",
|
|
" pm.collectionVariables.set('client_token', json.client_token);",
|
|
" pm.collectionVariables.set('application_token', json.application_token);",
|
|
" pm.test('has client_token', () => pm.expect(json.client_token).to.be.a('string'));",
|
|
"} else {",
|
|
" pm.test('request failed: ' + pm.response.code, () => pm.expect.fail(pm.response.text()));",
|
|
"}"
|
|
]
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"name": "Send push — action_code + click_object_id_value",
|
|
"request": {
|
|
"method": "POST",
|
|
"header": [
|
|
{ "key": "Authorization", "value": "Bearer {{app_access_token}}" },
|
|
{ "key": "Content-Type", "value": "application/json" }
|
|
],
|
|
"url": {
|
|
"raw": "{{notifications_base_url}}/push/application/{{user_uuid}}/application/",
|
|
"host": ["{{notifications_base_url}}"],
|
|
"path": ["push", "application", "{{user_uuid}}", "application", ""]
|
|
},
|
|
"body": {
|
|
"mode": "raw",
|
|
"raw": "{\n \"title\": \"Billboard approved\",\n \"message\": \"Tap to view your billboard\",\n \"priority\": 5,\n \"extras\": {},\n \"action_code\": \"billboard.approved\",\n \"click_object_id_value\": \"8fb638c2-e6a4-4baf-aefe-83dab78fb5bd\"\n}"
|
|
},
|
|
"description": "Called AS THE PRODUCER SERVICE (app_access_token). Resolves action_code against the admin-managed NotificationLink table at send time — make sure that row exists and is active in staging (see the seed_notification_links management command), otherwise the message still sends but with no click_url. Response 201 means the PushMessage row was created and a Celery task was enqueued to actually deliver it to Gotify."
|
|
},
|
|
"event": [
|
|
{
|
|
"listen": "test",
|
|
"script": {
|
|
"exec": [
|
|
"pm.test('push accepted (201)', () => pm.expect(pm.response.code).to.equal(201));"
|
|
]
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"name": "Send push — raw click_url (alternative)",
|
|
"request": {
|
|
"method": "POST",
|
|
"header": [
|
|
{ "key": "Authorization", "value": "Bearer {{app_access_token}}" },
|
|
{ "key": "Content-Type", "value": "application/json" }
|
|
],
|
|
"url": {
|
|
"raw": "{{notifications_base_url}}/push/application/{{user_uuid}}/application/",
|
|
"host": ["{{notifications_base_url}}"],
|
|
"path": ["push", "application", "{{user_uuid}}", "application", ""]
|
|
},
|
|
"body": {
|
|
"mode": "raw",
|
|
"raw": "{\n \"title\": \"Order shipped\",\n \"message\": \"Tap to view your order\",\n \"priority\": 5,\n \"extras\": {},\n \"click_url\": \"https://app.gooyal.ir/orders/123\"\n}"
|
|
},
|
|
"description": "click_url always wins over action_code if both are set. Useful to confirm the plumbing works independent of the NotificationLink admin table."
|
|
},
|
|
"event": [
|
|
{
|
|
"listen": "test",
|
|
"script": {
|
|
"exec": [
|
|
"pm.test('push accepted (201)', () => pm.expect(pm.response.code).to.equal(201));"
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"name": "3. Gotify (read back)",
|
|
"item": [
|
|
{
|
|
"name": "Get my messages (client_token)",
|
|
"request": {
|
|
"method": "GET",
|
|
"header": [
|
|
{ "key": "X-Gotify-Key", "value": "{{client_token}}" }
|
|
],
|
|
"url": {
|
|
"raw": "{{gotify_base_url}}/message?limit=100",
|
|
"host": ["{{gotify_base_url}}"],
|
|
"path": ["message"],
|
|
"query": [
|
|
{ "key": "limit", "value": "100" }
|
|
]
|
|
},
|
|
"description": "Reads Gotify DIRECTLY — not through the notifications service, which has no read endpoint of its own. Authenticates as the user via client_token (from step 2), so this only ever returns that user's own messages; Gotify enforces the isolation. Wait a second or two after sending for the Celery task to actually deliver before checking. Confirm extras[\"client::notification\"][\"click\"][\"url\"] matches what you expect from the action_code/click_url you sent."
|
|
},
|
|
"event": [
|
|
{
|
|
"listen": "test",
|
|
"script": {
|
|
"exec": [
|
|
"pm.test('200 OK', () => pm.expect(pm.response.code).to.equal(200));",
|
|
"if (pm.response.code === 200) {",
|
|
" const json = pm.response.json();",
|
|
" console.log('messages:', JSON.stringify(json.messages, null, 2));",
|
|
"}"
|
|
]
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"name": "Get messages since a given id (incremental poll)",
|
|
"request": {
|
|
"method": "GET",
|
|
"header": [
|
|
{ "key": "X-Gotify-Key", "value": "{{client_token}}" }
|
|
],
|
|
"url": {
|
|
"raw": "{{gotify_base_url}}/message?since={{gotify_since}}&limit=100",
|
|
"host": ["{{gotify_base_url}}"],
|
|
"path": ["message"],
|
|
"query": [
|
|
{ "key": "since", "value": "{{gotify_since}}" },
|
|
{ "key": "limit", "value": "100" }
|
|
]
|
|
},
|
|
"description": "Same as above but only messages newer than gotify_since (a message id) — this is the shape a real client polling loop would use to avoid re-fetching everything. Set gotify_since to the paging.since value from a previous response to page forward."
|
|
}
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|