{ "info": { "name": "Medicout API v2", "description": "Complete API test collection for Medicout backend", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json" }, "variable": [ { "key": "baseUrl", "value": "http://localhost:3000/api" }, { "key": "patientToken", "value": "" }, { "key": "doctorToken", "value": "" }, { "key": "refreshToken", "value": "" }, { "key": "appointmentId", "value": "" }, { "key": "threadId", "value": "" } ], "item": [ { "name": "🔐 Auth", "item": [ { "name": "Register Patient", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Status 201', () => pm.response.to.have.status(201));", "pm.test('Has accessToken', () => {", " const data = pm.response.json().data;", " pm.expect(data.accessToken).to.be.a('string');", " pm.collectionVariables.set('patientToken', data.accessToken);", " pm.collectionVariables.set('refreshToken', data.refreshToken);", "});", "pm.test('No password in response', () => {", " const body = pm.response.text();", " pm.expect(body).to.not.include('password_hash');", "});", "pm.test('Response under 500ms', () => {", " pm.expect(pm.response.responseTime).to.be.below(500);", "});", "pm.test('Headers: Content-Type is present', () => { pm.response.to.have.header('Content-Type'); });", "pm.test('Headers: Body is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Safeguard: Non-error structure', () => { if(pm.response.code >= 200 && pm.response.code < 300) { pm.expect(pm.response.json().error).to.be.undefined; } });", "pm.test('Security: No internal paths revealed', () => { pm.expect(pm.response.text()).to.not.include('/var/www/'); pm.expect(pm.response.text()).to.not.include('C:\\\\Users'); });" ] } } ], "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": "{{baseUrl}}/auth/register", "body": { "mode": "raw", "raw": "{\n \"fullName\": \"Test Patient\",\n \"email\": \"patient@test.com\",\n \"password\": \"test123\",\n \"role\": \"patient\"\n}" } } }, { "name": "Register Doctor", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Status 201', () => pm.response.to.have.status(201));", "pm.test('Has accessToken', () => {", " const data = pm.response.json().data;", " pm.expect(data.accessToken).to.be.a('string');", " pm.collectionVariables.set('doctorToken', data.accessToken);", "});", "pm.test('Performance: Response under 600ms', () => { pm.expect(pm.response.responseTime).to.be.below(600); });", "pm.test('Performance: Response under 1000ms', () => { pm.expect(pm.response.responseTime).to.be.below(1000); });", "pm.test('Headers: Content-Type is present', () => { pm.response.to.have.header('Content-Type'); });", "pm.test('Headers: Body is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Safeguard: Non-error structure', () => { if(pm.response.code >= 200 && pm.response.code < 300) { pm.expect(pm.response.json().error).to.be.undefined; } });", "pm.test('Security: No internal paths revealed', () => { pm.expect(pm.response.text()).to.not.include('/var/www/'); pm.expect(pm.response.text()).to.not.include('C:\\\\Users'); });" ] } } ], "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": "{{baseUrl}}/auth/register", "body": { "mode": "raw", "raw": "{\n \"fullName\": \"Dr. Sarah Smith\",\n \"email\": \"doctor@test.com\",\n \"password\": \"test123\",\n \"role\": \"doctor\"\n}" } } }, { "name": "Login Patient", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Status 200', () => pm.response.to.have.status(200));", "pm.test('Tokens received', () => {", " const data = pm.response.json().data;", " pm.expect(data.accessToken).to.be.a('string');", " pm.expect(data.refreshToken).to.be.a('string');", " pm.collectionVariables.set('patientToken', data.accessToken);", " pm.collectionVariables.set('refreshToken', data.refreshToken);", "});", "pm.test('Response under 500ms', () => {", " pm.expect(pm.response.responseTime).to.be.below(500);", "});", "pm.test('Headers: Content-Type is present', () => { pm.response.to.have.header('Content-Type'); });", "pm.test('Headers: Body is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Safeguard: Non-error structure', () => { if(pm.response.code >= 200 && pm.response.code < 300) { pm.expect(pm.response.json().error).to.be.undefined; } });", "pm.test('Security: No internal paths revealed', () => { pm.expect(pm.response.text()).to.not.include('/var/www/'); pm.expect(pm.response.text()).to.not.include('C:\\\\Users'); });" ] } } ], "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": "{{baseUrl}}/auth/login", "body": { "mode": "raw", "raw": "{\n \"email\": \"patient@test.com\",\n \"password\": \"test123\"\n}" } } }, { "name": "Login Doctor", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Status 200', () => pm.response.to.have.status(200));", "pm.test('Doctor token saved', () => {", " const data = pm.response.json().data;", " pm.collectionVariables.set('doctorToken', data.accessToken);", "});", "pm.test('Performance: Response under 600ms', () => { pm.expect(pm.response.responseTime).to.be.below(600); });", "pm.test('Performance: Response under 1000ms', () => { pm.expect(pm.response.responseTime).to.be.below(1000); });", "pm.test('Headers: Content-Type is present', () => { pm.response.to.have.header('Content-Type'); });", "pm.test('Headers: Body is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Safeguard: Non-error structure', () => { if(pm.response.code >= 200 && pm.response.code < 300) { pm.expect(pm.response.json().error).to.be.undefined; } });", "pm.test('Security: No internal paths revealed', () => { pm.expect(pm.response.text()).to.not.include('/var/www/'); pm.expect(pm.response.text()).to.not.include('C:\\\\Users'); });" ] } } ], "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": "{{baseUrl}}/auth/login", "body": { "mode": "raw", "raw": "{\n \"email\": \"doctor@test.com\",\n \"password\": \"test123\"\n}" } } }, { "name": "Login Wrong Password (should 401)", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Status 401', () => pm.response.to.have.status(401));", "pm.test('Error message present', () => {", " pm.expect(pm.response.json().error).to.be.a('string');", "});", "pm.test('Performance: Response under 600ms', () => { pm.expect(pm.response.responseTime).to.be.below(600); });", "pm.test('Performance: Response under 1000ms', () => { pm.expect(pm.response.responseTime).to.be.below(1000); });", "pm.test('Headers: Content-Type is present', () => { pm.response.to.have.header('Content-Type'); });", "pm.test('Headers: Body is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Safeguard: Non-error structure', () => { if(pm.response.code >= 200 && pm.response.code < 300) { pm.expect(pm.response.json().error).to.be.undefined; } });", "pm.test('Security: No internal paths revealed', () => { pm.expect(pm.response.text()).to.not.include('/var/www/'); pm.expect(pm.response.text()).to.not.include('C:\\\\Users'); });" ] } } ], "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": "{{baseUrl}}/auth/login", "body": { "mode": "raw", "raw": "{\n \"email\": \"patient@test.com\",\n \"password\": \"wrongpassword\"\n}" } } }, { "name": "Verify Email", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Status 200 or 400', () => {", " pm.expect(pm.response.code).to.be.oneOf([200, 400]);", "});", "pm.test('Performance: Response under 600ms', () => { pm.expect(pm.response.responseTime).to.be.below(600); });", "pm.test('Performance: Response under 1000ms', () => { pm.expect(pm.response.responseTime).to.be.below(1000); });", "pm.test('Headers: Content-Type is present', () => { pm.response.to.have.header('Content-Type'); });", "pm.test('Headers: Body is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Safeguard: Non-error structure', () => { if(pm.response.code >= 200 && pm.response.code < 300) { pm.expect(pm.response.json().error).to.be.undefined; } });", "pm.test('Security: No internal paths revealed', () => { pm.expect(pm.response.text()).to.not.include('/var/www/'); pm.expect(pm.response.text()).to.not.include('C:\\\\Users'); });" ] } } ], "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": "{{baseUrl}}/auth/verify-email", "body": { "mode": "raw", "raw": "{\n \"email\": \"patient@test.com\",\n \"otp\": \"123456\"\n}" } } }, { "name": "Refresh Token", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Status 200', () => pm.response.to.have.status(200));", "pm.test('New access token', () => {", " pm.expect(pm.response.json().data.accessToken).to.be.a('string');", "});", "pm.test('Performance: Response under 600ms', () => { pm.expect(pm.response.responseTime).to.be.below(600); });", "pm.test('Performance: Response under 1000ms', () => { pm.expect(pm.response.responseTime).to.be.below(1000); });", "pm.test('Headers: Content-Type is present', () => { pm.response.to.have.header('Content-Type'); });", "pm.test('Headers: Body is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Safeguard: Non-error structure', () => { if(pm.response.code >= 200 && pm.response.code < 300) { pm.expect(pm.response.json().error).to.be.undefined; } });", "pm.test('Security: No internal paths revealed', () => { pm.expect(pm.response.text()).to.not.include('/var/www/'); pm.expect(pm.response.text()).to.not.include('C:\\\\Users'); });" ] } } ], "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": "{{baseUrl}}/auth/refresh", "body": { "mode": "raw", "raw": "{\n \"refreshToken\": \"{{refreshToken}}\"\n}" } } }, { "name": "No Token = 401", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Unauthorized without token', () => {", " pm.response.to.have.status(401);", "});", "pm.test('Performance: Response under 600ms', () => { pm.expect(pm.response.responseTime).to.be.below(600); });", "pm.test('Performance: Response under 1000ms', () => { pm.expect(pm.response.responseTime).to.be.below(1000); });", "pm.test('Headers: Content-Type is present', () => { pm.response.to.have.header('Content-Type'); });", "pm.test('Headers: Body is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Safeguard: Non-error structure', () => { if(pm.response.code >= 200 && pm.response.code < 300) { pm.expect(pm.response.json().error).to.be.undefined; } });", "pm.test('Security: No internal paths revealed', () => { pm.expect(pm.response.text()).to.not.include('/var/www/'); pm.expect(pm.response.text()).to.not.include('C:\\\\Users'); });" ] } } ], "request": { "method": "GET", "url": "{{baseUrl}}/profile" } }, { "name": "Logout", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Status 200', () => pm.response.to.have.status(200));", "pm.test('Performance: Response under 600ms', () => { pm.expect(pm.response.responseTime).to.be.below(600); });", "pm.test('Performance: Response under 1000ms', () => { pm.expect(pm.response.responseTime).to.be.below(1000); });", "pm.test('Headers: Content-Type is present', () => { pm.response.to.have.header('Content-Type'); });", "pm.test('Headers: Body is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Safeguard: Non-error structure', () => { if(pm.response.code >= 200 && pm.response.code < 300) { pm.expect(pm.response.json().error).to.be.undefined; } });", "pm.test('Security: No internal paths revealed', () => { pm.expect(pm.response.text()).to.not.include('/var/www/'); pm.expect(pm.response.text()).to.not.include('C:\\\\Users'); });" ] } } ], "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Authorization", "value": "Bearer {{patientToken}}" } ], "url": "{{baseUrl}}/auth/logout", "body": { "mode": "raw", "raw": "{\n \"refreshToken\": \"{{refreshToken}}\"\n}" } } } ] }, { "name": "👤 Profile", "item": [ { "name": "Get My Profile", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Status 200', () => pm.response.to.have.status(200));", "pm.test('Has completion score', () => {", " const data = pm.response.json().data;", " pm.expect(data.completion).to.have.property('score');", " pm.expect(data.completion.score).to.be.a('number');", "});", "pm.test('No sensitive fields', () => {", " const body = pm.response.text();", " pm.expect(body).to.not.include('password_hash');", "});", "pm.test('Response under 300ms', () => {", " pm.expect(pm.response.responseTime).to.be.below(300);", "});", "pm.test('Headers: Content-Type is present', () => { pm.response.to.have.header('Content-Type'); });", "pm.test('Headers: Body is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Safeguard: Non-error structure', () => { if(pm.response.code >= 200 && pm.response.code < 300) { pm.expect(pm.response.json().error).to.be.undefined; } });", "pm.test('Security: No internal paths revealed', () => { pm.expect(pm.response.text()).to.not.include('/var/www/'); pm.expect(pm.response.text()).to.not.include('C:\\\\Users'); });" ] } } ], "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{patientToken}}" } ], "url": "{{baseUrl}}/profile" } }, { "name": "Update Profile", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Status 200', () => pm.response.to.have.status(200));", "pm.test('Completion score increased', () => {", " const data = pm.response.json().data;", " pm.expect(data.completion.score).to.be.above(0);", "});", "pm.test('Performance: Response under 600ms', () => { pm.expect(pm.response.responseTime).to.be.below(600); });", "pm.test('Performance: Response under 1000ms', () => { pm.expect(pm.response.responseTime).to.be.below(1000); });", "pm.test('Headers: Content-Type is present', () => { pm.response.to.have.header('Content-Type'); });", "pm.test('Headers: Body is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Safeguard: Non-error structure', () => { if(pm.response.code >= 200 && pm.response.code < 300) { pm.expect(pm.response.json().error).to.be.undefined; } });", "pm.test('Security: No internal paths revealed', () => { pm.expect(pm.response.text()).to.not.include('/var/www/'); pm.expect(pm.response.text()).to.not.include('C:\\\\Users'); });" ] } } ], "request": { "method": "PUT", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Authorization", "value": "Bearer {{patientToken}}" } ], "url": "{{baseUrl}}/profile", "body": { "mode": "raw", "raw": "{\n \"phone\": \"+1234567890\",\n \"dateOfBirth\": \"1990-01-15\",\n \"gender\": \"male\",\n \"countryCode\": \"US\",\n \"city\": \"New York\"\n}" } } }, { "name": "Get Profile Completion", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Status 200', () => pm.response.to.have.status(200));", "pm.test('Has missing fields', () => {", " const data = pm.response.json().data;", " pm.expect(data.missing).to.be.an('array');", " pm.expect(data.score).to.be.a('number');", "});", "pm.test('Performance: Response under 600ms', () => { pm.expect(pm.response.responseTime).to.be.below(600); });", "pm.test('Performance: Response under 1000ms', () => { pm.expect(pm.response.responseTime).to.be.below(1000); });", "pm.test('Headers: Content-Type is present', () => { pm.response.to.have.header('Content-Type'); });", "pm.test('Headers: Body is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Safeguard: Non-error structure', () => { if(pm.response.code >= 200 && pm.response.code < 300) { pm.expect(pm.response.json().error).to.be.undefined; } });", "pm.test('Security: No internal paths revealed', () => { pm.expect(pm.response.text()).to.not.include('/var/www/'); pm.expect(pm.response.text()).to.not.include('C:\\\\Users'); });" ] } } ], "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{patientToken}}" } ], "url": "{{baseUrl}}/profile/completion" } }, { "name": "Update Doctor Profile", "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('Status is correct', () => { pm.response.to.have.status(200); });", "pm.test('Performance: Response under 600ms', () => { pm.expect(pm.response.responseTime).to.be.below(600); });", "pm.test('Headers: Content-Type is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Doctor profile updated', () => { pm.expect(pm.response.json().success).to.be.true; });" ] } } ], "request": { "method": "PUT", "header": [ { "key": "Authorization", "value": "Bearer {{doctorToken}}" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/profile", "host": [ "{{baseUrl}}" ], "path": [ "profile" ] }, "body": { "mode": "raw", "raw": "{\n \"specialtyId\": 1,\n \"phone\": \"+0987654321\",\n \"countryCode\": \"US\",\n \"city\": \"Los Angeles\",\n \"bio\": \"Experienced doctor\"\n}" } } } ] }, { "name": "🔍 Search", "item": [ { "name": "Search Symptoms - migraine", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Status 200', () => pm.response.to.have.status(200));", "pm.test('Returns specialty', () => {", " const data = pm.response.json().data;", " pm.expect(data.specialtyName).to.be.a('string');", "});", "pm.test('Response under 200ms', () => {", " pm.expect(pm.response.responseTime).to.be.below(200);", "});", "pm.test('Headers: Content-Type is present', () => { pm.response.to.have.header('Content-Type'); });", "pm.test('Headers: Body is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Safeguard: Non-error structure', () => { if(pm.response.code >= 200 && pm.response.code < 300) { pm.expect(pm.response.json().error).to.be.undefined; } });", "pm.test('Security: No internal paths revealed', () => { pm.expect(pm.response.text()).to.not.include('/var/www/'); pm.expect(pm.response.text()).to.not.include('C:\\\\Users'); });" ] } } ], "request": { "method": "GET", "url": "{{baseUrl}}/search/symptoms?q=migraine" } }, { "name": "Search Symptoms - chest pain", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Status 200', () => pm.response.to.have.status(200));", "pm.test('Maps to Cardiology', () => {", " const data = pm.response.json().data;", " pm.expect(data.specialtyName.toLowerCase()).to.include('cardio');", "});", "pm.test('Performance: Response under 600ms', () => { pm.expect(pm.response.responseTime).to.be.below(600); });", "pm.test('Performance: Response under 1000ms', () => { pm.expect(pm.response.responseTime).to.be.below(1000); });", "pm.test('Headers: Content-Type is present', () => { pm.response.to.have.header('Content-Type'); });", "pm.test('Headers: Body is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Safeguard: Non-error structure', () => { if(pm.response.code >= 200 && pm.response.code < 300) { pm.expect(pm.response.json().error).to.be.undefined; } });", "pm.test('Security: No internal paths revealed', () => { pm.expect(pm.response.text()).to.not.include('/var/www/'); pm.expect(pm.response.text()).to.not.include('C:\\\\Users'); });" ] } } ], "request": { "method": "GET", "url": "{{baseUrl}}/search/symptoms?q=chest pain" } }, { "name": "Search All Doctors", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Status 200', () => pm.response.to.have.status(200));", "pm.test('Returns doctors array', () => {", " const data = pm.response.json().data;", " pm.expect(data.doctors).to.be.an('array');", " pm.expect(data).to.have.property('total');", " pm.expect(data).to.have.property('totalPages');", "});", "pm.test('Each doctor has isOnline field', () => {", " const doctors = pm.response.json().data.doctors;", " if (doctors.length > 0) {", " pm.expect(doctors[0]).to.have.property('is_online');", " }", "});", "pm.test('Response under 500ms', () => {", " pm.expect(pm.response.responseTime).to.be.below(500);", "});", "pm.test('Headers: Content-Type is present', () => { pm.response.to.have.header('Content-Type'); });", "pm.test('Headers: Body is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Safeguard: Non-error structure', () => { if(pm.response.code >= 200 && pm.response.code < 300) { pm.expect(pm.response.json().error).to.be.undefined; } });", "pm.test('Security: No internal paths revealed', () => { pm.expect(pm.response.text()).to.not.include('/var/www/'); pm.expect(pm.response.text()).to.not.include('C:\\\\Users'); });" ] } } ], "request": { "method": "GET", "url": { "raw": "{{baseUrl}}/doctors/search?page=1&limit=10", "query": [ { "key": "page", "value": "1" }, { "key": "limit", "value": "10" } ] } } }, { "name": "Search Doctors by Specialty", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Status 200', () => pm.response.to.have.status(200));", "pm.test('Filtered results', () => {", " pm.expect(pm.response.json().data.doctors).to.be.an('array');", "});", "pm.test('Performance: Response under 600ms', () => { pm.expect(pm.response.responseTime).to.be.below(600); });", "pm.test('Performance: Response under 1000ms', () => { pm.expect(pm.response.responseTime).to.be.below(1000); });", "pm.test('Headers: Content-Type is present', () => { pm.response.to.have.header('Content-Type'); });", "pm.test('Headers: Body is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Safeguard: Non-error structure', () => { if(pm.response.code >= 200 && pm.response.code < 300) { pm.expect(pm.response.json().error).to.be.undefined; } });", "pm.test('Security: No internal paths revealed', () => { pm.expect(pm.response.text()).to.not.include('/var/www/'); pm.expect(pm.response.text()).to.not.include('C:\\\\Users'); });" ] } } ], "request": { "method": "GET", "url": "{{baseUrl}}/doctors/search?specialtyId=1&page=1&limit=5" } }, { "name": "Get All Specialties", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Status 200', () => pm.response.to.have.status(200));", "pm.test('Has specialties', () => {", " pm.expect(pm.response.json().data).to.be.an('array');", " pm.expect(pm.response.json().data.length).to.be.above(0);", "});", "pm.test('Performance: Response under 600ms', () => { pm.expect(pm.response.responseTime).to.be.below(600); });", "pm.test('Performance: Response under 1000ms', () => { pm.expect(pm.response.responseTime).to.be.below(1000); });", "pm.test('Headers: Content-Type is present', () => { pm.response.to.have.header('Content-Type'); });", "pm.test('Headers: Body is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Safeguard: Non-error structure', () => { if(pm.response.code >= 200 && pm.response.code < 300) { pm.expect(pm.response.json().error).to.be.undefined; } });", "pm.test('Security: No internal paths revealed', () => { pm.expect(pm.response.text()).to.not.include('/var/www/'); pm.expect(pm.response.text()).to.not.include('C:\\\\Users'); });" ] } } ], "request": { "method": "GET", "url": "{{baseUrl}}/specialties" } } ] }, { "name": "📅 Appointments", "item": [ { "name": "Get Doctor Slots", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Status 200', () => pm.response.to.have.status(200));", "pm.test('Returns slots array', () => {", " const slots = pm.response.json().data.slots;", " pm.expect(slots).to.be.an('array');", "});", "pm.test('Slots have correct structure', () => {", " const slots = pm.response.json().data.slots;", " if (slots.length > 0) {", " pm.expect(slots[0]).to.have.property('time');", " pm.expect(slots[0].status).to.be.oneOf(['available', 'booked']);", " }", "});", "pm.test('Performance: Response under 600ms', () => { pm.expect(pm.response.responseTime).to.be.below(600); });", "pm.test('Performance: Response under 1000ms', () => { pm.expect(pm.response.responseTime).to.be.below(1000); });", "pm.test('Headers: Content-Type is present', () => { pm.response.to.have.header('Content-Type'); });", "pm.test('Headers: Body is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Safeguard: Non-error structure', () => { if(pm.response.code >= 200 && pm.response.code < 300) { pm.expect(pm.response.json().error).to.be.undefined; } });", "pm.test('Security: No internal paths revealed', () => { pm.expect(pm.response.text()).to.not.include('/var/www/'); pm.expect(pm.response.text()).to.not.include('C:\\\\Users'); });" ] } } ], "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{patientToken}}" } ], "url": "{{baseUrl}}/doctors/1/slots?date=2026-04-20" } }, { "name": "Book Appointment (Patient)", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Status 201', () => pm.response.to.have.status(201));", "pm.test('Appointment created', () => {", " const data = pm.response.json().data;", " pm.expect(data.id).to.be.a('number');", " pm.expect(data.status).to.equal('pending');", " pm.collectionVariables.set('appointmentId', data.id);", "});", "pm.test('Performance: Response under 600ms', () => { pm.expect(pm.response.responseTime).to.be.below(600); });", "pm.test('Performance: Response under 1000ms', () => { pm.expect(pm.response.responseTime).to.be.below(1000); });", "pm.test('Headers: Content-Type is present', () => { pm.response.to.have.header('Content-Type'); });", "pm.test('Headers: Body is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Safeguard: Non-error structure', () => { if(pm.response.code >= 200 && pm.response.code < 300) { pm.expect(pm.response.json().error).to.be.undefined; } });", "pm.test('Security: No internal paths revealed', () => { pm.expect(pm.response.text()).to.not.include('/var/www/'); pm.expect(pm.response.text()).to.not.include('C:\\\\Users'); });" ] } } ], "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Authorization", "value": "Bearer {{patientToken}}" } ], "url": "{{baseUrl}}/appointments", "body": { "mode": "raw", "raw": "{\n \"doctorProfileId\": 1,\n \"scheduledAtUtc\": \"2026-04-20T09:00:00Z\",\n \"durationMins\": 30,\n \"type\": \"video\",\n \"patientNotes\": \"I have been having headaches\"\n}" } } }, { "name": "Doctor Cannot Book (should 403)", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Doctor blocked from booking', () => {", " pm.response.to.have.status(403);", "});", "pm.test('Performance: Response under 600ms', () => { pm.expect(pm.response.responseTime).to.be.below(600); });", "pm.test('Performance: Response under 1000ms', () => { pm.expect(pm.response.responseTime).to.be.below(1000); });", "pm.test('Headers: Content-Type is present', () => { pm.response.to.have.header('Content-Type'); });", "pm.test('Headers: Body is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Safeguard: Non-error structure', () => { if(pm.response.code >= 200 && pm.response.code < 300) { pm.expect(pm.response.json().error).to.be.undefined; } });", "pm.test('Security: No internal paths revealed', () => { pm.expect(pm.response.text()).to.not.include('/var/www/'); pm.expect(pm.response.text()).to.not.include('C:\\\\Users'); });" ] } } ], "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Authorization", "value": "Bearer {{doctorToken}}" } ], "url": "{{baseUrl}}/appointments", "body": { "mode": "raw", "raw": "{\n \"doctorProfileId\": 1,\n \"scheduledAtUtc\": \"2026-04-20T10:00:00Z\",\n \"type\": \"video\"\n}" } } }, { "name": "Get My Appointments (Patient)", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Status 200', () => pm.response.to.have.status(200));", "pm.test('Returns appointments', () => {", " pm.expect(pm.response.json().data.appointments).to.be.an('array');", "});", "pm.test('Performance: Response under 600ms', () => { pm.expect(pm.response.responseTime).to.be.below(600); });", "pm.test('Performance: Response under 1000ms', () => { pm.expect(pm.response.responseTime).to.be.below(1000); });", "pm.test('Headers: Content-Type is present', () => { pm.response.to.have.header('Content-Type'); });", "pm.test('Headers: Body is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Safeguard: Non-error structure', () => { if(pm.response.code >= 200 && pm.response.code < 300) { pm.expect(pm.response.json().error).to.be.undefined; } });", "pm.test('Security: No internal paths revealed', () => { pm.expect(pm.response.text()).to.not.include('/var/www/'); pm.expect(pm.response.text()).to.not.include('C:\\\\Users'); });" ] } } ], "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{patientToken}}" } ], "url": "{{baseUrl}}/appointments" } }, { "name": "Confirm Appointment (Doctor)", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Status 200', () => pm.response.to.have.status(200));", "pm.test('Status confirmed', () => {", " pm.expect(pm.response.json().data.status).to.equal('confirmed');", "});", "pm.test('Performance: Response under 600ms', () => { pm.expect(pm.response.responseTime).to.be.below(600); });", "pm.test('Performance: Response under 1000ms', () => { pm.expect(pm.response.responseTime).to.be.below(1000); });", "pm.test('Headers: Content-Type is present', () => { pm.response.to.have.header('Content-Type'); });", "pm.test('Headers: Body is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Safeguard: Non-error structure', () => { if(pm.response.code >= 200 && pm.response.code < 300) { pm.expect(pm.response.json().error).to.be.undefined; } });", "pm.test('Security: No internal paths revealed', () => { pm.expect(pm.response.text()).to.not.include('/var/www/'); pm.expect(pm.response.text()).to.not.include('C:\\\\Users'); });" ] } } ], "request": { "method": "PUT", "header": [ { "key": "Authorization", "value": "Bearer {{doctorToken}}" } ], "url": "{{baseUrl}}/appointments/{{appointmentId}}/confirm" } }, { "name": "Cancel Appointment", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Status 200', () => pm.response.to.have.status(200));", "pm.test('Status cancelled', () => {", " pm.expect(pm.response.json().data.status).to.equal('cancelled');", "});", "pm.test('Performance: Response under 600ms', () => { pm.expect(pm.response.responseTime).to.be.below(600); });", "pm.test('Performance: Response under 1000ms', () => { pm.expect(pm.response.responseTime).to.be.below(1000); });", "pm.test('Headers: Content-Type is present', () => { pm.response.to.have.header('Content-Type'); });", "pm.test('Headers: Body is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Safeguard: Non-error structure', () => { if(pm.response.code >= 200 && pm.response.code < 300) { pm.expect(pm.response.json().error).to.be.undefined; } });", "pm.test('Security: No internal paths revealed', () => { pm.expect(pm.response.text()).to.not.include('/var/www/'); pm.expect(pm.response.text()).to.not.include('C:\\\\Users'); });" ] } } ], "request": { "method": "PUT", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Authorization", "value": "Bearer {{patientToken}}" } ], "url": "{{baseUrl}}/appointments/{{appointmentId}}/cancel", "body": { "mode": "raw", "raw": "{\n \"reason\": \"Schedule conflict\"\n}" } } }, { "name": "Double-book slot (fails)", "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('Status is correct', () => { pm.response.to.have.status(201); });", "pm.test('Performance: Response under 600ms', () => { pm.expect(pm.response.responseTime).to.be.below(600); });", "pm.test('Headers: Content-Type is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Status 400 or 409', () => { pm.expect(pm.response.code).to.be.oneOf([400, 409]); });" ] } } ], "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{patientToken}}" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/appointments", "host": [ "{{baseUrl}}" ], "path": [ "appointments" ] }, "body": { "mode": "raw", "raw": "{\n \"doctorProfileId\": 1,\n \"scheduledAtUtc\": \"2026-04-20T09:00:00Z\",\n \"durationMins\": 30,\n \"type\": \"video\"\n}" } } }, { "name": "Reschedule Appointment", "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('Status is correct', () => { pm.response.to.have.status(200); });", "pm.test('Performance: Response under 600ms', () => { pm.expect(pm.response.responseTime).to.be.below(600); });", "pm.test('Headers: Content-Type is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Status 200', () => { pm.response.to.have.status(200); });" ] } } ], "request": { "method": "PUT", "header": [ { "key": "Authorization", "value": "Bearer {{patientToken}}" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/appointments/{{appointmentId}}/reschedule", "host": [ "{{baseUrl}}" ], "path": [ "appointments", "{{appointmentId}}", "reschedule" ] }, "body": { "mode": "raw", "raw": "{\n \"scheduledAtUtc\": \"2026-04-21T10:00:00Z\"\n}" } } } ] }, { "name": "💬 Chat", "item": [ { "name": "Get/Create Thread", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Status 200 or 201', () => {", " pm.expect(pm.response.code).to.be.oneOf([200, 201]);", "});", "pm.test('Thread created', () => {", " const data = pm.response.json().data;", " pm.expect(data.id).to.be.a('number');", " pm.collectionVariables.set('threadId', data.id);", "});", "pm.test('Performance: Response under 600ms', () => { pm.expect(pm.response.responseTime).to.be.below(600); });", "pm.test('Performance: Response under 1000ms', () => { pm.expect(pm.response.responseTime).to.be.below(1000); });", "pm.test('Headers: Content-Type is present', () => { pm.response.to.have.header('Content-Type'); });", "pm.test('Headers: Body is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Safeguard: Non-error structure', () => { if(pm.response.code >= 200 && pm.response.code < 300) { pm.expect(pm.response.json().error).to.be.undefined; } });", "pm.test('Security: No internal paths revealed', () => { pm.expect(pm.response.text()).to.not.include('/var/www/'); pm.expect(pm.response.text()).to.not.include('C:\\\\Users'); });" ] } } ], "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Authorization", "value": "Bearer {{patientToken}}" } ], "url": "{{baseUrl}}/chat/threads", "body": { "mode": "raw", "raw": "{\n \"doctorProfileId\": 1,\n \"type\": \"query\"\n}" } } }, { "name": "Get Thread Messages", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Status 200', () => pm.response.to.have.status(200));", "pm.test('Messages array returned', () => {", " pm.expect(pm.response.json().data.messages).to.be.an('array');", "});", "pm.test('No encrypted content visible', () => {", " const messages = pm.response.json().data.messages;", " messages.forEach(msg => {", " if (msg.content) {", " pm.expect(msg.content).to.not.include(':');", " }", " });", "});", "pm.test('Performance: Response under 600ms', () => { pm.expect(pm.response.responseTime).to.be.below(600); });", "pm.test('Performance: Response under 1000ms', () => { pm.expect(pm.response.responseTime).to.be.below(1000); });", "pm.test('Headers: Content-Type is present', () => { pm.response.to.have.header('Content-Type'); });", "pm.test('Headers: Body is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Safeguard: Non-error structure', () => { if(pm.response.code >= 200 && pm.response.code < 300) { pm.expect(pm.response.json().error).to.be.undefined; } });", "pm.test('Security: No internal paths revealed', () => { pm.expect(pm.response.text()).to.not.include('/var/www/'); pm.expect(pm.response.text()).to.not.include('C:\\\\Users'); });" ] } } ], "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{patientToken}}" } ], "url": "{{baseUrl}}/chat/threads/{{threadId}}/messages?page=1&limit=20" } }, { "name": "Get All Threads", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Status 200', () => pm.response.to.have.status(200));", "pm.test('Threads array', () => {", " pm.expect(pm.response.json().data).to.be.an('array');", "});", "pm.test('Performance: Response under 600ms', () => { pm.expect(pm.response.responseTime).to.be.below(600); });", "pm.test('Performance: Response under 1000ms', () => { pm.expect(pm.response.responseTime).to.be.below(1000); });", "pm.test('Headers: Content-Type is present', () => { pm.response.to.have.header('Content-Type'); });", "pm.test('Headers: Body is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Safeguard: Non-error structure', () => { if(pm.response.code >= 200 && pm.response.code < 300) { pm.expect(pm.response.json().error).to.be.undefined; } });", "pm.test('Security: No internal paths revealed', () => { pm.expect(pm.response.text()).to.not.include('/var/www/'); pm.expect(pm.response.text()).to.not.include('C:\\\\Users'); });" ] } } ], "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{patientToken}}" } ], "url": "{{baseUrl}}/chat/threads" } }, { "name": "Send Message", "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('Status is correct', () => { pm.response.to.have.status(201); });", "pm.test('Performance: Response under 600ms', () => { pm.expect(pm.response.responseTime).to.be.below(600); });", "pm.test('Headers: Content-Type is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Message saved', () => { pm.expect(pm.response.json().data.id).to.be.a('number'); });" ] } } ], "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{patientToken}}" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/chat/threads/{{threadId}}/messages", "host": [ "{{baseUrl}}" ], "path": [ "chat", "threads", "{{threadId}}", "messages" ] }, "body": { "mode": "raw", "raw": "{\n \"content\": \"Hello doctor!\"\n}" } } }, { "name": "Upload File in Chat", "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('Status is correct', () => { pm.response.to.have.status(201); });", "pm.test('Performance: Response under 600ms', () => { pm.expect(pm.response.responseTime).to.be.below(600); });", "pm.test('Headers: Content-Type is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Status correct for file upload', () => { pm.expect(pm.response.code).to.be.oneOf([400, 201]); });" ] } } ], "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{patientToken}}" } ], "url": { "raw": "{{baseUrl}}/chat/threads/{{threadId}}/files", "host": [ "{{baseUrl}}" ], "path": [ "chat", "threads", "{{threadId}}", "files" ] } } } ] }, { "name": "🔔 Notifications", "item": [ { "name": "Get Notifications", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Status 200', () => pm.response.to.have.status(200));", "pm.test('Notifications array', () => {", " pm.expect(pm.response.json().data.notifications).to.be.an('array');", "});", "pm.test('Performance: Response under 600ms', () => { pm.expect(pm.response.responseTime).to.be.below(600); });", "pm.test('Performance: Response under 1000ms', () => { pm.expect(pm.response.responseTime).to.be.below(1000); });", "pm.test('Headers: Content-Type is present', () => { pm.response.to.have.header('Content-Type'); });", "pm.test('Headers: Body is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Safeguard: Non-error structure', () => { if(pm.response.code >= 200 && pm.response.code < 300) { pm.expect(pm.response.json().error).to.be.undefined; } });", "pm.test('Security: No internal paths revealed', () => { pm.expect(pm.response.text()).to.not.include('/var/www/'); pm.expect(pm.response.text()).to.not.include('C:\\\\Users'); });" ] } } ], "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{patientToken}}" } ], "url": "{{baseUrl}}/notifications" } }, { "name": "Register FCM Token", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Status 200', () => pm.response.to.have.status(200));", "pm.test('Performance: Response under 600ms', () => { pm.expect(pm.response.responseTime).to.be.below(600); });", "pm.test('Performance: Response under 1000ms', () => { pm.expect(pm.response.responseTime).to.be.below(1000); });", "pm.test('Headers: Content-Type is present', () => { pm.response.to.have.header('Content-Type'); });", "pm.test('Headers: Body is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Safeguard: Non-error structure', () => { if(pm.response.code >= 200 && pm.response.code < 300) { pm.expect(pm.response.json().error).to.be.undefined; } });", "pm.test('Security: No internal paths revealed', () => { pm.expect(pm.response.text()).to.not.include('/var/www/'); pm.expect(pm.response.text()).to.not.include('C:\\\\Users'); });" ] } } ], "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Authorization", "value": "Bearer {{patientToken}}" } ], "url": "{{baseUrl}}/notifications/register-token", "body": { "mode": "raw", "raw": "{\n \"platform\": \"android\",\n \"fcmToken\": \"test_fcm_token_12345\"\n}" } } } ] }, { "name": "🛡️ Security", "item": [ { "name": "SQL Injection in Login", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('SQL injection blocked', () => {", " pm.expect(pm.response.code).to.not.equal(200);", "});", "pm.test('Performance: Response under 600ms', () => { pm.expect(pm.response.responseTime).to.be.below(600); });", "pm.test('Performance: Response under 1000ms', () => { pm.expect(pm.response.responseTime).to.be.below(1000); });", "pm.test('Headers: Content-Type is present', () => { pm.response.to.have.header('Content-Type'); });", "pm.test('Headers: Body is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Safeguard: Non-error structure', () => { if(pm.response.code >= 200 && pm.response.code < 300) { pm.expect(pm.response.json().error).to.be.undefined; } });", "pm.test('Security: No internal paths revealed', () => { pm.expect(pm.response.text()).to.not.include('/var/www/'); pm.expect(pm.response.text()).to.not.include('C:\\\\Users'); });" ] } } ], "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": "{{baseUrl}}/auth/login", "body": { "mode": "raw", "raw": "{\n \"email\": \"' OR '1'='1\",\n \"password\": \"' OR '1'='1\"\n}" } } }, { "name": "Fake JWT Token", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Fake token rejected', () => {", " pm.response.to.have.status(401);", "});", "pm.test('Performance: Response under 600ms', () => { pm.expect(pm.response.responseTime).to.be.below(600); });", "pm.test('Performance: Response under 1000ms', () => { pm.expect(pm.response.responseTime).to.be.below(1000); });", "pm.test('Headers: Content-Type is present', () => { pm.response.to.have.header('Content-Type'); });", "pm.test('Headers: Body is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Safeguard: Non-error structure', () => { if(pm.response.code >= 200 && pm.response.code < 300) { pm.expect(pm.response.json().error).to.be.undefined; } });", "pm.test('Security: No internal paths revealed', () => { pm.expect(pm.response.text()).to.not.include('/var/www/'); pm.expect(pm.response.text()).to.not.include('C:\\\\Users'); });" ] } } ], "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer fake.jwt.token.here" } ], "url": "{{baseUrl}}/profile" } }, { "name": "Patient Accessing Doctor Route", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Patient blocked from doctor route', () => {", " pm.response.to.have.status(403);", "});", "pm.test('Performance: Response under 600ms', () => { pm.expect(pm.response.responseTime).to.be.below(600); });", "pm.test('Performance: Response under 1000ms', () => { pm.expect(pm.response.responseTime).to.be.below(1000); });", "pm.test('Headers: Content-Type is present', () => { pm.response.to.have.header('Content-Type'); });", "pm.test('Headers: Body is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Safeguard: Non-error structure', () => { if(pm.response.code >= 200 && pm.response.code < 300) { pm.expect(pm.response.json().error).to.be.undefined; } });", "pm.test('Security: No internal paths revealed', () => { pm.expect(pm.response.text()).to.not.include('/var/www/'); pm.expect(pm.response.text()).to.not.include('C:\\\\Users'); });" ] } } ], "request": { "method": "PUT", "header": [ { "key": "Authorization", "value": "Bearer {{patientToken}}" } ], "url": "{{baseUrl}}/appointments/1/confirm" } }, { "name": "Missing Required Fields", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Validation error 400', () => {", " pm.response.to.have.status(400);", "});", "pm.test('Performance: Response under 600ms', () => { pm.expect(pm.response.responseTime).to.be.below(600); });", "pm.test('Performance: Response under 1000ms', () => { pm.expect(pm.response.responseTime).to.be.below(1000); });", "pm.test('Headers: Content-Type is present', () => { pm.response.to.have.header('Content-Type'); });", "pm.test('Headers: Body is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Safeguard: Non-error structure', () => { if(pm.response.code >= 200 && pm.response.code < 300) { pm.expect(pm.response.json().error).to.be.undefined; } });", "pm.test('Security: No internal paths revealed', () => { pm.expect(pm.response.text()).to.not.include('/var/www/'); pm.expect(pm.response.text()).to.not.include('C:\\\\Users'); });" ] } } ], "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": "{{baseUrl}}/auth/register", "body": { "mode": "raw", "raw": "{\n \"email\": \"incomplete@test.com\"\n}" } } }, { "name": "Fake JWT Access", "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('Status is correct', () => { pm.response.to.have.status(200); });", "pm.test('Performance: Response under 600ms', () => { pm.expect(pm.response.responseTime).to.be.below(600); });", "pm.test('Headers: Content-Type is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Status 401 on missing token', () => { pm.expect(pm.response.code).to.equal(401); });" ] } } ], "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/profile", "host": [ "{{baseUrl}}" ], "path": [ "profile" ] } } }, { "name": "Invalid Role Violation", "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('Status is correct', () => { pm.response.to.have.status(201); });", "pm.test('Performance: Response under 600ms', () => { pm.expect(pm.response.responseTime).to.be.below(600); });", "pm.test('Headers: Content-Type is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Status 403 for role violation', () => { pm.response.to.have.status(403); });" ] } } ], "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{patientToken}}" } ], "url": { "raw": "{{baseUrl}}/appointments/{{appointmentId}}/confirm", "host": [ "{{baseUrl}}" ], "path": [ "appointments", "{{appointmentId}}", "confirm" ] } } }, { "name": "XSS Payload Test", "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('Status is correct', () => { pm.response.to.have.status(200); });", "pm.test('Performance: Response under 600ms', () => { pm.expect(pm.response.responseTime).to.be.below(600); });", "pm.test('Headers: Content-Type is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Payload sanitized or blocked', () => { let body = pm.response.text(); pm.expect(body).to.not.include('\"\n}" } } } ] }, { "name": "🛠️ Setup", "item": [ { "name": "Reset Dev Users", "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('Status is correct', () => { pm.response.to.have.status(200); });", "pm.test('Performance: Response under 600ms', () => { pm.expect(pm.response.responseTime).to.be.below(600); });", "pm.test('Headers: Content-Type is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Reset successful', () => { pm.response.to.have.status(200); });", "pm.test('Message matches', () => { pm.expect(pm.response.json().message).to.include('flushed'); });" ] } } ], "request": { "method": "DELETE", "header": [], "url": { "raw": "{{baseUrl}}/test/reset", "host": [ "{{baseUrl}}" ], "path": [ "test", "reset" ] } } } ] }, { "name": "System", "item": [ { "name": "Presence Socket Health Check", "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test('Status is correct', () => { pm.response.to.have.status(200); });", "pm.test('Performance: Response under 600ms', () => { pm.expect(pm.response.responseTime).to.be.below(600); });", "pm.test('Headers: Content-Type is JSON', () => { pm.expect(pm.response.headers.get('Content-Type')).to.include('application/json'); });", "pm.test('Status 200 or 404', () => { pm.expect(pm.response.code).to.be.oneOf([200, 404]); });" ] } } ], "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{patientToken}}" } ], "url": { "raw": "{{baseUrl}}/health/presence", "host": [ "{{baseUrl}}" ], "path": [ "health", "presence" ] } } } ] } ], "event": [ { "listen": "prerequest", "script": { "type": "text/javascript", "exec": [ "const baseUrl = pm.collectionVariables.get('baseUrl') || 'http://localhost:3000/api';", "pm.sendRequest({", " url: baseUrl + '/auth/login',", " method: 'POST',", " header: { 'Content-Type': 'application/json' },", " body: { mode: 'raw', raw: JSON.stringify({ email: 'patient@test.com', password: 'test123' }) }", "}, function (err, res) {", " if (!err && res.code === 200) {", " let data = res.json().data;", " pm.collectionVariables.set('patientToken', data.accessToken);", " pm.collectionVariables.set('refreshToken', data.refreshToken);", " }", "});", "", "pm.sendRequest({", " url: baseUrl + '/auth/login',", " method: 'POST',", " header: { 'Content-Type': 'application/json' },", " body: { mode: 'raw', raw: JSON.stringify({ email: 'doctor@test.com', password: 'test123' }) }", "}, function (err, res) {", " if (!err && res.code === 200) {", " let data = res.json().data;", " pm.collectionVariables.set('doctorToken', data.accessToken);", " }", "});" ] } } ] }