Signup
Test valid enrollment, duplicate identity, malformed input, and the policy after the first administrator exists.
Authentication guide
Take an account through its complete lifecycle.
Configure enrollment and recovery before opening signup. Then verify signin, JWT use, credential-change invalidation, groups, and an optional second factor as one connected path.
- Account lifecycle
- JWT
- Optional TOTP
Account policy
Decide who can create and recover accounts.
A fresh server allows creation of the first account and administrator setup. Confirm the intended post-bootstrap signup policy before exposing the server publicly. Configure email delivery if verification or password recovery depends on messages reaching the user.
Verification
Confirm verification tokens expire and cannot be reused after successful account verification.
Password recovery
Exercise request, token expiry, password replacement, and the behavior of sessions issued before replacement.
Administrative recovery
Document how an operator restores access without weakening the normal account path.
First request
Create and sign in a disposable account.
curl -X POST http://localhost:6336/action/user_account/signup \
-H "Content-Type: application/json" \
-d '{"attributes":{"email":"test@example.com","name":"Test User","password":"replace-this-password","passwordConfirm":"replace-this-password"}}'
curl -X POST http://localhost:6336/action/user_account/signin \
-H "Content-Type: application/json" \
-d '{"attributes":{"email":"test@example.com","password":"replace-this-password"}}'Use a disposable account and a non-production password. Inspect the action response for the issued token, then send it as a Bearer token to a permissioned endpoint. Repeat with the wrong password and confirm access is denied.
Sessions
Verify more than a successful sign-in.
Daptin compares bcrypt password hashes and issues JWTs for authenticated requests. Authentication-version checks allow account or password changes to invalidate tokens issued under the previous credential state.
- A valid password produces the expected token response.
- An incorrect password and unknown account fail without revealing unnecessary identity details.
- An expired JWT is rejected.
- A token issued before a password change is rejected afterward.
- Disabled or changed accounts no longer retain old access.
- Group membership in the authenticated context matches the permission tests.
Second factor
Add TOTP after recovery is ready.
Enroll
Generate the shared secret for an authenticated account and require confirmation with a current code.
Verify
Test accepted clock windows, bounded attempts, and reuse of a previously accepted code.
Recover
Establish the support or administrator process for a lost authenticator before requiring TOTP.
Keep the boundary clear
TOTP strengthens account authentication. Record and action permissions still decide what the account may do.
Detailed TOTP guide →End-to-end test
Use ordinary accounts, not only an administrator.
- Create a user and complete any required verification.
- Sign in and call one allowed and one denied resource.
- Add and remove group membership, then verify the resulting access.
- Change the password and retry the old token.
- Complete TOTP enrollment, valid verification, bad attempts, and replay checks.
- Run password recovery and confirm the new credential without preserving unintended sessions.