Test with Insomnia

Insomnia is a really useful tool to test direct http request before coding them in your app. So you can test your API server directly before coding the client-side code.

Download the Free version of Insomnia

https://insomnia.rest/

Start Insomnia, You can either create a new collection: Create -> Request,

or import mine Create -> Import from file (you can find the file in Assets/NodeJS folder).

Then click on your new collection to open the list of requests.

Register a user

From here you can create request to test your API. Let's try to create a new admin user. You can edit an existing request or create a new one.

POST http://127.0.0.1/users/register

Change the Body to JSON and put this as body:

{
    "username": "admin",
    "email": "[e-mail]",
    "password": "admin"
}

Since we are testing locally, the password/email doesn't matter for now. We just use something easy to remember.

Make sure NodeJS is running in your command line window, and click on SEND

If it works, hopefully you should see something like this.

{
    "success": true,
    "id": "64079a109630dced89a3f612"
}

Change ADMIN permission manually

There are no direct function to create the first ADMIN user, so we will go change the permissionLevel in mongo directly. You can open in Mongo Compass, click on your new user and change the permissionLevel to 10

This will allow the admin user to execute more function, and also let it grant permissions to other users if needed.

Login with a user

Now use the auth request to login with the admin user

POST http://127.0.0.1/auth

Body JSON again:

{
    "username": "admin",
    "password": "admin"
}

Click on SEND, if it works you should see something like this

{
	"id": "64079ef79630dced89a3f61c",
	"username": "admin",
	"access_token": "eyJhbGciOiJIUzI1NiI421XVCJ9.eyJ1c2VySWQiOiI2NDA3OWVmNzk2MzBkY2VkODlhM2Y2MWMiLCJ1c2VybmFtZSI6ImFkbWluIiwiZW1haWwiOiJhZG1pbkB0ZXN0LmNvbSIsInBlcm1pc3Npb25MZXZlbCI6MSwidmFsaWRhdGlvbkxldmVsIjowLCJwcm92aWRlciI6InVzZXJuYW1lIiwicmVmcmVzaEtleSI6Ik83OUtFYVovMGU5cDA5TFY0N3Q4aXc9PSIsImlhdCI6MTY3ODIyMTA1MH0.ly_Ivy1XV-lOvxx_Bj-9qHaH5n4YXHez0kXmCbyAy_s",
	"refresh_token": "NVM5RDNvbGdySSa2d24Y0xtMDkyL0NMWThhSEhKVk1iMTZQNjFqNHpNTXpxZ2s5OHVmVzdRbXl4cHU4RDN0QUIxUThqcDBqOGRWbWtjaUQ1Y0d2dldPcEE9PQ==",
	"permission_level": 10,
	"validation_level": 0,
	"version": "0.01"
}

This gives you an access_token you will need to execute any requests that require authentication. Copy the access token you got (without the ")

Read the list of all users

Let's create a new request to read the list of all users

GET http://127.0.0.1/users

Leave the body empty, instead click on Headers and add one, as header name, write:

authorization

And as value paste the access token you got when login in.

Now click on send, it should show the full list of existing users.

Great, now you know how to use Insomnia, you can do the same for all other requests. To know which requests are possible, check the other sections of this doc, or check the .routes.js files inside the NodeJS code.

Granting Permissions

If you also have a game server, you could create a "server" user with permission level 5. This will allow the user to give rewards and read other users, but won't let it assign permissions or delete users (only an admin can).

To set permission Level of a user through requests, if you already have at least 1 admin user, you can login with the admin user and use

POST http://127.0.0.1/users/permission/edit/6407a114953

Replace the ID at the end of the URL by the ID of the user you want to target. Use the authorization token of your admin user. And set the body to:

{
    "permission_level" : 5
}

There are only 4 relevant permission levels in this API. By default, for new users the permission Level will be 1, which is what it should be for most users.

See permission levels here.

Testing request on the cloud server

To test online request, once you installed your cloud server, you can replace 127.0.0.1 by the IP of your server, or your domain name. If you enabled https, you can also replace http by https in the URL. Other than that everything should work the same.