Skip to content
Postman API Testing Tips

How To Use Postman To Test Rails App Permission

API Testing Blog

Setting Up Your Rails Application for Testing

Before you start testing your Rails app permissions with Postman, you need to set up your application to handle authentication and authorization.

**1. ** Implement Authentication and Authorization:

  • Choose an Authentication Method: For this example, let’s use JSON Web Tokens (JWT) for authentication. You can find various JWT gems available in Ruby.
  • Create a User Model: Define a User model with email, password, and any other relevant attributes.
  • Add an authenticate method: Implement a method in your User model that checks the user credentials against a database or other storage method.
  • Generate JWT Tokens: After successful authentication, create a JWT token that contains user information (e.g., user ID, roles).
  • Authorization Logic: Define roles for different users and implement checks for access based on those roles.

**2. ** Install Necessary Gems and Configure the Application:

  • Add gems: Install the necessary gems for authentication and authorization, and for creating JWT tokens.
  • Configure environment variables: Set up environment variables for secret keys, database credentials, and other relevant variables.
  • Create Authentication Controller: Implement a controller to handle user login and registration, including JWT token generation.

**3. ** Define Permissions and Roles:

  • Create a Role model: Define different roles with permissions attached to them.
  • Create a Permission model: Define the various actions/resources that users can access.
  • Associate roles with permissions: Implement a relationship between roles and permissions, so each role has a set of allowed actions.
app/models/role.rb
class Role < ApplicationRecord
  has_and_belongs_to_many :permissions
end


# app/models/permission.rb
class Permission < ApplicationRecord
  has_and_belongs_to_many :roles
end


# app/models/user.rb
class User < ApplicationRecord
  has_and_belongs_to_many :roles
end

Testing Rails App Permissions with Postman: A Step-by-Step Guide

With your Rails application set up for authentication and authorization, you can now use Postman to test it.

**1. ** Create a Postman Collection:

Create a new collection in Postman and name it according to your project. This will organize your requests.

**2. ** Build Authentication Requests:

  • Login Request: Create a POST request to your authentication endpoint, passing in valid user credentials and receiving the JWT token.
  • Generate JWT Token: Implement logic in your application to generate a JWT token after successful authentication.

**3. ** Test Permissioned Endpoints:

**a. ** Create a GET request: Choose a route in your Rails application that is restricted by permissions (e.g., /users, /admin/products).

**b. ** Add Authorization Header:

  • Header Key: Authorization
  • Header Value: Bearer [JWT Token]

**c. ** Send the request: Execute the request in Postman.

**d. ** Check the Response:

  • Successful Access (200 OK): The response should reflect successful access.
  • Unauthorized Access (401 Unauthorized): The response should indicate unauthorized access.

**4. ** Test Different User Roles and Permissions:

  • Create Test Users with Different Roles: Create a user with a different role (e.g., admin, customer) and set the appropriate permissions for each user.
  • Send Requests for Each User: Repeat steps 2 and 3 above with different users. Verify the responses based on the assigned permissions.

**5. ** Example Code (Rails Controller):

app/controllers/users_controller.rb
class UsersController < ApplicationController


  skip_before_action :authenticate_user, only: [:create]


  def index
    @users = User.all
  end


  # ... other user-related methods
end


# app/controllers/application_controller.rb
class ApplicationController < ActionController::Base
  # ...


  def authenticate_user
    # Verify JWT token, decode it, and store user info
    token = request.headers['Authorization'].match(/Bearer (.*)/)[1]
    user = User.find_by(id: decode_token(token)['user_id'])


    if user
      @current_user = user
    else
      render json: { error: 'Unauthorized' }, status: :unauthorized
    end
  end


  private


  def decode_token(token)
    # Decode JWT token using your chosen method
  end
end

Practical Examples of Permission Testing with Postman

**1. ** Test Access to a Specific User’s Profile:

  • Endpoint: /users/:id
  • Request: A GET request to the user’s profile endpoint, including the user’s ID in the URL parameter.
  • Permissions: Only the user themselves, or users with appropriate permissions (e.g., admins) should have access to this endpoint.

**2. ** Test Access to Admin-Only Resources:

  • Endpoint: /admin/products
  • Request: A GET request to the admin products endpoint.
  • Permissions: Only users with the admin role should be able to access this endpoint.

**3. ** Test Access to a Resource Creation Endpoint:

  • Endpoint: /projects
  • Request: A POST request to create a new project.
  • Permissions: Only users with the appropriate roles (e.g., “manager” or “project owner”) should be able to create new projects.

Key Considerations for Permission Testing with Postman

**1. ** Complete Coverage: Make sure to test all the important endpoints in your application with different user roles and permissions to ensure proper authorization flow.

**2. ** Clear Documentation: Maintain detailed documentation of your test cases in Postman. This will help you easily replicate and update them as your application evolves.

**3. ** Version Control: Use a version control system (like Git) to track changes made to your Postman collections. This will help you manage different versions of your tests and roll back to previous versions if needed.

**4. ** Test for Edge Cases: Test for negative cases: unauthorized access, invalid tokens, expired tokens, and other edge conditions.

Conclusion

Testing permissions thoroughly with Postman is essential to ensure that your Rails application is secure and restricts access correctly. By following the steps and examples provided in this guide, you can effectively test your application’s permission logic, increase the security of your application, and build trust with your users.

API Testing Blog