playground.http

# Barbacane Playground — HTTP requests
# Works with JetBrains HTTP Client and VS Code REST Client extension.
#
# Start the playground first:
#   DOCKER_BUILDKIT=0 docker-compose up -d --build

@baseUrl    = http://localhost:8080
@oauthUrl   = http://localhost:9099
@metricsUrl = http://localhost:8082/metrics
@wiremockUrl = http://localhost:8081

# ===========================================================================
# OIDC Token (required for protected endpoints)
# ===========================================================================

### Get access token from mock OIDC provider
# @name auth
POST {{oauthUrl}}/barbacane/token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&scope=openid&client_id=playground&client_secret=secret

# ===========================================================================
# Stations (Public · Cached)
# ===========================================================================

### List all stations
GET {{baseUrl}}/stations

### Get station details
GET {{baseUrl}}/stations/efdbb9d1-02c2-4bc3-afb7-6788d8782b1e

### Get live departures for a station
GET {{baseUrl}}/stations/efdbb9d1-02c2-4bc3-afb7-6788d8782b1e/departures

### Filter by country — invalid value triggers 400
GET {{baseUrl}}/stations?country=invalid

# ===========================================================================
# Trips (Public)
# ===========================================================================

### Search trips
GET {{baseUrl}}/trips?origin=efdbb9d1-02c2-4bc3-afb7-6788d8782b1e&destination=b2e783e1-c824-4d63-b37a-d8ee6c0b95da&departure_date=2025-03-15

### Get trip details
GET {{baseUrl}}/trips/f08d2c3e-8d6f-7f5f-2c1f-4e5f6a7b8c9d

### Get real-time status
GET {{baseUrl}}/trips/f08d2c3e-8d6f-7f5f-2c1f-4e5f6a7b8c9d/realtime

# ===========================================================================
# Bookings (OIDC protected)
# ===========================================================================

### List bookings
GET {{baseUrl}}/bookings
Authorization: Bearer {{auth.response.body.access_token}}

### Get booking details
GET {{baseUrl}}/bookings/d4e5f6a7-b8c9-0d1e-2f3a-4b5c6d7e8f9a
Authorization: Bearer {{auth.response.body.access_token}}

### Create a booking
POST {{baseUrl}}/bookings
Authorization: Bearer {{auth.response.body.access_token}}
Content-Type: application/json

{
  "trip_id": "f08d2c3e-8d6f-7f5f-2c1f-4e5f6a7b8c9d",
  "passengers": [
    { "name": "John Doe", "email": "john@example.com" }
  ]
}

### No token → 401 Unauthorized
GET {{baseUrl}}/bookings

# ===========================================================================
# Events (NATS dispatch · AsyncAPI)
# ===========================================================================

### Publish a trip delay event
POST {{baseUrl}}/events/trips/delayed
Content-Type: application/json

{
  "event_type": "trip.delayed",
  "trip_id": "f08d2c3e-8d6f-7f5f-2c1f-4e5f6a7b8c9d",
  "delay_minutes": 15,
  "reason": "weather",
  "timestamp": "2025-03-15T10:30:00Z"
}

### Publish a booking confirmed event
POST {{baseUrl}}/events/bookings/confirmed
Content-Type: application/json

{
  "event_type": "booking.confirmed",
  "booking_id": "d4e5f6a7-b8c9-0d1e-2f3a-4b5c6d7e8f9a",
  "reference": "BOOK-123",
  "passenger_count": 2,
  "trip_id": "f08d2c3e-8d6f-7f5f-2c1f-4e5f6a7b8c9d",
  "timestamp": "2025-03-15T10:30:00Z"
}

### Publish a payment succeeded event
POST {{baseUrl}}/events/payments/succeeded
Content-Type: application/json

{
  "event_type": "payment.succeeded",
  "payment_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "booking_id": "d4e5f6a7-b8c9-0d1e-2f3a-4b5c6d7e8f9a",
  "amount": 49.99,
  "currency": "EUR",
  "method": "card",
  "timestamp": "2025-03-15T10:30:00Z"
}

# ===========================================================================
# S3 Object Storage Proxy (RustFS · s3 dispatcher)
# Authenticated multi-bucket proxy on /storage/{bucket}/{key+}
# Public rate-limited CDN on /assets/{key+}
# ===========================================================================

### Upload an object (authenticated)
PUT {{baseUrl}}/storage/playground/hello.txt
Authorization: Bearer {{auth.response.body.access_token}}
Content-Type: text/plain

Hello from Barbacane!

### Download the object (authenticated)
GET {{baseUrl}}/storage/playground/hello.txt
Authorization: Bearer {{auth.response.body.access_token}}

### Multi-segment key — {key+} captures slashes
GET {{baseUrl}}/storage/playground/2024/reports/q4.pdf
Authorization: Bearer {{auth.response.body.access_token}}

### Delete the object (authenticated)
DELETE {{baseUrl}}/storage/playground/hello.txt
Authorization: Bearer {{auth.response.body.access_token}}

### Public asset CDN — no auth required (pre-seeded by init container)
GET {{baseUrl}}/assets/welcome.txt

### No token → 401 Unauthorized
GET {{baseUrl}}/storage/playground/hello.txt

# ===========================================================================
# MCP Server (Model Context Protocol · JSON-RPC 2.0)
# AI agents connect to /__barbacane/mcp to discover and call API tools.
# ===========================================================================

### Initialize MCP session
# @name mcp_init
POST {{baseUrl}}/__barbacane/mcp
Content-Type: application/json

{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"clientInfo":{"name":"playground","version":"1.0"}}}

### List available tools
POST {{baseUrl}}/__barbacane/mcp
Content-Type: application/json
Mcp-Session-Id: {{mcp_init.response.headers.mcp-session-id}}

{"jsonrpc":"2.0","id":2,"method":"tools/list"}

### Call tool: list stations
POST {{baseUrl}}/__barbacane/mcp
Content-Type: application/json
Mcp-Session-Id: {{mcp_init.response.headers.mcp-session-id}}

{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"listStations"}}

### Call tool: search trips
POST {{baseUrl}}/__barbacane/mcp
Content-Type: application/json
Mcp-Session-Id: {{mcp_init.response.headers.mcp-session-id}}

{"jsonrpc":"2.0","id":4,"method":"tools/call","params":{"name":"searchTrips","arguments":{"origin":"efdbb9d1-02c2-4bc3-afb7-6788d8782b1e","destination":"b2e783e1-c824-4d63-b37a-d8ee6c0b95da","departure_date":"2025-03-15"}}}

### Call tool: get station details
POST {{baseUrl}}/__barbacane/mcp
Content-Type: application/json
Mcp-Session-Id: {{mcp_init.response.headers.mcp-session-id}}

{"jsonrpc":"2.0","id":5,"method":"tools/call","params":{"name":"getStation","arguments":{"stationId":"efdbb9d1-02c2-4bc3-afb7-6788d8782b1e"}}}

### Ping (heartbeat)
POST {{baseUrl}}/__barbacane/mcp
Content-Type: application/json
Mcp-Session-Id: {{mcp_init.response.headers.mcp-session-id}}

{"jsonrpc":"2.0","id":99,"method":"ping"}

# ===========================================================================
# Observability
# ===========================================================================

### Prometheus metrics
GET {{metricsUrl}}

### NATS server stats
GET http://localhost:8222/varz

# ===========================================================================
# WireMock admin
# ===========================================================================

### List all stubs
GET {{wiremockUrl}}/__admin/mappings

### View request log
GET {{wiremockUrl}}/__admin/requests

# ===========================================================================
# WAF (SQLi / XSS / traversal + outbound leak): see specs/waf-demo.yaml
# ===========================================================================
# Blocking mode. Benign requests pass (200); attacks reach the inbound
# anomaly threshold and are refused (403). The rule set scores each attack
# with both regex signatures and the libinjection classifiers
# (@detectSQLi/@detectXSS), which add coverage for obfuscated payloads. Every
# inspected transaction is written to the `waf.audit` log target (audit: on).

### Benign search: passes (200)
GET {{baseUrl}}/waf/search?q=paris

### SQLi tautology: blocked (403)
GET {{baseUrl}}/waf/search?q=1' OR '1'='1

### SQLi union select: blocked (403)
GET {{baseUrl}}/waf/search?q=1 UNION SELECT password FROM users

### XSS in a query parameter: blocked (403)
GET {{baseUrl}}/waf/search?q=<script>alert(1)</script>

### Path traversal: blocked (403)
GET {{baseUrl}}/waf/search?q=../../etc/passwd

### Benign JSON body: passes (200)
POST {{baseUrl}}/waf/submit
Content-Type: application/json

{"comment": "great service, thanks"}

### SQLi in a JSON body: blocked (403)
POST {{baseUrl}}/waf/submit
Content-Type: application/json

{"comment": "'; DROP TABLE users; --"}

### Outbound leak: the upstream response body carries an AWS key, so a
### response-phase (phase 4) rule blocks the response with 403.
GET {{baseUrl}}/waf/leak