prowler-test-api
This skill equips you with battle-tested patterns for writing Prowler API tests, covering JSON:API request formatting, cross-tenant isolation via row-level security, role-based access control, and Celery task mocking. It includes a fixture dependency chain, response status code reference, and explicit rules for avoiding common pitfalls like TruffleHog false positives and incorrect content-type headers.
prowler-test-api provides patterns for testing Prowler's JSON:API endpoints with tenant isolation, role-based access, and async task validation.
AI-generated summary based on this skill's SKILL.md
Install
prowler-cloud/prowler/prowler-test-api · repository language: Python
git clone https://github.com/prowler-cloud/prowler
cp -r prowler/skills/prowler-test-api ~/.claude/skills/prowler-test-apinpx skillfed install prowler-cloud/prowler/prowler-test-apiFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What are prowler api testing patterns for JSON:API compliance?
prowler-test-api covers JSON:API request/response patterns including proper Content-Type headers (application/vnd.api+json), PATCH and POST formatting with data envelopes, and relationship links. Tests validate that Prowler API endpoints serialize resources correctly, handle sparse fieldsets, and return standardized error objects. The skill includes fixtures for common resource types and demonstrates how to assert on response structure rather than raw JSON.
How do you test multi-tenant isolation and RLS in prowler-test-api?
prowler-test-api teaches cross-tenant access control by writing tests that verify row-level security (RLS) blocks unauthorized access. Key pattern: authenticated requests from Tenant A should return 404 (not 403) for Tenant B resources, signaling the resource doesn't exist in that tenant's scope. Fixtures establish separate tenants with distinct API keys; tests confirm queries, mutations, and list endpoints respect tenant boundaries without leaking data or permission hints.
How should you mock Celery async tasks in Django views with prowler-test-api?
prowler-test-api demonstrates mocking Celery tasks using pytest fixtures and task_always_eager mode for synchronous execution in tests. The skill shows patching task.apply and task.delay calls, capturing task arguments, and asserting side effects. For complex workflows, it covers mocking canvas primitives (chain, group) and validating that view code enqueues tasks with correct parameters without executing actual async work.
What fixture patterns does prowler-test-api use to avoid TruffleHog detection?
prowler-test-api establishes secure test fixtures by using placeholder tokens (e.g., 'test-key-' prefixes) that don't match real secret patterns, storing sensitive test data in environment variables or .env.test files excluded from version control, and using factory libraries to generate deterministic but non-production credentials. The skill avoids hardcoding real API keys and demonstrates how to configure TruffleHog allowlists for known test patterns.
How do you structure RBAC permission tests in prowler-test-api fixtures?
prowler-test-api organizes RBAC tests by creating users with distinct roles (admin, viewer, editor) in fixtures, then writing parameterized tests that verify each role's access to endpoints. Tests assert that unauthorized roles receive 403 Forbidden, permitted roles succeed, and viewset serializers respect permission classes. The skill includes examples of custom permission classes integrated with DjangoRestFramework and patterns for testing role transitions.
What Content-Type headers and response extraction patterns does prowler-test-api teach?
prowler-test-api emphasizes setting Content-Type: application/vnd.api+json for all JSON:API requests and validating responses include the same header. For response extraction, the skill teaches accessing data via response.json()['data'] for single resources or response.json()['data'][0] for collections, then asserting on attributes, relationships, and included resources. Error responses use response.json()['errors'] for validation testing.
SKILL.md
rendered from the published skill — quoted content, verbatim
Critical Rules
- ALWAYS use
response.json()["data"]notresponse.data - ALWAYS use
content_type = "application/vnd.api+json"for PATCH/PUT requests - ALWAYS use
format="vnd.api+json"for POST requests - ALWAYS test cross-tenant isolation - RLS returns 404, NOT 403
- NEVER skip RLS isolation tests when adding new endpoints
- NEVER use realistic-looking API keys in tests (TruffleHog will flag them)
- ALWAYS mock BOTH
.delay()ANDTask.objects.getfor async task tests
1. Fixture Dependency Chain
```text create_test_user (session) ─► tenants_fixture (function) ─► authenticated_client │
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 3 files
skills/prowler-test-api/SKILL.md
skills/prowler-test-api/assets/api_test.py
skills/prowler-test-api/references/test-api-docs.md