prowler-test-api
This skill equips you with battle-tested patterns for writing Prowler API tests, covering JSON:API request formatting, cross-tenant isolation via row-level security, role-based access control, and Celery task mocking. It includes a fixture dependency chain, response status code reference, and explicit rules for avoiding common pitfalls like TruffleHog false positives and incorrect content-type headers.
prowler-test-api provides patterns for testing Prowler's JSON:API endpoints with tenant isolation, role-based access, and async task validation.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-07-27
prowler-test-api provides patterns for testing Prowler's JSON:API endpoints with tenant isolation, role-based access, and async task validation. This skill equips you with battle-tested patterns for writing Prowler API tests, covering JSON:API request formatting, cross-tenant isolation via row-level security, role-based access control, and Celery task mocking. It includes a fixture dependency chain, response status code reference, and explicit rules for avoiding common pitfalls like TruffleHog false positives and incorrect content-type headers.
Use it when
- prowler-test-api teaches cross-tenant access control by writing tests that verify row-level security (RLS) blocks unauthorized access.
- prowler-test-api demonstrates mocking Celery tasks using pytest fixtures and task_always_eager mode for synchronous execution in tests.
Verify before relying
Read SKILL.md below before installing (3 files). Open directory: indexed for reading, not audited.
Install
prowler-cloud/prowler/prowler-test-api · repository language: Python
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What are prowler api testing patterns for JSON:API compliance?
prowler-test-api covers JSON:API request/response patterns including proper Content-Type headers (application/vnd.api+json), PATCH and POST formatting with data envelopes, and relationship links. Tests validate that Prowler API endpoints serialize resources correctly, handle sparse fieldsets, and return standardized error objects. The skill includes fixtures for common resource types and demonstrates how to assert on response structure rather than raw JSON.
How do you test multi-tenant isolation and RLS in prowler-test-api?
prowler-test-api teaches cross-tenant access control by writing tests that verify row-level security (RLS) blocks unauthorized access. Key pattern: authenticated requests from Tenant A should return 404 (not 403) for Tenant B resources, signaling the resource doesn't exist in that tenant's scope. Fixtures establish separate tenants with distinct API keys; tests confirm queries, mutations, and list endpoints respect tenant boundaries without leaking data or permission hints.
How should you mock Celery async tasks in Django views with prowler-test-api?
prowler-test-api demonstrates mocking Celery tasks using pytest fixtures and task_always_eager mode for synchronous execution in tests. The skill shows patching task.apply and task.delay calls, capturing task arguments, and asserting side effects. For complex workflows, it covers mocking canvas primitives (chain, group) and validating that view code enqueues tasks with correct parameters without executing actual async work.
What fixture patterns does prowler-test-api use to avoid TruffleHog detection?
prowler-test-api establishes secure test fixtures by using placeholder tokens (e.g., 'test-key-' prefixes) that don't match real secret patterns, storing sensitive test data in environment variables or .env.test files excluded from version control, and using factory libraries to generate deterministic but non-production credentials. The skill avoids hardcoding real API keys and demonstrates how to configure TruffleHog allowlists for known test patterns.
How do you structure RBAC permission tests in prowler-test-api fixtures?
prowler-test-api organizes RBAC tests by creating users with distinct roles (admin, viewer, editor) in fixtures, then writing parameterized tests that verify each role's access to endpoints. Tests assert that unauthorized roles receive 403 Forbidden, permitted roles succeed, and viewset serializers respect permission classes. The skill includes examples of custom permission classes integrated with DjangoRestFramework and patterns for testing role transitions.
What Content-Type headers and response extraction patterns does prowler-test-api teach?
prowler-test-api emphasizes setting Content-Type: application/vnd.api+json for all JSON:API requests and validating responses include the same header. For response extraction, the skill teaches accessing data via response.json()['data'] for single resources or response.json()['data'][0] for collections, then asserting on attributes, relationships, and included resources. Error responses use response.json()['errors'] for validation testing.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
Critical Rules
- ALWAYS use
response.json()["data"]notresponse.data - ALWAYS use
content_type = "application/vnd.api+json"for PATCH/PUT requests - ALWAYS use
format="vnd.api+json"for POST requests - ALWAYS test cross-tenant isolation - RLS returns 404, NOT 403
- NEVER skip RLS isolation tests when adding new endpoints
- NEVER use realistic-looking API keys in tests (TruffleHog will flag them)
- ALWAYS mock BOTH
.delay()ANDTask.objects.getfor async task tests
1. Fixture Dependency Chain
```text create_test_user (session) ─► tenants_fixture (function) ─► authenticated_client │
(truncated - see the full file via the links below)
File tree — 3 files
skills/prowler-test-api/SKILL.md
skills/prowler-test-api/assets/api_test.py
skills/prowler-test-api/references/test-api-docs.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Write comprehensive API tests for Prowler with JSON:API, RLS, and RBAC”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
This skill guides implementation of Prowler's multi-tenant API architecture, covering row-level security enforcement, role-based access control, provider validation, and async task patterns. Learn the 4-database setup, RLS model constraints, M2M through-model requirements, and critical decorator ordering for tenant-isolated operations.
tdd guides you through mandatory test-driven development across all Prowler components using the red-green-refactor cycle. Learn to write failing tests first, implement minimum code to pass, triangulate with edge cases, and refactor with confidence. Covers TypeScript/React, Python SDK, and Django API stacks with practical examples.
This skill audits Django migration files against PostgreSQL safety rules, catching common mistakes like bundling index creation with model definitions, mixing indexes across tables, and mishandling partitioned table indexes. It enforces separation of concerns—structural changes in one migration, performance indexes in another—and provides the two-step pattern required for partitioned tables to ensure indexes apply to all existing partitions without locking production data.
This skill drafts and executes git commits following the conventional-commits standard, enforcing structure with type, scope, and concise descriptions. It analyzes staged changes, presents a formatted message for review, and commits only after explicit user approval.
Prowler-changelog automates changelog management across UI, API, MCP Server, and SDK components using a fragment-based system that prevents merge conflicts on concurrent PRs. Each change gets its own fragment file under `changelog.d/` directories, which compile into versioned `CHANGELOG.md` files at release time. The skill enforces semantic versioning rules, validates fragment format, and requires explicit confirmation before any changelog edits.
Prowler-docs provides the authoring standards and formatting conventions for creating consistent Prowler documentation. It covers brand voice principles, markdown formatting, SEO best practices, and MDX component usage across feature docs, tutorials, API references, and compliance guides.
More skills prowler-ci (Apache-2.0) · prowler-provider (Apache-2.0) · agentcore-investigation (Apache-2.0) · prowler-test-sdk (Apache-2.0)