[

  {
    "comment": "get root policy (creates it)",
    "request": { "uri": "users/root/policy" },
    "response": {
      "store": "rootPolicy"
    }
  },

  {
    "comment": "update root policy, add authenticator",
    "include": "add_authenticator",
    "params": {
      "userId": "root",
      "authenticatorVar": "rootAuthenticator"
    }
  },

  {
    "comment": "as root user, create another admin user",
    "include": "new_account",
    "params": {
      "email": "admin-change_password@example.com",
      "password": "bazquux1!",
      "admin": true,
      "verifyEmail": "true"
    }
  },

  {
    "comment": "login as second admin, verify OK",
    "request": {
      "session": "new",
      "uri": "auth/login",
      "entity": {
        "name": "admin-change_password@example.com",
        "password": "bazquux1!"
      }
    },
    "response": {
      "sessionName": "adminSession",
      "session": "token"
    }
  },

  {
    "comment": "as second admin, read self, succeeds. verify we are admin",
    "request": { "uri": "me" },
    "response": {
      "check": [
        {"condition": "json.getName() === 'admin-change_password@example.com'"},
        {"condition": "json.admin() === true"}
      ]
    }
  },

  {
    "comment": "as second admin, try to change root password without sending current password, fails without TOTP token",
    "request": {
      "uri": "users/root/changePassword",
      "entity": {
        "newPassword": "wh00pDeDoo."
      }
    },
    "response": {
      "status": 422,
      "check": [ {"condition": "json.has('err.totpToken.invalid')"} ]
    }
  },

  {
    "comment": "as second admin, try to change root password sending TOTP token, but without sending current password, fails password check",
    "request": {
      "uri": "users/root/changePassword",
      "entity": {
        "newPassword": "wh00pDeDoo.",
        "totpToken": "{{authenticator_token rootAuthenticator.totpKey}}"
      }
    },
    "response": {
      "status": 422,
      "check": [ {"condition": "json.has('err.currentPassword.invalid')"} ]
    }
  },

  {
    "comment": "as admin user, try to change root user password sending current password and TOTP token, succeeds",
    "request": {
      "uri": "users/root/changePassword",
      "session": "adminSession",
      "entity": {
        "oldPassword": "password1!",
        "newPassword": "aNewRootPass1!",
        "totpToken": "{{authenticator_token rootAuthenticator.totpKey}}"
      }
    }
  },

  {
    "comment": "as root user, try to read self, fails because our session has been invalidated",
    "request": {
      "uri": "me",
      "session": "rootSession"
    },
    "response": { "status": 401 }
  },

  {
    "comment": "login as root with old password, verify failure",
    "request": {
      "session": "new",
      "uri": "auth/login",
      "entity": {
        "name": "root",
        "password": "password1!"
      }
    },
    "response": {
      "status": 404
    }
  },

  {
    "comment": "login as root with new password and TOTP token, succeeds",
    "request": {
      "session": "new",
      "uri": "auth/login",
      "entity": {
        "name": "root",
        "password": "aNewRootPass1!",
        "totpToken": "{{authenticator_token rootAuthenticator.totpKey}}"
      }
    },
    "response": {
      "sessionName": "rootSession",
      "session": "token"
    }
  },

  {
    "comment": "as root, read self, succeeds",
    "request": { "uri": "me" },
    "response": {
      "check": [ {"condition": "json.getName() === 'root'"} ]
    }
  },

  {
    "comment": "as root user, try to change admin user password without sending current password, succeeds because we are senior admin",
    "request": {
      "uri": "users/admin-change_password@example.com/changePassword",
      "entity": {
        "newPassword": "newadminPASS1!"
      }
    }
  },

  {
    "comment": "login as second admin with old password, verify failure",
    "request": {
      "session": "new",
      "uri": "auth/login",
      "entity": {
        "name": "admin-change_password@example.com",
        "password": "bazquux1!"
      }
    },
    "response": {
      "status": 404
    }
  },

  {
    "comment": "login as second admin with new password, verify OK",
    "request": {
      "session": "new",
      "uri": "auth/login",
      "entity": {
        "name": "admin-change_password@example.com",
        "password": "newadminPASS1!"
      }
    },
    "response": {
      "sessionName": "adminSession",
      "session": "token"
    }
  },

  {
    "comment": "as second admin, read self, succeeds",
    "request": { "uri": "me" },
    "response": {
      "check": [ {"condition": "json.getName() === 'admin-change_password@example.com'"} ]
    }
  }

]