{
  "info": {
    "_postman_id": "loan-marketplace-auth-rbac-v1",
    "name": "Loan Aggregator Marketplace - Auth & RBAC Collection",
    "description": "Production-ready Postman collection for Loan Aggregator Marketplace API.\nIncludes Auth, RBAC enforcement across 4 roles (Borrower, Lender Admin, Lender Staff, Platform Admin), tenant isolation, and negative access control tests.",
    "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
  },
  "variable": [
    {
      "key": "baseUrl",
      "value": "http://localhost:5000/api/v1",
      "type": "string"
    },
    {
      "key": "adminToken",
      "value": "",
      "type": "string"
    },
    {
      "key": "lenderAdminToken",
      "value": "",
      "type": "string"
    },
    {
      "key": "lenderStaffToken",
      "value": "",
      "type": "string"
    },
    {
      "key": "borrowerToken",
      "value": "",
      "type": "string"
    },
    {
      "key": "currentAccessToken",
      "value": "",
      "type": "string"
    },
    {
      "key": "apexLenderId",
      "value": "4f1f0be1-1a1f-41e3-83a6-8185fa9a28e2",
      "type": "string"
    }
  ],
  "item": [
    {
      "name": "1. Authentication (Auth APIs)",
      "item": [
        {
          "name": "1.1 Login - Platform Admin",
          "event": [
            {
              "listen": "test",
              "script": {
                "exec": [
                  "const res = pm.response.json();",
                  "if (res.success && res.data && res.data.accessToken) {",
                  "    pm.collectionVariables.set('adminToken', res.data.accessToken);",
                  "    pm.collectionVariables.set('currentAccessToken', res.data.accessToken);",
                  "    pm.test('Platform Admin login successful', () => {",
                  "        pm.expect(res.data.user.role).to.eql('PLATFORM_ADMIN');",
                  "    });",
                  "}"
                ],
                "type": "text/javascript"
              }
            }
          ],
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/json"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"email\": \"admin@loanmarketplace.com\",\n  \"password\": \"Password@123\"\n}"
            },
            "url": {
              "raw": "{{baseUrl}}/auth/login",
              "host": ["{{baseUrl}}"],
              "path": ["auth", "login"]
            },
            "description": "Logs in as Platform Admin. Saves JWT token automatically into {{adminToken}} and {{currentAccessToken}} variables."
          }
        },
        {
          "name": "1.2 Login - Lender Admin",
          "event": [
            {
              "listen": "test",
              "script": {
                "exec": [
                  "const res = pm.response.json();",
                  "if (res.success && res.data && res.data.accessToken) {",
                  "    pm.collectionVariables.set('lenderAdminToken', res.data.accessToken);",
                  "    pm.collectionVariables.set('currentAccessToken', res.data.accessToken);",
                  "    pm.test('Lender Admin login successful', () => {",
                  "        pm.expect(res.data.user.role).to.eql('LENDER_ADMIN');",
                  "    });",
                  "}"
                ],
                "type": "text/javascript"
              }
            }
          ],
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/json"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"email\": \"lender.apex@apexbank.com\",\n  \"password\": \"Password@123\"\n}"
            },
            "url": {
              "raw": "{{baseUrl}}/auth/login",
              "host": ["{{baseUrl}}"],
              "path": ["auth", "login"]
            },
            "description": "Logs in as Apex Bank Lender Admin. Saves token automatically into {{lenderAdminToken}}."
          }
        },
        {
          "name": "1.3 Login - Lender Staff",
          "event": [
            {
              "listen": "test",
              "script": {
                "exec": [
                  "const res = pm.response.json();",
                  "if (res.success && res.data && res.data.accessToken) {",
                  "    pm.collectionVariables.set('lenderStaffToken', res.data.accessToken);",
                  "    pm.collectionVariables.set('currentAccessToken', res.data.accessToken);",
                  "    pm.test('Lender Staff login successful', () => {",
                  "        pm.expect(res.data.user.role).to.eql('LENDER_STAFF');",
                  "    });",
                  "}"
                ],
                "type": "text/javascript"
              }
            }
          ],
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/json"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"email\": \"staff.blue@bluestar.com\",\n  \"password\": \"Password@123\"\n}"
            },
            "url": {
              "raw": "{{baseUrl}}/auth/login",
              "host": ["{{baseUrl}}"],
              "path": ["auth", "login"]
            },
            "description": "Logs in as BlueStar NBFC Staff. Saves token automatically into {{lenderStaffToken}}."
          }
        },
        {
          "name": "1.4 Login - Borrower",
          "event": [
            {
              "listen": "test",
              "script": {
                "exec": [
                  "const res = pm.response.json();",
                  "if (res.success && res.data && res.data.accessToken) {",
                  "    pm.collectionVariables.set('borrowerToken', res.data.accessToken);",
                  "    pm.collectionVariables.set('currentAccessToken', res.data.accessToken);",
                  "    pm.test('Borrower login successful', () => {",
                  "        pm.expect(res.data.user.role).to.eql('BORROWER');",
                  "    });",
                  "}"
                ],
                "type": "text/javascript"
              }
            }
          ],
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/json"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"email\": \"borrower@example.com\",\n  \"password\": \"Password@123\"\n}"
            },
            "url": {
              "raw": "{{baseUrl}}/auth/login",
              "host": ["{{baseUrl}}"],
              "path": ["auth", "login"]
            },
            "description": "Logs in as sample Borrower. Saves token automatically into {{borrowerToken}}."
          }
        },
        {
          "name": "1.5 Register New Borrower",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/json"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"email\": \"new_applicant@example.com\",\n  \"password\": \"SecurePass@123\",\n  \"fullName\": \"Rahul Sharma\",\n  \"phoneNumber\": \"+919876543210\",\n  \"role\": \"BORROWER\"\n}"
            },
            "url": {
              "raw": "{{baseUrl}}/auth/register",
              "host": ["{{baseUrl}}"],
              "path": ["auth", "register"]
            },
            "description": "Self-registration for a new Borrower account."
          }
        },
        {
          "name": "1.6 Get Current User Profile (/me)",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{currentAccessToken}}"
              }
            ],
            "url": {
              "raw": "{{baseUrl}}/auth/me",
              "host": ["{{baseUrl}}"],
              "path": ["auth", "me"]
            },
            "description": "Inspects the currently active JWT access token."
          }
        },
        {
          "name": "1.7 Refresh Token",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/json"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"refreshToken\": \"\"\n}"
            },
            "url": {
              "raw": "{{baseUrl}}/auth/refresh",
              "host": ["{{baseUrl}}"],
              "path": ["auth", "refresh"]
            },
            "description": "Rotates refresh token. Note: If Postman stores cookies, refreshToken body field is optional."
          }
        },
        {
          "name": "1.8 Logout",
          "event": [
            {
              "listen": "test",
              "script": {
                "exec": [
                  "const res = pm.response.json();",
                  "pm.test('Logout successful', () => {",
                  "    pm.expect(res.success).to.be.true;",
                  "});",
                  "// Clears the active session token variable",
                  "pm.collectionVariables.set('currentAccessToken', '');"
                ],
                "type": "text/javascript"
              }
            }
          ],
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{currentAccessToken}}"
              }
            ],
            "url": {
              "raw": "{{baseUrl}}/auth/logout",
              "host": ["{{baseUrl}}"],
              "path": ["auth", "logout"]
            },
            "description": "Revokes active access token in blacklist, invalidates refresh token family, and clears session cookies."
          }
        },
        {
          "name": "1.9 Forgot Password",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/json"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"email\": \"borrower@example.com\"\n}"
            },
            "url": {
              "raw": "{{baseUrl}}/auth/forgot-password",
              "host": ["{{baseUrl}}"],
              "path": ["auth", "forgot-password"]
            },
            "description": "Initiates password recovery. Dispatches email via SMTP with reset token."
          }
        },
        {
          "name": "1.10 Reset Password",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/json"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"token\": \"PASTE_RESET_TOKEN_FROM_EMAIL_OR_TERMINAL_HERE\",\n  \"newPassword\": \"NewSecurePass@123\"\n}"
            },
            "url": {
              "raw": "{{baseUrl}}/auth/reset-password",
              "host": ["{{baseUrl}}"],
              "path": ["auth", "reset-password"]
            },
            "description": "Resets user password using the token sent via email. Automatically revokes old sessions."
          }
        },
        {
          "name": "1.11 Verify Email",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/json"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"token\": \"PASTE_VERIFICATION_TOKEN_FROM_EMAIL_OR_TERMINAL_HERE\"\n}"
            },
            "url": {
              "raw": "{{baseUrl}}/auth/verify-email",
              "host": ["{{baseUrl}}"],
              "path": ["auth", "verify-email"]
            },
            "description": "Verifies borrower or lender email address."
          }
        },
        {
          "name": "1.12 Resend Verification Email",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/json"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"email\": \"new_applicant@example.com\"\n}"
            },
            "url": {
              "raw": "{{baseUrl}}/auth/resend-verification",
              "host": ["{{baseUrl}}"],
              "path": ["auth", "resend-verification"]
            },
            "description": "Resends a new email verification token to the user inbox if the previous token expired or was lost."
          }
        }
      ]
    },
    {
      "name": "2. RBAC - Platform Admin Only",
      "item": [
        {
          "name": "2.1 Admin Dashboard (System Analytics)",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{adminToken}}"
              }
            ],
            "url": {
              "raw": "{{baseUrl}}/admin/dashboard",
              "host": ["{{baseUrl}}"],
              "path": ["admin", "dashboard"]
            },
            "description": "Accessible ONLY by PLATFORM_ADMIN. Returns real-time aggregate counts."
          }
        },
        {
          "name": "2.2 List All Users",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{adminToken}}"
              }
            ],
            "url": {
              "raw": "{{baseUrl}}/admin/users",
              "host": ["{{baseUrl}}"],
              "path": ["admin", "users"]
            },
            "description": "PLATFORM_ADMIN only. Returns all registered users with their roles."
          }
        },
        {
          "name": "2.3 Update User Status (Suspend/Activate)",
          "request": {
            "method": "PATCH",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{adminToken}}"
              },
              {
                "key": "Content-Type",
                "value": "application/json"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"status\": \"ACTIVE\"\n}"
            },
            "url": {
              "raw": "{{baseUrl}}/admin/users/:userId/status",
              "host": ["{{baseUrl}}"],
              "path": ["admin", "users", ":userId", "status"],
              "variable": [
                {
                  "key": "userId",
                  "value": "USER_ID_HERE"
                }
              ]
            },
            "description": "PLATFORM_ADMIN only. Can suspend or reactivate any user account."
          }
        },
        {
          "name": "2.4 List All Lenders",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{adminToken}}"
              }
            ],
            "url": {
              "raw": "{{baseUrl}}/admin/lenders",
              "host": ["{{baseUrl}}"],
              "path": ["admin", "lenders"]
            },
            "description": "PLATFORM_ADMIN only. Lists institutional lenders and onboarding statuses."
          }
        },
        {
          "name": "2.5 Update Lender Onboarding Status",
          "request": {
            "method": "PATCH",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{adminToken}}"
              },
              {
                "key": "Content-Type",
                "value": "application/json"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"status\": \"APPROVED\",\n  \"reviewNotes\": \"Compliance and regulatory verification completed successfully.\"\n}"
            },
            "url": {
              "raw": "{{baseUrl}}/admin/lenders/:lenderId/status",
              "host": ["{{baseUrl}}"],
              "path": ["admin", "lenders", ":lenderId", "status"],
              "variable": [
                {
                  "key": "lenderId",
                  "value": "LENDER_ID_HERE"
                }
              ]
            },
            "description": "PLATFORM_ADMIN only. Approves or rejects lender onboarding."
          }
        },
        {
          "name": "2.6 Inspect System Audit Logs",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{adminToken}}"
              }
            ],
            "url": {
              "raw": "{{baseUrl}}/admin/audit-logs",
              "host": ["{{baseUrl}}"],
              "path": ["admin", "audit-logs"]
            },
            "description": "PLATFORM_ADMIN only. Queries immutable audit trail."
          }
        },
        {
          "name": "2.7 Create Commission Rule",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{adminToken}}"
              },
              {
                "key": "Content-Type",
                "value": "application/json"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"lenderId\": \"{{apexLenderId}}\",\n  \"categoryCode\": \"PERSONAL_LOAN\",\n  \"commissionType\": \"PERCENTAGE\",\n  \"commissionValue\": 1.5,\n  \"minCommissionAmount\": 500,\n  \"maxCommissionAmount\": 50000,\n  \"effectiveFrom\": \"2026-01-01T00:00:00.000Z\"\n}"
            },
            "url": {
              "raw": "{{baseUrl}}/commissions/rules",
              "host": ["{{baseUrl}}"],
              "path": ["commissions", "rules"]
            },
            "description": "PLATFORM_ADMIN only. Configures monetization and commission rules per partner lender. Requires lenderId (UUID), commissionType ('PERCENTAGE' or 'FLAT'), and commissionValue."
          }
        }
      ]
    },
    {
      "name": "3. RBAC - Lender Portal (Admin & Staff)",
      "item": [
        {
          "name": "3.1 View Lender Profile",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{lenderAdminToken}}"
              }
            ],
            "url": {
              "raw": "{{baseUrl}}/lender/profile",
              "host": ["{{baseUrl}}"],
              "path": ["lender", "profile"]
            },
            "description": "Allowed for LENDER_ADMIN and LENDER_STAFF. Returns own organization details."
          }
        },
        {
          "name": "3.2 View Assigned Applications (Tenant Isolated)",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{lenderAdminToken}}"
              }
            ],
            "url": {
              "raw": "{{baseUrl}}/lender/applications",
              "host": ["{{baseUrl}}"],
              "path": ["lender", "applications"]
            },
            "description": "Enforces tenant isolation: Returns applications submitted ONLY to this lender."
          }
        },
        {
          "name": "3.3 Create Loan Product (LENDER_ADMIN Only)",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{lenderAdminToken}}"
              },
              {
                "key": "Content-Type",
                "value": "application/json"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"category\": \"PERSONAL_LOAN\",\n  \"productName\": \"Apex Express Personal Loan Plus\",\n  \"description\": \"Fast personal financing with minimal documentation.\",\n  \"minLoanAmount\": 50000,\n  \"maxLoanAmount\": 1500000,\n  \"minTenureMonths\": 12,\n  \"maxTenureMonths\": 60,\n  \"minInterestRate\": 10.75,\n  \"maxInterestRate\": 16.5,\n  \"interestRateType\": \"FIXED\",\n  \"processingFeeType\": \"PERCENTAGE\",\n  \"processingFeeValue\": 1.5,\n  \"minProcessingFee\": 1000,\n  \"maxProcessingFee\": 7500,\n  \"indicativeApprovalTatHours\": 24\n}"
            },
            "url": {
              "raw": "{{baseUrl}}/lender/products",
              "host": ["{{baseUrl}}"],
              "path": ["lender", "products"]
            },
            "description": "Allowed strictly for LENDER_ADMIN. LENDER_STAFF will receive 403 Forbidden."
          }
        },
        {
          "name": "3.4 Transition Application Status",
          "request": {
            "method": "PATCH",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{lenderStaffToken}}"
              },
              {
                "key": "Content-Type",
                "value": "application/json"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"status\": \"IN_PROGRESS_WITH_LENDER\",\n  \"reason\": \"Applicant credit profile under evaluation by underwriting desk.\",\n  \"internalNotes\": \"Salary slips and PAN verified. Awaiting bank statement confirmation.\"\n}"
            },
            "url": {
              "raw": "{{baseUrl}}/applications/:appId/status",
              "host": ["{{baseUrl}}"],
              "path": ["applications", ":appId", "status"],
              "variable": [
                {
                  "key": "appId",
                  "value": "APP_ID_HERE"
                }
              ]
            },
            "description": "Allowed for LENDER_ADMIN and LENDER_STAFF for applications assigned to their organization."
          }
        },
        {
          "name": "3.5 View Tenant Commission Ledger",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{lenderAdminToken}}"
              }
            ],
            "url": {
              "raw": "{{baseUrl}}/commissions/ledger",
              "host": ["{{baseUrl}}"],
              "path": ["commissions", "ledger"]
            },
            "description": "Returns commission records scoped strictly to this lender."
          }
        }
      ]
    },
    {
      "name": "4. RBAC - Borrower Portal",
      "item": [
        {
          "name": "4.1 View Borrower Profile",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{borrowerToken}}"
              }
            ],
            "url": {
              "raw": "{{baseUrl}}/borrower/profile",
              "host": ["{{baseUrl}}"],
              "path": ["borrower", "profile"]
            },
            "description": "Allowed for BORROWER. Returns personal demographic, address & income profile."
          }
        },
        {
          "name": "4.2 Update Borrower Profile",
          "request": {
            "method": "PATCH",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{borrowerToken}}"
              },
              {
                "key": "Content-Type",
                "value": "application/json"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"fullName\": \"Aarav S. Patel\",\n  \"monthlyIncome\": 85000,\n  \"existingMonthlyObligations\": 15000,\n  \"employmentType\": \"SALARIED\",\n  \"employerName\": \"Tata Consultancy Services\",\n  \"panNumber\": \"ABCDE1234F\",\n  \"residentialAddress\": \"Flat 402, Green Glen Layout, Bellandur\",\n  \"city\": \"Bengaluru\",\n  \"state\": \"Karnataka\",\n  \"postalCode\": \"560103\"\n}"
            },
            "url": {
              "raw": "{{baseUrl}}/borrower/profile",
              "host": ["{{baseUrl}}"],
              "path": ["borrower", "profile"]
            },
            "description": "Updates the borrower's personal and financial profile."
          }
        },
        {
          "name": "4.3 View My Applications",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{borrowerToken}}"
              }
            ],
            "url": {
              "raw": "{{baseUrl}}/borrower/applications",
              "host": ["{{baseUrl}}"],
              "path": ["borrower", "applications"]
            },
            "description": "Returns only applications belonging to the authenticated borrower."
          }
        },
        {
          "name": "4.4 View Saved Offers",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{borrowerToken}}"
              }
            ],
            "url": {
              "raw": "{{baseUrl}}/borrower/saved-offers",
              "host": ["{{baseUrl}}"],
              "path": ["borrower", "saved-offers"]
            },
            "description": "Returns loan offers bookmarked by the borrower."
          }
        },
        {
          "name": "4.5 Create Draft Loan Application",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{borrowerToken}}"
              },
              {
                "key": "Content-Type",
                "value": "application/json"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"productId\": \"PRODUCT_UUID_HERE\",\n  \"requestedAmount\": 300000,\n  \"requestedTenureMonths\": 36,\n  \"monthlyIncome\": 85000,\n  \"employmentType\": \"SALARIED\"\n}"
            },
            "url": {
              "raw": "{{baseUrl}}/applications",
              "host": ["{{baseUrl}}"],
              "path": ["applications"]
            },
            "description": "Creates an application draft."
          }
        }
      ]
    },
    {
      "name": "5. RBAC Negative Tests (Forbidden & Unauthorized Verification)",
      "item": [
        {
          "name": "5.1 Borrower trying to access Admin Dashboard -> Expect 403 Forbidden",
          "event": [
            {
              "listen": "test",
              "script": {
                "exec": [
                  "pm.test('RBAC Guard: Rejects Borrower with 403 Forbidden', () => {",
                  "    pm.expect(pm.response.code).to.eql(403);",
                  "    pm.expect(pm.response.json().error.message).to.include('Access denied');",
                  "});"
                ],
                "type": "text/javascript"
              }
            }
          ],
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{borrowerToken}}"
              }
            ],
            "url": {
              "raw": "{{baseUrl}}/admin/dashboard",
              "host": ["{{baseUrl}}"],
              "path": ["admin", "dashboard"]
            },
            "description": "Tests that BORROWER cannot access /admin/dashboard."
          }
        },
        {
          "name": "5.2 Lender Staff trying to create Loan Product -> Expect 403 Forbidden",
          "event": [
            {
              "listen": "test",
              "script": {
                "exec": [
                  "pm.test('RBAC Guard: Rejects Lender Staff from creating product with 403', () => {",
                  "    pm.expect(pm.response.code).to.eql(403);",
                  "});"
                ],
                "type": "text/javascript"
              }
            }
          ],
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Authorization",
                "value": "Bearer {{lenderStaffToken}}"
              },
              {
                "key": "Content-Type",
                "value": "application/json"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"category\": \"PERSONAL_LOAN\",\n  \"productName\": \"Unauthorized Product Creation Attempt\",\n  \"minLoanAmount\": 10000,\n  \"maxLoanAmount\": 50000,\n  \"minTenureMonths\": 6,\n  \"maxTenureMonths\": 12,\n  \"minInterestRate\": 12,\n  \"maxInterestRate\": 18,\n  \"interestRateType\": \"FIXED\",\n  \"processingFeeType\": \"FLAT\",\n  \"processingFeeValue\": 500\n}"
            },
            "url": {
              "raw": "{{baseUrl}}/lender/products",
              "host": ["{{baseUrl}}"],
              "path": ["lender", "products"]
            },
            "description": "Only LENDER_ADMIN can create products. LENDER_STAFF is rejected."
          }
        },
        {
          "name": "5.3 Accessing Protected Route Without Token -> Expect 401 Unauthorized",
          "event": [
            {
              "listen": "test",
              "script": {
                "exec": [
                  "pm.test('Auth Guard: Rejects unauthenticated request with 401', () => {",
                  "    pm.expect(pm.response.code).to.eql(401);",
                  "});"
                ],
                "type": "text/javascript"
              }
            }
          ],
          "request": {
            "method": "GET",
            "header": [],
            "url": {
              "raw": "{{baseUrl}}/borrower/profile",
              "host": ["{{baseUrl}}"],
              "path": ["borrower", "profile"]
            },
            "description": "Validates that omitting Authorization header triggers 401 Unauthorized."
          }
        },
        {
          "name": "5.4 Attempting to Register as PLATFORM_ADMIN -> Expect 400/422 Bad Request",
          "event": [
            {
              "listen": "test",
              "script": {
                "exec": [
                  "pm.test('Privilege Escalation Guard: Blocks self-registration as PLATFORM_ADMIN', () => {",
                  "    pm.expect([400, 422]).to.include(pm.response.code);",
                  "});"
                ],
                "type": "text/javascript"
              }
            }
          ],
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/json"
              }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"email\": \"hacker_superadmin@test.com\",\n  \"password\": \"HackerPass@123\",\n  \"fullName\": \"Malicious Attacker\",\n  \"phoneNumber\": \"+919999988888\",\n  \"role\": \"PLATFORM_ADMIN\"\n}"
            },
            "url": {
              "raw": "{{baseUrl}}/auth/register",
              "host": ["{{baseUrl}}"],
              "path": ["auth", "register"]
            },
            "description": "Validates privilege escalation prevention: PLATFORM_ADMIN cannot be self-registered."
          }
        }
      ]
    }
  ]
}