From ab714a4ff1aa17e84720e6ec8306a059b316e121 Mon Sep 17 00:00:00 2001
From: Ophir LOJKINE <ophir.lojkine@datadoghq.com>
Date: Tue, 2 Jun 2026 14:40:22 +0200
Subject: [PATCH] Strengthen CRUD auth Hurl flow

---
 .github/workflows/examples-hurl.yml      |  6 ++-
 examples/CRUD - Authentication/test.hurl | 68 ++++++++++++++++++++++++
 2 files changed, 73 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/examples-hurl.yml b/.github/workflows/examples-hurl.yml
index e56d5db4..043cc232 100644
--- a/.github/workflows/examples-hurl.yml
+++ b/.github/workflows/examples-hurl.yml
@@ -27,9 +27,13 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - name: Install Hurl
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: |
           version=8.0.0
-          curl --silent --location "https://github.com/Orange-OpenSource/hurl/releases/download/${version}/hurl-${version}-x86_64-unknown-linux-gnu.tar.gz" | tar xz -C /tmp
+          archive="hurl-${version}-x86_64-unknown-linux-gnu.tar.gz"
+          gh release download "$version" --repo Orange-OpenSource/hurl --pattern "$archive" --dir /tmp
+          tar xzf "/tmp/$archive" -C /tmp
           echo "/tmp/hurl-${version}-x86_64-unknown-linux-gnu/bin" >> "$GITHUB_PATH"
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
diff --git a/examples/CRUD - Authentication/test.hurl b/examples/CRUD - Authentication/test.hurl
index ec87a188..dd496aaf 100644
--- a/examples/CRUD - Authentication/test.hurl	
+++ b/examples/CRUD - Authentication/test.hurl	
@@ -20,6 +20,20 @@ body contains "Username"
 body contains "Password"
 body not contains "An error occurred"
 
+POST http://localhost:8080/create_session.sql?path=/currencies_list.sql
+[FormParams]
+username: admin
+password: wrong
+HTTP 302
+[Asserts]
+header "Location" contains "login.sql"
+header "Location" contains "error=1"
+
+GET http://localhost:8080/currencies_list.sql
+HTTP 302
+[Asserts]
+header "Location" == "/login.sql?path=/currencies_list.sql"
+
 # Demo credentials from the example migration: admin/admin.
 POST http://localhost:8080/create_session.sql?path=/currencies_list.sql
 [FormParams]
@@ -56,6 +70,60 @@ body contains "Exchange Rate to RUR"
 body contains "BROWSE"
 body not contains "An error occurred"
 
+POST http://localhost:8080/currencies_item_dml.sql?path=currencies_list.sql&action=UPDATE
+[FormParams]
+id:
+name: HURLTEST
+to_rub: 7.89
+HTTP 302
+[Captures]
+currency_id: header "Location" regex "id=(\\d+)"
+[Asserts]
+header "Location" contains "currencies_list.sql"
+header "Location" contains "info=INSERT"
+
+GET http://localhost:8080/currencies_list.sql
+HTTP 200
+[Asserts]
+body contains "HURLTEST"
+body contains "7.89"
+body htmlUnescape contains "currencies_item_form.sql?&path=/currencies_list.sql&id={{currency_id}}"
+body not contains "An error occurred"
+
+POST http://localhost:8080/currencies_item_dml.sql?path=currencies_list.sql&action=UPDATE
+[FormParams]
+id: {{currency_id}}
+name: HURLEDITED
+to_rub: 8.91
+HTTP 302
+[Asserts]
+header "Location" contains "currencies_list.sql"
+header "Location" contains "id={{currency_id}}"
+header "Location" contains "info=UPDATE"
+
+GET http://localhost:8080/currencies_item_form.sql?id={{currency_id}}
+HTTP 200
+[Asserts]
+body contains "HURLEDITED"
+body contains "8.91"
+body not contains "An error occurred"
+
+POST http://localhost:8080/currencies_item_dml.sql?path=currencies_list.sql&action=DELETE
+[FormParams]
+id: {{currency_id}}
+name: HURLEDITED
+to_rub: 8.91
+HTTP 302
+[Asserts]
+header "Location" contains "currencies_list.sql"
+header "Location" contains "info=DELETE"
+
+GET http://localhost:8080/currencies_list.sql
+HTTP 200
+[Asserts]
+body not contains "HURLEDITED"
+body not contains "An error occurred"
+
 GET http://localhost:8080/logout.sql?path=currencies_list.sql
 HTTP 302
 [Asserts]