Strapi Integration
Using Impersona with Strapi for role-based permission testing.
Auth model
Strapi typically authenticates API requests with Authorization: Bearer <token> and enforces permissions per role and content type.
Recommended strategy
Use Authorization header swap.
What to test
- Content-type permissions behave as expected for each role
- Public vs authenticated routes behave correctly
- CRUD operations are permitted or denied based on role
Notes
If you use custom Strapi policies or middlewares, confirm impersonation flows through the full stack.