Bite 30L.1 30L.2 — Manual Promotion Test Suite - RodrigoMattosoSilveira/EnterpriseRemoteSystems GitHub Wiki

ERS Bite 30L.1 + 30L.2 — Manual Promotion Test Suite

Branch: 820-30l2
Committed HEAD SHA: cc5a95e9ed0e37b6df2bdb286ba5786ccb90da38
Purpose: Manual promotion verification for 30L.1 — Multi-Tenant Identity and Confidentiality E2E and 30L.2 — Identity Lifecycle and Delegated Authorization E2E after local and CI automation are green.

Promotion rule

Promote 30L.1 + 30L.2 only if all five tests PASS. Any wrong Tenant context, leaked other-Tenant identity, loss of the surviving Tenant session, incorrect Account/session lifecycle, lost Person self-service after delegated-role revocation, or incorrect Collaborator Journey lifecycle is promotion-blocking.

0. Prerequisites and deterministic local fixtures

0.1 Confirm the committed source

From the repository root:

git rev-parse HEAD

Expected:

cc5a95e9ed0e37b6df2bdb286ba5786ccb90da38

PASS: the SHA matches exactly.
BLOCK PROMOTION: stop if it does not match.

0.2 Start the backend with the deterministic 30L E2E identities provisioned

Stop any currently running local backend first. For this manual promotion suite, use a dedicated disposable database rather than your normal backend/data/app.db. This prevents fixture provisioning from colliding with historical local identities such as an [email protected] Account already bound to bootstrap-admin.

For the first start of the manual-test backend, from the repository root run:

ERS_DATABASE_PATH=data/manual-30l.db \
ERS_RESET_DATABASE=true \
ERS_PROVISION_E2E_ADMIN=true \
AUTHZ_BOOTSTRAP_ENABLED=false \
[email protected] \
E2E_ADMIN_PASSWORD='Local-E2E-Administrator-28D!' \
make local-backend

Leave that terminal running. ERS_RESET_DATABASE=true deletes only backend/data/manual-30l.db; it does not touch your normal backend/data/app.db.

If you need to restart the backend while continuing the same manual suite, preserve the manual-test data by omitting the reset flag:

ERS_DATABASE_PATH=data/manual-30l.db \
ERS_PROVISION_E2E_ADMIN=true \
AUTHZ_BOOTSTRAP_ENABLED=false \
[email protected] \
E2E_ADMIN_PASSWORD='Local-E2E-Administrator-28D!' \
make local-backend

Do not point this fixture-provisioning command at an existing developer database whose [email protected] login is already bound to another Actor. The provisioner intentionally stops on login ownership conflicts instead of silently relinking an Authentication Account.

This provisioning creates/reconciles the identities used below, including:

Role Login Password
Application Administrator [email protected] Local-E2E-Administrator-28D!
Default Tenant Administrator [email protected] Local-E2E-Administrator-28D!
Multi-Tenant Person [email protected] Local-E2E-Administrator-28D!
Tenant A Administrator [email protected] Local-E2E-Administrator-28D!
Tenant B Administrator [email protected] Local-E2E-Administrator-28D!

The deterministic multi-Tenant identity is:

Item Expected value
Global Person e2e-multi-tenant-person
Tenant A E2E Multi Tenant A / E2EMULTIA
Tenant A Membership e2e-multi-tenant-membership-e2e-multi-tenant-a
Tenant A Actor e2e-multi-tenant-actor-e2e-multi-tenant-a
Tenant B E2E Multi Tenant B / E2EMULTIB
Tenant B Membership e2e-multi-tenant-membership-e2e-multi-tenant-b
Tenant B Actor e2e-multi-tenant-actor-e2e-multi-tenant-b

0.3 Start the frontend

In a second terminal:

make local-frontend

Open the normal local frontend in the browser.

0.4 Browser-session rule for these tests

Where a test requires two identities at the same time, use two independent browser sessions, for example:

  • one normal browser window/profile;
  • one Incognito/InPrivate window or a different browser profile.

Do not reuse the same cookie jar for two simultaneous identities.

Test 01 — One Account switches between Tenant A and Tenant B without leaking the other Tenant relationship

Identity and context

Sign in as: [email protected]
Password: Local-E2E-Administrator-28D!

Steps

  1. Open the application login page.
  2. Enter the exact login and password above.
  3. Click Sign in.
  4. In the top bar, locate the Tenant selector.
  5. Click the collapsed Tenant selector.
  6. Verify the selection panel initially shows both:
    • E2E Multi Tenant A (E2EMULTIA)
    • E2E Multi Tenant B (E2EMULTIB)
  7. Select E2E Multi Tenant A.
  8. Confirm the selector closes and the top bar now shows E2E Multi Tenant A.
  9. Click People in the application navigation.
  10. Open the signed-in Person's own Person record if it is not already displayed.
  11. Record the displayed Membership ID.
  12. Verify it is exactly:
e2e-multi-tenant-membership-e2e-multi-tenant-a
  1. On that Person screen, look for any visible value containing any of the following Tenant B identifiers:
e2e-multi-tenant-b
e2e-multi-tenant-membership-e2e-multi-tenant-b
e2e-multi-tenant-actor-e2e-multi-tenant-b
  1. Verify none of those Tenant B identifiers is visible.
  2. Open the Tenant selector again.
  3. Verify reopening the selector shows the full unfiltered list again.
  4. Select E2E Multi Tenant B.
  5. Confirm the selector closes and the top bar now shows E2E Multi Tenant B.
  6. Open People and the signed-in Person's own Person record.
  7. Record the displayed Membership ID.
  8. Verify it is exactly:
e2e-multi-tenant-membership-e2e-multi-tenant-b
  1. Verify none of these Tenant A identifiers is visible:
e2e-multi-tenant-a
e2e-multi-tenant-membership-e2e-multi-tenant-a
e2e-multi-tenant-actor-e2e-multi-tenant-a
  1. Confirm you were not required to sign in again when switching from Tenant A to Tenant B.

Expected result

The same Authentication Account can use both Tenant contexts, but each Tenant context exposes only its own Membership projection. Switching Tenant changes operating context without changing Account session.

PASS criteria

  • Both Tenant choices are available.
  • Selecting a Tenant closes the selector and changes the visible current Tenant.
  • Tenant A shows only Membership A.
  • Tenant B shows only Membership B.
  • No other-Tenant Membership/Actor identifiers are exposed.
  • No re-login is required between Tenant A and Tenant B.

Promotion-blocking conditions

BLOCK PROMOTION if the wrong Membership appears, both Memberships appear together, another Tenant's Actor/Membership is disclosed, Tenant switching signs the Account out, or the selected Tenant in the top bar does not match the Person projection.

Test 02 — Deactivating Tenant Actor A leaves Tenant B usable in the same Account session, then reactivation restores Tenant A

Identities and browser sessions

Browser session 1 — Multi-Tenant Person

Login: [email protected]
Password: Local-E2E-Administrator-28D!

Browser session 2 — Tenant A Administrator

Login: [email protected]
Password: Local-E2E-Administrator-28D!
Required Tenant context: E2E Multi Tenant A

Steps

  1. In browser session 1, sign in as the Multi-Tenant Person.

  2. Select E2E Multi Tenant B and confirm the application is usable.

  3. Keep browser session 1 signed in.

  4. In browser session 2, sign in as the Tenant A Administrator.

  5. Confirm the top-bar Tenant is E2E Multi Tenant A.

  6. Click Authorization in the application navigation.

  7. In the Actors section, locate the field labeled Filter actors by Actor Key or display name.

  8. Enter exactly:

    e2e-multi-tenant-actor-e2e-multi-tenant-a

  9. Verify exactly the intended Tenant A Actor card remains visible.

  10. Confirm the card currently shows Active.

  11. Click Deactivate on that Actor card.

  12. Wait until the same card shows Inactive and the action changes to Activate.

  13. Return to browser session 1 without signing out.

  14. Reload the current page once so the shell refreshes the Account's available Tenant options.

  15. Verify you remain authenticated.

  16. Open the Tenant selector.

  17. Verify E2E Multi Tenant B remains available.

  18. Verify E2E Multi Tenant A is no longer available while Actor A is inactive.

  19. Select or retain E2E Multi Tenant B.

  20. Click People and confirm the signed-in Person's self-service still loads successfully.

  21. Return to browser session 2.

  22. On the same Tenant A Actor card, click Activate.

  23. Wait until the card shows Active again.

  24. Return to browser session 1.

  25. Reload the page once.

  26. Open the Tenant selector.

  27. Verify both E2E Multi Tenant A and E2E Multi Tenant B are available again.

  28. Select E2E Multi Tenant A.

  29. Confirm the application changes to Tenant A successfully without asking for credentials again.

  30. Open People and confirm self-service loads in Tenant A.

Values to record

Record:

  • whether the Person Account remained signed in while Actor A was inactive;
  • whether Tenant B remained selectable and usable;
  • whether Tenant A disappeared while inactive;
  • whether Tenant A returned after reactivation without a new login.

PASS criteria

All four observations must be Yes.

Promotion-blocking conditions

BLOCK PROMOTION if deactivating Actor A invalidates the whole Account session, disables Tenant B, leaves Tenant A selectable as if active, or if reactivation requires a new login before Tenant A becomes usable again.

Test 03 — Revoking a delegated Role Grant removes operator authority but preserves Person self-service

Identities and browser sessions

Browser session 1 — Multi-Tenant Person

Login: [email protected]
Password: Local-E2E-Administrator-28D!
Tenant: E2E Multi Tenant A

Browser session 2 — Tenant A Administrator

Login: [email protected]
Password: Local-E2E-Administrator-28D!
Tenant: E2E Multi Tenant A

Steps

  1. In browser session 2, sign in as the Tenant A Administrator.

  2. Confirm E2E Multi Tenant A is selected.

  3. Open Authorization.

  4. Filter Actors by:

    e2e-multi-tenant-actor-e2e-multi-tenant-a

  5. On that Actor card, use the Role selector and choose:

    EXPENSE_OPERATOR

  6. Verify Grant tenant displays the Tenant A binding and is not editable.

  7. Click Grant Role.

  8. Verify the Actor card displays an active EXPENSE_OPERATOR grant.

  9. In browser session 1, sign in as the Multi-Tenant Person and select E2E Multi Tenant A.

  10. Reload once so navigation reflects the new effective authorization.

  11. Verify the application exposes the Expenses navigation/workspace that comes from the delegated Expense Operator role.

  12. Verify People self-service is also available.

  13. Return to browser session 2.

  14. On the same Actor card, locate the active EXPENSE_OPERATOR grant.

  15. Click Revoke for that grant.

  16. Wait until the active EXPENSE_OPERATOR grant is no longer shown as active.

  17. Return to browser session 1.

  18. Reload once.

  19. Verify the Account remains signed in.

  20. Verify the delegated Expenses capability/navigation is no longer available to this Person.

  21. Verify People remains available.

  22. Open the signed-in Person's own Person record and confirm it loads successfully.

  23. Open the Tenant selector and verify Tenant A remains a valid Tenant context; the Role revocation must not remove the Account→Actor→Membership identity binding.

Expected result

Revoking EXPENSE_OPERATOR removes only delegated Expense Operator authority. It does not deactivate the Actor, remove the Membership, invalidate the Account session, or remove intrinsic Person self-service.

PASS criteria

  • EXPENSE_OPERATOR can be granted and then revoked.
  • Expense-operator UI capability disappears after revocation.
  • The Account remains authenticated.
  • Tenant A remains selectable.
  • People self-service still works.

Promotion-blocking conditions

BLOCK PROMOTION if revocation signs the Person out, removes Tenant A, disables the Actor, removes the Membership, or prevents the Person from opening their own People/self-service view.

Test 04 — Temporary password, Account security suspension/reactivation, session invalidation, and administrator-issued reset

This test creates a disposable Person/Account through the UI so the deterministic 30L fixtures are not left with a changed password.

Test data

Use exactly these values:

Field Value
First Name Manual30L2
Last Name Lifecycle
Nickname M30L2 Lifecycle
CPF 16180339805
RG M30L2-LIFECYCLE-001
Cellular 11987654321
Email / login [email protected]
Initial temporary password Manual-30L2-Temp-1!
First permanent password Manual-30L2-Permanent-2!
Reset password Manual-30L2-Reset-3!

Phase A — Create the Person in Default Tenant

Identity

Sign in as: [email protected]
Password: Local-E2E-Administrator-28D!
Tenant: Default Tenant (DEFAULT)

Steps

  1. Sign in as the Default Tenant Administrator.
  2. Confirm the top-bar Tenant is Default Tenant.
  3. Open People.
  4. Choose the UI action to create a new Person.
  5. Enter the exact Personal values from the table above.
  6. Set Status to Active.
  7. Click Create Person.
  8. Find M30L2 Lifecycle in People and open the record.
  9. Confirm the Person exists and is ACTIVE in Default Tenant.

Phase B — Create the Authentication Account with a temporary password

Identity

Sign in as: [email protected]
Password: Local-E2E-Administrator-28D!
Administration context: global/Application Administration (*)

Steps

  1. In a separate browser session, sign in as the Application Administrator.

  2. Confirm the top bar shows the Administration context, not a Tenant operating context.

  3. Open Authentication.

  4. In the create-account form, choose Default Tenant as the target Tenant.

  5. Enter exact Person login email:

    [email protected]

  6. Enter temporary password:

    Manual-30L2-Temp-1!

  7. Click Create account.

  8. In Actor/account filter, search for [email protected].

  9. Confirm one Authentication Account card appears.

  10. Confirm the card identifies the linked Person and a Tenant Actor for Default Tenant.

  11. Confirm the card indicates Password change required.

Phase C — First login must force a password change

  1. In a new Incognito/InPrivate browser session, open the login page.

  2. Sign in as [email protected] with Manual-30L2-Temp-1!.

  3. Verify the application sends the user to Change password before normal application use.

  4. Enter:

    Current password

    Manual-30L2-Temp-1!

    New password

    Manual-30L2-Permanent-2!

    Confirm new password

    Manual-30L2-Permanent-2!

  5. Click Change password.

  6. Confirm the Person reaches normal authenticated self-service.

Phase D — Security suspension invalidates the active session and uses the explicit reactivation workflow

  1. Return to the Application Administrator browser session.

  2. On the filtered Authentication Account card for [email protected], click Security suspend.

  3. Confirm the account card now shows Security suspended.

  4. Return to the Person browser session.

  5. Attempt normal navigation, for example click People or reload the current protected page.

  6. Verify the existing session is no longer accepted and the browser is returned to Sign in.

  7. Attempt to sign in with:

    [email protected]
Manual-30L2-Permanent-2!

  8. Verify login is rejected with the security-suspension message.

  9. Verify Request reactivation is offered.

  10. Click Request reactivation.

  11. Verify the page shows Reactivation requested and explains that an Application Administrator must review the request.

  12. Return to the Application Administrator browser session.

  13. Open Tenants if necessary to expose the pending-request alert.

  14. Find Pending account reactivation requests and click Review requests.

  15. In Account reactivation requests, find the card for [email protected].

  16. Enter Review reason:

    Manual 30L.2 lifecycle promotion verification

  17. Click Approve reactivation.

  18. Confirm the request disappears from the pending list.

  19. Return to the Person browser session.

  20. Click Return to sign in if that button is shown.

  21. Sign in using Manual-30L2-Permanent-2!.

  22. Confirm normal Person self-service is restored.

Phase E — Administrator-issued reset invalidates the old credential/session

  1. Return to the Application Administrator browser session.

  2. Open Authentication and filter for [email protected].

  3. On that Account card, click Issue reset token.

  4. Verify a panel appears with heading One-time reset token for [email protected].

  5. Click Open reset page.

  6. Confirm the reset page contains the issued token automatically.

  7. Enter New password and Confirm new password as:

    Manual-30L2-Reset-3!

  8. Click Reset password.

  9. Return to the previously authenticated Person browser session.

  10. Attempt protected navigation or reload.

  11. Verify the pre-reset session is no longer accepted.

  12. Attempt login with the old permanent password:

    Manual-30L2-Permanent-2!

  13. Verify it is rejected.

  14. Sign in with:

    Manual-30L2-Reset-3!

  15. Verify authentication succeeds and Person self-service loads.

PASS criteria

  • Temporary-password login forces Change password.
  • New permanent password works.
  • Security suspension invalidates the existing session.
  • Suspended login is denied with a clear review/reactivation path.
  • Reactivation request can be reviewed and approved by Application Administrator.
  • The same Account works again after approval.
  • Administrator-issued reset invalidates the old session/credential.
  • Old password fails after reset.
  • New reset password succeeds.

Promotion-blocking conditions

BLOCK PROMOTION for any failure in the sequence above, including a suspended Account retaining an active session, password reset leaving an old session usable, reactivation silently restoring delegated authorization incorrectly, or an Application Administrator being forced into Tenant standing identity to perform review.

Test 05 — Close a zero-balance Collaborator Journey and create a new Journey for the same canonical Membership

Identity and context

Sign in as: [email protected]
Password: Local-E2E-Administrator-28D!
Tenant: Default Tenant (DEFAULT)

Test Person values

Field Value
First Name Manual30L2
Last Name Journey
Nickname M30L2 Journey
CPF 31415926590
RG M30L2-JOURNEY-001
Cellular 11987654322
Email [email protected]
Street 1 Rua Manual 30L2 200
State Pará
City Manual City
CEP 66000-000
Bank Name Manual Bank
Bank Number 001
Checking Account M30L2-002
PIX [email protected]
Emergency Contact Name Manual Emergency
Emergency Cellular 11999990002
Emergency Email [email protected]

Phase A — Create and complete the Person

  1. Sign in as the Default Tenant Administrator.
  2. Confirm Default Tenant is selected.
  3. Open People and create a new Person.
  4. Enter the exact Personal values above and set Status to Active.
  5. Click Create Person.
  6. Find and open M30L2 Journey.
  7. Open the Address tab and enter the exact Address values above.
  8. Click Save Changes.
  9. Open the Bank tab and enter the exact Bank values above.
  10. Click Save Changes.
  11. Open the Emergency tab and enter the exact Emergency values above.
  12. Click Save Changes.
  13. Confirm the page indicates the Person is eligible to become a Collaborator.
  14. Record the displayed Membership ID. Call this recorded value MEMBERSHIP-30L2 for the remainder of the test.

Phase B — Create Journey #1

  1. Open Collaborators.

  2. Choose the UI action to create a new Collaborator.

  3. In Find eligible Person by nickname, type:

    M30L2 Journey

  4. Select the matching Person.

  5. Confirm the UI says Selected Person is complete.

  6. Enter/select:

    Field Value
    Journey Start Date 2026-09-11
    Status Active
    Sector Mining
    Location Main Mine
    Task Miner
    Payment Method Daily wage
    Payment Value 100
    Notes Manual 30L.2 first Journey

  7. Click Create Collaborator.

  8. Open the new Collaborator Journey detail.

  9. Record:

    • Journey ID as JOURNEY-1;
    • Membership ID displayed on the Journey.

  10. Verify the Journey Membership ID exactly equals MEMBERSHIP-30L2.

  11. Locate Journey Settlement.

  12. Confirm the settlement state indicates all Journey balances are zero and closure is allowed.

  13. Confirm Close Journey is enabled.

Phase C — Close Journey #1 through the real settlement UI

  1. Click Close Journey.

  2. In the sensitive-action form choose Reason code:

    End-of-journey closure

  3. Enter Reason text:

    Manual 30L.2 zero-balance Journey closure verification.

  4. Click Confirm reauthentication.

  5. If the page says second-person approval is Required, stop this test and first change Administration → Account settings → Second-person approval to Optional, recording the previous value so you can restore it afterward. Then return to the Journey and repeat the closure action.

  6. Click the final Close Journey button.

  7. Verify a success dialog titled Journey Closed appears and contains:

    Journey closed successfully.

  8. Click Continue.

  9. Verify the Journey detail now prominently shows Journey Closed and a Closed At value.

  10. Verify the closed Journey still displays Membership ID MEMBERSHIP-30L2.

  11. Record the Closed At value.

Phase D — Create Journey #2 for the same Membership

  1. Return to Collaborators.

  2. Choose the UI action to create a new Collaborator.

  3. Search eligible People for M30L2 Journey again.

  4. Verify the Person is eligible again after Journey #1 is closed.

  5. Select that Person.

  6. Enter/select:

    Field Value
    Journey Start Date 2026-09-12
    Status Active
    Sector Mining
    Location Main Mine
    Task Miner
    Payment Method Daily wage
    Payment Value 125
    Notes Manual 30L.2 second Journey

  7. Click Create Collaborator.

  8. Open the new Journey detail.

  9. Record its Journey ID as JOURNEY-2.

  10. Verify JOURNEY-2 is different from JOURNEY-1.

  11. Verify its Membership ID still equals MEMBERSHIP-30L2.

  12. Verify its Status is active/open rather than closed.

  13. Open Journey Settlement.

  14. Verify the new Journey begins with zero Journey balances and is independently eligible for closure.

  15. If you changed the Second-person approval setting in step 32, restore the original setting now.

PASS criteria

  • Journey #1 is created against the canonical Membership.
  • Zero-balance closure succeeds only through the sensitive settlement flow.
  • The closed Journey keeps the same Membership ID and records Closed At.
  • The Person becomes eligible for a new Journey after closure.
  • Journey #2 has a new Journey ID but the same Membership ID.
  • Journey #2 starts with zero balances rather than inheriting Journey #1 financial state.

Promotion-blocking conditions

BLOCK PROMOTION if Journey #1 cannot close at zero balance, if closure changes/removes the canonical Membership identity, if the Person cannot be re-onboarded after closure, if Journey #2 reuses Journey #1's ID, or if Journey #2 inherits prior Journey balances/history as current balance.

Final promotion decision

Mark each test:

  • Test 01 — Multi-Tenant selection and confidentiality — PASS
  • Test 02 — Tenant Actor deactivate/reactivate with surviving Tenant session — PASS
  • Test 03 — Role Grant revoke while self-service survives — PASS
  • Test 04 — Account/session/password/reset lifecycle — PASS
  • Test 05 — Collaborator Journey close/re-onboard lifecycle — PASS

Promote 30L.1 + 30L.2 only when all five boxes are checked and no promotion-blocking condition was observed.

Manual-suite tooling impact

No DevTools commands are required.
No direct API calls are required.
No SQL commands are required.
The only non-UI setup is deterministic local E2E fixture provisioning through the normal provision-e2e-admin path before the UI tests begin.