TC-ADMIN-006: Super-Admin Tenant Detail — Split, Attestation & Finance (Detailed)
URLs for this test:
Admin Portal login:
Tenant detail:
Org Controls (finance overview):
New platform user:
API base:
Admin Portal login:
https://stg-admin.membervu.com/loginTenant detail:
https://stg-admin.membervu.com/tenants/:id (via tenant list, or Org Controls)Org Controls (finance overview):
https://stg-admin.membervu.com/org-controlsNew platform user:
https://stg-admin.membervu.com/users/newAPI base:
https://stg-api.membervu.com/api/platform
Do NOT use the org portal (
stg-rcme.membervu.com) for this TC. All scenarios below live in the Admin Portal (stg-admin.membervu.com) — logging in as a platform-role-only user on the org portal causes a redirect loop. If the admin portal is not deployed to staging, mark this entire TC as SKIPPED — admin portal not available on staging.
Step 1: Log in as SUPER_ADMIN and create a throwaway PLATFORM_SUPPORT user
| Step | Action (EXACT clicks/typing) | Expected Result (EXACT text/behavior) | Test Value |
|---|---|---|---|
| 1 | Go to https://stg-admin.membervu.com/login. Enter email/password and click Sign In. | Login succeeds; admin portal dashboard loads. | superadmin@zeniark.com / SuperAdmin123! |
| 2 | Navigate to Platform Users → /users/new. | Create-platform-user form loads with a role checklist: Super Admin (Full platform access) and Support (View tenants, assist users). | — |
| 3 | Fill the form for a throwaway account. Check ONLY the Support role checkbox (do NOT check Super Admin). | Only the PLATFORM_SUPPORT role is selected. | Name QA Admin006 Support · Email qa-admin006-support@example.com · Password QaSupport123! |
| 4 | Submit. | User created successfully; platformRoles = ["PLATFORM_SUPPORT"] only (no SUPER_ADMIN). | — |
Step 2: SUPER_ADMIN — open tenant detail, confirm Split Agreement tab + values (ADM6-01)
| Step | Action | Expected Result | Test Value |
|---|---|---|---|
| 1 | Still logged in as SUPER_ADMIN, navigate to the tenant list (Dashboard or Tenants nav) and click into the rcme tenant. | TenantDetailPage loads at /tenants/:id. Tab bar shows: Overview, Platform Channels, PayBiz Config, Split Agreement, Events — all 5 tabs visible. | — |
| 2 | Open browser DevTools → Network tab. Reload the page (or re-trigger the fetch). | GET /api/platform/tenants/rcme returns 200. Inspect the JSON body. | — |
| 3 | In the Network response body, locate these fields. | All 10 commercial fields are present in the response: paybizOnboardingStatus, paybizWalletId, paymentsEnabled, platformFeePercent, platformFeeFixed, processingFeePercent, splitPercentBps, splitFixedCentavos, paybizUrlAttestationAt, paybizUrlAttestorId. | — |
| 4 | Click the Split Agreement tab. | TenantSplitAgreementConfig renders. Header reads "Split Agreement" / "Zeniark commercial cut (not member-facing)". The current-value line (data-testid="split-current-value") shows one of: "Current: N BPS (N.NN%)", "Current: ₱X,XXX.XX fixed", or "Pilot — 0% (default)". | — |
| 5 | Compare the displayed current value against the raw API's splitPercentBps/splitFixedCentavos from Step 2. | If splitPercentBps is non-null, the UI shows exactly that integer as BPS and (splitPercentBps / 100).toFixed(2)% — e.g. API 250 → UI "Current: 250 BPS (2.50%)". If both are null, UI shows "Pilot — 0% (default)". | — |
Data assertion: the UI value must be a byte-exact derivation of the raw API field, not a placeholder or a hardcoded default — if the API returns a non-null
splitFixedCentavos, the UI must NOT be showing "Pilot — 0% (default)".
Step 3: SUPER_ADMIN — confirm PayBiz attestation fields (ADM6-02)
| Step | Action | Expected Result | Test Value |
|---|---|---|---|
| 1 | On the same tenant detail page, click the PayBiz Config tab. | TenantPayBizConfig renders (inline mode). | — |
| 2 | Check the raw API response from Step 2.3 for paybizUrlAttestationAt and paybizUrlAttestorId. | If the tenant has already been attested (non-null paybizUrlAttestationAt), the PayBiz Config tab displays the attestation date and attestor label ("platform admin") near the URL guidance section. | — |
| 3 | If paybizUrlAttestationAt is null for this tenant, instead check onboarding status: if the tenant is being moved to APPROVED for the first time, the attestation checkbox (data-testid="paybiz-url-attestation-checkbox") is shown and must be checked before the first APPROVED transition can be saved. | Attestation checkbox visible and required only on the FIRST APPROVED transition — once attested, paybizUrlAttestationAt is set and the checkbox no longer appears on subsequent visits. | — |
Step 4: PLATFORM_SUPPORT — fields redacted from API response (ADM6-03)
This is a security-boundary assertion — verify via the raw network response, not just the UI. A field that's merely hidden in the UI but still present in the API payload is NOT compliant.
| Step | Action | Expected Result | Test Value |
|---|---|---|---|
| 1 | Log out of SUPER_ADMIN. Log in at https://stg-admin.membervu.com/login as the throwaway PLATFORM_SUPPORT user created in Step 1. | Login succeeds; admin portal dashboard loads (platform-wide nav, not org-level). | qa-admin006-support@example.com / QaSupport123! |
| 2 | Navigate to the rcme tenant detail page. Open DevTools Network tab and inspect GET /api/platform/tenants/rcme. | Response is 200 (PLATFORM_SUPPORT can read the tenant for nav purposes) but the JSON body does NOT contain ANY of the 10 commercial fields: paybizOnboardingStatus, paybizWalletId, paymentsEnabled, platformFeePercent, platformFeeFixed, processingFeePercent, splitPercentBps, splitFixedCentavos, paybizUrlAttestationAt, paybizUrlAttestorId. | — |
| 3 | Confirm the response STILL contains the non-commercial nav fields. | id, slug, name, description, appDomain, isActive, suspendedAt, createdAt, orgProfile are all present — redaction is scoped to commercial fields only, not the whole payload. | — |
Step 5: PLATFORM_SUPPORT — tabs absent in UI (ADM6-04)
| Step | Action | Expected Result | Test Value |
|---|---|---|---|
| 1 | Still logged in as PLATFORM_SUPPORT, look at the tab bar on the tenant detail page. | Only Overview and Events tabs are rendered. Platform Channels, PayBiz Config, and Split Agreement tabs do not appear at all in the DOM — not present-but-disabled. | — |
| 2 | Manually edit the URL to append ?tab=split (a stale/guessed deep link), e.g. https://stg-admin.membervu.com/tenants/<rcme-id>?tab=split. | The page does NOT render the Split Agreement tab content. It falls back to Overview (client-side redirect guard) rather than attempting to fetch SUPER_ADMIN-only data and erroring. | — |
| 3 | Confirm the Overview tab itself still renders correctly (General Information, Org Profile) for PLATFORM_SUPPORT. | Overview tab content loads normally — redaction/tab-hiding is scoped to commercial data only. | — |
Step 6: Platform finance overview — correct ₱ totals, reachable by both roles (ADM6-05)
| Step | Action | Expected Result | Test Value |
|---|---|---|---|
| 1 | Still logged in as PLATFORM_SUPPORT, navigate to Org Controls → /org-controls. Locate the billing/finance section. | Page loads without a 403 — GET /api/platform/billing/overview is reachable by PLATFORM_SUPPORT (this endpoint only requires requirePlatformSupport, i.e. SUPER_ADMIN OR PLATFORM_SUPPORT — it is NOT SUPER_ADMIN-gated like the split/attestation fields). | — |
| 2 | Note the summary cards: Organizations, Total Revenue, Outstanding, Overdue. Open DevTools Network and inspect the raw GET /api/platform/billing/overview response. | Response JSON has totals.totalRevenue and totals.outstanding as plain peso-denominated numbers (major units, i.e. already divided by 100 from amountCents — NOT raw cents). | — |
| 3 | Compare the UI's Total Revenue card text against the raw API's totals.totalRevenue. | UI shows ₱ followed by the exact value, formatted with the en-PH locale and exactly 2 decimal places (e.g. API 15000 → UI ₱15,000.00). No $ symbol anywhere (#493). | — |
| 4 | Scroll to the Per-Tenant table. Find the rcme row. | Row shows Organization (name + slug), Members, Statements (invoice count), Revenue, Outstanding, Overdue — all in ₱ where monetary. Sum the per-tenant Revenue column across all rows. | — |
| 5 | Compare the sum from Step 4 against the Total Revenue summary card. | The sum of per-tenant totalRevenue equals the platform-wide totals.totalRevenue exactly — no double-counting, no omitted tenant. | — |
| 6 | Log back in as SUPER_ADMIN and repeat step 1–2 on the same /org-controls page. | Same endpoint, same data — SUPER_ADMIN sees an identical (non-redacted) finance overview; this view is not part of the commercial-field redaction boundary. | — |
CLEANUP
- Deactivate or delete the throwaway
qa-admin006-support@example.comPLATFORM_SUPPORT user created in Step 1, if a deactivate/delete affordance exists on/users. If not available, note the account in your test log for the team. - No tenant data was mutated by this TC (read-only verification) — no invoice/split/attestation cleanup needed.
- Ensure you end the session logged back in as SUPER_ADMIN, not the throwaway support user.