🆕 New on stage — 2026-06-19 → 2026-06-29. This TC covers three features shipped after the prior guide freeze: the guest profile's "Guest" type label (#368), the guest roster's server-side CSV export with formula-injection guard (#340), and PII redaction on the guest-registration roster response (#486). See the Test Plan banners and the Jun 19 / Jun 29 release notes.
Module: Guest Portal — Data Handling & Security
Primary Test Users: guest@demo.membervu.com / Guest123! (Guest) · admin@rcme.membervu.com / Admin123! (Admin, privileged) · events@demo.membervu.com / Events123! (Events Manager, privileged) · testmember@rcme.membervu.com / Member123! (Member, non-privileged for #486)
Priority: P1 (security-adjacent — #486 is a PII-exposure fix, #340 is a formula-injection fix)
Objectives
- Log in as the seeded guest and confirm the profile card's TYPE row displays exactly "Guest" — not blank, not "Member".
- As an admin, export the guest roster and confirm the download comes from the server endpoint (
GET /api/admin/guests/export.csv), not a client-assembled blob. - Confirm a CSV cell whose source value starts with
=(or+/-/@) is neutralized with a leading'in the exported file — it does not execute as a formula when opened in a spreadsheet app. - Confirm a non-privileged caller's view of the event guest-registration roster omits
invitedBy.email, attendee/member/guest emails,checkInCode,displayTicketCode, and theinvoicesub-object for rows that are not their own — while a privileged caller (or the row's own owner) still sees the full data.
Scenario summary
| ID | Scenario | Key data assertion |
|---|---|---|
| GUEST3-01 | Guest profile card shows "Guest" type | Login as guest@demo.membervu.com → dashboard's Profile Card TYPE row renders the exact text "Guest" (not empty, not "Member"). |
| GUEST3-02 | Admin guest export is server-side | Clicking "Export CSV" on /admin/guests triggers a network request to GET /api/admin/guests/export.csv that returns Content-Type: text/csv and a Content-Disposition: attachment header — no client-side CSV string assembly in the page's JS. |
| GUEST3-03 | Formula-injection guard on export | A guest record with a name/email starting with = produces a CSV cell of the literal form "'=..." (leading single-quote inside the quoted cell) — opening in Excel/Sheets shows it as text, not a formula. |
| GUEST3-04 | Non-privileged roster view redacts PII | As a plain MEMBER with no EVENTS:VIEW:registrations, GET /api/events/:eventId/registrations/guests response rows for OTHER attendees/guests have attendeeEmail/memberEmail/guestEmail/checkInCode/displayTicketCode absent and invoice: null; the caller's own row keeps them. |
| GUEST3-05 | Inviter email redacted for non-privileged | Same non-privileged call: a GUEST row's invitedBy object keeps id/firstName/lastName but has NO email property. |
| GUEST3-06 | Privileged caller sees full roster | As Events Manager (EVENTS:VIEW:registrations), every row — including other attendees' and guests' — has checkInCode, emails, displayTicketCode, invoice, and invitedBy.email populated. |
➡️ Full click-by-click steps: TC-GUEST-003 (Detailed).