Step-by-Step Guide — Follow each step exactly as written. All values are provided — do not improvise.
TC-RBAC-001: Role Management (Detailed)
Module: RBAC - Role Management
Primary Test User: admin@rcme.membervu.com / Admin123! (Admin)
Secondary Test User: testmember@rcme.membervu.com / Member123! (Member — Maria Cruz)
URL for this test:
Org Portal:
Org Portal:
https://stg-rcme.membervu.com/login
IMPORTANT — how to reach Roles & Permissions: there is no direct sidebar link. You open it via sidebar Settings → the "Roles & Permissions" card. Role names may be truncated by CSS — identify roles by their code (e.g.
FINANCE_MANAGER) shown in monospace.
Step 1: Log in and Open the Roles & Permissions Page
| Step | Action (EXACT clicks/typing) | Expected Result (EXACT text/behavior) | Test Value |
|---|---|---|---|
| 1 | Go to https://stg-rcme.membervu.com/login. Email: admin@rcme.membervu.com, Password: Admin123!. Click "Sign In". | Login succeeds. Dashboard loads. | admin@rcme.membervu.com / Admin123! |
| 2 | If a tour overlay appears, click "Skip". | Tour dismissed. | - |
| 3 | In the left sidebar (Organization group), click "Settings". | Settings hub (/admin/settings) loads, showing setting cards. | - |
| 4 | Click the "Roles & Permissions" card. | The Roles & Permissions page (/admin/roles) loads: a left "Roles" list panel + a right detail panel. | - |
| 5 | In the left panel, confirm the two section headers "System Roles" and "Custom Roles", and that all 10 system roles appear with a "System" lock badge. | ADMIN, OFFICER, FINANCE_MANAGER, EVENT_MANAGER, MEMBERSHIP_MANAGER, COMMUNICATIONS_MANAGER, MEMBER, PENDING_MEMBER, EXPIRED_MEMBER, GUEST. | - |
PASS if: All 10 system roles are listed under "System Roles" with lock badges.
Step 2: Create a Custom Role
Purpose: create a custom role. (Permissions are added in Step 3 — the create modal has no permission picker.)
| Step | Action (EXACT clicks/typing) | Expected Result (EXACT text/behavior) | Test Value |
|---|---|---|---|
| 1 | In the left panel header, click "New Role". | "Create New Role" modal opens. | - |
| 2 | In Role Name, type: QA Test Finance Viewer | The Role Code field auto-fills to QA_TEST_FINANCE_VIEWER. | QA Test Finance Viewer |
| 3 | In Description, type: Read-only finance access (QA). Pick any Colour. | Values set. | - |
| 4 | Click "Create Role". | Toast "Role created successfully". The new role is auto-selected and appears under "Custom Roles" with 0 of 38 permissions granted. | - |
PASS if: "QA Test Finance Viewer" (code QA_TEST_FINANCE_VIEWER) appears under Custom Roles with no permissions.
Step 3: Grant Permissions to the Custom Role
Purpose: grant read-only finance permissions using the permission matrix (these are FINANCE:VIEW:* permissions, not dot-notation).
| Step | Action (EXACT clicks/typing) | Expected Result (EXACT text/behavior) | Test Value |
|---|---|---|---|
| 1 | With "QA Test Finance Viewer" selected, in the right panel click the "Finance" module tab. | The Finance permission matrix appears: rows = dashboard, invoices, payments, dues, donations, bank-accounts; columns = View / Create / Edit / Delete. | - |
| 2 | Check the View box on these rows: dashboard, invoices, payments. | Three checkboxes turn blue. A "Save Changes" button appears at the top-right of the detail header. | FINANCE:VIEW:dashboard, FINANCE:VIEW:invoices, FINANCE:VIEW:payments |
| 3 | Click "Save Changes". | Button shows "Saving…" then disappears. (Calls PUT /api/admin/roles/:roleId/permissions.) The role now shows "3 permissions". | - |
PASS if: The custom role has exactly the 3 Finance VIEW permissions and the change persists on reload.
Step 4: Duplicate a Role
| Step | Action (EXACT clicks/typing) | Expected Result (EXACT text/behavior) | Test Value |
|---|---|---|---|
| 1 | Hover the EVENT_MANAGER row → click the ⋮ menu → "Duplicate" (or use the copy icon in its detail header). | "Duplicate Role" modal opens with Name "Events Manager (Copy)" and Code EVENT_MANAGER_COPY. | - |
| 2 | Change Name to QA Event Coordinator (code auto-updates). Click "Duplicate Role". | Toast "Role duplicated successfully". New custom role created with EVENT_MANAGER's permissions copied. | QA Event Coordinator |
PASS if: "QA Event Coordinator" appears under Custom Roles with the same permissions as Events Manager.
Step 5: Assign a Role to a Member (built-in role)
KNOWN LIMITATION: The member "Manage Roles" modal only offers the 6 built-in staff roles (Administrator, Officer, Treasurer, Events Manager, Membership Manager, Communications). Custom roles cannot be assigned to a member through the UI — only via the API (
PUT /api/membership/members/:id/roles). This step therefore assigns a built-in role.
| Step | Action (EXACT clicks/typing) | Expected Result (EXACT text/behavior) | Test Value |
|---|---|---|---|
| 1 | In the sidebar (Members group), click "All Members" (/admin/members). Click Maria Cruz (testmember@rcme.membervu.com) in the list. | Her detail panel opens on the right. | - |
| 2 | In the detail header, click "Actions ▾" → "Manage Roles". | "Manage Roles" modal opens with 6 role cards + a "Current roles:" chip row showing "MEMBER". | - |
| 3 | Check "Treasurer" (FINANCE_MANAGER). Click "Save Roles". | Modal closes; member chips update. (Calls PUT /api/membership/members/:id/roles with ["FINANCE_MANAGER"]; MEMBER auto-retained.) | FINANCE_MANAGER |
| 4 | Log out. Log in as Maria Cruz (testmember@rcme.membervu.com / Member123!). | Login succeeds. | - |
| 5 | Check the sidebar. | Maria now sees the Finance group items (Dashboard, Invoices, Payments) from the FINANCE_MANAGER role, in addition to her member items. | - |
PASS if: Maria Cruz gained Finance access after being assigned FINANCE_MANAGER via the Manage Roles modal.
Step 6: Remove the Role from the Member
| Step | Action (EXACT clicks/typing) | Expected Result (EXACT text/behavior) | Test Value |
|---|---|---|---|
| 1 | Log out. Log back in as admin. Go to All Members → Maria Cruz → Actions ▾ → Manage Roles. Uncheck "Treasurer". Click "Save Roles". | Maria has only MEMBER again. | - |
| 2 | Log out. Log in as Maria Cruz. Check the sidebar. | Finance items are gone — only member items remain. (If they persist, role changes require token refresh / re-login — note it; the permission cache TTL is 5 minutes.) | - |
PASS if: Finance access removed after un-assigning the role (allowing for re-login).
Step 7: Delete the Custom Roles
| Step | Action (EXACT clicks/typing) | Expected Result (EXACT text/behavior) | Test Value |
|---|---|---|---|
| 1 | As admin, open Settings → Roles & Permissions. Select "QA Test Finance Viewer". Click the trash icon (or ⋮ → Delete). | "Delete Role" modal. As it has no assigned users, the Delete button is enabled. | - |
| 2 | Click "Delete Role". Repeat for "QA Event Coordinator". | Toast "Role deleted successfully" each time; both removed from the list. | - |
Step 8: Verify System Roles Cannot Be Deleted
| Step | Action (EXACT clicks/typing) | Expected Result (EXACT text/behavior) | Test Value |
|---|---|---|---|
| 1 | Select the ADMIN role. Look for a delete/trash button in the detail header, and hover the row to open its ⋮ menu. | There is no Delete option — the trash button is absent and the ⋮ menu offers only "Duplicate". | - |
| 2 | Repeat for MEMBER and FINANCE_MANAGER. | Same — no delete option for any system role. | - |
PASS if: No system role exposes a delete control.
CLEANUP
Ensure:
- Maria Cruz has ONLY her original MEMBER role (no FINANCE_MANAGER).
- Custom roles "QA Test Finance Viewer" and "QA Event Coordinator" have been deleted.