Step-by-Step Guide — Follow each step exactly as written. All values are provided — do not improvise.
TC-RBAC-003: Multi-Role & Edge Cases (Detailed)
Module: RBAC - Multi-Role Assignment & Edge Cases
Admin User: admin@rcme.membervu.com / Admin123!
Test Member: testmember@rcme.membervu.com / Member123! (Maria Cruz)
SuperAdmin: superadmin@zeniark.com / SuperAdmin123!
URLs for this test:
Org Portal:
Admin Portal (SuperAdmin only):
Org Portal:
https://stg-rcme.membervu.com/loginAdmin Portal (SuperAdmin only):
https://stg-admin.membervu.com
Step 1: Assign Multiple Roles to a Member
Purpose: verify a member with multiple roles gets the union of their permissions. Roles are assigned via the Manage Roles modal (built-in staff roles only).
| Step | Action (EXACT clicks/typing) | Expected Result (EXACT text/behavior) | Test Value |
|---|---|---|---|
| 1 | Log in as admin (admin@rcme.membervu.com / Admin123!). Skip any tour. | Dashboard loads. | - |
| 2 | Sidebar Members → All Members. Click Maria Cruz to open her detail panel. Click "Actions ▾" → "Manage Roles". | "Manage Roles" modal opens; current roles chip shows "MEMBER". | - |
| 3 | Check "Officer" (OFFICER) and "Events Manager" (EVENT_MANAGER). Click "Save Roles". | Modal closes. Calls PUT /api/membership/members/:id/roles with ["OFFICER","EVENT_MANAGER"] (MEMBER auto-retained). Chips now show MEMBER, OFFICER, EVENT_MANAGER. | Roles: OFFICER, EVENT_MANAGER |
| 4 | Log out. Log in as Maria Cruz (testmember@rcme.membervu.com / Member123!). | Login succeeds. | - |
| 5 | Inspect the sidebar. | Combined access: Overview; Members (All Members + Prospects); Events (All Events, Create Event, Guests, Check-in); Communications (Broadcasts); plus her member items (Directory, My Account). | - |
| 6 | Open Events → All Events (admin), then her My Account. | Both work — admin event management AND member features coexist. | - |
PASS if: Maria has the union of MEMBER + OFFICER + EVENT_MANAGER access (events admin + members + broadcasts + member features).
Step 2: Remove the Extra Roles (Restore Original)
| Step | Action (EXACT clicks/typing) | Expected Result (EXACT text/behavior) | Test Value |
|---|---|---|---|
| 1 | Log out. Log in as admin. All Members → Maria Cruz → Actions ▾ → Manage Roles. Uncheck Officer and Events Manager. Click "Save Roles". | Maria has only MEMBER again. | - |
| 2 | Log out. Log in as Maria Cruz. Inspect the sidebar. | Only member items remain; all admin groups gone. (If admin items linger, role changes need re-login / token refresh — the permission cache TTL is 5 minutes.) | - |
PASS if: Access reverts to MEMBER-only after the roles are removed.
Step 3: SuperAdmin Platform Access (Admin Portal)
SKIP if: the admin portal (
https://stg-admin.membervu.com) is not deployed to staging. Mark SKIPPED — admin portal not available.
IMPORTANT: SuperAdmin authenticates through a separate flow (
POST /api/auth/platform/login) and uses the admin portal, not the org PWA. Its JWT has tenantId: null + platformRoles: ["SUPER_ADMIN"]. Don't drive tenant-scoped org work as SuperAdmin in the org PWA — tenant-scoped API calls can return 401 because the token carries no tenant claim.
| Step | Action (EXACT clicks/typing) | Expected Result (EXACT text/behavior) | Test Value |
|---|---|---|---|
| 1 | Open a new tab → https://stg-admin.membervu.com. Email: superadmin@zeniark.com, Password: SuperAdmin123!. Click "Sign In". | Admin portal dashboard loads (platform management tools). | superadmin@zeniark.com / SuperAdmin123! |
| 2 | Open the "Tenants" section. | Tenant list loads — e.g. rcme, acme-corporation, test-org, e2e-test. | - |
| 3 | Open a tenant (e.g. acme-corporation) to view its detail. | Tenant detail loads. | acme-corporation |
| 4 | Open "Users" (platform users) and "Org Controls". | Both load — platform-level user management + org controls. | - |
PASS if: SuperAdmin can view all tenants + platform users via the admin portal.
Step 4: Role Change Propagation (Edge Case)
Expectation: permission/role changes are picked up after token refresh or re-login, or once the 5-minute permission cache expires — not necessarily on a plain page refresh while the same JWT is in use.
| Step | Action (EXACT clicks/typing) | Expected Result (EXACT text/behavior) | Test Value |
|---|---|---|---|
| 1 | Browser 1 (admin): assign Officer to Maria via Manage Roles. Save. | OFFICER assigned. | - |
| 2 | Browser 2 (incognito): log in as Maria Cruz. Confirm OFFICER-related items (e.g. All Members, Directory) appear. | Officer access visible. | - |
| 3 | Browser 1: remove Officer from Maria. Save. | OFFICER removed in DB. | - |
| 4 | Browser 2: log out and log back in (forces a fresh token). | After re-login, OFFICER access is gone. Document whether a plain refresh alone was sufficient. | - |
PASS if: Role removal takes effect after re-login / cache expiry (document the exact trigger observed).
CLEANUP
Ensure:
- Maria Cruz has ONLY her original MEMBER role.
- No extra roles (OFFICER, EVENT_MANAGER) remain assigned.