MemberVu Manual E2E Testing Roadmap
Overview
A prioritized roadmap for manual E2E testing of the MemberVu membership management platform.
Existing Resources:
- 50+ test case files in
/tester-files/organized by module - Master test data:
/tester-files/00_MASTER_TEST_DATA.md - QA documentation:
/mmp/docs/qa/ - E2E Seed Script:
/mmp/auth-service/scripts/seed-rcme-sandbox.ts
Test Environment Setup
Prerequisites
- Docker Compose running (
docker compose up) - RCME seed data loaded (
docker exec membervu-backend npm run seed:rcme) - Access to test environment URLs:
- Frontend:
https://stg-app.membervu.com - Backend API:
https://stg-api.membervu.com - MailHog:
https://stg-mail.membervu.com
Test Users (12 accounts from seed-rcme-sandbox.ts)
Platform Administrator
| Role | Password | |
|---|---|---|
| Super Admin | superadmin@zeniark.com | SuperAdmin123! |
Organization Leadership
| Role | Password | |
|---|---|---|
| Admin | admin@rcme.membervu.com | Admin123! |
| Officer (Read-only) | officer@rcme.membervu.com | Officer123! |
| Finance Manager | treasurer@demo.membervu.com | Treasurer123! |
| Events Manager | events@demo.membervu.com | Events123! |
| Membership Manager | membershipchair@demo.membervu.com | Membership123! |
| Communications Manager | comms@demo.membervu.com | Comms123! |
Member Lifecycle
| Role | Password | Status | |
|---|---|---|---|
| Active Member | testmember@rcme.membervu.com | Member123! | ACTIVE |
| Guest | guest@demo.membervu.com | Guest123! | Guest user |
| Pending Applicant | pending@demo.membervu.com | Pending123! | PENDING_VERIFICATION |
| Pending Payment | pending-payment@demo.membervu.com | Payment123! | PENDING_PAYMENT |
| Expired Member | expired@demo.membervu.com | Expired123! | EXPIRED |
Test Tenant
| Field | Value |
|---|---|
| Slug | rcme |
| Name | Rotary Club of Manila Expats |
Environment Check
- [ ] Docker containers running (
docker ps) - [ ] Frontend loads at https://stg-app.membervu.com
- [ ] API responds at https://stg-api.membervu.com/api/health
- [ ] MailHog accessible at https://stg-mail.membervu.com
- [ ] Seed data loaded (12 users, 3 events, 5 invoices)
Phase 0: Platform Administration (Day 0)
Priority: PREREQUISITE - Must pass before any feature testing
0.1 Environment Health Check
Test Case: /tester-files/admin/TC_ADMIN_001_ENVIRONMENT.md
| # | Test Scenario | Priority |
|---|---|---|
| 1 | Frontend service accessible | P0 |
| 2 | Backend API health check | P0 |
| 3 | MailHog service accessible | P0 |
| 4 | All Docker containers running | P0 |
| 5 | Database connection working | P0 |
Pass Criteria: All services accessible
0.2 Tenant Configuration
Test Case: /tester-files/admin/TC_ADMIN_002_TENANT.md
| # | Test Scenario | Priority |
|---|---|---|
| 1 | rcme tenant exists | P0 |
| 2 | Feature flags enabled | P0 |
| 3 | Organization profile configured | P0 |
| 4 | Dues settings configured | P0 |
| 5 | Approval workflow configured | P0 |
| 6 | Membership types exist | P0 |
Pass Criteria: All tenant configuration verified
0.3 Test User Verification
Test Case: /tester-files/admin/TC_ADMIN_003_USERS.md
| # | Test Scenario | Test User | Priority |
|---|---|---|---|
| 1 | Super Admin login | superadmin@zeniark.com | P0 |
| 2 | Admin login | admin@rcme.membervu.com | P0 |
| 3 | Officer login | officer@rcme.membervu.com | P0 |
| 4 | Finance Manager login | treasurer@demo.membervu.com | P0 |
| 5 | Events Manager login | events@demo.membervu.com | P0 |
| 6 | Membership Manager login | membershipchair@demo.membervu.com | P0 |
| 7 | Communications Manager login | comms@demo.membervu.com | P0 |
| 8 | Active Member login | testmember@rcme.membervu.com | P0 |
| 9 | Guest login | guest@demo.membervu.com | P0 |
| 10 | Pending Applicant login | pending@demo.membervu.com | P0 |
| 11 | Pending Payment login | pending-payment@demo.membervu.com | P0 |
| 12 | Expired Member login | expired@demo.membervu.com | P0 |
Pass Criteria: All 12 users can authenticate
0.4 Role Permissions Verification
Test Case: /tester-files/admin/TC_ADMIN_004_PERMISSIONS.md
| # | Test Scenario | Priority |
|---|---|---|
| 1 | Super Admin has full access + tenant switcher | P0 |
| 2 | Admin has full org access | P0 |
| 3 | Officer has read-only access | P0 |
| 4 | Finance Manager has finance-only access | P0 |
| 5 | Events Manager has events-only access | P0 |
| 6 | Membership Manager has members-only access | P0 |
| 7 | Communications Manager has broadcasts-only access | P0 |
| 8 | Member cannot access admin pages | P0 |
| 9 | Guest has public-only access | P0 |
Pass Criteria: All role restrictions verified
0.5 Seed Data Verification
Test Case: /tester-files/admin/TC_ADMIN_005_SEED_DATA.md
| # | Test Scenario | Priority |
|---|---|---|
| 1 | 2 membership types exist | P0 |
| 2 | 3 test events exist | P0 |
| 3 | 5 test invoices exist | P0 |
| 4 | 12 member records exist | P0 |
| 5 | User-Member links valid | P0 |
Pass Criteria: All seed data verified
Phase 0B: Creation Tests - "From Scratch" Setup
Priority: P1 - Critical for validating first-time setup workflows
Key Difference from Phase 0A:
- Phase 0A uses pre-seeded data via
npm run seed:rcme - Phase 0B uses ONLY the pre-seeded Super Admin account
- Phase 0B simulates real-world first-time organization setup
0B.1 Create New Tenant
Test Case: /tester-files/admin/TC_ADMIN_006_TENANT_CREATE.md
| # | Test Scenario | Priority |
|---|---|---|
| 1 | Super Admin can access tenant management | P1 |
| 2 | Create tenant form displays | P1 |
| 3 | Tenant created with valid data | P1 |
| 4 | New tenant appears in list | P1 |
| 5 | New tenant accessible via switcher | P1 |
| 6 | Slug validation (duplicates rejected) | P1 |
Pass Criteria: New tenant created and accessible
0B.2 Configure New Tenant
Test Case: /tester-files/admin/TC_ADMIN_007_TENANT_CONFIG.md
| # | Test Scenario | Priority |
|---|---|---|
| 1 | Organization Profile configured | P1 |
| 2 | Feature Flags enabled | P1 |
| 3 | Dues Settings configured | P1 |
| 4 | Approval Workflow configured | P1 |
| 5 | Membership Types created | P1 |
| 6 | All settings persist after refresh | P1 |
Pass Criteria: All tenant configuration complete
0B.3 Create Admin User
Test Case: /tester-files/admin/TC_ADMIN_008_USER_CREATE.md
| # | Test Scenario | Priority |
|---|---|---|
| 1 | User creation form accessible | P1 |
| 2 | Admin user created successfully | P1 |
| 3 | Verification email sent (MailHog) | P1 |
| 4 | Email verification link works | P1 |
| 5 | New admin can login | P1 |
| 6 | New admin has correct permissions | P1 |
Pass Criteria: Admin user created, verified, and functional
0B.4 Create Member
Test Case: /tester-files/admin/TC_ADMIN_009_MEMBER_CREATE.md
| # | Test Scenario | Priority |
|---|---|---|
| 1 | Admin can access member management | P1 |
| 2 | Member creation form works | P1 |
| 3 | Member created with membership type | P1 |
| 4 | Member appears in directory | P1 |
| 5 | Dues invoice generated | P1 |
| 6 | Invoice amount matches membership type | P1 |
Pass Criteria: Member created with correct invoice
0B.5 End-to-End Onboarding
Test Case: /tester-files/admin/TC_ADMIN_010_ONBOARDING.md
| # | Test Scenario | Priority |
|---|---|---|
| 1 | Phase 1: Tenant created | P0 |
| 2 | Phase 2: Tenant fully configured | P0 |
| 3 | Phase 3: Admin user functional | P0 |
| 4 | Phase 4: Admin has full access | P0 |
| 5 | Phase 5: Members created with invoices | P0 |
| 6 | Phase 6: All users can login | P0 |
Pass Criteria: Complete first-time setup flow works end-to-end
0B.6 Edit Tenant
Test Case: /tester-files/admin/TC_ADMIN_011_TENANT_EDIT.md
| # | Test Scenario | Priority |
|---|---|---|
| 1 | Super Admin can access tenant management | P1 |
| 2 | Inline edit mode activates on click | P1 |
| 3 | Slug is read-only | P1 |
| 4 | Name and description editable and saved | P1 |
| 5 | Changes persist after page refresh | P1 |
Pass Criteria: Tenant name and description can be edited inline
0B.7 Tenant Switch (Super Admin)
Test Case: /tester-files/admin/TC_ADMIN_012_TENANT_SWITCH.md
| # | Test Scenario | Priority |
|---|---|---|
| 1 | Super Admin sees tenant dropdown in header | P1 |
| 2 | Switch tenant via dropdown updates all API data | P1 |
| 3 | Org Profile shows target tenant's data | P1 |
| 4 | Switched tenant persists on page refresh | P1 |
| 5 | "Switch & Configure" button works from Tenant Management | P1 |
| 6 | Regular admin gets CSS-only switch (no data change) | P1 |
Pass Criteria: Super Admin can switch between tenants with full data context change
Phase 1: Critical Path Testing (Days 1-3)
Priority: HIGHEST - Must pass before any release
1.1 Authentication Flow
Test Cases: /tester-files/auth/TC_AUTH_*.md
| # | Test Scenario | Test User | Priority | Test Case |
|---|---|---|---|---|
| 1 | Login with valid credentials | admin@rcme.membervu.com | P0 | TC_AUTH_001 |
| 2 | Login with invalid password | Any | P0 | TC_AUTH_001 |
| 3 | Login rate limiting (5 failed attempts) | Any | P0 | TC_AUTH_001 |
| 4 | Password reset flow | testmember@rcme.membervu.com | P0 | TC_AUTH_003 |
| 5 | Session timeout/expiry | Any | P1 | TC_AUTH_005 |
| 6 | Logout clears session | Any | P0 | TC_AUTH_005 |
Pass Criteria: All P0 tests pass
1.2 Member Registration & Verification
Test Cases: /tester-files/auth/TC_AUTH_002_REGISTRATION.md, /tester-files/membership/TC_MEM_004_APPROVAL.md
| # | Test Scenario | Test User | Priority | Test Case |
|---|---|---|---|---|
| 1 | New member registration | New email | P0 | TC_AUTH_002 |
| 2 | Email verification link works | Pending member | P0 | TC_AUTH_004 |
| 3 | Expired verification link rejected | Test with old link | P0 | TC_AUTH_004 |
| 4 | Duplicate email rejected | Existing email | P0 | TC_AUTH_002 |
| 5 | Member approval workflow | Admin approves pending@demo.membervu.com | P0 | TC_MEM_004 |
Pass Criteria: Full registration-to-approved flow works
1.3 Payment Processing
Test Cases: /tester-files/payments/TC_PAY_*.md
| # | Test Scenario | Test User | Priority | Test Case |
|---|---|---|---|---|
| 1 | Submit manual payment (Bank Transfer) | pending-payment@demo.membervu.com | P0 | TC_PAY_001 |
| 2 | Admin approves pending payment | treasurer@demo.membervu.com | P0 | TC_PAY_003 |
| 3 | Admin rejects payment | treasurer@demo.membervu.com | P0 | TC_PAY_003 |
| 4 | Payment allocates to invoice correctly | treasurer@demo.membervu.com | P0 | TC_PAY_003 |
| 5 | Partial payment handling | testmember@rcme.membervu.com | P1 | TC_PAY_001 |
| 6 | Payment gateway (TraxionPay) | testmember@rcme.membervu.com | P0 | TC_PAY_005 |
Pass Criteria: Money flows correctly, balances update
Phase 2: Core Feature Testing (Days 4-7)
Priority: HIGH - Core business functionality
2.1 Invoice Management
Test Cases: /tester-files/billing/TC_BIL_*.md
| # | Test Scenario | Test User | Priority | Test Case |
|---|---|---|---|---|
| 1 | Create manual invoice | treasurer@demo.membervu.com | P0 | TC_BIL_001 |
| 2 | View invoice list with filters | Any member | P0 | TC_BIL_002 |
| 3 | View invoice details | testmember@rcme.membervu.com (own) | P0 | TC_BIL_003 |
| 4 | Download invoice PDF | testmember@rcme.membervu.com | P1 | TC_BIL_003 |
| 5 | Void invoice | treasurer@demo.membervu.com | P1 | TC_BIL_004 |
| 6 | Invoice status transitions (DRAFT->ISSUED->PAID) | treasurer@demo.membervu.com | P0 | TC_BIL_004 |
| 7 | Overdue invoice identification | System | P1 | TC_BIL_002 |
| 8 | Export invoices to CSV | admin@rcme.membervu.com | P2 | TC_BIL_005 |
2.2 Event Management
Test Cases: /tester-files/events/TC_EVT_*.md
| # | Test Scenario | Test User | Priority | Test Case |
|---|---|---|---|---|
| 1 | Create new event (free) | events@demo.membervu.com | P0 | TC_EVT_004 |
| 2 | Create paid event with tickets | events@demo.membervu.com | P0 | TC_EVT_004 |
| 3 | Publish/unpublish event | events@demo.membervu.com | P0 | TC_EVT_004 |
| 4 | Register for free event | testmember@rcme.membervu.com | P0 | TC_EVT_002 |
| 5 | Register for paid event (creates invoice) | testmember@rcme.membervu.com | P0 | TC_EVT_003 |
| 6 | Cancel registration | testmember@rcme.membervu.com | P1 | TC_EVT_002 |
| 7 | Event capacity limit enforcement | Multiple users | P0 | TC_EVT_002 |
| 8 | Waitlist functionality | Member when full | P1 | TC_EVT_002 |
| 9 | Guest registration for event | guest@demo.membervu.com | P1 | TC_EVT_002 |
| 10 | Event check-in (QR code) | events@demo.membervu.com | P0 | TC_EVT_005 |
2.3 Membership Management
Test Cases: /tester-files/membership/TC_MEM_*.md
| # | Test Scenario | Test User | Priority | Test Case |
|---|---|---|---|---|
| 1 | View/edit own profile | testmember@rcme.membervu.com | P0 | TC_MEM_001 |
| 2 | Admin edits member profile | admin@rcme.membervu.com | P1 | TC_MEM_003 |
| 3 | Change membership type | membershipchair@demo.membervu.com | P1 | TC_MEM_003 |
| 4 | Suspend member | membershipchair@demo.membervu.com | P1 | TC_MEM_003 |
| 5 | Reactivate member | membershipchair@demo.membervu.com | P1 | TC_MEM_003 |
| 6 | Member directory search | testmember@rcme.membervu.com | P0 | TC_MEM_002 |
| 7 | Directory visibility settings | admin@rcme.membervu.com | P2 | TC_MEM_002 |
Phase 3: Role-Based Access Testing (Days 8-10)
Priority: HIGH - Security & Permissions
3.1 RBAC Verification
Test Cases: /tester-files/rbac/TC_RBAC_*.md
Test each role can ONLY access permitted features:
| Role | Can Access | Cannot Access |
|---|---|---|
| ADMIN | All features | N/A |
| FINANCE_MANAGER | Invoices, Payments, Financial Reports | Member management, Events |
| EVENT_MANAGER | Events, Registrations, Check-in | Invoices, Payments |
| MEMBERSHIP_MANAGER | Members, Applications, Directory | Payments, Events |
| MEMBER | Own profile, Events, Own invoices | Other members' data, Admin |
| GUEST | Public events only | Member-only content |
Test Matrix:
| Feature | Admin | Finance Mgr | Events Mgr | Membership Mgr | Member | Guest |
|---|---|---|---|---|---|---|
| Dashboard | ✓ | ✓ | ✓ | ✓ | ✓ | ✗ |
| All Members | ✓ | ✗ | ✗ | ✓ | ✗ | ✗ |
| All Invoices | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ |
| All Events | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ |
| Create Invoice | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ |
| Create Event | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ |
| Approve Member | ✓ | ✗ | ✗ | ✓ | ✗ | ✗ |
| Approve Payment | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ |
Test Method: Login as each role, attempt to access each feature, verify correct allow/deny.
Phase 4: Communication Testing (Days 11-13)
Priority: MEDIUM-HIGH - Core feature with gaps
4.1 Broadcast Campaigns
Test Cases: /tester-files/communications/TC_COMM_*.md
| # | Test Scenario | Test User | Priority | Test Case |
|---|---|---|---|---|
| 1 | Create broadcast (draft) | comms@demo.membervu.com | P0 | TC_COMM_001 |
| 2 | Edit draft broadcast | comms@demo.membervu.com | P1 | TC_COMM_001 |
| 3 | Delete draft broadcast | comms@demo.membervu.com | P1 | TC_COMM_001 |
| 4 | Send broadcast to all members | comms@demo.membervu.com | P0 | TC_COMM_001 |
| 5 | Send to segment (e.g., active only) | comms@demo.membervu.com | P1 | TC_COMM_002 |
| 6 | Verify email received (check MailHog) | N/A | P0 | TC_COMM_003 |
| 7 | Cannot edit sent broadcast | comms@demo.membervu.com | P1 | TC_COMM_001 |
4.2 Automated Notifications
| # | Test Scenario | Trigger | Priority |
|---|---|---|---|
| 1 | Welcome email on registration | New member signup | P0 |
| 2 | Email verification link | Registration | P0 |
| 3 | Password reset email | Forgot password | P0 |
| 4 | Event registration confirmation | Register for event | P0 |
| 5 | Invoice issued notification | Invoice created | P1 |
| 6 | Payment confirmation | Payment approved | P1 |
| 7 | Event reminder (7 days) | Scheduled job | P2 |
| 8 | Event reminder (1 day) | Scheduled job | P2 |
| 9 | Payment overdue reminder | Scheduled job | P2 |
Phase 5: Dues & Financial Reports (Days 14-16)
Priority: MEDIUM - Financial accuracy critical
5.1 Dues Management
Test Cases: /tester-files/dues/TC_DUES_*.md
| # | Test Scenario | Test User | Priority | Test Case |
|---|---|---|---|---|
| 1 | Configure dues settings | admin@rcme.membervu.com | P0 | TC_DUES_001 |
| 2 | Auto-generate dues invoices | System/Admin | P0 | TC_DUES_003 |
| 3 | Dues calculation by membership type | Verify amounts | P0 | TC_DUES_002 |
| 4 | Pro-rated dues for new members | New member | P1 | TC_DUES_002 |
| 5 | Dues renewal invoices | Annual cycle | P1 | TC_DUES_003 |
5.2 Financial Reporting
| # | Test Scenario | Test User | Priority |
|---|---|---|---|
| 1 | View financial summary | treasurer@demo.membervu.com | P0 |
| 2 | Payment report by date range | treasurer@demo.membervu.com | P1 |
| 3 | Outstanding balances report | treasurer@demo.membervu.com | P1 |
| 4 | Member statement generation | Member/Finance Manager | P1 |
| 5 | Export financial data | admin@rcme.membervu.com | P2 |
Phase 6: Edge Cases & Error Handling (Days 17-18)
Priority: MEDIUM - Robustness
6.1 Validation & Error Cases
| # | Test Scenario | Expected Result |
|---|---|---|
| 1 | Submit form with required fields empty | Validation errors shown |
| 2 | Enter invalid email format | Error message |
| 3 | Enter negative payment amount | Rejected |
| 4 | Upload oversized file (>10MB) | Error message |
| 5 | Upload invalid file type | Rejected |
| 6 | Access page without login | Redirect to login |
| 7 | Access other tenant's data (if multi-tenant) | 403 Forbidden |
6.2 Concurrency Scenarios
| # | Test Scenario | Expected Result |
|---|---|---|
| 1 | Two users register for last event spot | Only one succeeds |
| 2 | Two payments for same invoice simultaneously | No double-payment |
| 3 | Edit same record from two browsers | Last save wins or conflict shown |
Phase 2B: Homepage Dynamic Content (Days 7-9)
Priority: HIGH - Core member experience, all content previously hardcoded/empty
Reference: _bmad-output/planning-artifacts/prd-homepage-dynamic-content-2026-03-21.md
Admin Route: /admin/homepage (new page)
Member Surface: MemberHomePage.tsx — 7 components now data-driven
2B.1 President's Message
Test Case: /tester-files/01_TEST_CASES/homepage/TC_HP_001_PRESIDENTS_MESSAGE.md
| # | Test Scenario | Test User | Priority |
|---|---|---|---|
| 1 | Admin creates president's message | admin@rcme.membervu.com | P0 |
| 2 | Message displays on member homepage | testmember@rcme.membervu.com | P0 |
| 3 | Replacing message removes old one (one per tenant) | admin@rcme.membervu.com | P0 |
| 4 | Empty state: card hidden when no message set | testmember@rcme.membervu.com | P1 |
| 5 | Required field validation | admin@rcme.membervu.com | P1 |
Pass Criteria: Admin can create/replace; member sees it; card hidden when absent
2B.2 Announcements
Test Case: /tester-files/01_TEST_CASES/homepage/TC_HP_002_ANNOUNCEMENTS.md
| # | Test Scenario | Test User | Priority |
|---|---|---|---|
| 1 | Create announcement | admin@rcme.membervu.com | P0 |
| 2 | Announcements appear newest-first on homepage | testmember@rcme.membervu.com | P0 |
| 3 | Max 5 shown by default (pagination) | testmember@rcme.membervu.com | P1 |
| 4 | Edit and delete announcement | admin@rcme.membervu.com | P1 |
| 5 | Empty state handled gracefully | testmember@rcme.membervu.com | P1 |
Pass Criteria: Full CRUD works; ordering correct; 5-item limit enforced
2B.3 Upcoming Birthdays
Test Case: /tester-files/01_TEST_CASES/homepage/TC_HP_003_BIRTHDAYS.md
| # | Test Scenario | Test User | Priority |
|---|---|---|---|
| 1 | Members with DOB in next 30 days shown | testmember@rcme.membervu.com | P0 |
| 2 | Birth year NOT displayed (privacy) | testmember@rcme.membervu.com | P0 |
| 3 | Members with no DOB excluded | testmember@rcme.membervu.com | P0 |
| 4 | Birthday hero banner triggers on member's birthday | testmember@rcme.membervu.com | P1 |
| 5 | Members beyond 30-day window excluded | testmember@rcme.membervu.com | P1 |
Pass Criteria: DOB privacy preserved; hero banner triggers correctly; window respected
2B.4 Club Officers
Test Case: /tester-files/01_TEST_CASES/homepage/TC_HP_004_CLUB_OFFICERS.md
| # | Test Scenario | Test User | Priority |
|---|---|---|---|
| 1 | Admin adds officers | admin@rcme.membervu.com | P0 |
| 2 | Officers display sorted by sortOrder | testmember@rcme.membervu.com | P0 |
| 3 | Admin reorders officers | admin@rcme.membervu.com | P1 |
| 4 | Edit and delete officer | admin@rcme.membervu.com | P1 |
| 5 | Standalone (not tied to Member records) | admin@rcme.membervu.com | P1 |
Pass Criteria: Officers render in correct order; CRUD complete; standalone model confirmed
2B.5 Content Customization (Birthday, Guest Welcome, Pending Member)
Test Case: /tester-files/01_TEST_CASES/homepage/TC_HP_005_CONTENT_CUSTOMIZATION.md
| # | Test Scenario | Test User | Priority |
|---|---|---|---|
| 1 | Custom birthday banner message with {memberName} merge tag | admin + testmember | P0 |
| 2 | Custom guest welcome title/body with {orgName} merge tag | admin + guest@demo.membervu.com | P0 |
| 3 | Custom pending member message with {memberName} merge tag | admin + pending@demo.membervu.com | P1 |
| 4 | Reset to default clears custom value | admin@rcme.membervu.com | P1 |
| 5 | Null fields fall back to app-level defaults on GET | testmember@rcme.membervu.com | P1 |
Pass Criteria: Merge tags resolve; defaults apply when fields null; per-tenant isolation
2B.6 Security — HTML Sanitization & Tenant Isolation
Test Case: /tester-files/01_TEST_CASES/homepage/TC_HP_006_SECURITY.md
| # | Test Scenario | Priority |
|---|---|---|
| 1 | tag stripped from all rich text fields | P0 |
| 2 | on* event handlers stripped | P0 |
| 3 | Tenant A content NOT visible to tenant B | P0 |
| 4 | TenantId cannot be overridden via request body | P0 |
| 5 | Cross-tenant DELETE returns 404 (not 403) | P1 |
| 6 | Title 200-char limit and body 10,000-char limit enforced | P1 |
Pass Criteria: XSS vectors sanitized; full tenant isolation; size limits enforced
Phase 7: Guest Portal & Public Access (Days 19-20)
Priority: MEDIUM - Public-facing features
7.1 Guest Portal
Reference: /mmp/docs/qa/assessments/guest-lifecycle.md
| # | Test Scenario | Test User | Priority |
|---|---|---|---|
| 1 | View public events catalog | Unauthenticated | P0 |
| 2 | Guest registers for public event | guest@demo.membervu.com | P0 |
| 3 | Guest account created with password reset email | New guest email | P0 |
| 4 | Guest can login after setting password | guest@demo.membervu.com | P0 |
| 5 | Guest dashboard shows limited features | guest@demo.membervu.com | P1 |
| 6 | Guest converts to member (application) | guest@demo.membervu.com | P1 |
| 7 | Virtual link access (paid event, after payment) | Guest with paid ticket | P1 |
Regression Test Checklist
Run before each release:
Critical Flows (15 min)
- [ ] Login/Logout works
- [ ] Member can view dashboard
- [ ] Member can view own invoices
- [ ] Member can register for event
- [ ] Admin can create invoice
- [ ] Payment submission works
- [ ] Email notifications sending
Core Features (30 min)
- [ ] Full registration flow
- [ ] Full event registration flow
- [ ] Full payment flow (submit -> approve -> allocate)
- [ ] Broadcast send works
- [ ] RBAC enforced (test 2-3 role restrictions)
Milestone Testing (Post-Phase 7)
These test scenarios cover the M1-M4 milestones. M3 and M4 are implemented; M1 and M2 define acceptance criteria for future implementation.
M1: Admin Settings Access (Not Yet Implemented)
| # | Test Scenario | Test Case File | Priority |
|---|---|---|---|
| 1 | Admin Settings Hub shows 5 tenant setting cards | admin/TC_ADMIN_004_PERMISSIONS.md (TC_ADMIN_004j) | P1 |
| 2 | Platform Tools shows only 5 platform items | admin/TC_ADMIN_004_PERMISSIONS.md (TC_ADMIN_004k) | P1 |
| 3 | Feature Flags on Settings Hub, not Platform Tools | org/TC_ORG_003_FEATURE_FLAGS.md (TC-FF-090, TC-FF-091) | P1 |
| 4 | Payment Channels accessible to ADMIN | admin/TC_ADMIN_004_PERMISSIONS.md (TC_ADMIN_004m) | P1 |
M2: Tenant-Aware Formatting (Not Yet Implemented)
| # | Test Scenario | Test Case File | Priority |
|---|---|---|---|
| 1 | TenantFormatContext provides formatCurrency/formatDate | tenant/TC_TENANT_001_FORMATTING.md (TC-FMT-001 to 004) | P1 |
| 2 | Invoice/event amounts use tenant currency | tenant/TC_TENANT_001_FORMATTING.md (TC-FMT-010 to 014) | P1 |
| 3 | Event times use tenant timezone | tenant/TC_TENANT_001_FORMATTING.md (TC-FMT-020 to 022) | P1 |
| 4 | No hardcoded PHP/Manila in components | tenant/TC_TENANT_001_FORMATTING.md (TC-FMT-030, 031) | P2 |
| 5 | RCME backward compatibility | tenant/TC_TENANT_001_FORMATTING.md (TC-FMT-040) | P0 |
M3: Organization Branding Consistency (Implemented)
| # | Test Scenario | Test Case File | E2E Spec |
|---|---|---|---|
| 1 | Branding tab with color picker | org/TC_ORG_002_BRANDING.md (TC-BRAND-032 to 034) | TC_M3_001_*.spec.ts |
| 2 | CSS variable injection | org/TC_ORG_002_BRANDING.md (TC-BRAND-036) | TC_M3_002_*.spec.ts |
| 3 | Dashboard greeting uses org name | org/TC_ORG_002_BRANDING.md (TC-BRAND-039) | TC_M3_003_*.spec.ts |
| 4 | Email sign-off uses org name | org/TC_ORG_002_BRANDING.md (TC-BRAND-040) | — |
| 5 | Color utility functions | org/TC_ORG_002_BRANDING.md (TC-BRAND-041) | Vitest |
Existing E2E: 7 tests in playwright-e2e/tests/m3/ (all passing)
Existing Vitest: 31 unit tests (colorUtils, branding, tenant-format-context)
M4: Multi-Domain Tenant Resolution (Implemented)
| # | Test Scenario | Test Case File | E2E Spec |
|---|---|---|---|
| 1 | Path-based resolution (/rcme/login) | tenant/TC_TENANT_002_RESOLUTION.md (TC-RES-001 to 004) | TC_M4_001_*.spec.ts |
| 2 | Bare route backward compatibility | tenant/TC_TENANT_002_RESOLUTION.md (TC-RES-010 to 012) | TC_M4_001_*.spec.ts |
| 3 | Invalid tenant shows 404 | tenant/TC_TENANT_002_RESOLUTION.md (TC-RES-020) | TC_M4_001_*.spec.ts |
| 4 | Tenant-scoped login (full flow) | auth/TC_AUTH_001_LOGIN.md (TC-LOG-07 to 12) | TC_M4_001_*.spec.ts |
| 5 | Tenant-scoped registration | auth/TC_AUTH_002_REGISTRATION.md (TC-REG-07 to 09) | — |
| 6 | Resolution waterfall priority | tenant/TC_TENANT_002_RESOLUTION.md (TC-RES-060) | Unit tests |
Existing E2E: 11 tests in playwright-e2e/tests/m4/ (all passing)
Existing Unit Tests: 23 tests (tenant-resolver.test.ts, tenant-context.test.tsx)
Known Gaps to Test (from QA Assessments)
These areas need extra attention:
- Donations end-to-end flow -
/mmp/docs/qa/assessments/donations-test-plan.md - Payment reminders -
/mmp/docs/qa/assessments/payment-reminders-test-plan.md - Event admin actions - Clone, unpublish, slug update
- S3 storage uploads - Avatar, logos, attachments
- Virtual link protection - Requires confirmed + paid registration
- Homepage Dynamic Content - See Phase 2B (added 2026-03-23, PRD dated 2026-03-21)
File Reference
| Resource | Path |
|---|---|
| Master Test Data | /tester-files/00_MASTER_TEST_DATA.md |
| Platform Admin Tests (Verification) | /tester-files/admin/TC_ADMIN_001-005_*.md |
| Platform Admin Tests (Creation) | /tester-files/admin/TC_ADMIN_006-012_*.md |
| Auth Tests | /tester-files/auth/TC_AUTH_*.md |
| Billing Tests | /tester-files/billing/TC_BIL_*.md |
| Communications Tests | /tester-files/communications/TC_COMM_*.md |
| Dues Tests | /tester-files/dues/TC_DUES_*.md |
| Events Tests | /tester-files/events/TC_EVT_*.md |
| Membership Tests | /tester-files/membership/TC_MEM_*.md |
| Payments Tests | /tester-files/payments/TC_PAY_*.md |
| RBAC Tests | /tester-files/rbac/TC_RBAC_*.md |
| QA Assessments | /mmp/docs/qa/assessments/ |
| Guest Lifecycle | /mmp/docs/qa/assessments/guest-lifecycle.md |
| RCME Seed Script | /mmp/auth-service/scripts/seed-rcme-sandbox.ts |
Homepage Content Test Files (Phase 2B — Added 2026-03-23)
| Test Case | File | Purpose |
|---|---|---|
| TEST_PLAN_HOMEPAGE | homepage/TEST_PLAN_HOMEPAGE.md | Strategy & scope for homepage content module |
| TC_HP_001 | homepage/TC_HP_001_PRESIDENTS_MESSAGE.md | President's message admin CRUD + rendering |
| TC_HP_002 | homepage/TC_HP_002_ANNOUNCEMENTS.md | Announcements CRUD + ordering + pagination |
| TC_HP_003 | homepage/TC_HP_003_BIRTHDAYS.md | Birthday data, privacy, hero banner trigger |
| TC_HP_004 | homepage/TC_HP_004_CLUB_OFFICERS.md | Officers CRUD + reorder |
| TC_HP_005 | homepage/TC_HP_005_CONTENT_CUSTOMIZATION.md | Customizable messages + merge tags |
| TC_HP_006 | homepage/TC_HP_006_SECURITY.md | HTML sanitization + tenant isolation + size limits |
Phase 0B Test Files (Creation/Setup Tests)
| Test Case | File | Purpose |
|---|---|---|
| TC_ADMIN_006 | TC_ADMIN_006_TENANT_CREATE.md | Create new tenant |
| TC_ADMIN_007 | TC_ADMIN_007_TENANT_CONFIG.md | Configure tenant settings |
| TC_ADMIN_008 | TC_ADMIN_008_USER_CREATE.md | Create admin user |
| TC_ADMIN_009 | TC_ADMIN_009_MEMBER_CREATE.md | Create member via admin |
| TC_ADMIN_010 | TC_ADMIN_010_ONBOARDING.md | Complete onboarding flow |
| TC_ADMIN_011 | TC_ADMIN_011_TENANT_EDIT.md | Edit tenant (inline) |
| TC_ADMIN_012 | TC_ADMIN_012_TENANT_SWITCH.md | Switch tenant (Super Admin) |