Test cases: Admin backend

Document control

Version	Date (UTC)	Summary
1.0.0	2026-05-13	Initial catalogue keyed to admin module layout
1.1.0	2026-05-13	Split deep scenarios to catalog + B2B orders sheets; this page = cross-cutting only
1.2.0	2026-05-13	Pagination defaults, optimistic concurrency headers, bulk id caps

---

Scope

• HTTP: auth/admin/*, admin/* after /api/v1 (Backend modules).
• Deep dives (use these for release QA):
  • Admin catalog & products
  • Admin B2B orders

---

Scenario catalogue (cross-cutting)

ID	Class	Scenario	Automation
TC-ADM-001	Happy	Master admin (modules === null) lists stores in any zone	Unit
TC-ADM-002	Unhappy	Zoned admin requests store outside zone → 403	Unit
TC-ADM-003	Unhappy	Role missing module key → 403 on matching controller	Unit
TC-ADM-004	Happy	assertStoreAllowedForAdmin allows in-zone store for write	Unit
TC-ADM-005	Unhappy	Global ValidationPipe: malformed JSON → 400	Unit
TC-ADM-006	Happy	Soft-delete filters consistent on list endpoints when deleted filter used	Unit
TC-ADM-007	Unhappy	SQL injection attempts in search DTOs sanitized → safe query or 400	Unit
TC-ADM-008	Happy	Cursor / offset pagination: page + limit clamped to max server cap	Unit
TC-ADM-009	Unhappy	Batch body ids.length over cap → 400 with stable error code	Unit
TC-ADM-010	Happy	If-Match / version column optimistic update returns 409 on stale write	Unit
TC-ADM-011	Unhappy	Admin JWT aud / issuer mismatch → 401 on all admin/*	Unit
TC-ADM-012	Happy	File upload endpoints enforce MIME + size limits at pipe	Unit

---

Coverage checklist (this sheet)

• New admin-* controller groups add a pointer row here OR a link row in the right deep sheet
• Zone + module matrix updated when new admin features ship
• No duplicate TC ids between this file and Admin catalog / Admin B2B orders

Parent index: System test cases (index)