Test cases: Admin organization & RBAC

Document control

Version	Date (UTC)	Summary
1.0.0	2026-05-13	Initial sheet — routes under dashboard for org + access control

---

Scope

• App: apps/admin-web — ADMIN_ROUTES for managers, stores, vendors, roles, modules, marketing banners, settings, profile (Frontend applications).
• API pairing: Admin backend (zones, modules, JWT).
• Not in this sheet: catalog products, B2B orders, membership billing, client events, support tickets, notifications (System test cases index).

---

Scenario catalogue

Managers (platform staff)

ID	Class	Scenario	Automation
TC-AOR-001	Happy	Managers list loads with pagination + search	E2E*
TC-AOR-002	Happy	Create manager → form validation (RHF + Zod) → success toast	E2E*
TC-AOR-003	Happy	Manager detail shows identity + role links	E2E*
TC-AOR-004	Unhappy	Duplicate email / invalid phone → field errors, no silent 500	E2E*
TC-AOR-005	Unhappy	Non-master hits manager write route without module → 403 UI	E2E*

Stores & vendors (tenancy)

ID	Class	Scenario	Automation
TC-AOR-010	Happy	Stores list respects zone filter; KPI or counts consistent	E2E*
TC-AOR-011	Happy	Store detail ?create=1 / ?edit=1 legacy redirects resolve	E2E*
TC-AOR-012	Unhappy	Zoned admin opens store outside zone → 403 or empty guarded state	E2E*
TC-AOR-013	Happy	Vendors list + search + pagination	E2E*
TC-AOR-014	Happy	Vendor create/edit form submits; assign-package flow when present	E2E*
TC-AOR-015	Unhappy	Delete store/vendor blocked when entity delete guards apply → actionable message	E2E*

Roles & modules

ID	Class	Scenario	Automation
TC-AOR-020	Happy	Roles list + create role → permission matrix saved	E2E*
TC-AOR-021	Happy	Role detail shows assigned managers count / links	E2E*
TC-AOR-022	Unhappy	Delete role still assigned → API error mapped to toast	E2E*
TC-AOR-023	Happy	Modules directory lists modules; detail page loads	E2E*
TC-AOR-024	Unhappy	Deep link to module without access → 403 shell	E2E*

Marketing, settings, profile

ID	Class	Scenario	Automation
TC-AOR-030	Happy	Marketing banners list CRUD (create, toggle, reorder if supported)	E2E*
TC-AOR-031	Unhappy	Invalid image URL or oversize asset → validation before save	E2E*
TC-AOR-032	Happy	Settings page loads; save changes refetches session where needed	E2E*
TC-AOR-033	Happy	Profile page: update display fields	E2E*
TC-AOR-034	Unhappy	Profile password change wrong current password → error	E2E*

---

Coverage checklist (this sheet)

• Each new ADMIN_ROUTES.* screen under org/RBAC has a TC-AOR- row or a child sheet
• Zone matrix from Admin backend kept in sync when store/vendor APIs change
• Align with Auth & public for password / OTP flows touching profile

Parent index: System test cases (index)