Test cases: Auth & public
Nội dung này hiện chưa có sẵn bằng ngôn ngữ của bạn.
Document control
Section titled “Document control”| Version | Date (UTC) | Summary |
|---|---|---|
| 1.0.0 | 2026-05-13 | Initial scenario table + automation hints |
| 1.1.0 | 2026-05-13 | MFA, lockout, refresh rotation, vendor context edge cases |
- Backend:
apps/backend/src/modules/auth, JWT issuance for customer/admin/vendor (Authentication). - Public:
public/*landing settings (throttled).
Scenario catalogue
Section titled “Scenario catalogue”Customer & shared auth
Section titled “Customer & shared auth”| ID | Class | Scenario | Automation |
|---|---|---|---|
| TC-AUTH-001 | Happy | Customer sign-in with valid credentials returns token envelope | E2E* |
| TC-AUTH-002 | Unhappy | Invalid password → 401, no sensitive hint which field failed | Unit + E2E* |
| TC-AUTH-003 | Unhappy | Locked / disabled account per policy | Unit |
| TC-AUTH-004 | Unhappy | Rate limit on login endpoint → 429 | Unit |
Admin auth
Section titled “Admin auth”| ID | Class | Scenario | Automation |
|---|---|---|---|
| TC-AUTH-010 | Happy | Admin sign-in valid creds; JWT includes modules or null master | E2E* |
| TC-AUTH-011 | Unhappy | Admin MFA required: challenge step before token (if enabled) | E2E* |
| TC-AUTH-012 | Unhappy | Wrong modules still issues JWT but catalog APIs 403 — document UX | Unit |
Vendor auth & context
Section titled “Vendor auth & context”| ID | Class | Scenario | Automation |
|---|---|---|---|
| TC-AUTH-020 | Happy | Vendor login + GET auth/vendor/context resolves stores and prefs | Unit + E2E* |
| TC-AUTH-021 | Happy | Refresh token rotation; old refresh invalidated | Unit |
| TC-AUTH-022 | Unhappy | Expired refresh → 401; client forces re-login | Unit + E2E* |
| TC-AUTH-023 | Unhappy | Employee removed mid-session → next API 403 | Unit |
| TC-AUTH-024 | Unhappy | Vendor suspended → login or refresh denied | Unit |
Public landing
Section titled “Public landing”| ID | Class | Scenario | Automation |
|---|---|---|---|
| TC-PUB-001 | Happy | GET …/public/landing-settings returns JSON within throttle budget | E2E* |
| TC-PUB-002 | Unhappy | Throttle exceeded → 429 | Manual / load |
Coverage checklist (this sheet)
Section titled “Coverage checklist (this sheet)”- OAuth / SSO (if added) gets new TC block with happy + unhappy
- Password reset / OTP flows aligned with Vendor auth and admin equivalent
- Security review: no tokens in URL logs, HTTPS-only cookies documented
Parent index: System test cases (index)