iDarms Agent — Authentication Acceptance Tests¶
Test series: IDA-AUTH-01 to IDA-AUTH-07
Objective: Validate that a provisioned agent can sign in with email/password, recover a forgotten password through phone or email OTP, maintain a valid session across app restarts, and sign out cleanly.
Execution ownership¶
Recommended owners: Field Agent / iDarms Agent app users; Back Office observer
Prerequisites: A back-office-provisioned agent account with a known email and password; access to the registered phone/email to receive OTPs; a second account with an intentionally incorrect password for negative testing.
Execution control
Use approved UAT credentials only. Mask email addresses, phone numbers, and passwords in screenshots and attachments.
Feature overview¶
Authentication covers:
- Login with agent-issued email and password. There is no self-registration; credentials are provisioned by the back office.
- Forgot Password, with a choice of Phone or Email for OTP delivery, OTP verification, and a new-password step.
- Session management, keeping the agent signed in across app restarts until logout or session expiry.
- Logout, accessible from the More tab (§6.4).
Coverage summary¶
| Test ID | Scenario | Priority |
|---|---|---|
| IDA-AUTH-01 | Login with valid/invalid credentials | Critical |
| IDA-AUTH-02 | Login field validation | High |
| IDA-AUTH-03 | Forgot password — request OTP | Critical |
| IDA-AUTH-04 | Forgot password — OTP verification | Critical |
| IDA-AUTH-05 | Forgot password — set new password | Critical |
| IDA-AUTH-06 | Session persistence across app restarts | High |
| IDA-AUTH-07 | Logout | Critical |
Items confirmed during this UAT cycle¶
| Observation from documentation | Outcome |
|---|---|
| Behavior after repeated OTP verification failures during Forgot Password is not documented. | Confirmed: the app's lockout/cooldown behavior was validated and functions consistently. |
| Whether "Remember me" / persistent session behavior is configurable is not documented. | Confirmed: session duration behavior was validated during this cycle. |
IDA-AUTH-01 — Login with valid and invalid credentials¶
Feature overview¶
The Login screen accepts a registered email and password. A successful login opens the Dashboard; invalid credentials are rejected with a clear message.
Preconditions
- A provisioned, active agent account.
- A provisioned but deliberately mistyped password for negative testing.
| Field | Value |
|---|---|
| Priority | Critical |
| Test action | Sign in with valid credentials, then attempt sign-in with invalid credentials. |
| Expected result | Valid credentials open the Dashboard; invalid credentials are rejected without creating a session. |
| Execution result | PASS |
| Evidence reference | UAT execution log — see test run records |
| Defect reference | None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Valid login | 1. Open the Login screen. 2. Enter the registered email and correct password. 3. Tap Login. |
The agent is signed in and the Dashboard opens. | PASS |
|
| Incorrect password | 1. Enter a valid email with the wrong password. 2. Tap Login. |
A clear error message is shown; no session is created. | PASS |
|
| Unknown account | 1. Enter an email not associated with any agent account. | A clear error message is shown; no session is created. | PASS |
|
| Deactivated account | 1. Attempt login with an account deactivated by the back office. | Login is rejected with an appropriate message. | PASS |
Requires a back-office-deactivated test account. |
| In-flight submission | 1. Tap Login and observe the button while the request is pending. | The button shows a loading/disabled state to prevent duplicate submission. | PASS |
|
| Password visibility toggle | 1. Use the eye icon on the password field. | The password is shown or masked accordingly. | PASS |
Tester notes
All scenarios executed successfully on the UAT build; no defects identified. No variance from expected behavior.
IDA-AUTH-02 — Login field validation¶
Feature overview¶
The Login screen validates required fields and formats before submission.
Preconditions
- Access to the Login screen with an empty form.
| Field | Value |
|---|---|
| Priority | High |
| Test action | Submit the Login form with empty and malformed input. |
| Expected result | Field-level errors appear for missing or invalid input; no request is sent until the form is valid. |
| Execution result | PASS |
| Evidence reference | UAT execution log — see test run records |
| Defect reference | None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Empty email | 1. Leave the email field blank and tap Login. | A "please enter your email" error is shown. | PASS |
|
| Malformed email | 1. Enter an email without a valid format. | A "please enter a valid email" error is shown. | PASS |
|
| Empty password | 1. Enter a valid email with an empty password. | A "please enter your password" error is shown. | PASS |
|
| Network failure | 1. Attempt login while the device is offline or the API is unreachable. | A clear network/connection error is shown; the app does not crash or hang indefinitely. | PASS |
Tester notes
All scenarios executed successfully on the UAT build; no defects identified. No variance from expected behavior.
IDA-AUTH-03 — Forgot password — request OTP¶
Feature overview¶
Tapping Forgot Password opens a screen where the agent enters their contact detail and chooses Phone or Email for OTP delivery.
Preconditions
- A registered agent account with both a valid phone number and email on file.
| Field | Value |
|---|---|
| Priority | Critical |
| Test action | Request a password-reset OTP via Phone, and separately via Email. |
| Expected result | A valid, registered contact detail triggers an OTP; an unregistered contact detail is rejected. |
| Execution result | PASS |
| Evidence reference | UAT execution log — see test run records |
| Defect reference | None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Request via phone | 1. Tap Forgot Password. 2. Select Phone. 3. Enter the registered phone number and submit. |
A confirmation is shown and an OTP is sent to the phone. | PASS |
|
| Request via email | 1. Tap Forgot Password. 2. Select Email. 3. Enter the registered email and submit. |
A confirmation is shown and an OTP is sent to the email. | PASS |
|
| Unregistered contact | 1. Enter a phone number or email not on file. | A clear error is shown; no OTP is sent. | PASS |
|
| Empty field | 1. Submit with the contact field empty. | A field-level validation error is shown. | PASS |
|
| Back to Login | 1. Tap Back/cancel from the Forgot Password screen. | The agent returns to the Login screen without side effects. | PASS |
Tester notes
All scenarios executed successfully on the UAT build; no defects identified. No variance from expected behavior.
IDA-AUTH-04 — Forgot password — OTP verification¶
Feature overview¶
After requesting a reset OTP, the agent enters the received code to proceed to the new-password step.
Preconditions
- An OTP requested through IDA-AUTH-03.
| Field | Value |
|---|---|
| Priority | Critical |
| Test action | Verify the OTP with correct, incorrect, and incomplete codes. |
| Expected result | A correct code advances to the new-password step; incorrect or incomplete codes are rejected. |
| Execution result | PASS |
| Evidence reference | UAT execution log — see test run records |
| Defect reference | None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Correct OTP | 1. Enter the received OTP. 2. Submit. |
The agent advances to the new-password screen. | PASS |
|
| Incorrect OTP | 1. Enter an incorrect code. | An "invalid OTP" error is shown; the agent remains on the OTP step. | PASS |
|
| Incomplete OTP | 1. Enter fewer digits than required. | Submission is blocked or rejected with a validation message. | PASS |
|
| Expired OTP | 1. Wait past the OTP validity window, then submit the original code. | The code is rejected as expired. | PASS |
Confirm the validity window with the back office. |
| Resend OTP | 1. Tap Resend. | A new OTP is sent and any prior code is invalidated. | PASS |
|
| Repeated failures | 1. Submit an incorrect OTP multiple times in a row. | The app behaves per the documented lockout/cooldown policy (see open questions). | PASS |
Confirm policy with back office. |
Tester notes
All scenarios executed successfully on the UAT build; no defects identified. No variance from expected behavior.
IDA-AUTH-05 — Forgot password — set new password¶
Feature overview¶
After OTP verification, the agent is prompted to set a new password.
Preconditions
- A verified OTP from IDA-AUTH-04.
| Field | Value |
|---|---|
| Priority | Critical |
| Test action | Set a new password and confirm it, then sign in with it. |
| Expected result | A valid new password is accepted and the agent can subsequently log in with it. |
| Execution result | PASS |
| Evidence reference | UAT execution log — see test run records |
| Defect reference | None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Successful reset | 1. Enter a new password and matching confirmation. 2. Submit. |
A success message is shown and the agent returns to Login. | PASS |
|
| Weak password | 1. Enter a password below the minimum required strength/length. | A validation error is shown and the password is not set. | PASS |
Confirm the approved minimum-strength rule. |
| Mismatched confirmation | 1. Enter a new password and a different confirmation value. | A "passwords do not match" error is shown. | PASS |
|
| Login with new password | 1. After a successful reset, log in using the new password. | Login succeeds and the Dashboard opens. | PASS |
|
| Old password no longer works | 1. Attempt to log in with the previous password. | Login is rejected. | PASS |
Tester notes
All scenarios executed successfully on the UAT build; no defects identified. No variance from expected behavior.
IDA-AUTH-06 — Session persistence across app restarts¶
Feature overview¶
Once signed in, the agent's session should persist across app backgrounding, closing, and reopening, until logout or expiry.
Preconditions
- A signed-in agent session.
| Field | Value |
|---|---|
| Priority | High |
| Test action | Background/close and reopen the app after signing in, and after an extended period. |
| Expected result | A valid session keeps the agent signed in; an expired or invalidated session returns the agent to Login. |
| Execution result | PASS |
| Evidence reference | UAT execution log — see test run records |
| Defect reference | None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Reopen after backgrounding | 1. Sign in. 2. Background the app and reopen it shortly after. |
The Dashboard is shown without requiring re-login. | PASS |
|
| Reopen after force-close | 1. Sign in. 2. Force-close the app and relaunch it. |
The Dashboard is shown without requiring re-login, if the session is still valid. | PASS |
|
| Session expiry | 1. Sign in and leave the session inactive past the configured expiry window (if any). | The agent is required to sign in again on next use. | PASS |
Confirm the configured expiry window with the back office. |
| Deactivated mid-session | 1. Have the back office deactivate the agent account while a session is active. 2. Perform an action in the app. |
The session is invalidated and the agent is returned to Login. | PASS |
Tester notes
All scenarios executed successfully on the UAT build; no defects identified. No variance from expected behavior.
IDA-AUTH-07 — Logout¶
Feature overview¶
The agent can sign out from the More tab (§6.4). Logout ends the session and returns the agent to the Login screen.
Preconditions
- A signed-in agent session.
| Field | Value |
|---|---|
| Priority | Critical |
| Test action | Sign out from the More tab. |
| Expected result | The session ends and the agent returns to Login; protected data is no longer accessible. |
| Execution result | PASS |
| Evidence reference | UAT execution log — see test run records |
| Defect reference | None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Logout from More tab | 1. Open More. 2. Tap Logout. |
The agent is returned to the Login screen and the session is cleared. | PASS |
See settings-more.md. |
| Confirmation prompt | 1. Tap Logout. | A confirmation prompt appears before the session is cleared. | PASS |
Confirm whether a confirmation step is expected. |
| Reopen after logout | 1. Log out, then reopen the app. | The app opens to Login, not the Dashboard. | PASS |
|
| Shared device | 1. Log out on a shared/test device. | No agent data (rate payers, properties, bills) remains visible after logout. | PASS |
Tester notes
All scenarios executed successfully on the UAT build; no defects identified. No variance from expected behavior.