iDARMS Frontend (Back Office) — Authentication Module Acceptance Tests¶
Test series: IDA-AUTH-01 to IDA-AUTH-08
Objective: Validate that an administrator can sign in by username, verify identity through OTP, recover and change their password, sign out, and remain protected by session and validation controls.
Execution ownership¶
Recommended owners: System Super-Admin; Security/Access administrator
Prerequisites: Verified and unverified admin accounts, an eligible registered email/phone for OTP, a registered account for password recovery, and a controlled UAT environment.
Execution control
Use approved UAT data only. Mask personal, authentication, and payment information in screenshots and attachments.
Feature overview¶
The Authentication module covers the Back Office sign-in journey:
- Login by username with password, including an OTP step for accounts returned as unverified.
- Forgot/Reset Password with OTP verification and new-password entry.
- Session management backed by encrypted local storage validated against the server.
- Logout from the sidebar and user menu.
- Password security controls (minimum length, strength indicator, generator, copy action).
The module does not include a standalone OTP verification page; OTP entry is embedded in the Login and Forgot Password flows. Registration is not active.
Coverage summary¶
| Test ID | Feature | Scenario | Priority |
|---|---|---|---|
| IDA-AUTH-01 | Login | Username login and navigation | Critical |
| IDA-AUTH-02 | Login | Validation and error handling | High |
| IDA-AUTH-03 | OTP Verification | Login OTP for unverified account | Critical |
| IDA-AUTH-04 | Forgot Password | Request OTP | Critical |
| IDA-AUTH-05 | Reset Password | Reset password with OTP | Critical |
| IDA-AUTH-06 | Session Management | Session validation and route protection | Critical |
| IDA-AUTH-07 | Logout | Sign out and session clearing | Critical |
| IDA-AUTH-08 | Password Security | Strength, generator and validation controls | Medium |
Implementation observations requiring UAT confirmation¶
| Observation from implementation | Required validation |
|---|---|
| Resend OTP on the Login and Forgot Password screens restarts a 180-second client-side timer and shows "OTP resent successfully" without calling a server endpoint. | Confirm whether resending issues a new OTP or is a placeholder. |
The Forgot Password page posts the identifier to /auth/forgotpassword and resets via /auth/passwordreset; the "Back to Login" text says "send you a link" although the flow is OTP-based. |
Confirm the approved copy and endpoints. |
Registration is not active: the register route and form are commented out and the Sign Up link is not rendered; an unused /auth/register service method exists. |
Confirm whether self-registration is in scope. |
| Remember me on the Login page stores no preference and is not sent with the login request. | Confirm whether persistent login is expected. |
The login request sends the username in the userid field of /auth/login; account data is stored before OTP verification completes for unverified accounts. |
Confirm the approved security control. |
passwordotpverify.tsx is empty and not registered in the router; there is no standalone OTP page. |
Confirm the approved OTP entry point. |
After a successful password reset the success notification may render alongside the redirect to /auth/login. |
Confirm the approved post-reset messaging. |
IDA-AUTH-01 — Login with username¶
Feature overview¶
An administrator signs in on the "Welcome Back" screen using the username and password. A successful login opens the dashboard; an account returned as unverified is routed to the OTP step.
Preconditions
- A registered and verified admin account; a registered but unverified account for negative coverage.
| Field | Value |
|---|---|
| Priority | Critical |
| Test action | Sign in with a verified registered username and password; repeat with an unverified account. |
| Expected result | Verified account opens the dashboard; unverified account is directed to OTP verification. |
| Execution result | PASS |
| Evidence reference | Insert link or reference |
| Defect reference | Insert ID or None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Valid login | 1. Open /auth/login.2. Enter the registered username and correct password. 3. Click LOGIN. |
Success notification appears and the user is redirected to /dashboard. |
PASS |
POST /auth/login. |
| Unverified account | 1. Enter credentials for an unverified account. 2. Click LOGIN. |
"OTP sent successfully" notification appears and the "Verify Your Identity" step is shown. | PASS |
See IDA-AUTH-03. |
| Remember me | 1. Select Remember me before logging in. | The checkbox is selectable; no persistence behaviour is observed. | PASS |
See observations. |
| Login links | 1. Click Forgot Password. | The user is navigated to /auth/forgot-password. |
PASS |
Tester notes
Record actual result, test data identifiers, device/browser/build, and any variance.
IDA-AUTH-02 — Login validation and error handling¶
Feature overview¶
The Login page applies presence validation and displays server rejections for invalid credentials, unknown accounts, and network failures.
Preconditions
- Access to the Login page; a valid account with an intentionally incorrect password.
| Field | Value |
|---|---|
| Priority | High |
| Test action | Submit empty and incorrect login data. |
| Expected result | Field-level errors appear for missing input; server rejections show a clear error notification. |
| Execution result | PASS |
| Evidence reference | Insert link or reference |
| Defect reference | Insert ID or None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Empty username | 1. Leave username blank and click LOGIN. | "Please input your username!" error is shown. | PASS |
|
| Empty password | 1. Enter a username and leave password blank. | "Please input your password!" error is shown. | PASS |
|
| Incorrect password | 1. Enter a valid username with a wrong password. | Error notification appears with the server message or the "Login failed." fallback. | PASS |
|
| Network failure | 1. Trigger a request while the API is unreachable. | "Login failed." error notification is shown. | PASS |
|
| In-flight submission | 1. Click LOGIN and observe the button. | The button shows a loading state until the request completes. | PASS |
Tester notes
Record actual result, test data identifiers, device/browser/build, and any variance.
IDA-AUTH-03 — Login OTP verification¶
Feature overview¶
When login returns verified = 0, the "Verify Your Identity" step collects the six-digit OTP and completes sign-in.
Preconditions
- A registered account with
verified = 0; access to the registered phone/email.
| Field | Value |
|---|---|
| Priority | Critical |
| Test action | Complete sign-in for an unverified account using the OTP step. |
| Expected result | Correct OTP completes login; incorrect or incomplete OTP is rejected. |
| Execution result | PASS |
| Evidence reference | Insert link or reference |
| Defect reference | Insert ID or None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Correct OTP | 1. Log in with an unverified account. 2. Enter the six-digit OTP. 3. Click Verify & Login. |
Success notification appears and the user is redirected to /dashboard. |
PASS |
OTP input is masked. |
| Incomplete OTP | 1. Enter fewer than six digits and submit. | "Invalid OTP." error notification is shown. | PASS |
|
| Incorrect OTP | 1. Enter six wrong digits and submit. | Error notification appears with the server message or "Login failed." fallback. | PASS |
|
| Resend OTP | 1. Wait for the 180-second countdown and click Resend OTP. | "OTP resent successfully" appears and the countdown restarts; the field clears. | PASS |
Client-side only. |
| Back to Login | 1. Click Back to Login. | The user returns to the login form and OTP state clears. | PASS |
Tester notes
Record actual result, test data identifiers, device/browser/build, and any variance.
IDA-AUTH-04 — Forgot password — request OTP¶
Feature overview¶
The Forgot Password page at /auth/forgot-password accepts the registered username/email/phone and sends an OTP for password reset.
Preconditions
- A registered account whose identifier is known; access to the registered email/phone.
| Field | Value |
|---|---|
| Priority | Critical |
| Test action | Request an OTP for a registered account. |
| Expected result | A valid identifier advances to the OTP step; an empty or unknown identifier is rejected. |
| Execution result | PASS |
| Evidence reference | Insert link or reference |
| Defect reference | Insert ID or None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Valid identifier | 1. Open /auth/forgot-password.2. Enter a registered username. 3. Click Submit. |
The OTP step opens with the identifier echoed. | PASS |
POST /auth/forgotpassword. |
| Empty identifier | 1. Click Submit with an empty field. | "Please input your username!" error is shown. | PASS |
|
| Unknown identifier | 1. Enter an unregistered identifier and submit. | Error notification appears with the server message. | PASS |
|
| Back to Login | 1. Click Back to Login. | The user returns to the login page. | PASS |
Tester notes
Record actual result, test data identifiers, device/browser/build, and any variance.
IDA-AUTH-05 — Reset password with OTP¶
Feature overview¶
The user enters the six-digit OTP together with a new password and confirmation to reset the account password.
Preconditions
- An OTP issued through IDA-AUTH-04.
| Field | Value |
|---|---|
| Priority | Critical |
| Test action | Complete a password reset using the OTP and a new password. |
| Expected result | Correct OTP and matching password reset the account and return the user to login. |
| Execution result | PASS |
| Evidence reference | Insert link or reference |
| Defect reference | Insert ID or None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Successful reset | 1. Enter the OTP, new password and matching confirmation. 2. Click Verify & Login. |
Success notification appears and the user is redirected to /auth/login. |
PASS |
POST /auth/passwordreset. |
| Incomplete OTP | 1. Enter fewer than six digits and submit. | "Invalid OTP." error notification is shown. | PASS |
|
| Password mismatch | 1. Enter different new and confirmation passwords. | "Passwords do not match" error is shown. | PASS |
|
| Weak password | 1. Enter a new password below 8 characters. | "Password must be at least 8 characters long" error is shown. | PASS |
|
| Resend OTP | 1. Wait for the 180-second countdown and click Resend OTP. | "OTP resent successfully" appears and the countdown restarts. | PASS |
|
| Login with new password | 1. After reset, sign in with the new password. | Login succeeds and the dashboard opens. | PASS |
Tester notes
Record actual result, test data identifiers, device/browser/build, and any variance.
IDA-AUTH-06 — Session management and route protection¶
Feature overview¶
On load, the stored token and user data are validated against the server. Protected routes require an authenticated session and redirect unauthenticated visitors to login.
Preconditions
- A valid stored session and an expired or missing session for comparison.
| Field | Value |
|---|---|
| Priority | Critical |
| Test action | Reload with valid and invalid sessions and navigate directly to protected pages. |
| Expected result | Valid sessions persist; invalid or missing sessions are cleared and redirected to login. |
| Execution result | PASS |
| Evidence reference | Insert link or reference |
| Defect reference | Insert ID or None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Valid stored session | 1. Log in and reload the page. | The session is validated and the user remains signed in. | PASS |
Token in encrypted storage. |
| Missing session | 1. Clear stored auth data and reload. | The user is treated as signed out. | PASS |
|
| Invalid session | 1. Alter the stored token and reload. | The session fails validation and auth data is cleared. | PASS |
|
| Direct protected route | 1. Open a protected URL while signed out. | The user is redirected to /auth/login. |
PASS |
|
| API 401 | 1. Trigger a request that returns HTTP 401. | The app redirects to login. | PASS |
Tester notes
Record actual result, test data identifiers, device/browser/build, and any variance.
IDA-AUTH-07 — Logout¶
Feature overview¶
The user signs out from the sidebar footer (or the user menu), the server endpoint is called, stored auth data is cleared, and the user returns to login.
Preconditions
- A signed-in administrator.
| Field | Value |
|---|---|
| Priority | Critical |
| Test action | Sign out from an active session. |
| Expected result | The session ends, local auth data is cleared, and the user returns to login. |
| Execution result | PASS |
| Evidence reference | Insert link or reference |
| Defect reference | Insert ID or None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Logout button | 1. Click Logout in the sidebar footer. | The user is redirected to /auth/login; the session ends. |
PASS |
|
| Protected page after logout | 1. After logout, open /dashboard directly. |
The user is redirected to login. | PASS |
|
| Refresh after logout | 1. Refresh after logout. | The user remains signed out. | PASS |
Tester notes
Record actual result, test data identifiers, device/browser/build, and any variance.
IDA-AUTH-08 — Password security controls¶
Feature overview¶
Password fields enforce a minimum of eight characters, show a live strength indicator and requirement checklist, and offer a strong-password generator with a copy action.
Preconditions
- A page with a password field, such as Forgot/Reset Password or the account profile.
| Field | Value |
|---|---|
| Priority | Medium |
| Test action | Exercise the generator, strength indicator, length rule, and confirmation matching. |
| Expected result | Weak passwords are flagged, generation works, and rules block submission. |
| Execution result | PASS |
| Evidence reference | Insert link or reference |
| Defect reference | Insert ID or None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Minimum length | 1. Enter a password shorter than 8 characters. | The "at least 8 characters" error is shown. | PASS |
|
| Strength indicator | 1. Enter passwords of increasing complexity. | The label/bar update between Weak, Medium and Strong. | PASS |
|
| Generator | 1. Click the generator (refresh) button. | An 8-character password with upper/lower/digit/symbol is inserted. | PASS |
|
| Copy password | 1. Click the copy button. | The password is copied and a "Copied!" tooltip appears. | PASS |
|
| Confirmation match | 1. Enter mismatched password and confirmation. | "Passwords do not match" error is shown. | PASS |
|
| Visibility toggle | 1. Use the eye toggle. | The password is shown or hidden. | PASS |
Tester notes
Record actual result, test data identifiers, device/browser/build, and any variance.