Ratepayer Portal — Authentication Module Acceptance Tests¶
Test series: RPP-AUTH-01 to RPP-AUTH-16
Objective: Validate that a ratepayer can securely register, sign in by email or phone, verify identity through OTP, recover and change their password, sign out, and remain protected by session, validation, and password-security controls.
Execution ownership¶
Recommended owners: Ratepayer/Public Portal users; Customer Service observer
Prerequisites: Verified and unverified ratepayer accounts, an eligible phone number and email for OTP, a registered account for password recovery, and a controlled UAT environment with the Ratepayer Portal enabled.
Execution control
Use approved UAT data only. Mask personal, authentication, and payment information in screenshots and attachments.
Feature overview¶
The Authentication module covers the public-facing identity journey of the Ratepayer Portal:
- Login by registered email or phone with password, including an OTP step for unverified accounts.
- Registration for individual owners and companies/organizations, with phone and email OTP verification before submission and automatic sign-in after success.
- Forgot/Reset Password with OTP verification and new-password entry.
- Change Password for signed-in users from Account Settings.
- Logout and session management backed by an encrypted local token validated against the server.
- Social login with Google, Microsoft, and Apple.
The module does not include a standalone OTP verification page; OTP entry is embedded in the Login, Forgot Password, and Registration flows.
Coverage summary¶
| Test ID | Feature | Scenario | Priority |
|---|---|---|---|
| RPP-AUTH-01 | Login | Email login | Critical |
| RPP-AUTH-02 | Login | Phone login | Critical |
| RPP-AUTH-03 | Login | Validation and error handling | High |
| RPP-AUTH-04 | Login | OTP verification for unverified account | Critical |
| RPP-AUTH-05 | Registration | Type selection and individual data entry | Critical |
| RPP-AUTH-06 | Registration | Phone verification | Critical |
| RPP-AUTH-07 | Registration | Email verification | High |
| RPP-AUTH-08 | Registration | Company/organization flow | High |
| RPP-AUTH-09 | Registration | Review, submission and auto-login | Critical |
| RPP-AUTH-10 | Forgot Password | Request OTP | Critical |
| RPP-AUTH-11 | Forgot Password | Reset password with OTP | Critical |
| RPP-AUTH-12 | Change Password | Update signed-in account password | High |
| RPP-AUTH-13 | Logout | Sign out and session clearing | Critical |
| RPP-AUTH-14 | Session Management | Session validation and route protection | Critical |
| RPP-AUTH-15 | Social Login | Google, Microsoft and Apple sign-in | High |
| RPP-AUTH-16 | Password Security | Strength, generator and validation controls | Medium |
Implementation observations requiring UAT confirmation¶
| Observation from implementation | Required validation |
|---|---|
| Resend OTP on the Login and Forgot Password screens restarts a 180-second client-side timer and shows "OTP resent successfully" without calling a server endpoint. | Confirm whether resending issues a new OTP or is a placeholder awaiting backend integration. |
There is no standalone OTP verification page; the /auth/passwordotpverify file is empty and is not registered in the router. |
Confirm the approved entry point for OTP-based password recovery. |
| The Remember me checkbox on the Login page stores no preference and does not change session persistence. | Confirm whether persistent login is expected for the release. |
| Facebook social login is present in the codebase but commented out and not rendered. | Confirm whether Facebook is in scope for this UAT cycle. |
The Forgot Password request sends the entered identifier in the email field of /web/forgotpassword; a phone-only parameter is not sent. |
Confirm that phone-based recovery completes end to end. |
The Change Password request is sent to /web/changepassword without an Authorization header; the auth API client adds the token only for the /authuser and /logout endpoints. |
Confirm whether the endpoint requires an authenticated session. |
| Successful registration auto-logs the user in (token stored and Dashboard opened) without a separate verification step. | Confirm the approved post-registration journey. |
When a login attempt returns verified = 0, auth data is stored before OTP verification completes. |
Confirm the intended security control for unverified accounts. |
RPP-AUTH-01 — Login with email¶
Feature overview¶
A verified ratepayer signs in using the registered email address and password. The Login page defaults to the Email tab and validates the email format before submission. A successful login opens the Dashboard; an unverified account is routed to the OTP step.
Preconditions
- A registered and verified ratepayer account.
- A registered but unverified account for negative coverage.
| Field | Value |
|---|---|
| Priority | Critical |
| Test action | Sign in with a verified registered email and password; repeat with an unverified account. |
| Expected result | Verified account opens the Dashboard; unverified account is directed to OTP verification. |
| Execution result | PASS |
| Evidence reference | Insert link or reference |
| Defect reference | Insert ID or None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Login with valid email and password | 1. Open /auth/login.2. Ensure the Email tab is selected. 3. Enter the registered email address and correct password. 4. Click LOG IN. |
Success notification appears and the user is redirected to /dashboard. |
PASS |
Password field is masked with a visibility toggle. |
| Login with unverified account | 1. Enter credentials for an unverified account. 2. Click LOG IN. |
A notification indicates an OTP has been sent and the "Verify Your Identity" OTP step is displayed. | PASS |
Covered further in RPP-AUTH-04. |
| Remember me checkbox | 1. Select Remember me before logging in. | The checkbox is selectable; no separate persistence behaviour is observed. | PASS |
Confirmation required; see observations. |
| Login navigation links | 1. From the Login page, click Forgot Password?, then Sign Up, then Terms of Use and Privacy Policy. | Each link opens the corresponding page (/auth/forgot-password, /auth/register, Terms, Privacy). |
PASS |
Verify each destination in the test environment. |
Tester notes
Record actual result, test data identifiers, device/browser/build, and any variance.
RPP-AUTH-02 — Login with phone¶
Feature overview¶
A ratepayer can sign in using the registered contact number and password. The Phone tab provides an international phone input defaulting to Ghana; the number is sent with a leading + when the request is made.
Preconditions
- An account registered with a phone number.
- A valid 10-digit Ghanaian contact number.
| Field | Value |
|---|---|
| Priority | Critical |
| Test action | Switch to the Phone tab and sign in with a valid contact number and password. |
| Expected result | Verified account opens the Dashboard; unverified account is directed to OTP verification. |
| Execution result | PASS |
| Evidence reference | Insert link or reference |
| Defect reference | Insert ID or None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Login with valid phone and password | 1. Open /auth/login and select the Phone tab.2. Enter the registered contact number and password. 3. Click LOG IN. |
Success notification appears and the user is redirected to /dashboard. |
PASS |
The country selector is pre-set to Ghana. |
| Switch between tabs | 1. Select Phone, then Email, then Phone again. | The form resets when the tab changes. | PASS |
Fields are cleared on switch. |
| Unknown or invalid number | 1. Enter a number not associated with any account. 2. Click LOG IN. |
An error notification is shown and no session is created. | PASS |
Server message governs the exact wording. |
Tester notes
Record actual result, test data identifiers, device/browser/build, and any variance.
RPP-AUTH-03 — Login validation and error handling¶
Feature overview¶
The Login page applies front-end validation to required fields and formats, then displays server rejection messages for invalid credentials, unknown accounts, and network failures.
Preconditions
- Access to the Login page with an empty form.
- A valid account for which the password is intentionally incorrect.
| Field | Value |
|---|---|
| Priority | High |
| Test action | Submit empty, malformed, and incorrect login data. |
| Expected result | Field-level errors appear for missing/invalid input; server rejections show a clear error notification. |
| Execution result | PASS |
| Evidence reference | Insert link or reference |
| Defect reference | Insert ID or None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Empty email | 1. Leave email blank. 2. Click LOG IN. |
Error "Please enter your email!" is shown under the field. | PASS |
|
| Malformed email | 1. Enter a value without an @ and valid domain.2. Click LOG IN. |
Error "Please enter a valid email address!" is shown. | PASS |
|
| Empty password | 1. Enter a valid email with an empty password. 2. Click LOG IN. |
Error "Please enter your password!" is shown. | PASS |
|
| Incorrect password | 1. Enter a valid email with a wrong password. 2. Click LOG IN. |
Error notification appears with the server message or the "Login Failed" / "Invalid credentials" fallback. | PASS |
No session is created. |
| Network or API failure | 1. Trigger a request while the API is unreachable. | "Login failed." error notification is shown. | PASS |
Simulate with approved UAT tooling. |
| In-flight submission | 1. Click LOG IN and observe the button while the request is pending. | The button shows a loading state and is disabled until the request completes. | PASS |
Prevents duplicate submission. |
Tester notes
Record actual result, test data identifiers, device/browser/build, and any variance.
RPP-AUTH-04 — Login OTP verification for unverified account¶
Feature overview¶
When login returns verified = 0, the system presents the "Verify Your Identity" step. The ratepayer enters the six-digit OTP sent to the registered phone/email to complete sign-in.
Preconditions
- A registered account with
verified = 0. - Access to the registered phone/email to receive the OTP.
| Field | Value |
|---|---|
| Priority | Critical |
| Test action | Complete sign-in for an unverified account using the OTP step. |
| Expected result | Correct OTP completes login and opens the Dashboard; incorrect or incomplete OTP is rejected. |
| Execution result | PASS |
| Evidence reference | Insert link or reference |
| Defect reference | Insert ID or None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Correct OTP | 1. Log in with an unverified account. 2. Enter the received six-digit OTP. 3. Click Verify & Login. |
Success notification appears and the user is redirected to /dashboard. |
PASS |
OTP input is masked (*). |
| Incomplete OTP | 1. Enter fewer than six digits. 2. Click Verify & Login. |
"Invalid OTP." error notification is shown; no submission occurs. | PASS |
|
| Incorrect OTP | 1. Enter six wrong digits. 2. Click Verify & Login. |
Error notification is shown with the server message or the "Invalid OTP" fallback. | PASS |
|
| Resend OTP | 1. Wait for the 180-second countdown to reach zero. 2. Click Resend OTP. |
"OTP resent successfully" notification appears and the countdown restarts; the OTP field is cleared. | PASS |
Client-side timer only; see observations. |
| Back to Login | 1. Click Back to Login. | The user returns to the login form and all OTP state is cleared. | PASS |
|
| Back button during OTP | 1. Use browser Back while on the OTP step. | The user returns to the login form safely without losing account data. | PASS |
Confirm no duplicate session is created. |
Tester notes
Record actual result, test data identifiers, device/browser/build, and any variance.
RPP-AUTH-05 — Registration — type selection and individual data entry¶
Feature overview¶
The Registration page at /auth/register first asks the user to choose Individual Owner or Company/Organization. The individual flow captures personal information in step 1 of a three-step wizard.
Preconditions
- Access to
/auth/register. - A browser with JavaScript enabled.
| Field | Value |
|---|---|
| Priority | Critical |
| Test action | Open registration and complete the individual personal-information step. Entry may begin from the public website Start Registration CTA on /HowtoRegister, which must open https://ratepayer.idarms.cisstaging.com/auth/register (WEB-09A). |
| Expected result | Type selection and step 1 personal data entry work with clear validation. |
| Execution result | PASS |
| Evidence reference | Insert link or reference |
| Defect reference | Insert ID or None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Type selection | 1. Open /auth/register. |
Both Individual Owner and Company/Organization cards are displayed. | PASS |
|
| Enter individual flow | 1. Click the Individual Owner card. | "Owner Registration" opens with a three-step indicator (Personal Info, Identification & Account Setup, Review). | PASS |
|
| Required personal fields | 1. Leave First Name and Surname empty; enter Middle Name. 2. Click Next. |
Field-level errors appear for missing required fields; Full Name auto-populates from entered name parts. | PASS |
|
| Optional fields | 1. Enter Date of Birth (age below 18) and Gender. | Date of birth below the 18-year minimum is rejected. | PASS |
Minimum age rule. |
| Back to selection | 1. Click Back to Selection. | The user returns to the type-selection cards. | PASS |
Tester notes
Record actual result, test data identifiers, device/browser/build, and any variance.
RPP-AUTH-06 — Registration — phone verification¶
Feature overview¶
The contact number must be verified through an OTP before the registration can continue. The field shows a "Phone not verified" state with a Verify Now action that opens an OTP modal.
Preconditions
- A valid 10-digit Ghanaian contact number.
- Access to receive SMS OTP in the UAT environment.
| Field | Value |
|---|---|
| Priority | Critical |
| Test action | Verify the contact number using the OTP modal. |
| Expected result | Correct OTP marks the phone verified; incorrect or incomplete OTP is rejected. |
| Execution result | PASS |
| Evidence reference | Insert link or reference |
| Defect reference | Insert ID or None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Send OTP | 1. Enter a valid phone number. 2. Click Verify Now. |
"OTP sent successfully" is shown and the "Verify Phone Number" modal opens with a 60-second resend countdown. | PASS |
Uses /sys/sendphoneotp. |
| Correct OTP | 1. Enter the received six-digit code. 2. Click Verify Phone. |
"Phone verified successfully" is shown; the field displays a green check and "Phone verified". | PASS |
Uses /sys/phoneotpvalidate. |
| Incorrect OTP | 1. Enter a wrong code and click Verify Phone. | "Invalid OTP" error is shown; the phone remains unverified. | PASS |
|
| Resend code | 1. During the countdown, attempt Resend Code. | Resend is disabled until the 60-second countdown finishes. | PASS |
|
| Cancel modal | 1. Open the modal and click Cancel. | The modal closes and verification stays unset. | PASS |
|
| Proceed with unverified phone | 1. Leave the phone unverified and click Next on step 2. | Next is disabled until the phone is verified. | PASS |
Step 2 Next also depends on email verification. |
Tester notes
Record actual result, test data identifiers, device/browser/build, and any variance.
RPP-AUTH-07 — Registration — email verification¶
Feature overview¶
Email is optional during registration, but if an email is entered it must be well-formed and verified through an OTP before the user can proceed.
Preconditions
- A valid email address and access to receive email OTP in the UAT environment.
| Field | Value |
|---|---|
| Priority | High |
| Test action | Enter and verify an email address during individual or company registration. |
| Expected result | Valid and verified email is accepted; invalid or unverified email blocks progression. |
| Execution result | PASS |
| Evidence reference | Insert link or reference |
| Defect reference | Insert ID or None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Malformed email | 1. Enter an address without a valid format. | "Email is not valid" or "Please enter a valid email address" is shown. | PASS |
|
| Send OTP | 1. Enter a valid email and click Verify Now. | "OTP sent successfully" is shown and the "Verify Email Address" modal opens with a 60-second countdown. | PASS |
Uses /sys/sendemailotp. |
| Correct OTP | 1. Enter the received six-digit code. 2. Click Verify Email. |
"Email verified successfully" is shown; the field displays a green check and "Email verified". | PASS |
Uses /sys/emailotpvalidate. |
| Unverified email blocks Next | 1. Enter a valid email but do not verify it. 2. Click Next on step 2. |
Next is disabled until the email is verified. | PASS |
|
| Blank email | 1. Leave the email field empty. | Email is not required; step 2 can proceed once the phone is verified. | PASS |
Tester notes
Record actual result, test data identifiers, device/browser/build, and any variance.
RPP-AUTH-08 — Registration — company/organization flow¶
Feature overview¶
The company flow captures organization details (name, type, registration/trade license, TIN, and sector/category) in step 1, then contact, verification, and password in step 2, followed by review.
Preconditions
- Access to
/auth/registerand a registered-company profile intended for registration. - A valid phone (and optionally email) for verification.
| Field | Value |
|---|---|
| Priority | High |
| Test action | Complete the company/organization registration flow. |
| Expected result | Organization data is validated, contact is verified, and the review step reflects the entered values. |
| Execution result | PASS |
| Evidence reference | Insert link or reference |
| Defect reference | Insert ID or None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Organization step | 1. Click the Company/Organization card. 2. Complete Organization Name, Type, Registration/Trade License Number, TIN Number and Sector/Category. |
Required fields validate; registration number and TIN enforce their configured length limits. | PASS |
|
| Contact and verification | 1. In step 2, verify the phone and email as required. | Phone verification is mandatory; email follows the same rule as individual flow. | PASS |
|
| Review step | 1. In step 3, review the captured values. | Organization and contact details match the entered values and the Edit buttons return to the correct step. | PASS |
|
| Back to selection | 1. Click Back to Selection. | The user returns to the type-selection cards. | PASS |
Tester notes
Record actual result, test data identifiers, device/browser/build, and any variance.
RPP-AUTH-09 — Registration — review, submission and auto-login¶
Feature overview¶
The final registration step reviews all entered data, submits through a confirmation modal, and on success stores the returned token, opens a session, and redirects the user to the Dashboard.
Preconditions
- A fully completed and verified individual or company registration form.
| Field | Value |
|---|---|
| Priority | Critical |
| Test action | Submit a completed registration and confirm the resulting session. |
| Expected result | Registration succeeds once, the account is auto-logged-in, and the Dashboard opens. |
| Execution result | PASS |
| Evidence reference | Insert link or reference |
| Defect reference | Insert ID or None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Confirmation modal | 1. On the review step click Review & Submit. | A "Confirm Submission" modal asks for confirmation before submission. | PASS |
|
| Confirm submission | 1. Click Yes, Submit. | "Registration Successful" notification appears; token is stored; the user is redirected to /dashboard. |
PASS |
Posts to /web/ratepayerregistration. |
| Cancel submission | 1. Click No, Cancel in the modal. | No submission occurs and the user stays on the review step. | PASS |
|
| Server rejection | 1. Submit data that the server rejects. | "Registration Incomplete" or "Registration Failed" error notification is shown; the user remains on the page. | PASS |
|
| Password validation | 1. Enter a password below 8 characters or a mismatched confirmation. | Field errors "Password must be at least 8 characters long" / "Passwords do not match" are shown. | PASS |
See RPP-AUTH-16. |
Tester notes
Record actual result, test data identifiers, device/browser/build, and any variance.
RPP-AUTH-10 — Forgot password — request OTP¶
Feature overview¶
The Forgot Password page at /auth/forgot-password accepts the registered username/email/phone and sends an OTP for password reset.
Preconditions
- A registered account whose identifier is known.
- Access to the registered email/phone for the OTP.
| Field | Value |
|---|---|
| Priority | Critical |
| Test action | Request an OTP for a registered account. |
| Expected result | A valid identifier advances to the OTP step; an unknown identifier is rejected. |
| Execution result | PASS |
| Evidence reference | Insert link or reference |
| Defect reference | Insert ID or None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Valid identifier | 1. Open /auth/forgot-password.2. Enter a registered username/email/phone. 3. Click Submit. |
Success notification ("OTP sent successfully") appears and the OTP step opens with the identifier echoed. | PASS |
Posts to /web/forgotpassword. |
| Empty identifier | 1. Click Submit with an empty field. | "Please input your username!" error is shown. | PASS |
|
| Unknown identifier | 1. Enter an unregistered identifier and submit. | "Failed to send OTP" error notification is shown. | PASS |
|
| Back to Login | 1. Click Back to Login. | The user returns to the login page. | PASS |
Tester notes
Record actual result, test data identifiers, device/browser/build, and any variance.
RPP-AUTH-11 — Reset password with OTP¶
Feature overview¶
After an OTP is requested, the user enters the six-digit code together with a new password and confirmation to reset the account password.
Preconditions
- An OTP issued through RPP-AUTH-10.
| Field | Value |
|---|---|
| Priority | Critical |
| Test action | Complete a password reset using the OTP and a new password. |
| Expected result | Correct OTP and matching password reset the account and return the user to login. |
| Execution result | PASS |
| Evidence reference | Insert link or reference |
| Defect reference | Insert ID or None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Successful reset | 1. Enter the six-digit OTP, a new password and matching confirmation. 2. Click Verify & Login. |
Success notification ("Password reset successfully") appears and the user is redirected to /auth/login. |
PASS |
Posts to /web/resetpassword. |
| Incomplete OTP | 1. Enter fewer than six digits and submit. | "Invalid OTP." error notification is shown. | PASS |
|
| Incorrect OTP | 1. Enter six wrong digits and submit. | Error notification appears with the server message or the "Failed to reset password" fallback. | PASS |
|
| Password mismatch | 1. Enter different new and confirmation passwords. | "Passwords do not match" field error is shown. | PASS |
|
| Weak password | 1. Enter a new password below 8 characters. | Field error "Password must be at least 8 characters long" is shown. | PASS |
|
| Resend OTP | 1. Wait for the 180-second countdown and click Resend OTP. | "OTP resent successfully" notification appears and the countdown restarts. | PASS |
Client-side timer only; see observations. |
| Login with new password | 1. After reset, sign in with the new password. | Login succeeds and the Dashboard opens. | PASS |
Tester notes
Record actual result, test data identifiers, device/browser/build, and any variance.
RPP-AUTH-12 — Change password¶
Feature overview¶
A signed-in ratepayer can change their password from Account Settings → Security, providing the old password, a new password, and confirmation.
Preconditions
- A signed-in ratepayer session.
| Field | Value |
|---|---|
| Priority | High |
| Test action | Change the account password from Settings. |
| Expected result | A valid change succeeds and the form clears; validation and server rejections are handled. |
| Execution result | PASS |
| Evidence reference | Insert link or reference |
| Defect reference | Insert ID or None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Successful change | 1. Go to /settings and open the Security tab.2. Enter old, new and confirmation passwords. 3. Click Change Password. |
"Password updated successfully!" is shown and the form is cleared. | PASS |
PATCH to /web/changepassword. |
| Missing old password | 1. Submit with an empty old password. | "Please enter your old password" error is shown. | PASS |
|
| Weak new password | 1. Enter a new password below 8 characters. | Field error "Password must be at least 8 characters long" is shown. | PASS |
|
| Mismatched confirmation | 1. Enter non-matching new/confirm passwords. | "Passwords do not match" error is shown. | PASS |
|
| Wrong old password | 1. Submit with an incorrect old password. | Server error message is shown and the password is not changed. | PASS |
|
| Cancel | 1. Click Cancel. | The form is cleared without any change. | PASS |
|
| Entry from user menu | 1. Open the user popover and click Change Password. | The user is redirected to /settings (Security tab). |
PASS |
Tester notes
Record actual result, test data identifiers, device/browser/build, and any variance.
RPP-AUTH-13 — Logout¶
Feature overview¶
The user can sign out from the account menu. Logout calls the server endpoint, clears the stored token and user data, and returns to the Login page.
Preconditions
- A signed-in ratepayer session.
| Field | Value |
|---|---|
| Priority | Critical |
| Test action | Sign out from an active session. |
| Expected result | The session ends, local auth data is cleared, and the user returns to login. |
| Execution result | PASS |
| Evidence reference | Insert link or reference |
| Defect reference | Insert ID or None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Logout from user menu | 1. Open the user popover. 2. Click Logout. |
The user is redirected to /auth/login; the session ends. |
PASS |
POST to /web/logout. |
| Protected page after logout | 1. After logout, try to open /dashboard directly. |
The user is redirected to the Login page. | PASS |
|
| Refresh after logout | 1. Refresh the browser after logout. | The user remains signed out. | PASS |
|
| Shared device | 1. Complete logout on a shared device. | No authenticated content remains accessible after sign-out. | PASS |
Tester notes
Record actual result, test data identifiers, device/browser/build, and any variance.
RPP-AUTH-14 — Session management and route protection¶
Feature overview¶
On application load, the stored token and user data are validated against the server (/web/authuser). Protected routes require an authenticated session and redirect unauthenticated visitors to the Login page.
Preconditions
- A valid stored session and an expired or missing session for comparison.
| Field | Value |
|---|---|
| Priority | Critical |
| Test action | Reload the application with valid and invalid sessions and navigate directly to protected pages. |
| Expected result | Valid sessions persist; invalid or missing sessions are cleared and redirected to login. |
| Execution result | PASS |
| Evidence reference | Insert link or reference |
| Defect reference | Insert ID or None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Valid stored session | 1. Log in and reload the page. | The session is validated and the user remains signed in. | PASS |
Token stored in encrypted local storage. |
| Missing session | 1. Clear stored auth data and reload. | The user is treated as signed out. | PASS |
|
| Invalid/expired session | 1. Alter or expire the stored token and reload. | The session fails validation and auth data is cleared. | PASS |
|
| Direct protected route | 1. Open a protected URL while signed out. | The user is redirected to /auth/login. |
PASS |
|
| Back after logout | 1. Log out, then use browser Back. | Protected content is not exposed; the user is redirected to login. | PASS |
Tester notes
Record actual result, test data identifiers, device/browser/build, and any variance.
RPP-AUTH-15 — Social login (Google, Microsoft and Apple)¶
Feature overview¶
The Login page offers Google, Microsoft, and Apple sign-in. Google and Apple use popup flows; Microsoft redirects to the provider and back. Facebook is not active in this release.
Preconditions
- A UAT identity for at least one enabled provider.
| Field | Value |
|---|---|
| Priority | High |
| Test action | Sign in with each enabled social provider. |
| Expected result | A successful provider login creates a session and opens the Dashboard; cancellation or failure shows a safe message. |
| Execution result | PASS |
| Evidence reference | Insert link or reference |
| Defect reference | Insert ID or None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Google sign-in | 1. Click Google on the Login page. 2. Complete the Google popup. |
The user is signed in and redirected to /dashboard. |
PASS |
The one-time credential is cleared after use. |
| Google popup cancelled | 1. Open the Google popup and close it. | No session is created; the loading state resets after a short delay. | PASS |
|
| Microsoft sign-in | 1. Click Microsoft. 2. Complete the provider sign-in and callback. |
The user is signed in and redirected to /dashboard. |
PASS |
Redirect-based OAuth flow. |
| Apple sign-in | 1. Click Apple. 2. Complete the Apple popup. |
The user is signed in and redirected to /dashboard. |
PASS |
|
| Provider failure | 1. Complete a provider flow that the backend rejects. | A "Social Login Failed"/"Login Error" notification is shown and no session is created. | PASS |
|
| Concurrent sign-in | 1. Start one provider flow and attempt another. | Social buttons are disabled while a sign-in is in progress. | PASS |
|
| Facebook button | 1. Inspect the Login page for a Facebook button. | No Facebook option is rendered in this release. | PASS |
See observations. |
Tester notes
Record actual result, test data identifiers, device/browser/build, and any variance.
RPP-AUTH-16 — Password security controls¶
Feature overview¶
Password fields enforce a minimum of eight characters, display a live strength indicator, and offer a strong-password generator with a copy action. Confirmation fields must match the chosen password.
Preconditions
- A page with a password field, such as Registration, Forgot/Reset Password, or Change Password.
| Field | Value |
|---|---|
| Priority | Medium |
| Test action | Exercise the password generator, strength indicator, length rule, and confirmation matching. |
| Expected result | Weak passwords are flagged, strong generation works, and length/match rules block submission. |
| Execution result | PASS |
| Evidence reference | Insert link or reference |
| Defect reference | Insert ID or None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Minimum length | 1. Enter a password shorter than 8 characters. | Field error "Password must be at least 8 characters long" is shown. | PASS |
|
| Strength indicator | 1. Enter passwords of increasing complexity. | The label and bar update live between Weak, Medium and Strong. | PASS |
Based on length, case, digits and symbols. |
| Password generator | 1. Click the generator (refresh) button. | An 8-character password containing uppercase, lowercase, digit and symbol is inserted. | PASS |
|
| Copy password | 1. Click the copy button on the generated password. | The password is copied and a "Copied!" confirmation appears. | PASS |
|
| Confirmation match | 1. Enter mismatched password and confirmation. | "Passwords do not match" error is shown. | PASS |
|
| Visibility toggle | 1. Use the eye toggle on any password field. | The password is shown or hidden. | PASS |
Tester notes
Record actual result, test data identifiers, device/browser/build, and any variance.