groombook/web
13
0
Fork 0
Code Issues 1 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

docs(UAT_PLAYBOOK.md): add TC-WEB-SSO-ROLE-* test cases for GRO-1822
CI / Test (pull_request) Successful in 15s
Details
CI / Lint & Typecheck (pull_request) Successful in 17s
Details
CI / Build & Push Docker Image (pull_request) Successful in 34s
Details

Browse Source 
Add section 5.4.3 covering role-based redirect after SSO login:
- Customer SSO → portal at / (not redirected to /admin)
- Staff SSO → redirect to /admin
- Impersonation bypass via ?sessionId= preserved
- Dev mode unaffected

Refs: GRO-1822
This commit is contained in:
Flea Flicker
2026-05-27 00:54:07 +00:00
parent 505904d8bd
commit 4213c1f2e7
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
UAT_PLAYBOOK.md
+9
View File
@@ -98,6 +98,15 @@ export const { signIn, signOut, useSession, changePassword } = authClient;
| TC-WEB-OOBE-4 | Admin panel accessible after setup | After completing OOBE, navigate to admin panel | Admin features accessible | 403 on admin panel, insufficient permissions |
| TC-WEB-OOBE-5 | SSO login during OOBE does not interfere | During fresh OOBE, attempt SSO login before completing setup | SSO login redirected appropriately, setup can still complete | Auto-provision creates staff prematurely, setup flow broken |
### 5.4.3 Role-Based Redirect After SSO Login (GRO-1822)
| # | Scenario | Steps | Pass Criteria | Fail Criteria |
|---|----------|-------|---------------|---------------|
| TC-WEB-SSO-ROLE-1 | Customer SSO redirects to portal | Sign in via Authentik as a **customer** account, return to app root `/` | Customer portal is displayed at `/`; URL stays at `/` | Redirects to `/admin`, customer cannot access portal |
| TC-WEB-SSO-ROLE-2 | Staff SSO redirects to admin | Sign in via Authentik as a **staff** (groomer/manager/receptionist) account, return to app root `/` | Browser redirects to `/admin` | URL stays at `/`, staff cannot reach admin panel |
| TC-WEB-SSO-ROLE-3 | Impersonation bypasses role redirect | Append `?sessionId=<active-impersonation-id>` to any URL | Impersonation session activates; role redirect is skipped | Role redirect runs despite `?sessionId=`, impersonation blocked |
| TC-WEB-SSO-ROLE-4 | Dev mode unaffected | Set `AUTH_DISABLED=true`, load app, select a dev user | Dev login selector works; role redirect logic does not interfere | Dev login broken or redirected incorrectly |
### 5.5 Dashboard
| # | Scenario | Steps | Expected |