A R R R Associates
3810 lines
118 KiB
JSON
3810 lines
118 KiB
JSON
[
|
|
{
|
|
"Test ID": "GEN-001",
|
|
"Module": "Login & Session",
|
|
"Role / User": "All roles",
|
|
"Scenario": "Valid login redirects to correct workspace",
|
|
"Steps": "Login with System Admin, Firm Admin, Partner, Manager, Staff, Client and Consultant users.",
|
|
"Expected Result": "Each role lands on its correct dashboard/workspace without error.",
|
|
"Priority": "Critical",
|
|
"Type": "Smoke",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Common"
|
|
},
|
|
{
|
|
"Test ID": "GEN-002",
|
|
"Module": "Login & Session",
|
|
"Role / User": "Manager / Branch Manager",
|
|
"Scenario": "Manager direct landing",
|
|
"Steps": "Login as Manager / Branch Manager.",
|
|
"Expected Result": "User lands directly at /manager/dashboard.",
|
|
"Priority": "High",
|
|
"Type": "Regression",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Common"
|
|
},
|
|
{
|
|
"Test ID": "GEN-003",
|
|
"Module": "Login & Session",
|
|
"Role / User": "Partner",
|
|
"Scenario": "Partner direct landing",
|
|
"Steps": "Login as Partner.",
|
|
"Expected Result": "User lands at /partner/dashboard.",
|
|
"Priority": "High",
|
|
"Type": "Regression",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Common"
|
|
},
|
|
{
|
|
"Test ID": "GEN-004",
|
|
"Module": "Login & Session",
|
|
"Role / User": "Client",
|
|
"Scenario": "Client direct landing",
|
|
"Steps": "Login as Client portal user.",
|
|
"Expected Result": "User lands at /client/dashboard.",
|
|
"Priority": "High",
|
|
"Type": "Regression",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Common"
|
|
},
|
|
{
|
|
"Test ID": "GEN-005",
|
|
"Module": "Login & Session",
|
|
"Role / User": "Consultant",
|
|
"Scenario": "Consultant direct landing",
|
|
"Steps": "Login as Consultant.",
|
|
"Expected Result": "User lands at /consultant/dashboard.",
|
|
"Priority": "High",
|
|
"Type": "Regression",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Common"
|
|
},
|
|
{
|
|
"Test ID": "GEN-006",
|
|
"Module": "Header/Layout",
|
|
"Role / User": "All firm users",
|
|
"Scenario": "Header firm/branch display",
|
|
"Steps": "Open any page after login.",
|
|
"Expected Result": "Header shows Firm Name and Branch Name, not raw tenant/branch IDs.",
|
|
"Priority": "Medium",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Common"
|
|
},
|
|
{
|
|
"Test ID": "GEN-007",
|
|
"Module": "Sidebar",
|
|
"Role / User": "Staff",
|
|
"Scenario": "Staff menu restriction",
|
|
"Steps": "Login as normal staff and view sidebar.",
|
|
"Expected Result": "Core Setup, Platform/Documents, full Documents agent menu and firm admin menus are hidden.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Common"
|
|
},
|
|
{
|
|
"Test ID": "GEN-008",
|
|
"Module": "Sidebar",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "Menu order",
|
|
"Steps": "Login as Firm Admin and verify sidebar order.",
|
|
"Expected Result": "Order is My Workspace, Team Workspace, Billing, Team Administration, Firm Administration, Core Setup as applicable.",
|
|
"Priority": "Medium",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Common"
|
|
},
|
|
{
|
|
"Test ID": "GEN-009",
|
|
"Module": "Alerts",
|
|
"Role / User": "All roles",
|
|
"Scenario": "Alert page access",
|
|
"Steps": "Open /alerts.",
|
|
"Expected Result": "User sees only their own alerts and can mark as read.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Common"
|
|
},
|
|
{
|
|
"Test ID": "GEN-010",
|
|
"Module": "Alerts",
|
|
"Role / User": "All roles",
|
|
"Scenario": "Popup polling",
|
|
"Steps": "Keep any page open while unread alert exists or create new alert.",
|
|
"Expected Result": "Toast popup appears and unread count logic works without showing top header Alerts button.",
|
|
"Priority": "Medium",
|
|
"Type": "Regression",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Common"
|
|
},
|
|
{
|
|
"Test ID": "GEN-011",
|
|
"Module": "CSRF",
|
|
"Role / User": "All roles",
|
|
"Scenario": "HTML POST CSRF",
|
|
"Steps": "Submit key forms with missing/invalid CSRF token.",
|
|
"Expected Result": "Request is rejected or redirected safely; no data change.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Common"
|
|
},
|
|
{
|
|
"Test ID": "GEN-012",
|
|
"Module": "Unauthorized URL access",
|
|
"Role / User": "All roles",
|
|
"Scenario": "Direct URL access control",
|
|
"Steps": "Paste URLs for another role directly.",
|
|
"Expected Result": "User is denied or redirected; no restricted data shown.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Common"
|
|
},
|
|
{
|
|
"Test ID": "GEN-013",
|
|
"Module": "Validation",
|
|
"Role / User": "All roles",
|
|
"Scenario": "Blank/invalid form submission",
|
|
"Steps": "Submit blank or invalid forms on key pages.",
|
|
"Expected Result": "Clear validation error shown; no server 500.",
|
|
"Priority": "Medium",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Common"
|
|
},
|
|
{
|
|
"Test ID": "GEN-014",
|
|
"Module": "Audit / Logs",
|
|
"Role / User": "All roles",
|
|
"Scenario": "Permission denied events logged",
|
|
"Steps": "Attempt blocked action and check audit log.",
|
|
"Expected Result": "Event logged correctly without exposing secrets.",
|
|
"Priority": "Medium",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Common"
|
|
},
|
|
{
|
|
"Test ID": "GEN-015",
|
|
"Module": "Search / Filter",
|
|
"Role / User": "All roles",
|
|
"Scenario": "List page search, filter, pagination",
|
|
"Steps": "Use search/filter/pagination on client, employee, service list pages.",
|
|
"Expected Result": "Works without data leakage across tenant/branch.",
|
|
"Priority": "Medium",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Common"
|
|
},
|
|
{
|
|
"Test ID": "GEN-016",
|
|
"Module": "Imports",
|
|
"Role / User": "All roles",
|
|
"Scenario": "Upload invalid Excel/file on any import",
|
|
"Steps": "Upload malformed or wrong-format file on any import screen.",
|
|
"Expected Result": "Rejected with row-level errors; no partial commit.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Common"
|
|
},
|
|
{
|
|
"Test ID": "CL-001",
|
|
"Module": "Clients",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "Create firm-managed client",
|
|
"Steps": "Create client from Firm Admin with PAN/GSTIN/contact/address/branch/partner.",
|
|
"Expected Result": "Client is created under active firm/branch and appears in client list.",
|
|
"Priority": "Critical",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Clients"
|
|
},
|
|
{
|
|
"Test ID": "CL-002",
|
|
"Module": "Clients",
|
|
"Role / User": "Partner",
|
|
"Scenario": "Create partner client",
|
|
"Steps": "Create client as Partner.",
|
|
"Expected Result": "Client is linked to same firm and partner by default/available partner logic.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Clients"
|
|
},
|
|
{
|
|
"Test ID": "CL-003",
|
|
"Module": "Clients",
|
|
"Role / User": "System Admin",
|
|
"Scenario": "Cross-tenant client view",
|
|
"Steps": "Login as System Admin and view clients.",
|
|
"Expected Result": "Can view all clients across tenants where designed, with clear firm context.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Clients"
|
|
},
|
|
{
|
|
"Test ID": "CL-004",
|
|
"Module": "Clients",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "No cross-tenant client leakage",
|
|
"Steps": "Login as Firm Admin and view clients.",
|
|
"Expected Result": "Only clients belonging to that firm are visible.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Clients"
|
|
},
|
|
{
|
|
"Test ID": "CL-005",
|
|
"Module": "Clients",
|
|
"Role / User": "Partner",
|
|
"Scenario": "Partner scoping",
|
|
"Steps": "Login as Partner and view clients.",
|
|
"Expected Result": "Partner sees own assigned clients only unless higher permission exists.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Clients"
|
|
},
|
|
{
|
|
"Test ID": "CL-006",
|
|
"Module": "Clients",
|
|
"Role / User": "Staff",
|
|
"Scenario": "Staff client visibility",
|
|
"Steps": "Login as staff and access client list/direct client URL.",
|
|
"Expected Result": "Staff only sees clients linked through assigned work or is blocked as per permission.",
|
|
"Priority": "High",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Clients"
|
|
},
|
|
{
|
|
"Test ID": "CL-007",
|
|
"Module": "Clients",
|
|
"Role / User": "Consultant",
|
|
"Scenario": "Consultant client visibility",
|
|
"Steps": "Login as Consultant and view clients.",
|
|
"Expected Result": "Consultant sees only linked consultant clients.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Clients"
|
|
},
|
|
{
|
|
"Test ID": "CL-008",
|
|
"Module": "Clients",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "Client user auto-creation",
|
|
"Steps": "Create client with valid email.",
|
|
"Expected Result": "Client portal user is mandatorily created/linked as per current business logic.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Clients"
|
|
},
|
|
{
|
|
"Test ID": "CL-009",
|
|
"Module": "Clients",
|
|
"Role / User": "Client",
|
|
"Scenario": "Client portal login after creation",
|
|
"Steps": "Login as auto-created client user or invite-created user.",
|
|
"Expected Result": "Client can access /client/dashboard and sees only own compliance/documents/messages.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Clients"
|
|
},
|
|
{
|
|
"Test ID": "CL-010",
|
|
"Module": "Clients",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "PAN validation by entity type",
|
|
"Steps": "Create client with various entity types and PAN formats.",
|
|
"Expected Result": "PAN validation accepts/rejects correctly per entity.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Clients"
|
|
},
|
|
{
|
|
"Test ID": "CL-011",
|
|
"Module": "Clients",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "GSTIN validation state/PAN format",
|
|
"Steps": "Enter GSTIN values.",
|
|
"Expected Result": "GSTIN validated for state code and embedded PAN match.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Clients"
|
|
},
|
|
{
|
|
"Test ID": "CL-012",
|
|
"Module": "Clients",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "Additional fields save",
|
|
"Steps": "Fill CIN/LLPIN/TAN/MSME/IEC/alternate mobile/email/risk category/onboarding date.",
|
|
"Expected Result": "All fields saved correctly and appear in detail view.",
|
|
"Priority": "Medium",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Clients"
|
|
},
|
|
{
|
|
"Test ID": "CL-013",
|
|
"Module": "Clients",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "Bulk import clients",
|
|
"Steps": "Upload valid client import file.",
|
|
"Expected Result": "Clients are imported with tenant/branch/partner scope and validation errors shown.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Clients"
|
|
},
|
|
{
|
|
"Test ID": "CL-014",
|
|
"Module": "Clients",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "Duplicate client protection",
|
|
"Steps": "Try duplicate PAN/GSTIN/client code within firm.",
|
|
"Expected Result": "System prevents duplicate or shows clear validation message.",
|
|
"Priority": "High",
|
|
"Type": "Negative",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Clients"
|
|
},
|
|
{
|
|
"Test ID": "CL-015",
|
|
"Module": "Clients",
|
|
"Role / User": "Client",
|
|
"Scenario": "Client profile update restriction",
|
|
"Steps": "Client tries to edit restricted firm-controlled fields.",
|
|
"Expected Result": "Only permitted profile/contact fields are editable; internal classification remains protected.",
|
|
"Priority": "High",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Clients"
|
|
},
|
|
{
|
|
"Test ID": "SVC-001",
|
|
"Module": "Services",
|
|
"Role / User": "System Admin",
|
|
"Scenario": "Create service catalogue",
|
|
"Steps": "Create service category and catalogue service.",
|
|
"Expected Result": "Catalogue service is created and visible system-wide.",
|
|
"Priority": "Critical",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Services"
|
|
},
|
|
{
|
|
"Test ID": "SVC-002",
|
|
"Module": "Services",
|
|
"Role / User": "System Admin",
|
|
"Scenario": "Import service catalogue and default tasks",
|
|
"Steps": "Use service import/bulk import if enabled.",
|
|
"Expected Result": "Catalogue and default task templates are imported with validation.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Services"
|
|
},
|
|
{
|
|
"Test ID": "SVC-003",
|
|
"Module": "Services",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "View service catalogue",
|
|
"Steps": "Open /services/catalogue.",
|
|
"Expected Result": "Firm Admin can view catalogue without 303 redirect/permission error.",
|
|
"Priority": "Critical",
|
|
"Type": "Regression",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Services"
|
|
},
|
|
{
|
|
"Test ID": "SVC-004",
|
|
"Module": "Services",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "Select service for firm",
|
|
"Steps": "From catalogue/list/detail click Select for Firm.",
|
|
"Expected Result": "Service becomes enabled for firm and appears in Firm Services.",
|
|
"Priority": "Critical",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Services"
|
|
},
|
|
{
|
|
"Test ID": "SVC-005",
|
|
"Module": "Services",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "Disable service for firm",
|
|
"Steps": "Disable previously selected firm service.",
|
|
"Expected Result": "Service is inactive/disabled for firm but catalogue remains unchanged.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Services"
|
|
},
|
|
{
|
|
"Test ID": "SVC-006",
|
|
"Module": "Services",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "Customize firm tasks",
|
|
"Steps": "Open /services/templates/{catalogue_id}.",
|
|
"Expected Result": "Firm Admin can copy default tasks and add/edit firm-level templates.",
|
|
"Priority": "Critical",
|
|
"Type": "Regression",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Services"
|
|
},
|
|
{
|
|
"Test ID": "SVC-007",
|
|
"Module": "Services",
|
|
"Role / User": "Partner",
|
|
"Scenario": "Partner task template access",
|
|
"Steps": "Open firm task templates as Partner if permitted.",
|
|
"Expected Result": "Partner can view/customise only permitted firm task templates.",
|
|
"Priority": "Medium",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Services"
|
|
},
|
|
{
|
|
"Test ID": "SVC-008",
|
|
"Module": "Services",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "System-only controls hidden",
|
|
"Steps": "Check Create Catalogue Service/System Default Tasks.",
|
|
"Expected Result": "These actions are hidden/blocked for Firm Admin; System Admin only.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Services"
|
|
},
|
|
{
|
|
"Test ID": "SVC-009",
|
|
"Module": "Services",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "Service categories view",
|
|
"Steps": "Open /services/categories.",
|
|
"Expected Result": "Firm Admin can view categories; creation/edit remains System Admin only.",
|
|
"Priority": "Medium",
|
|
"Type": "Regression",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Services"
|
|
},
|
|
{
|
|
"Test ID": "SVC-010",
|
|
"Module": "Services",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "Client service assignment",
|
|
"Steps": "Assign firm-enabled services to one or more clients.",
|
|
"Expected Result": "Subscriptions are created with correct firm/branch/client scope.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Services"
|
|
},
|
|
{
|
|
"Test ID": "SVC-011",
|
|
"Module": "Services",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "Bulk service assignment",
|
|
"Steps": "Import client-service assignment file.",
|
|
"Expected Result": "Rows validate service enabled status, client scope and duplicates.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Services"
|
|
},
|
|
{
|
|
"Test ID": "SVC-012",
|
|
"Module": "Services",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "Task template detail page",
|
|
"Steps": "Open /services/templates/2 or valid id.",
|
|
"Expected Result": "Page renders task template detail, not engagement detail; no 'row undefined' error.",
|
|
"Priority": "Critical",
|
|
"Type": "Regression",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Services"
|
|
},
|
|
{
|
|
"Test ID": "SVC-013",
|
|
"Module": "Services",
|
|
"Role / User": "Partner/Staff",
|
|
"Scenario": "Access as per permission",
|
|
"Steps": "Access service management pages with different roles.",
|
|
"Expected Result": "Each role sees only permitted actions; write actions blocked for read-only roles.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Services"
|
|
},
|
|
{
|
|
"Test ID": "SVC-014",
|
|
"Module": "Services",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "Duplicate subscription prevention",
|
|
"Steps": "Assign same service to same client twice.",
|
|
"Expected Result": "Prevented or handled safely with validation message.",
|
|
"Priority": "High",
|
|
"Type": "Negative",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Services"
|
|
},
|
|
{
|
|
"Test ID": "WK-001",
|
|
"Module": "Staff Workspace",
|
|
"Role / User": "Staff",
|
|
"Scenario": "My Workspace dashboard",
|
|
"Steps": "Open /employee/dashboard.",
|
|
"Expected Result": "Dashboard shows workspace tabs and no duplicate unnecessary buttons.",
|
|
"Priority": "Medium",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Workspaces"
|
|
},
|
|
{
|
|
"Test ID": "WK-002",
|
|
"Module": "Staff Workspace",
|
|
"Role / User": "Staff",
|
|
"Scenario": "My Work board",
|
|
"Steps": "Open /employee/work.",
|
|
"Expected Result": "Assigned work appears in Pending/In Progress/Blocked/Completed grouping.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Workspaces"
|
|
},
|
|
{
|
|
"Test ID": "WK-003",
|
|
"Module": "Unified Work Detail",
|
|
"Role / User": "Staff",
|
|
"Scenario": "Open work detail",
|
|
"Steps": "Click work card to /work/engagements/{id}.",
|
|
"Expected Result": "Staff sees own tasks, documents side panel and permitted communication.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Workspaces"
|
|
},
|
|
{
|
|
"Test ID": "WK-004",
|
|
"Module": "Unified Work Detail",
|
|
"Role / User": "Manager",
|
|
"Scenario": "Manager open work detail",
|
|
"Steps": "Click team work card.",
|
|
"Expected Result": "Manager sees team assignment view and permitted status/priority updates.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Workspaces"
|
|
},
|
|
{
|
|
"Test ID": "WK-005",
|
|
"Module": "Unified Work Detail",
|
|
"Role / User": "Partner",
|
|
"Scenario": "Partner open engagement detail",
|
|
"Steps": "Click review board item.",
|
|
"Expected Result": "Partner sees engagement wording, tasks, documents, review actions if implemented.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Workspaces"
|
|
},
|
|
{
|
|
"Test ID": "WK-006",
|
|
"Module": "Unified Work Detail",
|
|
"Role / User": "Client",
|
|
"Scenario": "Client open compliance/service detail",
|
|
"Steps": "Click compliance item.",
|
|
"Expected Result": "Client sees service/compliance-safe data only, no internal notes.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Workspaces"
|
|
},
|
|
{
|
|
"Test ID": "WK-007",
|
|
"Module": "Unified Work Detail",
|
|
"Role / User": "Consultant",
|
|
"Scenario": "Consultant open assignment detail",
|
|
"Steps": "Click consultant assignment.",
|
|
"Expected Result": "Consultant sees only referred/shared work and shared documents.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Workspaces"
|
|
},
|
|
{
|
|
"Test ID": "WK-008",
|
|
"Module": "Documents",
|
|
"Role / User": "Staff/Manager/Partner",
|
|
"Scenario": "Engagement documents side panel",
|
|
"Steps": "Open unified detail with documents.",
|
|
"Expected Result": "Relevant engagement documents appear; downloads respect permission and role visibility.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Workspaces"
|
|
},
|
|
{
|
|
"Test ID": "WK-009",
|
|
"Module": "Communication",
|
|
"Role / User": "All roles",
|
|
"Scenario": "Communication visibility",
|
|
"Steps": "Add internal/client/consultant comments.",
|
|
"Expected Result": "Internal notes hidden from client/consultant; client-visible notes visible to client only where allowed.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Workspaces"
|
|
},
|
|
{
|
|
"Test ID": "WK-010",
|
|
"Module": "Task Status",
|
|
"Role / User": "Staff",
|
|
"Scenario": "Task status update",
|
|
"Steps": "Move/update task status from detail page.",
|
|
"Expected Result": "Status saves and appears correctly on staff/manager/partner boards.",
|
|
"Priority": "High",
|
|
"Type": "Regression",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Workspaces"
|
|
},
|
|
{
|
|
"Test ID": "MP-001",
|
|
"Module": "Manager Workspace",
|
|
"Role / User": "Manager",
|
|
"Scenario": "Manager dashboard",
|
|
"Steps": "Open /manager/dashboard.",
|
|
"Expected Result": "Shows total, unassigned, in progress, blocked, overdue, completed and team snapshot.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Manager_Partner"
|
|
},
|
|
{
|
|
"Test ID": "MP-002",
|
|
"Module": "Manager Workspace",
|
|
"Role / User": "Manager",
|
|
"Scenario": "Team Work Board",
|
|
"Steps": "Open /manager/work.",
|
|
"Expected Result": "Shows team task columns and manager actions.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Manager_Partner"
|
|
},
|
|
{
|
|
"Test ID": "MP-003",
|
|
"Module": "Manager Workspace",
|
|
"Role / User": "Manager",
|
|
"Scenario": "Detailed Allocation",
|
|
"Steps": "Open /employees/work.",
|
|
"Expected Result": "Manager top tabs visible and active; allocation functions available.",
|
|
"Priority": "Medium",
|
|
"Type": "Regression",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Manager_Partner"
|
|
},
|
|
{
|
|
"Test ID": "MP-004",
|
|
"Module": "Manager Workspace",
|
|
"Role / User": "Manager",
|
|
"Scenario": "Engagement Progress",
|
|
"Steps": "Open /employees/progress.",
|
|
"Expected Result": "Manager top tabs visible; progress renders without get_db or row errors.",
|
|
"Priority": "High",
|
|
"Type": "Regression",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Manager_Partner"
|
|
},
|
|
{
|
|
"Test ID": "MP-005",
|
|
"Module": "Manager Workspace",
|
|
"Role / User": "Manager",
|
|
"Scenario": "Team attendance",
|
|
"Steps": "Open /employees/attendance.",
|
|
"Expected Result": "Manager can view team attendance only for permitted branch/team.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Manager_Partner"
|
|
},
|
|
{
|
|
"Test ID": "MP-006",
|
|
"Module": "Manager Workspace",
|
|
"Role / User": "Manager",
|
|
"Scenario": "Team leave",
|
|
"Steps": "Open /employees/leave.",
|
|
"Expected Result": "Manager can view/approve/act only within permitted branch/team.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Manager_Partner"
|
|
},
|
|
{
|
|
"Test ID": "MP-007",
|
|
"Module": "Partner Workspace",
|
|
"Role / User": "Partner",
|
|
"Scenario": "Partner dashboard",
|
|
"Steps": "Open /partner/dashboard.",
|
|
"Expected Result": "Partner dashboard summary loads.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Manager_Partner"
|
|
},
|
|
{
|
|
"Test ID": "MP-008",
|
|
"Module": "Partner Workspace",
|
|
"Role / User": "Partner",
|
|
"Scenario": "Review board",
|
|
"Steps": "Open /partner/reviews.",
|
|
"Expected Result": "Shows pending review, blocked and overdue engagement items.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Manager_Partner"
|
|
},
|
|
{
|
|
"Test ID": "MP-009",
|
|
"Module": "Partner Workspace",
|
|
"Role / User": "Partner",
|
|
"Scenario": "My Clients",
|
|
"Steps": "Open /partner/clients.",
|
|
"Expected Result": "Partner sees own client portfolio only unless higher permission exists.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Manager_Partner"
|
|
},
|
|
{
|
|
"Test ID": "MP-010",
|
|
"Module": "Partner Workspace",
|
|
"Role / User": "Partner",
|
|
"Scenario": "Review actions",
|
|
"Steps": "Approve/send rework/request clarification from engagement detail.",
|
|
"Expected Result": "Review note is saved to task communication and status updates correctly.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Manager_Partner"
|
|
},
|
|
{
|
|
"Test ID": "CON-001",
|
|
"Module": "Consultants",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "Create consultant",
|
|
"Steps": "Create consultant master/profile.",
|
|
"Expected Result": "Consultant user/profile is created/linked and visible in Consultant List.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Consultants_Leads"
|
|
},
|
|
{
|
|
"Test ID": "CON-002",
|
|
"Module": "Consultant Portal",
|
|
"Role / User": "Consultant",
|
|
"Scenario": "Consultant dashboard",
|
|
"Steps": "Login as consultant.",
|
|
"Expected Result": "Consultant lands at /consultant/dashboard with portal tabs.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Consultants_Leads"
|
|
},
|
|
{
|
|
"Test ID": "CON-003",
|
|
"Module": "Consultant Portal",
|
|
"Role / User": "Consultant",
|
|
"Scenario": "My Work Board",
|
|
"Steps": "Open /consultant/work.",
|
|
"Expected Result": "Only referred/assigned consultant-visible tasks appear.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Consultants_Leads"
|
|
},
|
|
{
|
|
"Test ID": "CON-004",
|
|
"Module": "Consultant Portal",
|
|
"Role / User": "Consultant",
|
|
"Scenario": "Assignment detail",
|
|
"Steps": "Open /consultant/assignments/{task_id} or unified detail link.",
|
|
"Expected Result": "Consultant can view assignment and submit reply/update without internal data exposure.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Consultants_Leads"
|
|
},
|
|
{
|
|
"Test ID": "CON-005",
|
|
"Module": "Consultant Portal",
|
|
"Role / User": "Consultant",
|
|
"Scenario": "Shared documents",
|
|
"Steps": "Open /consultant/documents.",
|
|
"Expected Result": "Only shared/allowed documents are listed.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Consultants_Leads"
|
|
},
|
|
{
|
|
"Test ID": "CON-006",
|
|
"Module": "Consultants",
|
|
"Role / User": "Consultant",
|
|
"Scenario": "Service request/lead creation",
|
|
"Steps": "Consultant creates service request/lead for a client needing audit/filing from firm.",
|
|
"Expected Result": "Lead/request is captured and visible to firm in Consultant Service Requests.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Consultants_Leads"
|
|
},
|
|
{
|
|
"Test ID": "CON-007",
|
|
"Module": "Consultants",
|
|
"Role / User": "Firm Admin/Partner",
|
|
"Scenario": "Lead conversion",
|
|
"Steps": "Firm reviews consultant-generated service request and converts/links it to client/service/engagement.",
|
|
"Expected Result": "Conversion request status updates and no duplicate client is created unless intentionally approved.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Consultants_Leads"
|
|
},
|
|
{
|
|
"Test ID": "CON-008",
|
|
"Module": "Consultants",
|
|
"Role / User": "Consultant",
|
|
"Scenario": "Bookkeeping client to audit firm referral",
|
|
"Steps": "Consultant managing bookkeeping refers same client to audit firm for audit.",
|
|
"Expected Result": "Firm receives referral; consultant cannot access audit engagement unless shared.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Consultants_Leads"
|
|
},
|
|
{
|
|
"Test ID": "CON-009",
|
|
"Module": "Consultants",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "Consultant menu entries",
|
|
"Steps": "Open Firm Administration \u2192 Consultants.",
|
|
"Expected Result": "Consultant List, Add Consultant, Service Requests, Conversions are available if permissions allow.",
|
|
"Priority": "Medium",
|
|
"Type": "Regression",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Consultants_Leads"
|
|
},
|
|
{
|
|
"Test ID": "CON-010",
|
|
"Module": "Consultants",
|
|
"Role / User": "Negative",
|
|
"Scenario": "Cross-client consultant leakage",
|
|
"Steps": "Consultant attempts direct URL to another consultant/client assignment.",
|
|
"Expected Result": "Access blocked or returns not found.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Consultants_Leads"
|
|
},
|
|
{
|
|
"Test ID": "CON-011",
|
|
"Module": "Consultants",
|
|
"Role / User": "Consultant",
|
|
"Scenario": "Consultant cannot edit plan/limits",
|
|
"Steps": "Attempt to edit firm plan or conversion limits as Consultant.",
|
|
"Expected Result": "Blocked; only Firm Admin can manage these.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Consultants_Leads"
|
|
},
|
|
{
|
|
"Test ID": "CON-012",
|
|
"Module": "Consultants",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "Duplicate consultant email/mobile",
|
|
"Steps": "Try creating consultant with duplicate email/mobile.",
|
|
"Expected Result": "Validation warning or prevention shown.",
|
|
"Priority": "Medium",
|
|
"Type": "Negative",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Consultants_Leads"
|
|
},
|
|
{
|
|
"Test ID": "CON-013",
|
|
"Module": "Consultants",
|
|
"Role / User": "Staff/Client",
|
|
"Scenario": "Staff or client direct access to consultant admin URL",
|
|
"Steps": "Login as Staff or Client and open /consultants admin URLs.",
|
|
"Expected Result": "Blocked; unauthorized access redirected.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Consultants_Leads"
|
|
},
|
|
{
|
|
"Test ID": "CON-014",
|
|
"Module": "Consultants",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "Approve/reject service request with notes",
|
|
"Steps": "Review service request and approve or reject with reason.",
|
|
"Expected Result": "Status and reason saved correctly.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Consultants_Leads"
|
|
},
|
|
{
|
|
"Test ID": "CON-015",
|
|
"Module": "Consultants",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "Approve/reject conversion request",
|
|
"Steps": "Firm approves or rejects conversion.",
|
|
"Expected Result": "Firm client created/linked or rejected without duplicates.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Consultants_Leads"
|
|
},
|
|
{
|
|
"Test ID": "CP-001",
|
|
"Module": "Client Portal",
|
|
"Role / User": "Client",
|
|
"Scenario": "Client dashboard",
|
|
"Steps": "Open /client/dashboard.",
|
|
"Expected Result": "Overview shows compliance summary and portal tabs.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Client_Portal"
|
|
},
|
|
{
|
|
"Test ID": "CP-002",
|
|
"Module": "Client Portal",
|
|
"Role / User": "Client",
|
|
"Scenario": "My Compliance",
|
|
"Steps": "Open /client/compliance.",
|
|
"Expected Result": "Shows Pending from Client / With Firm / Clarification Required / Filed Completed style statuses.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Client_Portal"
|
|
},
|
|
{
|
|
"Test ID": "CP-003",
|
|
"Module": "Client Portal",
|
|
"Role / User": "Client",
|
|
"Scenario": "Service detail",
|
|
"Steps": "Open /client/engagements/{id} or unified detail.",
|
|
"Expected Result": "Client sees service status, required actions, shared docs and messages only.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Client_Portal"
|
|
},
|
|
{
|
|
"Test ID": "CP-004",
|
|
"Module": "Client Portal",
|
|
"Role / User": "Client",
|
|
"Scenario": "Document upload/download",
|
|
"Steps": "Open /client/documents.",
|
|
"Expected Result": "Client can view/upload/download allowed documents; internal documents hidden.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Client_Portal"
|
|
},
|
|
{
|
|
"Test ID": "CP-005",
|
|
"Module": "Client Portal",
|
|
"Role / User": "Client",
|
|
"Scenario": "Messages",
|
|
"Steps": "Open /client/messages and reply to clarification.",
|
|
"Expected Result": "Reply is saved and visible to firm users with proper visibility.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Client_Portal"
|
|
},
|
|
{
|
|
"Test ID": "CP-006",
|
|
"Module": "Client Portal",
|
|
"Role / User": "Client",
|
|
"Scenario": "Profile",
|
|
"Steps": "Open /client/profile.",
|
|
"Expected Result": "Profile loads with client tabs and permitted fields only.",
|
|
"Priority": "Medium",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Client_Portal"
|
|
},
|
|
{
|
|
"Test ID": "CP-007",
|
|
"Module": "Client Portal",
|
|
"Role / User": "Client",
|
|
"Scenario": "Alerts",
|
|
"Steps": "Open /alerts from client portal.",
|
|
"Expected Result": "Only client alerts shown.",
|
|
"Priority": "High",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Client_Portal"
|
|
},
|
|
{
|
|
"Test ID": "EMP-001",
|
|
"Module": "Employees",
|
|
"Role / User": "Firm Admin/Manager",
|
|
"Scenario": "Create employee",
|
|
"Steps": "Create staff/manager/partner-linked employee.",
|
|
"Expected Result": "Employee profile and user relationship is created as per business logic.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Employees"
|
|
},
|
|
{
|
|
"Test ID": "EMP-002",
|
|
"Module": "Employees",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "Create employee with linked user",
|
|
"Steps": "Create employee and link to existing user.",
|
|
"Expected Result": "User linked correctly.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Employees"
|
|
},
|
|
{
|
|
"Test ID": "EMP-003",
|
|
"Module": "Employees",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "Filter linked/unlinked employees",
|
|
"Steps": "Use filter on employee list.",
|
|
"Expected Result": "Shows correct filtered set.",
|
|
"Priority": "Medium",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Employees"
|
|
},
|
|
{
|
|
"Test ID": "EMP-004",
|
|
"Module": "Employees",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "Change employee status",
|
|
"Steps": "Change status to active/inactive/relieved.",
|
|
"Expected Result": "Status updated and access adjusted accordingly.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Employees"
|
|
},
|
|
{
|
|
"Test ID": "EMP-005",
|
|
"Module": "Employees",
|
|
"Role / User": "Staff",
|
|
"Scenario": "My profile",
|
|
"Steps": "Open /employee/profile.",
|
|
"Expected Result": "Profile opens with My Workspace top menu and no page compression.",
|
|
"Priority": "Medium",
|
|
"Type": "Regression",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Employees"
|
|
},
|
|
{
|
|
"Test ID": "EMP-006",
|
|
"Module": "Employees",
|
|
"Role / User": "Staff",
|
|
"Scenario": "My Workspace dashboard",
|
|
"Steps": "Open /employee/dashboard.",
|
|
"Expected Result": "Dashboard loads with workspace tabs.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Employees"
|
|
},
|
|
{
|
|
"Test ID": "EMP-007",
|
|
"Module": "Employees",
|
|
"Role / User": "Staff",
|
|
"Scenario": "My attendance",
|
|
"Steps": "Open /employee/attendance and punch in/out.",
|
|
"Expected Result": "Location permission prompt/geolocation flow works if configured; timestamps show correctly.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Employees"
|
|
},
|
|
{
|
|
"Test ID": "EMP-008",
|
|
"Module": "Employees",
|
|
"Role / User": "Staff",
|
|
"Scenario": "My leave",
|
|
"Steps": "Open /employee/leave.",
|
|
"Expected Result": "Workspace tabs visible; no unnecessary buttons.",
|
|
"Priority": "Medium",
|
|
"Type": "Regression",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Employees"
|
|
},
|
|
{
|
|
"Test ID": "EMP-009",
|
|
"Module": "Employees",
|
|
"Role / User": "Manager",
|
|
"Scenario": "Employee master scoping",
|
|
"Steps": "Open /employees as Manager/Branch Manager.",
|
|
"Expected Result": "Manager sees employees only for permitted tenant/branch.",
|
|
"Priority": "High",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Employees"
|
|
},
|
|
{
|
|
"Test ID": "EMP-010",
|
|
"Module": "Employees",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "Leave types/balances",
|
|
"Steps": "Open leave setup/balances.",
|
|
"Expected Result": "Setup pages work and are visible under Team Administration as permitted.",
|
|
"Priority": "Medium",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Employees"
|
|
},
|
|
{
|
|
"Test ID": "EMP-011",
|
|
"Module": "Employees",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "Employee documents",
|
|
"Steps": "Open employee documents and document types.",
|
|
"Expected Result": "Employee HR documents are separate from engagement documents and permission-controlled.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Employees"
|
|
},
|
|
{
|
|
"Test ID": "EMP-012",
|
|
"Module": "Employees",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "Onboarding/offboarding",
|
|
"Steps": "Open employee lifecycle pages.",
|
|
"Expected Result": "Onboarding/offboarding flows render and permissions apply.",
|
|
"Priority": "Medium",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Employees"
|
|
},
|
|
{
|
|
"Test ID": "EMP-013",
|
|
"Module": "Payroll",
|
|
"Role / User": "Firm Admin/Allowed role",
|
|
"Scenario": "Payroll pages",
|
|
"Steps": "Open salary structures, runs, payslips.",
|
|
"Expected Result": "Visible only to payroll-permitted users and CRUD/actions work.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Employees"
|
|
},
|
|
{
|
|
"Test ID": "EMP-014",
|
|
"Module": "Employees",
|
|
"Role / User": "Staff",
|
|
"Scenario": "Forbidden HR pages",
|
|
"Steps": "Staff tries /employees or payroll admin URLs.",
|
|
"Expected Result": "Blocked/redirected without data leakage.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Employees"
|
|
},
|
|
{
|
|
"Test ID": "EMP-015",
|
|
"Module": "Attendance",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "Branch timezone saved",
|
|
"Steps": "Set branch timezone to Asia/Kolkata.",
|
|
"Expected Result": "Saved correctly and punch times reflect branch local time.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Employees"
|
|
},
|
|
{
|
|
"Test ID": "EMP-016",
|
|
"Module": "Attendance",
|
|
"Role / User": "Staff",
|
|
"Scenario": "Punch within geofence",
|
|
"Steps": "Employee punches within 100m geofence.",
|
|
"Expected Result": "Auto-approved.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Employees"
|
|
},
|
|
{
|
|
"Test ID": "EMP-017",
|
|
"Module": "Attendance",
|
|
"Role / User": "Staff",
|
|
"Scenario": "Punch outside geofence",
|
|
"Steps": "Employee punches outside 100m / geolocation denied.",
|
|
"Expected Result": "Marked pending approval / OD.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Employees"
|
|
},
|
|
{
|
|
"Test ID": "EMP-018",
|
|
"Module": "Attendance",
|
|
"Role / User": "Manager/Admin",
|
|
"Scenario": "Late/half-day/weekly-off rules",
|
|
"Steps": "Configure rules and create attendance records.",
|
|
"Expected Result": "Rules applied correctly.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Employees"
|
|
},
|
|
{
|
|
"Test ID": "EMP-019",
|
|
"Module": "Attendance",
|
|
"Role / User": "Manager/Admin",
|
|
"Scenario": "Approve OD",
|
|
"Steps": "Branch Manager/Partner/Admin approves OD request.",
|
|
"Expected Result": "Status approved.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Employees"
|
|
},
|
|
{
|
|
"Test ID": "EMP-020",
|
|
"Module": "Leave",
|
|
"Role / User": "Staff",
|
|
"Scenario": "Apply leave and balance validation",
|
|
"Steps": "Employee applies leave; balance checked.",
|
|
"Expected Result": "Request created; balance validated; error if insufficient.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Employees"
|
|
},
|
|
{
|
|
"Test ID": "EMP-021",
|
|
"Module": "Leave",
|
|
"Role / User": "Manager/Admin",
|
|
"Scenario": "Approve/reject leave",
|
|
"Steps": "Approve or reject leave request.",
|
|
"Expected Result": "Balance updated only on approval.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Employees"
|
|
},
|
|
{
|
|
"Test ID": "EMP-022",
|
|
"Module": "Payroll",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "Add salary structure",
|
|
"Steps": "Create salary structure for employee.",
|
|
"Expected Result": "Saved correctly.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Employees"
|
|
},
|
|
{
|
|
"Test ID": "EMP-023",
|
|
"Module": "Payroll",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "Generate payroll run and payslips",
|
|
"Steps": "Run payroll for a period.",
|
|
"Expected Result": "Payslips generated correctly.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Employees"
|
|
},
|
|
{
|
|
"Test ID": "EMP-024",
|
|
"Module": "Payroll",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "Approve and mark paid",
|
|
"Steps": "Approve payroll run and mark as paid.",
|
|
"Expected Result": "Status updated.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Employees"
|
|
},
|
|
{
|
|
"Test ID": "EMP-025",
|
|
"Module": "Payroll",
|
|
"Role / User": "Staff",
|
|
"Scenario": "Employee views own payslip only",
|
|
"Steps": "Staff opens payslip page.",
|
|
"Expected Result": "Only own payslips visible; other employee payslips blocked.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Employees"
|
|
},
|
|
{
|
|
"Test ID": "EMP-026",
|
|
"Module": "HR Imports",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "Download and upload employee/leave/payroll templates",
|
|
"Steps": "Download import template; upload with valid and invalid data.",
|
|
"Expected Result": "Preview, errors and commit work correctly.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Employees"
|
|
},
|
|
{
|
|
"Test ID": "EMP-027",
|
|
"Module": "Employees",
|
|
"Role / User": "Staff",
|
|
"Scenario": "Employee cannot access another employee document",
|
|
"Steps": "Staff tries direct URL to another employee HR document.",
|
|
"Expected Result": "Blocked.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Employees"
|
|
},
|
|
{
|
|
"Test ID": "WRK-001",
|
|
"Module": "Engagement Work",
|
|
"Role / User": "Staff",
|
|
"Scenario": "My Work board opens",
|
|
"Steps": "Open /employee/work.",
|
|
"Expected Result": "Assigned tasks appear grouped in Pending/In Progress/Blocked/Completed columns.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Work"
|
|
},
|
|
{
|
|
"Test ID": "WRK-002",
|
|
"Module": "Engagement Work",
|
|
"Role / User": "Staff",
|
|
"Scenario": "Grouped priority \u2192 client \u2192 engagement",
|
|
"Steps": "View My Work board task grouping.",
|
|
"Expected Result": "Correct priority \u2192 client \u2192 engagement grouping applied.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Work"
|
|
},
|
|
{
|
|
"Test ID": "WRK-003",
|
|
"Module": "Engagement Work",
|
|
"Role / User": "Staff",
|
|
"Scenario": "Expand/collapse sections",
|
|
"Steps": "Use expand/collapse on work board.",
|
|
"Expected Result": "Works without page error.",
|
|
"Priority": "Medium",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Work"
|
|
},
|
|
{
|
|
"Test ID": "WRK-004",
|
|
"Module": "Engagement Work",
|
|
"Role / User": "Staff",
|
|
"Scenario": "Search task/client/engagement",
|
|
"Steps": "Use search on work board.",
|
|
"Expected Result": "Results filtered correctly.",
|
|
"Priority": "Medium",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Work"
|
|
},
|
|
{
|
|
"Test ID": "WRK-005",
|
|
"Module": "Engagement Work",
|
|
"Role / User": "Staff",
|
|
"Scenario": "Employee updates own task status",
|
|
"Steps": "Change task status on My Work.",
|
|
"Expected Result": "Status updated and reflected on manager/partner boards.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Work"
|
|
},
|
|
{
|
|
"Test ID": "WRK-006",
|
|
"Module": "Engagement Work",
|
|
"Role / User": "Staff",
|
|
"Scenario": "Employee cannot update others' tasks",
|
|
"Steps": "Staff tries to change another employee's task status.",
|
|
"Expected Result": "Blocked.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Work"
|
|
},
|
|
{
|
|
"Test ID": "WRK-007",
|
|
"Module": "Allocation",
|
|
"Role / User": "Manager",
|
|
"Scenario": "Manager opens Work Allocation",
|
|
"Steps": "Open /employees/work.",
|
|
"Expected Result": "Team tasks visible; allocation actions available.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Work"
|
|
},
|
|
{
|
|
"Test ID": "WRK-008",
|
|
"Module": "Allocation",
|
|
"Role / User": "Manager",
|
|
"Scenario": "Manager assigns task to employee",
|
|
"Steps": "Assign/reassign task from allocation view.",
|
|
"Expected Result": "Assignee updated.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Work"
|
|
},
|
|
{
|
|
"Test ID": "WRK-009",
|
|
"Module": "Allocation",
|
|
"Role / User": "Manager",
|
|
"Scenario": "Manager changes priority/status/due date",
|
|
"Steps": "Update task priority, status and due date.",
|
|
"Expected Result": "Fields updated correctly.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Work"
|
|
},
|
|
{
|
|
"Test ID": "WRK-010",
|
|
"Module": "Progress",
|
|
"Role / User": "Manager",
|
|
"Scenario": "Progress dashboard opens",
|
|
"Steps": "Open /employees/progress.",
|
|
"Expected Result": "Client/engagement progress visible without errors.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Work"
|
|
},
|
|
{
|
|
"Test ID": "WRK-011",
|
|
"Module": "Progress",
|
|
"Role / User": "Manager",
|
|
"Scenario": "Progress percentage calculation",
|
|
"Steps": "Check progress percentages.",
|
|
"Expected Result": "Completed \u00f7 total tasks calculation correct.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Work"
|
|
},
|
|
{
|
|
"Test ID": "WRK-012",
|
|
"Module": "Progress",
|
|
"Role / User": "Manager",
|
|
"Scenario": "Overdue/due today filters",
|
|
"Steps": "Apply overdue and due-today filters.",
|
|
"Expected Result": "Correct results returned.",
|
|
"Priority": "Medium",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Work"
|
|
},
|
|
{
|
|
"Test ID": "WRK-013",
|
|
"Module": "Communication",
|
|
"Role / User": "All roles",
|
|
"Scenario": "Task communication timeline opens",
|
|
"Steps": "Open communication tab on work detail.",
|
|
"Expected Result": "Timeline visible with correct notes and timestamps.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Work"
|
|
},
|
|
{
|
|
"Test ID": "WRK-014",
|
|
"Module": "Communication",
|
|
"Role / User": "All roles",
|
|
"Scenario": "Add internal note/client clarification/partner note",
|
|
"Steps": "Add different comment types.",
|
|
"Expected Result": "Note saved with correct type/visibility; wrong-role notes hidden.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Work"
|
|
},
|
|
{
|
|
"Test ID": "WRK-015",
|
|
"Module": "Communication",
|
|
"Role / User": "All roles",
|
|
"Scenario": "Comment count/latest preview",
|
|
"Steps": "View comment count on work list/board.",
|
|
"Expected Result": "Shows correctly and updates after adding comment.",
|
|
"Priority": "Medium",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Work"
|
|
},
|
|
{
|
|
"Test ID": "DOC-001",
|
|
"Module": "Storage Agent",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "Generate branch local storage agent",
|
|
"Steps": "Open /documents/storage-nodes and generate/download branch agent.",
|
|
"Expected Result": "Firm Admin can generate/download only for their permitted firm/branch.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Docs_Billing_Alerts"
|
|
},
|
|
{
|
|
"Test ID": "DOC-002",
|
|
"Module": "Storage Agent",
|
|
"Role / User": "Partner",
|
|
"Scenario": "Generate branch local storage agent",
|
|
"Steps": "Open /documents/storage-nodes as Partner.",
|
|
"Expected Result": "Partner can access only permitted branch agent flow if business rule allows.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Docs_Billing_Alerts"
|
|
},
|
|
{
|
|
"Test ID": "DOC-003",
|
|
"Module": "Documents",
|
|
"Role / User": "Staff",
|
|
"Scenario": "Full documents menu hidden",
|
|
"Steps": "Login as staff.",
|
|
"Expected Result": "Global documents menu/download agents are hidden; docs accessible only from My Docs/work detail.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Docs_Billing_Alerts"
|
|
},
|
|
{
|
|
"Test ID": "DOC-004",
|
|
"Module": "Documents",
|
|
"Role / User": "Client",
|
|
"Scenario": "Permanent documents",
|
|
"Steps": "Open client document list.",
|
|
"Expected Result": "Client sees/downloads only their own allowed permanent and engagement documents.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Docs_Billing_Alerts"
|
|
},
|
|
{
|
|
"Test ID": "BILL-001",
|
|
"Module": "Billing",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "Invoice list",
|
|
"Steps": "Open /billing.",
|
|
"Expected Result": "Invoices list loads within firm scope.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Docs_Billing_Alerts"
|
|
},
|
|
{
|
|
"Test ID": "BILL-002",
|
|
"Module": "Billing",
|
|
"Role / User": "Partner",
|
|
"Scenario": "Partner billing rights",
|
|
"Steps": "Partner generates invoice/bill for own client/engagement if permitted.",
|
|
"Expected Result": "Partner cannot bill other partner's clients unless permission exists.",
|
|
"Priority": "High",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Docs_Billing_Alerts"
|
|
},
|
|
{
|
|
"Test ID": "BILL-003",
|
|
"Module": "Billing",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "Fee structure import",
|
|
"Steps": "Download fee template and import fee structure.",
|
|
"Expected Result": "Import validates client/service mapping and creates fee structures.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Docs_Billing_Alerts"
|
|
},
|
|
{
|
|
"Test ID": "ALRT-001",
|
|
"Module": "Alerts Automation",
|
|
"Role / User": "Scheduler",
|
|
"Scenario": "Due today alert",
|
|
"Steps": "Create task due today and run/await scheduler.",
|
|
"Expected Result": "Assigned staff receives alert.",
|
|
"Priority": "Medium",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Docs_Billing_Alerts"
|
|
},
|
|
{
|
|
"Test ID": "ALRT-002",
|
|
"Module": "Alerts Automation",
|
|
"Role / User": "Scheduler",
|
|
"Scenario": "Overdue escalation",
|
|
"Steps": "Create overdue task by 1/3 days.",
|
|
"Expected Result": "Alert escalates to manager/partner according to rules.",
|
|
"Priority": "Medium",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Docs_Billing_Alerts"
|
|
},
|
|
{
|
|
"Test ID": "ALRT-003",
|
|
"Module": "Alerts Popup",
|
|
"Role / User": "All roles",
|
|
"Scenario": "Toast polling",
|
|
"Steps": "Keep page open after alert creation.",
|
|
"Expected Result": "Popup appears within polling interval; no visible header alert button required.",
|
|
"Priority": "Medium",
|
|
"Type": "Regression",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Docs_Billing_Alerts"
|
|
},
|
|
{
|
|
"Test ID": "TD-001",
|
|
"Module": "Task Level Documents",
|
|
"Role / User": "Firm Admin / Partner",
|
|
"Scenario": "Create document requirement in service task template",
|
|
"Steps": "Open Service Catalogue > Task Template > Add Document Requirement.",
|
|
"Expected Result": "Requirement is saved and displayed under the selected task template.",
|
|
"Priority": "Critical",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Task_Documents"
|
|
},
|
|
{
|
|
"Test ID": "TD-002",
|
|
"Module": "Task Level Documents",
|
|
"Role / User": "Firm Admin / Partner",
|
|
"Scenario": "Mark required document as mandatory",
|
|
"Steps": "Create/edit requirement and enable Mandatory.",
|
|
"Expected Result": "Mandatory flag is saved and visible.",
|
|
"Priority": "Critical",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Task_Documents"
|
|
},
|
|
{
|
|
"Test ID": "TD-003",
|
|
"Module": "Task Level Documents",
|
|
"Role / User": "Firm Admin / Partner",
|
|
"Scenario": "Mark required document as optional",
|
|
"Steps": "Create/edit requirement and disable Mandatory.",
|
|
"Expected Result": "Optional flag is saved and visible.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Task_Documents"
|
|
},
|
|
{
|
|
"Test ID": "TD-004",
|
|
"Module": "Task Level Documents",
|
|
"Role / User": "Firm Admin / Partner",
|
|
"Scenario": "Upload template attachment at task template level",
|
|
"Steps": "Upload DOCX/PDF/XLSX template against service task template.",
|
|
"Expected Result": "Template file is uploaded, listed, and downloadable.",
|
|
"Priority": "Critical",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Task_Documents"
|
|
},
|
|
{
|
|
"Test ID": "TD-005",
|
|
"Module": "Task Level Documents",
|
|
"Role / User": "Firm Admin / Partner",
|
|
"Scenario": "Edit document requirement",
|
|
"Steps": "Change document name/type/mandatory flag/allowed file types.",
|
|
"Expected Result": "Updated values are saved without affecting unrelated tasks.",
|
|
"Priority": "High",
|
|
"Type": "Regression",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Task_Documents"
|
|
},
|
|
{
|
|
"Test ID": "TD-006",
|
|
"Module": "Task Level Documents",
|
|
"Role / User": "Firm Admin / Partner",
|
|
"Scenario": "Delete/deactivate document requirement",
|
|
"Steps": "Delete/deactivate a test requirement.",
|
|
"Expected Result": "Requirement is removed/deactivated without deleting existing uploaded engagement documents.",
|
|
"Priority": "High",
|
|
"Type": "Regression",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Task_Documents"
|
|
},
|
|
{
|
|
"Test ID": "TD-007",
|
|
"Module": "Task Level Documents",
|
|
"Role / User": "Firm Admin / Partner",
|
|
"Scenario": "Create engagement from service with requirements",
|
|
"Steps": "Create engagement using service containing task document requirements.",
|
|
"Expected Result": "Engagement tasks are created and document requirements are available at task level.",
|
|
"Priority": "Critical",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Task_Documents"
|
|
},
|
|
{
|
|
"Test ID": "TD-008",
|
|
"Module": "Task Level Documents",
|
|
"Role / User": "Staff / Manager",
|
|
"Scenario": "Upload engagement task document",
|
|
"Steps": "Open engagement task document page and upload valid file.",
|
|
"Expected Result": "File is uploaded and linked to correct engagement task.",
|
|
"Priority": "Critical",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Task_Documents"
|
|
},
|
|
{
|
|
"Test ID": "TD-009",
|
|
"Module": "Task Level Documents",
|
|
"Role / User": "Staff / Manager",
|
|
"Scenario": "Upload multiple versions/documents",
|
|
"Steps": "Upload another file for same requirement/task.",
|
|
"Expected Result": "System records latest upload and preserves version history.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Task_Documents"
|
|
},
|
|
{
|
|
"Test ID": "TD-010",
|
|
"Module": "Task Level Documents",
|
|
"Role / User": "Authorized roles",
|
|
"Scenario": "Download uploaded task document",
|
|
"Steps": "Click download/view for uploaded task document.",
|
|
"Expected Result": "Correct file is downloaded; no wrong client/task file is served.",
|
|
"Priority": "Critical",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Task_Documents"
|
|
},
|
|
{
|
|
"Test ID": "TD-011",
|
|
"Module": "Task Level Documents",
|
|
"Role / User": "Staff",
|
|
"Scenario": "Staff task document upload permission",
|
|
"Steps": "Login as Staff and upload document for assigned/permitted task.",
|
|
"Expected Result": "Upload allowed only where permission and assignment/tenant scope permit.",
|
|
"Priority": "Critical",
|
|
"Type": "Permission",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Task_Documents"
|
|
},
|
|
{
|
|
"Test ID": "TD-012",
|
|
"Module": "Task Level Documents",
|
|
"Role / User": "Manager",
|
|
"Scenario": "Manager task document access",
|
|
"Steps": "Login as Manager and view/upload/download task documents.",
|
|
"Expected Result": "Manager can access only permitted branch/tenant task documents.",
|
|
"Priority": "Critical",
|
|
"Type": "Permission",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Task_Documents"
|
|
},
|
|
{
|
|
"Test ID": "TD-013",
|
|
"Module": "Task Level Documents",
|
|
"Role / User": "Client",
|
|
"Scenario": "Client upload restriction/permission",
|
|
"Steps": "Login as Client and attempt upload if client upload is enabled/disabled.",
|
|
"Expected Result": "Client upload follows configured permission; unauthorized action is blocked.",
|
|
"Priority": "High",
|
|
"Type": "Permission",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Task_Documents"
|
|
},
|
|
{
|
|
"Test ID": "TD-014",
|
|
"Module": "Task Level Documents",
|
|
"Role / User": "Staff / Manager",
|
|
"Scenario": "Mandatory document missing indicator",
|
|
"Steps": "Open task where mandatory document is not uploaded.",
|
|
"Expected Result": "Missing mandatory document is clearly shown/warned.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Task_Documents"
|
|
},
|
|
{
|
|
"Test ID": "TD-015",
|
|
"Module": "Task Level Documents",
|
|
"Role / User": "All upload roles",
|
|
"Scenario": "Invalid file type upload",
|
|
"Steps": "Try uploading unsupported extension such as .exe/.bat or invalid renamed file.",
|
|
"Expected Result": "Upload is blocked or rejected as per validation.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Task_Documents"
|
|
},
|
|
{
|
|
"Test ID": "TD-016",
|
|
"Module": "Task Level Documents",
|
|
"Role / User": "All upload roles",
|
|
"Scenario": "Large file upload validation",
|
|
"Steps": "Try uploading file beyond permitted size.",
|
|
"Expected Result": "System blocks or handles gracefully without crash.",
|
|
"Priority": "High",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Task_Documents"
|
|
},
|
|
{
|
|
"Test ID": "TD-017",
|
|
"Module": "Task Level Documents",
|
|
"Role / User": "Authorized roles",
|
|
"Scenario": "Delete task document",
|
|
"Steps": "Delete a test uploaded document if delete feature is enabled.",
|
|
"Expected Result": "Delete is permission controlled and audit/history is preserved where applicable.",
|
|
"Priority": "High",
|
|
"Type": "Permission",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Task_Documents"
|
|
},
|
|
{
|
|
"Test ID": "TD-018",
|
|
"Module": "Task Level Documents",
|
|
"Role / User": "System Admin / Firm Admin",
|
|
"Scenario": "Storage path generation",
|
|
"Steps": "Upload task document and verify stored path.",
|
|
"Expected Result": "Path follows FY/client/service/period/engagement/task document structure as designed.",
|
|
"Priority": "Critical",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Task_Documents"
|
|
},
|
|
{
|
|
"Test ID": "TD-019",
|
|
"Module": "Task Level Documents",
|
|
"Role / User": "System Admin / Firm Admin",
|
|
"Scenario": "Tenant isolation",
|
|
"Steps": "Attempt to view/download task document from another tenant by URL/id manipulation.",
|
|
"Expected Result": "Access is blocked; no data leakage.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Task_Documents"
|
|
},
|
|
{
|
|
"Test ID": "TD-020",
|
|
"Module": "Task Level Documents",
|
|
"Role / User": "Manager / Staff",
|
|
"Scenario": "Branch isolation",
|
|
"Steps": "Attempt to view/download task document from another branch.",
|
|
"Expected Result": "Access is blocked unless cross-branch permission exists.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Task_Documents"
|
|
},
|
|
{
|
|
"Test ID": "NC-001",
|
|
"Module": "Notice & Case Management",
|
|
"Role / User": "Firm Admin / Partner / Manager",
|
|
"Scenario": "Create GST notice case",
|
|
"Steps": "Open Notices & Cases > New and create GST notice.",
|
|
"Expected Result": "Case is created with client, department, reference number and due date.",
|
|
"Priority": "Critical",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Notice_Cases"
|
|
},
|
|
{
|
|
"Test ID": "NC-002",
|
|
"Module": "Notice & Case Management",
|
|
"Role / User": "Firm Admin / Partner / Manager",
|
|
"Scenario": "Create Income Tax notice case",
|
|
"Steps": "Create Income Tax notice/assessment case.",
|
|
"Expected Result": "Case is created and listed correctly.",
|
|
"Priority": "Critical",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Notice_Cases"
|
|
},
|
|
{
|
|
"Test ID": "NC-003",
|
|
"Module": "Notice & Case Management",
|
|
"Role / User": "Firm Admin / Partner / Manager",
|
|
"Scenario": "Create ROC case",
|
|
"Steps": "Create ROC/MCA case.",
|
|
"Expected Result": "Case is created and department/category is saved correctly.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Notice_Cases"
|
|
},
|
|
{
|
|
"Test ID": "NC-004",
|
|
"Module": "Notice & Case Management",
|
|
"Role / User": "Firm Admin / Partner",
|
|
"Scenario": "Create appeal case",
|
|
"Steps": "Create Appeal case linked to client/FY/AY where applicable.",
|
|
"Expected Result": "Appeal case is created with correct status and due date.",
|
|
"Priority": "Critical",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Notice_Cases"
|
|
},
|
|
{
|
|
"Test ID": "NC-005",
|
|
"Module": "Notice & Case Management",
|
|
"Role / User": "Firm Admin / Partner / Manager",
|
|
"Scenario": "Create rectification/refund/registration case",
|
|
"Steps": "Create non-notice case type.",
|
|
"Expected Result": "Case type is saved and appears in list/detail pages.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Notice_Cases"
|
|
},
|
|
{
|
|
"Test ID": "NC-006",
|
|
"Module": "Notice & Case Management",
|
|
"Role / User": "Firm Admin / Partner / Manager",
|
|
"Scenario": "Assign case to user",
|
|
"Steps": "Select assigned user in case form.",
|
|
"Expected Result": "Assignment is saved and visible in case detail/list.",
|
|
"Priority": "Critical",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Notice_Cases"
|
|
},
|
|
{
|
|
"Test ID": "NC-007",
|
|
"Module": "Notice & Case Management",
|
|
"Role / User": "All permitted roles",
|
|
"Scenario": "Due date tracking",
|
|
"Steps": "Create case with due date and check list/detail display.",
|
|
"Expected Result": "Due date is visible; overdue/upcoming indicator works if implemented.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Notice_Cases"
|
|
},
|
|
{
|
|
"Test ID": "NC-008",
|
|
"Module": "Notice & Case Management",
|
|
"Role / User": "Assigned user / Manager",
|
|
"Scenario": "Add timeline event",
|
|
"Steps": "Add event such as Notice Received / Reply Filed / Appeal Filed.",
|
|
"Expected Result": "Event appears in case timeline with date/user/remarks.",
|
|
"Priority": "Critical",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Notice_Cases"
|
|
},
|
|
{
|
|
"Test ID": "NC-009",
|
|
"Module": "Notice & Case Management",
|
|
"Role / User": "Assigned user / Manager",
|
|
"Scenario": "Add hearing",
|
|
"Steps": "Add hearing date, authority, mode and remarks.",
|
|
"Expected Result": "Hearing record is saved and displayed.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Notice_Cases"
|
|
},
|
|
{
|
|
"Test ID": "NC-010",
|
|
"Module": "Notice & Case Management",
|
|
"Role / User": "Assigned user / Manager",
|
|
"Scenario": "Add order",
|
|
"Steps": "Add order details/status/date/outcome.",
|
|
"Expected Result": "Order record is saved and displayed.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Notice_Cases"
|
|
},
|
|
{
|
|
"Test ID": "NC-011",
|
|
"Module": "Notice & Case Management",
|
|
"Role / User": "Assigned user / Manager",
|
|
"Scenario": "Upload case document",
|
|
"Steps": "Upload notice/reply/order/appeal PDF/DOCX.",
|
|
"Expected Result": "Document is uploaded and linked to correct case/event if applicable.",
|
|
"Priority": "Critical",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Notice_Cases"
|
|
},
|
|
{
|
|
"Test ID": "NC-012",
|
|
"Module": "Notice & Case Management",
|
|
"Role / User": "Authorized roles",
|
|
"Scenario": "Download case document",
|
|
"Steps": "Download uploaded case document.",
|
|
"Expected Result": "Correct document downloads; unauthorized access blocked.",
|
|
"Priority": "Critical",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Notice_Cases"
|
|
},
|
|
{
|
|
"Test ID": "NC-013",
|
|
"Module": "Notice & Case Management",
|
|
"Role / User": "Assigned user / Manager",
|
|
"Scenario": "Change case status",
|
|
"Steps": "Move case through Open/In Progress/Replied/Appealed/Closed etc.",
|
|
"Expected Result": "Status updates correctly without losing timeline/documents.",
|
|
"Priority": "Critical",
|
|
"Type": "Regression",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Notice_Cases"
|
|
},
|
|
{
|
|
"Test ID": "NC-014",
|
|
"Module": "Notice & Case Management",
|
|
"Role / User": "All permitted roles",
|
|
"Scenario": "Overdue case visibility",
|
|
"Steps": "Create/verify case with past due date and open list/dashboard.",
|
|
"Expected Result": "Overdue status is visible/highlighted if configured.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Notice_Cases"
|
|
},
|
|
{
|
|
"Test ID": "NC-015",
|
|
"Module": "Notice & Case Management",
|
|
"Role / User": "All permitted roles",
|
|
"Scenario": "Client-wise case listing",
|
|
"Steps": "Filter/search cases by client.",
|
|
"Expected Result": "Only selected client's cases are shown.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Notice_Cases"
|
|
},
|
|
{
|
|
"Test ID": "NC-016",
|
|
"Module": "Notice & Case Management",
|
|
"Role / User": "All permitted roles",
|
|
"Scenario": "Department-wise listing",
|
|
"Steps": "Filter by GST/Income Tax/ROC/PF/ESI/Other.",
|
|
"Expected Result": "Filtered results are correct.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Notice_Cases"
|
|
},
|
|
{
|
|
"Test ID": "NC-017",
|
|
"Module": "Notice & Case Management",
|
|
"Role / User": "All permitted roles",
|
|
"Scenario": "Search by reference number",
|
|
"Steps": "Search using notice/reference/order number.",
|
|
"Expected Result": "Correct case is found.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Notice_Cases"
|
|
},
|
|
{
|
|
"Test ID": "NC-018",
|
|
"Module": "Notice & Case Management",
|
|
"Role / User": "Manager / Staff",
|
|
"Scenario": "Branch visibility",
|
|
"Steps": "Access cases from different branch.",
|
|
"Expected Result": "Access is restricted as per branch permissions.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Notice_Cases"
|
|
},
|
|
{
|
|
"Test ID": "NC-019",
|
|
"Module": "Notice & Case Management",
|
|
"Role / User": "Firm Admin / System Admin",
|
|
"Scenario": "Tenant visibility",
|
|
"Steps": "Access cases from different tenant by URL/id manipulation.",
|
|
"Expected Result": "Access is blocked unless explicit cross-tenant permission exists.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Notice_Cases"
|
|
},
|
|
{
|
|
"Test ID": "NC-020",
|
|
"Module": "Notice & Case Management",
|
|
"Role / User": "Authorized roles",
|
|
"Scenario": "Delete/close case control",
|
|
"Steps": "Attempt delete/close case with different roles.",
|
|
"Expected Result": "Only authorized roles can delete/close; data integrity is maintained.",
|
|
"Priority": "Critical",
|
|
"Type": "Permission",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Notice_Cases"
|
|
},
|
|
{
|
|
"Test ID": "DOM-UAT-001",
|
|
"Module": "Sidebar/Menu",
|
|
"Role / User": "System Admin",
|
|
"Scenario": "System Admin sees Domain Configuration",
|
|
"Steps": "Login as System Admin; verify Platform menu opens and Domain Configuration section appears with all 6 child links.",
|
|
"Expected Result": "System Admin only",
|
|
"Priority": "Critical",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Domains"
|
|
},
|
|
{
|
|
"Test ID": "DOM-UAT-002",
|
|
"Module": "Sidebar/Menu",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "Firm Admin cannot see Domain Configuration",
|
|
"Steps": "Login as Firm Admin; verify Platform \u2192 Domain Configuration is hidden.",
|
|
"Expected Result": "Hidden",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Domains"
|
|
},
|
|
{
|
|
"Test ID": "DOM-UAT-003",
|
|
"Module": "Sidebar/Menu",
|
|
"Role / User": "Partner/Manager/Staff",
|
|
"Scenario": "Partner/Manager/Staff cannot see Domain Configuration",
|
|
"Steps": "Login as Partner, Manager and Staff; verify no domain management menu is visible.",
|
|
"Expected Result": "Hidden",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Domains"
|
|
},
|
|
{
|
|
"Test ID": "DOM-UAT-004",
|
|
"Module": "Routes",
|
|
"Role / User": "System Admin",
|
|
"Scenario": "Domain Mappings page opens",
|
|
"Steps": "Open /domains as System Admin; page should load without 404/500.",
|
|
"Expected Result": "System Admin",
|
|
"Priority": "Critical",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Domains"
|
|
},
|
|
{
|
|
"Test ID": "DOM-UAT-005",
|
|
"Module": "Routes",
|
|
"Role / User": "System Admin",
|
|
"Scenario": "Tenant Subdomains page opens",
|
|
"Steps": "Open /domains/tenant-subdomains.",
|
|
"Expected Result": "Page loads and shows tenant subdomain records/actions.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Domains"
|
|
},
|
|
{
|
|
"Test ID": "DOM-UAT-006",
|
|
"Module": "Routes",
|
|
"Role / User": "System Admin",
|
|
"Scenario": "Firm Domains page opens",
|
|
"Steps": "Open /domains/firm-domain.",
|
|
"Expected Result": "Page loads and firm-domain mapping UI visible.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Domains"
|
|
},
|
|
{
|
|
"Test ID": "DOM-UAT-007",
|
|
"Module": "Routes",
|
|
"Role / User": "System Admin",
|
|
"Scenario": "Consultant Domains page opens",
|
|
"Steps": "Open /domains/consultant-domains.",
|
|
"Expected Result": "Page loads and consultant-domain mapping UI visible.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Domains"
|
|
},
|
|
{
|
|
"Test ID": "DOM-UAT-008",
|
|
"Module": "Routes",
|
|
"Role / User": "System Admin",
|
|
"Scenario": "DNS Verification page opens",
|
|
"Steps": "Open /domains/verification.",
|
|
"Expected Result": "Page loads and shows DNS verification controls/status.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Domains"
|
|
},
|
|
{
|
|
"Test ID": "DOM-UAT-009",
|
|
"Module": "Routes",
|
|
"Role / User": "System Admin",
|
|
"Scenario": "SSL Status page opens",
|
|
"Steps": "Open /domains/ssl.",
|
|
"Expected Result": "Page loads and shows SSL status/actions.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Domains"
|
|
},
|
|
{
|
|
"Test ID": "DOM-UAT-010",
|
|
"Module": "Active State",
|
|
"Role / User": "System Admin",
|
|
"Scenario": "Correct menu item remains highlighted",
|
|
"Steps": "Open each /domains path; verify correct child item highlighted.",
|
|
"Expected Result": "Platform menu expanded; correct child highlighted.",
|
|
"Priority": "Medium",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Domains"
|
|
},
|
|
{
|
|
"Test ID": "DOM-UAT-011",
|
|
"Module": "No Regression",
|
|
"Role / User": "Existing roles",
|
|
"Scenario": "Existing Firm Administration menus unchanged",
|
|
"Steps": "Verify Services, Clients, Consultants, Email Settings, Branding, Local Storage links still appear.",
|
|
"Expected Result": "Existing menus intact.",
|
|
"Priority": "Critical",
|
|
"Type": "Regression",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Domains"
|
|
},
|
|
{
|
|
"Test ID": "DOM-UAT-012",
|
|
"Module": "No Regression",
|
|
"Role / User": "Existing roles",
|
|
"Scenario": "Existing Workspace menus unchanged",
|
|
"Steps": "Verify My Workspace, Partner Workspace, Team Workspace and Team Administration menus still appear.",
|
|
"Expected Result": "Existing menus intact.",
|
|
"Priority": "Critical",
|
|
"Type": "Regression",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Domains"
|
|
},
|
|
{
|
|
"Test ID": "DOM-UAT-013",
|
|
"Module": "No Regression",
|
|
"Role / User": "Existing roles",
|
|
"Scenario": "Existing Core Setup menu unchanged",
|
|
"Steps": "Verify System Settings, Audit Firms, Branches and Audit Logs remain accessible.",
|
|
"Expected Result": "Existing menus intact.",
|
|
"Priority": "High",
|
|
"Type": "Regression",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Domains"
|
|
},
|
|
{
|
|
"Test ID": "DOM-UAT-014",
|
|
"Module": "Template Safety",
|
|
"Role / User": "All logged-in users",
|
|
"Scenario": "layout.html renders after replacement",
|
|
"Steps": "Restart Uvicorn and open dashboard; verify no Jinja UndefinedError or syntax error.",
|
|
"Expected Result": "No Jinja error.",
|
|
"Priority": "Critical",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Domains"
|
|
},
|
|
{
|
|
"Test ID": "DOM-UAT-015",
|
|
"Module": "Access Control",
|
|
"Role / User": "Non-System Admin",
|
|
"Scenario": "Direct URL access blocked for non-System Admin",
|
|
"Steps": "Login as Firm Admin/Partner and open each /domains URL directly.",
|
|
"Expected Result": "403/redirect; not data exposure.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Domains"
|
|
},
|
|
{
|
|
"Test ID": "DOM-UAT-016",
|
|
"Module": "Tenant Safety",
|
|
"Role / User": "Firm Admin/Partner",
|
|
"Scenario": "Domain records not editable from firm context",
|
|
"Steps": "Verify Firm Admin/Partner cannot create/edit/delete platform domain mappings.",
|
|
"Expected Result": "Blocked.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Domains"
|
|
},
|
|
{
|
|
"Test ID": "DOM-UAT-017",
|
|
"Module": "Data Integrity",
|
|
"Role / User": "System Admin",
|
|
"Scenario": "Saving domain mapping does not affect tenant/branch context",
|
|
"Steps": "Create/update a mapping; verify normal pages still work.",
|
|
"Expected Result": "Tenant/branch context unaffected.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Domains"
|
|
},
|
|
{
|
|
"Test ID": "DOM-UAT-018",
|
|
"Module": "Validation",
|
|
"Role / User": "System Admin",
|
|
"Scenario": "Duplicate domain/subdomain validation",
|
|
"Steps": "Attempt to add duplicate domain/subdomain.",
|
|
"Expected Result": "Rejected or shows safe validation message.",
|
|
"Priority": "High",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Domains"
|
|
},
|
|
{
|
|
"Test ID": "DOM-UAT-019",
|
|
"Module": "Validation",
|
|
"Role / User": "System Admin",
|
|
"Scenario": "Invalid domain format validation",
|
|
"Steps": "Try invalid domain values.",
|
|
"Expected Result": "Rejected without server error.",
|
|
"Priority": "Medium",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Domains"
|
|
},
|
|
{
|
|
"Test ID": "DOM-UAT-020",
|
|
"Module": "SSL Flow",
|
|
"Role / User": "System Admin",
|
|
"Scenario": "SSL status action safe when certificate absent",
|
|
"Steps": "Open SSL page for domain without certificate.",
|
|
"Expected Result": "Safe pending/not configured status, not crash.",
|
|
"Priority": "Medium",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "UAT_Domains"
|
|
},
|
|
{
|
|
"Test ID": "SEC-001",
|
|
"Module": "Authentication",
|
|
"Role / User": "All roles",
|
|
"Scenario": "Invalid password lockout",
|
|
"Steps": "Attempt multiple wrong logins.",
|
|
"Expected Result": "Account lockout/rate limit behavior works and does not reveal sensitive info.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-002",
|
|
"Module": "Authentication",
|
|
"Role / User": "All roles",
|
|
"Scenario": "Session fixation/logout",
|
|
"Steps": "Login/logout/back-button/session reuse tests.",
|
|
"Expected Result": "Logged-out sessions cannot access protected pages.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-003",
|
|
"Module": "Authorization",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "Cross-tenant direct URL",
|
|
"Steps": "Change client/service/employee ids in URL to another tenant.",
|
|
"Expected Result": "403/404/redirect; no data leakage.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-004",
|
|
"Module": "Authorization",
|
|
"Role / User": "Branch Manager",
|
|
"Scenario": "Cross-branch direct URL",
|
|
"Steps": "Access records from another branch.",
|
|
"Expected Result": "Blocked unless explicitly permitted.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-005",
|
|
"Module": "Authorization",
|
|
"Role / User": "Client",
|
|
"Scenario": "Internal note leakage",
|
|
"Steps": "Client views work detail/messages.",
|
|
"Expected Result": "Internal/partner/manager notes are hidden.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-006",
|
|
"Module": "Authorization",
|
|
"Role / User": "Consultant",
|
|
"Scenario": "Internal engagement leakage",
|
|
"Steps": "Consultant views work detail/shared docs.",
|
|
"Expected Result": "Only referred/shared data visible.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-007",
|
|
"Module": "CSRF",
|
|
"Role / User": "All forms",
|
|
"Scenario": "CSRF token missing on POST",
|
|
"Steps": "Submit forms without CSRF.",
|
|
"Expected Result": "Request blocked.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-008",
|
|
"Module": "XSS",
|
|
"Role / User": "All input forms",
|
|
"Scenario": "Stored XSS attempt",
|
|
"Steps": "Enter <script> or HTML in notes/client/consultant fields.",
|
|
"Expected Result": "Output escaped; script not executed.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-009",
|
|
"Module": "File Upload",
|
|
"Role / User": "Documents",
|
|
"Scenario": "Malicious upload",
|
|
"Steps": "Upload exe/html/js disguised files.",
|
|
"Expected Result": "Rejected or safely stored; download headers safe.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-010",
|
|
"Module": "File Download",
|
|
"Role / User": "Documents",
|
|
"Scenario": "Path traversal",
|
|
"Steps": "Try filename/path traversal or direct file URL manipulation.",
|
|
"Expected Result": "Blocked; only DB-authorized file ids downloadable.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-011",
|
|
"Module": "Service Catalogue",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "System-only mutation",
|
|
"Steps": "Firm Admin attempts create/edit catalogue/default task URLs.",
|
|
"Expected Result": "Blocked; Firm Admin can only firm selection/customisation.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-012",
|
|
"Module": "Alerts",
|
|
"Role / User": "All roles",
|
|
"Scenario": "Alert ownership",
|
|
"Steps": "User changes alert id in mark-read URL.",
|
|
"Expected Result": "Cannot read/modify another user's alert.",
|
|
"Priority": "High",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-013",
|
|
"Module": "Invite Flow",
|
|
"Role / User": "Invited user",
|
|
"Scenario": "Invite token reuse/expiry",
|
|
"Steps": "Use expired or already-used invite token.",
|
|
"Expected Result": "Rejected with safe message.",
|
|
"Priority": "High",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-014",
|
|
"Module": "API/HTML consistency",
|
|
"Role / User": "All roles",
|
|
"Scenario": "Backend permission after menu hidden",
|
|
"Steps": "Directly call hidden menu URLs.",
|
|
"Expected Result": "Backend still enforces permission; hiding menu is not sole security.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-015",
|
|
"Module": "Rate Limits",
|
|
"Role / User": "Login/OTP",
|
|
"Scenario": "Brute force controls",
|
|
"Steps": "Repeat login/OTP attempts quickly.",
|
|
"Expected Result": "Rate limit/lockout works; logs capture event.",
|
|
"Priority": "High",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-016",
|
|
"Module": "Authentication",
|
|
"Role / User": "All roles",
|
|
"Scenario": "Disabled/inactive user login",
|
|
"Steps": "Login as deactivated or inactive user.",
|
|
"Expected Result": "Blocked; clear error without sensitive info.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-017",
|
|
"Module": "Session",
|
|
"Role / User": "All roles",
|
|
"Scenario": "Cookie HttpOnly/Secure/SameSite flags",
|
|
"Steps": "Inspect session cookie in browser dev tools.",
|
|
"Expected Result": "HttpOnly, Secure (production), SameSite=Lax flags set.",
|
|
"Priority": "High",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-018",
|
|
"Module": "Authorization",
|
|
"Role / User": "Staff",
|
|
"Scenario": "Staff opens /employees",
|
|
"Steps": "Login as staff and attempt /employees URL.",
|
|
"Expected Result": "Blocked.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-019",
|
|
"Module": "Authorization",
|
|
"Role / User": "Client/Consultant",
|
|
"Scenario": "Client/consultant opens internal HR/work URLs",
|
|
"Steps": "Login as Client or Consultant and attempt internal URLs.",
|
|
"Expected Result": "Blocked.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-020",
|
|
"Module": "Authorization",
|
|
"Role / User": "All roles",
|
|
"Scenario": "Non-admin imports HR/services Excel",
|
|
"Steps": "Non-admin role attempts import confirm action.",
|
|
"Expected Result": "Blocked.",
|
|
"Priority": "High",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-021",
|
|
"Module": "Injection",
|
|
"Role / User": "All roles",
|
|
"Scenario": "SQL injection in search/id params",
|
|
"Steps": "Use SQL payloads such as ' OR 1=1 -- in search/id fields.",
|
|
"Expected Result": "No SQL error or data leak; ORM protects correctly.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-022",
|
|
"Module": "Business Logic",
|
|
"Role / User": "Staff",
|
|
"Scenario": "Employee approves own leave/OD",
|
|
"Steps": "Employee attempts to approve own leave/OD request.",
|
|
"Expected Result": "Blocked; self-approval not allowed.",
|
|
"Priority": "High",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-023",
|
|
"Module": "Business Logic",
|
|
"Role / User": "Payroll role",
|
|
"Scenario": "Payroll marked paid without approval",
|
|
"Steps": "Attempt to mark payroll as paid without approval step.",
|
|
"Expected Result": "Blocked if approval required.",
|
|
"Priority": "High",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-024",
|
|
"Module": "Business Logic",
|
|
"Role / User": "Staff",
|
|
"Scenario": "Staff changes hidden tenant/branch ids in form",
|
|
"Steps": "Submit form with modified hidden tenant/branch field values.",
|
|
"Expected Result": "Server ignores/validates against session scope.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-025",
|
|
"Module": "Error Handling",
|
|
"Role / User": "All roles",
|
|
"Scenario": "Invalid URL/DB error response",
|
|
"Steps": "Hit invalid URLs and trigger DB errors in production mode.",
|
|
"Expected Result": "No stack trace or SQL details leaked.",
|
|
"Priority": "High",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-026",
|
|
"Module": "Security Headers",
|
|
"Role / User": "All roles",
|
|
"Scenario": "CSP/X-Frame/X-Content-Type/Referrer/HSTS headers",
|
|
"Steps": "Check response headers on any page.",
|
|
"Expected Result": "Headers present and correctly configured per environment.",
|
|
"Priority": "Medium",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-027",
|
|
"Module": "Configuration",
|
|
"Role / User": "System Admin",
|
|
"Scenario": "Secret key/.env/debug mode/upload dirs",
|
|
"Steps": "Verify production deployment configuration.",
|
|
"Expected Result": "DEBUG=False, COOKIE_SECURE=True, SECRET_KEY changed from default, no .env committed.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-101",
|
|
"Module": "Notice & Case Management",
|
|
"Role / User": "Unauthorized user",
|
|
"Scenario": "Direct access to another tenant's notice",
|
|
"Steps": "Manually change notice/case id in URL to another tenant's case.",
|
|
"Expected Result": "403/404/redirect; no case data leakage.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-102",
|
|
"Module": "Notice & Case Management",
|
|
"Role / User": "Branch-restricted user",
|
|
"Scenario": "Direct access to another branch's notice",
|
|
"Steps": "Change id to case belonging to another branch.",
|
|
"Expected Result": "Access denied unless cross-branch permission exists.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-103",
|
|
"Module": "Task Level Documents",
|
|
"Role / User": "Unauthorized user",
|
|
"Scenario": "Direct download of task document by URL manipulation",
|
|
"Steps": "Modify document id/download URL.",
|
|
"Expected Result": "Download is blocked; no file leakage.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-104",
|
|
"Module": "Notice & Case Management",
|
|
"Role / User": "Unauthorized user",
|
|
"Scenario": "Direct download of case document by URL manipulation",
|
|
"Steps": "Modify case document id/download URL.",
|
|
"Expected Result": "Download is blocked; no file leakage.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-105",
|
|
"Module": "File Upload Security",
|
|
"Role / User": "All upload roles",
|
|
"Scenario": "Upload executable file renamed as PDF",
|
|
"Steps": "Rename .exe/.bat to .pdf and upload.",
|
|
"Expected Result": "Upload is rejected or safely quarantined; no execution risk.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-106",
|
|
"Module": "File Upload Security",
|
|
"Role / User": "All upload roles",
|
|
"Scenario": "Upload oversized file",
|
|
"Steps": "Upload file beyond configured limit.",
|
|
"Expected Result": "Upload is blocked or handled gracefully.",
|
|
"Priority": "High",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-107",
|
|
"Module": "Notice & Case Management",
|
|
"Role / User": "Unauthorized user",
|
|
"Scenario": "Unauthorized user creates case",
|
|
"Steps": "Login as user without case create permission and access /notice-cases/new.",
|
|
"Expected Result": "Action is blocked.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-108",
|
|
"Module": "Notice & Case Management",
|
|
"Role / User": "Staff",
|
|
"Scenario": "Staff accesses management-only case",
|
|
"Steps": "Login as staff and access restricted management case.",
|
|
"Expected Result": "Action is blocked or limited to permitted records.",
|
|
"Priority": "High",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-109",
|
|
"Module": "Search / Filtering",
|
|
"Role / User": "Branch/Tenant user",
|
|
"Scenario": "Cross-tenant search leakage",
|
|
"Steps": "Search using client/reference keywords from another tenant.",
|
|
"Expected Result": "No cross-tenant results shown.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-110",
|
|
"Module": "Notice & Case Management",
|
|
"Role / User": "Unauthorized user",
|
|
"Scenario": "IDOR on notice-case IDs",
|
|
"Steps": "Enumerate notice-case ids in URLs/API calls.",
|
|
"Expected Result": "Unauthorized records are not returned.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-111",
|
|
"Module": "Task Level Documents",
|
|
"Role / User": "Unauthorized user",
|
|
"Scenario": "IDOR on task-document IDs",
|
|
"Steps": "Enumerate task document ids in URLs/API calls.",
|
|
"Expected Result": "Unauthorized records/files are not returned.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-112",
|
|
"Module": "Notice & Case Management",
|
|
"Role / User": "All roles",
|
|
"Scenario": "Stored XSS in case remarks",
|
|
"Steps": "Enter <script> payload in case remarks.",
|
|
"Expected Result": "Script is escaped/sanitized and not executed.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-113",
|
|
"Module": "Notice & Case Management",
|
|
"Role / User": "All roles",
|
|
"Scenario": "Stored XSS in hearing remarks",
|
|
"Steps": "Enter script payload in hearing remarks.",
|
|
"Expected Result": "Script is escaped/sanitized and not executed.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-114",
|
|
"Module": "Documents",
|
|
"Role / User": "All upload roles",
|
|
"Scenario": "Stored XSS in document description",
|
|
"Steps": "Enter script payload in document description/title.",
|
|
"Expected Result": "Script is escaped/sanitized and not executed.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "SEC-115",
|
|
"Module": "Notice & Case Management",
|
|
"Role / User": "All permitted roles",
|
|
"Scenario": "SQL injection in case search",
|
|
"Steps": "Search using SQL payloads such as ' OR 1=1 --.",
|
|
"Expected Result": "No SQL error; results remain scoped and safe.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Security"
|
|
},
|
|
{
|
|
"Test ID": "DOM-VAPT-001",
|
|
"Module": "Authentication",
|
|
"Role / User": "Unauthenticated user",
|
|
"Scenario": "Unauthenticated user cannot access domain pages",
|
|
"Steps": "Logout and open every /domains URL.",
|
|
"Expected Result": "Redirect/login or 401/403, not page content.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Domains"
|
|
},
|
|
{
|
|
"Test ID": "DOM-VAPT-002",
|
|
"Module": "Authorization",
|
|
"Role / User": "Firm Admin",
|
|
"Scenario": "Firm Admin direct URL access is blocked",
|
|
"Steps": "Login as Firm Admin and open every /domains URL.",
|
|
"Expected Result": "403/redirect.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Domains"
|
|
},
|
|
{
|
|
"Test ID": "DOM-VAPT-003",
|
|
"Module": "Authorization",
|
|
"Role / User": "Partner/Staff",
|
|
"Scenario": "Partner/Staff direct URL access is blocked",
|
|
"Steps": "Login as Partner/Staff and open every /domains URL.",
|
|
"Expected Result": "403/redirect.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Domains"
|
|
},
|
|
{
|
|
"Test ID": "DOM-VAPT-004",
|
|
"Module": "Authorization",
|
|
"Role / User": "Non-System Admin",
|
|
"Scenario": "POST/PUT/DELETE actions require System Admin",
|
|
"Steps": "Attempt create/update/delete request as non-System Admin.",
|
|
"Expected Result": "403/CSRF rejection.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Domains"
|
|
},
|
|
{
|
|
"Test ID": "DOM-VAPT-005",
|
|
"Module": "CSRF",
|
|
"Role / User": "All forms",
|
|
"Scenario": "Domain configuration forms require CSRF token",
|
|
"Steps": "Submit without/invalid CSRF token.",
|
|
"Expected Result": "Rejection and no DB write.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Domains"
|
|
},
|
|
{
|
|
"Test ID": "DOM-VAPT-006",
|
|
"Module": "Input Validation",
|
|
"Role / User": "All roles",
|
|
"Scenario": "Domain field rejects script tags and HTML injection",
|
|
"Steps": "Enter <script> payload in domain/name fields.",
|
|
"Expected Result": "Escaped display/no execution.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Domains"
|
|
},
|
|
{
|
|
"Test ID": "DOM-VAPT-007",
|
|
"Module": "Input Validation",
|
|
"Role / User": "All roles",
|
|
"Scenario": "Domain field rejects path/URL injection",
|
|
"Steps": "Try values like https://evil.com/path, ../admin, or domain with spaces.",
|
|
"Expected Result": "Validation failure.",
|
|
"Priority": "High",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Domains"
|
|
},
|
|
{
|
|
"Test ID": "DOM-VAPT-008",
|
|
"Module": "Tenant Isolation",
|
|
"Role / User": "System Admin",
|
|
"Scenario": "Domain mapping cannot be used to view another tenant data",
|
|
"Steps": "Map test domain to Tenant A, then attempt access to Tenant B records.",
|
|
"Expected Result": "Tenant isolation maintained.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Domains"
|
|
},
|
|
{
|
|
"Test ID": "DOM-VAPT-009",
|
|
"Module": "Host Header",
|
|
"Role / User": "All roles",
|
|
"Scenario": "Unknown Host header does not resolve to tenant data",
|
|
"Steps": "Send request with unknown Host.",
|
|
"Expected Result": "Default/login/error, not tenant data leakage.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Domains"
|
|
},
|
|
{
|
|
"Test ID": "DOM-VAPT-010",
|
|
"Module": "Host Header",
|
|
"Role / User": "All roles",
|
|
"Scenario": "Malformed Host header is safely handled",
|
|
"Steps": "Use malformed/long Host header.",
|
|
"Expected Result": "Safe rejection/no crash.",
|
|
"Priority": "High",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Domains"
|
|
},
|
|
{
|
|
"Test ID": "DOM-VAPT-011",
|
|
"Module": "DNS Verification",
|
|
"Role / User": "System Admin",
|
|
"Scenario": "Verification token cannot be guessed or reused across tenant",
|
|
"Steps": "Try using one tenant verification token for another.",
|
|
"Expected Result": "Rejection.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Domains"
|
|
},
|
|
{
|
|
"Test ID": "DOM-VAPT-012",
|
|
"Module": "SSL Automation",
|
|
"Role / User": "System Admin",
|
|
"Scenario": "SSL action cannot be triggered by unauthorized role",
|
|
"Steps": "Attempt SSL issue/renew action as non-System Admin.",
|
|
"Expected Result": "Block.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Domains"
|
|
},
|
|
{
|
|
"Test ID": "DOM-VAPT-013",
|
|
"Module": "Audit Log",
|
|
"Role / User": "System Admin",
|
|
"Scenario": "Domain create/update/delete is audit logged",
|
|
"Steps": "Perform domain mapping change; verify actor, timestamp, tenant/domain and action are logged.",
|
|
"Expected Result": "Audit log entry created correctly.",
|
|
"Priority": "High",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Domains"
|
|
},
|
|
{
|
|
"Test ID": "DOM-VAPT-014",
|
|
"Module": "Rate/Abuse",
|
|
"Role / User": "System Admin",
|
|
"Scenario": "Verification endpoint resists repeated brute attempts",
|
|
"Steps": "Send repeated verification attempts.",
|
|
"Expected Result": "Throttling or safe handling without server degradation.",
|
|
"Priority": "Medium",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Domains"
|
|
},
|
|
{
|
|
"Test ID": "DOM-VAPT-015",
|
|
"Module": "Regression",
|
|
"Role / User": "All roles",
|
|
"Scenario": "Existing auth/session flow still works after menu patch",
|
|
"Steps": "Login, OTP, logout, password change and normal dashboard rendering continue to work.",
|
|
"Expected Result": "All flows intact.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": null,
|
|
"Sheet": "VAPT_Domains"
|
|
},
|
|
{
|
|
"Test ID": "V204-SEC-001",
|
|
"Module": "Security Hardening",
|
|
"Role / User": "System Admin",
|
|
"Scenario": "Forgot-password API does not expose reset token",
|
|
"Steps": "POST forgot-password endpoint for a real seeded user and inspect response body.",
|
|
"Expected Result": "Response must not contain reset_token/password_reset_token or long token values.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": "Added in Playwright v2.3 for v2.0.4 security/FY hardening",
|
|
"Sheet": "V204_Additional_Checks"
|
|
},
|
|
{
|
|
"Test ID": "V204-SEC-002",
|
|
"Module": "Security Hardening",
|
|
"Role / User": "All roles",
|
|
"Scenario": "Invalid reset token is rejected safely",
|
|
"Steps": "Submit random reset token to reset-password API.",
|
|
"Expected Result": "Request is rejected without 500 error and without changing password.",
|
|
"Priority": "High",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": "Added in Playwright v2.3 for v2.0.4 security/FY hardening",
|
|
"Sheet": "V204_Additional_Checks"
|
|
},
|
|
{
|
|
"Test ID": "V204-SEC-003",
|
|
"Module": "Security Hardening",
|
|
"Role / User": "All roles",
|
|
"Scenario": "API login brute-force attempts do not crash",
|
|
"Steps": "Submit repeated wrong API token/login requests.",
|
|
"Expected Result": "All responses are safe 4xx/429 and no server error occurs.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": "Added in Playwright v2.3 for v2.0.4 security/FY hardening",
|
|
"Sheet": "V204_Additional_Checks"
|
|
},
|
|
{
|
|
"Test ID": "V204-CTX-001",
|
|
"Module": "Tenant/Branch Context",
|
|
"Role / User": "Staff",
|
|
"Scenario": "Public X-Tenant-Code/X-Branch-Code/X-Year-Code headers ignored",
|
|
"Steps": "Login with spoofed tenant/branch/year headers but without secret.",
|
|
"Expected Result": "ERP must not switch context or leak another tenant/branch/year.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": "Added in Playwright v2.3 for v2.0.4 security/FY hardening",
|
|
"Sheet": "V204_Additional_Checks"
|
|
},
|
|
{
|
|
"Test ID": "V204-CTX-002",
|
|
"Module": "Tenant/Branch Context",
|
|
"Role / User": "Staff",
|
|
"Scenario": "Wrong context secret is ignored",
|
|
"Steps": "Login with spoofed context headers and wrong X-AuditFirm-Context-Secret.",
|
|
"Expected Result": "ERP must ignore context headers and must not leak Tenant B.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": "Added in Playwright v2.3 for v2.0.4 security/FY hardening",
|
|
"Sheet": "V204_Additional_Checks"
|
|
},
|
|
{
|
|
"Test ID": "V204-CTX-003",
|
|
"Module": "Tenant/Branch Context",
|
|
"Role / User": "System Admin",
|
|
"Scenario": "Trusted context headers require configured secret",
|
|
"Steps": "When TRUST_CONTEXT_HEADERS=true, send headers with configured secret.",
|
|
"Expected Result": "Trusted internal context works only with matching secret.",
|
|
"Priority": "Medium",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": "Added in Playwright v2.3 for v2.0.4 security/FY hardening",
|
|
"Sheet": "V204_Additional_Checks"
|
|
},
|
|
{
|
|
"Test ID": "V204-FY-001",
|
|
"Module": "Financial Year",
|
|
"Role / User": "System Admin",
|
|
"Scenario": "FY selector/session context visible after login",
|
|
"Steps": "Login and open system settings/dashboard.",
|
|
"Expected Result": "Active FY selector or active FY text is visible.",
|
|
"Priority": "Critical",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": "Added in Playwright v2.3 for v2.0.4 security/FY hardening",
|
|
"Sheet": "V204_Additional_Checks"
|
|
},
|
|
{
|
|
"Test ID": "V204-FY-002",
|
|
"Module": "Financial Year",
|
|
"Role / User": "System Admin",
|
|
"Scenario": "Active FY switch does not break transactional screens",
|
|
"Steps": "Switch active FY and open engagements, documents, notices, billing and payments.",
|
|
"Expected Result": "All screens load without 500 and use selected FY context.",
|
|
"Priority": "Critical",
|
|
"Type": "UAT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": "Added in Playwright v2.3 for v2.0.4 security/FY hardening",
|
|
"Sheet": "V204_Additional_Checks"
|
|
},
|
|
{
|
|
"Test ID": "V204-LOCK-001",
|
|
"Module": "Year Lock",
|
|
"Role / User": "System Admin",
|
|
"Scenario": "Locked FY write attempt blocked",
|
|
"Steps": "Set LOCKED_FY, switch to locked FY and try notice/case creation.",
|
|
"Expected Result": "Create/edit/write operation is blocked safely.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": "Added in Playwright v2.3 for v2.0.4 security/FY hardening",
|
|
"Sheet": "V204_Additional_Checks"
|
|
},
|
|
{
|
|
"Test ID": "V204-BACKUP-001",
|
|
"Module": "Year Backup",
|
|
"Role / User": "Anonymous",
|
|
"Scenario": "Backup screens/files not anonymously accessible",
|
|
"Steps": "Open backup URLs and likely backup file paths without login.",
|
|
"Expected Result": "All requests redirect/block/404 and no backup file is exposed.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": "Added in Playwright v2.3 for v2.0.4 security/FY hardening",
|
|
"Sheet": "V204_Additional_Checks"
|
|
},
|
|
{
|
|
"Test ID": "V204-BACKUP-002",
|
|
"Module": "Year Backup",
|
|
"Role / User": "Staff",
|
|
"Scenario": "Low-privilege user cannot access backup export",
|
|
"Steps": "Login as Staff and open backup/export URLs.",
|
|
"Expected Result": "Staff is denied and no backup ZIP is downloadable.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": "Added in Playwright v2.3 for v2.0.4 security/FY hardening",
|
|
"Sheet": "V204_Additional_Checks"
|
|
},
|
|
{
|
|
"Test ID": "V204-UPLOAD-001",
|
|
"Module": "Upload Security",
|
|
"Role / User": "System Admin",
|
|
"Scenario": "Executable upload blocked in notice/case documents",
|
|
"Steps": "Upload not-a-pdf.exe to seeded notice/case document flow.",
|
|
"Expected Result": "Upload is rejected due to type/extension validation.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": "Added in Playwright v2.3 for v2.0.4 security/FY hardening",
|
|
"Sheet": "V204_Additional_Checks"
|
|
},
|
|
{
|
|
"Test ID": "V204-UPLOAD-002",
|
|
"Module": "Upload Security",
|
|
"Role / User": "System Admin",
|
|
"Scenario": "Oversized upload blocked safely",
|
|
"Steps": "Upload large-file.bin to seeded notice/case document flow.",
|
|
"Expected Result": "Upload is rejected due to size/type validation and no memory/server error occurs.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": "Added in Playwright v2.3 for v2.0.4 security/FY hardening",
|
|
"Sheet": "V204_Additional_Checks"
|
|
},
|
|
{
|
|
"Test ID": "V204-STORAGE-001",
|
|
"Module": "Storage Agent Security",
|
|
"Role / User": "Anonymous",
|
|
"Scenario": "Storage agent endpoints require node authentication",
|
|
"Steps": "Call storage-agent pending jobs endpoints without node headers.",
|
|
"Expected Result": "Endpoints reject unauthenticated caller without 500.",
|
|
"Priority": "High",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": "Added in Playwright v2.3 for v2.0.4 security/FY hardening",
|
|
"Sheet": "V204_Additional_Checks"
|
|
},
|
|
{
|
|
"Test ID": "V204-HEADERS-001",
|
|
"Module": "Session/Cookie Security",
|
|
"Role / User": "System Admin",
|
|
"Scenario": "Security headers and cookie flags remain valid",
|
|
"Steps": "Open login, login as System Admin and inspect headers/cookies.",
|
|
"Expected Result": "Security headers exist and session cookie is HttpOnly/SameSite; Secure when production flag enabled.",
|
|
"Priority": "Critical",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": "Added in Playwright v2.3 for v2.0.4 security/FY hardening",
|
|
"Sheet": "V204_Additional_Checks"
|
|
},
|
|
{
|
|
"Test ID": "V204-CSP-001",
|
|
"Module": "XSS/CSP",
|
|
"Role / User": "Anonymous",
|
|
"Scenario": "Strict CSP has no unsafe-inline when enforced",
|
|
"Steps": "Enable EXPECT_STRICT_CSP after removing inline JS/CSS and inspect CSP.",
|
|
"Expected Result": "CSP exists and does not contain unsafe-inline.",
|
|
"Priority": "Medium",
|
|
"Type": "VAPT",
|
|
"Status": "Not Started",
|
|
"Defect ID": null,
|
|
"Remarks": "Added in Playwright v2.3 for v2.0.4 security/FY hardening",
|
|
"Sheet": "V204_Additional_Checks"
|
|
}
|
|
] |