# OGSG Asset Management Role-Based UAT Test Script

Last updated: 2026-07-07

## Purpose

Use this script to test the core app functions role by role: Super Admin, Central Admin, MDA users, assigned approvers, and suppliers.

Record each result as `Pass`, `Fail`, or `Blocked`, with screenshot/error evidence for every failed step.

Do not use real government financial data during testing.

## Test Accounts Required

| Role/account | Required setup |
| --- | --- |
| Super Admin | Created only through `php artisan app:create-super-admin` |
| Central Admin | Created by Super Admin and activated through platform invitation |
| MDA Admin | Invited from an MDA users page as `ministry-admin` |
| MDA Accountant | Invited from an MDA users page as `ministry-accountant` |
| MDA Member | Invited from an MDA users page as `ministry-member` |
| MDA Viewer | Invited from an MDA users page as `ministry-viewer` |
| Assigned Approver | Any eligible user with active approval assignment |
| Supplier | Created from Suppliers and assigned to procurement/order workflow |

## Current App Rules To Confirm During UAT

| Area | Current behavior to verify |
| --- | --- |
| Platform users | Super Admin creates Central Admin/platform users with first name and last name; no password field is shown |
| Platform invitations | Central Admin setup uses `/platform-invitations/{token}`, expires after 7 days, supports resend, and verifies email after password setup |
| MDA invitations | MDA users are invited with first name and last name; no full-name field is used |
| MDA email domain | MDA invitations are restricted to `ogunstate.gov.ng`; the old editable domain field should not appear across the app |
| Account status | Pending platform users show `Setup pending`; expired platform invitations show `Invitation expired`; completed accounts show `Active` |
| Password reset | Forgot-password is recovery-only and should not be treated as an invitation flow |
| Approvals | Approval authority comes from active approval assignments, not from a standalone `approver` role |
| Removed roles | `admin`, `approver`, `approver-1`, `approver-2`, `ministry-owner`, `ministry-asset-officer`, and `ministry-request-officer` must not appear |
| MDA identity | MDA dashboards/pages must clearly show the current MDA/ministry name for all MDA roles |

## Shared Setup Data

Create or confirm:

| Data | Minimum needed |
| --- | --- |
| MDAs | At least two MDAs for cross-MDA checks |
| MDA domain | Confirm MDA invitation emails are restricted to `ogunstate.gov.ng` |
| Categories | At least one parent category and one sub-category |
| Assets | At least one active asset and one inventory asset |
| Budgets | One active budget and one exhausted/closed budget |
| Approval assignments | Purchase request and lifecycle approval assignments |
| Supplier | One supplier account with assigned procurement order |

Suggested clean test setup:

```bash
php artisan migrate:fresh
php artisan db:seed --class=RolesAndPermissionsSeeder
php artisan app:create-super-admin admin@ogsg.gov.ng --first-name="Super" --last-name="Admin"
php artisan db:seed --class=AssetOnlySeeder
```

Run `php artisan migrate` instead of `migrate:fresh` on shared/staging environments where data must not be deleted.

## Result Template

| Test ID | Tester | Date | Role | Result | Evidence / notes |
| --- | --- | --- | --- | --- | --- |
|  |  |  |  |  |  |

## A. Authentication And Account Setup

| ID | Role | Steps | Expected result |
| --- | --- | --- | --- |
| AUTH-01 | Super Admin | Log in with valid credentials and complete OTP if shown | User reaches Super Admin dashboard |
| AUTH-02 | Central Admin | Open platform invitation link, create password, then log in | Account becomes verified/active and reaches Central Admin dashboard |
| AUTH-03 | MDA user | Open MDA invitation link, create password, then log in | User is attached to correct MDA and reaches correct dashboard |
| AUTH-04 | Any user | Use wrong password | Login is rejected |
| AUTH-05 | Any user | Use forgot password and set a new password | User can log in with new password; this does not act as an invitation |
| AUTH-06 | Any user | Try to access app before email/setup completion | User is blocked or redirected to verification/setup flow |
| AUTH-07 | Any user | Revoke trusted device or other sessions | Sessions/devices are revoked only for that user |
| AUTH-08 | Platform invitation | Open a valid platform invitation page | Page shows one header/title only and displays invited email/role once |
| AUTH-09 | Expired platform invitation | Open expired platform invitation link | Page says the link is no longer valid and asks user to contact admin |

## B. Super Admin Tests

| ID | Area | Steps | Expected result |
| --- | --- | --- | --- |
| SA-01 | Dashboard | Log in as Super Admin | Super Admin sees platform/admin navigation |
| SA-02 | Platform user creation | Create a Central Admin with first name, last name, email, and role | User is created as `Setup pending`; no password field is required; platform invitation email is sent |
| SA-03 | Platform invitation resend | Open setup-pending or expired Central Admin details and click resend invitation | New token is sent, old token becomes unusable, expiry is extended by 7 days |
| SA-04 | Expired platform invitation | Open expired invitation link | User sees expired-link message and cannot set password |
| SA-05 | Role restriction | Try to create another Super Admin from web UI | Role is not selectable or request is rejected |
| SA-06 | User details | Open Central Admin details before and after setup | Status changes from `Setup pending` or `Invitation expired` to `Active` after setup |
| SA-07 | Account recovery | Update recovery email for a platform user | Email updates, account becomes verified only through approved recovery flow, sessions are revoked |
| SA-08 | Delete guard | Try to delete own Super Admin account | Action is blocked |
| SA-09 | MDA visibility | View all MDAs and users | Platform user can review all MDAs without being scoped to one MDA |
| SA-10 | Activity logs | Open activity logs after user invite/recovery actions | Logs show actor, action, target, and timestamp |
| SA-11 | Platform invite copy | Inspect received Central Admin email | Subject/copy says invited to OGSG Asset Management, not reset password |

## C. Central Admin Tests

| ID | Area | Steps | Expected result |
| --- | --- | --- | --- |
| CA-01 | Dashboard | Log in as Central Admin | Central Admin dashboard loads |
| CA-02 | MDA create | Create an MDA | MDA appears in list and details page |
| CA-03 | MDA import | Download MDA template and upload valid CSV | Valid rows import; invalid rows report errors |
| CA-04 | MDA invitation | Invite an MDA user from MDA users page using first and last name | Invitation is sent once and appears as pending |
| CA-05 | MDA bulk invitation | Upload bulk MDA invitation CSV | Valid invitations are sent; failed rows are summarized |
| CA-06 | MDA invitation resend/cancel | Resend and cancel pending invitation | Token rotates on resend; cancelled invitation cannot be accepted |
| CA-07 | Domain restriction | Try non-`ogunstate.gov.ng` MDA invitation email | Invitation is blocked; editable allowed-domain field/copy is not visible |
| CA-08 | Category management | Create parent category and sub-category | Categories save and appear in category list |
| CA-09 | Category guard | Try to make a category its own parent | Validation blocks the update |
| CA-10 | Asset create | Register an asset for an MDA | Asset is created with tag and appears in asset list |
| CA-11 | Asset import | Upload asset template with valid purchase date format | Assets import and failed rows are summarized |
| CA-12 | Asset tag print | Open QR/asset tag print page | Tag renders on a compact printable page |
| CA-13 | Public asset page | Open public QR link | Public page hides financial, supplier, and internal details |
| CA-14 | Asset export | Filter assets and export | Export completes and file downloads |
| CA-15 | Budget create | Create active budget for MDA/year/expense code | Budget is created with correct opening balance |
| CA-16 | Duplicate budget guard | Create duplicate active budget key | Duplicate is blocked |
| CA-17 | Approval assignment | Assign purchase approver level 1 and level 2 | Assigned users can see applicable approval work |
| CA-18 | Request review | Mark submitted request under review | Request status updates |
| CA-19 | Forward to approvers | Forward reviewed request | Approval records are created for assigned approvers |
| CA-20 | Fulfill from inventory | Fulfill approved/valid request using inventory asset | Asset transfers to request MDA and fulfillment email is sent |
| CA-21 | Inventory conflict | Fulfill using already assigned asset | Action is blocked |
| CA-22 | Procurement create | Create procurement order from approved request | Procurement order is created |
| CA-23 | Procurement confirm | Confirm supplier quote within approved amount | Order is confirmed |
| CA-24 | Variance approval | Submit quote above approved amount and approve variance | Confirmation is blocked before variance approval and allowed after |
| CA-25 | Procurement PDF | Download procurement PDF | PDF contains order, supplier, MDA, and item details |
| CA-26 | Reports | Open asset, request, and procurement reports | Reports load with filters |
| CA-27 | Report export | Export report | Export is queued/completed and downloadable |
| CA-28 | Cross-MDA guard | Attempt to force another MDA's private route/filter as non-platform MDA user | Data remains protected |
| CA-29 | Bulk import emails | Complete asset import and bulk MDA invite import | Initiating admin receives summary email only; per-row spam is not sent except invitation links |

## D. MDA Admin Tests

| ID | Area | Steps | Expected result |
| --- | --- | --- | --- |
| MA-01 | Dashboard | Log in as MDA Admin | Dashboard shows current MDA identity/name |
| MA-02 | MDA scope | View assets, requests, members | Only own MDA data is visible |
| MA-03 | Invite MDA user | Invite member/accountant/viewer using first and last name | Invitation is sent and pending entry appears |
| MA-04 | Bulk invite users | Upload MDA user invitation CSV | Valid invitations sent; invalid rows summarized |
| MA-05 | Manage members | Toggle member active status | Member access changes only within same MDA |
| MA-06 | Role options | Open invitation role selector | Only allowed MDA roles appear; removed roles do not appear |
| MA-07 | Create asset | Create asset for own MDA | Asset is saved under own MDA |
| MA-08 | Import asset | Upload valid asset CSV for own MDA | Assets import under own MDA |
| MA-09 | Edit asset | Edit allowed asset fields | Allowed fields update; locked financial fields stay protected |
| MA-10 | Create request | Submit asset request | Request is created under own MDA |
| MA-11 | View request status | Track submitted request | Status and approval history are visible |
| MA-12 | Reports | Open MDA reports | Reports are scoped to own MDA |
| MA-13 | Export MDA report | Export MDA report | Export contains only own MDA data |
| MA-14 | Transfer lifecycle | Submit transfer request | Transfer is pending and asset does not move immediately |
| MA-15 | Maintenance lifecycle | Submit maintenance request | Lifecycle request is pending approval |
| MA-16 | Disposal lifecycle | Submit disposal request | Disposal does not complete without approval |
| MA-17 | Cross-MDA denial | Try to access another MDA's members/assets by URL | Access denied or data not found |
| MA-18 | MDA identity | Open dashboard, assets, requests, members, and reports | Current MDA/ministry name is visible on each main MDA work surface |

## E. MDA Accountant Tests

| ID | Area | Steps | Expected result |
| --- | --- | --- | --- |
| MAC-01 | Dashboard | Log in as MDA Accountant | MDA dashboard loads with current MDA identifier |
| MAC-02 | Asset finance view | Open asset details | Finance/provenance fields visible according to permission |
| MAC-03 | Budget view | Open MDA budgets | Own MDA budgets are visible |
| MAC-04 | Report view | Open MDA reports | Reports are scoped to own MDA |
| MAC-05 | Export report | Export permitted MDA report | Export is scoped to own MDA |
| MAC-06 | Mutation guard | Try to manage users or central settings | Access is denied |
| MAC-07 | Cross-MDA guard | Attempt another MDA budget/report URL | Access denied or scoped back to own MDA |
| MAC-08 | Mutation guard | Try asset create/import and member invite routes | Access is denied unless the app explicitly grants that permission |

## F. MDA Member Tests

| ID | Area | Steps | Expected result |
| --- | --- | --- | --- |
| MM-01 | Dashboard | Log in as MDA Member | MDA dashboard loads with current MDA identifier |
| MM-02 | Create asset | Create asset if permission allows | Asset is created under own MDA |
| MM-03 | Import asset | Upload asset CSV if permission allows | Assets import under own MDA |
| MM-04 | Create request | Submit asset request | Request is created under own MDA |
| MM-05 | Edit request | Edit request before locked/reviewed state if allowed | Allowed edits save |
| MM-06 | View own assets/requests | Open lists | Only own MDA data appears |
| MM-07 | Financial guard | Attempt to edit locked financial/provenance fields | Change is blocked |
| MM-08 | Member management guard | Try to invite or manage users | Access is denied |
| MM-09 | Cross-MDA guard | Force another MDA asset/request URL | Access is denied or not found |
| MM-10 | Report guard | Try to open MDA reports/export routes | Access is denied unless permission is granted |

## G. MDA Viewer Tests

| ID | Area | Steps | Expected result |
| --- | --- | --- | --- |
| MV-01 | Dashboard | Log in as MDA Viewer | MDA dashboard loads with current MDA identifier |
| MV-02 | View assets | Open asset list and details | Own MDA assets are visible |
| MV-03 | View requests | Open request list and details | Own MDA requests are visible |
| MV-04 | Mutation guard | Try to create/edit/delete asset | Access is denied |
| MV-05 | Request guard | Try to create request | Access is denied |
| MV-06 | Report/export guard | Try report export if not permitted | Access is denied |
| MV-07 | Cross-MDA guard | Force another MDA URL | Access is denied or not found |
| MV-08 | Financial guard | Open asset pages | Internal financial/provenance controls are hidden unless permission allows |

## H. Assigned Approver Tests

Approval is assignment-based. There is no standalone `approver` role.

| ID | Area | Steps | Expected result |
| --- | --- | --- | --- |
| AP-01 | Assignment visibility | Log in as assigned approver | Relevant approval work is visible |
| AP-02 | No assignment guard | Remove assignment and try approval page/action | Access is denied |
| AP-03 | Level 1 approval | Approve level 1 forwarded request | Level 1 approval records; request waits for next level |
| AP-04 | Level 2 approval | Approve after level 1 | Request becomes approved and budget deducts once |
| AP-05 | Rejection | Reject with reason | Request is rejected; budget does not deduct |
| AP-06 | Duplicate approval | Submit same approval twice | Second approval is blocked |
| AP-07 | Wrong MDA guard | Try to approve another MDA's request | Access/action is denied |
| AP-08 | Lifecycle approval | Approve transfer/maintenance/disposal request | Lifecycle moves to next expected stage |
| AP-09 | Initiator guard | Initiator attempts to approve own request | Approval is blocked unless audited override is intended |

## I. Supplier Tests

| ID | Area | Steps | Expected result |
| --- | --- | --- | --- |
| SUP-01 | Dashboard | Log in as supplier | Supplier dashboard loads |
| SUP-02 | View assigned order | Open supplier orders | Only assigned orders are visible |
| SUP-03 | Submit quote | Submit quote for assigned order | Quote saves and order status updates |
| SUP-04 | Quote validation | Submit incomplete/invalid quote | Validation blocks submission |
| SUP-05 | Delivery | Mark deliverable order delivered if available | Delivery status updates according to workflow |
| SUP-06 | Admin route guard | Try `/admin/dashboard` or MDA routes | Access is denied |
| SUP-07 | Other supplier guard | Try another supplier order URL | Access is denied or not found |
| SUP-08 | Password handling | Confirm supplier creation/edit flow | Supplier password is managed directly by admin flow, not platform invitation |

## J. End-To-End Smoke Flow

Run this sequence after role-level tests pass:

1. Super Admin invites Central Admin.
2. Central Admin accepts invite and logs in.
3. Central Admin creates MDA and invites MDA Admin using `ogunstate.gov.ng` email.
4. MDA Admin accepts invite and invites Accountant, Member, and Viewer.
5. Central Admin creates asset category, budget, supplier, and approval assignments.
6. MDA Member creates/imports asset and submits asset request.
7. Central Admin reviews request and either fulfills from inventory or forwards to approvers.
8. Assigned approvers approve in sequence.
9. Central Admin creates procurement order if needed.
10. Supplier submits quote.
11. Central Admin confirms quote, handles variance if needed, and downloads PDF.
12. MDA Admin submits transfer/maintenance/disposal lifecycle request.
13. Assigned lifecycle approver approves.
14. Receiving MDA accepts transfer where applicable.
15. Central Admin and MDA users export reports.
16. Confirm activity logs show major actions.

Expected final result:

- Platform invitation and MDA invitation flows work.
- Every role lands on the correct dashboard.
- MDA name/identity is visible for MDA users.
- Platform users and MDA users are created with first and last name, not full name.
- MDA invitations are restricted to `ogunstate.gov.ng`.
- MDA users cannot see or mutate other MDA data.
- Approval requires active assignment, not role name alone.
- Budget deduction happens once on final approval only.
- Procurement and supplier routes are isolated.
- Public QR pages do not expose internal financial data.
- Reports and exports respect authorization.

## Sign-Off Checklist

| Area | Pass/Fail | Notes |
| --- | --- | --- |
| Super Admin platform user and recovery flows |  |  |
| Central Admin MDA, asset, budget, procurement, report flows |  |  |
| MDA Admin member, invitation, asset, request, lifecycle flows |  |  |
| MDA Accountant finance/report visibility |  |  |
| MDA Member operational asset/request actions |  |  |
| MDA Viewer read-only restrictions |  |  |
| Assigned approval workflow |  |  |
| Supplier portal isolation |  |  |
| Cross-MDA access controls |  |  |
| Email/invitation flows |  |  |
| Activity logs and exports |  |  |
| MDA identity visible for all MDA roles |  |  |

## Blocking Defects

Treat any of these as release blockers:

- user can access another MDA's private data
- supplier can access admin or MDA routes
- unassigned user can approve
- role-only approval works without active assignment
- removed roles appear in UI or templates
- budget deducts twice for one request
- final approval succeeds without required active budget
- locked financial/provenance fields can be edited after lock
- public QR page exposes financial, supplier, budget, or internal audit data
- expired invitation can still be accepted
- platform invitation email uses reset-password link or reset-password copy
- MDA user invitation accepts non-`ogunstate.gov.ng` email
- MDA pages do not identify the current MDA/ministry
- report export includes unauthorized MDA data