# OGSG Asset Management UAT Test Script

Last updated: 2026-07-07

## UAT Objective

Confirm that the OGSG Asset Management application works as expected across platform invitations, MDA invitations, roles, MDA tenancy, asset management, requests, approval assignments, budgets, procurement, reports, supplier portal, email notifications, and security controls.

For role-by-role execution details, use [Role-Based UAT Test Script](role-based-uat-test-script.md) alongside this main checklist.

## Test Recording Rules

For every test case, record:
- tester name
- date and time
- environment URL
- browser/device
- user account and role
- test data used
- result: Pass, Fail, or Blocked
- screenshot or error message for failures

Do not use real government financial data in UAT.

## Required Test Accounts

| Account type | Role/condition needed |
| --- | --- |
| Platform bootstrap user | `super-admin`, created by CLI only |
| Central operations user | `central-admin`, invited by Super Admin through platform invitation |
| MDA administrator | `ministry-admin`, invited through MDA invitation |
| MDA finance user | `ministry-accountant` |
| MDA operational user | `ministry-member` |
| MDA read-only user | `ministry-viewer` |
| Assigned purchase approver level 1 | Any eligible MDA user with active approval assignment |
| Assigned purchase approver level 2 | Any eligible MDA user with active approval assignment |
| Assigned lifecycle approver | Any eligible MDA user with active lifecycle approval assignment |
| Supplier | `supplier` |

## Required Setup Data

Create or confirm the following before UAT starts:
- at least two MDAs
- MDA invitation domain fixed to `ogunstate.gov.ng`
- asset categories and sub-categories
- at least one active budget for the test MDA
- at least one inactive or exhausted budget for negative testing
- at least one supplier
- active approval assignments for purchase requests
- active approval assignments for lifecycle actions
- at least one available inventory asset
- at least one asset with financial/provenance fields locked
- mail delivery available for invitations, reset links, workflow notifications, and import summaries

Suggested clean UAT setup commands:

```bash
php artisan migrate:fresh
php artisan db:seed --class=RolesAndPermissionsSeeder
php artisan app:create-super-admin admin@ogsg.gov.ng --first-name="Super" --last-name="Admin"
php artisan db:seed --class=AssetOnlySeeder
```

## Current App Rules To Verify

- Super Admin is bootstrap-only and must not be created from the web UI.
- Super Admin creates Central Admin/platform users with first name and last name; no password field is shown.
- Platform users receive `/platform-invitations/{token}` links, not password reset links.
- Platform invitation links expire after 7 days, support resend, and verify email only after password setup.
- Password reset is for account recovery only and must not verify pending invited accounts.
- MDA invitations use first name and last name, not full name.
- MDA invitation email domain is restricted to `ogunstate.gov.ng`; the old editable allowed-domain field must not appear.
- MDA users must see a clear current MDA/ministry identifier on their landing page and core pages.
- Removed roles must not appear anywhere: `admin`, `approver`, `approver-1`, `approver-2`, `ministry-owner`, `ministry-asset-officer`, `ministry-request-officer`.
- Approval power comes from active approval assignments, not from a standalone approver role.
- Email notifications should be limited to high-value actions: invitations, security/account recovery, approver action needed, final request outcome, bulk import summaries, and fulfillment/transfer summaries.

## UAT Priority Order

Run the full script, but prioritize defects in this order:

1. Onboarding and account setup: platform invitations, MDA invitations, first/last-name fields, fixed email domain, resend/expired links, account statuses, and login.
2. Asset creation and asset records: manual creation, bulk import, date handling, categories, tags, QR/public view, media, custodian/location, locked fields, and MDA scoping.
3. Asset request and approval flow: request creation, Central Admin review, inventory fulfillment, approver assignment, final approval/rejection, budget deduction, and notifications.
4. Budget and procurement/supply flow: budget availability, duplicate prevention, procurement order, supplier quote, variance, confirmation, delivery, and PDF.
5. Account management across roles: role visibility, permission boundaries, disable/recovery, supplier isolation, MDA identity, and audit logs.

## Functional Coverage Matrix

| Functionality | Roles to test | Minimum coverage |
| --- | --- | --- |
| Platform onboarding | `super-admin`, `central-admin` | Create Central Admin, receive invitation, accept setup, verify status, resend expired invitation, confirm password reset remains recovery-only |
| MDA onboarding | `central-admin`, `ministry-admin`, invited MDA users | Create MDA, invite first MDA Admin, invite individual MDA users, bulk import users, block invalid domain, confirm first/last-name fields |
| Account management | `super-admin`, `central-admin`, `ministry-admin`, every MDA role, `supplier` | View details, status badges, disable/recover where permitted, update role where permitted, block unauthorized role/user management |
| Asset setup | `central-admin` | Create categories/sub-categories, prevent invalid category hierarchy, create inventory asset, lock financial/provenance fields |
| Asset creation | `central-admin`, `ministry-admin`, `ministry-member`, `ministry-accountant`, `ministry-viewer` | Manual create, edit, import, export, search/filter, media, tag print, QR/public page, role-based mutation restrictions |
| Asset requests | `ministry-member`, `ministry-admin`, `central-admin`, assigned approvers | Create request, review, fulfill from inventory, forward to approvers, approve/reject, prevent duplicate/unauthorized approvals |
| Budget | `central-admin`, assigned approvers, `ministry-accountant` | Create active budget, block duplicate active budget, insufficient budget guard, close/extend/return balance, report scoped balance |
| Procurement and supplier flow | `central-admin`, `supplier` | Create order, supplier quote, confirm within amount, variance flow, cancel, delivery, PDF, supplier route isolation |
| Lifecycle | MDA asset users, assigned lifecycle approvers, receiving MDA user | Transfer, receiving acceptance, maintenance, disposal, initiator approval guard, history |
| Reports and exports | `central-admin`, `ministry-accountant`, `ministry-viewer` | Render reports, export scoped data, block cross-MDA filters, queue-backed export |
| Notifications and audit | All roles involved in workflows | Invitation emails, import summaries, approver action emails, final outcome emails, fulfillment/transfer summaries, no duplicate alerts, activity logs |

## Test Cases

| ID | Area | User | Steps | Expected result |
| --- | --- | --- | --- | --- |
| UAT-001 | Login | Existing verified user | Open login page, enter valid credentials, complete two-factor challenge if shown | User reaches the correct dashboard for their role |
| UAT-002 | Login security | Any user | Enter wrong password repeatedly | Login is rejected and throttling applies after repeated attempts |
| UAT-003 | Password reset | Any user | Use forgot password, open reset link, set new password | User can log in with the new password |
| UAT-004 | Platform invitation setup | New `central-admin` | Super Admin creates Central Admin with first and last name, opens invitation link, sets password | Link uses `/platform-invitations/{token}`, account becomes verified only after password setup, user can log in |
| UAT-005 | Trusted devices | Authenticated user | Open Security page, view trusted devices, revoke one device | Device is removed and no other user's device is affected |
| UAT-006 | MDA creation | `central-admin` | Create MDA with name, code, and type | MDA is created, appears in MDA list, and no editable allowed-domain field is shown |
| UAT-007 | MDA import | `central-admin` | Download template, upload valid MDA CSV | Valid MDAs are imported and invalid rows report errors |
| UAT-008 | First MDA admin invitation | `central-admin` or authorized MDA admin | Invite a `ministry-admin` with first name, last name, and `@ogunstate.gov.ng` email, then accept invitation | User is created under the selected MDA with selected role and can access MDA dashboard |
| UAT-009 | MDA invitation invalid domain | Authorized inviter | Attempt MDA invitation with a non-`@ogunstate.gov.ng` email | Invitation is blocked with a clear validation message |
| UAT-010 | MDA invitation invalid or expired link | Invited user | Open cancelled, expired, or tampered invitation link | Access is blocked and user is told to request a fresh invitation |
| UAT-011 | Platform invitation resend | `super-admin` | Create Central Admin, allow invitation to be expired or mark it pending, resend invitation, try old and new links | Old link is unusable; new link works and expiry is extended by 7 days |
| UAT-012 | Individual MDA invitation | `ministry-admin` | Invite user as `ministry-member` using first and last name, accept invitation | User is created under the same MDA with selected role |
| UAT-013 | Bulk MDA invitation | `ministry-admin` | Upload bulk invitation CSV with first-name and last-name columns | Valid invitations are created, invalid rows are reported, and initiating admin receives one summary email |
| UAT-014 | Removed roles unavailable | `ministry-admin` or `central-admin` | Open role selection screens and CSV templates | Removed roles are not selectable: `admin`, `approver`, `approver-1`, `approver-2`, `ministry-owner`, `ministry-asset-officer`, `ministry-request-officer` |
| UAT-015 | MDA tenancy | User from MDA A | Try to view or edit MDA B users/assets/requests by URL | Access is denied or data is not visible |
| UAT-016 | Platform user create | `super-admin` | Create Central Admin/platform user with first name, last name, email, and role | User is created as setup pending, no password field is required, and platform invitation email is sent |
| UAT-017 | Supplier create | `central-admin` | Create supplier user through supplier flow | Supplier can log in and sees supplier dashboard only |
| UAT-018 | Asset category create | `central-admin` | Create parent category and sub-category | Category records are saved and visible |
| UAT-019 | Asset category guard | `central-admin` | Attempt to set category parent to itself or child | Validation blocks the change |
| UAT-020 | Asset create | `central-admin` or permitted MDA user | Create asset with category, MDA, custodian, location, supplier, media | Asset is created with tag and appears in asset list |
| UAT-021 | Asset update | Permitted user | Edit allowed asset fields and media | Changes save and activity/history is visible where applicable |
| UAT-022 | Locked financial fields | Permitted user | Try to change locked financial/provenance fields on locked asset | Change is blocked |
| UAT-023 | Asset import | Permitted user | Download asset template, upload valid CSV using dates such as `2024-01-15` and `1/15/2024` | Assets are imported, valid purchase dates are accepted, failed rows are reported, and initiating user receives one summary email |
| UAT-024 | Asset export | Permitted user | Apply filters and request export | Export job is created and downloadable when complete |
| UAT-025 | Public QR page | Any user | Open public asset URL/QR page | Only public asset identity appears; financial/supplier/internal details are hidden |
| UAT-025A | Asset tag print | Permitted user | Print or preview asset tag for a long asset name/tag | Tag content fits within the printable layout and does not span across 5 or more pages |
| UAT-026 | MDA member asset permissions | `ministry-member` | Create/edit/import asset, then attempt delete or financial view | Create/edit/import succeeds; delete and financial view are blocked |
| UAT-027 | MDA viewer restrictions | `ministry-viewer` | View assets/requests, attempt create/edit | View succeeds; mutation is blocked |
| UAT-028 | Asset request create | `ministry-member` | Create asset request with category, quantity, amount, expense code | Request is created for user's MDA |
| UAT-029 | Request review | `central-admin` | Open request and mark under review | Status changes to under review |
| UAT-030 | Fulfill from inventory | `central-admin` | Select available inventory asset and fulfill request | Asset is assigned and request becomes fulfilled |
| UAT-031 | Inventory conflict | `central-admin` | Try to fulfill using already assigned asset | Fulfillment is blocked with validation error |
| UAT-032 | Forward request | `central-admin` | Forward reviewed request to approvers | Approval records are created for assigned levels |
| UAT-033 | Role-only approval blocked | User with role but no assignment | Open approval route or submit approval action | Access is denied |
| UAT-034 | Assigned level 1 approval | Assigned approver level 1 | Approve forwarded request | Level 1 records approval, request waits for next level |
| UAT-035 | Assigned level 2 approval | Assigned approver level 2 | Approve after level 1 | Request is approved and budget deduction occurs |
| UAT-036 | Approval wrong MDA | Assigned approver for MDA A | Attempt to approve MDA B request | Access/action is denied |
| UAT-037 | Duplicate approval | Same assigned approver | Submit same approval twice | Second approval is blocked and no duplicate budget deduction occurs |
| UAT-038 | Rejection | Assigned approver | Reject a forwarded request with comment | Request is rejected and budget is not deducted |
| UAT-039 | Approval summary | Authorized user | Open approved request summary | Summary shows request, budget, and approval history |
| UAT-040 | Budget create | `central-admin` | Create active budget for MDA/year/organisation/expense code | Budget is created with correct balance |
| UAT-041 | Duplicate active budget | `central-admin` | Create duplicate active budget key | Duplicate active budget is blocked |
| UAT-042 | Insufficient budget | Assigned final approver | Approve request above available balance | Approval is blocked and balance remains unchanged |
| UAT-043 | Budget status update | `central-admin` | Close budget, extend within allowed February window, return balance | Status fields and ledger values update as expected |
| UAT-044 | Invalid budget extension | `central-admin` | Set extension outside allowed window | Validation blocks the update |
| UAT-045 | Procurement create | `central-admin` | Create procurement order from approved request and supplier | Order is created and visible |
| UAT-046 | Supplier quote | `supplier` | Open assigned order and submit quote items | Quote is saved and order status updates |
| UAT-047 | Procurement confirm | `central-admin` | Confirm quote within approved amount | Order is confirmed |
| UAT-048 | Procurement variance | `central-admin` | Submit quote above approved amount, try confirm, then approve variance | Confirm is blocked until variance approval; after approval confirmation succeeds |
| UAT-049 | Procurement cancel | `central-admin` | Cancel active procurement order with reason | Order is cancelled and cannot continue as active |
| UAT-050 | Procurement delivery | `central-admin` or allowed supplier flow | Mark confirmed order delivered | Order is delivered and related asset workflow completes as expected |
| UAT-051 | Procurement PDF | `central-admin` | Download procurement PDF | PDF downloads and contains order, supplier, MDA, and item details |
| UAT-052 | Asset transfer request | Permitted asset user | Submit transfer to another MDA | Transfer request is pending; asset MDA does not change immediately |
| UAT-053 | Transfer approval | Assigned lifecycle approver | Approve transfer request | Request moves to receiving acceptance stage |
| UAT-054 | Transfer acceptance | Receiving MDA authorized user | Accept approved transfer | Asset moves to receiving MDA and history is recorded |
| UAT-055 | Maintenance lifecycle | Permitted user + assigned approver | Submit maintenance, approve, complete | Asset lifecycle status/history updates correctly |
| UAT-056 | Disposal lifecycle | Permitted user + assigned approver | Submit disposal, approve, complete | Asset is disposed through lifecycle history |
| UAT-057 | Initiator approval blocked | Same initiator user | Submit and attempt to approve own lifecycle request | Approval is blocked unless audited super-admin override applies |
| UAT-058 | Reports index | `central-admin` | Open asset/request/procurement reports | Reports render with filters |
| UAT-059 | Report export authorization | `ministry-accountant` | Export MDA report | Export is scoped to user's MDA |
| UAT-060 | Cross-MDA report guard | MDA user | Attempt to export another MDA's report by URL/filter | Data is denied or constrained to own MDA |
| UAT-061 | Activity logs | `central-admin` | Open activity logs after user/asset/request actions | Logs show relevant action, actor, target, and timestamp |
| UAT-062 | Account recovery | Authorized platform admin | Open account recovery and update recoverable account state | Recovery action is allowed only for authorized admin |
| UAT-063 | Supplier portal isolation | `supplier` | Try to open admin/ministry routes | Access is denied |
| UAT-064 | Queue-backed export | Authorized user | Request large export with queue worker running | Export job completes and file can be downloaded |
| UAT-065 | Production readiness command | Technical tester | Run `php artisan app:production-readiness` in target environment | Command passes or reports concrete blockers |
| UAT-066 | MDA identity display | Any MDA user | Log in and open MDA landing page, asset pages, request pages, and reports | Current MDA/ministry name is visibly shown so the user knows the active MDA context |
| UAT-067 | Platform invitation page copy | Invited platform user | Open platform invitation link | Page shows one clear government/platform header and one setup title; repeated header/title content is absent |
| UAT-068 | Lean email notification scope | Multiple roles | Perform MDA create, manual asset create, under-review status change, report export, request forward, approval, rejection, fulfillment, and imports | Emails are sent only for high-value actions and are not duplicated |
| UAT-069 | Workflow email recipients | Request creator, Central Admin, assigned approvers | Submit request, forward to approvers, approve/reject, fulfill from inventory | Central Admins receive new request notice, assigned approvers receive action-needed notice, creator receives final outcome, fulfillment recipients receive summary |
| UAT-070 | Platform account statuses | `super-admin` | View user details for pending, expired, accepted, and disabled platform users | Status badges show `Setup pending`, `Invitation expired`, `Active`, or `Disabled` accurately; resend is available only when appropriate |
| UAT-071 | Account role boundaries | `super-admin`, `central-admin`, `ministry-admin` | Attempt to create, edit, disable, recover, or change users outside each role's authority | Only permitted account actions succeed; unauthorized role/user actions are blocked |
| UAT-072 | MDA bulk user import | `ministry-admin` | Download user import template, upload valid and invalid rows | Valid users are invited under the correct MDA, invalid rows are summarized, and no per-row duplicate alert is sent |
| UAT-073 | Asset create validation | Permitted asset user | Attempt asset creation without required category, tag/name, MDA/custodian/location, or purchase details where required | Validation messages are clear and no partial asset is created |
| UAT-074 | Asset search and filters | MDA user and `central-admin` | Search/filter by tag, category, MDA, status, location, custodian, and acquisition fields | Results are accurate and scoped to the user's authority |
| UAT-075 | Asset media handling | Permitted asset user | Upload, view, replace, and remove allowed asset media files | Media updates correctly, invalid files are rejected, and history/activity remains intact |
| UAT-076 | Asset delete/archive guard | Permitted and restricted users | Attempt delete/archive for assigned asset, locked asset, and cross-MDA asset | Only authorized and valid delete/archive actions succeed; protected assets remain unchanged |
| UAT-077 | Budget ledger integrity | `central-admin`, assigned final approver | Approve request, reject request, retry duplicate approval, return balance | Ledger/balance changes happen once, rejected requests do not deduct, returned balance is traceable |
| UAT-078 | Supplier management | `central-admin` | Create supplier profile/user, update supplier details, disable supplier, try supplier login after disable | Supplier records update correctly and disabled suppliers cannot access protected supplier routes |
| UAT-079 | Dashboard coverage | All roles | Log in as each role and open the default dashboard/landing page | Dashboard content matches the role and does not expose unauthorized actions |
| UAT-080 | Navigation authorization | All roles | Open primary nav items and manually try restricted URLs | Navigation hides unauthorized actions and direct URLs are denied |

## End-to-End UAT Flow

Run this flow after individual tests pass:

1. Super Admin creates/invites a `central-admin` using the platform invitation flow.
2. Invited `central-admin` accepts `/platform-invitations/{token}`, sets password, and logs in.
3. `central-admin` creates MDA without any editable allowed-domain field.
4. `central-admin` confirms fixed MDA invitation domain behavior for `ogunstate.gov.ng`.
5. `central-admin` or authorized MDA admin invites the first `ministry-admin` with an `@ogunstate.gov.ng` email.
6. `ministry-admin` accepts invitation and confirms the current MDA name is visible on landing/core pages.
7. `ministry-admin` invites `ministry-member`, `ministry-accountant`, and `ministry-viewer` using first and last names.
8. `central-admin` creates supplier and active budget.
9. `central-admin` creates approval assignments for purchase and lifecycle approval.
10. `ministry-member` creates or imports an asset, including a valid `1/15/2024` purchase date import row.
11. `ministry-member` prints/previews the asset tag and confirms the layout fits.
12. `ministry-member` creates an asset request.
13. `central-admin` reviews the request.
14. `central-admin` fulfills from inventory, or forwards to assigned approvers.
15. Assigned approvers approve in sequence.
16. Confirm final approval deducts budget exactly once.
17. `central-admin` creates procurement order for approved request if needed.
18. `supplier` submits quote.
19. `central-admin` confirms quote or approves variance.
20. Procurement is delivered and PDF is downloaded.
21. Run asset transfer lifecycle from request to approval to receiving acceptance.
22. Export asset and report data.
23. Confirm activity logs and lean email notifications capture the major actions without duplicate alerts.

Expected result:
- No cross-MDA leakage.
- Current MDA identity is visible for MDA users.
- No removed roles appear.
- Approval authority depends on assignments, not roles.
- Budget deduction happens once on final approval only.
- Supplier sees only supplier routes.
- Reports and exports respect authorization.
- Platform onboarding uses platform invitations, not password reset links.
- MDA invitations enforce `ogunstate.gov.ng` and first/last-name fields.

## UAT Sign-Off Checklist

| Check | Pass/Fail | Evidence |
| --- | --- | --- |
| Authentication and security flows pass |  |  |
| Platform invitation flow works and separates setup from password reset |  |  |
| MDA invitations work and block invalid domains/links |  |  |
| MDA identity is visible for all MDA roles |  |  |
| Role permissions match expected access |  |  |
| Removed roles are absent from UI/imports/tests |  |  |
| MDA tenancy prevents cross-MDA access |  |  |
| Asset CRUD/import/export works, including accepted purchase date formats |  |  |
| Asset tag print layout fits on the intended page |  |  |
| Locked financial fields cannot be edited |  |  |
| Asset lifecycle workflows require assignments and history |  |  |
| Request review, inventory fulfillment, and approval work |  |  |
| Budget deduction and validation controls work |  |  |
| Procurement and supplier workflows work |  |  |
| Reports and exports work with proper authorization |  |  |
| Email notifications are correct, useful, and not duplicated |  |  |
| Activity logs show important actions |  |  |
| Production readiness command passes in target environment |  |  |

## Blocking Defects

Treat these as UAT blockers:
- user can access another MDA's private data
- MDA user cannot identify the current MDA/ministry context
- unassigned user can approve
- removed role appears as selectable authority
- web UI can create or promote a `super-admin`
- Central Admin/platform setup email uses a reset-password link instead of a platform invitation link
- pending invited platform user shows as active before password setup
- expired or resent platform invitation token remains usable
- password reset verifies an invited account before setup
- MDA invitation accepts an email outside `ogunstate.gov.ng`
- user creation uses a full-name field where first and last name are required
- duplicate invitation or workflow emails are sent for one action
- budget deducts twice for one request
- final approval succeeds without active budget when budget is required
- locked financial fields can be edited
- valid asset import purchase date such as `1/15/2024` is rejected
- asset tag print layout spans across multiple unintended pages
- supplier can access admin or MDA routes
- public asset page exposes financial, supplier, budget, or internal audit details
- report export includes unauthorized MDA data
- lifecycle transfer/disposal/maintenance bypasses required approval assignment