johannes
4f84fc5e80
The 'dev' audience tier was gated via isInternal() (MSP_ADMIN || BCOS_ADMIN), so MSP admins could read developer/architecture content: technical.* and platform.* Overviews, agent-module internals, dev Internal/Overview tabs. Remap 'dev' to isBcos() (BCOS_ADMIN only) in visible(). Retag the 66 Testing docs from 'audience: dev' to 'audience: internal' so MSP keeps them, per Johannes. Result: MSP sees Customer + Internal + Testing (66 modules); loses all Architect/Claude/architecture. BCOS unchanged. Update platform.guide-access to the new model. Closes #18 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2.3 KiB
2.3 KiB
module, title, tab, order, audience
| module | title | tab | order | audience |
|---|---|---|---|---|
| aria.dashboard | Threat Dashboard | Testing | 35 | internal |
Frontend test checklist for the ARIA Threat Dashboard (aria.bcos.dev) — the landing screen of the ARIA SPA. Click through in the UI and mark each row Pass or Fail.
Set up
Log in at aria.bcos.dev — test accounts (all password Passw0rd-d3v!):
| Login | Role | Sees |
|---|---|---|
bcos_a@bcos.dev |
Admin | Full ARIA dashboard (BCOS_ADMIN only) |
msp_a@msp1.bcos.dev |
MSP admin | No access — dashboard fails to load |
customer_a@customer1.bcos.dev |
Customer | No access — dashboard fails to load |
The cards are fleet-wide totals built from the simulator devices (C1-ATM-001…, C1-TCR-001…, and C2-/C3- for the other institutions). The dashboard loads once on open — there is no refresh button, so reload the page to re-pull numbers.
What to test
| # | Do this | ✅ Pass if |
|---|---|---|
| 1 | As bcos_a, open the ARIA Dashboard |
Page loads with header ARIA Dashboard and three sections: Threat Activity, Compliance, Phase Coverage — cards show numbers, no "Load Failed" toast |
| 2 | Look at the Threat Activity cards | Four cards visible: Total Events, Critical, High, Active Sequences |
| 3 | Click the Critical card | Jumps to the events list filtered to critical events |
| 4 | Click the High card | Jumps to the events list filtered to high events |
| 5 | Click Active Sequences | Opens the Precursor Alerts / sequences view |
| 6 | Click Active IOCs | Opens the IOC Management view |
| 7 | Click Low Posture (and EOL Devices) | Opens the Device Posture view |
| 8 | Try clicking Total Events and Non-Critical Events | Nothing happens — these two cards are not clickable (no hover lift, no navigation) |
| 9 | Scroll to Phase Coverage | Shows five reference rows: Physical Access, Malware Staging, Malware Execution, Persistence, Cleanup — each with a description |
| 10 | Log in as msp_a, then customer_a, open the dashboard |
Both see a "Could not load ARIA stats" error toast with empty/no cards — ARIA is admin-only |
Report a fail with: the row #, which login you used, and what you actually saw.