johannes
4f84fc5e80
The 'dev' audience tier was gated via isInternal() (MSP_ADMIN || BCOS_ADMIN), so MSP admins could read developer/architecture content: technical.* and platform.* Overviews, agent-module internals, dev Internal/Overview tabs. Remap 'dev' to isBcos() (BCOS_ADMIN only) in visible(). Retag the 66 Testing docs from 'audience: dev' to 'audience: internal' so MSP keeps them, per Johannes. Result: MSP sees Customer + Internal + Testing (66 modules); loses all Architect/Claude/architecture. BCOS unchanged. Update platform.guide-access to the new model. Closes #18 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2.3 KiB
2.3 KiB
module, title, tab, order, audience
| module | title | tab | order | audience |
|---|---|---|---|---|
| profile.security | Security | Testing | 35 | internal |
Frontend test checklist for the Security screen in the Profile app. Click through in the UI and mark each row Pass or Fail.
Set up
Log in to any HiveIQ app, then open Profile → Security (sidebar 🔒). Test accounts (all password Passw0rd-d3v!):
| Login | Role | Sees |
|---|---|---|
bcos_a@bcos.dev |
Admin | All institutions |
msp_a@msp1.bcos.dev |
MSP admin | C1 + C2 |
customer_a@customer1.bcos.dev |
Customer | C1 only |
This screen is self-service — it only ever touches your own account, so there's no device or institution list to check. Every role sees the exact same two cards.
What to test
| # | Do this | ✅ Pass if |
|---|---|---|
| 1 | As customer_a, open Profile → Security |
Screen shows two cards: Change Password and Session Timeout — no admin-only controls |
| 2 | In Change Password, leave one field empty | The Change Password button stays greyed out until both fields are filled |
| 3 | Type two different values in New / Confirm, click Change Password | Red message "Passwords do not match." appears and nothing is saved |
| 4 | Type a strong password (12+ chars, upper + lower + a number + a symbol) in both fields, click Change Password | Green "Password changed" toast; both fields clear |
| 5 | Type a short simple password like abc12345 in both fields, click Change Password |
A red error toast appears (real rule is 12+ chars with mixed case, a number and a symbol). This is expected — the placeholder says "Min. 8" but the stronger rule wins, so don't false-fail |
| 6 | Open Session Timeout without changing anything | The Save button is greyed out (nothing to save); Discard is not shown |
| 7 | Change the minutes value (e.g. to 30), click Save |
Green "Session timeout saved" toast; Save greys out again |
| 8 | Change the minutes value again, then click Discard | Value snaps back to the previously saved number and Save greys out — no toast |
| 9 | Log in as bcos_a (admin) and open the same screen |
Identical two cards acting on the admin's own account — no extra admin-only password/reset controls here |
Report a fail with: the row #, which login you used, and what you actually saw.