# Phase 0 manual test script

For a non-developer. About 20 minutes. You need the app running on XAMPP and a phone with an
authenticator app (Google Authenticator, Microsoft Authenticator or similar).

**Address:** http://localhost/church_acct_app/public
**Test logins:** listed at the top of `database/seeders/TobasSeeder.php` (all share one test password,
written in that file). If the test church is missing, a developer runs `php artisan db:seed --class=TobasSeeder`.

Tick each box as you go. If anything does not match, note the step number and what you saw.

## A. Look and feel

1. [ ] Open the address. The sign-in page is deep red with the arch-and-path mark, "TOBAS" and
   "Old Path Revival Church" in gold.
2. [ ] Sign in as **ikeja.cashier@toprc.test**. You go straight in (no two-factor step for a cashier).
3. [ ] The sidebar (or the bar at the top on a phone) is **oxblood red**. Under the church name it says
   **TOBAS · IKEJA**.
4. [ ] Headings use a serif typeface; pages have a warm paper colour, not white or grey.
5. [ ] At the bottom of the sidebar, click the **sun / moon** button. The app switches between
   light, dark and "match device". Reload the page: your choice is remembered.

## B. A branch only sees itself

6. [ ] Open **Members**. You see exactly three people (Tolulope Adebayo, Kunle Ajayi, Ngozi Eze), all
   in **Ikeja**. Nobody from Ajah, Abuja Central or Kano.
7. [ ] Ask a developer for the number of an Ajah member (or try a few numbers) and type
   `/members/<number>` after the address. You get **404 Not Found**, never the other branch's member.
8. [ ] Sign out.

## C. Two-factor login is enforced

9. [ ] Sign in as **ikeja.treasurer@toprc.test**. Instead of the dashboard you are sent to
   **Account security** and asked to set up two-factor login. Nothing else opens until you do.
10. [ ] Scan the code with your authenticator app, enter the 6-digit code, and save the recovery codes.
    You can now use the app.
11. [ ] Sign out and sign in again: you are asked for the 6-digit code.

## D. Headquarters sees every branch

12. [ ] Sign in as **hq.finance@toprc.test** (set up two-factor as in step 10).
13. [ ] The sidebar is **ink (near-black)**, not red, and says **TOBAS · HEADQUARTERS**.
14. [ ] **Members** shows all eight test members across Ikeja, Ajah, Abuja Central and Kano.
15. [ ] Sign out.

## E. Giving roles: "you can only give what you have"

16. [ ] Sign in as **ikeja.admin@toprc.test** (Branch System Admin; set up two-factor).
17. [ ] Open **Users & roles**. The list shows Ikeja's users only, not HQ or Ajah staff.
18. [ ] Open the **Role** list when adding a user. Cashier, Treasurer and Pastor are offered.
    **HQ Administrator**, **HQ Finance Officer** and **Accountant** are *not* offered (they carry
    access a branch admin does not have, such as editing the chart of accounts).
19. [ ] Create a cashier for Ikeja. It works and the new user appears in the list.
20. [ ] Sign out.

## F. The auditor can look but not touch

21. [ ] Sign in as **auditor@toprc.test** (set up two-factor).
22. [ ] You can open Members, Journals and Reports, but there are no buttons to add or change anything.
23. [ ] Sign out, sign in as **hq.admin@toprc.test**, open **Audit trail**. You see entries for the
    auditor's page views ("auditor_viewed"), sign-ins and sign-outs, and the role you gave in step 19
    ("role_assigned").

## G. The audit trail cannot be quietly changed (developer step)

24. [ ] A developer runs `php artisan audit:verify`. It reports **"Audit log intact"**.
    On the live database (MySQL/MariaDB) the audit table also refuses edits outright.

## Known limits of Phase 0

- The public website, CMS and Directs screens are later phases (1, 5 and 7).
- In Claude's built-in preview browser the offline service worker does not register; check offline
  behaviour in Chrome or on a phone.
- New Hausa, Igbo, Pidgin and Yoruba wording needs a native speaker's review.