# Phase 4B manual test script: budgets, roles, sessions and passwords

For the treasurer, a department head and the administrator. About 30 minutes. The rules (cost-centre
lines, control by cost centre, one alert per threshold, copy forward, the variance figures, custom roles
only carrying access the author holds, password length, reuse and expiry, ending sessions) are also proved
by `tests/Feature/BudgetsAndUsersTest.php`. This script checks what people see.

**Staff app:** http://localhost/church_acct_app/public/app
**Logins** (demo church, no two-factor): **treasurer@demo.church.test** (budgets),
**media@demo.church.test** (department head, requisitions), **pastor@demo.church.test** (approves budgets).
The administrator **admin@demo.church.test** uses the password you set on 18 Oct. See `docs/test-logins.md`.
The demo church has cost centres (Setup › Cost centres). If it has none, add "Youth" and "Media" first.

## A. Budget lines by cost centre (treasurer)

1. [ ] **Budgets**: open this year's draft budget, or make one with **New budget**. On an expenditure
   heading (e.g. Fuel and diesel) press **+ cost centre** and choose Youth. The amount moves onto a
   "Youth" line.
2. [ ] Press **+ cost centre** on that line again and add Media; give it an amount. Press **Save**. Both
   lines stay after the page reloads.
3. [ ] Press **remove** on the Media line, then on the Youth line. The heading goes back to one line for
   the whole account. Put the two cost-centre lines back and save.
4. [ ] Choose a **Holder** (yourself) and save. Ask the pastor to **Approve**.

## B. Requisitions by cost centre (department head)

5. [ ] **Expenses › New requisition** on the same heading. A **Cost centre** list appears. Choose Youth:
   the budget box shows the Youth line only (annual, spent, committed, available).
6. [ ] Ask for more than the Youth line has left. In block mode it is refused on submission; in warn mode
   it is flagged. Choose Media instead: the box shows Media's figures.
7. [ ] Create a requisition within budget. The green message says how much of the line is now used, e.g.
   "The budget line is now 45% used". The requisition page shows its cost centre.

## C. Alerts, dashboard and next year (treasurer)

8. [ ] Spend or request enough on one cost-centre line to pass 80%. The **Dashboard** lists it under
   "Budget lines nearly used up" with its percentage.
9. [ ] (Optional, on the server) run `php artisan budgets:alerts`. The holder gets one email "Budget 8x%
   used: …". Running it again sends nothing new.
10. [ ] On the approved budget press **Copy to {next year}…** and enter 10. Next year's draft opens with every
   line 10% higher, the same cost-centre lines and the same holder. The button no longer appears on the
   original budget.
11. [ ] **Reports › Budget Variance**: press **Quarter**, then **Year**. Variance is positive when spending
   is under budget; overspent lines are highlighted. Choose the Youth cost centre and run: only Youth's
   budget and spending are compared.

## D. Custom roles (administrator)

12. [ ] **Users & roles › Roles and what each can do**: the built-in roles are listed with their number of
   permissions and people. **See access** lists a role's permissions.
13. [ ] **New role** "Welfare Desk", start from nothing, tick Welfare: view and manage. Create it.
14. [ ] Give an existing test user (e.g. welfare@demo.church.test) the role "Welfare Desk" on the Users
   page. Their role shows as "Welfare Desk". Signed in as them, the menu shows Welfare and nothing about
   giving or expenses.
15. [ ] Try to **Delete** the role: the Delete link is not shown while someone holds it. Try to create a
   role named "Treasurer": refused, the name is taken.
16. [ ] Signed in as the treasurer, open `/app/setup/roles`: not allowed (it needs user management).
   Put the welfare user back on their old role afterwards.

## E. Sessions and passwords

17. [ ] Sign in as the treasurer in two browsers (e.g. Chrome and Edge, or one private window). **Account
   security › Where you're signed in** lists both, with "this device" on the current one.
18. [ ] **Sign out** the other one: that browser goes to the sign-in page on its next click.
19. [ ] As the administrator on **Users & roles**, the Devices column shows how many sessions each person
   has. **Sign out** next to the treasurer signs them out everywhere.
20. [ ] **Password policy**: minimum length 12, expires after 90 days, 3 earlier passwords barred. Save.
21. [ ] So the demo logins keep their passwords, make a throwaway user "Policy Test" (role Counting team)
   with a temporary password of 12+ characters, and sign in as them. On **Account security**, change the
   password to an 11-character one: refused. Change it to a new 12-character one, then try to change it
   back to the temporary one: refused ("not used before").
22. [ ] Set the policy back to 10 / 0 / 0 and make "Policy Test" inactive.

## Sign-off

| Section | Checked by | Date | Notes |
|---|---|---|---|
| A–C Budgets | | | |
| D Roles | | | |
| E Sessions and passwords | | | |