Trường Số QA/00 Shell, tenancy, roles and decisions
Trường Số · QA test suite · Phase 1 · 10/09/2026

00 · Shell, tenancy, roles and decisions

Test cases for PRD 00. Every case names the fixture data it needs (see the dashboard fixtures table), numbered steps, and one observable expected result. Trace points to the user story or rule in the PRD.

Key facts, origin and limits
Cases
33
P0 / P1
6 / 21
Regression pack
17
PRD
00 Shell, tenancy, roles and decisions
Phase
P1

Drafted by an AI assistant in a single session on 10/09/2026 as part of the Trường Số QA suite, under the request quoted verbatim on the dashboard. A proposal for team review, not a sign-off.

Sources

  • The Trường Số PRD set (Draft v1, 10/09/2026): user stories, screen tables, business rules and permission matrices, plus the Cloud theme reference.

Limits

  • Phase 1 (authoring) only. Cases are executed in Phase 2 against the local build; results are recorded in testcases.json and runs/run-1/, and every result field is still not_run.
  • Cases inherit any open question or inconsistency in the PRDs they trace to.

1Summary

P0
6
P1
21
P2
6
P3
0
Typefunctionalui-uxedgenegativeregressionflowa11yperfsecurityi18n
Count22400100042

2Test cases

IDTitleTypePriorityPhasePreconditionsStepsExpected resultPRD traceData neededRun 1
TS-OVW-001Sidebar shows the target navigation tree in the specified orderfunctionalP1P1Logged in as U-OWNER on tenant BIG at 1440 px.
  1. Open /dashboard.
  2. Read the sidebar from top to bottom.
Order is exactly: Tổng quan; group TUYỂN SINH with Khách hàng, Lịch hẹn & cuộc gọi, Học thử, Kiểm tra xếp lớp, Nhập dữ liệu; group HỌC VỤ with Học viên, Lớp học, Thời khoá biểu, Điểm danh, Sổ liên lạc; group TÀI CHÍNH with Học phí, Công nợ, Thu chi, Kho; group NHÂN SỰ with Nhân sự, Bảng công; BÁO CÁO; CÀI ĐẶT. No other top-level items.00 §5 navigation map, D8Fixtures belowNot run
TS-OVW-002Each sidebar item routes to the specified pathfunctionalP1P1As U-OWNER.
  1. Click every sidebar item in turn.
  2. Read the browser URL after each click.
URLs are /dashboard, /crm/customers, /crm/schedules, /crm/trials, /crm/placement-tests, /crm/imports, /students, /classes, /timetable, /attendance, /communication, /finance/tuition, /finance/debt, /finance/cashbook, /inventory, /staff, /staff/timesheets, /reports, /settings. Each page renders an h1 matching the sidebar label.00 §5, D8Fixtures belowNot run
TS-OVW-003Legacy /crm/settings/* routes redirect to /settingsfunctionalP1P1As U-OWNER.
  1. Open /crm/settings/users directly.
  2. Open /crm/settings/roles directly.
  3. Open /crm/settings/tags directly.
Each request ends on /settings/users, /settings/roles, /settings/tags respectively (HTTP 301/302 or client redirect); the page content is the new settings page; no 404.00 §5 route prefix note, 10 §3Fixtures belowNot run
TS-OVW-004Existing CRM routes remain under /crm and old bookmarks keep workingregressionP1P1As U-ADM.
  1. Open /crm/customers.
  2. Open /crm/customers/<L1 id>.
Both pages render (Kanban/table list, then lead detail shell) with HTTP 200; no redirect to a root route.D8Fixtures belowNot run
TS-OVW-005Sidebar conforms to Cloud theme geometryui-uxP2P1As U-OWNER at 1440 px.
  1. Measure sidebar width with devtools.
  2. Inspect group heading font size and case.
  3. Inspect the active item style on /students.
Sidebar width 292 px, white background, 1 px right border; group headings uppercase 11 px; active item has light purple background (#F3EBFA) and purple text (#6A309B), no solid bar.Cloud theme §2Fixtures belowNot run
TS-OVW-006Top bar contains branch switcher, quick search, bell and user menufunctionalP1P1As U-OWNER.
  1. Open /students.
  2. Inspect the top bar left to right.
Controls present: branch dropdown showing "Tất cả chi nhánh", search field with ⌘K hint (opens on Cmd/Ctrl+K), notification bell with unread count, user avatar menu. Pipeline selector is NOT shown on /students.00 §5 top barFixtures belowNot run
TS-OVW-007Pipeline selector appears only on CRM pagesfunctionalP2P1As U-ADM.
  1. Open /crm/customers and note the pipeline selector.
  2. Open /classes.
Pipeline selector visible on /crm/customers; absent on /classes and every non-/crm route.00 §5 top barFixtures belowNot run
TS-OVW-008Branch switcher lists exactly the user's accessible branchesfunctionalP0P1U-BM-A (branch A only) and U-OWNER.
  1. As U-BM-A open the branch dropdown.
  2. As U-OWNER open the branch dropdown.
U-BM-A sees only "Quận 1" preselected and no "Tất cả chi nhánh" option. U-OWNER sees "Tất cả chi nhánh", "Quận 1", "Thủ Đức", "Gò Vấp".D1, 00 §3Fixtures belowNot run
TS-OVW-009Switching branch filters every branch-scoped listfunctionalP0P1As U-OWNER.
  1. Select branch "Thủ Đức".
  2. Open /students, /classes, /attendance, /finance/tuition in turn.
  3. Select "Tất cả chi nhánh" and repeat.
With Thủ Đức: /students lists S2 but not S1; /classes lists C3 but not C1; /finance/tuition lists INV-2 but not INV-1. With all branches: both sets appear and a "Chi nhánh" column is shown on /students.D1, 02 §5 Chi nhánh columnFixtures belowNot run
TS-OVW-010Branch selection persists across navigation and reloadfunctionalP2P1As U-OWNER.
  1. Select "Thủ Đức".
  2. Navigate to /classes then reload the page.
Branch dropdown still shows "Thủ Đức" after navigation and after reload.D1Fixtures belowNot run
TS-OVW-011Leads are tenant-level and not filtered by the branch switcherfunctionalP1P1As U-OWNER with branch "Thủ Đức" selected.
  1. Open /crm/customers table view.
  2. Search for L1 (school_id branch A).
L1 is listed; the leads list ignores the branch switcher (leads are per center).00 §3 consequencesFixtures belowNot run
TS-OVW-012Branch-A user cannot read branch-B rows by URLsecurityP0P1As U-BM-A.
  1. Open /students/<S2 id> directly.
  2. Open /classes/<C3 id> directly.
  3. Call GET /api/v3/school/students/<S2 id> with the session cookie.
UI shows a not-found page (text "Không tìm thấy" / 404); API returns HTTP 404 (not 403) with no student fields in the body.12 §3 authorisation, 00 §3Fixtures belowNot run
TS-OVW-013Default roles exist and are lockedfunctionalP1P1As U-OWNER.
  1. Open /settings/roles.
Rows for Chủ trung tâm (owner), Quản lý chi nhánh (branch_manager), Tư vấn tuyển sinh (admissions), Giáo vụ (academic_admin), Kế toán (accountant), Giáo viên (teacher), Chỉ xem (viewer) exist with "Mặc định" tick; the delete action is absent or disabled for each; code and name fields are read-only.D2, 10 §4 default rolesFixtures belowNot run
TS-OVW-014Role matrix per module matches PRD 00 §4 for ownerfunctionalP1P1As U-OWNER.
  1. Open /settings/roles, open Chủ trung tâm.
Every permission group shows scope "Tất cả" (all) for all nine module groups.00 §4Fixtures belowNot run
TS-OVW-015Role matrix for teacher matches PRD 00 §4functionalP1P1As U-OWNER.
  1. Open /settings/roles, open Giáo viên.
Leads: Không; Students: Của mình (own classes); Classes: Của mình read; Attendance: mark own sessions; Finance: Không; Staff: self; Communication: own classes; Inventory: read; Reports: own classes; Settings: Không.00 §4Fixtures belowNot run
TS-OVW-016Viewer role is read-only everywheresecurityP1P1As U-VIEWER.
  1. Open /dashboard, /students, /classes, /finance/tuition.
  2. Look for any create/edit/delete control.
  3. Send POST /api/v3/school/students with a valid body.
Lists and dashboard render; no "+ Thêm", "Sửa", "Thu tiền" or kebab actions are shown; the API returns HTTP 403 with an error code.10 §4 viewerFixtures belowNot run
TS-OVW-017Permission change takes effect on the next request without re-loginfunctionalP1P1U-OWNER and U-ACAD-A logged in in two browsers.
  1. As U-OWNER, on role Giáo vụ untick finance.invoice.create and save.
  2. As U-ACAD-A (already logged in) open /students/<S1 id> and look for "Thu học phí".
  3. As U-ACAD-A call POST /api/v3/teacher/school-finance/tuitions.
Button "Thu học phí" is no longer shown after a page navigation; API returns 403. No logout was required.00 §4, 10 SET-03, test seed 00/10Fixtures belowNot run
TS-OVW-018Stub PermissionGate is removed: Kanban actions respect real permissionssecurityP0P1As U-VIEWER (or a role without customers.edit).
  1. Open /crm/customers Kanban view.
  2. Attempt to drag a card to another stage.
  3. Open a card and look for Won/Lost/Delete buttons.
Drag is disabled or reverts with an error toast; Won/Lost/Delete are hidden; PATCH /customers/{id}/kanban-position returns 403 when sent manually.00 §6 known inconsistenciesFixtures belowNot run
TS-OVW-019Scope vocabulary is own | branch | all everywherefunctionalP1P1As U-OWNER.
  1. Open the role matrix editor.
  2. Call GET /api/v3/crm/me/permissions.
Matrix scope radios are exactly Không / Của mình / Chi nhánh / Tất cả; the API returns scope values only from {own, branch, all}; no "team", "read", "write", "manage" values appear.00 §6, 10 §4 vocabularyFixtures belowNot run
TS-OVW-020D3: every new module ships a table view and no boardui-uxP1P1As U-OWNER.
  1. Open /students, /classes, /attendance, /finance/tuition, /finance/debt, /staff, /inventory.
Each page opens in a table list; no Kanban/board toggle exists on these pages. /crm/customers still offers Kanban and table.D3Fixtures belowNot run
TS-OVW-021D4: an enrolled student always has a FLYER learner profilefunctionalP0P1As U-ACAD-A.
  1. Open /students/<S1 id>.
  2. Check the right rail "Tài khoản FLYER".
  3. Attempt to create a student via /students/new leaving "Tài khoản FLYER" radio unselected.
S1 shows a username and last-active time. The new-student form blocks submit with an inline error under Tài khoản FLYER ("Bắt buộc" or equivalent).D4, 02 STU-02Fixtures belowNot run
TS-OVW-022D5: sessions are materialised rowsfunctionalP1P1As U-ACAD-A.
  1. Open /classes/<C1 id> tab Buổi học.
  2. Count rows.
48 numbered session rows exist, each with date, time, room, teacher, status; the 20 held sessions show "Đã điểm danh" or an attendance marker.D5, 03 §6Fixtures belowNot run
TS-OVW-023D6: invoices reuse the Tuition model with payment_codefunctionalP1P1As U-ACC.
  1. Open /finance/tuition/<INV-1 id>.
  2. Call GET /api/v3/teacher/school-finance/tuitions/<INV-1 id>.
Detail shows Mã HĐ TS1A0001 and a QR; the API response is a Tuition object with lines[], payment_code, qr_url.D6, 05 §2Fixtures belowNot run
TS-OVW-024D7: no SMS channel anywhere in the productfunctionalP1P1As U-OWNER.
  1. Open /settings/notifications.
  2. Open the announcement composer channel checkboxes.
  3. Search the vi and en message files for "SMS".
Channel options are Zalo ZNS, Zalo OA, Ứng dụng (push), Email, Cổng phụ huynh only; no SMS checkbox; no "SMS" string in message files except in a "not available" explanation, if any.D7, 07 §3Fixtures belowNot run
TS-OVW-025D9: switching locale to en translates every visible stringi18nP1P1As U-OWNER.
  1. Switch locale to English from the user menu.
  2. Open /dashboard, /students, /classes, /attendance, /finance/tuition, /settings.
  3. Screenshot each.
All labels, tabs, buttons, empty states and column headers are English; no Vietnamese string remains; no raw i18n keys (e.g. "students.list.title") are rendered.D9, 12 §8Fixtures belowNot run
TS-OVW-026D9: vi and en message files have identical key setsi18nP1P1Repo checkout of the build.
  1. Run the i18n parity script (or diff the key sets of src/i18n/messages/vi.json and en.json).
Zero keys missing on either side; the CI check passes.D9, 12 §8, 12 §11Fixtures belowNot run
TS-OVW-027D10: phase 2 modules are feature-flagged per tenantfunctionalP2P1Tenant BIG with flags inventory=false, staff_pay=false; tenant with flags on.
  1. As U-OWNER on BIG open /inventory and /staff/timesheets.
  2. Repeat on a tenant with the flags on.
With flags off the sidebar hides Kho and Bảng công and direct URL shows a "Tính năng chưa bật" page (not a crash); with flags on both pages render.D10, 12 §10 feature flagsFixtures belowNot run
TS-OVW-028Unauthenticated access redirects to login and backsecurityP0P1Logged out.
  1. Open /students/<S1 id>.
  2. Log in as U-ACAD-A.
Redirect to the login page; after login the browser lands on /students/<S1 id> (return URL preserved).11 §1 auth 401 redirectsFixtures belowNot run
TS-OVW-029Global search finds students, classes and leadsfunctionalP1P1As U-OWNER.
  1. Press Cmd/Ctrl+K.
  2. Type "Nguyen An" (no accents).
  3. Type "MOV-2609".
  4. Type "0987000001".
Results group by type: Học viên S1 (Nguyễn An); Lớp học C1; Khách hàng L1 by phone. Enter on a result navigates to its detail. Accent-insensitive matching works.00 §5 ⌘K, 12 §8 collationFixtures belowNot run
TS-OVW-030Onboarding checklist appears for a new tenantfunctionalP1P1As owner of tenant EMPTY.
  1. Open /dashboard.
A checklist card lists 7 items: thêm chi nhánh, mời nhân sự, tạo khoá học và gói phí, thêm phòng, kết nối tài khoản ngân hàng, kết nối Zalo, nhập học viên; each is a link to its settings page; none is ticked.10 SET-01Fixtures belowNot run
TS-OVW-031Console has a minimum viewport of 1280 px; 1024 shows horizontal scroll inside tables onlyui-uxP2P1As U-OWNER.
  1. Set viewport 1024 x 768 and open /students.
  2. Set viewport 1440 x 900 and repeat.
At 1024 the sidebar collapses to icons or a drawer, the page body does not scroll horizontally, the table scrolls inside its own container. At 1440 the full layout shows with no overflow.12 §9 viewportFixtures belowNot run
TS-OVW-032Error pages show a support codeui-uxP2P1Any user.
  1. Open /students/does-not-exist.
  2. Trigger a server error via a stubbed 500 endpoint if available.
Not-found page shows a short message and a code in the format TS-4xxx; the 500 page shows TS-5xxx and a "Thử lại" button; no stack trace.12 §10 observabilityFixtures belowNot run
TS-OVW-033User menu shows name, role and tenant; logout ends the sessionfunctionalP1P1As U-ACAD-A.
  1. Open the user menu.
  2. Click Đăng xuất.
  3. Press browser Back.
Menu shows display name, role "Giáo vụ", tenant "Big Center", locale switch, Đăng xuất. After logout, Back does not show protected content (redirect to login).12 §3 authenticationFixtures belowNot run
← Dashboard01 Admissions CRM →

Trường Số (truongso.net) · FLYER internal