@mohasinac/appkit 4.34.0 → 4.35.0

package/dist/features/tester/seed-data/authored/account-auth__profile-settings.js

@@ -0,0 +1,207 @@
+/*
+ * WHY: Authored six-part procedures for the account-auth/profile-settings checklist page.
+ * WHAT: 9 case(s), keyed by full checklist id.
+ *
+ * Written by hand, case by case, against the label each one states. There is no
+ * generator: the authoring scripts were deleted once it was clear they were
+ * scaffolding around work that is simply writing.
+ *
+ * 🛑 ONE CASE HERE CHANGES A PASSWORD. `password-change-reset-link` uses
+ * karthik.new@gmail.com and nothing else does, deliberately: `seed-cli` sets
+ * `TempPass123!` only when it CREATES an Auth record and never resets an existing
+ * one, so a persona whose password this case changed would stay changed through
+ * every future re-seed and every later case that signs in as them would fail for a
+ * reason that is not a bug. Its last step puts the password back.
+ *
+ * @tag domain:tester
+ * @tag layer:seed
+ * @tag pattern:none
+ * @tag access:server-only
+ * @tag consumers:seed-data/authored/index.ts
+ * @tag sideEffects:none
+ */
+export const authored = {
+    "checklist-account-auth-profile-settings-avatar-upload": {
+        roles: ["buyer"],
+        startPage: "/user/profile",
+        steps: [
+            "Sign in as rehan.sheikh@gmail.com / TempPass123!.",
+            "Open /user/profile.",
+            "Click 'Profile Details' to expand the section.",
+            "Click 'Edit Profile'.",
+            "Click 'Choose image'.",
+            "Select the file public/test-media/sample-image.png (561 bytes, image/png) from the checkout of this repo.",
+            "Click 'Save changes'.",
+            "Reload the page.",
+            "Click 'Profile Details' to expand the section.",
+        ],
+        inputs: { avatarFile: "public/test-media/sample-image.png", avatarMimeType: "image/png" },
+        expectedBehaviour: "The file uploads through the signed-URL flow and is stored as the user's avatar. The stored URL is a /media/… proxy path, never a raw storage-bucket URL — the proxy is what applies the watermark and keeps the bucket private. After reload the avatar renders from that stored image rather than the initial-letter placeholder.",
+        expectedUiState: "After reload, the Profile Details section shows the uploaded image where the round initial-letter placeholder ('R' for Rehan) previously was. The image renders — not a broken-image icon and not the grey placeholder glyph.",
+        expectedData: { avatarUrlPrefix: "/media/" },
+        endResult: "After reload the uploaded avatar is still displayed, and it also appears in the header account menu. The upload survived the reload.",
+    },
+    "checklist-account-auth-profile-settings-edit-profile": {
+        roles: ["buyer"],
+        startPage: "/user/profile",
+        steps: [
+            "Sign in as rehan.sheikh@gmail.com / TempPass123!.",
+            "Open /user/profile.",
+            "Click 'Profile Details' to expand the section.",
+            "Click 'Edit Profile'.",
+            "Clear the 'Display name' field and type 'QA Profile account-auth-profile-settings-edit-profile'.",
+            "Clear the 'Bio' field and type 'Tester bio update for QA.'.",
+            "Click 'Save changes'.",
+            "Reload the page.",
+            "Click 'Profile Details' to expand the section.",
+        ],
+        inputs: {
+            displayName: "QA Profile account-auth-profile-settings-edit-profile",
+            bio: "Tester bio update for QA.",
+        },
+        expectedBehaviour: "The save succeeds and both fields are written to the user document. The header account menu picks up the new display name too, since it reads the same field.",
+        expectedUiState: "After reload, Profile Details shows the display name 'QA Profile account-auth-profile-settings-edit-profile' and the bio 'Tester bio update for QA.'. Neither field has reverted to 'Rehan Sheikh' or to an empty bio.",
+        expectedData: {
+            displayName: "QA Profile account-auth-profile-settings-edit-profile",
+            bio: "Tester bio update for QA.",
+        },
+        endResult: "After reload the edited display name and bio are still present. A save that 200s and reverts on reload is the failure this case exists to catch.",
+    },
+    "checklist-account-auth-profile-settings-hand-mode-persists-reload": {
+        roles: ["buyer"],
+        startPage: "/user/settings",
+        steps: [
+            "Sign in as rehan.sheikh@gmail.com / TempPass123!.",
+            "Open /user/settings.",
+            "Click the 'Appearance' tab.",
+            "Set the 'Left-hand mode' switch to on.",
+            "Reload the page.",
+            "Click the 'Appearance' tab.",
+            "Sign out.",
+            "Sign back in as rehan.sheikh@gmail.com / TempPass123!.",
+            "Open /user/settings.",
+            "Click the 'Appearance' tab.",
+        ],
+        inputs: { leftHandMode: true },
+        expectedBehaviour: "Left-hand mode is stored on the user's record, not only in browser storage. It therefore survives both a reload and a full sign-out/sign-in cycle, which a localStorage-only preference would not.",
+        expectedUiState: "After reload: the 'Left-hand mode' switch is still on, and the sidebar/drawers are still on the left. After sign-out and sign back in: still on. At no point does it silently reset to off.",
+        expectedData: { leftHandMode: true },
+        endResult: "After a sign-out and sign back in, Left-hand mode is still enabled. Reset it to off afterwards so later cases start from the default layout.",
+    },
+    "checklist-account-auth-profile-settings-hand-mode-toggle-exists": {
+        roles: ["buyer"],
+        startPage: "/user/settings",
+        steps: [
+            "Sign in as rehan.sheikh@gmail.com / TempPass123!.",
+            "Open /user/settings.",
+            "Click the 'Appearance' tab.",
+            "Set the 'Left-hand mode' switch to on.",
+            "Open /user/profile.",
+            "Scroll to the 'Left-hand mode' toggle below the 'Profile Details' section.",
+            "Set the same switch to off.",
+        ],
+        inputs: { leftHandMode: false },
+        expectedBehaviour: "The toggle exists in both places and each writes the same single preference. Switching it takes effect immediately — the drawers and floating buttons move side without a full page load.",
+        expectedUiState: "On the /user/settings Appearance tab a 'Left-hand mode' switch sits under the Layout heading. On /user/profile the same switch appears with the description 'Move drawers, sidebars, and floating buttons to the left side of the screen'. Flipping either one moves the sidebar immediately; the browser does not navigate or re-render the whole page.",
+        endResult: "The switch is present in both places and the page did not reload when it was flipped. The preference is left off, which is the default.",
+    },
+    "checklist-account-auth-profile-settings-notification-prefs": {
+        roles: ["buyer"],
+        startPage: "/user/settings",
+        steps: [
+            "Sign in as rehan.sheikh@gmail.com / TempPass123!.",
+            "Open /user/settings.",
+            "Click the 'Notifications' tab.",
+            "Set the 'Email' switch to off.",
+            "Set the 'Promotions' switch to off.",
+            "Click 'Save preferences'.",
+            "Reload the page.",
+            "Click the 'Notifications' tab.",
+        ],
+        inputs: { emailNotifications: false, promotions: false },
+        expectedBehaviour: "Both changed switches are persisted, and the ones that were not touched keep their prior values. A save that writes the whole preference object from a partly-populated form — resetting untouched switches to their defaults — is the failure to watch for.",
+        expectedUiState: "After reload the Notifications tab shows 'Email' off and 'Promotions' off. Every other switch is exactly as it was before the edit, not reset.",
+        expectedData: { emailNotifications: false, promotions: false },
+        endResult: "After reload the two switches are still off. Turn them back on afterwards so later notification cases are not silently suppressed.",
+    },
+    "checklist-account-auth-profile-settings-own-public-profile-quick-links": {
+        roles: ["buyer"],
+        startPage: "/user",
+        steps: [
+            "Sign in as rehan.sheikh@gmail.com / TempPass123!.",
+            "Open /user.",
+            "Click the 'View public profile' link in the dashboard header.",
+            "Note the URL, then go back to /user.",
+            "Click the 'My Public Profile' tile in the quick-links grid.",
+            "Note the URL, then go back.",
+            "Open /user/profile.",
+            "Click 'Profile Details' to expand the section.",
+            "Click 'View Public Profile', beside 'Manage Addresses'.",
+            "Note the URL.",
+            "Click 'Edit Profile', expand 'Visibility', set profile visibility to Private and click 'Save changes'.",
+            "Open /profile/user-yugi-muto.",
+        ],
+        inputs: { profileVisibility: "Private" },
+        expectedBehaviour: "All three entry points — dashboard header, quick-links tile, and the /user/profile link next to 'Manage Addresses' — resolve to the SAME public profile URL, /profile/user-yugi-muto. None of them lands on the edit-profile page. With visibility set to Private the page still loads for its owner, even though another signed-in user would get a 404.",
+        expectedUiState: "Each of the three clicks puts /profile/user-yugi-muto in the address bar and renders the public profile — a display name, avatar and public tabs — with no 'Display name' input, no 'Save changes' button, and no /user/profile chrome. After switching to Private, /profile/user-yugi-muto still renders for the owner rather than a 'Not found' page.",
+        expectedData: { publicProfileUrl: "/profile/user-yugi-muto" },
+        endResult: "All three links reach the same page. Set profile visibility back to Public afterwards, since other cases read this profile as another user.",
+    },
+    "checklist-account-auth-profile-settings-password-change-reset-link": {
+        roles: ["buyer"],
+        startPage: "/user/settings",
+        steps: [
+            "Sign in as karthik.new@gmail.com / TempPass123!.",
+            "Open /user/settings.",
+            "Expand the 'Change Password' section.",
+            "Read the section without submitting anything, looking for a 'New password' or 'Confirm password' field.",
+            "Click 'Update Password'.",
+            "Open the inbox for karthik.new@gmail.com.",
+            "Open the password-reset email from LetItRip and click the reset link.",
+            "Type QaReset456! as the new password on the reset page and submit it.",
+            "Sign out of LetItRip.",
+            "Sign in as karthik.new@gmail.com / QaReset456!.",
+            "Open /user/settings, expand 'Change Password', click 'Update Password' again, open the new email, follow the link and set the password back to TempPass123!.",
+        ],
+        inputs: { email: "karthik.new@gmail.com", newPassword: "QaReset456!", restoredPassword: "TempPass123!" },
+        expectedBehaviour: "'Update Password' sends a Firebase password-reset email to the account's own address and changes nothing by itself. Identity is proved by reaching that inbox, so a stolen session cookie alone cannot change the password. The new password only becomes active once the emailed link is completed.",
+        expectedUiState: "The 'Change Password' section offers no new-password field at all — only a button that sends the link. After clicking it a confirmation names karthik.new@gmail.com. The email arrives; its link opens the reset page; after submitting, signing in with QaReset456! succeeds and lands on the account dashboard, while the old password is refused.",
+        expectedData: { passwordFieldsOnSettingsPage: 0 },
+        endResult: "The password is back at TempPass123! by the last step. That restore is not optional: the seeder never resets an existing password, so skipping it leaves this account permanently unusable by every other case.",
+    },
+    "checklist-account-auth-profile-settings-public-profile-toggle": {
+        roles: ["buyer"],
+        startPage: "/user/profile",
+        steps: [
+            "Sign in as rehan.sheikh@gmail.com / TempPass123!.",
+            "Open /user/profile.",
+            "Click 'Profile Details' to expand the section.",
+            "Click 'Edit Profile'.",
+            "Click 'Visibility' to expand it.",
+            "Set profile visibility to Private.",
+            "Click 'Save changes'.",
+            "Reload the page.",
+            "Click 'Profile Details' to expand the section.",
+            "Click 'Edit Profile', expand 'Visibility', set profile visibility back to Public and click 'Save changes'.",
+        ],
+        inputs: { profileVisibility: "Private" },
+        expectedBehaviour: "The visibility value is saved without a full page load, and the saved value is what the profile read path uses — not the value the form happened to be showing.",
+        expectedUiState: "After reload, the 'Profile visibility' line in Profile Details reads 'Private'. It has not reverted to 'Public', and the page did not navigate away when Save was clicked.",
+        expectedData: { profileVisibility: "Private" },
+        endResult: "The Private setting survived a reload. Visibility is returned to Public in the final step, because other cases open this profile as a different user.",
+    },
+    "checklist-account-auth-profile-settings-user-pages-signed-out-redirect": {
+        roles: ["guest"],
+        startPage: "/user/profile",
+        steps: [
+            "Open a private/incognito browser window with no active session.",
+            "Open /user/profile and watch the page for 5 seconds.",
+            "Open /user/orders and watch the page for 5 seconds.",
+            "Open /user/bids and watch the page for 5 seconds.",
+        ],
+        expectedBehaviour: "Each route serves a prerendered static shell carrying no session data, then hydrates, finds no user, and redirects to /auth/login. Because the shell is static it is the SAME bytes for every visitor, so it cannot contain anyone's uid, email, display name, order or store id.",
+        expectedUiState: "For each URL: site chrome plus a brief loading state, then the address bar becomes /auth/login. At no point does a real name, email address, order number or store name appear. No spinner is still turning after 5 seconds. Record in the comment whether the flash before the redirect feels acceptable — that tradeoff is what this case is evaluating.",
+        expectedData: { redirectTarget: "/auth/login" },
+        endResult: "All three navigations end on /auth/login with no account data shown. Any trace of a real account is a serious leak and fails this case immediately, separately from the spinner question.",
+    },
+};

package/dist/features/tester/seed-data/authored/account-auth__signup-login.d.ts

@@ -0,0 +1,2 @@
+import type { AuthoredCase } from "./_types";
+export declare const authored: Record<string, AuthoredCase>;

package/dist/features/tester/seed-data/authored/account-auth__signup-login.js

@@ -0,0 +1,298 @@
+/*
+ * WHY: Authored six-part procedures for the account-auth/signup-login checklist page.
+ * WHAT: 15 case(s), keyed by full checklist id.
+ *
+ * Written by hand, case by case, against the label each one states. There is no
+ * generator: the authoring scripts were deleted once it was clear they were
+ * scaffolding around work that is simply writing.
+ *
+ * 🛑 TWO CASES HERE CHANGE A PASSWORD, and each owns a persona nothing else uses —
+ * `password-reset` has neha.op@gmail.com, `auth-email-links-single-use` has
+ * divya.funko@gmail.com. `seed-cli` sets `TempPass123!` only when it CREATES an
+ * Auth record and never resets an existing one, so a changed password outlives
+ * every future re-seed. Both cases restore it in their last step. They used to
+ * point at vivaan.kapoor@gmail.com, which four other authored pages sign in as.
+ *
+ * 🛑 THE GOOGLE CASES NEED REAL GOOGLE CREDENTIALS and cannot be seeded — a
+ * provider link lives in Firebase Auth, not Firestore. They are NOT flagged
+ * `needsReview`: their intent is perfectly clear, and a case that cannot be
+ * reached is a `null` verdict at run time, not an authoring doubt. Confusing the
+ * two hides the unwritten cases inside the unanswerable ones.
+ *
+ * @tag domain:tester
+ * @tag layer:seed
+ * @tag pattern:none
+ * @tag access:server-only
+ * @tag consumers:seed-data/authored/index.ts
+ * @tag sideEffects:none
+ */
+export const authored = {
+    "checklist-account-auth-signup-login-auth-email-links-single-use": {
+        roles: ["guest"],
+        startPage: "/auth/forgot-password",
+        steps: [
+            "Open /auth/forgot-password.",
+            "Type divya.funko@gmail.com in the 'Email address' field.",
+            "Click 'Send reset link'.",
+            "Open the inbox for divya.funko@gmail.com and copy the reset link URL out of the email before opening it.",
+            "Open the copied URL, type QaSingleUse789! as the new password, confirm it, and submit.",
+            "Open the same copied URL a second time.",
+            "Register a fresh account at /auth/register using an inbox you can open, then open its verification link once, and then open that same link a second time.",
+            "Open /auth/forgot-password, request a link for divya.funko@gmail.com again, and use it to set the password back to TempPass123!.",
+        ],
+        inputs: {
+            email: "divya.funko@gmail.com",
+            newPassword: "QaSingleUse789!",
+            restoredPassword: "TempPass123!",
+        },
+        expectedBehaviour: "The action code in each link is one-time. The second open is refused by Firebase and the site turns that refusal into readable English with a way to get a fresh link. No second password change is applied and no second verification is recorded.",
+        expectedUiState: "On the second open of the reset link: a message in the shape of 'This link has already been used or has expired', plus a control to request a new one. Not a blank page, not a raw 'auth/invalid-action-code', not a stack trace, and not a working password form. The second open of the verification link reads the same way.",
+        expectedData: { passwordChangesApplied: 1 },
+        endResult: "Account state after the second click is identical to after the first. divya.funko@gmail.com is back on TempPass123! by the final step — skipping that restore leaves the account unusable by every later case, since the seeder never resets an existing password.",
+    },
+    "checklist-account-auth-signup-login-auth-emails-sender-identity-and-inbox": {
+        roles: ["guest"],
+        startPage: "/auth/register",
+        steps: [
+            "Open /auth/register.",
+            "Type QA Sender Test in 'Full name', a real Gmail address you can open in 'Email address', TestPass123! in both password fields, tick the terms checkbox, and click 'Create account'.",
+            "Open that Gmail inbox, checking the Spam and Promotions tabs as well, and find the verification email.",
+            "Read its From name and From address, and open the link inside it.",
+            "Open /auth/forgot-password, type the same Gmail address, and click 'Send reset link'.",
+            "Open the Gmail inbox again, find the password-reset email, and read its From name and From address.",
+            "Repeat both flows with a non-Gmail address if one is available, and check that inbox the same way.",
+        ],
+        inputs: { fullName: "QA Sender Test", password: "TestPass123!" },
+        expectedBehaviour: "Both emails are delivered to the inbox within a few minutes, from the site's own configured sender. The links inside resolve to the live site and complete their flows rather than 404ing or landing on a Firebase-hosted page the site does not control.",
+        expectedUiState: "The From display name is spelled 'LetItRip' exactly — not 'Letitrip', not 'LetiTrip', not 'letitrip.in'. Both messages sit in the Primary inbox, not Spam or Promotions. Clicking through opens letitrip.in and the flow finishes.",
+        expectedData: { senderDisplayName: "LetItRip" },
+        endResult: "Verification marks the new account verified and the reset link changes its password. If Gmail and non-Gmail were both tried, note in the comment whether delivery differed — that difference is the point of testing two providers.",
+    },
+    "checklist-account-auth-signup-login-email-signup": {
+        roles: ["guest"],
+        startPage: "/auth/register",
+        steps: [
+            "Open /auth/register.",
+            "Type QA Signup Tester in the 'Full name' field.",
+            "Type qa-signup-1@mailnull.com in the 'Email address' field — if that address already has an account from a previous run, increment the number and use qa-signup-2@mailnull.com, and so on.",
+            "Type TestPass123! in the 'Password' field.",
+            "Type TestPass123! in the 'Confirm password' field.",
+            "Tick the 'I accept the terms' checkbox.",
+            "Click 'Create account'.",
+            "Open /user.",
+        ],
+        inputs: {
+            fullName: "QA Signup Tester",
+            email: "qa-signup-1@mailnull.com",
+            password: "TestPass123!",
+        },
+        expectedBehaviour: "A Firebase Auth record and a matching Firestore user document are created, keyed on the Auth uid rather than on a generated user-* slug. A verification email is dispatched. The browser is signed in and moved off /auth/register.",
+        expectedUiState: "The address bar leaves /auth/register for / or /user, and the header shows a signed-in avatar with no 'Sign in' link. Submitting the same address a second time is refused with a readable 'email already in use' message, not a duplicate account.",
+        expectedData: { displayName: "QA Signup Tester" },
+        endResult: "Reloading /user shows 'QA Signup Tester' and the address used. The account persists — this case creates a real row that a later teardown does not remove, which is why the address is numbered rather than fixed.",
+    },
+    "checklist-account-auth-signup-login-email-verify": {
+        roles: ["guest"],
+        startPage: "/auth/register",
+        steps: [
+            "Open /auth/register and create an account with an inbox you can open, using TestPass123! as the password.",
+            "Open the inbox and find the verification email from Firebase.",
+            "Open the verification link in the email.",
+            "Open /auth/login and sign in with that account.",
+            "Open /user.",
+        ],
+        inputs: { password: "TestPass123!" },
+        expectedBehaviour: "Following the link flips the account's emailVerified flag in Firebase Auth, and the site reads that flag rather than a separate copy of its own. The verified state survives sign-out and sign-in.",
+        expectedUiState: "The link lands on a confirmation page. After signing in, /user carries no 'Your email is not verified' banner and no prompt to resend the verification email.",
+        expectedData: { emailVerified: true },
+        endResult: "Reloading /user still shows no verification warning. An account that reads as unverified after a successful link click is the failure this case catches.",
+    },
+    "checklist-account-auth-signup-login-forgot-password-no-account-enumeration": {
+        roles: ["guest"],
+        startPage: "/auth/forgot-password",
+        steps: [
+            "Open /auth/forgot-password.",
+            "Type nobody-here-12345@example.com in the 'Email address' field.",
+            "Click 'Send reset link'.",
+            "Read the resulting message and note its exact wording.",
+            "Reload /auth/forgot-password, type rehan.sheikh@gmail.com, and click 'Send reset link'.",
+            "Read that message and compare the two word for word.",
+        ],
+        inputs: { unknownEmail: "nobody-here-12345@example.com", knownEmail: "rehan.sheikh@gmail.com" },
+        expectedBehaviour: "The browser calls Firebase directly, so it is the client that must swallow auth/user-not-found. Both submissions produce the identical generic response; nothing in the message, the timing or an error toast distinguishes an address that has an account from one that does not.",
+        expectedUiState: "Both attempts show the same text — 'If an account exists for that email, a reset link is on its way.' or equivalent. The unknown address produces no red toast, no 'user not found', no field-level error, and no different button state.",
+        endResult: "No email arrives for nobody-here-12345@example.com. The two on-screen responses were indistinguishable, which is the whole point — a difference of any kind is an account-enumeration leak.",
+    },
+    "checklist-account-auth-signup-login-google-link-confirmation-shown": {
+        roles: ["buyer"],
+        startPage: "/user",
+        steps: [
+            "Sign in as an account that already has Google linked — or link one first through /user/settings > 'Linked Accounts' > 'Connect Google'.",
+            "Open /user.",
+            "Read the alert area near the top of the dashboard.",
+            "Reload the page.",
+        ],
+        expectedBehaviour: "The dashboard handles the linked case explicitly, not just by omitting the unlinked prompt. Before this was fixed the whole alert block disappeared once linked, so a user had no confirmation on /user at all — only Settings showed a Connected badge.",
+        expectedUiState: "A green confirmation alert reading 'Google account connected', carrying a Connected badge and the linked Google email address. The blue 'Connect your Google account' prompt is absent. An empty space where the alert used to be is a fail, not a pass.",
+        endResult: "After reload the green confirmation is still there and the blue prompt has not returned. Needs a Google account to reach — answer null with that reason rather than guessing if none is available.",
+    },
+    "checklist-account-auth-signup-login-google-link-conflict-rejected": {
+        roles: ["buyer"],
+        startPage: "/user/settings",
+        steps: [
+            "Sign in as rehan.sheikh@gmail.com / TempPass123!.",
+            "Open /user/settings, expand 'Linked Accounts', click 'Connect Google', and complete the popup with a Google account G.",
+            "Sign out.",
+            "Sign in as vivaan.kapoor@gmail.com / TempPass123!.",
+            "Open /user/settings.",
+            "Expand the 'Linked Accounts' accordion.",
+            "Click 'Connect Google'.",
+            "Select the same Google account G in the popup and complete the flow.",
+            "Reload /user/settings and expand 'Linked Accounts'.",
+        ],
+        inputs: { accountA: "vivaan.kapoor@gmail.com", accountB: "rehan.sheikh@gmail.com" },
+        expectedBehaviour: "The second link is refused because G already belongs to rehan.sheikh@gmail.com. Neither account is modified: the two are not merged, and G's email is not moved from one to the other. A silent merge here would join two people's orders, addresses and wishlists.",
+        expectedUiState: "A readable error in the shape of 'This Google account is already linked to another account'. vivaan.kapoor@gmail.com still shows a 'Connect Google' button, not a Connected badge.",
+        endResult: "After reload vivaan.kapoor@gmail.com has no Google link and rehan.sheikh@gmail.com still has G. Unlink G from rehan.sheikh@gmail.com afterwards. Needs a real Google account — answer null if none is available.",
+    },
+    "checklist-account-auth-signup-login-google-link-different-email": {
+        roles: ["buyer"],
+        startPage: "/user/settings",
+        steps: [
+            "Sign in as vivaan.kapoor@gmail.com / TempPass123!.",
+            "Open /user/settings.",
+            "Expand the 'Linked Accounts' accordion.",
+            "Click 'Connect Google'.",
+            "Select a Google account whose email is NOT vivaan.kapoor@gmail.com, and complete the popup.",
+            "Reload /user/settings and expand 'Linked Accounts'.",
+            "Sign out, open /auth/login, and click 'Sign in with Google' choosing that same Google account.",
+        ],
+        inputs: { primaryEmail: "vivaan.kapoor@gmail.com" },
+        expectedBehaviour: "Linking a differently-addressed Google account requires this explicit button press — it never happens as a side effect of merely signing in with Google. One account now answers to two emails; a second account is not created. The primary login email is unchanged.",
+        expectedUiState: "'Linked Accounts' shows Google as Connected and displays the OTHER email. The account's own email elsewhere in Settings still reads vivaan.kapoor@gmail.com. Signing in with that Google account afterwards lands in this same account, with its existing orders and wishlist.",
+        expectedData: { primaryEmail: "vivaan.kapoor@gmail.com" },
+        endResult: "After reload the link persists and the primary email is still vivaan.kapoor@gmail.com. Unlink afterwards. Needs a second Google account — answer null if none is available.",
+    },
+    "checklist-account-auth-signup-login-google-link-existing": {
+        roles: ["guest"],
+        startPage: "/auth/register",
+        steps: [
+            "Open /auth/register.",
+            "Type QA Google Merge in 'Full name', the email address of a Google account you control in 'Email address', TestPass123! in both password fields, tick the terms checkbox, and click 'Create account'.",
+            "Add any product to the wishlist so the account has something identifying in it.",
+            "Sign out.",
+            "Open /auth/login.",
+            "Click 'Sign in with Google'.",
+            "Select that same Google account in the popup and complete it.",
+            "Open /wishlist.",
+            "Open /user/settings and expand 'Linked Accounts'.",
+        ],
+        inputs: { fullName: "QA Google Merge", password: "TestPass123!" },
+        expectedBehaviour: "Because the Google email matches an existing password account exactly, the sign-in resolves to that same account automatically — no duplicate, and no explicit linking step asked of the user. Google is recorded as connected as a side effect.",
+        expectedUiState: "No 'create account' step appears after the popup. The header shows 'QA Google Merge', and /wishlist still holds the item added before signing out — the proof it is the same account and not a fresh one wearing the same email. 'Linked Accounts' shows Google Connected.",
+        expectedData: { displayName: "QA Google Merge" },
+        endResult: "One account exists for that email, not two, and it kept its wishlist. Needs a Google account whose address you can also register with — answer null if none is available.",
+    },
+    "checklist-account-auth-signup-login-google-oauth": {
+        roles: ["guest"],
+        startPage: "/auth/login",
+        steps: [
+            "Open /auth/login.",
+            "Click 'Sign in with Google'.",
+            "Complete the Google popup by choosing an account.",
+            "Wait for the popup to close and the site to respond.",
+            "Open /user.",
+        ],
+        expectedBehaviour: "The popup opens, Google authenticates, the popup closes, and the site establishes its own session cookie from the returned credential. An account is created if the email is new, or signed into if it already exists.",
+        expectedUiState: "The address bar leaves /auth/login. The header shows a signed-in avatar and no 'Sign in' link. No error toast, and no popup left hanging open after authentication.",
+        endResult: "Reloading /user keeps the session. Needs a Google account — answer null with that reason if none is available.",
+    },
+    "checklist-account-auth-signup-login-google-popup-blocked-fallback": {
+        roles: ["guest"],
+        startPage: "/auth/login",
+        steps: [
+            "Set the browser to block popups for letitrip.in.",
+            "Open /auth/login.",
+            "Click 'Sign in with Google'.",
+            "Leave the blocked-popup notification alone without unblocking it.",
+            "Wait up to 30 seconds and watch the page.",
+            "Open /user.",
+        ],
+        expectedBehaviour: "The site notices the popup never opened and falls back — either to a full-page redirect flow, or to the RTDB signal plus postMessage path — and completes sign-in without asking the user to change browser settings.",
+        expectedUiState: "Within 30 seconds the page reaches a signed-in state: avatar in the header, no 'Sign in' link. What must NOT happen is a button stuck in a loading state forever, or an error toast telling the user to allow popups and nothing else.",
+        endResult: "Reloading /user keeps the session. Needs a Google account plus popup blocking — answer null if either is unavailable.",
+    },
+    "checklist-account-auth-signup-login-login": {
+        roles: ["guest"],
+        startPage: "/auth/login",
+        steps: [
+            "Open /auth/login.",
+            "Type vivaan.kapoor@gmail.com in the 'Email address' field.",
+            "Type TempPass123! in the 'Password' field.",
+            "Click 'Sign in'.",
+            "Open /user.",
+        ],
+        inputs: { email: "vivaan.kapoor@gmail.com", password: "TempPass123!" },
+        expectedBehaviour: "Firebase validates the credential, the site exchanges it for its own __session cookie, and the browser is moved off /auth/login. A wrong password is refused with a readable message rather than a raw Firebase code.",
+        expectedUiState: "The address bar leaves /auth/login for / or /user, and the header shows the avatar for Vivaan Kapoor. No error toast.",
+        expectedData: { signedInUid: "user-seto-kaiba" },
+        endResult: "Reloading /user keeps the session as user-seto-kaiba. Every seeded account uses TempPass123!, so no separate credential lookup is needed.",
+    },
+    "checklist-account-auth-signup-login-logout": {
+        roles: ["buyer"],
+        startPage: "/user",
+        steps: [
+            "Sign in as vivaan.kapoor@gmail.com / TempPass123!.",
+            "Open /user.",
+            "Click 'Log out' in the sidebar.",
+            "Open /user again.",
+        ],
+        expectedBehaviour: "Both halves of the session end: the server __session cookie is cleared and the Firebase client session is revoked. Clearing only one leaves the browser able to re-mint a session on the next request, which is what makes the second navigation the real check.",
+        expectedUiState: "After Log out the page redirects and the header shows the signed-out state. Opening /user afterwards redirects to /auth/login rather than rendering the dashboard, even briefly with real data in it.",
+        expectedData: { redirectTarget: "/auth/login" },
+        endResult: "Navigating to /user lands on /auth/login and no data for Vivaan Kapoor is rendered at any point. A back-button press does not restore the dashboard.",
+    },
+    "checklist-account-auth-signup-login-password-reset": {
+        roles: ["guest"],
+        startPage: "/auth/login",
+        steps: [
+            "Open /auth/login.",
+            "Click 'Forgot password?'.",
+            "Type neha.op@gmail.com in the 'Email address' field.",
+            "Click 'Send reset link'.",
+            "Open the inbox for neha.op@gmail.com and open the reset link.",
+            "Type QaReset321! as the new password, confirm it, and submit.",
+            "Open /auth/login, type neha.op@gmail.com and TempPass123!, and click 'Sign in'.",
+            "Type neha.op@gmail.com and QaReset321! instead, and click 'Sign in'.",
+            "Request another reset link for neha.op@gmail.com and use it to set the password back to TempPass123!.",
+        ],
+        inputs: {
+            email: "neha.op@gmail.com",
+            newPassword: "QaReset321!",
+            restoredPassword: "TempPass123!",
+        },
+        expectedBehaviour: "The reset email arrives, its link opens a set-password form, and the submitted password replaces the old one in Firebase Auth. The old password stops working at that moment — a reset that leaves both passwords valid is the failure worth catching.",
+        expectedUiState: "'Send reset link' produces the generic 'If an account exists for that email…' message. Signing in with TempPass123! after the reset is refused with a readable error; signing in with QaReset321! succeeds and lands on the dashboard.",
+        endResult: "The password is back at TempPass123! by the final step. That restore is mandatory: the seeder never resets an existing password, so skipping it leaves this account permanently signed out of every later case.",
+    },
+    "checklist-account-auth-signup-login-signup-verification-email-arrives": {
+        roles: ["guest"],
+        startPage: "/auth/register",
+        steps: [
+            "Open /auth/register.",
+            "Type QA Verify Tester in the 'Full name' field.",
+            "Type a real inbox address you can open in the 'Email address' field.",
+            "Type TestPass123! in the 'Password' field.",
+            "Type TestPass123! in the 'Confirm password' field.",
+            "Tick the 'I accept the terms' checkbox.",
+            "Click 'Create account'.",
+            "Open that inbox, checking Spam as well, and wait up to five minutes.",
+            "Open the verification link in the email.",
+        ],
+        inputs: { fullName: "QA Verify Tester", password: "TestPass123!" },
+        expectedBehaviour: "Firebase's client SDK sends the verification mail directly, so it carries Firebase's own template and sender rather than the branded LetItRip one. The link resolves to the live site and marks the account verified. The on-screen 'check your email' message is not the thing being tested — the arrival is.",
+        expectedUiState: "An email is present in the inbox within a few minutes. It looks like Firebase's default template, and that difference from the branded Resend emails is expected here, not a defect. Its link opens letitrip.in and reports success.",
+        expectedData: { emailVerified: true },
+        endResult: "Signing in and reloading /user shows no 'email not verified' warning. A 'check your email' screen with no email ever arriving is exactly the failure this case exists to separate from success.",
+    },
+};

package/dist/features/tester/seed-data/authored/account-auth__testing-program--admin.d.ts

@@ -0,0 +1,2 @@
+import type { AuthoredCase } from "./_types";
+export declare const authored: Record<string, AuthoredCase>;

package/dist/features/tester/seed-data/authored/account-auth__testing-program--admin.js

@@ -0,0 +1,33 @@
+/*
+ * WHY: Authored six-part procedures for the account-auth/testing-program checklist page.
+ * WHAT: 1 case(s), keyed by full checklist id.
+ *
+ * Generated by `node tester/scripts/merge-authored.mjs --page account-auth/testing-program`, then
+ * reviewed by a human before merge — the review is the gate, not the generation.
+ * Hand edits are safe and expected: re-running the merge for this page replaces
+ * the file, so re-author only when you mean to discard them.
+ *
+ * @tag domain:tester
+ * @tag layer:seed
+ * @tag pattern:none
+ * @tag access:server-only
+ * @tag consumers:seed-data/authored/index.ts
+ * @tag sideEffects:none
+ */
+export const authored = {
+    "checklist-account-auth-testing-program-admin-testing-section": {
+        roles: ["admin"],
+        startPage: "/admin/dashboard",
+        steps: [
+            "Sign in as admin@letitrip.in.",
+            "Open /admin/dashboard.",
+            "Locate the 'Admin Panel' sidebar on the right side of the page.",
+            "Click the 'Testing' section heading in the sidebar to expand it.",
+            "Locate the 'Test Cases' link in the Testing section.",
+            "Locate the 'Results' link in the Testing section.",
+        ],
+        expectedBehaviour: "The admin sidebar renders a 'Testing' collapsible section containing at least two links: 'Test Cases' (pointing to /admin/tester-checklist) and 'Results' (pointing to /admin/tester-feedback). Both links are clickable and navigate to their respective pages.",
+        expectedUiState: "The Testing section is visible in the Admin Panel sidebar. It contains a 'Test Cases' link and a 'Results' link. Both links are present and labelled exactly 'Test Cases' and 'Results'.",
+        endResult: "After reload, the sidebar still shows the Testing section with both links. No data is persisted by this case — it is a read-only navigation check.",
+    },
+};

package/dist/features/tester/seed-data/authored/account-auth__testing-program.d.ts

@@ -0,0 +1,2 @@
+import type { AuthoredCase } from "./_types";
+export declare const authored: Record<string, AuthoredCase>;