@mohasinac/appkit 4.34.0 → 4.35.0

package/dist/features/tester/seed-data/authored/admin__content-marketing.js

@@ -0,0 +1,151 @@
+/*
+ * WHY: Authored six-part procedures for the admin/content-marketing page.
+ * WHAT: 7 case(s), keyed by full checklist id.
+ *
+ * Written by hand, case by case, against the label each one states. There is no
+ * generator: the authoring scripts were deleted once it was clear they were
+ * scaffolding around work that is simply writing.
+ *
+ * 🛑 THE ADS SETTINGS WERE WRITTEN BY THE ADMIN FORM WHILE UNDECLARED ON THE
+ * SETTINGS TYPE, which is how a whole group escapes every type-driven review —
+ * provider credentials and every draft, paused and scheduled ad went out through
+ * an unauthenticated public endpoint, unmasked and invisible to any reader
+ * checking the interface. Two cases here read the PUBLIC response rather than the
+ * admin form.
+ *
+ * @tag domain:tester
+ * @tag layer:seed
+ * @tag pattern:none
+ * @tag access:server-only
+ * @tag consumers:seed-data/authored/index.ts
+ * @tag sideEffects:none
+ */
+export const authored = {
+    "checklist-admin-content-marketing-ads-crud-preview": {
+        roles: ["admin", "guest"],
+        startPage: "/admin/ads",
+        steps: [
+            "Sign in as admin@letitrip.in / TempPass123!.",
+            "Open the admin ads surface and read every existing ad, its status and its provider settings.",
+            "Create an ad named 'QA Ad crud-preview' in a DRAFT state, with a placement and any provider credential field filled in.",
+            "Save, RELOAD, and read every field including how the credential is displayed.",
+            "Use the preview and read what it renders.",
+            "Open / in a private window and check the draft ad is NOT rendered anywhere.",
+            "Open that page's source and search for the ad's name and for the credential value.",
+            "Delete the ad.",
+        ],
+        inputs: { name: "QA Ad crud-preview", status: "draft" },
+        expectedBehaviour: "A draft ad is invisible publicly and its provider credentials never leave the server. The ads group was written by the admin form while undeclared on the settings type, so it was published wholesale by an unauthenticated endpoint — including drafts and unmasked credentials — and nothing type-driven could see it.",
+        expectedUiState: "The ad round-trips with its credential MASKED in the admin form. The public page does not render it and its source contains neither the ad's name nor the credential value. A draft appearing publicly, or a credential in the source, is a leak rather than a display bug.",
+        expectedData: { credentialInPublicSource: 0 },
+        endResult: "The ad is deleted by the final step.",
+    },
+    "checklist-admin-content-marketing-newsletter-export-admin": {
+        roles: ["admin"],
+        startPage: "/admin/newsletter",
+        steps: [
+            "Sign in as admin@letitrip.in / TempPass123!.",
+            "Open the admin newsletter surface and read the subscriber count and the rows.",
+            "Read whether subscriber email addresses are shown in full or masked.",
+            "Trigger the export and read what the page does immediately.",
+            "Navigate away and back, then read whether the export's progress is still reported.",
+            "Wait for it to finish and open the exported file.",
+            "Compare the file's row count against the subscriber count shown.",
+        ],
+        expectedBehaviour: "The export runs as a background job rather than inside the request — an unbounded scan of every subscriber is exactly the shape that dies at the ten-second function ceiling in production while a small local list passes. The page subscribes to the job's progress instead of waiting on a response.",
+        expectedUiState: "The export returns immediately with a job accepted rather than freezing the page. Progress survives navigating away and back. The finished file's row count matches the subscriber count. A request that hangs and then times out is the failure.",
+        endResult: "An export file exists. Note whether subscriber emails are exposed in the LIST as well as in the file — the file is expected to carry them, the list is a judgement.",
+    },
+    "checklist-admin-content-marketing-contact-submissions-admin": {
+        roles: ["admin", "guest"],
+        startPage: "/contact",
+        steps: [
+            "Open /contact in a private window and submit a message: name 'QA Contact submissions-admin', email qa-contact-admin@mailnull.com, subject 'Checklist submission', message 'Sent by the tester checklist.'.",
+            "Sign in as admin@letitrip.in / TempPass123!.",
+            "Open the admin contact submissions surface and find that message.",
+            "Read every field of it and check the full message body is readable from the list or a detail view.",
+            "Read the row actions offered and check at least one lets you VIEW rather than only act.",
+            "Use any status control to mark it handled, then RELOAD and read the status.",
+            "Search zzzznope and read the result count.",
+        ],
+        inputs: {
+            name: "QA Contact submissions-admin",
+            email: "qa-contact-admin@mailnull.com",
+            message: "Sent by the tester checklist.",
+        },
+        expectedBehaviour: "A submitted message arrives in the admin surface with its full body readable. This is the round trip the contact form's own case cannot prove — a form that shows a confirmation and delivers nothing looks identical to one that works, from the sender's side.",
+        expectedUiState: "The submission appears with its name, email, subject and full body. A view affordance exists alongside any actions. The status change survives a reload. 'zzzznope' returns zero rows rather than the full list.",
+        expectedData: { nonsenseResultCount: 0 },
+        endResult: "The submission remains, marked handled. Its arrival is the assertion — a missing message means the contact form delivers nowhere.",
+    },
+    "checklist-admin-content-marketing-media-library-admin": {
+        roles: ["admin"],
+        startPage: "/admin/media",
+        steps: [
+            "Sign in as admin@letitrip.in / TempPass123!.",
+            "Open the admin media library and read the grid.",
+            "Check every tile renders its image rather than an empty bordered box.",
+            "Read the filter and sort controls and use each, confirming the results change.",
+            "Search for a known filename, then search zzzznope and read the count.",
+            "Open one item and read its detail — filename, dimensions, where it is used.",
+            "Read whether any stored URL shown is a proxy path rather than a raw bucket URL.",
+        ],
+        inputs: { nonsenseQuery: "zzzznope" },
+        expectedBehaviour: "The library lists stored media with working previews. Every tile is a clickable image inside a control, which is the exact shape that collapses to nothing when a shrink-to-fit wrapper sits between the button and the image — the tile renders as an empty box while the control still works.",
+        expectedUiState: "Every tile shows its image at the same size as its neighbours. Filters and sorts change the grid and 'zzzznope' returns none. Stored URLs are proxy paths, since a raw bucket URL bypasses the watermark and the private-bucket guarantee.",
+        expectedData: { nonsenseResultCount: 0 },
+        endResult: "Read-only; nothing persists beyond the URL.",
+    },
+    "checklist-admin-content-marketing-navigation-editor-admin": {
+        roles: ["admin", "guest"],
+        startPage: "/admin/navigation",
+        steps: [
+            "Sign in as admin@letitrip.in / TempPass123!.",
+            "Open /admin/navigation and read every nav item, its label and its destination.",
+            "Create one labelled 'QA Nav navigation-editor' pointing at /about, and save.",
+            "RELOAD and read every field of it.",
+            "Open / in a private window and find the new item in the public navigation.",
+            "Click it and confirm it lands on /about.",
+            "Reorder two items, save, reload, and check the new order holds publicly.",
+            "Delete the item and confirm it disappears from both the editor and the public nav.",
+        ],
+        inputs: { label: "QA Nav navigation-editor", href: "/about" },
+        expectedBehaviour: "The editor is the source of the public navigation, so a create, a reorder and a delete all reach it. A nav entry pointing at a page that does not exist is blocked elsewhere as a hard failure; this case is the other half — an entry that exists and never renders.",
+        expectedUiState: "The new item appears in the public navigation and resolves to /about. The reorder holds after a reload, publicly as well as in the editor. After the delete it is gone from both.",
+        endResult: "The item is deleted and the original order restored. An item saved in the editor but absent from the public nav is the failure.",
+    },
+    "checklist-admin-content-marketing-settings-navigation-actions": {
+        roles: ["admin"],
+        startPage: "/admin/site",
+        steps: [
+            "Sign in as admin@letitrip.in / TempPass123!.",
+            "Open /admin/site and read every tab in the strip.",
+            "Open the header search and type a settings term such as fees.",
+            "Click the result and read which tab opens.",
+            "Read the URL and check it names the tab.",
+            "Copy that URL, open it in a new tab, and confirm it opens on the same tab.",
+            "Open /admin/site with an unknown tab value and read what happens.",
+        ],
+        expectedBehaviour: "Settings are reachable by deep link and by search, and search reaches individual tabs rather than only the page. Landing on the first of nineteen tabs and leaving the admin to hunt is a fail rather than a partial pass, and an unknown tab value falls back quietly because the realistic cause is a stale bookmark.",
+        expectedUiState: "The search result opens the named tab, the URL carries it, and the copied URL reopens the same tab. An unknown value opens the default with no error banner and no blank panel.",
+        endResult: "Read-only; nothing is saved.",
+    },
+    "checklist-admin-content-marketing-features-feature-flags-admin": {
+        roles: ["admin", "guest"],
+        startPage: "/admin/site",
+        steps: [
+            "Sign in as admin@letitrip.in / TempPass123!.",
+            "Open the feature-flags surface and read every flag and its state.",
+            "Write down the state of each.",
+            "Turn ONE flag off and save.",
+            "RELOAD and check only that flag changed.",
+            "Open the public surface that flag controls and confirm the behaviour changed.",
+            "Turn it back on, save, and confirm the behaviour returns.",
+            "Open /api/site-settings in a private window and read whether any flag is present in the response.",
+        ],
+        expectedBehaviour: "A flag reaches the behaviour it names, and a save of one leaves the others alone. The public settings response is an ALLOW-LIST projection: a flag such as the admin checkout bypass has no business being readable by an anonymous caller, and it was published for a long time because the response was built by spreading the document and deleting three keys.",
+        expectedUiState: "Only the toggled flag changes after the reload. The public behaviour follows it in both directions. The public settings response carries no operational flag — specifically nothing naming a checkout bypass or an admin capability.",
+        expectedData: { operationalFlagsInPublicResponse: 0 },
+        endResult: "Every flag is back in its original state. A flag visible in the public response is a projection leak rather than a settings bug.",
+    },
+};

package/dist/features/tester/seed-data/authored/admin__coupons.d.ts

@@ -0,0 +1,2 @@
+import type { AuthoredCase } from "./_types";
+export declare const authored: Record<string, AuthoredCase>;

package/dist/features/tester/seed-data/authored/admin__coupons.js

@@ -0,0 +1,214 @@
+/*
+ * WHY: Authored six-part procedures for the admin/coupons page.
+ * WHAT: 11 case(s), keyed by full checklist id.
+ *
+ * Written by hand, case by case, against the label each one states. There is no
+ * generator: the authoring scripts were deleted once it was clear they were
+ * scaffolding around work that is simply writing.
+ *
+ * 🛑 THIS ROUTE ONCE ACCEPTED EVERY EDIT AND WROTE NOTHING. The handler returned a
+ * 200 echoing the submission back while only activate and deactivate reached a
+ * repository write — so a changed name, discount, limit or validity looked saved,
+ * looked correct on screen, and was gone on reload. That is why
+ * coupon-admin-edit-actually-saves exists and why nearly every case here ends in
+ * a reload rather than a confirmation message.
+ *
+ * @tag domain:tester
+ * @tag layer:seed
+ * @tag pattern:none
+ * @tag access:server-only
+ * @tag consumers:seed-data/authored/index.ts
+ * @tag sideEffects:none
+ */
+export const authored = {
+    "checklist-admin-coupons-coupon-create-percentage": {
+        roles: ["admin", "buyer"],
+        startPage: "/admin/coupons",
+        steps: [
+            "Sign in as admin@letitrip.in / TempPass123!.",
+            "Open /admin/coupons and create a percentage coupon coded QAADMIN15 at 15%, maximum discount 200, minimum purchase 500, valid for a week.",
+            "Save, RELOAD, and read every field.",
+            "Sign out and sign in as vivaan.kapoor@gmail.com / TempPass123!.",
+            "Add product-beyblade-original-driger-v (₹1,799) to the cart and reach the checkout coupon step.",
+            "Apply QAADMIN15 and read the discount amount.",
+            "Compare it against 15% of ₹1,799 and against the ₹200 cap.",
+        ],
+        inputs: { code: "QAADMIN15", percent: 15, maxDiscount: 200, minPurchase: 500, itemPrice: 1799 },
+        expectedBehaviour: "A percentage coupon applies its rate and then its cap. 15% of ₹1,799 is ₹269.85, above the ₹200 maximum, so the cap is what the buyer receives — a cap that is stored and not applied is invisible until a large enough cart reaches it.",
+        expectedUiState: "After the reload every field holds. At checkout the discount is ₹200.00, not ₹269.85. A discount of ₹269.85 means the cap was ignored.",
+        expectedData: { appliedDiscount: 200 },
+        endResult: "Leave the coupon in place — later cases read it.",
+    },
+    "checklist-admin-coupons-coupon-create-fixed-freeship-bxgy": {
+        roles: ["admin", "buyer"],
+        startPage: "/admin/coupons",
+        steps: [
+            "Sign in as admin@letitrip.in / TempPass123!.",
+            "Open /admin/coupons and read every coupon TYPE the form offers.",
+            "Create a fixed-amount coupon coded QAFIXED100 at ₹100 off with no minimum, and save.",
+            "Create a free-shipping coupon coded QAFREESHIP with no minimum, and save.",
+            "Create a buy-X-get-Y coupon coded QABXGY if the form offers that type, and save.",
+            "RELOAD each and read its type and settings.",
+            "As vivaan.kapoor@gmail.com / TempPass123!, apply each in turn at checkout and read what each changes.",
+            "Delete all three.",
+        ],
+        inputs: { fixedCode: "QAFIXED100", fixedAmount: 100, freeShipCode: "QAFREESHIP", bxgyCode: "QABXGY" },
+        expectedBehaviour: "Each type does something different at checkout: fixed reduces the subtotal by a flat amount, free shipping zeroes the shipping line specifically, and buy-X-get-Y discounts by quantity. A type that saves but behaves identically to another has not been implemented, only listed.",
+        expectedUiState: "The fixed coupon reduces the subtotal by ₹100. The free-shipping one zeroes the SHIPPING line rather than the subtotal — a free-shipping coupon that takes its value off the subtotal is the failure worth naming. Buy-X-get-Y changes the total by quantity.",
+        endResult: "All three coupons are deleted by the final step.",
+    },
+    "checklist-admin-coupons-coupon-per-user-limit-enforced": {
+        roles: ["admin", "buyer"],
+        startPage: "/admin/coupons",
+        steps: [
+            "Sign in as admin@letitrip.in / TempPass123!.",
+            "Open /admin/coupons, find TESTERLIMITED, and read its per-user limit, total limit and current usage.",
+            "Sign in as vivaan.kapoor@gmail.com / TempPass123! and place an order applying TESTERLIMITED.",
+            "Attempt a second order applying it again and read the refusal.",
+            "Sign in as rehan.sheikh@gmail.com / TempPass123! and apply TESTERLIMITED at checkout.",
+            "Sign back in as admin and read the usage count.",
+        ],
+        inputs: { code: "TESTERLIMITED", perUserLimit: 1 },
+        expectedBehaviour: "TESTERLIMITED is one use per user with NO total limit, so exhausting it for one buyer must leave it fully usable by the next. Enforcing a per-user limit as if it were global withdraws the coupon from everybody after a single redemption.",
+        expectedUiState: "The same buyer's second attempt is refused with a limit message. A DIFFERENT buyer's attempt is accepted. The admin usage count has risen by the number of redemptions, and the coupon still reads as active.",
+        expectedData: { perUserLimit: 1 },
+        endResult: "The cross-account half is the case — the same-account half alone passes under either reading.",
+    },
+    "checklist-admin-coupons-coupon-min-max-discount": {
+        roles: ["admin", "buyer"],
+        startPage: "/admin/coupons",
+        steps: [
+            "Sign in as admin@letitrip.in / TempPass123! and confirm QAADMIN15 has a minimum purchase of 500 and a maximum discount of 200.",
+            "Sign in as vivaan.kapoor@gmail.com / TempPass123!.",
+            "Add product-tester-standard-3 (₹99) to the cart alone and apply QAADMIN15 at checkout.",
+            "Read the refusal and whether it names the required amount.",
+            "Add product-beyblade-original-driger-v (₹1,799) so the subtotal clears the minimum, and apply again.",
+            "Read the discount amount.",
+            "Type 799.50 into a money field elsewhere in the coupon form and check a decimal is accepted.",
+        ],
+        inputs: { code: "QAADMIN15", minPurchase: 500, maxDiscount: 200 },
+        expectedBehaviour: "The minimum gates whether the coupon applies at all and the maximum caps what it gives. The minimum is measured against the items the coupon could actually discount rather than the whole cart, and money is decimal rupees throughout — a validator rejecting 799.50 as a non-integer is a leftover from the old whole-number storage.",
+        expectedUiState: "Below the minimum the coupon is refused with a message naming the threshold, not a bare 'Invalid coupon'. Above it the discount is capped at ₹200.00. A decimal amount is accepted in the coupon form.",
+        endResult: "Nothing is ordered; leave checkout without placing.",
+    },
+    "checklist-admin-coupons-coupon-scope-admin-vs-seller": {
+        roles: ["admin"],
+        startPage: "/admin/coupons",
+        steps: [
+            "Sign in as admin@letitrip.in / TempPass123!.",
+            "Open /admin/coupons and read the scope shown on every row.",
+            "Filter or sort by scope if the list offers it, and read the results.",
+            "Open a seller-scoped coupon and read which store it belongs to.",
+            "Open an admin-scoped coupon and read whether it names a store at all.",
+            "Read whether the admin can change a coupon's scope after creation.",
+        ],
+        expectedBehaviour: "There are exactly two scopes and no third: platform-wide with no store, or seller-scoped to one store. The distinction decides which stacking bucket a coupon occupies at checkout, so a row that does not show its scope hides the one field that determines its behaviour.",
+        expectedUiState: "Every row shows its scope. Seller-scoped coupons name their store; admin-scoped ones do not name any. Any scope filter returns rows for both values.",
+        endResult: "Read-only; nothing persists beyond the URL.",
+    },
+    "checklist-admin-coupons-coupon-expire-reject": {
+        roles: ["admin", "buyer"],
+        startPage: "/admin/coupons",
+        steps: [
+            "Sign in as admin@letitrip.in / TempPass123!.",
+            "Open /admin/coupons and find TESTEREXPIRED, reading its end date and its active flag.",
+            "Note that it is still marked active while its end date is in the past.",
+            "Sign in as vivaan.kapoor@gmail.com / TempPass123! and apply TESTEREXPIRED at checkout.",
+            "Read the exact wording of the refusal.",
+            "Sign back in as admin, deactivate an ACTIVE coupon, and apply that one as the buyer.",
+            "Compare the two refusal messages.",
+        ],
+        inputs: { expiredCode: "TESTEREXPIRED" },
+        expectedBehaviour: "Expiry and deactivation are two separate reasons and both refuse. TESTEREXPIRED is seeded past its end date while still flagged active precisely so the DATE check is exercised rather than the flag — a validator reading only the flag would accept it.",
+        expectedUiState: "The expired coupon is refused with a message naming expiry. The deactivated one is refused with a different message. Two identical generic refusals mean only one of the two checks is running.",
+        endResult: "Reactivate the coupon that was deactivated. Leaving it off silently breaks every later case that applies it.",
+    },
+    "checklist-admin-coupons-coupon-admin-is-platform-wide": {
+        roles: ["admin", "buyer"],
+        startPage: "/admin/coupons",
+        steps: [
+            "Sign in as admin@letitrip.in / TempPass123! and confirm QAADMIN15 is admin-scoped with no store.",
+            "Sign in as vivaan.kapoor@gmail.com / TempPass123!.",
+            "Add product-beyblade-burst-regalia-genesis (₹1,399, Beyblade Arena) to the cart.",
+            "Add prizedraw-beyblade-original-vintage-vault (₹299, LetItRip Official) and set its quantity to 2.",
+            "Apply QAADMIN15 at checkout and read the discount.",
+            "Place the order and open both resulting orders in /user/orders.",
+            "Read the QAADMIN15 amount on each and add them together.",
+        ],
+        inputs: { code: "QAADMIN15", arenaSubtotal: 1399, officialSubtotal: 598 },
+        expectedBehaviour: "A platform coupon applies across the whole cart and is then prorated across the per-store orders by their share of the subtotal. The parts must reconcile exactly to what the buyer was shown, or the platform absorbed or overcharged the difference.",
+        expectedUiState: "The discount is computed against the combined subtotal rather than one store's. Both orders carry a share of it and the two shares sum to the single figure shown at checkout — not to more, and not to less.",
+        expectedData: { orderCount: 2 },
+        endResult: "Two orders exist, each with its prorated share. The reconciliation is the assertion.",
+    },
+    "checklist-admin-coupons-coupon-admin-no-stacking-toggle": {
+        roles: ["admin"],
+        startPage: "/admin/coupons",
+        steps: [
+            "Sign in as admin@letitrip.in / TempPass123!.",
+            "Open /admin/coupons and start creating a coupon.",
+            "Read every field and toggle the form offers.",
+            "Look for any control about combining with seller coupons or with other platform coupons.",
+            "Open an existing coupon's editor and look for the same.",
+        ],
+        expectedBehaviour: "Stacking is a platform rule, not a per-coupon setting — one coupon per store plus one platform-wide, unconditionally. The old combine-with-seller-coupons opt-out was removed because nothing read it, and a control that appears to configure a rule it cannot change is worse than no control at all.",
+        expectedUiState: "No stacking or combinability toggle is offered on either the create or the edit form. A toggle present here is the finding, whether or not it saves.",
+        endResult: "Read-only; leave the form without saving.",
+    },
+    "checklist-admin-coupons-coupon-admin-category-restriction-enforced": {
+        roles: ["admin", "buyer"],
+        startPage: "/admin/coupons",
+        steps: [
+            "Sign in as admin@letitrip.in / TempPass123!.",
+            "Create a coupon coded QACATADMIN20 at 20%, restricted to the Beyblade Burst category, no minimum.",
+            "Save, RELOAD, and confirm the restriction persisted.",
+            "Sign in as vivaan.kapoor@gmail.com / TempPass123!.",
+            "Add product-beyblade-metal-storm-pegasus (₹1,299, Metal Fight) alone and apply QACATADMIN20 — read the refusal.",
+            "Add product-beyblade-burst-regalia-genesis (₹1,399, Burst) and apply again.",
+            "Read the discount and compare it against 20% of ₹1,399.",
+            "Sign back in as admin and delete the coupon.",
+        ],
+        inputs: { code: "QACATADMIN20", percent: 20, burstPrice: 1399, metalPrice: 1299 },
+        expectedBehaviour: "The restriction is tested by set intersection against each product's full category chain, and the discount covers only the eligible items. The category is fetched lazily — the cart snapshots none — so the lookup fires only when a coupon actually carries a restriction, and the common case costs no extra reads.",
+        expectedUiState: "The Metal-only cart is refused with a message naming the category. With the Burst item added the coupon applies at about ₹279.80 — 20% of ₹1,399 — not 20% of the ₹2,698 combined subtotal.",
+        expectedData: { eligibleSubtotal: 1399 },
+        endResult: "The coupon is deleted by the final step.",
+    },
+    "checklist-admin-coupons-coupon-admin-edit-actually-saves": {
+        roles: ["admin"],
+        startPage: "/admin/coupons",
+        steps: [
+            "Sign in as admin@letitrip.in / TempPass123!.",
+            "Open /admin/coupons and open QAADMIN15's editor.",
+            "Write down every field: name, description, discount, maximum, minimum, usage limits and both validity dates.",
+            "Change the NAME and the discount percentage, and save.",
+            "Read the confirmation message.",
+            "RELOAD the editor and compare every field against what was written down.",
+            "Change only the validity end date, save, RELOAD, and check the start date is still there.",
+            "Use the deactivate action, then reactivate it, reloading after each.",
+        ],
+        inputs: { code: "QAADMIN15" },
+        expectedBehaviour: "🛑 This is the case the page exists for. The handler once returned a 200 echoing the submission while only activate and deactivate reached a repository write — so a changed name, discount, limit or date looked saved and was gone on reload, with no error to notice. The validity object must also MERGE rather than replace: sending one sub-field wholesale wipes the other date.",
+        expectedUiState: "After the reload the new name and discount are present. After the end-date edit the start date is unchanged. Deactivate and reactivate both persist. A success message followed by the ORIGINAL values after reload is the exact failure, and without the reload the screen looks identical either way.",
+        expectedData: { changesPersisted: true },
+        endResult: "Restore QAADMIN15's original name and percentage, or delete it. This case cannot be judged from the confirmation message — only from the reload.",
+    },
+    "checklist-admin-coupons-coupon-admin-usage-visible": {
+        roles: ["admin", "buyer"],
+        startPage: "/admin/coupons",
+        steps: [
+            "Sign in as admin@letitrip.in / TempPass123!.",
+            "Open /admin/coupons and read the usage figure on every row.",
+            "Note the figure for ARENA25.",
+            "Sign in as vivaan.kapoor@gmail.com / TempPass123! and place an order applying ARENA25.",
+            "Sign back in as admin and read ARENA25's usage figure again.",
+            "Open the coupon's detail and read whether it shows total usage, per-user usage, or both.",
+            "Reload and confirm the figure persists.",
+        ],
+        inputs: { code: "ARENA25" },
+        expectedBehaviour: "Redemption is counted at checkout, per user as well as globally, and the per-user record is written as a side effect of applying the coupon. That write is fire-and-forget, so a failure is silent — a usage figure that never moves is how you find out it failed.",
+        expectedUiState: "The usage figure is exactly one higher after the order and survives a reload. A figure that does not move means the usage write failed without anything surfacing it.",
+        expectedData: { usageIncrement: 1 },
+        endResult: "One order exists carrying the discount. Delete QAADMIN15 as the last action on this page.",
+    },
+};

package/dist/features/tester/seed-data/authored/admin__events-raffles-spin.d.ts

@@ -0,0 +1,2 @@
+import type { AuthoredCase } from "./_types";
+export declare const authored: Record<string, AuthoredCase>;

package/dist/features/tester/seed-data/authored/admin__events-raffles-spin.js

@@ -0,0 +1,160 @@
+/*
+ * WHY: Authored six-part procedures for the admin/events-raffles-spin page.
+ * WHAT: 8 case(s), keyed by full checklist id.
+ *
+ * Written by hand, case by case, against the label each one states. There is no
+ * generator: the authoring scripts were deleted once it was clear they were
+ * scaffolding around work that is simply writing.
+ *
+ * 🛑 THE ADMIN EVENT TYPE PICKER HAS BEEN WRONG BEFORE in a way no query error
+ * surfaced: it offered three types the event union has never had, so each matched
+ * zero rows forever, while omitting five real ones. Two cases here read the picker
+ * and the filter chips against the real union rather than trusting either.
+ *
+ * The two "view before deciding" cases are the same defect as the moderation
+ * pages: a row that offers Confirm and Waitlist without showing the entry lets an
+ * admin act on a record they were never able to read.
+ *
+ * @tag domain:tester
+ * @tag layer:seed
+ * @tag pattern:none
+ * @tag access:server-only
+ * @tag consumers:seed-data/authored/index.ts
+ * @tag sideEffects:none
+ */
+export const authored = {
+    "checklist-admin-events-raffles-spin-raffle-create-open": {
+        roles: ["admin", "buyer"],
+        startPage: "/admin/events/new",
+        steps: [
+            "Sign in as admin@letitrip.in / TempPass123!.",
+            "Open /admin/events/new and read every option in the event type picker.",
+            "Write the list down and compare it against the real event types the catalogue supports.",
+            "Create an event titled 'QA Event raffle-open' with an open raffle, a prize, a start date of today and an end date a week out.",
+            "Save, RELOAD, and read the raffle type, the prize and the dates.",
+            "Sign out, sign in as rehan.sheikh@gmail.com / TempPass123!, and enter the raffle from its public page.",
+            "Sign back in as admin and read the entry count on the event.",
+        ],
+        inputs: { title: "QA Event raffle-open", raffleType: "open" },
+        expectedBehaviour: "The type picker offers every real event type and no invented ones. An option whose value is not a stored type matches nothing forever with no error — the picker once offered three such and omitted five real ones, under a comment deferring the fix.",
+        expectedUiState: "The picker's options match the real type list, with no contest, giveaway or flash-sale style values that the union does not carry, and with lottery present. After the reload the raffle settings hold, and the buyer's entry raises the count.",
+        endResult: "Leave the event in place — the draw case reads it.",
+    },
+    "checklist-admin-events-raffles-spin-raffle-create-top-n-scorers": {
+        roles: ["admin", "buyer"],
+        startPage: "/admin/events/new",
+        steps: [
+            "Sign in as admin@letitrip.in / TempPass123!.",
+            "Create an event titled 'QA Event raffle-scorers' with a top-N-scorers raffle, N set to 3, and a prize.",
+            "Save, RELOAD, and read the raffle type and the N value.",
+            "Open the public page and read how the Overview tab describes who can win.",
+            "Sign in as rehan.sheikh@gmail.com / TempPass123! and enter, then read the Leaderboard tab.",
+            "Read whether the leaderboard is ordered by score and whether the qualifying cut-off is stated.",
+        ],
+        inputs: { title: "QA Event raffle-scorers", raffleType: "top_n_scorers", topN: 3 },
+        expectedBehaviour: "A top-N-scorers raffle draws from the highest-scoring entries, so the leaderboard must rank by score and the public page must state how many qualify. Ranking by entry time instead silently changes who can win, and nothing errors.",
+        expectedUiState: "After the reload the type and N hold. The public Overview states the rule, and the Leaderboard is ordered by score with the cut-off named. A leaderboard ordered by entry time is the failure.",
+        endResult: "Delete the event after reading it.",
+    },
+    "checklist-admin-events-raffles-spin-raffle-create-top-n-participants": {
+        roles: ["admin", "buyer"],
+        startPage: "/admin/events/new",
+        steps: [
+            "Sign in as admin@letitrip.in / TempPass123!.",
+            "Create an event titled 'QA Event raffle-participants' with a top-N-participants raffle, N set to 3, and a prize.",
+            "Save, RELOAD, and read the raffle type and N.",
+            "Open the public page and read how the Overview tab describes who can win.",
+            "Compare that description against the scorers event's.",
+            "Enter as rehan.sheikh@gmail.com / TempPass123! and compare the two leaderboards' ordering.",
+        ],
+        inputs: { title: "QA Event raffle-participants", raffleType: "top_n_participants", topN: 3 },
+        expectedBehaviour: "This variant draws by participation rather than by score — a genuinely different rule from the scorers one. The two exist side by side precisely so the difference is checkable: identical leaderboards on both means the raffle type is not reaching the ranking.",
+        expectedUiState: "The type and N hold after the reload, and the Overview describes a different rule from the scorers event. The two leaderboards order differently. Identical ordering on both is the failure.",
+        endResult: "Delete the event after reading it.",
+    },
+    "checklist-admin-events-raffles-spin-raffle-draw-winner": {
+        roles: ["admin", "buyer"],
+        startPage: "/admin/events",
+        steps: [
+            "Sign in as admin@letitrip.in / TempPass123!.",
+            "Open 'QA Event raffle-open' in the admin and read the entry list.",
+            "Trigger the raffle draw and read the winner named.",
+            "RELOAD and read the winner again.",
+            "Read whether the winner's name and entry are both recorded on the event.",
+            "Sign in as the winning buyer and check they were notified.",
+            "Sign back in as admin and attempt to draw a second time, reading what happens.",
+        ],
+        expectedBehaviour: "The draw picks once with real randomness, records the winner on the event, and notifies them. A second draw must be refused — redrawing replaces a winner who has already been told they won, and the notification cannot be recalled.",
+        expectedUiState: "The winner is named and survives the reload. The event records both the winner and their entry. The buyer has a notification. The second draw attempt is refused rather than producing a new winner.",
+        expectedData: { drawsPermitted: 1 },
+        endResult: "Delete the event afterwards. A second draw succeeding is the most serious failure on this page.",
+    },
+    "checklist-admin-events-raffles-spin-spin-wheel-create": {
+        roles: ["admin", "buyer"],
+        startPage: "/admin/events/new",
+        steps: [
+            "Sign in as admin@letitrip.in / TempPass123!.",
+            "Create an event titled 'QA Event spin-create' of the spin-wheel type.",
+            "Define three prizes with labels and weights, set a maximum of 2 spins per user, and set a spin window covering today.",
+            "Save, RELOAD, and read every prize, weight, the maximum and the window.",
+            "Open the public page and read the wheel and its segments.",
+            "Check the wheel shows the prize labels and does NOT disclose their weights.",
+        ],
+        inputs: { title: "QA Event spin-create", prizeCount: 3, maxPerUser: 2 },
+        expectedBehaviour: "Prizes, weights, the per-user maximum and the window all round-trip. Weights are the odds and belong server-side — a public wheel that renders them tells every visitor which segment is worthless.",
+        expectedUiState: "After the reload all four groups of settings hold. The public wheel shows three labelled segments and no weight values anywhere on the page or in its source.",
+        expectedData: { weightsInPublicSource: 0 },
+        endResult: "Leave the event in place — the limits case reads it.",
+    },
+    "checklist-admin-events-raffles-spin-spin-wheel-limits-enforced": {
+        roles: ["admin", "buyer"],
+        startPage: "/admin/events",
+        steps: [
+            "Sign in as rehan.sheikh@gmail.com / TempPass123! and open 'QA Event spin-create'.",
+            "Spin once and read the prize and the remaining count.",
+            "Spin a second time and read the remaining count.",
+            "Attempt a third spin and read the refusal.",
+            "RELOAD the page and attempt another spin.",
+            "Sign out and sign in as admin@letitrip.in / TempPass123!, then narrow the spin window so it is closed.",
+            "Sign back in as the buyer and attempt a spin, reading the refusal.",
+        ],
+        inputs: { maxPerUser: 2 },
+        expectedBehaviour: "The per-user cap and the window are both enforced server-side. A cap held in the browser resets on refresh and is no cap at all, and the two refusals must read differently — 'no spins left' and 'the window is closed' are different facts and a single generic message tells the buyer neither.",
+        expectedUiState: "The remaining count falls with each spin and the third is refused naming the limit. After the reload it is still refused. With the window closed the refusal names the window instead. A fresh spin available after a reload is the failure.",
+        expectedData: { spinsAfterReload: 0 },
+        endResult: "Delete the event afterwards.",
+    },
+    "checklist-admin-events-raffles-spin-event-entries-admin-view": {
+        roles: ["admin"],
+        startPage: "/admin/events",
+        steps: [
+            "Sign in as admin@letitrip.in / TempPass123!.",
+            "Open an event's entries page and read every column.",
+            "Read every status filter offered and select each, noting any that returns nothing.",
+            "For each empty filter, check the unfiltered list for rows of that status.",
+            "Read the row actions offered and check at least one lets you VIEW an entry.",
+            "Use the search if one is offered, then search zzzznope and read the count.",
+            "Check whether buyer email addresses are shown in full.",
+        ],
+        inputs: { nonsenseQuery: "zzzznope" },
+        expectedBehaviour: "Entries are readable and filterable, and every status chip names a value entries actually hold. The entry document carries the participant's email, which is PII — how much of it this list exposes is worth recording rather than assuming.",
+        expectedUiState: "Every filter returns its own rows or is empty with none unfiltered either. A view affordance exists alongside the actions. 'zzzznope' returns none. Record exactly how buyer emails are displayed.",
+        expectedData: { nonsenseResultCount: 0 },
+        endResult: "Read-only; nothing persists beyond the URL.",
+    },
+    "checklist-admin-events-raffles-spin-event-entries-view-before-deciding": {
+        roles: ["admin"],
+        startPage: "/admin/events",
+        steps: [
+            "Sign in as admin@letitrip.in / TempPass123!.",
+            "Open the entries page for an event that collects responses — a poll, survey or feedback event.",
+            "Find a row offering Confirm, Waitlist or Cancel.",
+            "WITHOUT using any of those, look for a way to read the entry's actual content first.",
+            "Open the entry and read the participant's response in full.",
+            "Return to the list and check the same content is reachable from the row itself.",
+        ],
+        expectedBehaviour: "An admin can read an entry before deciding on it. A row offering Confirm, Waitlist and Cancel without showing what was submitted is a decision made blind — the same shape as approving a catalogue submission whose photos were never rendered, or confirming a bug report whose comment and screenshot are not on screen.",
+        expectedUiState: "The entry's response is readable from the list or from a detail view reachable from the row, before any action is taken. A row with only mutations is the failure, and it looks complete because the buttons work.",
+        endResult: "Read-only; take no action on any entry. Report whether the content was reachable WITHOUT deciding.",
+    },
+};

package/dist/features/tester/seed-data/authored/admin__media-watermark.d.ts

@@ -0,0 +1,2 @@
+import type { AuthoredCase } from "./_types";
+export declare const authored: Record<string, AuthoredCase>;