@nextsparkjs/theme-default 0.1.0-beta.17 → 0.1.0-beta.170

package/tests/cypress/e2e/uat/_core/auth/app-roles/developer-login.cy.ts

@@ -0,0 +1,144 @@
+/// <reference types="cypress" />
+
+/**
+ * Developer App Role Login Tests
+ *
+ * Tests the Developer app role login and specific access:
+ * - Login as developer@nextspark.dev
+ * - Access to /dev zone
+ * - Access to /superadmin (inherited)
+ * - No team context required (global role)
+ *
+ * Tags: @uat, @feat-auth, @app-role, @developer
+ */
+
+import * as allure from 'allure-cypress'
+
+import { loginAsDefaultDeveloper, CORE_USERS } from '../../../../src/session-helpers'
+
+describe('Authentication - Developer App Role', {
+  tags: ['@uat', '@feat-auth', '@app-role', '@developer']
+}, () => {
+  beforeEach(() => {
+    allure.epic('Authentication')
+    allure.feature('App Roles')
+    allure.story('Developer Login')
+  })
+
+  describe('DEV-LOGIN-001: Developer Login and Dev Zone Access', { tags: '@smoke' }, () => {
+    it('should login as developer and access /dev zone', { tags: '@smoke' }, () => {
+      allure.severity('critical')
+
+      // 1. Login as Developer
+      loginAsDefaultDeveloper()
+
+      // 2. Visit Dev Zone
+      cy.visit('/dev', { timeout: 60000 })
+
+      // 3. Validate access to Dev Zone
+      cy.url().should('include', '/dev')
+      cy.get('[data-cy="dev-home-page"]').should('be.visible')
+
+      cy.log(`✅ Developer login successful (${CORE_USERS.DEVELOPER})`)
+      cy.log('✅ Dev Zone access granted')
+    })
+  })
+
+  describe('DEV-LOGIN-002: Developer Access to Style Gallery', { tags: '@smoke' }, () => {
+    it('should access /dev/style page', { tags: '@smoke' }, () => {
+      allure.severity('normal')
+
+      // 1. Login as Developer
+      loginAsDefaultDeveloper()
+
+      // 2. Visit Style Gallery
+      cy.visit('/dev/style', { timeout: 60000 })
+
+      // 3. Validate access
+      cy.url().should('include', '/dev/style')
+      cy.get('[data-cy="dev-style-page"]').should('be.visible')
+
+      cy.log('✅ Style Gallery access granted')
+    })
+  })
+
+  describe('DEV-LOGIN-003: Developer Access to Test Cases', { tags: '@smoke' }, () => {
+    it('should access /dev/tests page', { tags: '@smoke' }, () => {
+      allure.severity('normal')
+
+      // 1. Login as Developer
+      loginAsDefaultDeveloper()
+
+      // 2. Visit Test Cases viewer
+      cy.visit('/dev/tests', { timeout: 60000 })
+
+      // 3. Validate access
+      cy.url().should('include', '/dev/tests')
+      cy.get('[data-cy="dev-tests-page"]').should('be.visible')
+
+      cy.log('✅ Test Cases viewer access granted')
+    })
+  })
+
+  describe('DEV-LOGIN-004: Developer Access to Config Viewer', { tags: '@smoke' }, () => {
+    it('should access /dev/config page', { tags: '@smoke' }, () => {
+      allure.severity('normal')
+
+      // 1. Login as Developer
+      loginAsDefaultDeveloper()
+
+      // 2. Visit Config Viewer
+      cy.visit('/dev/config', { timeout: 60000 })
+
+      // 3. Validate access
+      cy.url().should('include', '/dev/config')
+      cy.get('[data-cy="dev-config-page"]').should('be.visible')
+
+      cy.log('✅ Config Viewer access granted')
+    })
+  })
+
+  describe('DEV-LOGIN-005: Developer Inherited Superadmin Access', () => {
+    it('should have access to /superadmin (inherited from superadmin)', () => {
+      allure.severity('high')
+
+      // 1. Login as Developer
+      loginAsDefaultDeveloper()
+
+      // 2. Visit Superadmin
+      cy.visit('/superadmin', { timeout: 60000 })
+
+      // 3. Validate access to Superadmin
+      cy.url().should('include', '/superadmin')
+      cy.get('[data-cy="sector7-container"]').should('be.visible')
+
+      cy.log('✅ Superadmin access granted (inherited privilege)')
+    })
+  })
+
+  describe('DEV-LOGIN-006: Developer Logout Flow', () => {
+    it('should logout successfully and redirect to login', () => {
+      allure.severity('normal')
+
+      // 1. Login as Developer
+      loginAsDefaultDeveloper()
+
+      // 2. Visit dashboard
+      cy.visit('/dashboard', { timeout: 60000 })
+      cy.url().should('include', '/dashboard')
+
+      // 3. Logout via user menu
+      cy.get('[data-cy="topnav-user-menu-trigger"]').click()
+      cy.get('[data-cy="topnav-menu-signOut"]').should('be.visible').click()
+
+      // 4. Validate redirected to login
+      cy.url().should('include', '/login')
+
+      cy.log('✅ Developer logout successful')
+    })
+  })
+
+  after(() => {
+    cy.log('✅ Developer app role tests completed')
+  })
+})

package/tests/cypress/e2e/uat/_core/auth/app-roles/superadmin-login.bdd.md

@@ -0,0 +1,118 @@
+---
+feature: SuperAdmin Authentication Flow
+priority: critical
+tags: [authentication, superadmin, sector7, security]
+grepTags: [uat, feat-auth, security, regression]
+coverage: 1
+---
+
+# SuperAdmin Authentication Flow
+
+> Complete authentication flow for SuperAdmin users including Sector7 access, user/team management navigation, and logout.
+
+## @test SUPERADMIN_001: SuperAdmin complete login and Sector7 flow
+
+### Metadata
+- **Priority:** Critical
+- **Type:** Smoke
+- **Tags:** auth, sector7, security
+- **Grep:** `@smoke`, `@security`
+
+```gherkin:en
+Scenario: SuperAdmin complete flow - login, Sector7 access, navigate tables, logout
+
+Given I am logged in as SuperAdmin (superadmin@nextspark.dev)
+And I am on the dashboard
+
+# Sector7 Access
+When I verify the Sector7 icon is visible in TopNavbar
+And I click the Sector7 icon
+Then the URL should include /sector7
+And "Super Administrator Control Panel" should be visible
+
+# Users Management
+When I click the Users navigation link
+Then the URL should include /sector7/users
+And "User Management" should be visible
+And a table should be visible
+
+# Teams Management
+When I click the Teams navigation link
+Then the URL should include /sector7/teams
+And "Team Management" should be visible
+And a table should be visible
+
+# Exit Sector7
+When I click the "Exit to Dashboard" button
+Then the URL should include /dashboard
+And the URL should not include /sector7
+
+# Logout
+When I click the user menu trigger
+And I click the Sign Out option
+Then I should be redirected to /login
+```
+
+```gherkin:es
+Scenario: Flujo completo SuperAdmin - login, acceso Sector7, navegar tablas, logout
+
+Given estoy logueado como SuperAdmin (superadmin@nextspark.dev)
+And estoy en el dashboard
+
+# Acceso a Sector7
+When verifico que el icono de Sector7 esta visible en TopNavbar
+And hago clic en el icono de Sector7
+Then la URL deberia incluir /sector7
+And "Super Administrator Control Panel" deberia estar visible
+
+# Gestion de Usuarios
+When hago clic en el enlace de navegacion Users
+Then la URL deberia incluir /sector7/users
+And "User Management" deberia estar visible
+And una tabla deberia estar visible
+
+# Gestion de Equipos
+When hago clic en el enlace de navegacion Teams
+Then la URL deberia incluir /sector7/teams
+And "Team Management" deberia estar visible
+And una tabla deberia estar visible
+
+# Salir de Sector7
+When hago clic en el boton "Exit to Dashboard"
+Then la URL deberia incluir /dashboard
+And la URL no deberia incluir /sector7
+
+# Cerrar Sesion
+When hago clic en el trigger del menu de usuario
+And hago clic en la opcion Sign Out
+Then deberia ser redirigido a /login
+```
+
+### Expected Results
+- SuperAdmin can access dashboard after login
+- Sector7 icon visible in TopNavbar (superadmin only)
+- Sector7 control panel accessible
+- Users and Teams management tables visible
+- Exit to dashboard works correctly
+- Logout redirects to login page
+
+---
+
+## UI Elements
+
+| Element | Selector | Description |
+|---------|----------|-------------|
+| Sector7 Icon | `[data-cy="topnav-sector7"]` | Sector7 access (SuperAdmin/Developer only) |
+| Users Nav | `[data-cy="sector7-nav-users"]` | Navigate to Users management |
+| Teams Nav | `[data-cy="sector7-nav-teams"]` | Navigate to Teams management |
+| Exit Button | `[data-cy="sector7-sidebar-exit-to-dashboard"]` | Exit Sector7 to dashboard |
+| User Menu | `[data-cy="topnav-user-menu-trigger"]` | User dropdown menu trigger |
+| Sign Out | `[data-cy="topnav-menu-signOut"]` | Logout option |
+
+---
+
+## Summary
+
+| Test ID | Block | Description | Tags |
+|---------|-------|-------------|------|
+| SUPERADMIN_001 | Complete Flow | Login, Sector7 access, Users/Teams navigation, Logout | `@smoke`, `@security`, `@critical` |

package/tests/cypress/e2e/uat/_core/auth/app-roles/superadmin-login.cy.ts

@@ -0,0 +1,84 @@
+/// <reference types="cypress" />
+
+import * as allure from 'allure-cypress'
+
+import { loginAsDefaultSuperadmin, CORE_USERS } from '../../../../src/session-helpers'
+
+/**
+ * SuperAdmin Login Test
+ *
+ * Tests the complete SuperAdmin flow:
+ * 1. Login via API (using session helper)
+ * 2. Access Superadmin panel
+ * 3. Navigate through Users and Teams management
+ * 4. Logout
+ *
+ * Uses: loginAsDefaultSuperadmin() from session-helpers
+ * User: superadmin@nextspark.dev (core system user with global superadmin role)
+ */
+
+describe('Authentication - SuperAdmin Flow', {
+  tags: ['@uat', '@feat-auth', '@security', '@regression']
+}, () => {
+  beforeEach(() => {
+    allure.epic('UAT')
+    allure.feature('Authentication')
+    allure.story('SuperAdmin Access')
+    loginAsDefaultSuperadmin()
+  })
+
+  describe('SUPERADMIN_001: SuperAdmin Login and Panel Access', () => {
+    it('should login as superadmin, access panel, view tables, and logout', () => {
+      allure.severity('critical')
+
+      // 1. Visit dashboard (session already established)
+      cy.visit('/dashboard', { timeout: 60000 })
+      cy.url().should('include', '/dashboard')
+      cy.log(`✅ SuperAdmin login successful (${CORE_USERS.SUPERADMIN})`)
+
+      // 2. Validate Superadmin icon is visible (superadmin only)
+      cy.get('[data-cy="topnav-superadmin"]').should('be.visible')
+      cy.log('✅ Superadmin icon visible in TopNavbar')
+
+      // 3. Navigate to Superadmin panel
+      cy.get('[data-cy="topnav-superadmin"]').click()
+      cy.url().should('include', '/superadmin')
+      cy.contains('Super Administrator Control Panel').should('be.visible')
+      cy.log('✅ Navigated to Superadmin dashboard')
+
+      // 4. Navigate to Users table and validate
+      cy.get('[data-cy="superadmin-nav-users"]').click()
+      cy.url().should('include', '/superadmin/users')
+      cy.contains('User Management').should('be.visible')
+      cy.get('table').should('be.visible')
+      cy.log('✅ Users table loaded and visible')
+
+      // 5. Navigate to Teams table and validate
+      cy.get('[data-cy="superadmin-nav-teams"]').click()
+      cy.url().should('include', '/superadmin/teams')
+      cy.contains('Team Management').should('be.visible')
+      cy.get('table').should('be.visible')
+      cy.log('✅ Teams table loaded and visible')
+
+      // 6. Exit Superadmin back to dashboard
+      cy.get('[data-cy="superadmin-sidebar-exit-to-dashboard"]').click()
+      cy.url().should('include', '/dashboard')
+      cy.url().should('not.include', '/superadmin')
+      cy.log('✅ Exited Superadmin')
+
+      // 7. Logout from the main dashboard
+      cy.get('[data-cy="topnav-user-menu-trigger"]').click()
+      cy.get('[data-cy="topnav-menu-signOut"]').should('be.visible').click()
+
+      // Verify redirected to login
+      cy.url().should('include', '/login')
+      cy.log('✅ Logout successful')
+
+      cy.log('✅ SuperAdmin flow completed successfully')
+    })
+  })
+
+  after(() => {
+    cy.log('✅ SuperAdmin authentication tests completed')
+  })
+})

package/tests/cypress/e2e/uat/_core/auth/custom-roles/editor-login.bdd.md

@@ -0,0 +1,288 @@
+---
+feature: Editor Custom Role Permissions
+priority: high
+tags: [auth, custom-role, editor, permissions, security, theme]
+grepTags: [uat, feat-auth, custom-role, editor]
+coverage: 8
+---
+
+# Editor Custom Role Permissions
+
+> Tests for Editor custom role permissions. Editor is a theme-defined custom role with view-only access to entities. Cannot create, update, or delete. Cannot access Sector7 or Dev Zone.
+
+## @test EDITOR-PERM-001: Editor Dashboard Access
+
+### Metadata
+- **Priority:** Critical
+- **Type:** Smoke
+- **Tags:** editor, dashboard
+- **Grep:** `@smoke`
+
+```gherkin:en
+Scenario: Editor can access dashboard
+
+Given I am logged in as Editor (diego.ramirez@nextspark.dev)
+When I visit /dashboard
+Then the dashboard container should be visible
+```
+
+```gherkin:es
+Scenario: Editor puede acceder al dashboard
+
+Given estoy logueado como Editor (diego.ramirez@nextspark.dev)
+When visito /dashboard
+Then el contenedor del dashboard deberia estar visible
+```
+
+### Expected Results
+- Dashboard loads correctly
+- Limited navigation based on permissions
+
+---
+
+## @test EDITOR-PERM-002: Editor View-Only Customer Access
+
+### Metadata
+- **Priority:** Critical
+- **Type:** Smoke
+- **Tags:** editor, customers, view-only
+- **Grep:** `@smoke`
+
+```gherkin:en
+Scenario: Editor has view-only access to customers list
+
+Given I am logged in as Editor (diego.ramirez@nextspark.dev)
+When I visit /customers
+Then the entity list should be visible
+And the create button should NOT exist
+```
+
+```gherkin:es
+Scenario: Editor tiene acceso solo lectura a lista de customers
+
+Given estoy logueado como Editor (diego.ramirez@nextspark.dev)
+When visito /customers
+Then la lista de entidades deberia estar visible
+And el boton de crear NO deberia existir
+```
+
+### Expected Results
+- Can view customer list
+- No create button
+- Read-only experience
+
+---
+
+## @test EDITOR-PERM-003: Editor Cannot Edit Customers
+
+### Metadata
+- **Priority:** High
+- **Type:** Security
+- **Tags:** editor, customers, no-edit
+
+```gherkin:en
+Scenario: Editor cannot see edit buttons on customers
+
+Given I am logged in as Editor (diego.ramirez@nextspark.dev)
+When I visit /customers
+Then the entity list should be visible
+And edit buttons should not exist on items
+And delete buttons should not exist on items
+```
+
+```gherkin:es
+Scenario: Editor no puede ver botones de editar en customers
+
+Given estoy logueado como Editor (diego.ramirez@nextspark.dev)
+When visito /customers
+Then la lista de entidades deberia estar visible
+And los botones de editar no deberian existir en items
+And los botones de eliminar no deberian existir en items
+```
+
+### Expected Results
+- No edit action buttons
+- No delete action buttons
+- Pure read-only interface
+
+---
+
+## @test EDITOR-PERM-004: Editor Tasks Access
+
+### Metadata
+- **Priority:** High
+- **Type:** Regression
+- **Tags:** editor, tasks, read-only
+
+```gherkin:en
+Scenario: Editor has read-only access to tasks
+
+Given I am logged in as Editor (diego.ramirez@nextspark.dev)
+When I visit /tasks
+Then the entity list should be visible
+And the create button should NOT exist
+```
+
+```gherkin:es
+Scenario: Editor tiene acceso solo lectura a tasks
+
+Given estoy logueado como Editor (diego.ramirez@nextspark.dev)
+When visito /tasks
+Then la lista de entidades deberia estar visible
+And el boton de crear NO deberia existir
+```
+
+### Expected Results
+- Can view task list
+- No create functionality
+
+---
+
+## @test EDITOR-PERM-005: Editor Settings Access
+
+### Metadata
+- **Priority:** Normal
+- **Type:** Regression
+- **Tags:** editor, settings
+
+```gherkin:en
+Scenario: Editor has profile-only settings access
+
+Given I am logged in as Editor (diego.ramirez@nextspark.dev)
+When I visit /settings
+Then I should see profile tab or be redirected
+```
+
+```gherkin:es
+Scenario: Editor tiene acceso solo a perfil en settings
+
+Given estoy logueado como Editor (diego.ramirez@nextspark.dev)
+When visito /settings
+Then deberia ver pestana de perfil o ser redirigido
+```
+
+### Expected Results
+- Profile settings accessible
+- No team settings access
+
+---
+
+## @test EDITOR-PERM-006: Editor Cannot Access Sector7
+
+### Metadata
+- **Priority:** High
+- **Type:** Security
+- **Tags:** editor, sector7, blocked
+
+```gherkin:en
+Scenario: Editor is blocked from Sector7
+
+Given I am logged in as Editor (diego.ramirez@nextspark.dev)
+When I attempt to visit /sector7
+Then I should be redirected away from /sector7
+```
+
+```gherkin:es
+Scenario: Editor no puede acceder a Sector7
+
+Given estoy logueado como Editor (diego.ramirez@nextspark.dev)
+When intento visitar /sector7
+Then deberia ser redirigido fuera de /sector7
+```
+
+### Expected Results
+- Access denied
+- Redirect to dashboard
+
+---
+
+## @test EDITOR-PERM-007: Editor Cannot Access Dev Zone
+
+### Metadata
+- **Priority:** High
+- **Type:** Security
+- **Tags:** editor, dev-zone, blocked
+
+```gherkin:en
+Scenario: Editor is blocked from Dev Zone
+
+Given I am logged in as Editor (diego.ramirez@nextspark.dev)
+When I attempt to visit /dev
+Then I should be redirected away from /dev
+```
+
+```gherkin:es
+Scenario: Editor no puede acceder a Dev Zone
+
+Given estoy logueado como Editor (diego.ramirez@nextspark.dev)
+When intento visitar /dev
+Then deberia ser redirigido fuera de /dev
+```
+
+### Expected Results
+- Access denied
+- Redirect to dashboard
+
+---
+
+## @test EDITOR-PERM-008: Editor Logout Flow
+
+### Metadata
+- **Priority:** Normal
+- **Type:** Regression
+- **Tags:** editor, logout
+
+```gherkin:en
+Scenario: Editor can logout successfully
+
+Given I am logged in as Editor (diego.ramirez@nextspark.dev)
+And I am on the dashboard
+When I click on user menu
+And I click on Sign Out
+Then I should be redirected to /login
+```
+
+```gherkin:es
+Scenario: Editor puede cerrar sesion correctamente
+
+Given estoy logueado como Editor (diego.ramirez@nextspark.dev)
+And estoy en el dashboard
+When hago click en el menu de usuario
+And hago click en Sign Out
+Then deberia ser redirigido a /login
+```
+
+### Expected Results
+- Logout works correctly
+- Redirect to login page
+
+---
+
+## UI Elements
+
+| Element | Selector | Description |
+|---------|----------|-------------|
+| Dashboard Container | `[data-cy="dashboard-container"]` | Main dashboard container |
+| Create Button | `[data-cy="entity-create-button"]` | Entity create button (should not exist) |
+| Entity List | `[data-cy="entity-list-container"]` | Entity list container |
+| Row Edit | `[data-cy="entity-row-edit"]` | Row edit button (should not exist) |
+| Row Delete | `[data-cy="entity-row-delete"]` | Row delete button (should not exist) |
+| Settings Container | `[data-cy="settings-container"]` | Settings page container |
+| Profile Tab | `[data-cy="settings-tab-profile"]` | Profile settings tab |
+| User Menu | `[data-cy="topnav-user-menu-trigger"]` | User menu trigger |
+| Sign Out | `[data-cy="topnav-menu-signOut"]` | Sign out button |
+
+---
+
+## Summary
+
+| Test ID | Block | Description | Tags |
+|---------|-------|-------------|------|
+| EDITOR-PERM-001 | Access | Dashboard access | `@smoke` |
+| EDITOR-PERM-002 | View-Only | View-only customers | `@smoke` |
+| EDITOR-PERM-003 | Blocked | Cannot edit customers | |
+| EDITOR-PERM-004 | View-Only | Read-only tasks | |
+| EDITOR-PERM-005 | Access | Profile-only settings | |
+| EDITOR-PERM-006 | Blocked | Sector7 blocked | |
+| EDITOR-PERM-007 | Blocked | Dev Zone blocked | |
+| EDITOR-PERM-008 | Logout | Logout flow | |