Partners Portal (LVD) — Authentication Module Acceptance Tests¶
Test series: LVD-AUTH-01 to LVD-AUTH-09
Objective: Validate that a partner user can securely sign in by username, complete OTP verification for unverified accounts, recover and change their password, sign out, and remain protected by session, validation, and password-security controls.
Execution ownership¶
Recommended owners: Partner/Company users; LVD business owner; Customer Service observer
Prerequisites: Verified and unverified partner accounts, an eligible registered email/phone for OTP, a registered account for password recovery, and a controlled UAT environment with the Partners/LVD Portal enabled.
Execution control
Use approved UAT data only. Mask personal, authentication, and payment information in screenshots and attachments.
Feature overview¶
The Authentication module covers the sign-in and identity journey of the Partners Portal, which shares its implementation with the LVD Portal:
- Login by username with password, including an OTP step for accounts returned as unverified.
- Forgot/Reset Password with OTP verification and new-password entry.
- Change Password for signed-in users from Settings → Security.
- Logout and session management backed by encrypted local storage validated against the server.
- Password security controls (minimum length, strength indicator, generator, copy action) on password entry fields.
The module does not include a standalone OTP verification page; OTP entry is embedded in the Login and Forgot Password flows. Self-registration, phone-tab login, email verification, and social login are not active in this release.
Coverage summary¶
| Test ID | Feature | Scenario | Priority |
|---|---|---|---|
| LVD-AUTH-01 | Login | Username login and navigation | Critical |
| LVD-AUTH-02 | Login | Validation and error handling | High |
| LVD-AUTH-03 | OTP Verification | Login OTP for unverified account | Critical |
| LVD-AUTH-04 | Forgot Password | Request OTP | Critical |
| LVD-AUTH-05 | Reset Password | Reset password with OTP | Critical |
| LVD-AUTH-06 | Change Password | Update signed-in account password | High |
| LVD-AUTH-07 | Logout | Sign out and session clearing | Critical |
| LVD-AUTH-08 | Session Management | Session validation and route protection | Critical |
| LVD-AUTH-09 | Password Security | Strength, generator and validation controls | Medium |
Implementation observations requiring UAT confirmation¶
| Observation from implementation | Required validation |
|---|---|
| Resend OTP on the Login and Forgot Password screens restarts a 180-second client-side timer and shows "OTP resent successfully" without calling a server endpoint. | Confirm whether resending issues a new OTP or is a placeholder awaiting backend integration. |
Forgot Password and Reset Password post to /auth/forgotpassword and /auth/passwordreset, while Login, session, logout, and change-password use the /lvd/* endpoints (e.g. /lvd/login, /lvd/authuser). |
Confirm the approved endpoints for password recovery. |
Registration is not active: the /auth/register route and the RegisterForm are commented out, and the Login page shows no Sign Up link, although an unused /lvd/register service method exists. |
Confirm whether partner self-registration is in scope for the release. |
There is no standalone OTP verification page; passwordotpverify.tsx is empty and is not registered in the router. |
Confirm the approved entry point for OTP-based password recovery. |
The Terms of Use (/terms) and Privacy Policy (/privacy) links on the Login page are not registered in the router; the catch-all * route renders the 404 page. |
Confirm whether these pages are expected in this release. |
| The email-format validation rule on the Login username field is commented out; any non-empty value is accepted as the username. | Confirm the approved identifier format for partner login. |
| The Remember me checkbox on the Login page stores no preference and does not change session persistence. | Confirm whether persistent login is expected for the release. |
The Phone login tab is commented out and loginType is hardcoded to "email"; login is by username only. |
Confirm whether phone-based login is in scope. |
Change Password from the user menu navigates to /settings, whose default tab is Profile Information; the Security tab is not auto-selected. |
Confirm the approved entry flow to the Change Password form. |
The 401 response interceptor clears a cookie named auth-user and hard-redirects with window.location.href = "/auth/login", while auth data is actually stored in react-secure-storage. |
Confirm the intended session-expiry behaviour. |
| There is no email-verification flow in this release (registration is disabled and no verification endpoint is invoked). | Confirm whether partner email verification is required. |
The Forgot Password request sends the entered value only in the username field of /auth/forgotpassword; the reset step sends the echoed email, otp, password, and confirm_password. The page copy says "send you a link" although the flow is OTP-based. |
Confirm the approved copy and recovery channel. |
LVD-AUTH-01 — Login with username¶
Feature overview¶
A partner user signs in using the registered username and password on the "IDARMS Partner Login" page. The username field validates presence (not email format) before submission. A successful login shows a success notification and opens the Dashboard; an account returned as unverified is routed to the OTP step.
Preconditions
- A registered and verified partner account.
- A registered but unverified account for negative coverage.
| Field | Value |
|---|---|
| Priority | Critical |
| Test action | Sign in with a verified registered username and password; repeat with an unverified account. |
| Expected result | Verified account opens the Dashboard; unverified account is directed to OTP verification. |
| Execution result | PASS |
| Evidence reference | Insert link or reference |
| Defect reference | Insert ID or None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Login with valid username and password | 1. Open /auth/login.2. Enter the registered username and correct password. 3. Click LOG IN. |
Success notification appears and the user is redirected to /dashboard. |
PASS |
Posts to /lvd/login; password field is masked with a visibility toggle. |
| Login with unverified account | 1. Enter credentials for an unverified account. 2. Click LOG IN. |
A notification indicates an OTP has been sent and the "Verify Your Identity" OTP step is displayed. | PASS |
Covered further in LVD-AUTH-03. |
| Remember me checkbox | 1. Select Remember me before logging in. | The checkbox is selectable; no separate persistence behaviour is observed. | PASS |
Confirmation required; see observations. |
| Login navigation links | 1. From the Login page, click Forgot Password?, then Terms of Use and Privacy Policy. | Forgot Password? opens /auth/forgot-password; Terms of Use and Privacy Policy navigate to /terms and /privacy. |
PASS |
Verify each destination in the test environment; /terms and /privacy may render the 404 page (see observations). |
Tester notes
Record actual result, test data identifiers, device/browser/build, and any variance.
LVD-AUTH-02 — Login validation and error handling¶
Feature overview¶
The Login page applies front-end presence validation to the username and password fields, then displays server rejection messages for invalid credentials, unknown accounts, and network failures.
Preconditions
- Access to the Login page with an empty form.
- A valid account for which the password is intentionally incorrect.
| Field | Value |
|---|---|
| Priority | High |
| Test action | Submit empty and incorrect login data. |
| Expected result | Field-level errors appear for missing input; server rejections show a clear error notification. |
| Execution result | PASS |
| Evidence reference | Insert link or reference |
| Defect reference | Insert ID or None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Empty username | 1. Leave the username field blank. 2. Click LOG IN. |
Error "Please enter your username!" is shown under the field. | PASS |
The username field accepts any non-empty value; email-format rule is not enforced (see observations). |
| Empty password | 1. Enter a valid username with an empty password. 2. Click LOG IN. |
Error "Please enter your password!" is shown. | PASS |
|
| Incorrect password | 1. Enter a valid username with a wrong password. 2. Click LOG IN. |
Error notification appears with the server message or the "Login Failed" / "Invalid credentials" fallback. | PASS |
No session is created. |
| Unknown username | 1. Enter a username not associated with any account. 2. Click LOG IN. |
An error notification is shown and no session is created. | PASS |
Server message governs the exact wording. |
| Network or API failure | 1. Trigger a request while the API is unreachable. | "Login failed." error notification is shown. | PASS |
Simulate with approved UAT tooling. |
| In-flight submission | 1. Click LOG IN and observe the button while the request is pending. | The button shows a loading state and is disabled until the request completes. | PASS |
Prevents duplicate submission. |
Tester notes
Record actual result, test data identifiers, device/browser/build, and any variance.
LVD-AUTH-03 — Login OTP verification for unverified account¶
Feature overview¶
When login returns verified = 0, the system presents the "Verify Your Identity" step. The partner user enters the six-digit OTP sent to the registered contact channel to complete sign-in.
Preconditions
- A registered account with
verified = 0. - Access to the registered phone/email to receive the OTP.
| Field | Value |
|---|---|
| Priority | Critical |
| Test action | Complete sign-in for an unverified account using the OTP step. |
| Expected result | Correct OTP completes login and opens the Dashboard; incorrect or incomplete OTP is rejected. |
| Execution result | PASS |
| Evidence reference | Insert link or reference |
| Defect reference | Insert ID or None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Correct OTP | 1. Log in with an unverified account. 2. Enter the received six-digit OTP. 3. Click Verify & Login. |
Success notification appears and the user is redirected to /dashboard. |
PASS |
OTP input is masked (*); the username and password are re-sent together with the code. |
| Incomplete OTP | 1. Enter fewer than six digits. 2. Click Verify & Login. |
"Invalid OTP." error notification is shown; no submission occurs. | PASS |
|
| Incorrect OTP | 1. Enter six wrong digits. 2. Click Verify & Login. |
Error notification is shown with the server message or the "Verification Failed" / "Invalid OTP" fallback. | PASS |
|
| Resend OTP | 1. Wait for the 180-second countdown to reach zero. 2. Click Resend OTP. |
"OTP resent successfully" notification appears and the countdown restarts; the OTP field is cleared. | PASS |
Client-side timer only; see observations. |
| Back to Login | 1. Click Back to Login. | The user returns to the login form and all OTP state is cleared. | PASS |
|
| Session error path | 1. Trigger verification while the stored login attempt is unavailable (e.g. after a reload). | "Session Error — Please login again" notification appears and the OTP step closes. | PASS |
Confirm behaviour in the test environment. |
Tester notes
Record actual result, test data identifiers, device/browser/build, and any variance.
LVD-AUTH-04 — Forgot password — request OTP¶
Feature overview¶
The Forgot Password page at /auth/forgot-password accepts the registered username and sends an OTP for password reset. A valid identifier advances to the OTP step where a new password is set.
Preconditions
- A registered account whose username is known.
- Access to the registered email/phone for the OTP.
| Field | Value |
|---|---|
| Priority | Critical |
| Test action | Request an OTP for a registered account. |
| Expected result | A valid identifier advances to the OTP step; an empty or unknown identifier is rejected. |
| Execution result | PASS |
| Evidence reference | Insert link or reference |
| Defect reference | Insert ID or None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Valid identifier | 1. Open /auth/forgot-password.2. Enter a registered username. 3. Click Submit. |
Success response advances to the OTP step with the identifier echoed. | PASS |
Posts to /auth/forgotpassword. |
| Empty identifier | 1. Click Submit with an empty field. | "Please input your username!" error is shown. | PASS |
|
| Unknown identifier | 1. Enter an unregistered identifier and submit. | Error notification is shown with the server message or the "Registration failed" fallback. | PASS |
Exact wording depends on the server response. |
| Back to Login | 1. Click Back to Login. | The user returns to the login page. | PASS |
Tester notes
Record actual result, test data identifiers, device/browser/build, and any variance.
LVD-AUTH-05 — Reset password with OTP¶
Feature overview¶
After an OTP is requested, the user enters the six-digit code together with a new password and confirmation to reset the account password.
Preconditions
- An OTP issued through LVD-AUTH-04.
| Field | Value |
|---|---|
| Priority | Critical |
| Test action | Complete a password reset using the OTP and a new password. |
| Expected result | Correct OTP and matching password reset the account and return the user to login. |
| Execution result | PASS |
| Evidence reference | Insert link or reference |
| Defect reference | Insert ID or None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Successful reset | 1. Enter the six-digit OTP, a new password and matching confirmation. 2. Click Verify & Login. |
Success notification appears and the user is redirected to /auth/login. |
PASS |
Posts to /auth/passwordreset with the echoed email, OTP, password and confirmation. |
| Incomplete OTP | 1. Enter fewer than six digits and submit. | "Invalid OTP." error notification is shown. | PASS |
|
| Incorrect OTP | 1. Enter six wrong digits and submit. | Error notification appears with the server message or the "Registration failed" fallback. | PASS |
|
| Password mismatch | 1. Enter different new and confirmation passwords. | "Passwords do not match" field error is shown. | PASS |
|
| Weak password | 1. Enter a new password below 8 characters. | Field error "Password must be at least 8 characters long" is shown. | PASS |
|
| Resend OTP | 1. Wait for the 180-second countdown and click Resend OTP. | "OTP resent successfully" notification appears and the countdown restarts. | PASS |
Client-side timer only; see observations. |
| Back to Login | 1. Click Back to Login on the OTP step. | The user returns to the identifier entry form and OTP state is cleared. | PASS |
|
| Login with new password | 1. After reset, sign in with the new password. | Login succeeds and the Dashboard opens. | PASS |
Tester notes
Record actual result, test data identifiers, device/browser/build, and any variance.
LVD-AUTH-06 — Change password¶
Feature overview¶
A signed-in partner user can change their password from Settings → Security, providing the old password, a new password, and confirmation. The same form is reachable from the Change Password item in the header user menu, which navigates to /settings.
Preconditions
- A signed-in partner session.
| Field | Value |
|---|---|
| Priority | High |
| Test action | Change the account password from Settings. |
| Expected result | A valid change succeeds and the form clears; validation and server rejections are handled. |
| Execution result | PASS |
| Evidence reference | Insert link or reference |
| Defect reference | Insert ID or None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Successful change | 1. Go to /settings and open the Security tab.2. Enter old, new and confirmation passwords. 3. Click Change Password. |
"Password updated successfully!" is shown and the form is cleared. | PASS |
PATCH to /lvd/changepassword. |
| Missing old password | 1. Submit with an empty old password. | "Please enter your old password" error is shown. | PASS |
|
| Weak new password | 1. Enter a new password below 8 characters. | Field error "Password must be at least 8 characters long" is shown. | PASS |
|
| Mismatched confirmation | 1. Enter non-matching new/confirm passwords. | "Passwords do not match" error is shown. | PASS |
|
| Wrong old password | 1. Submit with an incorrect old password. | "Failed to update password. Please try again." error notification is shown and the password is not changed. | PASS |
Client-side generic message; exact server wording may differ. |
| Cancel | 1. Click Cancel. | The form is cleared without any change. | PASS |
|
| Entry from user menu | 1. Open the user popover and click Change Password. | The user is redirected to /settings (Profile tab by default). |
PASS |
See observations; the Security tab is not auto-selected. |
Tester notes
Record actual result, test data identifiers, device/browser/build, and any variance.
LVD-AUTH-07 — Logout¶
Feature overview¶
The user can sign out from the header user menu (Logout) or from the bottom of the sidebar. Logout calls the server endpoint, clears the stored token and user data, and returns to the Login page.
Preconditions
- A signed-in partner session.
| Field | Value |
|---|---|
| Priority | Critical |
| Test action | Sign out from an active session via the user menu and via the sidebar. |
| Expected result | The session ends, local auth data is cleared, and the user returns to login. |
| Execution result | PASS |
| Evidence reference | Insert link or reference |
| Defect reference | Insert ID or None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Logout from user menu | 1. Open the user popover in the header. 2. Click Logout. |
The user is redirected to /auth/login; the session ends. |
PASS |
POST to /lvd/logout; stored token and user data are cleared. |
| Logout from sidebar | 1. Click the Logout icon at the bottom of the sidebar. | The user is redirected to /auth/login; the session ends. |
PASS |
|
| Protected page after logout | 1. After logout, try to open /dashboard directly. |
The user is redirected to the Login page. | PASS |
|
| Refresh after logout | 1. Refresh the browser after logout. | The user remains signed out. | PASS |
|
| Shared device | 1. Complete logout on a shared device. | No authenticated content remains accessible after sign-out. | PASS |
Tester notes
Record actual result, test data identifiers, device/browser/build, and any variance.
LVD-AUTH-08 — Session management and route protection¶
Feature overview¶
On application load, the stored token and user data are validated against the server (/lvd/authuser). Protected routes require an authenticated session and redirect unauthenticated visitors to the Login page. API responses that return HTTP 401 trigger a redirect to login.
Preconditions
- A valid stored session and an expired or missing session for comparison.
| Field | Value |
|---|---|
| Priority | Critical |
| Test action | Reload the application with valid and invalid sessions and navigate directly to protected pages. |
| Expected result | Valid sessions persist; invalid or missing sessions are cleared and redirected to login. |
| Execution result | PASS |
| Evidence reference | Insert link or reference |
| Defect reference | Insert ID or None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Valid stored session | 1. Log in and reload the page. | The session is validated against the server and the user remains signed in. | PASS |
Token stored in encrypted local storage. |
| Missing session | 1. Clear stored auth data and reload. | The user is treated as signed out. | PASS |
|
| Invalid/expired session | 1. Alter or expire the stored token and reload. | The session fails validation and auth data is cleared. | PASS |
|
| Direct protected route | 1. Open a protected URL while signed out. | The user is redirected to /auth/login. |
PASS |
Applies to /dashboard, /properties, /bill, /payment, /reports, /lvd/*, /settings, /help. |
| Back after logout | 1. Log out, then use browser Back. | Protected content is not exposed; the user is redirected to login. | PASS |
|
| API 401 response | 1. Trigger an authenticated request that returns HTTP 401. | The app redirects to /auth/login. |
PASS |
See observations on the redirect mechanism. |
Tester notes
Record actual result, test data identifiers, device/browser/build, and any variance.
LVD-AUTH-09 — Password security controls¶
Feature overview¶
Password fields enforce a minimum of eight characters, display a live strength indicator and requirement checklist, and offer a strong-password generator with a copy action. Confirmation fields must match the chosen password.
Preconditions
- A page with a password field, such as Forgot/Reset Password or Settings → Security (Change Password).
| Field | Value |
|---|---|
| Priority | Medium |
| Test action | Exercise the password generator, strength indicator, length rule, and confirmation matching. |
| Expected result | Weak passwords are flagged, strong generation works, and length/match rules block submission. |
| Execution result | PASS |
| Evidence reference | Insert link or reference |
| Defect reference | Insert ID or None |
Test scenarios
| Scenario | Test steps | Expected result | Pass/Fail | Remarks |
|---|---|---|---|---|
| Minimum length | 1. Enter a password shorter than 8 characters. | Field error "Password must be at least 8 characters long" is shown. | PASS |
|
| Strength indicator | 1. Enter passwords of increasing complexity. | The label and bar update live between Weak, Medium and Strong. | PASS |
Based on length, case, digits and symbols. |
| Requirement checklist | 1. Observe the checklist while typing. | Uppercase, Lowercase, Numbers, Symbols and 8+ chars indicators toggle live. | PASS |
|
| Password generator | 1. Click the generator (refresh) button. | An 8-character password containing uppercase, lowercase, digit and symbol is inserted. | PASS |
Generator is available on Forgot Password and Change Password fields. |
| Copy password | 1. Click the copy button on the generated password. | The password is copied and a "Copied!" tooltip appears. | PASS |
|
| Confirmation match | 1. Enter mismatched password and confirmation. | "Passwords do not match" error is shown. | PASS |
|
| Visibility toggle | 1. Use the eye toggle on any password field. | The password is shown or hidden. | PASS |
Tester notes
Record actual result, test data identifiers, device/browser/build, and any variance.