# FieldOps Cloud Testing Strategy

## Goal

Validate FieldOps Cloud as a SaaS platform for trades and field-service businesses across tenant workflows, platform-admin workflows, billing foundations, import/export, integrations, mobile/PWA/offline readiness, and production release gates.

## Test Layers

| Layer | Purpose | Current Command Or Evidence |
| --- | --- | --- |
| Dependency checks | Ensure installable and no known vulnerable packages. | `composer install`, `composer validate`, `composer audit` |
| Service/regression tests | Validate business logic and previously fixed defects. | `composer test` |
| PHP lint | Catch syntax errors across application code. | `composer check` via `tools/lint-php.php` |
| Static route/action inventory | Catch dead links, form targets, anchors, and unhooked buttons. | `php tools\qa-inventory.php` |
| Browser smoke | Validate routed pages, role scenarios, responsiveness, and console/page errors. | `tools/browser-smoke.cjs` against XAMPP |
| Role/RBAC browser walkthrough | Validate explicit role sessions, allowed/forbidden routes, sidebar visibility, and support login-as return. | `tools/role-walkthrough.cjs` against XAMPP |
| Production auth/security smoke | Validate production-mode auth with demo disabled, CSP/security headers, session cookie policy, invalid login, signup, DB-backed role logins, and platform-admin isolation. | `tools/auth-production-smoke.cjs` |
| Database import | Validate schema and seed can load into MySQL. | Disposable XAMPP database import |
| Manual QA | Validate full workflows, UX, accessibility, and provider setup. | `docs/MANUAL_QA_SCRIPT.md` plus this strategy |

Browser automation intentionally blocks service workers and serves empty jsDelivr CSS/JS test stubs. This keeps local QA focused on FieldOps routes, RBAC, responsive behaviour, and console/page errors rather than PWA cache state or third-party CDN availability.

## Priority Coverage

1. Critical business flows:
   - Client create/view/edit.
   - Job create/view/edit/status/schedule.
   - Quote create/view/edit/approve/convert to invoice.
   - Invoice view/edit/payment state.
   - Customer portal token flow.
   - Import preview/validation/commit/undo.
   - Export gating by plan.
2. Money, data, and security paths:
   - Tenant isolation.
   - RBAC by role.
   - CSRF on mutating forms.
   - Billing plan/trial/grace-period actions.
   - Platform admin support login and tenant actions.
   - Audit log creation for sensitive actions.
   - CSV formula injection protection.
3. Integration boundaries:
   - Accounting provider settings for Xero, QuickBooks Online, Sage Accounting, Zoho Books, MYOB, FreeAgent, Reckon, SMEPlus, FreshBooks, and Wave.
   - Google Calendar and Outlook Calendar two-way sync settings.
   - LLM provider configuration without secret exposure.
4. Mobile and offline:
   - PWA manifest/service worker.
   - Mobile responsive layouts.
   - Offline technician queue.
   - Offline sync endpoint validation.
   - Capacitor Android/iOS project readiness.

## Required Permission Tests

Run route and workflow tests as:

- Public unauthenticated user.
- Trainee.
- Team Member.
- Supervisor.
- Manager.
- Director/Owner.
- Platform Admin.
- Platform Admin using support login as tenant admin.

For each role, verify:

- Allowed pages load.
- Forbidden pages return a controlled 403.
- Hidden UI actions are also blocked server-side.
- Tenant-scoped records cannot be accessed across tenants.

## Required Failure-Mode Tests

- Invalid login credentials.
- Expired/invalid portal token.
- Missing CSRF token.
- Invalid tenant support-login reason.
- Suspended tenant access.
- Expired trial and Basic plan export restriction.
- Duplicate client/team records where uniqueness applies.
- Invalid CSV headers and missing mandatory import fields.
- Malformed offline sync payload.
- Provider disconnected/expired integration token placeholders.

## Current Automated Status

Latest evidence is in `docs/PRODUCTION_READINESS_QA_REPORT.md`.

Current automated checks pass locally and in the XAMPP served copy, including:

- Composer install/validate/audit/test/check.
- Static route/action inventory with zero findings.
- Browser smoke across public, tenant-owner, and platform-admin scenarios on mobile/tablet/desktop.
- Role/RBAC browser walkthrough for Owner, Manager, Supervisor, Team Member, Trainee, Demo User, Platform Admin, and support login-as return flow.
- Production auth/security smoke with demo disabled, CSP/security headers, session cookie policy, DB-backed role login, invalid-login handling, signup, and platform-admin isolation.
- MySQL schema/seed disposable import.

## Production Release Gaps

The product is not production-ready until these gates pass:

- Full production-mode browser E2E beyond auth/dashboard/platform-admin isolation.
- Production-mode DB-backed role workflows through the core business modules.
- MySQL-backed tenant-isolation integration suite.
- Mocked provider contract tests for accounting/calendar providers.
- Payment gateway decision and test suite.
- Accessibility audit.
- Large-data import/export/performance tests.
- Native Android/iOS build, signing, store metadata, and physical-device QA.