14 — QA Checklist (Auth Module)

• 1. Functional
• 2. Visual / layout
• 3. Accessibility (00-shared/09)
• 4. Performance
• 5. Offline & network (10 §2)
• 6. Tablet / desktop
• 7. Localization
• 8. Permissions
• 9. Dark mode
• 10. Animations
• 11. Security (session, 2FA, rate, tokens)
• 12. Server-backed edge mirrors
• QA scripts

Module QA specific to framework + shared 00-shared/10. Every check derives from a specific backend behavior so failure analysis is direct.

1. Functional

• Login with valid email/password returns data.accessToken/refreshToken (auth.controller.ts:40).
• Wrong password + unknown email → identical 401 message (privacy, auth.service.ts:125/131).
• Registration (5 fields + tenantId) returns tokens → app goes straight to authed home.
• Duplicate email register → 409 DUPLICATE_RESOURCE inline.
• Verify email 200 / invalid token 400 / already-verified 200.
• Resend throttled (5/120 s).
• Forgot → neutral "reset link sent" screen (same host who exists/missing).
• Reset: min8; revokes all sessions → other devices logged out.
• Refresh rotation: two sequential POST /auth/refresh succeed; old token 401 on reuse.
• Logout (one device) leaves other sessions; logout-all clears all.
• Sessions list shows browser/OS/IP/location; revoke endpoint removes row.
• 2FA: enable → verify → on; disable requires code; 400/401 branches.
• API key create: secret shown once; list hides it; revoke removes.
• Rate limit 429 in production (guard rate-limit.guard.ts:30).

2. Visual / layout

• Pre-auth centered-form on tablet/desktop; phone one-thumb flow.
• Dark-light parity across login/2FA/keys (no hardcoded colors).
• Long school/tenant id + long key prefixes wrap without clipping at 200% text scale.

3. Accessibility (00-shared/09)

• TalkBack: login+2FA/session journey fully operable without sight.
• VoiceOver separately.
• Keyboard-only desktop: focus order, ring visible.
• Errors announced on focus + live region for snackbars (copied, revoked).
• 2FA digit field group readable.
• Contrast: body 4.5:1, icons 3:1.
• Reduced-motion: shake off.

4. Performance

• Login round-trip < budget; no duplicate parallel requests (refresh single-flight).
• No flicker: skeleton ≤ 200 ms for sessions update.
• Memory stable over 20-min session.

5. Offline & network (10 §2)

• Login offline → banner + disabled.
• Sessions cached last-good + offline banner.
• Revoke offline → blocked (no silent failure).
• Slow network × 429 countdown correct.

6. Tablet / desktop

• Master-detail sessions/api-keys at ≥840 px.
• Hover + right-click menus.
• Table: Enter submits, TAB order.
• focus.

7. Localization

• All strings via i18n; SMS/locales lengths; RTL on security lists.
• Date/time locale for expires/last-used.

8. Permissions

• Self-service auth screens require valid JWT only (no permission metadata — OQ-5).
• Cross-tenant sessions consumption impossible (no other-tenant reads possible by design, but revoke-by-id has no owner check — flag: confirm product decision).

9. Dark mode

• Full visual pass; key surfaceContainerHigh on dark; contrast.

10. Animations

• Tokens only; reduce-motion; no flashes in key reveal.

11. Security (session, 2FA, rate, tokens)

• Tokens never logged, never in analytics/screenshots.
• Secure storage only.
• Session-expiry overlay (reason banner) — app re-login flow.
• Refresh single-flight and rotation.
• API-key reveal = one-time only; clipboard auto-clear after 5s (proposed).
• Rate-limit loops — no auto retry on 429.

12. Server-backed edge mirrors

• Locked account message (server may set lockedUntil).
• Password reset token expiry path (1 h).
• Register with unknown tenantId still succeeds (creates that tenant) — confirm UX.

QA scripts

• Golden per component (light/dark × phone/tablet/desktop × key states).
• E2E: register→verify→login-2FA→create-key→revoke→logout-all (device-cloud P0).
• Security smoke: reuse rotated refresh → expect 401, then session expiry screen.