# Test Report

Test date: 2026-10-13 (Asia/Dhaka)

| Test | Result | Evidence |
|---|---|---|
| PHP syntax: application and entry point | Passed | PHP 8.3 local linter passed all 7 PHP files |
| Super Admin bcrypt hash | Passed | Local PHP `password_verify('Admin@12345', hash)` returned `true` |
| SQL import | Passed | Isolated local MySQL 8.4.3 on port 3307 imported the complete SQL successfully; all expected tables were listed |
| Initial Super Admin record | Passed | `superadmin` record and bcrypt hash verified after actual SQL import |
| Public website | Passed | Local PHP 8.3 web server returned HTTP 200 for the home route |
| Login and first-login enforcement | Passed | `superadmin` / `Admin@12345` returned HTTP 302 to `?r=password`; password page returned HTTP 200 |
| Routine conflict protection | Passed | Actual MySQL insert with an overlapping teacher schedule was rejected by `trg_timetable_conflict` with SQLSTATE 45000 |
| Demo data volume | Passed | Fresh MySQL import returned 25 students and 25 linked enrollments |
| Application syntax | Passed | Local PHP 8.3 linter passed all 9 application PHP files after the advanced workflows were added |
| Admission approval integrity | Implemented | Approval uses a CSRF-protected transaction and creates linked student, guardian, student-guardian and enrollment records; only Pending applications may proceed |
| Payment safeguards | Implemented | Payment allocation, receipt, account credit and invoice update are atomic; reversal creates the compensating account entry |
| Public admission → approval E2E | Passed | Browser test created a Pending application; Super Admin changed password, approved it, and database confirmed the linked student and guardian |
| Invoice → partial payment E2E | Passed | Database confirmed ৳1,000 invoice / ৳400 paid / ৳600 due / `Partial` status with receipt and credit transaction |
| Payment reversal E2E | Passed | Reversal removed the payment, restored invoice to ৳0 paid / ৳1,000 due / `Unpaid`, and created a debit transaction |
| Backup and restore E2E | Passed | A changed student name was restored from an app-generated private SQL backup using explicit `RESTORE` confirmation |
| Student portal access control E2E | Passed | A linked Student account saw only its own record; attempting the fee-management route returned HTTP 403 |
| Attendance entry E2E | Passed | Three batch attendance values were inserted/updated through the UI and verified in MySQL |
| Marks entry / grade E2E | Passed | UI marks entry persisted 88→A+/5.00 and 76→A/4.00 to the correct examination-subject rows |
| Account transfer E2E | Passed | UI transfer created one transfer and matching debit/credit cashbook entries of ৳100 |
| Expense / voucher E2E | Passed | UI expense created an expense, voucher and matching debit cashbook entry of ৳250 |
| Payroll E2E | Passed | UI payroll stored teacher salary ৳18,000, deduction ৳500, net ৳17,500 and `Paid` status |
| Student profile management E2E | Passed | UI created a Student profile with identity, contacts, birth date, address and active status; the row was verified in MySQL |

Additional implementation coverage: invoice creation, payment allocation/receipt, expense/voucher, payroll, attendance save/update, academic/routine setup, CSV export, private data backup, user creation, password change, and portal data filtering have source-level implementation. Full data-entry smoke coverage remains a recommended pre-production check.

The current release additionally provides examination/subject setup and publication, print-ready financial summary, portal-account linking and explicit-confirmation demo cleanup.

## Final architecture and defect fixes (2026-10-13)

| Check | Result | Evidence |
|---|---|---|
| Application bootstrap and route boundary | Passed | `public/index.php` boots `Application`; PHP syntax validation passed |
| CMS controller mapping | Passed | Added `CmsController` for draft/published page create and edit, with CSRF, slug validation, and audit logging; PHP syntax validation passed |
| Password-change enforcement | Passed | First-login users are held at password change, while users whose flag is cleared go to the dashboard; PHP syntax validation passed |
| Teacher data-entry ownership checks | Implemented | Attendance batch and exam-subject requests are checked against the logged-in teacher profile and assignments; syntax checked, full role E2E remains unverified |
| Release configuration | Passed | Local root DB credentials replaced by cPanel placeholders; cPanel setup guide updated |
| Full application PHP lint | Passed | Latest run passed syntax validation for all 45 PHP files in `app/` and `public/` |
| Core behavior checks | Passed | Latest `tests/run_tests.php` run passed 7 dependency-free checks for money, validation, escaping, and guest permissions; 59/59 total checks passed |
| MySQL import after final changes | Passed | MySQL 8.4.3 on the isolated `storage/mysql-e2e` instance imported the refreshed SQL; 46 tables, 25 students, 20 explicitly marked demo students, and one current academic year were verified |
| cPanel-style selected-database import | Passed | Imported the updated SQL into a separately selected empty database without CREATE DATABASE privileges; 46 tables and 25 seeded students were created |
| Initial Super Admin after final import | Passed | `superadmin` is Active, first-login password change is enabled, and `password_verify('Admin@12345', hash)` returned `true` |
| Seeded account safety | Passed | `admin`, `accountant`, `demo_teacher`, `demo_student`, and `demo_parent` are Inactive; only `superadmin` is Active |
| Repeat import support | Passed | Re-imported the updated schema into the existing isolated test database successfully after completing the SQL reset list |
| Demo cleanup targeting | Passed | In a rollback-only transaction, the archive rule selected exactly 20 marked demo students, left 5 unmarked students active, and rollback restored the database |
| Release archive | Passed | Rebuilt from the current source after the latest controller, permission, and test changes; verified required entries and excluded runtime storage |
| Role permissions local HTTP E2E | Passed | Super Admin changed Admin to dashboard-only in the UI; dashboard returned HTTP 200 and CMS returned HTTP 403; default grants were restored |
| CMS local HTTP E2E | Passed | Created a Published page through the CSRF-protected CMS form and retrieved it through the public page route (HTTP 200) |
| Teacher portal and scope local HTTP E2E | Passed | Teacher saw assigned routine/student only; own-batch attendance and assigned-subject marks returned HTTP 200; unassigned batch/subject returned HTTP 403 |
| Admission apply/approve/reject local HTTP E2E | Passed | Public application form submitted two records; approval created exactly one linked student, guardian, and enrollment; rejection persisted as Rejected |
| Issues found during latest E2E | Fixed | Selected `sort_order` in the teacher DISTINCT roster query for MySQL strict mode; renamed the enrollment factory to avoid overriding `Model::create` with an incompatible signature |

Only completed, evidenced checks may be marked passed. Complete the post-configure browser smoke test before production use.

## Latest verification pass

- PHP 8.3: 45/45 application/public syntax checks passed; the full runner also syntax-checked configuration, routes, and itself (52 PHP files total).
- Dependency-free behavior tests: 7/7 passed (59 checks total including syntax).
- Isolated MySQL 8.4.3 database on port 3310: 46 tables, 25 students, and permission grants present for all six seeded roles.
- cPanel-compatible import: confirmed the SQL imports into a pre-created/selected database and no longer attempts to create or switch to an unprefixed database name.
- The root SQL distribution and `database/StepUp-Academy-Database.sql` have matching SHA-256 hashes.
- Authenticated local HTTP E2E checks cover the recent role-permission, CMS, teacher-scope, and admission flows. Direct graphical browser control was unavailable because the desktop browser helper could not determine the active URL safely.