# 1. Login & Security — Test Cases

User Type: **Sponsor**
Source: *Mi Digital Academy - Education CRM Features Document*
Spec: login_security.md — every feature, sub-feature, and rule covered

## Test Execution Policy

- Zero tolerance: any deviation from the documented behavior is a defect.
- Every failed test is logged with a Bug ID, the feature, the sub-feature, the expected vs actual result, and the severity; 100% of bugs are fixed before the group passes.
- 100% pass rate is required for the group to be marked complete.

## Coverage Matrix

| Feature | Sub-feature / Rule | Test IDs |
|---------|--------------------|----------|
| 1.1 | Email + password login | TC-SPN-1-01-001 |
| 1.1 | OTP verification on login | TC-SPN-1-01-002 |
| 1.1 | Two-factor authentication (2FA) | TC-SPN-1-01-003 |
| 1.1 | Password reset via email link | TC-SPN-1-01-004 |
| 1.1 | Session timeout and auto-logout | TC-SPN-1-01-005 |
| 1.1 | Secure Login available on web and mobile | TC-SPN-1-01-006 |
| 1.1 | secure login event logging (viewed) | TC-SPN-1-01-007 |
| 1.1 | Audit logging of secure login | TC-SPN-1-01-008 |
| 1.1 | Rule: Email + password login. | TC-SPN-1-01-009 |
| 1.1 | Rule: OTP verification on login. | TC-SPN-1-01-010 |
| 1.1 | Rule: Two-factor authentication (2FA). | TC-SPN-1-01-011 |
| 1.1 | Rule: Password reset via email link. | TC-SPN-1-01-012 |
| 1.1 | Rule: Session timeout and auto-logout. | TC-SPN-1-01-013 |
| 1.2 | Sponsor registration form (brand name, contact, industry) | TC-SPN-1-02-014 |
| 1.2 | Brand asset upload (logo, brand guidelines) | TC-SPN-1-02-015 |
| 1.2 | Platform brand verification and approval workflow | TC-SPN-1-02-016 |
| 1.2 | Email verification of the sponsor contact | TC-SPN-1-02-017 |
| 1.2 | Account status: pending, verified, suspended | TC-SPN-1-02-018 |
| 1.2 | Registration & Brand Verification available on web and mobile | TC-SPN-1-02-019 |
| 1.2 | registration & brand verification event logging (viewed) | TC-SPN-1-02-020 |
| 1.2 | Audit logging of registration & brand verification | TC-SPN-1-02-021 |
| 1.2 | Rule: Sponsor registration form (brand name, contact, industry). | TC-SPN-1-02-022 |
| 1.2 | Rule: Brand asset upload (logo, brand guidelines). | TC-SPN-1-02-023 |
| 1.2 | Rule: Platform brand verification and approval workflow. | TC-SPN-1-02-024 |
| 1.2 | Rule: Email verification of the sponsor contact. | TC-SPN-1-02-025 |
| 1.2 | Rule: Account status: pending, verified, suspended. | TC-SPN-1-02-026 |

## 1.1 Secure Login

### TC-SPN-1-01-001 — Email + password login
**Type:** Positive
**Covers:** 1.1 → Email + password login; Rule: Email + password login.
**Preconditions:** A Sponsor account is active and the Sponsor is in the state required for this behavior.
**Steps:**
1. As a Sponsor, set up the precondition and perform: Email + password login.
2. Observe the result and verify the full behavior: Email + password login.
**Expected Result:** Email + password login — delivered exactly as documented.
**Priority:** Critical

### TC-SPN-1-01-002 — OTP verification on login
**Type:** Positive
**Covers:** 1.1 → OTP verification on login; Rule: OTP verification on login.
**Preconditions:** A Sponsor account is active and the Sponsor is in the state required for this behavior.
**Steps:**
1. As a Sponsor, set up the precondition and perform: OTP verification on login.
2. Observe the result and verify the full behavior: OTP verification on login.
**Expected Result:** OTP verification on login — delivered exactly as documented.
**Priority:** High

### TC-SPN-1-01-003 — Two-factor authentication (2FA)
**Type:** Positive
**Covers:** 1.1 → Two-factor authentication (2FA); Rule: Two-factor authentication (2FA).
**Preconditions:** A Sponsor account is active and the Sponsor is in the state required for this behavior.
**Steps:**
1. As a Sponsor, set up the precondition and perform: Two-factor authentication (2FA).
2. Observe the result and verify the full behavior: Two-factor authentication (2FA).
**Expected Result:** Two-factor authentication (2FA) — delivered exactly as documented.
**Priority:** Medium

### TC-SPN-1-01-004 — Password reset via email link
**Type:** Positive
**Covers:** 1.1 → Password reset via email link; Rule: Password reset via email link.
**Preconditions:** A Sponsor account is active and the Sponsor is in the state required for this behavior.
**Steps:**
1. As a Sponsor, set up the precondition and perform: Password reset via email link.
2. Observe the result and verify the full behavior: Password reset via email link.
**Expected Result:** Password reset via email link — delivered exactly as documented.
**Priority:** Medium

### TC-SPN-1-01-005 — Session timeout and auto-logout
**Type:** Positive
**Covers:** 1.1 → Session timeout and auto-logout; Rule: Session timeout and auto-logout.
**Preconditions:** A Sponsor account is active and the Sponsor is in the state required for this behavior.
**Steps:**
1. As a Sponsor, set up the precondition and perform: Session timeout and auto-logout.
2. Observe the result and verify the full behavior: Session timeout and auto-logout.
**Expected Result:** Session timeout and auto-logout — delivered exactly as documented.
**Priority:** Medium

### TC-SPN-1-01-006 — Secure Login available on web and mobile
**Type:** Positive
**Covers:** 1.1 → Secure Login available on web and mobile; Rule: Email + password login.
**Preconditions:** A Sponsor account is active and the Sponsor is in the state required for this behavior.
**Steps:**
1. As a Sponsor, set up the precondition and perform: Secure Login available on web and mobile.
2. Observe the result and verify the full behavior: Secure Login available on web and mobile.
**Expected Result:** Secure Login available on web and mobile — delivered exactly as documented.
**Priority:** Medium

### TC-SPN-1-01-007 — secure login event logging (viewed)
**Type:** Positive
**Covers:** 1.1 → secure login event logging (viewed); Rule: OTP verification on login.
**Preconditions:** A Sponsor account is active and the Sponsor is in the state required for this behavior.
**Steps:**
1. As a Sponsor, set up the precondition and perform: secure login event logging (viewed).
2. Observe the result and verify the full behavior: secure login event logging (viewed).
**Expected Result:** secure login event logging (viewed) — delivered exactly as documented.
**Priority:** Medium

### TC-SPN-1-01-008 — Audit logging of secure login
**Type:** Positive
**Covers:** 1.1 → Audit logging of secure login; Rule: Two-factor authentication (2FA).
**Preconditions:** A Sponsor account is active and the Sponsor is in the state required for this behavior.
**Steps:**
1. As a Sponsor, set up the precondition and perform: Audit logging of secure login.
2. Observe the result and verify the full behavior: Audit logging of secure login.
**Expected Result:** Audit logging of secure login — delivered exactly as documented.
**Priority:** Medium

### TC-SPN-1-01-009 — Rule: Email + password login.
**Type:** Positive
**Covers:** 1.1 → Rule: Email + password login.
**Preconditions:** A Sponsor account is active and the Sponsor is in the state required for this behavior.
**Steps:**
1. As a Sponsor, set up the precondition and perform the action that triggers the rule: Email + password login.
2. Observe the result and verify the full behavior: Email + password login.
**Expected Result:** Email + password login. — delivered exactly as documented.
**Priority:** Critical

### TC-SPN-1-01-010 — Rule: OTP verification on login.
**Type:** Positive
**Covers:** 1.1 → Rule: OTP verification on login.
**Preconditions:** A Sponsor account is active and the Sponsor is in the state required for this behavior.
**Steps:**
1. As a Sponsor, set up the precondition and perform the action that triggers the rule: OTP verification on login.
2. Observe the result and verify the full behavior: OTP verification on login.
**Expected Result:** OTP verification on login. — delivered exactly as documented.
**Priority:** High

### TC-SPN-1-01-011 — Rule: Two-factor authentication (2FA).
**Type:** Positive
**Covers:** 1.1 → Rule: Two-factor authentication (2FA).
**Preconditions:** A Sponsor account is active and the Sponsor is in the state required for this behavior.
**Steps:**
1. As a Sponsor, set up the precondition and perform the action that triggers the rule: Two-factor authentication (2FA).
2. Observe the result and verify the full behavior: Two-factor authentication (2FA).
**Expected Result:** Two-factor authentication (2FA). — delivered exactly as documented.
**Priority:** Medium

### TC-SPN-1-01-012 — Rule: Password reset via email link.
**Type:** Positive
**Covers:** 1.1 → Rule: Password reset via email link.
**Preconditions:** A Sponsor account is active and the Sponsor is in the state required for this behavior.
**Steps:**
1. As a Sponsor, set up the precondition and perform the action that triggers the rule: Password reset via email link.
2. Observe the result and verify the full behavior: Password reset via email link.
**Expected Result:** Password reset via email link. — delivered exactly as documented.
**Priority:** Medium

### TC-SPN-1-01-013 — Rule: Session timeout and auto-logout.
**Type:** Positive
**Covers:** 1.1 → Rule: Session timeout and auto-logout.
**Preconditions:** A Sponsor account is active and the Sponsor is in the state required for this behavior.
**Steps:**
1. As a Sponsor, set up the precondition and perform the action that triggers the rule: Session timeout and auto-logout.
2. Observe the result and verify the full behavior: Session timeout and auto-logout.
**Expected Result:** Session timeout and auto-logout. — delivered exactly as documented.
**Priority:** Medium

## 1.2 Registration & Brand Verification

### TC-SPN-1-02-014 — Sponsor registration form (brand name, contact, industry)
**Type:** Positive
**Covers:** 1.2 → Sponsor registration form (brand name, contact, industry); Rule: Sponsor registration form (brand name, contact, industry).
**Preconditions:** A Sponsor account is active and the Sponsor is in the state required for this behavior.
**Steps:**
1. As a Sponsor, set up the precondition and perform: Sponsor registration form (brand name, contact, industry).
2. Observe the result and verify the full behavior: Sponsor registration form (brand name, contact, industry).
**Expected Result:** Sponsor registration form (brand name, contact, industry) — delivered exactly as documented.
**Priority:** Critical

### TC-SPN-1-02-015 — Brand asset upload (logo, brand guidelines)
**Type:** Positive
**Covers:** 1.2 → Brand asset upload (logo, brand guidelines); Rule: Brand asset upload (logo, brand guidelines).
**Preconditions:** A Sponsor account is active and the Sponsor is in the state required for this behavior.
**Steps:**
1. As a Sponsor, set up the precondition and perform: Brand asset upload (logo, brand guidelines).
2. Observe the result and verify the full behavior: Brand asset upload (logo, brand guidelines).
**Expected Result:** Brand asset upload (logo, brand guidelines) — delivered exactly as documented.
**Priority:** High

### TC-SPN-1-02-016 — Platform brand verification and approval workflow
**Type:** Positive
**Covers:** 1.2 → Platform brand verification and approval workflow; Rule: Platform brand verification and approval workflow.
**Preconditions:** A Sponsor account is active and the Sponsor is in the state required for this behavior.
**Steps:**
1. As a Sponsor, set up the precondition and perform: Platform brand verification and approval workflow.
2. Observe the result and verify the full behavior: Platform brand verification and approval workflow.
**Expected Result:** Platform brand verification and approval workflow — delivered exactly as documented.
**Priority:** Medium

### TC-SPN-1-02-017 — Email verification of the sponsor contact
**Type:** Positive
**Covers:** 1.2 → Email verification of the sponsor contact; Rule: Email verification of the sponsor contact.
**Preconditions:** A Sponsor account is active and the Sponsor is in the state required for this behavior.
**Steps:**
1. As a Sponsor, set up the precondition and perform: Email verification of the sponsor contact.
2. Observe the result and verify the full behavior: Email verification of the sponsor contact.
**Expected Result:** Email verification of the sponsor contact — delivered exactly as documented.
**Priority:** Medium

### TC-SPN-1-02-018 — Account status: pending, verified, suspended
**Type:** Positive
**Covers:** 1.2 → Account status: pending, verified, suspended; Rule: Account status: pending, verified, suspended.
**Preconditions:** A Sponsor account is active and the Sponsor is in the state required for this behavior.
**Steps:**
1. As a Sponsor, set up the precondition and perform: Account status: pending, verified, suspended.
2. Observe the result and verify the full behavior: Account status: pending, verified, suspended.
**Expected Result:** Account status: pending, verified, suspended — delivered exactly as documented.
**Priority:** Medium

### TC-SPN-1-02-019 — Registration & Brand Verification available on web and mobile
**Type:** Positive
**Covers:** 1.2 → Registration & Brand Verification available on web and mobile; Rule: Sponsor registration form (brand name, contact, industry).
**Preconditions:** A Sponsor account is active and the Sponsor is in the state required for this behavior.
**Steps:**
1. As a Sponsor, set up the precondition and perform: Registration & Brand Verification available on web and mobile.
2. Observe the result and verify the full behavior: Registration & Brand Verification available on web and mobile.
**Expected Result:** Registration & Brand Verification available on web and mobile — delivered exactly as documented.
**Priority:** Medium

### TC-SPN-1-02-020 — registration & brand verification event logging (viewed)
**Type:** Positive
**Covers:** 1.2 → registration & brand verification event logging (viewed); Rule: Brand asset upload (logo, brand guidelines).
**Preconditions:** A Sponsor account is active and the Sponsor is in the state required for this behavior.
**Steps:**
1. As a Sponsor, set up the precondition and perform: registration & brand verification event logging (viewed).
2. Observe the result and verify the full behavior: registration & brand verification event logging (viewed).
**Expected Result:** registration & brand verification event logging (viewed) — delivered exactly as documented.
**Priority:** Medium

### TC-SPN-1-02-021 — Audit logging of registration & brand verification
**Type:** Positive
**Covers:** 1.2 → Audit logging of registration & brand verification; Rule: Platform brand verification and approval workflow.
**Preconditions:** A Sponsor account is active and the Sponsor is in the state required for this behavior.
**Steps:**
1. As a Sponsor, set up the precondition and perform: Audit logging of registration & brand verification.
2. Observe the result and verify the full behavior: Audit logging of registration & brand verification.
**Expected Result:** Audit logging of registration & brand verification — delivered exactly as documented.
**Priority:** Medium

### TC-SPN-1-02-022 — Rule: Sponsor registration form (brand name, contact, industry).
**Type:** Positive
**Covers:** 1.2 → Rule: Sponsor registration form (brand name, contact, industry).
**Preconditions:** A Sponsor account is active and the Sponsor is in the state required for this behavior.
**Steps:**
1. As a Sponsor, set up the precondition and perform the action that triggers the rule: Sponsor registration form (brand name, contact, industry).
2. Observe the result and verify the full behavior: Sponsor registration form (brand name, contact, industry).
**Expected Result:** Sponsor registration form (brand name, contact, industry). — delivered exactly as documented.
**Priority:** Critical

### TC-SPN-1-02-023 — Rule: Brand asset upload (logo, brand guidelines).
**Type:** Positive
**Covers:** 1.2 → Rule: Brand asset upload (logo, brand guidelines).
**Preconditions:** A Sponsor account is active and the Sponsor is in the state required for this behavior.
**Steps:**
1. As a Sponsor, set up the precondition and perform the action that triggers the rule: Brand asset upload (logo, brand guidelines).
2. Observe the result and verify the full behavior: Brand asset upload (logo, brand guidelines).
**Expected Result:** Brand asset upload (logo, brand guidelines). — delivered exactly as documented.
**Priority:** High

### TC-SPN-1-02-024 — Rule: Platform brand verification and approval workflow.
**Type:** Positive
**Covers:** 1.2 → Rule: Platform brand verification and approval workflow.
**Preconditions:** A Sponsor account is active and the Sponsor is in the state required for this behavior.
**Steps:**
1. As a Sponsor, set up the precondition and perform the action that triggers the rule: Platform brand verification and approval workflow.
2. Observe the result and verify the full behavior: Platform brand verification and approval workflow.
**Expected Result:** Platform brand verification and approval workflow. — delivered exactly as documented.
**Priority:** Medium

### TC-SPN-1-02-025 — Rule: Email verification of the sponsor contact.
**Type:** Positive
**Covers:** 1.2 → Rule: Email verification of the sponsor contact.
**Preconditions:** A Sponsor account is active and the Sponsor is in the state required for this behavior.
**Steps:**
1. As a Sponsor, set up the precondition and perform the action that triggers the rule: Email verification of the sponsor contact.
2. Observe the result and verify the full behavior: Email verification of the sponsor contact.
**Expected Result:** Email verification of the sponsor contact. — delivered exactly as documented.
**Priority:** Medium

### TC-SPN-1-02-026 — Rule: Account status: pending, verified, suspended.
**Type:** Positive
**Covers:** 1.2 → Rule: Account status: pending, verified, suspended.
**Preconditions:** A Sponsor account is active and the Sponsor is in the state required for this behavior.
**Steps:**
1. As a Sponsor, set up the precondition and perform the action that triggers the rule: Account status: pending, verified, suspended.
2. Observe the result and verify the full behavior: Account status: pending, verified, suspended.
**Expected Result:** Account status: pending, verified, suspended. — delivered exactly as documented.
**Priority:** Medium