# NextWks — Manual Test Instructions

## Credentials & URLs

Copy these as needed:

```
Authelia Login:  https://auth.lohmar.co.uk
Username:        admin
Password:        ueM8tLARi5v3orIzvd56w6u6!

Workspace:       https://wks.lohmar.co.uk

Admin API Token: grep secret_token /opt/nextwks/config.yaml
```

All services are deployed and running via systemd on `172.16.8.22`:
- `authelia` — port 9091
- `nextwks` — port 8080

---

## Test Suite 1 — OIDC Login Flow (Browser)

### T1.1 — Workspace Redirect
Open: `https://wks.lohmar.co.uk/`

**Expected:** Redirected to `https://auth.lohmar.co.uk/` login page.

### T1.2 — Login
Enter credentials:
- Username: `admin`
- Password: `ueM8tLARi5v3orIzvd56w6u6!`

**Expected:** After login, redirected back to workspace launcher page. Shows "Welcome" heading and app grid with 6 tiles.

### T1.3 — Session Persistence
Close the browser tab, reopen `https://wks.lohmar.co.uk/`.

**Expected:** Should go directly to launcher (session cookie still valid).

### T1.4 — Logout (if implemented)
Visit `https://wks.lohmar.co.uk/auth/logout`

**Expected:** Redirected to Authelia login page.

---

## Test Suite 2 — Admin UI (Browser)

The admin panel requires a bearer token in the `Authorization` header. Get the token:
```bash
ssh root@172.16.8.22 "grep secret_token /opt/nextwks/config.yaml | head -1"
```

### T2.1 — Admin Dashboard
With the token set as a header, visit: `https://wks.lohmar.co.uk/admin`

**Expected:** Dark-themed admin dashboard with user count stat card and sidebar.

### T2.2 — User Management
Navigate to `https://wks.lohmar.co.uk/admin/users`

**Expected:** User table loads, shows existing users with status badges. "+ Add User" and "Delete" buttons work via HTMX.

---

## Test Suite 3 — Admin API (Terminal)

Run from the server or any machine that can reach `172.16.8.22:8080`.

```bash
TOKEN=$(ssh root@172.16.8.22 "grep secret_token /opt/nextwks/config.yaml | head -1 | sed 's/.*: *\"//;s/\"//'")
API="http://172.16.8.22:8080/admin/api"
```

### T3.1 — Health Check
```bash
curl -H "Authorization: Bearer $TOKEN" $API/health
```
**Expected:** `{"status":"ok","user_count":...}`

### T3.2 — List Users
```bash
curl -H "Authorization: Bearer $TOKEN" $API/users | python3 -m json.tool
```
**Expected:** JSON array of users with role, groups, etc.

### T3.3 — Create User
```bash
curl -X POST $API/users \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"users":[{"username":"testuser","display_name":"Test","email":"test@test.com","role":"user"}]}'
```
**Expected:** Generated password displayed. User appears in Authelia YAML within seconds.

### T3.4 — Delete User
```bash
curl -X DELETE -H "Authorization: Bearer $TOKEN" $API/users/testuser
```
**Expected:** `{"status":"deleted","username":"testuser"}`

### T3.5 — No Token
```bash
curl $API/health
```
**Expected:** `{"error":"unauthorized"}` (HTTP 401)

---

## Test Suite 4 — Authelia Sync Verification

### T4.1 — Check YAML
```bash
ssh root@172.16.8.22 "cat /opt/authelia/users_database.yml"
```
**Expected:** Contains all NextWks users with argon2id password hashes.

### T4.2 — Create & Check
Create a user via API (T3.3), then immediately:
```bash
ssh root@172.16.8.22 "grep testuser /opt/authelia/users_database.yml"
```
**Expected:** User appears in YAML within seconds.

---

## Test Suite 5 — PWA & Launcher

### T5.1 — Manifest
```bash
curl -s https://wks.lohmar.co.uk/static/manifest.json | python3 -m json.tool
```
**Expected:** `"name":"Next Workspace"`, `"display":"standalone"`

### T5.2 — Service Worker
```bash
curl -s -o /dev/null -w "%{http_code}" https://wks.lohmar.co.uk/static/sw.js
```
**Expected:** `200`

### T5.3 — Install Button
On the launcher page, click the download icon in the header bar (might need PWA trigger or click Install to Desktop at bottom).

**Expected:** Either native install prompt or modal with platform-specific instructions (iOS Safari, Android Chrome, Desktop).

---

## Test Suite 6 — Error Cases

### T6.1 — Invalid Token
```bash
curl -H "Authorization: Bearer bad-token" $API/health
```
**Expected:** `{"error":"unauthorized"}`

### T6.2 — Empty Users Array
```bash
curl -X POST $API/users -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d '{"users":[]}'
```
**Expected:** `{"error":"no users provided"}`

### T6.3 — 404
```bash
curl -I https://wks.lohmar.co.uk/nonexistent
```
**Expected:** HTTP 404

---

## Results

| Suite | Tests | ✓ | Notes |
|-------|-------|---|-------|
| 1. OIDC Login | 4 | | |
| 2. Admin UI | 2 | | |
| 3. Admin API | 5 | | |
| 4. Authelia Sync | 2 | | |
| 5. PWA & Launcher | 3 | | |
| 6. Error Cases | 3 | | |
| **Total** | **19** | | |