Unified app — browser QA (M9)

Manual checklist plus optional Playwright smoke. Run after API smoke (npm run smoke:unified-workspace).

Automated (Playwright)

From repo root (requires npm install --prefix qa-tests, Admin running or ADMIN_URL set):

npm run unified-app:smoke

Configure qa-tests/.env (see .env.example):

Variable	Purpose
ADMIN_URL	Unified app origin (http://localhost:3000 or https://beentara.com)
UNIFIED_STAFF_EMAIL / UNIFIED_STAFF_PASSWORD	Real staff login (preferred for production)
UNIFIED_STAFF_TENANT	Workspace id if multi-tenant picker appears
REACT_APP_CRYPTO_SECRET	Must match Admin build when using JWT inject fallback

Without credentials, the script uses JWT inject when Backend/.env DB + JWT_SECRET are available (local only).

What the script checks

• Login page does not reference teams.beentara.com
• Staff tab copy visible
• Staff reaches /dashboard
• Staff legacy /follow-ups → /crm (when CRM permission allows)
• Staff /marquee stays authenticated
• Admin legacy /plan → /saas/subscription and /reciept → /receipt
• Staff without settings.read hitting /setting → /dashboard (when such a user exists in DB)

Manual smoke (staff test account)

1. Staff Login on /login → lands on /dashboard; shortcuts match permissions.
2. Sidebar only shows allowed modules (appMenu + RBAC).
3. Open denied deep link (e.g. /setting without permission) → access denied toast + redirect to /dashboard.
4. Owner admin login → full menu; analytics tab on dashboard if enabled.
5. teams.beentara.com (after DNS) → same app as beentara.com; staff login works without cross-origin redirect.

Manual smoke (owner admin)

1. SaaS / super-admin routes still reachable.
2. Settings and billing unchanged.

See also unified-app-cutover.md.