T0-D Golden Credential Fixtures — Notes¶

Item	Value
Mode	Server development `/home/scola/odoo`
Golden DB	`scola_golden` (default HTTP `http://127.0.0.1:8090`)
Secrets	`GT_E2E_*` env or `/tmp/gt_b2_secrets.env` (never commit; never print)
Harness	`custom_addons_scola/gcgscola/scripts/golden/t0d_credential_matrix.py`

Secrets template (`/tmp/gt_b2_secrets.env`)¶

Required keys for full Golden harness coverage (values are host-local; never commit):

GT_E2E_SCHOOL_ADMIN_PASS=
GT_E2E_TEACHER_A_PASS=
GT_E2E_HOMEROOM_PASS=
GT_E2E_MULTI_PASS=
GT_E2E_CONFLICT_PASS=
GT_E2E_STUDENT_PASS=
GT_E2E_PARENT_PASS=
GT_E2E_PRINCIPAL_PASS=
GT_E2E_VP_PASS=
GT_E2E_T2_ADMIN_PASS=
GT_E2E_T2_TEACHER_PASS=

GT_E2E_CONFLICT_PASS is required for w00_role_home_crawl case GT-AUTH-MULTI-CONFLICT (gt.multi.teacher_admin). If absent, harness scripts may copy from GT_E2E_MULTI_PASS or generate via e1_conflict_role_matrix.py (never print values).

Required logical actors¶

Actor need	Reuse / source	Login (stable)	Secret env	Notes
Active normal user	Golden Tenant teacher	`gt.teacher.assigned`	`GT_E2E_TEACHER_A_PASS`	Password change negative; public reset “exists”
Active admin with user management	Golden school admin	`gt.school_admin`	`GT_E2E_SCHOOL_ADMIN_PASS`	Admin reset, deactivate/reactivate for disabled probe
Admin without reset capability	Golden teacher (no `users.manage`)	`gt.teacher.assigned`	`GT_E2E_TEACHER_A_PASS`	Unauthorized admin-reset negative
Disabled user	Temporarily deactivate an active GT user during the run	prefer `gt.student.s1`	`GT_E2E_STUDENT_PASS`	Must be reactivated before harness exit
Forced-reset / must_change	Produced by admin reset (ephemeral)	any managed GT user	restored from env after case	Not a permanent seed row
Multi-session user	Same active teacher/admin with two cookie jars	as above	as above	Optional extension; revoke covered via reset/change
Multi-role conflict probe	`gt.multi.teacher_admin`	`GT_E2E_CONFLICT_PASS`	Required for `w00_role_home_crawl` GT-AUTH-MULTI-CONFLICT (otherwise SKIP)
Cross-tenant isolation (GT-T2)	`gt2.school_admin` / `gt2.teacher.assigned`	see fixture contract	`GT_E2E_T2_*`	Reserved for tenant-isolation cases when extended

Explicit non-actors¶

Do not use base.group_system / superadmin as a normal matrix actor.
Do not invent customer break-glass or impersonation fixtures (EXCLUDED).
Do not invent password-expiry or lockout fixtures for V1.

SPMB OTP¶

SPMB email OTP fixtures are out of scope for the password-reset matrix. Keep SPMB OTP tests separate so purpose binding stays clear.

Evidence outputs¶

Harness writes under this directory:

T0-D-<runid>-results.json
T0-D-<runid>-results.md

Run id format: T0-D-YYYYMMDDTHHMMSSZ.