Plan: V1F-002 — Authenticated demo UAT multi-role¶

Status¶

DONE / REMEDIATED — 2026-08-26T14:39:55Z (initial) · rebound 2026-08-29T04:40:12Z

Final evidence (Post-SCORE rebind): execution/V1-current-tip-evidence/V1-DEMO-UAT-20260829T043945Z.json
Prior evidence @ f7a20f7d/6ef1aa46: execution/V1-current-tip-evidence/V1-DEMO-UAT-20260826T143955Z.json
Totals: 16 PASS / 0 FAIL / 0 SKIP (16 executed) on both runs
Identity bound (rebind): FE 5bebc1b4 · BE 5e6be85 · DB scoladev_demo / fad7c305-…
Isolation pre/post: PASS
Production unchanged; V1F-010 production restart not performed

Evidence: execution/V1-current-tip-evidence/V1-DEMO-UAT-20260826T120317Z.json — 15/16 with FAIL DEMO-ADMIN-SPMB-REGISTERS-LIST

Role	Login pattern	Result
school_admin	disposable `v1f002.uat.admin.<ts>`	Login + Core + SPMB registers/list PASS
teacher	disposable	Login + session PASS
parent	disposable	Login + `/api/parent/children` PASS
SPMB public	unauthenticated	`/api/SPMB/registers` PASS
Negative	teacher → reset-password / SPMB registers list	PASS (`capability_denied`)

Item	Detail
Symptom	Admin `POST /api/SPMB/registers/list` → `Access denied` despite `admissions.period.view`
Root cause	Odoo merges all leaf subclasses of `SPMBApiController`; `SPMBComplaintsRankingController._check_access` always returned `False` and shadowed Registers/Applicants
Fix	Rename complaints helper to `_check_complaints_access`; Registers/Applicants use `_staff_permissions()` + explicit session `active_role`; harden `get_request_authority`
BE tip	`6ef1aa46362cd51623e2e159792f9ab8bd86c3c3` · tree `8bef7a61830e02eedab5a09ebe7ad2179b92d4ba057989111b74dc4fcaf72585`

Secrets: /tmp/v1f002_demo_uat.env only (not committed). Disposable users deactivated after run.

Menyelesaikan matriks UAT terautentikasi di https://demo.gcgscola.id untuk role Core + SPMB yang in-scope.