Testing

A hands-on checklist to confirm a BlockID deployment behaves correctly and securely. Work top to bottom before going live, and re-run the security-sensitive items after any change.

Routing

• / serves the marketing homepage (via DirectoryIndex).
• /login.php shows the sign-in page; a good login lands on /dashboard.php.
• /dashboard.php requires login — an anonymous visit redirects to /login.php.
• Public pages resolve: /pricing.php, /security.php, /signup.php, etc.
• /docs/** renders these docs; internal doc links resolve.

Database error handling

• With a deliberately wrong DB password, the dashboard shows a friendly database error page — not a raw exception or stack trace.
• The precise MySQL error appears in storage/logs/php-error.log.
• Restoring correct credentials makes the dashboard load normally.

Profile dropdown & logout

• The top-right profile dropdown shows avatar initials, name, and role.
• It contains My Profile, Account Settings, Security Settings, Switch Theme, and Sign Out.
• Sign Out performs a CSRF-protected POST and returns you to /login.php.
• After sign-out, the browser back button does not expose the dashboard.

API auth, scopes & rate limit

• GET /api/v1/health.php returns success: true with no token.
• A request without a token returns 401 UNAUTHORIZED.
• A token missing the needed scope returns 403 FORBIDDEN (e.g. verifying with only credentials:read).
• Exceeding 120 requests/min returns 429 RATE_LIMITED.
• A revoked or expired token returns 401.
• Every response follows the { success, code, message, data } envelope.

Issuance, verification & revocation

• Issuing a credential (UI or API) returns a credential ID, verification token, hash, and signature.
• Verifying that token returns VALID with all checks passing.
• Editing one field of the credential JSON and re-verifying returns TAMPERED.
• An expired credential verifies as EXPIRED.
• After revocation, verification returns REVOKED.
• A made-up token returns NOT_FOUND; a credential from another instance returns UNKNOWN_ISSUER.

Ledger integrity

• Verify Ledger Integrity (UI) and GET /api/v1/ledger/verify.php both report the chain intact on a healthy DB.
• The reported records_checked count grows as you issue and revoke.

RBAC & IDOR

• An End User cannot reach issuing or admin screens.
• A Verifier cannot issue or revoke.
• A user from Org A cannot read Org B's records — even by editing a record ID in the URL or API (expect 403/404).
• API tokens only ever return their own organization's data.

Security headers

• Responses include HSTS, CSP, X-Content-Type-Options: nosniff, frame protection, and Referrer-Policy.
• /config, /core, and /storage return 403 over HTTP.
• /install is gone (404), confirming cleanup.
• display_errors is off — a forced error shows nothing sensitive on screen.

Responsive & dark mode

• The dashboard and docs are usable on a narrow phone viewport (collapsible sidebar, no horizontal overflow).
• The dark/light toggle works and the choice persists across reloads and sign-ins.
• With OS "reduce motion" enabled, transitions are minimized.
• Pages print cleanly (sidebar/topbar hidden, link URLs shown) — try Ctrl/Cmd + P on any doc page.