RBAC Manual Test Plan

Prerequisites

You need 3 test accounts for the same company, each with a different role tier:

Account	Role	Expected Tier
Admin user	Company Admin (or Super Admin)	Full access
Member user	Recruiter/HR (or Internal Sales)	Can edit, cannot manage team
Viewer user	External Sales, Economy, or Auditor/Viewer	View only

Assign roles via the admin panel at /admin/settings/roles (Assignments tab) or during team invitation.

---

Test Matrix

For each section below, log in as all 3 roles and verify the expected behaviour.

Legend

• V = Visible / Accessible
• H = Hidden / Not visible
• n/a = Not applicable

---

1. Jobs

Page: /company/jobs

Element	Admin	Member	Viewer
Job list (view)	V	V	V
"Create" button (top bar)	V	V	H
Card dropdown menu → Edit	V	V	H
Card dropdown menu → Delete	V	V	H
Card dropdown menu → Duplicate	V	V	H
Card dropdown menu → Assign	V	V	H
Card dropdown menu → Share	V	V	V
Card dropdown menu → View	V	V	V

Page: /company/jobs/[jobId] (Job detail)

Element	Admin	Member	Viewer
View job details	V	V	V
Recommended Talents → "Add as Candidate"	V	V	H

Component: OptionsDropdown (3-dot menu on job detail/kanban)

Element	Admin	Member	Viewer
Publish on web toggle	V	V	H
Priority toggle	V	V	H
Assign to	V	V	H
Share	V	V	V
Edit	V	V	H
Duplicate	V	V	H
Delete	V	V	H

Kanban view: /company/jobs (kanban tab)

Element	Admin	Member	Viewer
View kanban board	V	V	V
Card dropdown → Edit/Delete	V	V	H
Status change (drag & drop)	V	V	V*

*Status change is handled by the card header select, which is not role-gated. The backend should reject unauthorised status changes.

---

2. Candidates

Page: /company/resume/candidates

Element	Admin	Member	Viewer
View candidate list	V	V	V
Card dropdown → Edit	V	V	H
Card dropdown → Delete	V	V	H
Card dropdown → Assign	V	V	H
Card dropdown → Download	V	V	V

Pipeline Kanban (candidates inside a pipeline)

Element	Admin	Member	Viewer
View kanban	V	V	V
Card dropdown → Edit/Delete/Assign	V	V	H

---

3. Talents

Page: /company/resume/talents

Element	Admin	Member	Viewer
View talent list	V	V	V
"Import" button	V	V	H
"Add" button	V	V	H
Card dropdown → Edit	V	V	H
Card dropdown → Delete	V	V	H

---

4. Talent Pools

Page: /company/resume/talentpool

Element	Admin	Member	Viewer
View pool list	V	V	V
"Add Pool" button	V	V	H
Card dropdown → Edit	V	V	H
Card dropdown → Delete	V	V	H

---

5. Share Lists

Page: /company/resume/sharelist

Element	Admin	Member	Viewer
View share lists	V	V	V
"Add List" button	V	V	H
Card dropdown → Edit	V	V	H
Card dropdown → Share	V	V	V
Card dropdown → Delete	V	V	H

---

6. Contacts

Page: /company/connections/contacts

Element	Admin	Member	Viewer
View contact list	V	V	V
"Add" button	V	V	H
"Import" button	V	V	H
Card dropdown → Edit	V	V	H
Card dropdown → Delete	V	V	H
Card footer → Call/Email	V	V	V

---

7. Pipelines

Page: /company/pipeline (list view)

Element	Admin	Member	Viewer
View pipeline list	V	V	V
"Add Pipeline" button	V	V	H
Card footer → Edit link	V	V	H
Card footer → View link	V	V	V

---

8. Collaborating Partners

Page: /company/connections/collaboratingpartner

Element	Admin	Member	Viewer
View partner list	V	V	V
"Invite" button	V	V	H
Card dropdown → Accept (pending received)	V	V	H
Card dropdown → Withdraw (pending sent)	V	V	H
Card dropdown → Leave (active received)	V	V	H
Card dropdown → Delete	V	V	H

---

9. Companies (Connections)

Page: /company/connections/companies

Element	Admin	Member	Viewer
View company list	V	V	V
Connection request Accept/Reject	V	V	H
Card dropdown → Disconnect	V	V	H

---

10. Team Members (Admin-Only)

Page: /company/team/members or /userprofile/members

Element	Admin	Member	Viewer
View member list	V	V	V
"Invite" button	V	H	H
Card dropdown → Edit/Delete	V	H	H

---

11. Invitations (Admin-Only)

Page: /userprofile/invitation

Element	Admin	Member	Viewer
View invitations	V	V	V
"Invite" button	V	H	H
Card dropdown → Resend	V	H	H
Card dropdown → Delete	V	H	H

---

12. Company Settings (Admin-Only)

Page: /userprofile (company tab)

Element	Admin	Member	Viewer
View company info	V	V	V
Edit any field (click to activate)	V	H	H
Save changes button	V	H	H
Delete company button	V	H	H

---

Edge Cases to Test

Role Switching

1. Log in as an admin user who has roles in multiple companies
2. Switch to a company where they are a Viewer
3. Verify all write actions are hidden
4. Switch back to the admin company
5. Verify all write actions are restored

Super Admin Override

1. Log in as a Super Admin (isSuperAdmin: true)
2. Even if company role is Viewer or missing, all actions should be visible

New User (No Role)

1. Create a user with no UserCompanyRole for the company
2. Verify they see view-only UI (same as Viewer)

Direct URL Navigation

1. As a Viewer, try navigating directly to:
   • /company/jobs/createjob — page should still load, but backend will reject the mutation
   • /company/resume/candidates/add — same behaviour
   • /company/resume/talentpool/add — same behaviour
2. The frontend hides the navigation buttons, but we don't block the routes themselves. The backend handles unauthorised mutation attempts.

Browser Back Button

1. As Admin, navigate to an edit page
2. Switch to Viewer role
3. Press browser back — verify no stale edit UI appears

Loading State

1. On slow connections, verify that buttons don't flash visible then disappear
2. The useCompanyRole hook uses cache-and-network, so cached role data should prevent this

---

Regression Checks

These features should continue to work exactly as before:

• Jobseeker pages — all actions remain visible (jobseekers are unrestricted)
• Admin panel (/admin/*) — fully accessible to Super Admins
• Support portal — accessible to support agents and super admins
• Login / logout flow — no changes
• Role switching between companies — role updates correctly
• Card view/list/table toggle — works across all views
• Pagination — works correctly with filtered actions
• Search and filters — unaffected
• Share / Download / View actions — always visible regardless of role