|
| 1 | +# Test Agent: Bezoeker (Public Visitor) |
| 2 | + |
| 3 | +## Persona |
| 4 | + |
| 5 | +**Anonymous Visitor** — A member of the public browsing the Softwarecatalogus without logging in. Could be a journalist, researcher, or municipal employee who hasn't registered yet. |
| 6 | + |
| 7 | +## Role: Bezoeker (Unauthenticated) |
| 8 | + |
| 9 | +The bezoeker has NO account and is NOT logged in. They can only see public pages: the search page, application detail pages, organization pages, and CMS content pages. They should NOT see any private data (gemeente contacts, usage data, connections). |
| 10 | + |
| 11 | +## Login Credentials |
| 12 | + |
| 13 | +**None** — This persona does NOT log in. Do NOT navigate to /login or enter any credentials. |
| 14 | + |
| 15 | +## Test Environment |
| 16 | + |
| 17 | +- **Frontend**: `{FRONTEND}` (default: `{FRONTEND}`) |
| 18 | +- **Backend**: `{BACKEND}` (default: `{BACKEND}`) |
| 19 | +- **Browser**: Use Playwright MCP browser tools (prefixed `mcp__browser-N__`, where N is assigned by the orchestrator) |
| 20 | +- **Start URL**: `{FRONTEND}/zoeken?_page=1` |
| 21 | + |
| 22 | +## Test Scope |
| 23 | + |
| 24 | +### Primary Focus |
| 25 | +- **Public search page** (`/zoeken`) — filters, results, cards, pagination |
| 26 | +- **Public detail pages** — application, dienst, organisatie detail pages |
| 27 | +- **Privacy verification** — ensure private data is NOT visible |
| 28 | +- **Application branding** — correct name, title, footer |
| 29 | + |
| 30 | +### What This Persona Tests |
| 31 | +This persona tests everything an **unauthenticated user** sees. The search page and detail pages are the primary interface for public visitors. |
| 32 | + |
| 33 | +## Issues to Test |
| 34 | + |
| 35 | +| Issue | Title | Test Focus | |
| 36 | +|-------|-------|------------| |
| 37 | +| #267 | Naam is softwarecatalogus i.p.v. Softwarecatalogus | Verify "Softwarecatalogus" in browser tab, header, footer, homepage | |
| 38 | +| #263 | Niet ingelogd: gebruik tab toont gemeenten | Verify "Gebruik" tab is NOT visible on application detail pages | |
| 39 | +| #278 | Filterteksten aanpassen | Check filter labels on /zoeken are correct and consistent | |
| 40 | +| #315 | Zoekpagina toont gemeentelijk applicatielandschap | Verify municipalities NOT shown as suppliers, no private data | |
| 41 | +| #345 | Dienst verschijnt niet in filters | Verify "Diensttype" filter is populated, diensten appear in results | |
| 42 | +| #347 | Dienstkaartje toont array | Verify dienst cards show readable text, not raw JSON arrays | |
| 43 | +| #394 | Contactpersonen gemeenten publiekelijk zichtbaar | Verify gemeente contact PII is NOT visible on public pages | |
| 44 | +| #443 | Dienst pagina: diensttypen aan elkaar geschreven | Verify diensttypen shown comma-separated on dienst detail page | |
| 45 | +| #444 | Vormgeving veranderd bij te lange URL's | Verify long URLs don't break page layout | |
| 46 | +| #447 | Zoeken: concept leverancier direct vindbaar | Verify concept/unapproved suppliers NOT visible in search | |
| 47 | +| #448 | Overzichtspagina's: vormgeving inconsistent | Verify dienst/koppeling detail pages match applicatie layout | |
| 48 | +| #453 | Zoeken: filters van slag met filter Type=Koppeling | Verify Type=Koppeling filter correctly scopes other facets | |
| 49 | +| #455 | Tabblad koppelingen en contactpersonen publiekelijk niet getoond | Verify Koppelingen and Contactpersonen tabs visible on public app detail pages | |
| 50 | + |
| 51 | +## Acceptance Criteria Reference |
| 52 | + |
| 53 | +**IMPORTANT**: Before testing each issue, read its detailed acceptance criteria in `issues.md` (in the repository root). Use these criteria to determine status: |
| 54 | +- **PASS** = ALL acceptance criteria are met |
| 55 | +- **PARTIAL** = Some criteria met, some not |
| 56 | +- **FAIL** = Key criteria not met or feature is broken |
| 57 | +- **CANNOT_TEST** = Feature not accessible or environment issue prevents testing |
| 58 | + |
| 59 | +## RBAC Reference |
| 60 | + |
| 61 | +As an unauthenticated visitor, you should only see data that has `"public"` read access: |
| 62 | + |
| 63 | +| Data Type | Should Be Visible? | Notes | |
| 64 | +|-----------|-------------------|-------| |
| 65 | +| Applicaties (leverancier) | YES | Only where `geregistreerdDoor: Leverancier` | |
| 66 | +| Applicaties (gemeente) | NO | Municipality application landscapes are private | |
| 67 | +| Diensten | YES | Public schema | |
| 68 | +| Organisaties | YES | Public schema | |
| 69 | +| Contactpersonen (leverancier) | YES | Visible via publication extensions | |
| 70 | +| Contactpersonen (gemeente) | NO | Private — this is the #394 bug | |
| 71 | +| Contactpersonen (samenwerking) | NO | Private | |
| 72 | +| Koppelingen | NO | Private schema | |
| 73 | +| Gebruik (usage) | NO | Private schema — this is the #263 check | |
| 74 | + |
| 75 | +## Testing Instructions |
| 76 | + |
| 77 | +### Step 1: Navigate to Search Page |
| 78 | +1. Navigate to `{FRONTEND}/zoeken?_page=1` |
| 79 | +2. Do NOT log in — remain anonymous |
| 80 | +3. Verify the page loads with search results |
| 81 | + |
| 82 | +### Step 2: Test #267 — Application Name |
| 83 | +1. Check the browser tab title |
| 84 | +2. Check the header/logo area for the application name |
| 85 | +3. Check the footer for the application name |
| 86 | +4. Navigate to the homepage (`/`) and check |
| 87 | +5. **Expected**: "Softwarecatalogus" everywhere (not "Development Catalogus" or just "softwarecatalogus") |
| 88 | + |
| 89 | +### Step 3: Test #345 — Dienst in Filters |
| 90 | +1. On `/zoeken?_page=1`, look at the available filter facets on the left |
| 91 | +2. Look for a "Type" or filter that includes "Dienst" as an option |
| 92 | +3. Look for a "Diensttype" filter — it should be populated with values |
| 93 | +4. Click on a dienst-type filter value and verify results filter correctly |
| 94 | +5. **Expected**: Diensten appear in results, diensttype filter has values |
| 95 | + |
| 96 | +### Step 4: Test #347 — Dienst Card Display |
| 97 | +1. Find a dienst in the search results (filter by type=Dienst if available) |
| 98 | +2. Look at the dienst card |
| 99 | +3. **Expected**: Service types shown as readable comma-separated text, NOT `["type1", "type2"]` |
| 100 | +4. Check that "Concept" status is clear (tooltip or alternative term) |
| 101 | + |
| 102 | +### Step 5: Test #278 — Filter Texts |
| 103 | +1. On the search page, examine all filter labels |
| 104 | +2. Verify labels are consistent with terminology used elsewhere |
| 105 | +3. Check for: |
| 106 | + - "Organisatietype" filter: should contain only valid types (Leverancier, Gemeente, Samenwerking), NOT "Applicatie", "extern", "intern" |
| 107 | + - "Aangeboden door" or "Leverancier" filter: should only contain actual suppliers |
| 108 | + - Filter labels should match wizards and management page terminology |
| 109 | + |
| 110 | +### Step 6: Test #315 — Municipal Data Exposure |
| 111 | +1. On the search page, check the "Aangeboden door" or supplier filter |
| 112 | +2. **Expected**: Only actual vendors/suppliers listed, NOT municipalities like "Bloemendaal-Heemstede" |
| 113 | +3. Check search result cards — the "aangeboden door" text should show a real vendor, not a municipality |
| 114 | +4. Check the "Organisatietype" filter — should NOT contain contaminated values |
| 115 | +5. Navigate to an application detail page — verify the supplier is correct |
| 116 | + |
| 117 | +### Step 7: Test #263 — Gebruik Tab Visibility |
| 118 | +1. Find an application in search results and click it to open the detail page |
| 119 | +2. Look at the available tabs (Beschrijving, Diensten, Standaarden, etc.) |
| 120 | +3. **Expected**: There should be NO "Gebruik" tab visible — usage data is private |
| 121 | +4. If a "Gebruik" tab exists, check whether it shows municipality names (it should NOT) |
| 122 | + |
| 123 | +### Step 8: Test #394 — Contact Person Privacy |
| 124 | +1. Navigate to an application detail page of a **leverancier** application |
| 125 | +2. Check if contact person information is visible |
| 126 | +3. **Expected for leverancier**: Contact person name, email, phone MAY be visible (this is expected) |
| 127 | +4. Check the API directly: `curl {BACKEND}/index.php/apps/openregister/api/objects/voorzieningen/module?_extend[]=contactpersonen&_limit=5` |
| 128 | +5. In the API response, check contactpersonen: |
| 129 | + - Leverancier contacts: expected to be visible |
| 130 | + - Gemeente contacts (look for `organisatie` field → type "Gemeente"): should NOT be visible |
| 131 | + - Samenwerking contacts: should NOT be visible |
| 132 | +6. Also check: `curl {BACKEND}/index.php/apps/openregister/api/objects/voorzieningen/contactpersoon?_limit=5` (without auth — should return 0 results since contactpersoon is not public) |
| 133 | + |
| 134 | +### Step 9: Additional Checks |
| 135 | +1. Check that the search page paginates correctly |
| 136 | +2. Verify sort options work (A-Z, Z-A, etc.) |
| 137 | +3. Check that clicking a search result navigates to a proper detail page (not `/publicatie/undefined`) |
| 138 | +4. Verify no "beheer" or admin links are visible in the navigation |
| 139 | + |
| 140 | +## Output Format |
| 141 | + |
| 142 | +Write results to: `softwarecatalog/test-results/bezoeker/results-public.md` |
| 143 | + |
| 144 | +Use this format: |
| 145 | +- Header with persona name, date, environment |
| 146 | +- Summary table: | Issue | Title | Previous Status | Current Status | Severity | |
| 147 | +- Per-issue sections with acceptance criteria checkboxes marked [x] or [ ] |
| 148 | +- Evidence screenshots saved to the same directory |
| 149 | + |
| 150 | +## Rules |
| 151 | + |
| 152 | +- **READ ONLY on GitHub issues** — never update, close, or comment on issues |
| 153 | +- Write test results ONLY to local files in the `test-results/` directory |
| 154 | +- Take screenshots for evidence where applicable |
| 155 | +- Do NOT log in — all testing is done as an anonymous visitor |
0 commit comments