# ERPFlow — nwidart Migration Regression Checklist

Related: [IMPLEMENTATION_PHASES_NWIDART.md](../IMPLEMENTATION_PHASES_NWIDART.md)

## Test Users

| User | Email | Password | Role | Purpose |
|------|-------|----------|------|---------|
| Developer / Admin | `admin@erpflow.local` | `password` | Administrator | Full access |
| Employee | `employee@erpflow.local` | `password` | Configuration Staff | Limited `configuration.view` + `configuration.employee` |

Company header: `X-Company-Id` from login response `companies[0].uuid`

## Verify Matrix

| Area | Test | Expected |
|------|------|----------|
| Auth | `POST /auth/login` | 200 + token |
| Permission | Employee user → `GET /configuration/employee-configs` with create | 403 without `configuration.create` |
| Permission | Admin → same endpoints | 200 |
| Permission | Role assign `configuration.create` → retry | 200 / 201 |
| Onboarding | Incomplete user → business API | 403 |
| Approval OFF | `POST /configuration/employee-configs` | 201 immediate |
| Approval ON | Enable in Admin → same POST | 202 pending |
| Activity | Login | `auth.login` in activity log |
| Activity | Create employee config | `employee_config.created` |

## Configuration Flow

```
Login (JWT + X-Company-Id)
  → GET /me/permissions
  → GET /configuration/health          [configuration.view]
  → GET /configuration/employee      [configuration.employee]
  → GET /configuration/employee-configs
  → POST /configuration/employee-configs   [configuration.create]
  → PUT /configuration/employee-configs/{id}  [configuration.update]
  → DELETE /configuration/employee-configs/{id} [configuration.delete]
```

## Postman

Import: [docs/postman/ERPFlow.postman_collection.json](./postman/ERPFlow.postman_collection.json)

Variables: `base_url`, `token`, `company_uuid`

## Commands

```bash
docker compose exec backend php artisan migrate --force
docker compose exec backend php artisan module:migrate Configuration --force
docker compose exec backend php artisan db:seed --force
```