# QA-001B
## Platform Backend, Permission, Security & Interaction Audit

ROLE

Act as a Senior Software Architect, Senior Backend Engineer, Senior Security Engineer, Senior UX Engineer, and SaaS Product Reviewer.

This is NOT feature development.

This is NOT Theme development.

This is NOT UI redesign.

This is the FINAL quality assurance audit before Sprint 1 is frozen.

Treat this as QA-001B.

The objective is to make the entire INVEETAIRE platform production-ready.

The platform currently contains:

✓ Landing Page
✓ Authentication
✓ Super Admin Portal
✓ Couple Portal
✓ Crew Portal
✓ Guest Management
✓ Wedding Event Management
✓ Guest Engagement
✓ Theme Engine

Review ALL of them.

Do NOT redesign architecture.

Do NOT rewrite business modules.

Reuse existing code whenever possible.

------------------------------------------------

SECTION 1
PERMISSION & AUTHORIZATION AUDIT

Perform a complete permission audit.

Review every route.

Verify there is NO privilege escalation.

Permission Matrix:

Super Admin

- Full access
- Workspace provisioning
- Theme assignment
- Workspace management
- Crew management
- User management

Couple

- Invitation
- Guest Management
- Guest Engagement
- Wedding Day
- Settings

Couple MUST NOT

- assign crew permissions
- change roles
- modify platform users
- access Super Admin pages

Crew

Crew Portal must remain operational only.

Crew should only access:

Dashboard

Wedding Day

Guest Lookup

QR Scanner

Settings

Crew MUST NOT access

Invitation

Guest CRUD

Workspace Users

Theme

Platform Settings

Review URL bypass.

Review hidden routes.

Review middleware.

Fix every permission leak.

------------------------------------------------

SECTION 2
WORKSPACE USER AUDIT

Current issue:

Couple can still modify Crew permissions.

This is NOT allowed.

Workspace User page must only manage Couple users.

Crew assignment and permissions belong ONLY to Super Admin.

Review

Controllers

Views

Routes

Authorization

Buttons

Actions

Hide any unauthorized controls.

------------------------------------------------

SECTION 3
AJAX REVIEW

Replace synchronous interactions where appropriate.

Review:

Guest Search

Wedding Day Search

Guest Lookup

RSVP Search

Wish Search

Implement

AJAX

Debounce (≈300ms)

Loading indicators

Empty result state

No full page reload.

------------------------------------------------

SECTION 4
WEDDING DAY EXPERIENCE

Current workflow is functional but not production ready.

Improve:

Guest Lookup

Search Guest

QR Scan

Manual Override

Reject

Scanner

Provide dedicated

"Scan QR"

button.

When pressed,

immediately request browser camera permission.

Support

Desktop webcam

Mobile rear camera

Gracefully fallback when camera unavailable.

Maintain existing QR logic.

Do NOT rewrite business flow.

------------------------------------------------

SECTION 5
ERROR HANDLING

Current issue:

Guest Lookup still throws PDOException.

Investigate root cause.

Fix query binding.

Fix parameter handling.

Fix empty search behaviour.

Do NOT suppress exceptions.

Fix the underlying issue.

Review all searches.

No raw PDOException may ever reach the browser.

Display user-friendly messages.

------------------------------------------------

SECTION 6
VALIDATION

Audit every form.

Client validation.

Server validation.

Duplicate detection.

Phone validation.

Required fields.

Import validation.

Check-in validation.

Manual Override validation.

------------------------------------------------

SECTION 7
PERFORMANCE

Review

duplicate SQL

N+1 queries

duplicate rendering

duplicate partials

unnecessary queries

Optimize without changing behaviour.

------------------------------------------------

SECTION 8
SECURITY REVIEW

Audit

CSRF

XSS

SQL Injection

Permission leaks

Session handling

Route protection

Upload validation

Authentication boundaries

Authorization boundaries

------------------------------------------------

SECTION 9
SUPER ADMIN PORTAL REVIEW

Review

Dashboard

Workspace Provision

Workspace Search

Workspace Table

Theme Assignment

Workspace Users

Pagination

Responsive

Empty States

Broken Links

Placeholder pages

Visual consistency

Dead routes

------------------------------------------------

SECTION 10
CREW PORTAL REVIEW

Review

Dashboard

Wedding Day

Guest Lookup

QR Scanner

Settings

Remove or hide anything unrelated to Crew operations.

Crew Portal must feel lightweight.

------------------------------------------------

SECTION 11
DEAD FEATURE AUDIT

Search entire project for

unused routes

unused controllers

unused methods

broken links

placeholder buttons

dead navigation

404 targets

500 targets

unused CSS hooks

unused partials

Remove or report them.

------------------------------------------------

SECTION 12
PRODUCTION READINESS

Verify

BASE_PATH compatibility

localhost/inveetaire

production deployment

asset()

url()

route()

Responsive

Desktop

Tablet

Mobile

PHP syntax

------------------------------------------------

CONSTRAINTS

Do NOT

Modify Theme Engine

Modify Authentication Architecture

Modify Database Schema unless absolutely required

Rewrite existing modules

Introduce new business features

Redesign workflow

------------------------------------------------

OUTPUT

Provide:

1. Files created

2. Files modified

3. Permission audit summary

4. Authorization matrix verification

5. AJAX improvements

6. Wedding Day improvements

7. Workspace User permission fixes

8. Error handling fixes

9. Performance improvements

10. Security improvements

11. Super Admin audit

12. Crew Portal audit

13. Dead feature audit

14. Verification results

15. Acceptance checklist

16. PHP syntax results

Perform a COMPLETE project-wide QA audit.

Stop after implementation.

Wait for Human Approval.