# User Management Test Plan

Manual checklist after changes to entity user management.

## Prerequisites

- Log in as Super Admin, Entity Admin, and (if possible) a non-admin user.
- Have at least one instance with two entities and existing evaluator assignments.
- Optional: run `docs/sql/admin_audit_log.sql` and verify `admin_audit_log` rows after actions.

## Access control

- [ ] Non-admin authenticated user cannot open `p=users` (warning shown).
- [ ] Entity admin sees only assigned entities in multi-entity view.
- [ ] Entity admin cannot select Super/System admin type when adding a user.
- [ ] Direct POST to `manage_instance_admin.php` with `adminTypeID=1` as entity admin is rejected.

## Add user

- [ ] Add new user with new email → `people` + `sbsl_administrators` created; flash success.
- [ ] On **localhost**, no registration email sent; on production, email received with valid link.
- [ ] Add same user again with same entity + type → error, no duplicate row.
- [ ] Add existing person via “Select from database” → assignment created with correct `entityID`.
- [ ] “Create Regular User Profile” checkbox creates `user_details` row when checked.

## Edit user

- [ ] Change admin type → saved; redirect back to users page with flash message.
- [ ] Toggle Main Evaluator Y/N → reflected in table.
- [ ] Suspend user → `Suspended=Y` in DB; table shows “Yes”.
- [ ] Entity admin cannot edit Super/System admin rows (no edit controls).

## Reset password

- [ ] Reset button opens modal with correct user id/email (single- and multi-entity views).
- [ ] Submit reset → redirect to users page with success flash (not raw script output).
- [ ] On **localhost**, success message notes email skipped; user flags updated in DB.
- [ ] On production, target user receives reset email with working link.

## CSRF

- [ ] Replay POST without `csrf_token` → rejected with invalid form message.

## Regression

- [ ] Link to **Create Entity** uses `atID=` query param correctly.
- [ ] Admin type link still opens `manager_eval` for that user/entity.