# Testing Checklist – JobPortal

## Authentication
- [ ] Register as candidate and as company
- [ ] Login / logout
- [ ] Invalid credentials rejected
- [ ] Login lockout after repeated failures
- [ ] Forgot password token flow
- [ ] Email verification token flow
- [ ] Remember-me cookie

## Authorization
- [ ] Candidate cannot access company/admin routes
- [ ] Company cannot access candidate-only routes
- [ ] Admin can access admin modules
- [ ] Guests redirected from protected pages

## Candidate
- [ ] Profile update and photo upload
- [ ] Skills / education / experience / certifications / languages CRUD
- [ ] CV upload (PDF/DOC/DOCX) and download
- [ ] Visibility public / recruiters / private
- [ ] Apply to approved job
- [ ] Cannot apply twice
- [ ] Cannot apply after deadline
- [ ] Withdraw application
- [ ] Recommended jobs appear on dashboard

## Company
- [ ] Profile + logo + verification submit
- [ ] Create job as draft and submit for approval
- [ ] Cannot publish without admin approval
- [ ] Edit rejected job and resubmit
- [ ] View applications, change status, download CV
- [ ] Message candidate from application
- [ ] Promote approved job (RWF packages)
- [ ] Premium activates only after payment confirmation
- [ ] Find candidates + match scores + save

## Admin
- [ ] Approve / reject job (rejection reason visible to company)
- [ ] Feature job
- [ ] Block / unblock user
- [ ] Verify / reject company
- [ ] Review reports
- [ ] Manage RWF premium package prices
- [ ] Audit log records actions
- [ ] Dashboard stats load

## Public
- [ ] Job search filters and pagination
- [ ] Job detail SEO slug + JobPosting JSON-LD
- [ ] Candidate directory respects visibility
- [ ] Sitemap.xml generates
- [ ] robots.txt present

## Security probes
- [ ] SQL injection attempts on search/login fail safely
- [ ] XSS payloads escaped in profiles and messages
- [ ] CSRF missing token rejected
- [ ] Direct access to another user's application/CV denied
- [ ] Expired premium jobs drop from premium ranking (cron)

## Payments (RWF)
- [ ] Checkout creates pending payment
- [ ] Confirm with reference activates premium
- [ ] Amounts displayed in RWF
- [ ] Payment history listed for company