Administrator Guide

Purpose

Document the administrator audit boundary without falsely claiming browser operation.

Eligible Users and Roles

Authorized administrator, operations, finance, or reviewer roles as defined by the server. This guide does not grant access.

Prerequisites

The isolated loopback Admin fixture on port 3007, synthetic data, an approved privileged role, and no production/provider mutation.

How to Open This Feature

Use the repository's port-3007 fixture runbook. Do not substitute the public port-3006 storefront or directly call privileged APIs to simulate UI coverage.

Step-by-Step Instructions

Step 1: Start the Isolated Fixture

Start only the documented loopback services and synthetic dataset. This was Blocked in the current audit.

Step 2: Authenticate with the Intended Role

Verify both allowed and denied deep links for that role without sharing credentials.

Step 3: Exercise One Privileged Workflow

Use the visible Admin UI for the approved synthetic action and confirm the corresponding non-GET response.

Step 4: Verify Persistence and Audit History

Reload the record and inspect state/history. Sample-order transition serialization is backend-verified; the Admin UI flow itself remains Not Tested here.

Step 5: Clean Up Owned Fixture Data

Use the fixture's bounded cleanup. Never delete shared or production data.

Possible States

Authorized

Expected only for the role/capability granted by the server.

Forbidden

The server must deny missing capabilities even if a UI control is hidden.

Review, Approval, Rejection, Refund, or Operational States

These depend on the selected fixture/workflow. No exhaustive state behavior is claimed in this audit.

Service Unavailable

Use documented recovery; do not bypass storage, payment, identity, or event checks.

Input Rules and Limits

All privileged payloads require server authorization and validation. Exact per-operation constraints across the 276-operation API inventory are Not Tested.

Common Problems and Recovery

• If port 3007 is unavailable, stop and record Blocked; do not use production.
• If a mutation result is ambiguous, reload the authoritative record before retrying.
• Preserve outbox/audit evidence and use bounded idempotent recovery.

Important Warnings

Privileged actions can affect money, access, publication, and personal data. Human approval is required for production operations and merge/release decisions.

What Happens Next

Retain redacted browser/network artifacts, verify fixture invariants, and append exact results to the test matrix and audit report.