# 01 – Login & Authentication

Pages: `/` (login), `/forgot-password/form`, logout · Roles tried: superadmin, company admin

## Works fine

- Login page opens correctly. After typing the email, the portal choice (Admin/User, Customer, Carrier) appears and is pre-selected when only one exists.
- Superadmin login → Superadmin dashboard. Company admin login → Dashboard. **No OTP screen** (new-login OTP is off on live).
- Wrong password → clear message "Your credentials do not match our records." (shown twice: pop-up + banner).
- Unknown email → "Invalid Email" and the Login button stays disabled. Empty form → button disabled.
- Logout works; opening `/dashboard` afterwards sends you back to login.

## Issues

| # | Sev | What the user experiences | Steps | Evidence |
|---|-----|---------------------------|-------|----------|
| L1 | **High** | **Forgot password: "Send OTP" hangs for about 1 minute** on "Sending…" with no progress. Users will think it is broken and click again. | Forgot Password → enter registered email → Send OTP → wait (≈63 s before the OTP boxes appear) | `screens/forgot_otp_step.png` |
| L2 | Medium | **Verify OTP does nothing if the "I'm not a robot" box is not ticked** – no message, no hint. Browser console: `ReferenceError: e is not defined`. | Forgot Password → get to OTP step → type 6 digits → Verify OTP | `screens/forgot_wrong_otp.png` |
| L3 | Low | Missing script file (404) `assets/bsmultiselect/bootstrap-multiselect.min.js` on the admin dashboard, plus console error `Cannot read properties of null (reading 'classList')`. Multi-select dropdowns may not style/work. | Login as company admin → open Dashboard | `screens/login_admin_landing.png` |
| L4 | Low (security) | Anyone can find out whether an email is registered ("Invalid Email" appears only for unknown emails). | Type any email on the login page | `screens/login_lockout.png` |

## Not tested (and why)

- Customer and Carrier **portal login** – no such account exists yet (registration is blocked by captcha for me; they can be created in the CRM / Carrier modules).
- **Finishing a password reset** – the OTP arrives only by email.
- **Lock-out after 3 wrong passwords** and the captcha that follows – not tried on real accounts to avoid locking them. (Unknown emails never reach the server because the button is disabled.)
- "Remember me", trusted-device / new-device OTP.