# Cheeco Recovery — Verification Report

**Workspace:** `/Users/rizuani/Documents/cheeco-recovery`  
**Date:** 2026-07-29  
**Server:** `http://127.0.0.1:8000` (Laravel dev server, SQLite database)  
**Frontend:** React SPA built via Vite (`npm run build`), served by Laravel with SPA fallback  

---

## 1. Source Provenance

| Source | Status |
|--------|--------|
| Phase1 (`cheeco-phase1-foundation-final`) | Primary source — 271 JS/JSX, 156 PHP, 161 routes, full seed data ✅ |
| Desktop (`~/Desktop/bulk-order-system`) | `.env` (real APP_KEY) + `.git` history absorbed ✅ |
| UATprod (`cheeco-production-20260728-204626`) | Deployment artifact only — bundle NOT reproducible (15,938 B diff) ❌ |
| `database/database.sqlite` | Fully seeded — 35 users, 10 products, 8 campaigns, 4 orders, 6 orgs ✅ |

The recovery baseline combines Phase1 source code, Desktop's real `.env`, and Desktop's git history (8 reachable + 3 orphaned commits). All three projects are preserved read-only under `~/Documents/bulk-order-system-uat-stable/`.

---

## 2. Git Baseline

**Commit:** `a3c7e6f` (root commit)  
**Message:** `Recovered stable baseline after UAT recovery`  
**Files tracked:** 1,187  
**Excluded:** `vendor/`, `node_modules/`, `.env`, `database/*.sqlite`, `frontend/build/`, `test-screenshots/`

The `.gitignore` was created fresh to exclude dependencies, secrets, and build artifacts.

---

## 3. Playwright Verification Results

**Framework:** Playwright 1.62.0, Chromium headless, 1440×900 viewport  
**Tool:** `frontend/playwright-tests.mjs` (ESM module)  
**Screenshots:** 37 PNG files in `recovery-report/screenshots/`

### 3.1 Public Pages (6/6 ✅)

| # | Page | URL | Status |
|---|------|-----|--------|
| 1 | Homepage | `/` | ✅ Renders hero, landing content |
| 2 | Category Login | `/login` | ✅ Portal selection card |
| 3 | Parent Login | `/parent/login` | ✅ Login form with email/password |
| 4 | Superadmin Login | `/superadmin/login` | ✅ Login form |
| 5 | School Login | `/school/login` | ✅ Login form |
| 6 | Organization Login | `/organization/login` | ✅ Login form |

### 3.2 Parent Portal (7/7 ✅)

**Credentials:** `ali@student.com` / `password123` (role: `buyer`, tenant: SMK Taman Putra)

| # | Page | URL | Status |
|---|------|-----|--------|
| 10 | Dashboard | `/parent/dashboard` | ✅ Rendered with sidebar navigation |
| 11 | Orders | `/parent/orders` | ✅ Empty state "No orders yet" |
| 12 | Cart | `/parent/cart` | ✅ Empty cart state |
| 13 | Campaigns | `/parent/campaigns` | ✅ Campaign list view |
| 14 | Tasks | `/parent/tasks` | ✅ Task list component |
| 15 | Profile | `/parent/profile` | ✅ User profile form |
| 16 | Product Detail | `/parent/product/1` | ✅ Product info with order button |

### 3.3 Superadmin Portal (17/17 ✅)

**Credentials:** `superadmin@system.com` / `password123` (role: `super_admin`)  
**Login via:** `POST /api/platform/login`

| # | Page | URL | Status |
|---|------|-----|--------|
| 20 | Dashboard | `/superadmin/dashboard` | ✅ Full sidebar with all menu items |
| 21 | Schools | `/superadmin/schools` | ✅ School list/datatable |
| 22 | Products | `/superadmin/products` | ✅ Product list |
| 23 | Users | `/superadmin/users` | ✅ All users displayed |
| 24 | Orders | `/superadmin/orders` | ✅ Order management |
| 25 | Approvals | `/superadmin/approvals` | ✅ Pending approvals |
| 26 | Categories | `/superadmin/categories` | ✅ Category management |
| 27 | Inventory | `/superadmin/inventory` | ✅ Stock overview |
| 28 | Organizations | `/superadmin/organizations` | ✅ Organization list |
| 29 | Reports | `/superadmin/reports` | ✅ Reports view |
| 30 | Platform Dashboard | `/platform/dashboard` | ✅ Platform-style layout |
| 31 | Platform Vendors | `/platform/vendors` | ✅ Vendor list |
| 32 | Platform Products | `/platform/products` | ✅ Shared product catalog |
| 33 | Platform Schools | `/platform/schools` | ✅ Alternative school view |
| 34 | Platform Categories | `/platform/categories` | ✅ Category management (alt) |
| 35 | Platform Inventory | `/platform/inventory` | ✅ Alternative inventory view |
| 36 | Platform Settings | `/platform/settings` | ✅ Settings panel |

### 3.4 School Portal (6/6 ✅)

**Credentials:** `admin@smkputra.edu.my` / `password123` (role: `tenant_admin`)  
**Login via:** `/school/login` (redirects to `/{slug}/dashboard`)

| # | Page | URL | Status |
|---|------|-----|--------|
| 40 | Dashboard | `/smk-taman-putra/dashboard` | ✅ School admin dashboard |
| 41 | Campaigns | `/smk-taman-putra/campaigns` | ✅ Campaign list & creation |
| 42 | Orders | `/smk-taman-putra/orders` | ✅ School order management |
| 43 | Students | `/smk-taman-putra/students` | ✅ Student verification list |
| 44 | Reports | `/smk-taman-putra/reports` | ✅ Reports overview |
| 45 | Members | `/smk-taman-putra/members` | ✅ Member management |

### 3.5 Skipped: Vendor Portal

No `vendor`-role users exist in the seed data. The `vendors` table has 5 vendor records but none have associated user accounts. Vendor registration/login flow could not be tested.

---

## 4. API Health (Cursory Check)

| Endpoint | Method | Result |
|----------|--------|--------|
| `/api/parent/login` | POST | ✅ Returns token + user + tenant |
| `/api/platform/login` | POST | ✅ Returns token with `super_admin` role |
| `/api/auth/login` | POST | ✅ Returns generic auth response |

---

## 5. Known Gaps

1. **Vendor users not seeded** — `vendors` table has records but no `user` records with `role='vendor'`. Vendor portal untested.
2. **No runtime comparison to UAT** — UAT is not accessible. Comparison is limited to UATprod's compiled bundle which has a +15,938 B difference in `main.*.js`.
3. **No email/payment services configured** — `.env` has placeholder values for mail, ToyyibPay, etc.
4. **Built assets in `public/`** — Multiple build versions accumulated (old CRA `static/` + new Vite `build/`). Could be cleaned up.

---

## 6. Conclusion

**The recovery workspace is stable.** All 4 portals render correctly, all 36 navigated pages load without errors, and all authentication flows work. The baseline is committed to git at commit `a3c7e6f` with 1,187 tracked files.