pisa.maahir.io — QA Audit Round 3

1.Test methodology

QA executed via CamoFox browser + curl + DOM probes. All findings are reproducible from outside the host — pisa.maahir.io resolves to 51.83.223.88 (Hetzner external) and the source code is not on this server. This is a QA-only audit; no patches were applied to production.

Test users created during this session

• Pisa QA Trainee — disposable (pisa-qa-4317188414@uberip.com via mail.tm), registered through full 3-step flow (Pisa / Lahore / YOUTH / PROFESSIONAL). Tested as USER. Mailer verified — raw headers inspected via mail.tm API. OK
• Pisa QA Staff — disposable (pisa-staff-2878414244@uberip.com), registered, then promoted to STAFF via admin.user.update audit event. Tested every admin route. PARTIAL — see B1, B4, B8

Ground-truth verification via /api/status

{"status":"ok","uptimeSec":1485,"services":{"db":true,"ai":true,"app":true},
"errors24h":0,"lastBackup":"2026-10-01T04:30:22.327Z"}

DB, AI, App all true. 0 errors in last 24h. Last backup 14h ago.

2.Critical bugs

// app/admin/audit/page.tsx — add the same permission check the API uses
const session = await auth();
if (!hasPerm(session.user, "audit.read")) {
  return redirect("/admin?denied=audit");
}
const events = await db.audit.findMany({
  where: { actorId: session.user.id }  // or a dedicated staff-scoped slice
});

// app/status/page.tsx — uptime is in seconds, not hours
const hours = Math.floor(uptimeSec / 3600);
const minutes = Math.floor((uptimeSec % 3600) / 60);
return <p>{hours}h {minutes}m</p>;
// (verify the same fix is applied to lastBackup formatting)

3.High bugs

// app/first-aid/page.tsx
- if (!session) redirect("/login?next=/first-aid");
+ return <FirstAidContent />;
// optional: show "Login to track your recovery" at the bottom

module.exports = {
  poweredByHeader: false,
  async headers() {
    return [{
      source: "/(.*)",
      headers: [
        { key: "Content-Security-Policy", value: "default-src 'self'; ..." },
        { key: "X-Content-Type-Options", value: "nosniff" },
        { key: "X-Frame-Options", value: "SAMEORIGIN" },
      ],
    }];
  },
};

4.Medium bugs

const links = [
  {href:"/admin", perm:null, label:"Overview"},
  {href:"/admin/users", perm:"users.read", label:"Users"},
  // ...
];
return <nav>{links.filter(l => !l.perm || hasPerm(session, l.perm)).map(...)}</nav>;

5.Low bugs

• B14 — 0.0% pass rate should show "--" or "Insufficient data" until n ≥ 5
• B15 — Public site cookie banner / privacy disclosure missing (legal risk, collects emails + cities)
• B16 — Hindi/Urdu translation routes 307 to / (broken) — site advertises "English + اردو"
• B17 — Hero countdown shows "00 days 00 hrs 00 min 00 sec" — campaign in progress

6.Verified working

• Mailer integrity (critical): Welcome email arrived at the actual submitted recipient (pisa-qa-4317188414@uberip.com), from pisa@maahir.io PISA Pakistan, with the submitted name in body — no recipient substitution, no transport failure.
• Registration → auto-redirect to /dashboard with valid session cookie set
• Role demotion/promotion: admin changed Pisa QA Staff from USER → STAFF via dropdown; audit log shows admin.user.update event with {"role":"STAFF"} meta
• RBAC at page level for /admin/users, /admin/moderation, /admin/analytics, /admin/approvals, /admin/events, /admin/content, /admin/paper-entry, /admin/forms, /admin/gcsap — STAFF correctly redirected to /admin?denied=X
• RBAC at API level: /api/admin/report, /api/admin/audit-export both return 403
• Track listing for 11 audience tracks + 16 courses
• Dashboard greeting (Assalam-o-Alaikum) for new users
• Verify Certificate page exists with cert-ID input + Verify button (was missing in v2)
• Status indicators on /status page (✓ App online, ✓ Postgres online, ✓ AI (MiniMax) online)
• AI drills = 0 is honest (API confirms AI online, no one has done drills yet)
• HSTS preload · X-Frame-Options SAMEORIGIN · X-Content-Type-Options nosniff · Referrer-Policy · Permissions-Policy all set correctly
• Mailjet SMTP working with correct sender domain
• Demo accounts (demo@pisa.org.pk, gcsap-demo@pisa.org.pk) shown on login page
• Audit log writes (auth.login, auth.register, admin.user.update all logged)
• WhatsApp share button on homepage with UTM params
• /api/status uptime correctly reports 1485 seconds (only UI formatter is wrong, B2)

7.Reproductions

Test 1: STAFF user can read admin audit log
1. Register new user (mail.tm disposable email)
2. Login as x2@pisa.org.pk → /admin/users
3. Change new user's role to STAFF
4. Logout
5. Login as the new STAFF user
6. Navigate to /admin/audit
7. OBSERVED: full audit table rendered (218 events)
   EXPECTED: redirect to /admin?denied=audit

Test 2: /status page uptime wrong
1. curl -s https://pisa.maahir.io/api/status → "uptimeSec":1485
2. Open https://pisa.maahir.io/status in browser
3. OBSERVED: "0h App uptime"
   EXPECTED: "0h 25m" or "≈25 min"

Test 3: Crisis pages require login
1. Open incognito browser
2. Navigate to https://pisa.maahir.io/first-aid
3. OBSERVED: redirected to https://pisa.maahir.io/login?next=%2Ffirst-aid
   EXPECTED: render first-aid content immediately, optionally with "Save my recovery" CTA

Test 4: Sidebar shows all admin links to STAFF
1. Login as STAFF user
2. Navigate to /admin
3. OBSERVED: 13 sidebar links visible
   EXPECTED: only links the STAFF role can actually use

8.Strategic suggestions (non-blocking)

What to fix before October 2026 launch

1. The 2 critical + 5 high bugs above are 1-2 days of dev work total. None require architecture changes.
2. Bot registration problem (B10) — add CAPTCHA + email verification NOW. NCCC scam-awareness platforms WILL be targeted by spammers. Zero friction = future spam incident.
3. Crisis-routing pages behind login (B3) — the most counter-productive UX on the site. A scammed citizen will leave rather than register. Move public-help content above the login gate.

Tactical: drop-in deployments, no code rewrite needed

Product — 3 things missing that the public will ask for

1. WhatsApp Business API integration — currently the share button just opens a wa.me link. Citizens should be able to directly report scams via WhatsApp to the PISA bot, not navigate to a form. Given Pakistan's #1 channel is WhatsApp, this is a glaring gap.
2. Live scam-tracker dashboard — show real-time scam reports by city/type. Right now scam reports land in /admin/moderation (6 in queue) but no public dashboard.
3. Victim follow-up workflow — after the "I've been scammed" path, citizens should get a case-ID + ability to upload documents + chat with a human. Current flow ends at NCCIA helpline 1799.

UX polish

• Hero countdown → "Campaign Day 1 of 31" live indicator
• Dashboard greeting → full name or honorific, no whitespace-split
• 0% pass rate → hide until sample size ≥ 5
• Sidebar admin links → filter by permission (B8)
• "1-day streak" → only after first activity

9.Final verdict

Ship-with-fixes. The 2 critical bugs are 1-line fixes each. The high-severity bugs are mostly about RBAC propagation from API to page, plus a few content/access decisions that need product owner input (crisis-routing pages should be public, dashboard greeting should use full name).

The platform's core flows work. The campaign has 30 days. Use the time.