# NexStock MVP V1.0 Original Comprehensive System Test Report

> **Document Version**: 1.0.0 (Original MVP Baseline)  
> **Date**: August 31, 2026  
> **Author**: Nexgen Technology Services / NexStock Engineering  
> **Scope**: Baseline evaluation of all 16 tenant and super-admin modules, architecture compliance, multi-tenancy validation, and bug audit.

---

## Executive Summary

NexStock MVP V1.0 was evaluated across 16 core functional modules. 13 modules passed initial functional tests, while 3 modules exhibited critical multi-tenancy or performance defects.

- **Total Modules Evaluated**: 16
- **Fully Working (Pass)**: 13 / 16 (81.25%)
- **Working with Defects / Issues**: 3 / 16 (18.75%)
- **Critical Multi-Tenancy Leaks**: 2 identified in Purchase & Inventory pipeline
- **Performance Hotspots**: 26 unnecessary `firstOrCreate` queries executing on every catalog/expense page hit

---

## Part 1: Detailed Module-by-Module Test Audit

### 🟢 = Pass | 🟡 = Working with Issues | 🔴 = Defect / Blocker

---

### 1. Landing Page (`/`) — 🟢 PASS
- **URL**: `http://localhost:8040/`
- **Result**: PASS
- **Features Tested**:
  - Hero section, feature navigation tabs (*Core Modules*, *Interactive Simulator*, *Reports & Insights*, *SaaS Pricing*, *About Nexgen*).
  - SaaS Pricing Switcher: Starter (TZS 35,000/mo), Growth (TZS 75,000/mo), Enterprise (TZS 150,000/mo).
  - "Start Free Trial" CTA routes directly to `/register`.
  - "Contact Nexgen Sales" triggers interactive modal for custom demos.
  - "Get in Touch" form under About tab submits directly to `POST /inquiries` with instant feedback.
  - Super Admin portal link in footer navigates to `/admin/login`.

---

### 2. Tenant Registration (`/register`) — 🟢 PASS
- **URL**: `http://localhost:8040/register`
- **Result**: PASS
- **Features Tested**:
  - Registration fields: Store Name, Manager Name, Email, Password, Confirm Password.
  - Creates `businesses` record with `trial_ends_at = Carbon::now()->addDays(14)`.
  - Automatically seeds primary HQ Branch (`branches`).
  - Creates manager account with `role = manager` and all permission flags enabled.
  - Logs user in and redirects smoothly to `/dashboard`.

---

### 3. Manager & Cashier Dashboard (`/dashboard`) — 🟢 PASS
- **URL**: `http://localhost:8040/dashboard`
- **Result**: PASS
- **Features Tested**:
  - 14-Day Free Trial Banner with real-time countdown badge.
  - Manager KPI cards: Today's Gross Sales, Total Completed Transactions, Sales Growth % (vs Yesterday), Active Low Stock Alert counter.
  - Interactive Period Selector: 7 Days, 30 Days, This Month.
  - ECharts 7-Day Revenue, COGS, Expense & Net Profit Multi-Line Chart.
  - Expense Category Distribution Donut/Pie Chart.
  - Top 5 Best-Selling Products table with revenue contribution %.
  - Hourly Customer Footfall & Sales Distribution Histogram (8:00 AM – 9:00 PM).
  - Cashier restricted view verified: Cashier role only sees their individual shift transactions and sales.

---

### 4. Product Catalog (`/products`) — 🟡 WORKING WITH ISSUES
- **URL**: `http://localhost:8040/products`
- **Result**: WORKING WITH PERFORMANCE DEFECT
- **Features Tested**:
  - Paginated product catalog (15 items per page) with search by product name and variant SKU.
  - Category filter dropdown including "General / Uncategorized" items.
  - Single product creation modal with compulsory Buying/Cost Price (`*`) and Selling Price for accurate P&L.
  - Opening stock balance recording during initial product registration.
  - Clean quantity display formatted without trailing zeros (e.g. `18 pcs` instead of `18.0000`).
  - Product active/inactive toggle switch.
  - Custom category creation (`POST /categories`) and unit creation (`POST /units`).
  - Bulk CSV import for mass product setup.
- **Defects Identified**:
  - *Performance Hotspot*: Lines 22–60 in `ProductController.php` execute 18 `firstOrCreate` queries on **every single page request** to ensure default categories and units exist.

---

### 5. Point of Sale Terminal (`/pos`) — 🟢 PASS
- **URL**: `http://localhost:8040/pos`
- **Result**: PASS
- **Features Tested**:
  - Fast touch/click product grid with stock level badges and price indicators.
  - Real-time search and category filtering.
  - Interactive cart drawer with quantity steppers and line-item totals.
  - **Out-of-Stock Enforcements**:
    - Frontend disables "Add to Cart" button for 0-stock products.
    - Backend `POSController.php` executes a strict pre-checkout stock verification in an atomic database transaction.
  - Multi-payment support: Cash, Card, and Mobile Money (M-Pesa / TigoPesa / Airtel Money).
  - Atomic sale completion generating unique `SL-XXXXXXXX` receipt code and decrements inventory balances.

---

### 6. Sales Ledger & Audit (`/sales`) — 🟢 PASS
- **URL**: `http://localhost:8040/sales`
- **Result**: PASS
- **Features Tested**:
  - Chronological transaction ledger with sale number, cashier name, payment method badge, line item summary, and total amount.
  - Filters: Today, This Week, This Month, All Time, and Custom Date Range.
  - Summary KPI cards: Filtered Revenue, Total Completed Transactions, Average Order Value (AOV).
- **Defects Identified**:
  - *Code Smell*: Duplicate query condition execution on custom date ranges in `SaleController.php` (lines 33–37 and 43–45).

---

### 7. Supplier Purchases (`/purchases`) — 🟡 WORKING WITH CRITICAL DEFECTS
- **URL**: `http://localhost:8040/purchases`
- **Result**: CRITICAL DEFECTS IN TENANT ISOLATION
- **Features Tested**:
  - Purchase order history ledger with PO numbers (`PO-XXXXXXXX`), supplier name, status badge, and total spend.
  - Search and filter by supplier, PO number, and date range.
  - New purchase modal: Supplier selection, multi-item line inputs (product variant, quantity, unit buying cost, optional updated selling price).
  - Auto-increments inventory balance and logs `type = 'purchase'` inventory movement.
- **Critical Defects Identified**:
  1. *Cross-Tenant Branch Leak*: In `PurchaseController.php` (line 81), `Branch::where('is_primary', true)->first()` does not scope by `tenant_id`. It fetches whichever tenant's primary branch was created first in the global database.
  2. *Inventory Balance Cross-Tenant Conflict*: Line 131 `InventoryBalance::firstOrCreate(['branch_id' => ..., 'product_variant_id' => ...])` omits `tenant_id`, potentially updating another tenant's stock balance record if IDs ever conflict.
  3. *Missing Inventory Movement Tenant Context*: Line 119 `InventoryMovement::create()` omits explicit `tenant_id`.
  4. *Missing Weighted Average Costing*: Purchasing items at a new cost does not recalculate the product variant's `cost_price`.

---

### 8. Stock Control & Balances (`/inventory`) — 🟢 PASS
- **URL**: `http://localhost:8040/inventory`
- **Result**: PASS
- **Features Tested**:
  - Real-time stock balance ledger: Product Name, SKU, Category, Unit, Branch, Current Physical Stock, Low Stock Reorder Threshold, and Stock Health status badge.
  - Search by product name and SKU.
  - Stock Adjustment modal for quick manual opening balances or restocks.
  - Removed confusing financial valuation cards from physical stock room view and retained strictly physical operational metrics.

---

### 9. Operating Expenses (`/expenses`) — 🟢 PASS
- **URL**: `http://localhost:8040/expenses`
- **Result**: PASS
- **Features Tested**:
  - Operating expense register with expense date, category, amount, reference voucher number, and user attribution.
  - Record new expense modal with category dropdown and receipt reference.
  - Custom expense category creation modal (`POST /expenses/category`).
- **Defects Identified**:
  - *Performance Hotspot*: 8 `firstOrCreate` queries executed on every page hit in `ExpenseController.php`.
  - *Missing Feature*: No edit or delete capability for recorded expense entries.

---

### 10. Non-POS Other Income (`/income`) — 🟢 PASS
- **URL**: `http://localhost:8040/income`
- **Result**: PASS
- **Features Tested**:
  - Other business revenues ledger (e.g. Delivery fees, commissions, scrap sales).
  - Income category dropdown, amount, payment reference, and notes.
- **Defects Identified**:
  - *Missing Feature*: No edit or delete capability for recorded income entries.

---

### 11. Business Reports & Financial Intelligence (`/reports`) — 🟢 PASS
- **URL**: `http://localhost:8040/reports`
- **Result**: PASS
- **Features Tested**:
  - **1. Sales Performance Report**: Total revenue, transaction count, average basket size, payment method distribution.
  - **2. Profit & Loss (P&L) Statement**: Net Revenue - Cost of Goods Sold (COGS from inventory movements) = Gross Profit; Gross Profit - Operating Expenses = Net Profit & Net Margin %.
  - **3. Cashflow Statement**: Total Cash Inflows (POS Sales + Other Incomes) vs Total Cash Outflows (Supplier Purchases + Operating Expenses) = Net Cashflow.
  - **4. Product Sales Performance**: Units sold, average realization price, gross revenue, product contribution percentage.
  - **5. Inventory Valuation & Stock Health**: Physical units on hand, unit cost valuation, retail value, potential gross margin %, low stock alerts.
  - **6. Supplier Spend Analysis**: PO transaction count, aggregate spend per supplier, supplier wallet share %.
  - Date Presets: Today, Yesterday, Last 7 Days, This Month, Last Month, This Year, Custom Date Range.

---

### 12. Staff Management & Role Permissions (`/staff`) — 🟢 PASS
- **URL**: `http://localhost:8040/staff`
- **Result**: PASS
- **Features Tested**:
  - Staff directory listing employees, email, role, and granular permission badges.
  - Add new staff member with dedicated password and 4 permission toggles:
    1. `can_sell` (POS access)
    2. `can_manage_stock` (Products, Purchases, Inventory access)
    3. `can_manage_expenses` (Expenses & Income access)
    4. `can_view_reports` (Financial P&L & Reports access)
  - Edit staff credentials and toggle permissions in real-time.
  - Manager role bypass verified: Store manager account has full access across all routes.
- **Defects Identified**:
  - Staff deletion uses `$staff->delete()` without soft-deletion or checking for historical sales attribution.

---

### 13. Profile & Account Settings (`/profile`) — 🟢 PASS
- **URL**: `http://localhost:8040/profile`
- **Result**: PASS
- **Features Tested**:
  - User profile name and email update with validation.
  - Password update with current password verification.
  - Delete account option.
- **Defects Identified**:
  - *Missing Feature*: Missing Business Settings interface (business name, primary currency code, tax rate %, timezone, receipt header note, logo).

---

### 14. Super Admin — SaaS Subscriptions (`/admin/subscriptions`) — 🟢 PASS
- **URL**: `http://localhost:8040/admin/subscriptions`
- **Result**: PASS
- **Features Tested**:
  - Platform KPI Metrics: Total Registered Stores, Active 14-Day Free Trials, Active Paid Subscriptions, Estimated Monthly Recurring Revenue (MRR in TZS).
  - Store Subscriptions Ledger: Store name, manager email/phone, active plan, branches/staff count, live days-left countdown.
  - **1-Click Subscription Management Actions**:
    - Extend Trial: +7, +14, or +30 Days.
    - Assign / Upgrade Plan: Starter, Growth, Enterprise for 1, 3, 6, or 12 months.
    - Cancel / Expire Subscription.
  - Pricing Tiers Configurator: View and modify monthly and annual billing rates.

---

### 15. Super Admin — Billing Orders (`/admin/orders`) — 🟢 PASS
- **URL**: `http://localhost:8040/admin/orders`
- **Result**: PASS
- **Features Tested**:
  - Subscription payment order verification ledger.
  - Captures payment reference (M-Pesa / TigoPesa trans ID or Bank slip #).
  - **1-Click "Approve & Activate"**: Automatically calculates renewal date and activates tenant plan.
  - 1-Click "Reject" with notes.
  - "+ Log Subscription Order" modal for admin manual recording of offline wire transfers.

---

### 16. Super Admin — Inquiries & Leads Inbox (`/admin/inquiries`) — 🟢 PASS
- **URL**: `http://localhost:8040/admin/inquiries`
- **Result**: PASS
- **Features Tested**:
  - Real-time lead capture inbox connected to landing page forms.
  - Filter by inquiry type (*Contact Message*, *Trial Request*, *Enterprise Demo*) and status (*Unread*, *In Progress*, *Contacted*, *Closed*).
  - Modal to view complete inquiry, direct phone/email shortcuts, status updating, and internal admin notes.

---

## Part 2: Audit Bug Matrix

| ID | Module | Severity | Location | Defect Description |
|---|---|---|---|---|
| **BUG-01** | Purchases | 🔴 Critical | `PurchaseController.php:81` | `Branch::where('is_primary', true)->first()` omits `tenant_id`, creating cross-tenant data leak. |
| **BUG-02** | Purchases | 🔴 Critical | `PurchaseController.php:131` | `InventoryBalance::firstOrCreate()` omits `tenant_id` in lookup attributes. |
| **BUG-03** | Purchases | 🟡 Medium | `PurchaseController.php:119` | `InventoryMovement::create()` does not explicitly pass `tenant_id`. |
| **BUG-04** | Products | 🟡 Medium | `ProductController.php:22-60` | 18 `firstOrCreate` DB queries execute on every single index load. |
| **BUG-05** | Expenses | 🟡 Medium | `ExpenseController.php:22-42` | 8 `firstOrCreate` DB queries execute on every single index load. |
| **BUG-06** | Sales | 🟡 Low | `SaleController.php:29-45` | Duplicate custom date range filtering inside `match` closure and `if` block. |
| **BUG-07** | Staff | 🟡 Medium | `StaffController.php:89` | Staff hard delete risks orphaning historical transaction attribution. |
| **BUG-08** | Models | 🟢 Low | `SaleItem.php`, `PurchaseItem.php` | Missing `tenant_id` in `$fillable` and missing `BelongsToTenant` trait. |
| **BUG-09** | Purchases | 🟡 Medium | `PurchaseController.php` | Lacks Weighted Average Costing (WAC) recalculation upon new stock intake. |
| **BUG-10** | Inventory | 🟡 Medium | `InventoryController.php` | Only supports positive additions; lacks negative adjustments for shrinkage/damage/loss. |

---

## Part 3: Baseline Sign-Off

This document stands as the official record of the **MVP V1.0** system state prior to the V1.1 hardening and enhancements release.