ABP rel-10.0 -> rel-10.1 QA Test Plan

[enisn]

ABP rel-10.0 -> rel-10.1 QA Test Plan

Scope

This plan focuses on QA-executable scenarios for rel-10.0 to rel-10.1 changes with code-path evidence from current branch analysis. Test cases are grouped by feature and mapped to affected PRs (including combined multi-PR features).

Test Cases by Feature

Identity Security

TC-ID-01: Password history enforcement after upgrade

• Affected PRs: #23894
• Area/paths: modules/identity/*PasswordHistory*, IdentityDbContextModelBuilderExtensions.cs
• Preconditions: Upgraded app from rel-10.0 to rel-10.1; migrations applied; password history enabled (>1).
• Steps: Change user password multiple times; attempt to reuse a recent password.
• Expected Result: Reuse is rejected; user data intact; migration works on non-empty user table.
• Priority: P0

TC-ID-02: Passkey sign-in and fallback

• Affected PRs: #24278
• Area/paths: modules/identity/*Passkey*, AbpSignInManager.cs
• Preconditions: Existing user account; passkey registration available.
• Steps: Register passkey; sign in with passkey; run negative cases (invalid/revoked/no passkey) and fallback to password.
• Expected Result: Passkey login succeeds when valid; invalid passkey cases fail cleanly; password fallback works.
• Priority: P0

TC-ID-03: Identity error localization and contract stability

• Affected PRs: #24595, #24695
• Area/paths: AbpIdentityErrorDescriber.cs, AbpIdentityResultException.cs
• Preconditions: API tests that assert identity validation errors.
• Steps: Trigger identity validation failures via create/update/change-password APIs.
• Expected Result: Status codes and error shape remain stable; localized messages resolve correctly.
• Priority: P1

Resource Authorization & Permission Management

TC-AUTH-01: Resource permission end-to-end consistency (Framework + Blazor + Angular)

• Affected PRs: #24184, #24374, #24516, #24531
• Area/paths: framework/src/Volo.Abp.Authorization*/, modules/permission-management/*, npm/ng-packs/packages/permission-management/*
• Preconditions: Resource-scoped permissions defined; Angular and Blazor UIs available.
• Steps: Grant/revoke by resource in Blazor and Angular; verify provider scoping; validate server-side permission checks.
• Expected Result: Correct allow/deny decisions per resource and provider; no cross-provider leakage; UI state consistent across both UIs.
• Priority: P0

API / OpenAPI / Swagger

TC-API-01: OpenAPI generation and no-content contract

• Affected PRs: #24255, #24656
• Area/paths: Volo.Abp.Swashbuckle/*, AbpNoContentApiDescriptionProvider.cs
• Preconditions: Sample solution with representative APIs.
• Steps: Generate OpenAPI; inspect no-content endpoints; run client-generation smoke.
• Expected Result: OpenAPI document is valid; no-content endpoints described correctly; client generation succeeds.
• Priority: P0

TC-API-02: Swagger UI path-base handling

• Affected PRs: #24799
• Area/paths: framework/src/Volo.Abp.Swashbuckle/wwwroot/swagger/ui/abp*.js
• Preconditions: Deployable app with configurable path base/reverse proxy.
• Steps: Open Swagger UI at /, /myapp, and proxy path-base scenario.
• Expected Result: Swagger UI loads assets and API definitions correctly in all hosting paths.
• Priority: P0

Background Jobs, Event Bus, Integrations

TC-INFRA-01: Event inbox idempotency + Hangfire periodic execution

• Affected PRs: #24550, #24669
• Area/paths: DistributedEventBusBase.cs, AbpHangfirePeriodicBackgroundWorkerAdapterOptions.cs
• Preconditions: Distributed event and Hangfire test setup.
• Steps: Produce duplicate-event conditions; execute periodic workers with default and custom options.
• Expected Result: Inbox processing remains idempotent; workers run on schedule without duplicate execution side effects.
• Priority: P1

TC-INFRA-02: Azure Service Bus auth modes

• Affected PRs: #24152
• Area/paths: ClientConfig.cs, ConnectionPool.cs in Volo.Abp.AzureServiceBus
• Preconditions: Azure Service Bus test namespace; both connection string and Azure.Identity credential options.
• Steps: Connect and publish/consume with each auth mode.
• Expected Result: Both auth modes connect and process messages successfully.
• Priority: P1

TC-INFRA-03: MinIO blob provider stability

• Affected PRs: #23968
• Area/paths: MinioBlobProvider.cs
• Preconditions: MinIO endpoint with test bucket.
• Steps: Run upload/download/delete with large and concurrent blobs.
• Expected Result: Blob CRUD succeeds reliably under concurrency.
• Priority: P1

Feature Flags, Domain Events, Tooling

TC-CORE-01: Configuration feature provider precedence

• Affected PRs: #24034
• Area/paths: ConfigurationFeatureValueProvider.cs
• Preconditions: Feature values set in config and DB.
• Steps: Evaluate feature checks with overlapping config/DB definitions.
• Expected Result: Runtime value resolution follows expected precedence/fallback.
• Priority: P1

TC-CORE-02: Aggregate event collection compatibility

• Affected PRs: #24533
• Area/paths: BasicAggregateRoot.cs
• Preconditions: Aggregate operations emitting local/distributed events.
• Steps: Execute create/update flows that raise domain events.
• Expected Result: Events are collected and published as expected.
• Priority: P1

TC-TOOL-01: CLI/template generation pipeline

• Affected PRs: #24572, #24677, #24439
• Area/paths: Volo.Abp.Cli.Core/*ProjectBuilding*, templates/*/Migrations/*
• Preconditions: ABP CLI installed; template combinations selected.
• Steps: Run abp new for common templates; build; apply generated migrations.
• Expected Result: Project generation succeeds without solution-step failures; migrations compile/apply.
• Priority: P2

TC-TOOL-02: Angular permission package and theme token updates

• Affected PRs: #24530, #24875
• Area/paths: npm/ng-packs/*permission-management*, npm/ng-packs/*theme*
• Preconditions: Angular sample app using updated packages.
• Steps: Run test pipeline; validate permission modal behavior; switch themes via tokens.
• Expected Result: Tests pass with expected behavior parity; theme token changes apply correctly.
• Priority: P2

Smoke Checklist (Short)

• P0 identity flows: password history + passkey login/fallback.
• P0 resource permission flow validated in both Angular and Blazor.
• P0 OpenAPI generation + Swagger UI path-base scenario.
• P1 event inbox idempotency + Hangfire periodic worker execution.