PHASE 16 — FUNCTIONAL AND SECURITY TEST MATRIX
================================================
Project: WEB-BASED REPORTING MANAGEMENT SYSTEM FOR HAZARDOUS TREES NEAR RESIDENTIAL AREA IN BARANGGAY TUPSAN PEQUEÑO
Environment: Local XAMPP HTTPS (native PHP + MariaDB)
Date recorded: 2026-07-22

ID       TEST AREA                                  EXPECTED RESULT                                      ACTUAL RESULT                                         RESULT  EVIDENCE
F16-01   Registration, login, logout, recovery      Valid account lifecycle works; invalid/reused       Registration validation, login, logout, throttled      PASS    Phase 7 unit/HTTPS suites
                                                    recovery requests are controlled.                    recovery, and one-time reset behavior passed.
F16-02   Resident permissions                        Resident can use resident routes but cannot access   Resident attempts against staff/admin routes returned  PASS    run_phase16_http.ps1
                                                    staff/admin pages or data.                           protected redirects.
F16-03   Staff permissions                           Staff can process operational work but cannot manage  Staff analytics returned 200; admin user management   PASS    run_phase16_http.ps1
                                                    administrator users/settings.                        was denied.
F16-04   Administrator permissions                   Administrator can open system dashboard and users.    Temporary administrator opened Admin Dashboard and     PASS    run_phase16_http.ps1
                                                                                                          User Management successfully.
F16-05   Suspended-account behavior                  Suspended account cannot continue an authenticated   Existing suspended-session and auth-version checks    PASS    Phase 7 unit/HTTPS suites
                                                    session.                                             passed.
F16-06   GPS and barangay boundary                  Invalid/outside coordinates are rejected; valid       Outside and invalid coordinates were rejected, while   PASS    Phase 8 unit/HTTPS suites
                                                    in-boundary points are accepted.                     valid in-boundary submissions proceeded.
F16-07   Required photograph and invalid uploads     Missing evidence and invalid upload content are      Missing-photo submission was rejected and invalid      PASS    Phase 8 HTTPS suite
                                                    rejected without partial report data.                 evidence rollback was verified.
F16-08   Ownership and personal-data protection      Residents see only their reports; map/report views   Ownership filtering, anonymized resident map fields,   PASS    Phase 8 + Phase 13 suites
                                                    do not expose another resident's personal data.       and protected report access passed.
F16-09   Face-to-face registration/submission        Staff-assisted registration and report submission   Existing/new resident FTF branches, GPS, consent,    PASS    Phase 10 HTTPS suite
                                                    require consent, GPS, and evidence.                  evidence, attribution, and receipt passed.
F16-10   Assignment and assessment                   Only authorized staff/admin can assign and assess;   Assignment restrictions, provisional assessment,      PASS    Phase 9 + Phase 11 HTTPS suites
                                                    required decisions and audit/history are persisted.   official severity and audit/history checks passed.
F16-11   Scheduling, rejection, and resolution       Workflow transitions enforce prerequisites and       Schedule lifecycle, reviewed rejection, completion,   PASS    Phase 11 + Phase 12 HTTPS suites
                                                    terminal states.                                     after-action evidence, and resolution passed.
F16-12   Notifications                               Notifications are recipient-scoped and read-state    Resident/staff notifications, assignment alert, and   PASS    Phase 14 HTTPS suite
                                                    updates cannot affect another user.                  mark-all-read behavior passed.
F16-13   Maps, searches, filters, and exports        Map privacy/layers work; analytics filters and CSV   Map layers/privacy, date/search scope, CSV export,     PASS    Phase 13 + Phase 15 HTTPS suites
                                                    export return only authorized data.                  monthly summary, and print views passed.
F16-14   Mobile layout and slow-network behavior     Mobile evidence controls remain available and a      Rear-camera capture, progress UI, and throttled       PASS    Phase 8 + run_phase16_http.ps1
                                                    slow response does not remove the submission UI.     10 KB/s form response retained required controls.
F16-15   Database backup and restoration             A non-empty local dump can be retained/restored      Isolated migration restore was previously verified;    PASS    Phase 8 notes + Phase 16 CLI check
                                                    without changing the approved manuscript.             current database dump exists and is non-empty.
F16-16   Complete test record                         Every Phase 16 requirement has expected, actual,    This matrix records all checklist areas and links      PASS    This file + all suites
                                                    and pass/fail evidence.                              each result to a repeatable test suite.

Summary: 16/16 test areas passed. No manuscript or approved project title was
changed. Temporary Phase 16 fixtures are removed by the HTTPS test cleanup.
