UI workflow
Scenario
Two-Role Approval Workflow
An employee submits a request, a manager (a separate login, separate session) approves or rejects it with a comment, and the employee sees the outcome. Data is shared across sessions, not cookie-isolated like everywhere else on this site.
How this works
- · The one UI scenario with truly shared, cross-session state — not cookie-isolated. standard_user (employee) and manager_user (manager) are two separate logins in two separate browser sessions (e.g. a normal tab plus an incognito tab) that both see the same underlying request list.
- · State lives in a single in-memory array on the server, seeded with one pending request — it only resets on server restart or the approvals-reset endpoint.
- · A manager's approve/reject with a comment is immediately visible on the employee's dashboard on next load — no polling or websockets involved, just a genuinely shared source of truth.
What you'll practice
- Two personas, two separate logins — practice testing an authorization boundary, not just "logged in or not"
- Data submitted by one session visible to a completely different session (this one is NOT cookie-isolated — see the Test Data page)
- A server-side authorization check: an employee session POSTing directly to the approve/reject endpoint is rejected, even though the button is simply hidden for them in the UI
- A full request lifecycle: submit → pending → approved/rejected with a comment
Test accounts
standard_user
Password123!
role: employee — submits requests
manager_user
Password123!
role: manager — approves/rejects
Try two browser profiles (or one normal + one private/incognito window) logged in as each persona at the same time to see both sides of the workflow live.
- 1 Login →
- 2 Dashboard