# Testing Checklist — Release 02.01.00

## Automated checks

Run with the EasyApache PHP 8.5 CLI binary:

```bash
/opt/cpanel/ea-php85/root/usr/bin/php /home/CPANEL_USER/examcert/tests/run.php
```

Expected result:

```text
Tests: 7 passed, 0 failed.
```

Covered automatically:

- application key generation/validation
- `.env` parsing
- singleton service resolution
- router parameters and HEAD behavior
- HTTP 405 and Allow header
- critical security headers
- response-header injection rejection

## CLI deployment checks

```bash
/opt/cpanel/ea-php85/root/usr/bin/php /home/CPANEL_USER/examcert/bin/console app:check
/opt/cpanel/ea-php85/root/usr/bin/php /home/CPANEL_USER/examcert/bin/console db:check
/opt/cpanel/ea-php85/root/usr/bin/php /home/CPANEL_USER/examcert/bin/console route:list
```

Pass criteria:

- PHP version is at least 8.5.0.
- All required extensions are loaded.
- `.env` exists and has no group/other permissions.
- `APP_KEY` is valid.
- debug is disabled.
- URL, host allowlist and HTTPS controls are valid.
- all private directories are writable by the cPanel account.
- MySQL connection succeeds.
- the four expected routes are listed.

## Browser/HTTP checks

1. Open the staging root and confirm the Phase 02 foundation page appears.
2. Confirm an unknown path returns HTTP 404 without PHP paths or stack traces.
3. Confirm an unapproved `Host` header returns HTTP 400.
4. Confirm plain HTTP redirects to the exact `APP_URL` origin.
5. Confirm `/_health/live` returns HTTP 200.
6. Confirm `/_health/ready` returns HTTP 200 after database configuration.
7. Confirm `/_security/csrf` returns a random token and secure session cookie.
8. Confirm a POST without a CSRF token returns HTTP 419.
9. Confirm HEAD responses contain headers but no response body.
10. Confirm no directory listing is available.

## Header checklist

Inspect with:

```bash
curl -sS -I https://v2.examcert.org/
```

Required headers:

- `Content-Security-Policy`
- `Strict-Transport-Security`
- `X-Content-Type-Options: nosniff`
- `X-Frame-Options: DENY`
- `Referrer-Policy`
- `Cross-Origin-Opener-Policy`
- `Cross-Origin-Resource-Policy`
- `Permissions-Policy`
- `Cache-Control: no-store`
- `X-Request-ID`

## Filesystem checks

```bash
namei -l /home/CPANEL_USER/examcert/.env
stat -c '%a %U:%G %n' /home/CPANEL_USER/examcert/.env
stat -c '%a %U:%G %n' /home/CPANEL_USER/examcert/storage/sessions
```

Expected:

- `.env`: `600`, owned by the cPanel user
- sessions/tmp/private uploads: `700`
- private application/log/cache directories: no world-write permission
- public document root contains no `.env`, SQL, logs or application classes

## Log checks

Generate one valid request, one 404 and one CSRF failure, then inspect:

```bash
tail -n 20 /home/CPANEL_USER/examcert/logs/app-$(date -u +%F).log
```

Confirm:

- every line is valid JSON
- request IDs correspond to HTTP response headers
- no password, database password, cookie value or CSRF token appears
- 4xx records contain no stack trace