Profitina Laundry acceptance checks against http://127.0.0.1:6130
expected values: App/docs/api.md
brand logo: /home/claude/kit/assets/DAA/media/profitina-logo-horizontal.png

PASS A-01 GET /api/services = api.md example (12 services), /api/services/s0002, S0099 404
PASS A-02 GET /api/status B2938 + 089600001482 = api.md example; no name/address/e-mail
PASS A-03 Status check: wrong phone and unknown bill give the same 404 message
PASS B-01 No session: /api/bills 401 not_logged_in (JSON); web page / redirects to /login
PASS B-02 Wrong password and unknown e-mail: the same 401 login_failed message
PASS B-03 POST /api/login kasir1 = api.md employee + csrf_token; cookie HttpOnly, SameSite=Lax
PASS B-04 GET /api/me as owner = api.md example (+ csrf_token); logout 204, then 401
PASS B-05 Login lock-out: after 5 failures for one e-mail the 6th attempt gets 429
PASS C-01 GET /api/bills?outlet=O03&status=queued&per_page=2 = api.md example
PASS C-02 GET /api/bills/B2938 and /api/bills/b0014 = api.md examples; B9999 404
PASS C-03 Bill filters: open 57, overdue 6, customer C0094 62, 30 Sep 2026 10 bills
PASS C-04 Paging: per_page=1000 is capped at 100; per_page=abc gives 400 bad_request
PASS D-01 GET /api/customers?q=wijaya&per_page=3 = api.md example
PASS D-02 GET /api/customers/C0094 = api.md example (10 recent bills, first 2 as documented)
PASS D-03 Roles: washer GET /api/customers 403; cashier GET /api/reports/monthly 403
PASS E-01 GET /api/reports/dashboard?date=2026-09-30 (owner) = api.md example
PASS E-02 Dashboard for a washer: own outlet only, no money fields; cashier: own outlet
PASS E-03 Reports monthly/outlets/services/employees/receivables = api.md examples
PASS E-04 CSV export: text/csv UTF-8, attachment report-monthly-2025-10_2026-09.csv, plain numbers
PASS E-05 GET /api/outlets and /api/employees (owner) first rows as api.md; washer employees 403
PASS E-06 No API answer contains 'password' (AC-11.5); errors share one JSON format
PASS F-01 POST /api/bills without X-CSRF-Token: 403 csrf_failed, nothing saved
PASS F-02 New bill validation: rack A05 in use at O03, unit 4.3, unknown customer -> 422 fields
PASS F-03 POST /api/bills (kasir5, C0151 S0001 5 kg A03, pay_now cash 20000, 'payment': 1 ignored) -> 201 B2954
PASS F-04 Workflow B2938: finished again 409; departed with balance 409; qris without ref 422; pay 201; departed 200
PASS F-05 Mark finished: washer cuci1 B2946 (O01) 200; cashier 403; washer on an O03 bill 403
PASS F-06 Cancel: B2952 (has payments) 409; B2941 by spv3 200 cancelled, payment 0; cashier 403
PASS F-07 Complaint on B0014 by the owner: 201 history row; complaint on a queued bill 409
PASS G-01 Services: price 8500.5 -> 422; delete S0001 -> 409 '1,368 bills'; create -> S0013; cashier 403
PASS G-02 Customers: create Rina -> 201 C0257; invalid -> 422 with 4 fields; delete C0094 409; C0257 cashier 403, owner 204
PASS H-01 Web login form (hidden CSRF field sent back) -> redirect; form POST without the token -> 403
PASS H-02 Receipt B2954: official logo (byte-identical), Rp 40.000, BALANCE, status hint, no address/e-mail
PASS H-03 Washer: dashboard without 'Rp', /reports/monthly 403; cashier /reports/monthly 403
PASS H-04 Public /status page: B0014 -> 'Collected', no customer name; wrong phone 404
PASS H-05 Web pages answer 200 for the owner: queue, bills, bill, customers, services, reports, employees
PASS H-06 XSS: a customer named <script>alert(1)</script> is shown as text
PASS H-07 Status check rate limit: more than 10 look-ups per minute from one address -> 429

RESULT: 37 passed, 0 failed (37 checks)
