PASS A1 guard: not logged in -> 302 /login
PASS A2 wrong password: 401, message shown
PASS A3 cashier refused: a cashier's correct password -> 401
PASS A4 owner login: 302 /services, new session id: True
PASS F1 list: 12 services, S0005 costs Rp 65.000
PASS F1 search: 'dry clean' -> S0004 S0005 S0006 S0007
PASS F2 refused: 422 The price must be from Rp 1 to Rp 99.999.
PASS F2 add: 302, then: Service added. S0013 listed
PASS F3 edit: 302, S0013 now Rp 50.000
PASS F4 refused: Service S0001 appears on bills and cannot be deleted.
PASS F4 delete: Service S0013 deleted.
PASS F5 outlets: 3 outlets, queues 9/9/5
PASS F6 refused: 422 The opening date must look like 2026-10-01.
PASS F6 open: 302, then: Outlet opened.
PASS F7 edit: 302, O04 phone now 031-0000-2199
PASS F8 refused: Outlet O01 still has employees or bills and cannot be closed.
PASS F8 close: Outlet O04 closed.
PASS S1 no token: a POST without the form token -> 403
PASS S2 GET delete: GET on a delete address -> 405
PASS S3 escaping: the description is shown, not run
PASS A5 logout: 302 /login; afterwards /services -> 302
21 of 21 checks passed
