Role-Based Access Control & Demonstration Accounts
The application implements strict Role-Based Access Control (RBAC). Use the 1-click login buttons below to instantly switch contexts and evaluate the platform from each persona's perspective.
Super Administrator
admin@asiaassociation.org
Full control over the platform: execute 7-step CSV roster imports, configure document rules, view immutable audit logs, inspect family links, and manage regional association chapters.
KYM Verifier Desk
verifier@asiaassociation.org
Dedicated reviewer desk: inspect pending dossiers, review photographs, preview uploaded Aadhaar (with masked UID) & PAN documents, request member corrections with notes, or approve KYM.
Member Self-Service
member@asiaassociation.org
Member experience: authenticated as J. Vergees (MEM-2026-00481). Navigate the 8-step wizard, experience the phone-only QR photo capture, upload documents, and track status.
Step-by-Step Scenario Testing & Core Business Rules
Follow these step-by-step interactive scenarios to test every core capability and business rule specified in the project requirements.
The "Vergees" Family Demo: Shared Phone Numbers & Duplicate Names
Business Rules: Non-blocking shared contact numbers + independent records for identical names
The Association Reality
In community associations, multiple family members (husband, wife, children, elderly parents) legitimately share a single household mobile number (+91 98765 43210) and residential address. Furthermore, common South Indian names like J. Vergees can belong to entirely separate individuals across different branches.
Traditional systems fail here by enforcing global uniqueness on phone numbers or names, erroneously rejecting family members as "duplicates".
How ASIA KYM Solves It
- Permanent internal database ID + permanent human-readable Member Code (
MEM-2026-XXXXX). - Non-blocking discovery: entering an existing phone shows a friendly contextual alert without halting entry.
- Each individual retains their own identity documents, photograph, and verification status.
- Family clusters can be explored together at Shared Info / Family Links.
Side-by-Side Selective Data Reuse & Identity Protection
Business Rules: Allow copying shared family address/phone while strictly locking individual identity fields
When creating or updating a family member, administrators can select an existing verified relative (e.g. J. Vergees) and inspect available information side-by-side with the current draft (e.g. P. Vergees).
- Mobile Phone (
9876543210) - Residential Address (
42, Palm Greens) - City, State & PIN Code (
Ahmedabad, Gujarat, 380054) - Emergency Contact Details
- Full Name & Date of Birth
- Individual Portrait Photograph
- Identity Document (Aadhaar / PAN UID)
- Member Code & Internal Database ID
- Individual Verification Status
Every copy action generates an immutable audit record documenting source ID, target ID, copied fields, actor, and timestamp.
Mandatory Phone-Only Photograph Capture Using QR Code
Business Rules: Laptop webcam blocked; secure expiring QR link with live polling synchronization
Expiring Secure QR Generation
On Step 5 of the KYM wizard, the laptop does NOT activate its webcam. Instead, it generates a vector QR code containing a 64-character cryptographically secure token with a 15-minute validity countdown.
Front Camera Portrait Capture
The user scans the QR with their smartphone. The dedicated mobile view validates the token on the server, activates the front camera via navigator.mediaDevices.getUserMedia(), renders a live video canvas, and lets the user capture, retake, or confirm their portrait.
Zero-Refresh Instant Laptop Update
While the phone is used, the laptop polls /kym/sessions/{token}/status every 2.5 seconds. The moment the photo is uploaded, the laptop automatically swaps the QR for the portrait preview and enables the next step without requiring a page refresh.
7-Step Member Roster CSV Import Workflow
Business Rules: Template download, preview, soft shared-phone validation, zero silent overwrites
Critical Data Protection Guarantee:
If an imported row matches an existing verified member's membership number, the engine flags it as an existing record and prevents silent overwriting of their verified personal and identity data. The import engine automatically assigns new unique sequential codes (MEM-2026-XXXXX) to new records.
Verification Queue & Manual Document Review
Business Rules: Manual document review, masked Aadhaar UID storage, change requests with feedback
No Fake API Simulation
The system is transparent: official UIDAI Aadhaar e-KYC and DigiLocker APIs require MeitY/KUA/ASA licensing. Therefore, the system adheres to strict manual document verification standards with private storage and masked UID references.
Masked UID & Private Storage
Aadhaar numbers are stored strictly as masked strings (e.g. XXXX-XXXX-4819). Supporting documents are saved in storage/app/private/ and served only via authenticated controller gateways.
Change Requests & Audit
Verifiers can approve, request changes, or reject. When requesting changes, the reviewer's comments are attached to the member's profile, triggering an in-app notice and unlocking only the fields requiring revision.
Shared Info / Family Links
Automatically aggregates members sharing phone numbers, residential addresses, or surnames into visual household cards without assuming marriage or relation.
Immutable Audit Trail
Tracks every significant event: CSV imports, field copying, draft saves, QR photo generations, photo uploads, submissions, and approvals with actor, IP, and JSON diffs.
Reports & CSV Export
Real-time calculated metrics: KYM completion percentages, pending verification lists, members missing photos/documents, and 1-click CSV report export.
Testing Phone Camera on Physical Smartphones (HTTPS)
Browser security specifications mandate that camera hardware access (navigator.mediaDevices.getUserMedia) requires a secure context (HTTPS or localhost).
Method A: Testing via Free HTTPS Tunnel (Recommended)
To scan the QR with your physical smartphone on a real Wi-Fi network:
- Run ngrok in terminal:
ngrok http 8000 - Copy the HTTPS tunnel URL (e.g.
https://xyz.ngrok-free.app) - Update
APP_URLinkym/.envto this HTTPS address - Open Step 5 on laptop, scan the QR with phone camera, and capture your live photo!
Method B: Local Machine Single-Device Simulation
If testing on the same laptop without an external tunnel:
- Navigate to Member Step 5 (
/member/kym?step=5) - Click the "Copy Mobile Link" button under the QR code
- Paste and open in a new browser tab or private window
- Allow camera permission or use the mobile upload fallback
- Confirm the photo and see the original laptop window instantly update!
Feature Test Suite & Scenario Coverage
The test suite in tests/Feature/KymWorkflowTest.php executes against an isolated database to validate all master prompt scenarios.
| Scenario | Master Prompt Requirement | Automated Test Method | Result |
|---|---|---|---|
| Scenario B | Multiple members with identical names are listed individually | test_scenario_b_multiple_members_with_same_name() | PASSED |
| Scenario C | Shared family phone number does not cause duplicate collision | test_scenario_c_shared_family_mobile_number() | PASSED |
| Scenario D | Side-by-side data reuse copies allowed fields but locks identity fields | test_scenario_d_side_by_side_reuse_locks_identity() | PASSED |
| Scenario E & F | QR token generation, 15-minute expiry, and invalid token protection | test_scenario_e_f_photo_capture_session_security() | PASSED |
| Scenario G | KYM verification status transitions, feedback notes, and review actions | test_scenario_g_kym_verification_transitions() | PASSED |
| Scenario H | Authorization gates prevent members approving own verification | test_scenario_h_authorization_gates() | PASSED |
| Scenario I | CSV import template download accessibility and column structure | test_scenario_i_import_template_validity() | PASSED |
php artisan test
36 Assertions Passed