# Remote Dashboard, Active Calls, and Audit Test Report

Date: 2026-06-29T05:52:07.874Z
Base URL: https://100.90.90.91
Username: admin
Low-Privilege Username: codex.low

| Result | Check | Detail |
| --- | --- | --- |
| PASS | admin can login | status=200, duration=457ms |
| PASS | admin login returns access token | tokenLength=296 |
| PASS | low-privilege user can login for RBAC checks | status=200, duration=1291ms |
| PASS | dashboard summary can be queried | status=200, duration=433ms |
| PASS | dashboard summary shape and Shanghai day window are valid | {"window":{"start":"2026-06-28T16:00:00.000Z","end":"2026-06-29T05:51:50.712Z","timezone":"Asia/Shanghai"},"calls":{"totalCalls":1,"answeredCalls":1,"failedCalls":0,"answerRate":"1.0000","totalDurationSec":6},"money":{"customerFee":"0.012000","vendorCost":"0.012000","grossProfit":"0.000000"},"quality":{"pendingReviews":54}} |
| PASS | dashboard trends can be queried with fixed range | status=200, duration=382ms |
| PASS | dashboard trends return fixed contiguous buckets | bucketCount=2 |
| PASS | invalid dashboard trend bucket is rejected | status=400, duration=800ms |
| PASS | invalid trend bucket returns DASHBOARD_BUCKET_INVALID | code=DASHBOARD_BUCKET_INVALID |
| PASS | too-large dashboard trend range is rejected | status=400, duration=1413ms |
| PASS | too-large trend range returns INTEGER_INVALID | code=INTEGER_INVALID |
| PASS | low dashboard-only user can query dashboard summary | status=200, duration=806ms |
| PASS | active calls can be listed | status=200, duration=807ms |
| PASS | active calls response shape is stable | {"total":0,"source":"opensips-mi"} |
| PASS | low dashboard-only user cannot list active calls | status=403, duration=379ms |
| PASS | invalid active call id is rejected (../x) | status=400, duration=382ms |
| PASS | invalid active call id returns ACTIVE_CALL_ID_INVALID (../x) | code=ACTIVE_CALL_ID_INVALID |
| PASS | invalid active call id is rejected (;rm -rf) | status=400, duration=867ms |
| PASS | invalid active call id returns ACTIVE_CALL_ID_INVALID (;rm -rf) | code=ACTIVE_CALL_ID_INVALID |
| PASS | invalid active call id is rejected (contains space) | status=400, duration=385ms |
| PASS | invalid active call id returns ACTIVE_CALL_ID_INVALID (contains space) | code=ACTIVE_CALL_ID_INVALID |
| PASS | invalid active call id is rejected (line\nbreak) | status=400, duration=386ms |
| PASS | invalid active call id returns ACTIVE_CALL_ID_INVALID (line\nbreak) | code=ACTIVE_CALL_ID_INVALID |
| FAIL | invalid active call id is rejected (xxxxxxxxxxxxxxxxxxxx) | status=404, duration=437ms |
| FAIL | invalid active call id returns ACTIVE_CALL_ID_INVALID (xxxxxxxxxxxxxxxxxxxx) | code=undefined |
| PASS | low dashboard-only user cannot hang up calls | status=403, duration=414ms |
| PASS | audit logs can be listed | status=200, duration=1314ms |
| PASS | audit list shape is valid | count=10, total=120 |
| PASS | low dashboard-only user cannot list audit logs | status=403, duration=463ms |
| PASS | invalid audit result filter is rejected | status=400, duration=377ms |
| PASS | invalid audit result returns AUDIT_RESULT_INVALID | code=AUDIT_RESULT_INVALID |
| PASS | audit logs can be filtered by result | status=200, duration=558ms |
| PASS | audit success filter only returns SUCCESS rows | count=5 |
| PASS | roles can be listed for temporary audit user setup | status=200, duration=424ms |
| PASS | dashboard-capable role is available | roleId=ROLE_TECH_OPS |
| PASS | temporary user with sensitive password can be created | status=201, expected=201, duration=432ms |
| PASS | created temporary user response does not expose password fields | {"id":"usr_b548190698424ba9b7b4a6c37bb2","username":"codex.audit.1782712309898"} |
| PASS | temporary user password reset succeeds | status=201, duration=432ms |
| PASS | password reset response does not expose sensitive fields | {"id":"usr_b548190698424ba9b7b4a6c37bb2","username":"codex.audit.1782712309898"} |
| PASS | password reset audit can be filtered by module/action/object/result | status=200, duration=695ms |
| PASS | password reset audit row exists | auditId=aud_a5b773a3ee0c4397a81eaf2b8fbac455 |
| PASS | password reset audit detail can be fetched | status=200, duration=580ms |
| PASS | password reset audit detail redacts sensitive body fields | {"id":"aud_a5b773a3ee0c4397a81eaf2b8fbac455","redactedPassword":"[REDACTED]"} |
| PASS | temporary audit user cleanup is stable | status=200, expected=200/404, duration=475ms |

## Notes

- Password and token values are intentionally omitted from console and report details.
- DASH-001 aggregate accuracy and DASH-002 exact Shanghai day-boundary attribution still require SQL comparison against seeded boundary CDRs.
- ACT-001/ACT-002 real long-call normalization and successful hangup require an active OpenSIPS dialog on A; this black-box run verifies list contract, RBAC, and invalid dialog-id safety.
- AUD-002 application log full-text checks require host-side log access; this run verifies API response and audit detail redaction.