Access Control (Tests\Feature\AccessControl)

• Guests are sent to login
• Public pages render with security headers
• Customer sees own dashboard but not back office
• Unverified customer must verify first
• Staff without two factor are sent to security
• Frozen accounts are signed out
• Customers cannot open other customers records

Allotment Allocation (Tests\Unit\AllotmentAllocation)

• Undersubscribed everyone gets their request
• First come fills in order with partial last
• Pro rata splits proportionally and hands leftovers to largest remainders
• Pro rata ties go to earliest application
• Never allots more than available or requested
• Lottery uses the shuffled order
• Nothing available

Formatting (Tests\Unit\Formatting)

• Money uses south asian grouping and sign
• Percent and change indicator never rely on colour alone
• Status tone mapping

Ledger And Holdings (Tests\Database\LedgerAndHoldings)

• Ledgers are append only
• Holdings are derived from the ledger
• Locked shares cannot be transferred
• Open requests reserve shares
• Value series has points for every period
• Sensitive columns are encrypted at rest
• Changes are audited

Marketplace (Tests\Database\Marketplace)

• Application rules
• First come cannot be oversold
• Forged callback changes nothing and genuine one still settles
• Pro rata allotment refunds and lots
• Payment after close is refunded automatically
• Processing refund posts to cash ledger

Payment Gateway (Tests\Unit\PaymentGateway)

• Form fields are signed in declared order
• Authentic completed payment is accepted
• Tampered or foreign callbacks are not authentic
• Redirect alone is not enough when status api disagrees or is down
• Cancelled payment is authentic failure only when esewa confirms
• Esewa refuses to start without credentials
• Demo gateway signature is required

Security Hardening (Tests\Feature\SecurityHardening)

• Totp code cannot be replayed
• The code used to turn on 2fa cannot be reused at login
• Two factor failures lock the user across sessions
• Sensitive outbox messages are wiped after delivery
• Payment pages require the two factor challenge
• Changing payout bank needs the current password
• A payment can only be settled once

Totp Service (Tests\Unit\TotpService)

• Matches rfc 6238 reference values
• Verify accepts one step of clock drift only
• Generated secret round trips
• Recovery codes work once each

Transfers And Corporate Actions (Tests\Database\TransfersAndCorporateActions)

• Locked lot cannot be sold
• Cannot request someone elses lot
• Sale lifecycle posts ledger and proceeds
• Cash dividend with tax and bonus issue
• Bonus lots inherit lock in
• Future record date cannot be applied

Two Factor Policy (Tests\Feature\TwoFactorPolicy)

• Customers without 2fa must set it up first
• Required 2fa cannot be turned off
• Ticking trust this device stores a hashed token
• A trusted device skips the code
• Expired or foreign trust is ignored
• Staff never skip the code
• Changing password forgets other trusted devices
• Forget all removes every trusted device