Intranet (S089): flows that aren't in the SRS, and how to test them

For Manuel, for testing. The SRS (v1.2) doesn't describe the flows below, so there's no requirement text to test them against. This file says where each one came from, who can use it, where to find it, what to do and what should happen.

Roles are the Zitadel project roles (Staff, Content owner, CCP, Leadership, P&C, Approving leader, DTI, Auditor, System admin).

How to read each entry: ✅ = what you should see. ⚠️ = a known limit, so not a bug.

Before testing: parts of this depend on the 26 Sept backend (delegation times, roster, #16, #18). If UAT hasn't been redeployed since then, those parts will behave the old way. Check with DevOps first.

Contents

A. Features not in the SRS at all

  1. Media library
  2. Duty roster
  3. Newsroom review (submit, approve, reject)
  4. Knowledge post categories

B. SRS features whose flow we had to design (the SRS names the feature but not the steps) 5. Knowledge spaces: request access and the moderator's queue 6. Knowledge spaces: creating a space 7. Delegation: times, countdown, and staff who cover 8. Restore after archive or takedown 9. Urgent notices: CCP can deactivate 10. Surveys: drafts, publish, results as totals 11. Force sync / Retry / Remind

C. Display behaviour that looks like a bug but isn't 12. Names instead of IDs 13. "View document" opens a tab 14. Home page: slider, clickable figures, 3 news cards 15. Things that are dev-only

A. Features not in the SRS at all

1. Media library

Origin: carried over from the reference portal. Because it isn't in the SRS, files are kept in the intranet's own storage, not Records Management.
Who Upload: Content owner, CCP. Approve or reject: CCP. Browse: all staff
Where Upload and approve: console → CCP → Media. Browse: portal → News → Media (/media)

Test: upload

  1. As a Content owner or CCP, open Media in the console.
  2. Pick a type tile (Image, Video, Document, Audio). ✅ The file chooser only accepts that type's extensions.
  3. Choose a file. ✅ A preview appears (picture, video or audio player). The title fills in from the file name. For audio and video, the length is read from the file.
  4. Set the audience and upload. ✅ The item appears as Pending. Staff can't see it yet.

Test: approve or reject 5. As CCP, open the pending item and Approve it. ✅ It now appears in the staff library with "Cleared by <name>". 6. Upload another file and Reject it. ✅ You're asked for a reason (required). The item never reaches staff.

Test: browse (as Staff) 7. Open /media and use the All / Image / Video / Document / Audio filter. ✅ Images show a thumbnail. Each card has a button named for its type: View document, View image, Play video or Play audio, plus Download. Clicking the picture area also opens the file, and hovering shows what a click will do. 8. Click View on a PDF. ✅ It opens in a new tab. 9. Click View on a Word file. ✅ It downloads, because browsers can't display Word files.

⚠️ Limits

2. Duty roster

Origin: carried over from the reference portal. The backend first dropped it, then brought it back in scope on 26 Sept (/v1/roster/).
Who Read: all staff. Write: P&C (API only for now; there's no console screen)
Where Portal → People → Roster (/roster), and the On duty panel on Home

Test

  1. Ask the backend team (or use Django admin) to add a few roster entries for today and the next few days, in more than one directorate.
  2. As Staff, open /roster. ✅ Shifts from today onward, grouped by day. Today is marked Today. Each card shows the name, role, shift and location, with a colour rule per shift.
  3. Use the directorate filter. ✅ The chips are built from the real data (not a fixed list), and filtering narrows the list.
  4. Open Home. ✅ On duty shows up to 4 entries. With no entries, it says "No one is rostered on duty yet."

⚠️ Limits

3. Newsroom review (submit, approve, reject)

Origin: the separate newsroom spec (NEWS-FR-002/003), not the SRS. The SRS content lifecycle is only Draft → Published → Urgent. News articles add a review step.
Who Write and submit: Content owner, CCP. Approve or reject: CCP and Content owner (routine categories) or Leadership only (sensitive categories)
Where Console → Newsroom → Articles (/newsroom/articles); the review queue is the Review tab

The routing rule. Nine categories exist. Four are sensitive: Executive, Statutory, Crisis, Reputation-sensitive. Only Leadership can approve or reject those.

Test

  1. As a Content owner, create an article in a routine category (e.g. People & culture) and submit it. ✅ Its status becomes In review.
  2. As CCP, open the Review tab and approve it. ✅ Approved — not yet published. It still needs Publish before staff see it.
  3. Submit another article, then reject it as CCP without a comment. ✅ The Reject button stays disabled until a comment is typed.
  4. Reject it with a comment. ✅ Returned with comments. The author sees the comment and can edit and resubmit.
  5. Submit an article in Crisis (or another sensitive category), then open the queue as CCP. ✅ The Approve and Reject buttons are disabled and say Leadership must decide.
  6. Open the same article as Leadership. ✅ Leadership can approve or reject it.
  7. After publishing, check the staff portal's News page. ✅ It appears there with its category cover.

4. Knowledge post categories

Origin: a backend addition. The SRS only talks about "posts".
Who Any space member when posting
Where Portal → a knowledge space → + New post → Category

The categories are FAQs, How-To Guides, Templates, Tools & Systems, Legal Education Standards, or none.

Test

  1. Post twice, with two different categories. ✅ Each post shows its category badge. A filter bar appears above the posts, only listing categories actually used in that space, with counts.
  2. Click a category chip. ✅ Only those posts show. All brings everything back.

⚠️ Posts made before categories existed have none; they only show under All.

B. SRS features whose flow we had to design

5. Knowledge spaces: request access and the moderator's queue

Origin: the SRS only gives the message "You are not a member of this space. Request access from the space moderator." The request and approve/decline flow was designed by us and the backend.

Test

  1. As Staff, open Library → Knowledge spaces (/knowledge). ✅ Restricted spaces you're not in are greyed out with a lock and Request access. Restricted spaces you are in open normally and show Joined and Member-only.
  2. Click Request access. ✅ "Request sent". The button stays Request sent, even after a reload in the same browser.
  3. As that space's moderator (or CCP), open the space. ✅ An Access requests card lists the person, with Approve and Decline.
  4. Approve. ✅ The requester can now open the space and post.
  5. Open a restricted space's link directly as a non-member. ✅ The SRS message, with Request access and Back to spaces.

⚠️ Limits (backend, already reported)

6. Knowledge spaces: creating a space

Test

  1. As Staff, open /knowledge. ✅ No "New space" button. Opening /knowledge/new directly explains that only content owners can create spaces.

  2. As a Content owner or CCP, create a space. ✅ The form offers:

    • name and description;
    • Type (Community of practice or Directorate space);
    • Who can see it (audience);
    • Joining (Open or Restricted);
    • Moderator (leave empty to be the moderator yourself).

    After creating, you land on the new space.

⚠️ The old builder's Members and Files steps are gone on purpose: they never saved anything. People join themselves (open spaces) or by request (restricted spaces), and files are attached to posts.

7. Delegation: times, countdown, and staff who cover

Origin: the SRS requires time-bound delegation (C06-01, RBAC-03). Exact times, the countdown and the covering banner are our design, built on the 26 Sept backend.

Test: leader side (console, Approving leader → Delegation)

  1. Pick a delegate, a start date and time, and an end date and time. Times default to 09:00 and 17:00. ✅ An end before the start shows "The delegation end time must be on or after the start time." and Create stays disabled.
  2. Create a delegation that starts in the future. ✅ Current & scheduled shows it as SCHEDULED, with Starts in … from <day, time>.
  3. Create one that's active now. ✅ ACTIVE, with Ends in …. The countdown refreshes every 30 seconds.

Test: delegate side, when the delegate is ordinary Staff (#18) 4. Sign in as the delegate and open the portal's Home or Memos. ✅ A banner: "You're covering memo approvals until <day, time>", with Open review queue. 5. Click it (console). ✅ The sidebar shows Covering approvals → Memos to review. The queue and memo pages open, and the delegate can decide. 6. As the delegate, open /approver/delegation. ✅ Access denied. Delegates can review but can't manage delegations. 7. After the end time passes, reload. ✅ The banner and menu item disappear, and the queue is no longer reachable.

⚠️ Times are in the viewer's local time.

8. Restore after archive or takedown

Origin: the backend changed this on 26 Sept (#16). Restore now puts an item back in the state it was in before. It used to always go back to draft.

Test

  1. Take down a published item (DTI → Emergency takedown), then restore it. ✅ The message says Restored, "back where it was, live on the feed", and it's visible to staff again.
  2. Archive an item and restore it (Scheduling, or Leadership → Updates). ✅ The message reads the real result. If the server returns it as a draft, the message says Restored as a draft and tells you to publish it again.

9. Urgent notices: CCP can deactivate

Origin: a backend decision (#16). CCP can lower an urgent banner but not raise one. DTI can't deactivate (DTI has Emergency takedown instead), following the SRS role table.

Test

  1. As Leadership, raise an urgent notice.
  2. As CCP, open Urgent notices. ✅ Deactivate shows on the active notice, and it works.
  3. As DTI, open the same page. ✅ No Deactivate button.

10. Surveys: drafts, publish, results as totals

Origin: the SRS covers surveys and anonymity. Drafts, and results sent as totals, were added later (#83).

Test

  1. As P&C, create a survey and save it as a draft. ✅ Staff can't see it.
  2. Publish it. ✅ Staff can see and answer it.
  3. Open the results. ✅ Counts per answer, with no individual responses.
  4. For an anonymous survey, confirm nothing identifies who answered.

11. Force sync / Retry / Remind

Origin: added for testing and operations (#83). The SRS only requires the scheduled jobs.

Where Button What should happen
DTI → Integration health Force sync (feed is stale) or Retry (feed is down); Open retry queue when throttled Starts a sync straight away. The page shows success, or the failure reason
P&C → Acknowledgement report Remind on a staff row Reminds that person to acknowledge. Needs a mandatory policy on UAT, which there isn't yet

C. Display behaviour that looks like a bug but isn't

12. Names instead of IDs, everywhere

Login IDs (long numbers like 387980450502541406) are never shown. When HR hasn't synced a person yet, you'll see a stand-in:

Where Stand-in
Authors "CLET Communications"
Submitters, delegates, members "A colleague"
Approvers blank

✅ Seeing one of these means the directory is missing that person. That's the empty-HRMS problem, not a display bug.

13. "View document" opens a tab

14. Home page: slider, clickable figures, 3 news cards

15. Things that are dev-only

Reporting

When something doesn't match, note:

A screenshot helps. Send it to the frontend team (Frank). We'll tell you whether it's frontend, backend or data.