Background Background: Given the application is running And the test database is seeded with known data And the API endpoints are reachable Scenario 1: Successful user login (UI) Scenario: User logs in with valid credentials Given I am on the login page When I enter email "testuser@example.com" And I enter password "ValidPass123!" And I click the login button Then I should be redirected to the dashboard And I should see a welcome message "Hello, Test User" And the logout button should be visible Scenario 2: Login with invalid password (UI) Scenario: User fails login with wrong password Given I am on the login page When I enter email "testuser@example.com" And I enter password "WrongPass" And I click the login button Then I should see an error message "Invalid email or password" And I should remain on the login page And the URL should not contain "/dashboard" Scenario 3: Empty login form validation (UI) Scenario Outline: Login form validation for empty fields Given I am on the login page When I enter email "<email>" And I enter password "<password>" And I click the login button Then I should see "<error_message>" Examples: | email | password | error_message | | | Valid123 | Email is required | | test@example.com | | Password is required | | | | Both fields are required | | invalid-email | Pass123 | Please enter a valid email | Scenario 4: Create new user via API (API automation) Scenario: API creates a new user successfully Given I have a valid API token When I send a POST request to "/api/v1/users" with body: """ "name": "John Doe", "email": "john.doe+test@example.com", "password": "TempPass123!", "role": "tester" """ Then the response status code should be 201 And the response should contain "id" And the response body should have "email" equal to "john.doe+test@example.com" And the user should exist in the database Scenario 5: Duplicate user registration (API negative test) Scenario: API rejects duplicate user registration Given a user with email "existing@example.com" already exists When I send a POST request to "/api/v1/users" with body: """ "email": "existing@example.com", "name": "Duplicate User", "password": "Pass123!" """ Then the response status code should be 409 And the error message should be "User with this email already exists" Scenario 6: Update user profile (Database verification) Scenario: User updates profile and changes are persisted in database Given I am logged in as "testuser@example.com" And I navigate to profile settings When I update my phone number to "+1234567890" And I save the changes Then I should see "Profile updated successfully" And the database query for user "testuser@example.com" should return phone = "+1234567890" And the updated_at timestamp should be within the last 30 seconds Scenario 7: Logout and session invalidation Scenario: User logs out and session token is invalidated Given I am logged in as "testuser@example.com" And I have a valid session token stored When I click the logout button Then I should be redirected to the login page And my session token should be invalid And accessing "/api/v1/user/profile" with the old token should return 401 Scenario 8: Password reset flow (E2E) Scenario: User resets password via email link Given I am on the login page When I click "Forgot password" And I enter email "testuser@example.com" And I click "Send reset link" Then I should see "Reset link sent to email" And a password reset email should be sent to "testuser@example.com" When I open the reset link from email Then I should be on the reset password page When I enter new password "NewStrongPass456!" And I confirm the new password And I click "Reset password" Then I should see "Password reset successful" And I should be able to login with "testuser@example.com" and "NewStrongPass456!" And I should not be able to login with old password Automation Checklist for These Scenarios | Type | Tools Suggested | Key Assertions | |------|----------------|----------------| | UI | Selenium / Playwright / Cypress | Element visibility, text, URL, error messages | | API | REST Assured / SuperTest / Postman Newman | Status codes, response body, headers | | Database | JDBC / SQLAlchemy / Prisma | Row existence, field values, timestamps | | Email | Mailhog / Ethereal / Gmail API | Email received, link extraction | | Session | JWT verification / Cookie check | Token invalidation, 401 responses |