jobtrackingapp/docs/audits/user-journey-audit.md

# JobTracker user-journey audit

Audit date: 2026-08-02

## Evidence classification

- **Tested in a running browser:** repository Playwright test drove real Chromium against isolated running API/UI services.
- **Tested with mocked services:** backend unit tests or frontend Jest/RTL tests replaced external or HTTP boundaries.
- **Inspected only in code:** execution path was read but not operated end to end.
- **Blocked:** the required browser-control client, safe external provider, or a functioning prerequisite endpoint was unavailable.
- **Not applicable:** the product has no such workflow.

No screenshot references exist: interactive browser control failed before navigation because its required client module was absent. The four repository Playwright tests capture screenshots only on failure and all passed.

## Journey results

Each record includes persona, preconditions, steps, expected/actual results, classification, status, console/network evidence, screenshots, and related findings.

| ID | Journey | Persona / preconditions | Steps and expected result | Actual result | Classification | Status | Console errors / failed requests / screenshot | Findings |
|---|---|---|---|---|---|---|---|---|
| UJ-01 | Landing and public navigation | Logged-out visitor | Open landing; follow public navigation without gaining private access | Landing/routes inspected; public CV opened in real Chromium. Landing navigation itself was not interactively exercised. | Inspected only in code / browser for public CV | Partial | No captured console error; screenshot none | JT-018 |
| UJ-02 | Local sign-in and invalid credentials | Returning local user; isolated Playwright DB | Enter credentials; expect Dashboard and visible identity. Invalid credentials should stay unauthenticated with generic response. | Real Chromium login passed. Generic 401/lockout logic and UI error state pass unit/component tests; invalid login was not manually typed. | Running browser / mocked | Pass for valid login; partial for invalid | No Playwright failure; screenshot none | — |
| UJ-03 | Manual registration and email verification | New synthetic user; isolated API with verification required and email disabled | Register; expect a verification-required state and no authenticated access until confirmation | Registration returned 200, stored `EmailConfirmed=0`, but registration-issued session immediately accessed `/auth/me` (200). | Running API; email mocked/disabled | Fail | Failed expectation at auth lifecycle; no email sent; screenshot none | JT-007 |
| UJ-04 | Sign-out and session expiry | Returning synthetic user with copied pre-logout cookie | Log out; expect current server session/token to be unusable | Browser cookie was cleared (subsequent 401), but copied pre-logout cookie remained accepted (200). Natural expiry was inspected, not waited out. | Running API / code-inspected | Fail for revocation; partial for expiry | No console; requests 204, 401, and copied-session 200 | JT-008 |
| UJ-05 | Password reset/change and email change | Local account; verification-required disposable API | Change email/password or reset; require verification/recovery semantics and revoke compromised sessions | Email changed with 204 and stayed confirmed. Password reset/change revoke no session rows by code inspection. Reset email delivery was not invoked against real SMTP. | Running API for email / mocked+code for passwords | Fail/partial | No real email; screenshot none | JT-007, JT-008, JT-002 |
| UJ-06 | Google/Microsoft sign-in, linking, 2FA and recovery | Synthetic principals/mocked validators only | Validate provider identity, explicit linking, 2FA/recovery, failure handling | Extensive unit tests cover success/failure; no real provider or TOTP browser journey. Microsoft path trusts mutable email-like claims and weak issuer shape for auto-linking. | Mocked services / code-inspected | Partial | External providers intentionally not contacted | JT-001 |
| UJ-07 | Protected routes and unauthorized API | Logged-out visitor and User B | Open private API/route without valid owner/session; expect 401/404/403 | Unauthenticated API returned 401; User B got 404 for A's resources and 403 for admin. UI redirect logic inspected. | Running API / code-inspected UI | Pass at API level | No screenshot | — |
| UJ-08 | First-run empty account and onboarding | User B with no data/incomplete profile | Expect actionable empty state, profile/integration guidance, and resumable setup | B received empty job/company lists and 404 own profile. Onboarding/empty-state components pass mocked tests; no browser keyboard/navigation review. | Running API / mocked UI | Partial | CV list instead returned 500 even for empty B | JT-003, JT-014 |
| UJ-09 | Create a job manually | Returning Playwright user | Add Job → manual details → company/title → skip optional steps → create; expect saved job visible | Passed in real Chromium. Synthetic Unicode/Norwegian job also existed in local API data. | Running browser | Pass | No Playwright failure; screenshot none | — |
| UJ-10 | Edit/delete/move/search/filter/sort/return | Returning user with jobs | Modify a job, move stages, soft-delete/restore, search/filter/sort, navigate away/back, prevent accidental destructive actions | Component and controller tests cover these flows; code uses disabled save states and confirm helpers. Not manually exercised in browser. No idempotency key for repeated submissions. | Mocked services / code-inspected | Partial | No browser console/network capture | JT-014 |
| UJ-11 | Job workspace, notes, deadlines, contacts and follow-ups | User A owns job 1 | Open workspace; expect overview/assets/activity/AI and linked subpanels | `/workspace` returned 500 under default SQLite. `/timeline` and `/interview-prep` returned 500 due duplicate routes; checklist/analysis/match returned 200. | Running API | Fail | Failed requests: workspace/timeline/interview-prep 500 | JT-003, JT-004 |
| UJ-12 | Attachments | User A/B and synthetic text file | Upload/list/download/rename/delete with ownership and file/DB consistency | A upload/list/download passed; B copied file ID returned 404. Rename/delete inspected only. Failure paths can orphan files or desynchronise path/row. | Running API / code-inspected failure paths | Partial | No failed owner request; screenshot none | JT-010 |
| UJ-13 | Import job from URL | Authenticated user; no external site contacted | Validate URL, reject private networks, safely bound fetch, populate draft | Parser/SSRF unit tests pass and direct/private IP checks exist. Real site import blocked; response body is buffered before the four-megabyte check. | Mocked services / code-inspected | Partial | External fetch not performed | JT-011, JT-024 |
| UJ-14 | Career Profile and CV import review | User with synthetic CV/profile | Create/edit profile; import CV; review diffs; accept selected, reject others, edit before acceptance; preserve existing data | Profile/diff/pipeline backend and frontend tests are broad and approval is explicit. No manual browser run. CV run/list endpoints contain default-SQLite failures. | Mocked services / code-inspected; blocked browser | Partial/fail | `GET /api/profile-cv/runs` 500 in local runtime | JT-003, JT-014 |
| UJ-15 | CV variants, edit/reorder/hide/preview/export | User with career data | Create variant; edit/reorder/hide; preview; export; return without lost work | Public synthetic CV creation/publish/render/PDF passed in Chromium. Authenticated variant list returned 500; editor/autosave/DOCX-related paths were component/code-only. | Browser for public PDF / mocked and code-only for editor | Partial/fail | CV list 500; screenshot none | JT-003, JT-015 |
| UJ-16 | Deterministic match and AI assistance | User A with job/profile; cloud/local AI not configured | View match; generate suggestion; accept/reject/edit; handle empty/malformed/delay/failure; never auto-apply | Deterministic match returned 200. Mocked tests show AI results are suggestions/history and user approval is required. Usage/history fail on SQLite; no paid provider invoked. | Running API for match / mocked AI / blocked provider | Partial | `/api/ai/usage` and AI history 500 | JT-003, JT-022 |
| UJ-17 | AI trust and private-data boundary | Synthetic untrusted job/email text | Treat content as untrusted, communicate limitations, restrict payload to relevant job/profile/selected attachments | Prompts include guardrails and labelled source text; Markdown renders as React nodes. AI workspace sends the current job plus full master profile for most modules. No per-user global opt-out/provider-recipient explanation exists. Prompt-injection resilience was code-inspected, not adversarially provider-tested. | Code-inspected / mocked | Partial | External AI intentionally blocked | JT-022, JT-025 |
| UJ-18 | Connect/disconnect email provider | Synthetic provider mocks | Connect/cancel/reject/expire/disconnect safely and show state | Gmail/Graph/IMAP controller/provider/component tests cover mocked cases. No real OAuth or mailbox used. | Mocked services / code-inspected | Partial | No external requests | — |
| UJ-19 | Link/view/draft/cancel/send correspondence | Synthetic messages only | Associate correct job/category; view sent/received; draft/discard; require explicit send; archive/pin/read-later/spam/trash; render safely | Local correspondence ownership passed. Provider imports, category state, and explicit send actions covered by tests/code. No real message sent. Some requested mailbox categories are not implemented as a unified workflow. | Running API for local records / mocked provider / code-only | Partial | No real email; no screenshot | JT-014 |
| UJ-20 | Dashboard and analytics | Empty B and small synthetic A | Verify empty/data KPIs, counts, trends, follow-ups, dates/timezones, drill-down | Analytics services/tests cover calculations, but no manual browser KPI comparison against substantial data. One-job local dataset is insufficient for accuracy claims. | Mocked/code-inspected | Partial | Browser blocked; no screenshot | JT-014 |
| UJ-21 | Settings/preferences/AI controls | Authenticated user | Persist real preferences; enable/disable AI; select/understand provider/privacy; show usage | Theme/language/table settings persist client-side. Notification checkboxes only update localStorage and do not govern server reminders. AI usage returns 500 on SQLite; no global per-user AI disable/provider choice. | Code-inspected / running API for usage | Fail/partial | AI usage 500 | JT-003, JT-012, JT-022 |
| UJ-22 | Data export and account deletion | Authenticated user/admin | Export all user data; confirm irreversible deletion; remove DB/files/tokens/backups as documented | No self-service account deletion. Admin delete removes only Identity user. Downloadable backup is app-key-encrypted and omits career/CV/AI/provider/session data and file bytes. | Code-inspected | Fail | Not irreversibly executed | JT-009 |
| UJ-23 | Administrator | Normal User B; admin implementation present | Normal user must be denied; admin can safely manage users/system/audit | B got 403. Admin browser workflows and destructive admin delete were not run. | Running API for denial / code-inspected admin | Partial | 403 as expected | JT-009, JT-014 |
| UJ-24 | Edge cases and failure states | Synthetic users/data | Empty/invalid/long/Unicode, duplicates, double-click, refresh/back, tabs, slow/interrupted network, missing records, concurrent edits, unsupported/oversized uploads | Validation and many failure paths have tests; Unicode job stored. Unsupported/oversized upload guards inspected. Multi-tab, throttling, refresh mid-save, concurrent edit and double-click were not manually exercised; no optimistic concurrency tokens are evident. | Mocked/code-inspected; browser blocked | Partial | No screenshots/console; route failures above | JT-010, JT-011, JT-014 |
| UJ-25 | Responsive and accessibility | Keyboard-only and 375/768/1440px users | No clipping; readable contrast; named controls; visible focus; modal focus; usable tables/boards/previews/themes | Manual checks blocked. Code confirms unnamed icon buttons, keyboard-inaccessible CV cards, and fixed 210mm public-CV iframe. Positive MUI labels/dialog semantics also observed. | Inspected only in code / blocked browser | Fail for confirmed semantics; blocked visually | Screenshot none | JT-015 |
| UJ-26 | Two-user isolation | Disposable User A and B | B must not access A by UI or copied/guessed IDs | No disclosure in meaningful API results; several CV/AI/workspace routes blocked by 500s. UI-level navigation not run. | Running API / code-inspected UI | Pass/partial | Detailed matrix in evidence; screenshot none | JT-003, JT-004 |

## Persona coverage

| Persona | Coverage |
|---|---|
| Logged-out visitor | Browser public CV; unauthorized API; public route code inspection |
| New user | Registration/verification running API; onboarding mocked/code-only |
| Returning user | Real Chromium login and job creation |
| User with no data | User B running API; UI empty states mocked |
| User with substantial synthetic data | Blocked; only small disposable dataset used |
| User with incomplete profile | User B/API plus mocked UI |
| User encountering API failures | Running API failures captured; UI display mostly mocked |
| User with expired session | Natural expiry not waited; copied-session/logout behaviour tested |
| Keyboard-only/mobile-width user | Blocked; code inspection only |
| Administrator | Normal-user denial tested; admin UI blocked |

## Most serious journey failures

1. Default SQLite breaks CV lists/runs, AI history/usage, and the application workspace.
2. Timeline and interview-prep URLs are ambiguous and always fail before user logic.
3. Registration grants an authenticated session to an unverified address; profile email changes remain confirmed.
4. Logout does not revoke the server session represented by a copied cookie.
5. Rules, enrichment, reminders, and scheduled exports cannot see tenant rows in background scopes.
6. Notification preferences and full data-deletion/export expectations are not enforced by server behaviour.

## Browser limitation

The exact browser-plugin blocker and the four genuine Chromium workflows are recorded in `evidence/browser-evidence.md`. No other workflow is claimed as browser-tested.