# QA Smoke Checklist

## Auth / RBAC
- unauthenticated protected route => 401
- student cannot use admin endpoints
- parent only sees linked students
- school user only sees own organization
- content reviewer can approve questions
- only authorized roles can publish

## Question Bank
- only published questions reach student
- exactly one correct choice
- editing published question returns to review
- AI import never auto-publishes

## Training
- selected choice must belong to question
- session ownership enforced
- mastery update transactional
- repeated submission does not corrupt mastery

## Tests
- timer expiry enforced
- autosave survives navigation
- answer key hidden before submit
- scoring only backend
- result analytics match answers

## AI Tutor
- official answer comes from Question Bank
- hint level 1 does not reveal full answer
- logs session/message ownership
- AI errors do not mutate official bank answer

## Parent
- attendance based on real activity
- absence only on planned study day
- emails respect preferences

## Billing
- coupon validity enforced
- idempotency on checkout
- duplicate webhook safe
- inactive/expired subscription blocked

## Security
- request ID returned
- API errors do not expose stack traces
- security headers present
- rate limits active
- audit events created on sensitive changes