# Laravel 12 Local Upgrade Tester Matrix

Role: Tester agent
Scope: local workspace only, no live servers, no application/dependency changes.
Generated on: 2026-06-06

## Baseline Commands Run

| Command | Result |
| --- | --- |
| `git status --short` | Worktree already dirty across app, config, routes, resources, public assets, tests, and untracked `docs/`; tester did not revert or edit those files. |
| `php -v` | PHP 8.2.29 with Xdebug 3.4.7. |
| `composer --version` | Composer 2.9.5, PHP 8.2.29. |
| `node -v; npm -v` | Node v20.20.2, npm 10.8.2. |
| `php artisan --version` | Laravel Framework 8.83.29. |
| `composer validate --no-check-publish` | Passed. |
| `composer why-not laravel/framework ^12.0` | Failed as expected; blockers include root `laravel/framework ^8.83.27`, `barryvdh/laravel-dompdf`, `beyondcode/laravel-websockets`, `cviebrock/eloquent-sluggable`, `fruitcake/laravel-cors`, `facade/ignition`, `laravel/sail`, `laravel/sanctum`, `laravel/ui`, `spatie/laravel-sitemap`, `tymon/jwt-auth`, and transitive Symfony/Carbon/Flysystem/Monolog constraints. |
| `php artisan route:list` | Passed; table output truncated in console. |
| `php artisan route:list --json` | Passed; full route inventory captured for this matrix. |
| Source inventory reads | Read `routes/web.php`, `routes/api.php`, `routes/channels.php`, `app/Console/Kernel.php`, key controllers, events, middleware, SMS helper, composer/package files, and Blade/action scans. |

Not run: `php artisan view:cache`, migrations, tests, local browser checks, queue workers, websocket server, mail/SMS sends, uploads, deletes, or PDF generation. These can write outside `docs/upgrade/` or require local fixtures/services and must be executed by the implementation/review phase in an isolated local environment.

## Route Matrix

Every route below must be verified after each approved upgrade stage. Expected baseline is Laravel 8 behavior.

| Area | Route/method/name | Page or function to test | Required assertions |
| --- | --- | --- | --- |
| Public | `GET /` `home` | Home page with active, non-offered, completed tenders, city filter, favorite state. | 200, cards render, images from storage render/fallback, countdowns run, subdomain bank filter still applies. |
| Public | `GET search` `search` | Search results page/form. | Query filters by property type, city/district, tender status, code, min/max price, sort order, Ziraat selector branch, empty result state. |
| Public AJAX | `GET getDistrictshome/{id}` `home.getDistrictsHome` | Home city-to-district select. | JSON array of `{id,text}`; invalid id behavior captured. |
| Public | `GET ihaleler/{slug}` `post.show` | Listing/detail page. | 200 for active tender; redirects home for inactive/expired; bank subdomain middleware; image gallery/lightbox; map assets; tabs/accordion; countdown; favorite button; bid UI states. |
| Public/Auth action | `PUT ihaleler/{slug}` `bidCheck` | Bid submit form. | Auth required; first bid and later bid amounts; validation errors; user permission gate; current price/winner update; higher-offer mail/SMS queue; websocket event fired; redirect preserves view-count session behavior. |
| Public/Auth action | `GET fastbuy/{slug}` `fastBuy` | Fast-buy button. | Auth required; only enabled fast-buy posts; winner/current price/status updated; broadcast event; redirect and status message. |
| Public/Auth action | `GET tenderUserPermissionMail/{slug}` `mail.tenderUserPermission` | Detail modal "request permission/mail" action. | Requires logged-in user in practice; PDF contract generation; notification log; queued mail; SMS; `mailed_users` and `mailed_posts` serialized fields update. |
| Public | `GET v/{slug}` `short.url` | Short URL redirect. | Redirects to listing detail for valid code; invalid code handling captured. |
| Public | `GET iletisim` `contact` | Contact static page. | 200, layout assets, nav/footer links. |
| Public | `GET hakkimizda` `aboutus` | About page. | 200, layout assets, links. |
| Public | `GET isimiz` `ourjob` | "Isimiz" page. | 200, layout assets, links. |
| Public | `GET nasil-edinirim` `buy-realestate` | Buyer information page. | 200, layout assets, links. |
| Public | `GET cerez-politikasi` `cookiesPolicy` | Cookie policy page. | 200. |
| Public | `GET gizlilik-politikasi` `privacyPolicy` | Privacy policy page. | 200. |
| Public | `GET kvkk` `kvkk` | KVKK page. | 200. |
| Auth | `GET login` `login` | Login page. | 200 for guests, redirect for authenticated users, CSRF present. |
| Auth | `POST login` | Login submit. | Valid user redirects by role, invalid credentials show errors, session persists. |
| Auth | `POST logout` `logout` | Logout action. | CSRF required, session cleared, redirect. |
| Auth | `GET register` `register` | Register page. | 200 for guests, redirect for authenticated users, fields and validation messages. |
| Auth | `POST register` | Register submit. | User slug, password hash, queued register mail/SMS behavior if present, validation errors. |
| Auth | `GET password/reset` `password.request` | Forgot password page. | 200 and form renders. |
| Auth | `POST password/email` `password.email` | Reset link send. | Mail queued/sent locally with fake; validation errors. |
| Auth | `GET password/reset/{token}` `password.reset` | Reset form. | 200 with valid token/email; invalid token behavior. |
| Auth | `POST password/reset` `password.update` | Password update. | Password changed, token invalidated, validation errors. |
| Auth | `GET password/confirm` `password.confirm` | Confirm-password page. | Auth required, form renders. |
| Auth | `POST password/confirm` | Confirm-password submit. | Valid password marks session, invalid errors. |
| Sanctum | `GET sanctum/csrf-cookie` | CSRF cookie endpoint. | Cookie headers and same-site settings remain compatible. |
| User | `GET kullanici/{slug}` `user.show` | User profile page. | Auth and policy gate; own/admin access; profile fields and tender links. |
| User | `GET kullanici/{slug}/guncelle` `user.edit` | Profile edit page. | Form renders; SMS permission checkbox; password optional; company fields. |
| User | `PUT kullanici/{slug}` `user.update` | Profile update submit. | Validation, phone normalization, optional password hash, SMS permission off/on, logs. |
| User | `GET kullanici/ihaleler/{slug}` `user.showUserTenders` | User tenders/favorites dashboard. | Pending, active, completed, favorite tabs; countdowns; DataTables export/print/PDF buttons; row click to detail. |
| User AJAX | `GET kullanici/ihaleler/favoricrud/{slug}` `user.userCRUDFavoriteTenders` | Favorite toggle endpoint. | Auth required; JSON boolean; serialized favorites push/pop. |
| User AJAX | `GET updateFavoritePosts/{slug}` `updateFavoritePosts` | Global favorite toggle from layout/card. | Auth required; AJAX updates icon/state; duplicate route behavior matches user endpoint. |
| User/SMS | `GET kullanici/sms-aktivasyon/{slug}` `user.smsPage` | SMS activation page. | Policy gate; activation code generated; SMS notification log and send isolated with local fake; form renders. |
| User/SMS | `POST kullanici/sms-aktivasyon/{slug}` `user.smsVerification` | SMS activation submit. | Correct code activates user and sends welcome SMS; wrong code returns error route behavior. |
| User/PDF | `GET tenderReport` `tender.report` | Finished tender report template preview. | Auth required; template renders without missing variables if intended, or route marked dev-only. |
| Admin | `GET admin/home` `admin.home` | Admin dashboard. | Admin middleware; posts list and status indicators render. |
| Admin AJAX | `GET admin/ajaxInput/{id}` `admin.ajaxInput` | Property create/edit dynamic partial. | Admin middleware; ids 0/1/2 return correct partial HTML; unexpected id behavior captured. |
| Admin AJAX | `GET getDistricts/{id}` `address.getDistricts` | Admin city-to-district select. | Admin middleware; JSON format compatible with Select2. |
| Admin AJAX | `GET getNeighborhoods/{id}` `address.getNeighborhoods` | Admin district-to-neighborhood select. | Admin middleware; JSON format compatible with Select2. |
| Admin bank AJAX | `GET admin/getbankId/{id}` `admin.getBankDepositRatio` | Bank deposit-ratio lookup. | Admin middleware; JSON numeric deposit. |
| Admin banks | `GET admin/banks` `admin.banks.index` | Bank list. | Admin middleware; rows, edit/delete buttons, create link. |
| Admin banks | `GET admin/banks/create` `admin.banks.create` | Bank create form. | Required fields, active/completed visibility toggles. |
| Admin banks | `POST admin/banks` `admin.banks.store` | Bank create submit. | Validation through `StoreBankRequest`; log entry; redirect/status. |
| Admin banks | `GET admin/banks/{bank}` `admin.banks.show` | Resource show redirect. | Redirects to index. |
| Admin banks | `GET admin/banks/{bank}/edit` `admin.banks.edit` | Bank edit form. | Active-post warning/locks, fields populated. |
| Admin banks | `PUT/PATCH admin/banks/{bank}` `admin.banks.update` | Bank update submit. | Checkbox false handling, validation, log entry, redirect/status. |
| Admin banks | `DELETE admin/banks/{bank}` `admin.banks.destroy` | Bank delete button/form. | CSRF/method spoofing, deletion constraints/current behavior, redirect/status. |
| Admin documents | `GET admin/documents` `admin.documents.index` | Document/contract list. | Route currently only `web` middleware in route list; verify intended access. Rows and edit/delete controls render. |
| Admin documents | `GET admin/documents/create` `admin.documents.create` | Document create form. | Bank select, Summernote/content editor, active toggle. |
| Admin documents | `POST admin/documents` `admin.documents.store` | Document create submit. | Validation, active checkbox false/true, redirect. |
| Admin documents | `GET admin/documents/{document}` `admin.documents.show` | Resource show. | Controller lacks explicit `show`; verify current 404/405/error baseline or fix later with approval. |
| Admin documents | `GET admin/documents/{document}/edit` `admin.documents.edit` | Document edit form. | Bank relation loads, content editor renders, active state. |
| Admin documents | `PUT/PATCH admin/documents/{document}` `admin.documents.update` | Document update submit. | Validation, checkbox false/true, redirect/status. |
| Admin documents | `DELETE admin/documents/{document}` `admin.documents.destroy` | Document delete route. | Controller lacks explicit `destroy`; verify current error baseline or fix later with approval. |
| Admin properties | `GET admin/properties` `admin.properties.index` | Property/tender list. | Auth and policy; DataTables/search/export; status buttons; clone/delete/edit/image/archive/report links. |
| Admin properties | `GET admin/properties/create` `admin.properties.create` | Multi-step property create form. | Select2, Mapbox, masks, wizard steps, property-type partials, bank/document dependencies, multi-image input preview/removal. |
| Admin properties | `POST admin/properties` `admin.properties.store` | Property create submit. | Validation/current permissiveness, serialized feature fields, address normalization, slug, storage image folder, tender code, short link, log, redirect to image page. |
| Admin properties | `GET admin/properties/{slug}` `admin.properties.show` | Admin property detail. | Auth/policy, countdown, property/post fields, storage images. |
| Admin properties | `GET admin/properties/{property}/edit` `admin.properties.edit` | Property edit form. | Existing values, address selects, contracts, partials, images preview, DRUPART remote call path isolated. |
| Admin properties | `PUT/PATCH admin/properties/{property}` `admin.properties.update` | Property update submit. | Serialized fields, checkbox defaults, duration math, price normalization, logs, Ziraat/DRUPART update path faked locally, redirect to image page. |
| Admin properties | `DELETE admin/properties/{property}` `admin.properties.destroy` | Property delete. | Only passive/non-active tender deletes; pivot detach; soft delete/current behavior. |
| Admin clone | `POST admin/properties/clone/count/{id}` `admin.properties.clone` | Clone action from list. | Count parameter, cloned property/post, copied storage images, unique slug/code/tender/short link. |
| Admin status | `GET admin/setTenderStatusActive/{id}` `admin.setTenderStatusActive` | Activate tender. | Auth/policy; publish time set; status 1; Ziraat remote API path must be faked. |
| Admin status | `GET admin/setTenderStatusPassive/{id}` `admin.setTenderStatusPassive` | Deactivate tender. | Cannot deactivate started tender; status 0 for allowed; Ziraat remote API path must be faked. |
| Admin image | `GET admin/properties/image/{slug}` `admin.imagePage` | Dropzone image management page. | Existing media JSON, thumbnails, finish button. |
| Admin image upload | `POST admin/properties/imageUpload/{slug}` `admin.imageUpload` | Dropzone upload. | Multipart `file`, Intervention resize, storage write, JSON `{valid,id}`. |
| Admin image delete | `POST admin/properties/imageDelete/{slug}` `admin.imageDelete` | Dropzone remove. | `_image` payload deletes correct storage file, JSON `{valid}`. |
| Admin archive | `GET admin/archive-files/{slug}` `admin.archiveFiles.index` | Archive file page. | Existing archive files, URLs, upload/download/delete controls. |
| Admin archive upload | `POST admin/archive-files/{slug}` `admin.archiveFile.upload` | Archive Dropzone upload. | Folder creation, `ArchiveFile` row, storage write, JSON `{valid,id}`. |
| Admin archive delete | `DELETE admin/archive-files/{slug}` `admin.archiveFile.delete` | Archive delete. | `_image` id deletes row and storage file, JSON valid. |
| Admin archive download | `POST admin/archive-files/{slug}/download` `admin.archiveFile.download` | Archive download. | `_archivefile` id downloads original filename, headers correct. |
| Admin PDF | `GET admin/tenderReportDownload/{id}` `admin.getTenderReportPdf` | Finished tender report PDF download. | DOMPDF renders A4 portrait with remote images enabled; winner/offers/views data; filename `ihale-sonucu-{code}.pdf`. |
| Admin users | `GET admin/users` `admin.users.index` | User list. | Admin/employee role filtering, create/edit/delete/custom mail links. |
| Admin users | `GET admin/users/create` `admin.users.create` | User create form. | Active tender permission checkboxes, roles, company fields. |
| Admin users | `POST admin/users` `admin.users.store` | User create submit. | Validation, slug, password hash, role restriction for employee, post permissions, queued mail, SMS, notification logs. |
| Admin users | `GET admin/users/{user}/edit` `admin.users.edit` | User edit form. | Current user fields and active tender permission state. |
| Admin users | `PUT/PATCH admin/users/{user}` `admin.users.update` | User update submit. | Validation, optional password, role restriction, permission sync, permission mail/SMS only for new grants, logs. |
| Admin users | `DELETE admin/users/{user}` `admin.users.destroy` | User delete. | Delete behavior including model deleting hook/pivots/logs. |
| Admin users/PDF | `GET admin/users/getBankContract/{id}` `admin.users.getBankContract` | Custom mail bank contracts AJAX. | Returns post, bank, active contracts plus propturk contracts and `is_checked` flags. |
| Admin users/mail | `GET admin/users/sendCustomMail/{user}` `admin.users.sendCustomMail` | Custom mail form. | Post select, contract AJAX, submit controls. |
| Admin users/mail | `POST admin/users/sendCustomMailUser/{user}` `admin.users.sendCustomMailUser` | Custom mail submit. | Contract placeholder replacement, DOMPDF generation, archive files, queued mail, failure if no contracts. |
| Admin logs | `GET admin/logs` `admin.logs` | Log viewer. | `can:show-logs` policy/gate, vendor view renders, log file selection works. |
| Admin logs | `GET admin/logs/mailSms` `admin.logs.mailSms` | Mail/SMS notification log list. | Admin middleware; rows link to mail view/PDF archive download. |
| Admin logs | `GET admin/logs/mailView/{log}` `admin.logs.logMailView` | Render logged mail. | Markdown/mail view renders correct notification log. |
| Admin logs/PDF zip | `GET admin/logs/logMailPdfsDownload/{log}/{user}/{post}` `admin.logs.logMailPdfsDownload` | Download archived contract PDFs zip. | Finds archive files, creates/downloads zip from `public/storage/mail_file_archive/...`; missing files behavior captured. |
| API/JWT | `POST api/rest/user/authenticate` | JWT authentication. | Valid `is_admin == 3` user returns token; invalid credentials 400; non-api user unauthorized; validation response remains 200 with error body as baseline. |
| API/JWT | `GET api/rest/realty/all` | Protected Ziraat realty feed. | Requires bearer JWT; invalid/expired/missing token JSON; valid token returns UTF-8 JSON, image URLs, city/district ids, empty-bank message. |
| Broadcast | `GET/POST/HEAD broadcasting/auth` | Private channel auth. | Authenticated user authorized for `App.Models.User.{id}` and `posts.{postId}` only when pivot permission exists; denied cases. |
| WebSockets | `GET laravel-websockets` | Websocket dashboard. | Dashboard auth middleware; page and assets render. |
| WebSockets | `GET laravel-websockets/api/{appId}/statistics` | Dashboard statistics AJAX. | Authorized response format. |
| WebSockets | `POST laravel-websockets/auth` | Dashboard auth. | Authorized dashboard login/auth behavior. |
| WebSockets | `POST laravel-websockets/event` | Dashboard event send. | Event dispatch works locally. |
| WebSockets | `POST laravel-websockets/statistics` | Statistics ingest. | Local websocket server can record stats. |

## In-Page Function Matrix

| Page/view | Functions that must not be missed |
| --- | --- |
| `resources/views/layout/include-js.blade.php` | Favorite AJAX click handler using `updateFavoritePosts/{slug}`; cookie/lazy scripts; CSRF headers. |
| `resources/views/search-component/search-component.blade.php` | Search form GET parameters, min/max masking, city/district selectors, Ziraat selector behavior. |
| `resources/views/home/index.blade.php` and card partials | Tender card links, favorite buttons, countdown timers, image fallback, completed/active/non-offered sections. |
| `resources/views/property/index.blade.php` | Bid form, fast-buy button, login CTA, SMS activation CTA, permission mail modal/action, parcel external link, gallery/lightbox, private Echo listener `posts.{id}`, countdown redirects. |
| `resources/views/user/home.blade.php` | Profile edit link and user data display. |
| `resources/views/user/edit.blade.php` | Profile update form, password optional flow, SMS permission checkbox, company fields, validation rendering. |
| `resources/views/user/account-activation.blade.php` | SMS code form, resend SMS disabled timer/button. |
| `resources/views/user/offer-favorite.blade.php` | Four tender tabs, row-click navigation, DataTables export/print/PDF buttons, countdowns. |
| `resources/views/admin/layout/*` | Admin navigation links, logout, CSS/JS includes, DataTables/SweetAlert/Summernote/Dropzone dependencies. |
| `resources/views/admin/properties/index.blade.php` | Create/edit/show/delete, activate/passive, clone count modal/form, image page, archive files, tender report PDF, DataTables controls. |
| `resources/views/admin/properties/create.blade.php` | Wizard steps, select2 city/district/neighborhood AJAX, property-type partial AJAX, bank deposit AJAX, bank document/contract selection, map/masks, multi-image preview/remove, numeric calculations. |
| `resources/views/admin/properties/edit.blade.php` | Same create-page functions plus existing address/contract/image data and update route. |
| `resources/views/admin/properties/property-photo.blade.php` | Dropzone upload success/error, mock existing files, removedfile AJAX delete, finish link. |
| `resources/views/admin/properties/archive-files.blade.php` | Archive upload, delete, download buttons and generated URLs. |
| `resources/views/admin/properties/show.blade.php` | Admin detail display, countdown, image access. |
| `resources/views/admin/banks/index/create/edit.blade.php` | Bank create/update/delete, active/completed toggles, active-post restrictions. |
| `resources/views/admin/documents/index/create/edit.blade.php` | Contract CRUD, Summernote/content editor, active toggle, bank select. |
| `resources/views/admin/users/index/create/edit/send-custom-mail.blade.php` | User CRUD, role selection, tender permission checkboxes, custom mail post select, get-bank-contract AJAX, contract checkboxes, submit. |
| `resources/views/vendor/laravel-log-viewer/*.blade.php` | Log viewer and mail/SMS log table, mail view links, PDF zip download. |
| `resources/views/mail/*` and `resources/views/mail/pdf-templates/*` | Queued mail templates and PDF templates render with Turkish characters, generated contracts, remote/storage images. |
| `resources/views/welcome.blade.php` | Demo Echo public channel `EventTriggered`; verify if still intentional or dead page. |

## Non-HTTP Work Matrix

| Area | Artifact | Local verification required |
| --- | --- | --- |
| Scheduler | `app/Console/Kernel.php` | `tender:everyminute` every minute, `tender:offerrequest` every six hours, `php artisan queue:work --once` every minute. Verify with local scheduler run/logs after faking mail/SMS. |
| Queue | Queued mail calls in tender/user flows | Queue driver behavior, failed jobs table, one-shot worker, retry/failure logging. |
| Mail | `app/Mail/*` | Render every mailable with fixtures; fake transport for assertions; Turkish encoding and PDF attachments/base64 payloads. |
| SMS | `app/Helpers/SmsSend.php` | Must be faked locally; helper currently contains Netgsm URL and credentials and uses live `curl`. No upgrade approval until SMS calls are isolated for tests. |
| Broadcast | `TenderOfferValueUpdateEvent`, `GetRequestEvent`, `routes/channels.php`, `resources/js/bootstrap.js` | Private `posts.{postId}` authorization, event name/payload compatibility, Echo/Pusher local websocket on port 6001, dashboard/statistics endpoints. |
| PDF | DOMPDF facade and templates | Contract PDFs, tender report PDFs, mail archive zip download, remote image support, DejaVu/Turkish characters, storage paths on Windows. |
| Storage | Images, archive files, mail PDF archive | `storage:link`, upload folders, delete paths, downloads, path separators on Windows, missing file handling. |
| Data | Migrations/factories/seeders/models | Fresh local DB with users/banks/properties/posts/offers/documents/archive files/notification logs; slugs, casts/serialized arrays, relationships, policies, soft deletes. |
| Assets | Laravel Mix, Echo, jQuery plugins, public assets | `npm run dev`/`prod` compatibility after approved dependency changes; Mapbox/CDN/select2/dropzone/datatables/summernote/lightbox/mask scripts load locally. |

## Upgrade-Blocking Coverage Gaps

These gaps must block a Laravel 12 upgrade sign-off until covered locally:

1. No local fixture pack has been confirmed for admin, employee, regular user, API user (`is_admin == 3`), banks including `propturk` and `ziraatkatilim`, active/passive/completed tenders, offers, documents, archive files, and notification logs.
2. SMS paths call the Netgsm live API directly from `sendSms`; tests must fake or intercept this before running user activation, permission, winner/loser, higher-offer, and reminder flows.
3. Ziraat/DRUPART update calls in property activate/passive/update can call `http://ziraatkatilim-com-tr.drp-dev.com/api/realty-update`; local tests must fake this and verify success/failure branches.
4. Realtime bidding is high risk because `beyondcode/laravel-websockets` blocks Laravel 12 and `TenderOfferValueUpdateEvent` uses private channels; local websocket dashboard, channel auth, and browser Echo updates must pass before acceptance.
5. JWT API is high risk because `tymon/jwt-auth` blocks Laravel 12; authenticate/protected feed/invalid token behavior must be covered with real local tokens.
6. DOMPDF is high risk for contracts, tender reports, and mail archives; every PDF action must be rendered and opened locally, including Turkish characters and remote/storage images.
7. Upload/delete/download workflows are not covered by route success alone; Dropzone image upload/delete and archive file upload/delete/download need filesystem assertions.
8. `admin.documents.show` and `admin.documents.destroy` routes exist from `Route::resource`, but `DocumentController` has no visible `show` or `destroy` implementation. Baseline behavior must be recorded or routes/controller fixed in an approved implementation pass.
9. `routes/web.php` defines duplicate `kullanici/ihaleler/{slug}` and `kullanici/ihaleler/favoricrud/{slug}` routes. Baseline route resolution must be preserved or duplicates removed only with approval.
10. `tenderReport` renders a PDF template view directly under auth and may require variables depending on template content; verify if it is a real user-facing route or legacy/dev-only.
11. Full browser coverage has not run yet: public pages, auth, user pages, admin pages, DataTables buttons, modals, wizards, Select2, Dropzone, Summernote, Echo, and external/CDN asset behavior still need local browser verification.

## Minimum Local Test Execution Plan

1. Prepare isolated local `.env` and database with faked mail/SMS/HTTP/broadcast where needed; do not touch live services.
2. Run `composer validate`, `php artisan route:list --json`, `php artisan migrate:fresh --seed`, `php artisan view:cache`, and the test suite after implementation approval.
3. Add/execute feature tests for every route group above, including auth/admin policy denial cases.
4. Run browser checks against a local server for all pages and in-page functions listed above.
5. Run filesystem checks for image/archive/PDF upload/delete/download paths.
6. Run queue/scheduler commands with faked mail/SMS and assert notification logs/jobs.
7. Run websocket server locally and verify bid update broadcast from one authenticated browser session to another.
8. Run JWT authenticate and protected realty feed with valid/invalid/expired/missing token cases.