Panel Test Checklist

Authentication & Security 10

Fresh install shows license agreement page

License acceptance persists after container restart

Default admin/admin login works

Account locks after 5 failed attempts (15-minute lockout)

Password change requires current password

Plaintext passwords auto-upgrade to bcrypt on login

Session timeout after configured inactivity period

CSRF token validation on all forms

Passkey (WebAuthn) registration

Passkey login as 2FA

Notes for Authentication & Security:

DNS / Portal Management 6

Add Xtream portal (URL, username, password)

Add Stalker portal

Add M3U portal

Edit existing portal

Delete portal

Type badges display correctly (Xtream/Stalker/M3U)

Notes for DNS / Portal Management:

Devices 3

Connected devices list populates

Device IP and user-agent display

Device last-seen timestamp updates

Notes for Devices:

Welcome Messages 2

Edit message_one, message_two, message_three

Changes persist and show in API response

Notes for Welcome Messages:

Announcements 4

Create announcement with title, content, start/end dates

Status badges (Active/Scheduled/Expired) display correctly

Edit announcement

Delete announcement

Notes for Announcements:

Analytics 4

Request log populates

IP geolocation resolves

Storage size displays

Recent activity timeline

Notes for Analytics:

Settings 5

Panel name / brand name editable

Security settings (bcrypt cost, session timeout, force HTTPS)

Credentials change with current password verification

Security notice shows for default/plaintext credentials

Rebrander API key field

Notes for Settings:

Rebrand 14

API key required prompt when unconfigured

Theme grid loads with previews (CDN or proxied)

Theme search/filter works

"Load more" pagination in theme grid

Custom colours mode toggles palette fields

Image upload shows thumbnail preview

Image upload clear (×) button works

Panel URL auto-detects full path (subdirectory support)

Panel URL test button returns success (✓)

APK version dropdown shows "Extended" only

Signing key auto-generated on first visit

Build submits and polls for status

Build complete → download link works

New Build button resets form

Notes for Rebrand:

Builds 8

Builds list displays with metadata

Direct link (copy) uses correct subdirectory path

Direct link downloads .apk (not 403)

Download via panel button works

Set as production / clear production flag

Rename build (file + DB)

Delete build (file + DB)

Clear all builds

Notes for Builds:

VPN 2

Add VPN configuration

Edit/delete VPN entries

Notes for VPN:

Sports 2

Sports fixtures load from API

Channel matching works against configured portals

Notes for Sports:

Webview 1

Add/edit/delete webview entries

Notes for Webview:

API Endpoint 4

HMAC signature validation (rejects unsigned requests)

getDevices_v3 returns encrypted portal data

checkAppInfo_v2 returns activation response

addDevice_v2 registers device

Notes for API Endpoint:

Subdirectory Hosting 5

Panel works when installed in a subdirectory (e.g., /Trvp/)

All navigation links use correct base path

Builds direct links include subdirectory

Panel URL in rebrand includes subdirectory

Theme previews load correctly

Notes for Subdirectory Hosting:

Docker Deployment 5

docker compose up -d --build starts cleanly

ionCube loader active (php -m | grep ionCube)

Database persists across container rebuilds

Builds directory writable by www-data

Config.ini writable for settings page

Notes for Docker Deployment:

Panel Connectivity & Activation 4

App launches without crashing, loads portal data from the configured panel URL

Sidebar Search row displays correctly, no longer overlapping the logo

Panel API calls succeed (api.php) — confirm HMAC-signed requests return 200 with decrypted portal data

Unsigned/old-app-version requests correctly get rejected with 403 (verifies key rotation took effect)

Notes for Panel Connectivity & Activation:

VPN 5

VPN menu row appears and is navigable via D-pad

Panel-provided VPN profiles connect successfully

Custom .ovpn import: browse local/USB files, import a config, optionally enter username/password, confirm it appears in the VPN list and connects

Imported VPN profile persists across app restarts (encrypted store)

D-pad navigation around the new import row doesn't break existing Search/Disconnect focus paths

Notes for VPN:

Sports 4

Sports Guide (WebView) shows/hides correctly based on panel config, and only one of Sports Guide / Sports Fixtures is ever active at a time

Sports Fixtures: browse leagues → fixtures list populates

Tap a fixture → "channels carrying this event" dialog opens, shows matched channels or a clear "no matches" message

Fixtures screen background/title and the channel-match dialog render in the currently selected theme's colors, not default black/white

Notes for Sports:

Theming 3

Switch themes from the panel and rebuild — confirm colors actually change across: sidebar, Sports Fixtures screen, VPN import dialogs, and the panel welcome/announcement popup

Switch themes a second time (A → B → A) and confirm no leftover/stuck colors from a previous theme

App icon, banner, and logo stroke color reflect the theme where applicable

Notes for Theming:

QR Onboarding 2

QR code renders correctly under "Service" on the Add-Playlist screen

Scanning the QR with a phone completes pairing and populates playlist credentials on the TV

Notes for QR Onboarding:

General Regression 3

APK installs at the expected size (~66MB) — flags if native libs got bloated again

No FATAL crashes in logcat during normal navigation (menu, playlists, playback start)

Existing playlists/portals still load channels and EPG normally after all these changes

Notes for General Regression: