# SME-Hub — Response to Tester Feedback (Rogers, 22 Jul 2026)

Every one of the 7 "remaining issues" was re-tested in a real browser against the
current codebase. **None of them reproduces on up-to-date code.** Most were fixed in
the same release as items 1–5 (which you confirmed as done), so if any still fail
for you, the likely causes are a stale deployment, browser cache, or a test account
that isn't set up for the scenario (details per item below).

Two genuine improvements did come out of your feedback and are now in place:

1. **Judges now have visible navigation to scoring** — a "Your evaluation panels"
   card on the Showcasing page, plus "Score pitches" / "Score entries" buttons on
   event and challenge pages.
2. **Clear guidance instead of error pages** — where you previously could hit a
   blocked/error page (live session, judging pages), you now get a plain-language
   message explaining why and what to do next.

---

## Issue-by-issue: status and how to re-test

### 6. Innovation pitch can't be scored by a judge — ✅ Working (navigation improved)

**Important precondition:** a judge can only score events/challenges they have been
added to. An administrator must add the judge account to the event's **evaluation
panel** (Edit event → Eligibility & panel). A judge on no panel sees an empty
judging queue — that is expected, not a bug.

**How to test:**
1. Ask an admin to add your judge account to a showcase event's evaluation panel.
2. Sign in as the judge.
3. On the **Dashboard**, find the "SME-Hub judge queue" widget → it lists the event.
4. Or open **SME-Hub → Showcasing** → the "Your evaluation panels" card lists it.
5. Open the event → click **Score pitches** → pick an application → set the score
   slider, add comments → **Save** → expect "Scores saved."
6. Negative check: open a scoring page for an event you are *not* on the panel of —
   you should now get a friendly explanation (not an error page) telling you to ask
   the organiser to add you.

### 7. SME drop-down not accessible by some users — ✅ Working (role-dependent by design)

The SME-Hub menu is shown only to SME-Hub roles: entrepreneur, mentor, investor,
buyer, service provider, partner, judge, SME admin, and platform admins. Users with
other roles (e.g. learner, scholar) intentionally do not see it.

**How to test:**
1. Sign in with an SME-Hub role account (entrepreneur, buyer, judge, …).
2. Desktop: the **SME-Hub** dropdown appears in the top navigation.
3. Mobile (or a narrow window): open the hamburger menu → an **SME-Hub** section
   expands with the same links.
4. If a specific account doesn't see it, check that account's role first — send us
   the email and we'll confirm the role.

### 8. "Express Interest by Email" button unfunctional — ✅ Working

The button was redesigned: instead of opening your computer's email program
(a `mailto:` link, which does nothing on machines without a configured mail app),
it now sends the interest **in-app and by email automatically**.

**How to test:**
1. Sign in as a buyer (must be signed in — the public page asks you to sign in first).
2. Open any marketplace product you don't own.
3. Optionally type a message, click **Express interest**.
4. Expect the banner: "Your interest has been sent to the seller — they'll receive
   it in-app and by email."
5. The seller receives an in-app notification and an email.

### 9. 2FA not functional — ✅ Working (check device clock if codes are rejected)

Enrol + sign-in verification passes end-to-end with an authenticator app.
TOTP codes are only valid for ±30 seconds, so the usual cause of "registers on the
phone but sign-in fails" is a **clock difference** between the phone, the computer,
and the server — or typing the code after it rotated.

**How to test:**
1. Sign in → **Account → Security** (`/accounts/mfa/`) → **Add authenticator**.
2. Scan the QR with Microsoft/Google Authenticator, enter the current 6-digit code
   to confirm enrolment.
3. Sign out, sign back in → you're taken to the verification step → enter a
   **fresh** code (enter it as soon as it appears, not near the end of its 30 s life).
4. If it still fails: enable "set time automatically" on the phone, and tell us the
   exact time shown on the phone vs. the computer when it failed.

### 10. Brute force protection not implemented — ✅ Implemented (lockout, no CAPTCHA)

Protection exists as an **account/IP lockout**, not a CAPTCHA: 5 failed sign-in
attempts lock the account (and the source IP) for 15 minutes with an "Account
temporarily locked" page.

**How to test:**
1. Use a throwaway test account — **not your own** (the lockout also applies to
   your IP address, so you'll lock yourself out of other accounts too).
2. Enter a wrong password 5 times.
3. Expect the "Account temporarily locked" page; even the correct password is
   refused until the cooloff expires.
4. If the client specifically requires a CAPTCHA in addition to lockout, that is a
   feature request — flag it and we'll scope it.

### 11. Direct navigation to SME unavailable — ✅ Working

**How to test:**
1. Sign in with an SME-Hub role.
2. Click **SME-Hub** in the top navigation → the first entry, **My SME-Hub**, goes
   straight to the SME-Hub workspace (`/smehub/`).
3. The same entry exists in the mobile menu drawer.

### 12. Live session button redirects to an error page — ✅ Working (guidance added)

The **Join live session** button only appears on *live*, virtual/hybrid events, and
only for people allowed to join: confirmed participants, the evaluation panel, and
organisers/admins.

**How to test:**
1. Sign in as a confirmed participant (an entrepreneur whose application on the
   live event was confirmed), a panel judge, or an admin.
2. Open the live event → click **Join live session** → it opens the session link.
3. If the organiser hasn't attached a session link yet you get: "The live session
   link isn't available yet — please check back shortly." (not an error).
4. If someone without access follows the join link directly, they now see a
   message explaining who may join and how to take part (apply / await
   confirmation) — no more error page.

---

## Test accounts

Use dedicated demo/test accounts for each role rather than personal ones — this
matters for #6 (panel membership), #7 (role decides the menu), and #10 (lockout
also locks your IP). If you need an account for a specific role, or a judge added
to an event panel, ask and we'll set it up.