shopdb-flask/.claude/setup/VM-USERS.md

# VM User Accounts for Testing

The SFTest VM has two user accounts configured for different testing scenarios.

---

## User Accounts

### 1. SupportUser (Administrator)

**Username:** SupportUser
**Password:** vos313
**Privileges:** Administrator
**SSH:** Enabled
**MCP Server:** `vm` (primary)

**Use for:**
- Installing agent service (requires admin)
- Configuring Windows services
- Installing software/dependencies
- Modifying system settings
- Reading system logs
- Managing Windows Firewall

**Example tasks:**
```
"Install the agent on VM as admin"
"Configure Windows Firewall on VM"
"Check Windows Event Logs on VM"
"Install dependencies on VM"
```

---

### 2. shopfloor (Standard User)

**Username:** shopfloor
**Password:** vos313
**Privileges:** Standard user (matches shop floor PCs)
**SSH:** Enabled
**Auto-login:** Yes (automatically logs in on boot/reboot)
**MCP Server:** `vm-shopfloor`

**Use for:**
- Testing agent behavior as standard user
- Testing tray application (runs as user)
- Simulating shop floor environment
- Testing operator report submission
- Verifying user-level permissions
- Testing endpoint collector scenarios

**Example tasks:**
```
"Test agent as shopfloor user"
"Check if tray is running for shopfloor user"
"Submit operator report as shopfloor"
"Verify shopfloor can access shared drives"
```

---

## MCP Configuration

Both users are configured in `.claude/mcp-servers.json`:

```json
{
  "mcpServers": {
    "vm": {
      "command": "npx",
      "args": ["...", "--user", "SupportUser", "--password", "vos313"]
    },
    "vm-shopfloor": {
      "command": "npx",
      "args": ["...", "--user", "shopfloor", "--password", "vos313"]
    }
  }
}
```

---

## When to Use Each Account

### Use SupportUser (vm) for:
- Initial agent installation
- Service management (`sc.exe`, `Get-Service`)
- System-level configuration
- Installing updates/patches
- Deployment tasks
- Administrative testing

### Use shopfloor (vm-shopfloor) for:
- **Realistic endpoint testing** (shop floor PCs run as standard users)
- Tray application testing (tray runs in user context)
- Operator report submission
- User-level permissions verification
- Non-admin agent behavior
- Production environment simulation

---

## Testing Workflow

### Complete Agent Test (Both Users)

```
You: "Test agent installation and operation with both admin and standard user"

Claude:
1. [vm (SupportUser): Install agent service]
2. [vm (SupportUser): Start agent service]
3. [vm (SupportUser): Verify service running]
4. [vm-shopfloor (shopfloor): Check if tray appears]
5. [MySQL: Create fleet alert]
6. [vm-shopfloor (shopfloor): Verify tray notification]
7. [vm-shopfloor (shopfloor): Submit operator report]
8. [MySQL: Verify report received]
```

### Tray-Only Testing (Standard User)

```
You: "Test the tray application as a standard user"

Claude:
1. [vm-shopfloor: Check if tray process running]
2. [vm-shopfloor: Read tray log file]
3. [MySQL: Create test alert]
4. [vm-shopfloor: Verify notification appears]
5. [vm-shopfloor: Test operator report UI]
```

---

## SSH Connection Testing

### Test SupportUser
```bash
ssh SupportUser@192.168.100.10 "whoami"
# Output: SFTest\SupportUser

ssh SupportUser@192.168.100.10 "net localgroup administrators"
# Should show SupportUser in list
```

### Test shopfloor
```bash
ssh shopfloor@192.168.100.10 "whoami"
# Output: SFTest\shopfloor

ssh shopfloor@192.168.100.10 "net localgroup users"
# Should show shopfloor in list
```

---

## Permission Differences

| Task | SupportUser | shopfloor |
|------|-------------|-----------|
| Install service | ✓ Yes | ✗ No |
| Start/stop service | ✓ Yes | ✗ No (needs admin) |
| Read service logs | ✓ Yes | △ Limited |
| Run tray app | ✓ Yes | ✓ Yes |
| Submit reports | ✓ Yes | ✓ Yes |
| Access user profile | Own only | Own only |
| Windows Event Log | ✓ Full access | △ Limited |
| Install software | ✓ Yes | ✗ No |
| Modify registry | ✓ Yes | △ HKCU only |

---

## Realistic Shop Floor Testing

**Shop floor PCs typically run as standard users**, so testing with the shopfloor account ensures:

- Agent behavior matches production
- Tray permissions are correct
- User-level features work
- No admin escalation issues
- File access permissions correct
- Network access verified

**Best practice:**
```
1. Install/configure agent as SupportUser (admin)
2. Test operation as shopfloor (standard user)
3. This matches actual deployment (IT installs, users run)
```

---

## Claude Code Usage

### Ask Claude to use specific user:

**Admin tasks:**
```
"Install agent on VM" (uses vm/SupportUser by default)
"Configure agent service on VM as admin"
```

**Standard user tasks:**
```
"Check tray status as shopfloor user"
"Test operator report submission as standard user"
"Verify shopfloor user can see notifications"
```

**Both users:**
```
"Test complete agent flow from installation to user notification"
(Claude will use vm for install, vm-shopfloor for testing)
```

---

## Troubleshooting

### shopfloor SSH fails

**Check if user exists:**
```bash
ssh SupportUser@192.168.100.10 "net user shopfloor"
```

**Verify password:**
```bash
ssh shopfloor@192.168.100.10 "echo 'Connected successfully'"
```

**Check SSH is enabled for both users:**
```bash
# On VM (as admin):
Get-LocalGroupMember -Group "Remote Desktop Users"
# Should show both users or "Everyone"
```

### Service won't start for shopfloor

**Expected!** Standard users can't start/stop services. Use SupportUser:
```bash
ssh SupportUser@192.168.100.10 "sc.exe start ShopDBEndpointAgent"
```

### Tray not visible for shopfloor

**Check if user is logged in:**
```bash
ssh shopfloor@192.168.100.10 "query user"
```

**Tray only shows when user has desktop session.**

---

## Security Notes

### Why Same Password?

Both accounts use `vos313` for simplicity in test environment:
- VM is on isolated internal network (192.168.100.x)
- No internet access
- Test environment only
- Matches actual shop floor password pattern (simple, memorable)

### Production Differences

Production shop floor PCs:
- Domain accounts (not local)
- Different passwords per user
- Group Policy restrictions
- Additional security software
- Network access controls

---

## VM Configuration

**VM Name:** SFTest (Shop Floor Test)
**IP:** 192.168.100.10
**OS:** Windows 11
**Network:** Internal only (192.168.100.x subnet)
**Default User:** shopfloor (auto-login enabled)

### Auto-Login Configuration

**shopfloor user automatically logs in** on VM start/reboot. This means:
- Tray application starts automatically
- No need to manually log in for testing
- Matches shop floor PC behavior (kiosk-like setup)
- Desktop session always available for tray

**To test tray after VM restart:**
```
You: "Restart the VM and verify tray starts automatically"

Claude:
1. [vm (SupportUser): Restart VM]
2. [Wait 60 seconds for boot]
3. [vm-shopfloor: Check tray process running]
4. [vm-shopfloor: Verify tray log shows startup]
```

---

## Summary

**Two users = Two test scenarios:**

1. **SupportUser** - Admin for installation and configuration
2. **shopfloor** - Standard user for realistic endpoint testing

**Both configured in MCP** - Claude can switch between them automatically based on task requirements.

**Realistic testing** - Matches actual shop floor deployment (IT installs as admin, users run as standard)

---

**Updated:** 2026-09-09 (added shopfloor user)