1Business context

KeyVault is a multi-DRM licence service console — the back office a streaming company uses to protect content. Operators register content keys, issue Widevine / PlayReady / FairPlay licence tokens with business rules (expiry, rentals, device binding, output protection) and audit every licence decision.

Sign in with OTP and roles, create API keys (secret shown once), register titles with 32-hex content keys, issue Widevine, PlayReady and FairPlay licence tokens with expiry, rental, device-binding and HDCP rules, then redeem them on simulated devices and audit every grant or denial.

2Users & roles

👤 Admin (admin@keyvault.dev) — everything, incl. API keys, services and account
👤 Content Ops (ops@keyvault.dev) — content keys and tokens
👤 Read-only (viewer@keyvault.dev) — dashboards and reports

3Modules & screens

Screen	Route	What it does
Login	/apps/drm	Email/password, then OTP 135790; lockout after 3 failures
Dashboard	/apps/drm/dashboard	KPIs, 7-day granted/denied chart, environment switch
Content & keys	/apps/drm/content	Titles, 32-hex content keys, KIDs, reveal and rotation
Token generator	/apps/drm/tokens	DRM, expiry (≤ 30 days), rental, device, HDCP, security level
Playback simulator	/apps/drm/simulator	Redeem tokens on devices with time travel; grant or KV-code denial
Reports	/apps/drm/reports	Filterable, paginated licence log with CSV export
Services	/apps/drm/services	DRM systems per environment and endpoint URLs
API keys	/apps/drm/api-keys	Create (secret shown once), revoke, regenerate
Account	/apps/drm/account	Token balance, top-up packs and roles

4Main end-to-end journey

Key to licence

Sign in as admin with OTP 135790
Create API key Storefront and store the secret
Issue a Widevine token for Nebula Drift bound to a1b2c3d4e5f60718 with HDCP required
Redeem on Android phone with that device ID
Redeem again on Chrome desktop
Open Reports

Expected: First redemption grants a LIC- licence; the second is denied with KV-420; both appear in Reports, newest first

5Business rules & validations

Two-step login & lockoutBeginner
Wrong password shows attempts left in drm-login-error; the 3rd failure locks the form (drm-unlock resets). Correct password leads to drm-otp-form; OTP 135790 signs in.
Role-based accessIntermediate
ops@ and viewer@ see access-denied on API keys and Account; viewer@ gets tokens-readonly and a disabled generate-token button.
Show-once secretsIntermediate
create-key opens secret-modal with secret-value (kv_live_…); after secret-done only key-masked-<id> (last 4 chars) remains. revoke-<id> needs confirm-revoke.
Hex validationBeginner
save-title with a 31-char or non-hex key shows error-title-key (KV-201); generate-key fills 32 hex and key-length shows 32 / 32.
Token rulesAdvanced
Expiry +2592001 fails with KV-204 (max 30 days); play duration above the rental period fails with KV-205; a 15-char device ID fails with KV-202.
Account-level blockersIntermediate
No active API key → token-error KV-101; FairPlay disabled in Production → KV-301; balance 0 (drain-balance) → KV-402.
Licence decisionsAdvanced
In the simulator, a wrong device ID gives KV-403, HDCP on Chrome desktop gives KV-420, Widevine level 5 on a phone gives KV-421, and moving sim-offset past expiry gives KV-410.
Reports & exportBeginner
Filter report-drm / report-result, search, walk report-next until disabled, and export-csv downloads keyvault-licences.csv.

6Test data & credentials

URL: /apps/drm
Admin: admin@keyvault.dev / Drm@123
OTP: 135790
Other roles: ops@ · viewer@keyvault.dev
Key format: 32 hex · device 16 hex

7Glossary

DRM: Digital Rights Management — encrypts content and controls playback via licences
Widevine / PlayReady / FairPlay: Google, Microsoft and Apple DRM systems
Content key / KID: 128-bit key (32 hex) that encrypts a title, and its key ID
HDCP: Output protection for connected displays
Licence token: Signed permission a player redeems for a licence

8Watch-outs for automation

⚠️Secrets are shown only once — assert the modal, then the masked value
⚠️Use the simulator's time slider instead of waiting for expiry
⚠️Checks apply in order: DRM enabled → device supports DRM → device ID → expiry → rental → HDCP → security level

9Suggested test strategy

1 · Smoke

P1 positive and end-to-end cases — run on every build.

2 · Regression

All cases, incl. 5 negative and 5 edge — run before release.

3 · End-to-end

Full user journeys — run nightly.

Start with these smoke cases

KEYVAULTDRM-01 — Two-step admin sign-in
KEYVAULTDRM-02 — Issue a Widevine token
KEYVAULTDRM-03 — Redeem a token successfully
KEYVAULTDRM-E2E-01 — Key to licence
KEYVAULTDRM-E2E-02 — Environment and service rules

All 18 test cases →Ready-made suites:Selenium Playwright Cypress

🔐 KeyVault DRM