--- id: TST-ACC-TRX-012 title: Payments suite kind: api-lifecycle product_area: accounting module: transactions revision: 1 status: draft source_sha: services-accounting: f47cb263875bbc0c5640fba7dae6785ec32695f8 repository: services-accounting files: - modules/transactions/tests/e2e/payments.e2e.spec.js implements: - ATS-ACC-TRX-006-01 - ATS-ACC-TRX-013-01 - ATS-ACC-TRX-015-06 - ATS-ACC-TRX-015-08 implements_parts: - scenario: ATS-ACC-TRX-006-01 assertion: it refuses a float amount (400) provenance: test source: >- services-accounting:modules/transactions/tests/e2e/payments.e2e.spec.js#it refuses a float amount (400) - scenario: ATS-ACC-TRX-013-01 assertion: >- it is refused the allocate and reallocate routes without accounting.payments.update, and the void route without .void (403) provenance: test source: >- services-accounting:modules/transactions/tests/e2e/payments.e2e.spec.js#it is refused the allocate and reallocate routes without accounting.payments.update, and the void route without .void (403) - scenario: ATS-ACC-TRX-015-06 assertion: >- it sets, then clears, the memo and notes of a succeeded payment when the console sends them blank (PUT .../details) provenance: test source: >- services-accounting:modules/transactions/tests/e2e/payments.e2e.spec.js#it sets, then clears, the memo and notes of a succeeded payment when the console sends them blank (PUT .../details) - scenario: ATS-ACC-TRX-015-08 assertion: >- it is refused the batch and details routes without accounting.payments.update (403) provenance: test source: >- services-accounting:modules/transactions/tests/e2e/payments.e2e.spec.js#it is refused the batch and details routes without accounting.payments.update (403) environment: local implementation_state: implemented latest_result: not-run latest_run_at: null latest_run_ref: null conformance: not-verified estimated_minutes: 3 isolation: >- Suite-marked records in the prepared local test database; fixture teardown removes owned records. provenance: test source: 'services-accounting:modules/transactions/tests/e2e/payments.e2e.spec.js' evidence: - provenance: test source: 'services-accounting:modules/transactions/tests/e2e/payments.e2e.spec.js' assertion_titles: - the payment routes (end to end) - the reassign and details routes - 'changes the payment’s reference number, memo and notes (PUT .../details)' - >- sets, then clears, the memo and notes of a succeeded payment when the console sends them blank (PUT .../details) - >- moves the payment to another open batch (PUT .../batch), and refuses a closed one batch_not_open - >- lists the reassign action for the administrator and performs it through the action route - a caller without the route’s permission - >- is refused POST /payments/{tenantId} without accounting.payments.create (403) - >- is refused GET /payments/{tenantId}/{id}, the list, the unapplied read and the intent read without accounting.payments.read (403) - >- is refused the batch and details routes without accounting.payments.update (403) - >- is refused the allocate and reallocate routes without accounting.payments.update, and the void route without .void (403) - >- is refused the actions routes without accounting.payments.read, and the void action without accounting.payments.void (403) - tenancy - answers another tenant’s payment 404 exactly as one that does not exist - refuses a path naming a tenant the signed context does not carry (403) - 'a body the contract refuses, before any command runs' - refuses a missing Idempotency-Key (400) - refuses a float amount (400) - >- refuses a payment naming no batch in a unit with no batch assignment rule (409 batch_required) - >- refuses more than 500 allocations in one command and an idempotency key longer than 200 characters (400): the contract’s limits - refuses a check with no bank account and a card with no token (400) - 'the receive, allocate, reallocate and void flow' - 'received the check: 1,000,000, succeeded, 6000 allocated, 4000 unapplied' - replays the same key and body as the same payment - allocates the rest to the invoice through POST .../allocate - 'reallocates through POST .../reallocate, taking the 4000 back' - >- lists the void, bounce and reassign-batch actions for the offline payment, and voids it through POST .../actions/void - refuses a void of a voided payment 409 payment_not_live - the card tender through the dummy processor - >- answers a succeeded card payment, with the void action (a processor void, package 2) - answers a declined card 400 processor_declined - >- answers a lost answer 409 tender_uncertain, the intent readable and processing - the reads - >- lists the tenant’s payments newest first with a cursor, filtered by method - lists Ada’s unapplied payments imports: - >- const { parseBody, proxyEvent } = require('@rhythmsoftware/macroservice-testing/signed-context'); - 'const { stage } = require(''@rhythmsoftware/macroservice-testing/stage'');' - >- const { accountingApi, accountingGrant } = require('../../../books/tests/e2e/e2e-security'); - >- const { PERMISSION_MISSING, accessRefusalOf, requireOk } = require('../../../books/tests/e2e/configuration-e2e-support'); - '} = require(''../integration/payments-fixtures'');' - "\t\t\tctx: ctx ?? session.require().administrator," - "\t\tconst { invoice } = session.require();" - "\t\tsession.require();" - "\t\t\t\tid: received.require().id," - "\t\t\tconst payment = received.require();" - "\t\t\t\tid: received.require().id," - "\t\t\t\tid: received.require().id," - "\t\t\tconst listed = await call('GET', ACTIONS, { id: received.require().id });" - "\t\t\t\tid: received.require().id," - "\t\tconst outsider = () => session.require().outsider;" - "\t\tconst id = () => received.require().id;" - "\t\t\tconst { intent_id: _intent, ...rest } = received.require();" - "\t\t\tconst reader = session.require().reader;" - "\t\t\tconst reader = session.require().reader;" - "\t\t\tconst reader = session.require().reader;" - "\t\t\tconst [absent, other] = [await call('GET', ONE, { id: NO_SUCH_PAYMENT }), await call('GET', ONE, { id: foreign.require().id })];" - "\t\t\tconst answer = await call('GET', ONE, { tenant: OTHER, id: foreign.require().id, ctx: session.require().reader });" - "\t\t\tconst payment = received.require();" - "\t\t\tconst { invoice } = session.require();" - "\t\t\texpect(again.id).to.equal(received.require().id);" - "\t\t\tconst { invoice } = session.require();" - "\t\t\t\t\tid: received.require().id," - "\t\t\tconst current = requireOk(await call('GET', ONE, { id: received.require().id }), 'reading');" - "\t\t\tconst id = received.require().id;" - "\t\t\tconst answer = await call('POST', `${ONE}/void`, { id: received.require().id, body: { reason: 'Again' }, key: 'e2e-void-again' });" test_double_declarations: [] --- # Payments suite ## Verification Boundary The suite exercises transaction commands and database protections in the local prepared test environment. Registration records the existing executable file; it does not report a run or establish product approval. ## What This Suite Proves Its cited assertions contribute evidence for invalid money cannot become a receipt; reversal needs authority and valid input; descriptive correction cannot erase required explanation; update access controls movement and details. The structured assertion bindings identify which parts of combined scenarios it executes. ## What It Does Not Prove Local commands and route invocations do not establish deployed routing, live processor guarantees or the complete staff browser experience. An unbound feature chain remains proposed, and this registration carries no execution result. ## Real Dependencies and Test Doubles The suite uses the imported commands, route handlers or persistence code against the local test database. Fixture helpers supply accounting context; any stepped clock, dummy processor or substituted external client is retained in the evidence declarations. ## Must Not Be Doubled The command or persistence behavior under assertion and its relevant database protections must remain real. Substituting the final financial result removes evidence of transactional effects.