---
id: TST-ACC-TRX-013
title: Refunds suite
kind: api-lifecycle
product_area: accounting
module: transactions
revision: 1
status: draft
source_sha:
  services-accounting: f47cb263875bbc0c5640fba7dae6785ec32695f8
repository: services-accounting
files:
  - modules/transactions/tests/e2e/refunds.e2e.spec.js
implements:
  - ATS-ACC-TRX-012-11
implements_parts:
  - scenario: ATS-ACC-TRX-012-11
    assertion: >-
      it is refused POST /refunds/{tenantId} without accounting.refunds.create
      (403)
    provenance: test
    source: >-
      services-accounting:modules/transactions/tests/e2e/refunds.e2e.spec.js#it
      is refused POST /refunds/{tenantId} without accounting.refunds.create
      (403)
  - scenario: ATS-ACC-TRX-012-11
    assertion: >-
      it is refused approve without .approve, execute without .execute and
      cancel without .create, as a reader (403)
    provenance: test
    source: >-
      services-accounting:modules/transactions/tests/e2e/refunds.e2e.spec.js#it
      is refused approve without .approve, execute without .execute and cancel
      without .create, as a reader (403)
environment: local
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 3
isolation: >-
  Suite-marked records in the prepared local test database; fixture teardown
  removes owned records.
provenance: test
source: 'services-accounting:modules/transactions/tests/e2e/refunds.e2e.spec.js'
evidence:
  - provenance: test
    source: 'services-accounting:modules/transactions/tests/e2e/refunds.e2e.spec.js'
    assertion_titles:
      - the refund routes (end to end)
      - a caller without the route’s permission
      - >-
        is refused POST /refunds/{tenantId} without accounting.refunds.create
        (403)
      - >-
        is refused the read, the list and the actions read without
        accounting.refunds.read (403)
      - >-
        is refused approve without .approve, execute without .execute and cancel
        without .create, as a reader (403)
      - >-
        is refused the execute action without accounting.refunds.execute, as a
        reader (403)
      - tenancy
      - answers another tenant’s refund 404 exactly as one that does not exist
      - refuses a path naming a tenant the signed context does not carry (403)
      - 'a body the contract refuses, before any command runs'
      - >-
        refuses a missing Idempotency-Key, a float amount and an unknown source
        kind (400)
      - 'the request, read, list, execute and cancel flow'
      - >-
        requested the refund: 1,000,000, requested, 1000 by check from the
        payment’s bank account
      - replays the same key and body as the same refund
      - 'reads it and lists it by payment, newest first, with the count'
      - >-
        offers execute and cancel on a requested refund, and nothing once it is
        paid
      - 'pays a refund in the request itself with execute: true'
      - cancels a requested refund through its cancel action with a reason
      - >-
        refuses more than the payment holds unapplied (400 over_refund) and
        executing a paid refund (409 refund_not_requested)
    imports:
      - >-
        const { parseBody, proxyEvent } =
        require('@rhythmsoftware/macroservice-testing/signed-context');
      - 'const { stage } = require(''@rhythmsoftware/macroservice-testing/stage'');'
      - >-
        const { accountingApi, accountingGrant } =
        require('../../../books/tests/e2e/e2e-security');
      - >-
        const { PERMISSION_MISSING, accessRefusalOf, requireOk } =
        require('../../../books/tests/e2e/configuration-e2e-support');
      - >-
        const { receivePayment } =
        require('../../services/payments/payment-receive');
      - '} = require(''../integration/payments-fixtures'');'
      - "\t\t\tctx: ctx ?? session.require().administrator,"
      - "\t\tconst { check } = session.require();"
      - "\t\tconst { foreignCheck } = session.require();"
      - "\t\tconst outsider = () => session.require().outsider;"
      - "\t\tconst id = () => requested.require().id;"
      - "\t\t\tconst { check } = session.require();"
      - "\t\t\tconst reader = session.require().reader;"
      - "\t\t\tconst performed = await call('POST', ACTION, { id: id(), action_id: 'execute', body: {}, ctx: session.require().reader });"
      - "\t\t\tconst [absent, other] = [await call('GET', ONE, { id: NO_SUCH }), await call('GET', ONE, { id: foreign.require().id })];"
      - "\t\t\texpect((await call('GET', ONE, { tenant: OTHER, id: foreign.require().id, ctx: session.require().reader })).status).to.equal(403);"
      - "\t\t\tconst { check } = session.require();"
      - "\t\t\tconst refund = requested.require();"
      - "\t\t\tconst { check } = session.require();"
      - "\t\t\texpect(again.id).to.equal(requested.require().id);"
      - "\t\t\tconst { check } = session.require();"
      - "\t\t\tconst refund = requested.require();"
      - "\t\t\tconst refund = requested.require();"
      - "\t\t\tconst payment = requireOk(await call('GET', '/payments/{tenantId}/{id}', { id: session.require().check.id }), 'reading the payment');"
      - "\t\t\tconst { check } = session.require();"
      - "\t\t\tconst { check } = session.require();"
      - "\t\t\tconst { check } = session.require();"
      - "\t\t\tconst again = await call('POST', `${ONE}/execute`, { id: requested.require().id, body: {}, key: 'e2e-rf-execute-again' });"
    test_double_declarations: []
---

# Refunds suite

## Verification Boundary

The suite exercises transaction commands and database protections in the local prepared test environment. Registration records the existing executable file; it does not report a run or establish product approval.

## What This Suite Proves

Its cited assertions contribute evidence for refund roles separate sensitive actions. The structured assertion bindings identify which parts of combined scenarios it executes.

## What It Does Not Prove

Local commands and route invocations do not establish deployed routing, live processor guarantees or the complete staff browser experience. An unbound feature chain remains proposed, and this registration carries no execution result.

## Real Dependencies and Test Doubles

The suite uses the imported commands, route handlers or persistence code against the local test database. Fixture helpers supply accounting context; any stepped clock, dummy processor or substituted external client is retained in the evidence declarations.

## Must Not Be Doubled

The command or persistence behavior under assertion and its relevant database protections must remain real. Substituting the final financial result removes evidence of transactional effects.