--- id: ATS-COM-ORD-011 scope: CAP-COM-ORD-011 product_area: commerce module: orders revision: 2 status: proposed approved_by: null approved_at: null source_sha: services-commerce: c8b66a98e2490617aec38ba5c8165dd9bd0a8f9b macroservice-libraries: 54536a441935c6e09fdb7f96f0bec71c52ba4e03 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f scenarios: - id: ATS-COM-ORD-011-01 title: Workspace authority never exposes another workspace’s record level: api proves: - BR-CAP-COM-ORD-011-01 preconditions: 'A cart and order belong to workspace A, with A-only, dual-workspace and absent contexts.' steps: - do: Request them through workspace B. provenance: test source: >- services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#refuses a call with no security context, 401 expected: >- Missing context returns 401, insufficient workspace authority returns 403 and authorized B scope still finds no A record. negative: true data_needs: Use the controlled records and transports established by the cited tests. bound_to: - >- services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#refuses a call with no security context, 401 - >- services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#refuses a context that covers only tenant A in tenant B, 403 - >- services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#answers 404 in tenant B to a checkout and an order of tenant A, to a context that covers both - TST-COM-ORD-025 provenance: test source: >- services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#refuses a call with no security context, 401 category: boundary expected_provenance: test expected_source: >- services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#refuses a call with no security context, 401 - id: ATS-COM-ORD-011-02 title: Read-only contexts preserve purchase state level: api proves: - BR-CAP-COM-ORD-011-02 preconditions: A reader inspects a member’s existing cart. steps: - do: 'Read it and attempt addition, preview and placement.' provenance: test source: >- services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#a reader reads any checkout and order of the tenant, and lists any buyer’s orders expected: Reads succeed and writes return permission_missing with the cart version unchanged. negative: true data_needs: Use the controlled records and transports established by the cited tests. bound_to: - >- services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#a reader reads any checkout and order of the tenant, and lists any buyer’s orders - >- services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#a reader is refused every write, 403 permission_missing, leaving the checkout as it was - TST-COM-ORD-025 provenance: test source: >- services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#a reader reads any checkout and order of the tenant, and lists any buyer’s orders category: permission expected_provenance: test expected_source: >- services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#a reader reads any checkout and order of the tenant, and lists any buyer’s orders - id: ATS-COM-ORD-011-03 title: Portal party checks separate two buyers level: api proves: - BR-CAP-COM-ORD-011-03 preconditions: Two linked contacts own different carts and orders. steps: - do: Read and mutate the other contact’s purchase as one member. provenance: test source: >- services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#reads their own checkout and order expected: The attempt receives not_your_party and the caller’s own purchase stays reachable. negative: true data_needs: Use the controlled records and transports established by the cited tests. bound_to: - >- services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#reads their own checkout and order - >- services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#is refused another member’s checkout and order, 403 not_your_party, and a change of it - >- services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#is refused another member’s order list, 403 - TST-COM-ORD-025 provenance: test source: >- services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#reads their own checkout and order category: permission expected_provenance: test expected_source: >- services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#reads their own checkout and order - id: ATS-COM-ORD-011-04 title: Support attribution is retained by event and stamp helpers level: unit proves: - BR-CAP-COM-ORD-011-05 preconditions: The helper inputs carry a stand-in support identity. steps: - do: Build the event actor and record-system values. provenance: test source: >- services-commerce:modules/checkout/tests/unit/checkout/checkout-event-actor.spec.js#names the support identity as the actor of the event expected: Both outputs retain the supplied support actor without proving a live Platform identity. negative: false data_needs: Use the controlled records and transports established by the cited tests. bound_to: - >- services-commerce:modules/checkout/tests/unit/checkout/checkout-event-actor.spec.js#names the support identity as the actor of the event - >- services-commerce:modules/checkout/tests/unit/checkout/checkout-event-actor.spec.js#names the support identity in the record system columns - TST-COM-ORD-048 provenance: test source: >- services-commerce:modules/checkout/tests/unit/checkout/checkout-event-actor.spec.js#names the support identity as the actor of the event category: edge expected_provenance: test expected_source: >- services-commerce:modules/checkout/tests/unit/checkout/checkout-event-actor.spec.js#names the support identity as the actor of the event - id: ATS-COM-ORD-011-05 title: Commerce application denial overrides operation access level: api proves: - BR-CAP-COM-ORD-011-06 preconditions: The principal is denied Commerce application access. steps: - do: Invoke a protected Commerce operation. provenance: test source: >- services-commerce:modules/purchasing/tests/e2e/purchasing.e2e.spec.js#lets a reader list and read, refuses the reader every write 403 permission_missing, a denied principal 403 app_not_permitted, no context 401, and another tenant 404 expected: The response identifies app_not_permitted. negative: true data_needs: Use the controlled records and transports established by the cited tests. bound_to: - >- services-commerce:modules/purchasing/tests/e2e/purchasing.e2e.spec.js#lets a reader list and read, refuses the reader every write 403 permission_missing, a denied principal 403 app_not_permitted, no context 401, and another tenant 404 - TST-COM-ORD-155 provenance: test source: >- services-commerce:modules/purchasing/tests/e2e/purchasing.e2e.spec.js#lets a reader list and read, refuses the reader every write 403 permission_missing, a denied principal 403 app_not_permitted, no context 401, and another tenant 404 category: permission expected_provenance: test expected_source: >- services-commerce:modules/purchasing/tests/e2e/purchasing.e2e.spec.js#lets a reader list and read, refuses the reader every write 403 permission_missing, a denied principal 403 app_not_permitted, no context 401, and another tenant 404 - id: ATS-COM-ORD-011-06 title: Sweep reads and writes use separate scopes level: api proves: - BR-CAP-COM-ORD-011-07 preconditions: Expired purchases belong to two workspaces. steps: - do: Invoke the bounded sweep cases. provenance: test source: >- services-commerce:modules/orders/tests/integration/services/persistence/orders.queries.integration.spec.js#lists, across tenants, every placed order past its window as references, oldest window first, under the sweep policy alone expected: Cross-workspace discovery yields references and each mutation uses its record’s workspace. negative: false data_needs: Use the controlled records and transports established by the cited tests. bound_to: - >- services-commerce:modules/orders/tests/integration/services/persistence/orders.queries.integration.spec.js#lists, across tenants, every placed order past its window as references, oldest window first, under the sweep policy alone - >- services-commerce:modules/checkout/tests/integration/services/checkout/checkout-sweeper.integration.spec.js#abandoned each expired open checkout in its own tenant, with the system as the actor and expired as the reason - TST-COM-ORD-104 - TST-COM-ORD-040 provenance: test source: >- services-commerce:modules/orders/tests/integration/services/persistence/orders.queries.integration.spec.js#lists, across tenants, every placed order past its window as references, oldest window first, under the sweep policy alone category: invariant expected_provenance: test expected_source: >- services-commerce:modules/orders/tests/integration/services/persistence/orders.queries.integration.spec.js#lists, across tenants, every placed order past its window as references, oldest window first, under the sweep policy alone - id: ATS-COM-ORD-011-07 title: A reader cannot change another authorized cart category: interaction level: api proves: - BR-CAP-COM-ORD-001-01 - BR-CAP-COM-ORD-011-02 preconditions: A workspace reader can read a staff-created cart. steps: - do: 'Read the cart, attempt an item addition and read its version again.' provenance: proposed source: - >- services-commerce:modules/checkout/tests/e2e/checkouts.e2e.spec.js#refuses a member opening a checkout for another contact, 403 - >- services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#a reader is refused every write, 403 permission_missing, leaving the checkout as it was expected: 'The read succeeds, the write is refused and the version stays unchanged.' negative: false data_needs: Use an isolated workspace with the records and responses named in the preconditions. bound_to: [] provenance: proposed source: - >- services-commerce:modules/checkout/tests/e2e/checkouts.e2e.spec.js#refuses a member opening a checkout for another contact, 403 - >- services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#a reader is refused every write, 403 permission_missing, leaving the checkout as it was exercises: - CAP-COM-ORD-011 - CAP-COM-ORD-001 related_capabilities: - CAP-COM-ORD-001 expected_provenance: proposed expected_source: - >- services-commerce:modules/checkout/tests/e2e/checkouts.e2e.spec.js#refuses a member opening a checkout for another contact, 403 - >- services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#a reader is refused every write, 403 permission_missing, leaving the checkout as it was - id: ATS-COM-ORD-011-08 title: Cart editing permission does not authorize a sale category: interaction level: api proves: - BR-CAP-COM-ORD-005-12 - BR-CAP-COM-ORD-011-02 preconditions: A clerk can edit carts but cannot place orders. steps: - do: Change an item and request placement. provenance: proposed source: - >- services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#a clerk without commerce.orders.create changes a checkout but is refused the placement - >- services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#a reader is refused every write, 403 permission_missing, leaving the checkout as it was expected: The item changes and placement is refused without creating an order. negative: false data_needs: Use an isolated workspace with the records and responses named in the preconditions. bound_to: [] provenance: proposed source: - >- services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#a clerk without commerce.orders.create changes a checkout but is refused the placement - >- services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#a reader is refused every write, 403 permission_missing, leaving the checkout as it was exercises: - CAP-COM-ORD-011 - CAP-COM-ORD-005 related_capabilities: - CAP-COM-ORD-005 expected_provenance: proposed expected_source: - >- services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#a clerk without commerce.orders.create changes a checkout but is refused the placement - >- services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#a reader is refused every write, 403 permission_missing, leaving the checkout as it was - id: ATS-COM-ORD-011-09 title: Portal ownership is checked before charging category: interaction level: api proves: - BR-CAP-COM-ORD-007-03 - BR-CAP-COM-ORD-011-03 preconditions: One member’s placed sale is addressed by another member. steps: - do: Attempt payment and inspect the sale’s attempts. provenance: proposed source: - >- services-commerce:modules/orders/tests/e2e/billing-and-tender.e2e.spec.js#refuses an offline tender by a member, 403 tender_kind_staff_only, and a kind the profile does not allow, 409, read from the ORDER’s snapshot: the order placed before the change still allows it (22 §9) - >- services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#is refused another member’s checkout and order, 403 not_your_party, and a change of it expected: The other-party request is refused and creates no payment attempt. negative: false data_needs: Use an isolated workspace with the records and responses named in the preconditions. bound_to: [] provenance: proposed source: - >- services-commerce:modules/orders/tests/e2e/billing-and-tender.e2e.spec.js#refuses an offline tender by a member, 403 tender_kind_staff_only, and a kind the profile does not allow, 409, read from the ORDER’s snapshot: the order placed before the change still allows it (22 §9) - >- services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#is refused another member’s checkout and order, 403 not_your_party, and a change of it exercises: - CAP-COM-ORD-011 - CAP-COM-ORD-007 related_capabilities: - CAP-COM-ORD-007 expected_provenance: proposed expected_source: - >- services-commerce:modules/orders/tests/e2e/billing-and-tender.e2e.spec.js#refuses an offline tender by a member, 403 tender_kind_staff_only, and a kind the profile does not allow, 409, read from the ORDER’s snapshot: the order placed before the change still allows it (22 §9) - >- services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#is refused another member’s checkout and order, 403 not_your_party, and a change of it - id: ATS-COM-ORD-011-10 title: A member’s list stays inside their buyer scope category: interaction level: api proves: - BR-CAP-COM-ORD-010-04 - BR-CAP-COM-ORD-011-03 preconditions: Two contacts in one workspace each have an order. steps: - do: 'List the first buyer as that member, request the other buyer and request the workspace list.' provenance: proposed source: - >- services-commerce:modules/orders/tests/unit/orders/orders-list-query.spec.js#refuses a search beside a buyer - >- services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#is refused another member’s checkout and order, 403 not_your_party, and a change of it expected: The own-buyer list succeeds and both broader requests are refused. negative: false data_needs: Use an isolated workspace with the records and responses named in the preconditions. bound_to: [] provenance: proposed source: - >- services-commerce:modules/orders/tests/unit/orders/orders-list-query.spec.js#refuses a search beside a buyer - >- services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#is refused another member’s checkout and order, 403 not_your_party, and a change of it exercises: - CAP-COM-ORD-011 - CAP-COM-ORD-010 related_capabilities: - CAP-COM-ORD-010 expected_provenance: proposed expected_source: - >- services-commerce:modules/orders/tests/unit/orders/orders-list-query.spec.js#refuses a search beside a buyer - >- services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#is refused another member’s checkout and order, 403 not_your_party, and a change of it evidence: - >- Examined reference: services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#a reader is refused every write, 403 permission_missing, leaving the checkout as it was - >- Examined reference: services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#a reader reads any checkout and order of the tenant, and lists any buyer’s orders - >- Examined reference: services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#answers 404 in tenant B to a checkout and an order of tenant A, to a context that covers both - >- Examined reference: services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#is refused another member’s checkout and order, 403 not_your_party, and a change of it - >- Examined reference: services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#is refused another member’s order list, 403 - >- Examined reference: services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#reads their own checkout and order - >- Examined reference: services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#refuses a call with no security context, 401 - >- Examined reference: services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#refuses a context that covers only tenant A in tenant B, 403 - >- Examined reference: services-commerce:modules/checkout/tests/integration/services/checkout/checkout-sweeper.integration.spec.js#abandoned each expired open checkout in its own tenant, with the system as the actor and expired as the reason - >- Examined reference: services-commerce:modules/checkout/tests/unit/checkout/checkout-event-actor.spec.js#names the support identity as the actor of the event - >- Examined reference: services-commerce:modules/checkout/tests/unit/checkout/checkout-event-actor.spec.js#names the support identity in the record system columns - >- Examined reference: services-commerce:modules/orders/tests/integration/services/persistence/orders.queries.integration.spec.js#lists, across tenants, every placed order past its window as references, oldest window first, under the sweep policy alone - >- Examined reference: services-commerce:modules/purchasing/tests/e2e/purchasing.e2e.spec.js#lets a reader list and read, refuses the reader every write 403 permission_missing, a denied principal 403 app_not_permitted, no context 401, and another tenant 404 coverage: rule: 'gap: FND-COM-ORD-068' transition: 'gap: FND-COM-ORD-068' validation: 'gap: FND-COM-ORD-068' permission: 'gap: FND-COM-ORD-068' edge: covered failure: 'gap: FND-COM-ORD-068' boundary: covered concurrency: 'gap: FND-COM-ORD-068' invariant: 'gap: FND-COM-ORD-068' interaction: covered coverage_definition: Covered means a design scenario exists; executable coverage and execution results are separate. permission_coverage: - key: commerce.application.access where_checked: api scenarios: - ATS-COM-ORD-011-02 - ATS-COM-ORD-011-03 - ATS-COM-ORD-011-05 gap: FND-COM-ORD-068 note: >- The listed examples do not establish a complete allow-and-deny matrix for this key; unused catalogue keys need no invented route. provenance: unknown source: FND-COM-ORD-068 - key: commerce.checkouts.read where_checked: api scenarios: - ATS-COM-ORD-011-02 - ATS-COM-ORD-011-03 - ATS-COM-ORD-011-05 gap: FND-COM-ORD-068 note: >- The listed examples do not establish a complete allow-and-deny matrix for this key; unused catalogue keys need no invented route. provenance: unknown source: FND-COM-ORD-068 - key: commerce.checkouts.create where_checked: api scenarios: - ATS-COM-ORD-011-02 - ATS-COM-ORD-011-03 - ATS-COM-ORD-011-05 gap: FND-COM-ORD-068 note: >- The listed examples do not establish a complete allow-and-deny matrix for this key; unused catalogue keys need no invented route. provenance: unknown source: FND-COM-ORD-068 - key: commerce.checkouts.update where_checked: api scenarios: - ATS-COM-ORD-011-02 - ATS-COM-ORD-011-03 - ATS-COM-ORD-011-05 gap: FND-COM-ORD-068 note: >- The listed examples do not establish a complete allow-and-deny matrix for this key; unused catalogue keys need no invented route. provenance: unknown source: FND-COM-ORD-068 - key: commerce.orders.read where_checked: api scenarios: - ATS-COM-ORD-011-02 - ATS-COM-ORD-011-03 - ATS-COM-ORD-011-05 gap: FND-COM-ORD-068 note: >- The listed examples do not establish a complete allow-and-deny matrix for this key; unused catalogue keys need no invented route. provenance: unknown source: FND-COM-ORD-068 - key: commerce.orders.create where_checked: api scenarios: - ATS-COM-ORD-011-02 - ATS-COM-ORD-011-03 - ATS-COM-ORD-011-05 gap: FND-COM-ORD-068 note: >- The listed examples do not establish a complete allow-and-deny matrix for this key; unused catalogue keys need no invented route. provenance: unknown source: FND-COM-ORD-068 - key: commerce.orders.tender where_checked: api scenarios: - ATS-COM-ORD-011-02 - ATS-COM-ORD-011-03 - ATS-COM-ORD-011-05 gap: FND-COM-ORD-068 note: >- The listed examples do not establish a complete allow-and-deny matrix for this key; unused catalogue keys need no invented route. provenance: unknown source: FND-COM-ORD-068 - key: commerce.orders.void where_checked: api scenarios: - ATS-COM-ORD-011-02 - ATS-COM-ORD-011-03 - ATS-COM-ORD-011-05 gap: FND-COM-ORD-068 note: >- The listed examples do not establish a complete allow-and-deny matrix for this key; unused catalogue keys need no invented route. provenance: unknown source: FND-COM-ORD-068 - key: commerce.checkouts.delete where_checked: api scenarios: - ATS-COM-ORD-011-02 - ATS-COM-ORD-011-03 - ATS-COM-ORD-011-05 gap: FND-COM-ORD-068 note: >- The listed examples do not establish a complete allow-and-deny matrix for this key; unused catalogue keys need no invented route. provenance: unknown source: FND-COM-ORD-068 - key: commerce.checkouts.bulk where_checked: api scenarios: - ATS-COM-ORD-011-02 - ATS-COM-ORD-011-03 - ATS-COM-ORD-011-05 gap: FND-COM-ORD-068 note: >- The listed examples do not establish a complete allow-and-deny matrix for this key; unused catalogue keys need no invented route. provenance: unknown source: FND-COM-ORD-068 - key: commerce.orders.update where_checked: api scenarios: - ATS-COM-ORD-011-02 - ATS-COM-ORD-011-03 - ATS-COM-ORD-011-05 gap: FND-COM-ORD-068 note: >- The listed examples do not establish a complete allow-and-deny matrix for this key; unused catalogue keys need no invented route. provenance: unknown source: FND-COM-ORD-068 - key: commerce.orders.delete where_checked: api scenarios: - ATS-COM-ORD-011-02 - ATS-COM-ORD-011-03 - ATS-COM-ORD-011-05 gap: FND-COM-ORD-068 note: >- The listed examples do not establish a complete allow-and-deny matrix for this key; unused catalogue keys need no invented route. provenance: unknown source: FND-COM-ORD-068 - key: commerce.orders.bulk where_checked: api scenarios: - ATS-COM-ORD-011-02 - ATS-COM-ORD-011-03 - ATS-COM-ORD-011-05 gap: FND-COM-ORD-068 note: >- The listed examples do not establish a complete allow-and-deny matrix for this key; unused catalogue keys need no invented route. provenance: unknown source: FND-COM-ORD-068 transition_coverage: [] invariant_coverage: - invariant: INV-DOM-COM-ORD-001-01 scenarios: [] gap: FND-COM-ORD-068 provenance: unknown source: 'services-commerce:modules/checkout/db/checkouts.table.ts:checkouts_placed_order_check' note: Broader invariant coverage remains open beyond the concrete examples. - invariant: INV-DOM-COM-ORD-001-02 scenarios: [] gap: FND-COM-ORD-068 provenance: unknown source: 'services-commerce:modules/checkout/db/checkouts.table.ts:checkouts_placed_order_uq' note: Broader invariant coverage remains open beyond the concrete examples. - invariant: INV-DOM-COM-ORD-001-03 scenarios: [] gap: FND-COM-ORD-068 provenance: unknown source: >- services-commerce:modules/checkout/db/checkouts.table.ts:checkouts_currency_check, checkouts_ordering_profile_source_check note: Broader invariant coverage remains open beyond the concrete examples. - invariant: INV-DOM-COM-ORD-001-04 scenarios: [] gap: FND-COM-ORD-068 provenance: unknown source: 'services-commerce:modules/checkout/services/persistence/checkouts.ts:CHECKOUT_TRANSITIONS' note: Broader invariant coverage remains open beyond the concrete examples. - invariant: INV-DOM-COM-ORD-001-05 scenarios: [] gap: FND-COM-ORD-068 provenance: unknown source: >- services-commerce:modules/checkout/tests/e2e/placement.e2e.spec.js#leaves the checkout placed, naming the order, its items frozen with what prepare attested, and its trail telling the story; services-commerce:modules/checkout/services/persistence/checkouts.ts:updateCheckout, appendCheckoutEvent note: Broader invariant coverage remains open beyond the concrete examples. - invariant: INV-DOM-COM-ORD-001-06 scenarios: [] gap: FND-COM-ORD-068 provenance: unknown source: 'services-commerce:modules/checkout/db/checkouts.table.ts:checkouts_ship_to_check' note: Broader invariant coverage remains open beyond the concrete examples. - invariant: INV-DOM-COM-ORD-001-07 scenarios: [] gap: FND-COM-ORD-068 provenance: unknown source: 'services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js' note: Broader invariant coverage remains open beyond the concrete examples. - invariant: INV-DOM-COM-ORD-001-08 scenarios: [] gap: FND-COM-ORD-068 provenance: unknown source: >- services-commerce:modules/checkout/db/checkout-items.table.ts:checkout_items_quantity_check; modules/checkout/services/checkout/checkout-part-checks.ts note: Broader invariant coverage remains open beyond the concrete examples. - invariant: INV-DOM-COM-ORD-002-01 scenarios: [] gap: FND-COM-ORD-068 provenance: unknown source: 'services-commerce:modules/orders/db/orders.table.ts:orders_total_check, orders_amounts_check' note: Broader invariant coverage remains open beyond the concrete examples. - invariant: INV-DOM-COM-ORD-002-02 scenarios: [] gap: FND-COM-ORD-068 provenance: unknown source: >- services-commerce:modules/checkout/tests/e2e/idempotency.e2e.spec.js#answers the stored status and body, marked Idempotent-Replayed, and runs the placement once: one order row; services-commerce:modules/orders/db/orders.table.ts:orders_checkout_uq note: Broader invariant coverage remains open beyond the concrete examples. - invariant: INV-DOM-COM-ORD-002-03 scenarios: [] gap: FND-COM-ORD-068 provenance: unknown source: 'services-commerce:modules/orders/db/orders.table.ts:orders_number_uq, orders_number_check' note: Broader invariant coverage remains open beyond the concrete examples. - invariant: INV-DOM-COM-ORD-002-04 scenarios: [] gap: FND-COM-ORD-068 provenance: unknown source: 'services-commerce:modules/orders/services/persistence/orders.ts:ORDER_TRANSITIONS' note: Broader invariant coverage remains open beyond the concrete examples. - invariant: INV-DOM-COM-ORD-002-05 scenarios: [] gap: FND-COM-ORD-068 provenance: unknown source: 'services-commerce:modules/orders/db/order-lines.table.ts:order_lines_quantity_check' note: Broader invariant coverage remains open beyond the concrete examples. - invariant: INV-DOM-COM-ORD-002-06 scenarios: [] gap: FND-COM-ORD-068 provenance: unknown source: >- services-commerce:modules/orders/db/order-line-purchases.table.ts:order_line_purchases_write_once_trigger note: Broader invariant coverage remains open beyond the concrete examples. - invariant: INV-DOM-COM-ORD-002-07 scenarios: [] gap: FND-COM-ORD-068 provenance: unknown source: >- services-commerce:modules/orders/tests/e2e/billing-and-tender.e2e.spec.js#resumes the same attempt on a retry, whatever card the retry names, and moves nothing while the intent is processing note: Broader invariant coverage remains open beyond the concrete examples. - invariant: INV-DOM-COM-ORD-002-08 scenarios: [] gap: FND-COM-ORD-068 provenance: unknown source: 'services-commerce:modules/orders/db/order-invoices.table.ts:order_invoices_idempotency_key_uq' note: Broader invariant coverage remains open beyond the concrete examples. - invariant: INV-DOM-COM-ORD-002-09 scenarios: [] gap: FND-COM-ORD-068 provenance: unknown source: 'services-commerce:modules/orders/db/order-events.table.ts' note: Broader invariant coverage remains open beyond the concrete examples. - invariant: INV-DOM-COM-ORD-002-10 scenarios: [] gap: FND-COM-ORD-068 provenance: unknown source: 'services-commerce:modules/orders/db/order-lines.table.ts:order_lines_order_fk' note: Broader invariant coverage remains open beyond the concrete examples. - invariant: INV-DOM-COM-ORD-002-11 scenarios: [] gap: FND-COM-ORD-068 provenance: unknown source: 'services-commerce:modules/orders/db/orders.table.ts:orders_installment_schedule_check' note: Broader invariant coverage remains open beyond the concrete examples. - invariant: INV-DOM-COM-ORD-002-12 scenarios: [] gap: FND-COM-ORD-068 provenance: unknown source: >- services-commerce:modules/orders/tests/e2e/billing-and-tender.e2e.spec.js#never stores the card: the attempt keeps a reference of the merchant account and the token’s last four only note: Broader invariant coverage remains open beyond the concrete examples. - invariant: INV-DOM-COM-ORD-002-13 scenarios: [] gap: FND-COM-ORD-068 provenance: unknown source: >- services-commerce:modules/orders/db/reservations.table.ts:reservations_subject_check; modules/orders/services/persistence/reservations.ts:RESERVATION_TRANSITIONS note: Broader invariant coverage remains open beyond the concrete examples. workflow_coverage: - workflow: WF-COM-ORD-001 scenarios: - ATS-COM-ORD-001-19 gap: FND-COM-ORD-068 provenance: proposed source: - 'services-commerce:modules/checkout/tests/e2e/ordering-profile-resolution.e2e.spec.js' - 'services-commerce:modules/checkout/services/checkout/purchasing-roles.ts' - >- services-commerce:modules/checkout/tests/e2e/holds-and-claims.e2e.spec.js#refuses another buyer the booth: 409 hold_unavailable with the participant’s reason, and their preview marks the item unavailable - 'services-commerce:modules/checkout/tests/e2e/checkout-preprocessing.e2e.spec.js' - 'services-commerce:modules/checkout/tests/e2e/participant-unavailable.e2e.spec.js' - 'services-commerce:modules/checkout/tests/e2e/product-purchase-eligibility.e2e.spec.js' - 'services-commerce:modules/checkout/tests/e2e/accounting-tax.e2e.spec.js' - 'services-commerce:modules/checkout/tests/e2e/checkouts.e2e.spec.js' - 'services-commerce:modules/checkout/aws/lambda/SWEEPER.ts:handler' - workflow: WF-COM-ORD-006 scenarios: - ATS-COM-ORD-001-20 gap: FND-COM-ORD-068 provenance: proposed source: - 'services-commerce:modules/checkout/aws/lambda/SWEEPER.ts:handler' - 'services-commerce:modules/orders/services/reservations/reservation-sweeper.ts:sweepReservations' - 'services-commerce:modules/orders/services/orders/tender-window-sweeper.ts:sweepTenderWindows' - 'services-commerce:modules/checkout/aws/lambda/SWEEPER.ts:handler' - 'services-commerce:modules/orders/services/orders/financial-sweeps.ts:sweepFinancials' - 'services-commerce:modules/entitlements/services/register/entitlement-sweeper.ts:sweepEntitlements' - 'services-commerce:modules/checkout/aws/lambda/SWEEPER.ts:handler' interaction_coverage: - with: CAP-COM-ORD-001 scenarios: - ATS-COM-ORD-011-07 - with: CAP-COM-ORD-005 scenarios: - ATS-COM-ORD-011-08 - with: CAP-COM-ORD-007 scenarios: - ATS-COM-ORD-011-09 - with: CAP-COM-ORD-010 scenarios: - ATS-COM-ORD-011-10 unproved_rules: - rule: BR-CAP-COM-ORD-011-04 gap: FND-COM-ORD-068 provenance: unknown source: >- services-commerce:docs/migrations/order-domain/README.md#D16. A portal caller's contact comes from Platform's user directory --- # Protect orders and carts by workspace and authority: Capability Test Specification ## Coverage | Rule | Scenario or finding | |---|---| | `BR-CAP-COM-ORD-011-01` | `ATS-COM-ORD-011-01` | | `BR-CAP-COM-ORD-011-02` | `ATS-COM-ORD-011-02`, `ATS-COM-ORD-011-07`, `ATS-COM-ORD-011-08` | | `BR-CAP-COM-ORD-011-03` | `ATS-COM-ORD-011-03`, `ATS-COM-ORD-011-09`, `ATS-COM-ORD-011-10` | | `BR-CAP-COM-ORD-011-04` | no scenario: `FND-COM-ORD-068` | | `BR-CAP-COM-ORD-011-05` | `ATS-COM-ORD-011-04` | | `BR-CAP-COM-ORD-011-06` | `ATS-COM-ORD-011-05` | | `BR-CAP-COM-ORD-011-07` | `ATS-COM-ORD-011-06` | ## Interactions With Related Capabilities A reader cannot change another authorized cart. A workspace reader can read a staff-created cart. Read the cart, attempt an item addition and read its version again. Cart editing permission does not authorize a sale. A clerk can edit carts but cannot place orders. Change an item and request placement. Portal ownership is checked before charging. One member’s placed sale is addressed by another member. Attempt payment and inspect the sale’s attempts. A member’s list stays inside their buyer scope. Two contacts in one workspace each have an order. List the first buyer as that member, request the other buyer and request the workspace list. Crossing workflow examples also cover preparation, commitment and recovery at their service handoffs. Their structured bindings distinguish specified outcomes from executable evidence.