---
id: TST-COM-ORD-025
title: Checkout and order security
kind: api-lifecycle
product_area: commerce
module: orders
revision: 1
status: draft
source_sha:
  services-commerce: c8b66a98e2490617aec38ba5c8165dd9bd0a8f9b
repository: services-commerce
files:
  - modules/checkout/tests/e2e/checkout-security.e2e.spec.js
implements:
  - ATS-COM-ORD-005-12
  - ATS-COM-ORD-010-01
  - ATS-COM-ORD-010-04
  - ATS-COM-ORD-011-01
  - ATS-COM-ORD-011-02
  - ATS-COM-ORD-011-03
environment: local
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 2
isolation: The suite creates its own test workspace records and removes them using the fixture cleanup.
evidence:
  - provenance: test
    source: 'services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js'
    test_cases:
      - reads their own checkout and order
      - 'is refused another member’s checkout and order, 403 not_your_party, and a change of it'
      - 'is refused another member’s order list, 403'
      - 'is refused the list of every order, 403, and still lists their own'
      - 'a reader reads any checkout and order of the tenant, and lists any buyer’s orders'
      - 'a reader lists every order of the tenant with no buyer named, newest first, 50 a page'
      - 'a reader finds the order by its display number, and is answered nothing for another'
      - 'refuses a list with a search beside a buyer, 400 naming the workspace'
      - 'refuses a caller without commerce.orders.read the list, 403 permission_missing'
      - 'a reader is refused every write, 403 permission_missing, leaving the checkout as it was'
      - a clerk without commerce.orders.create changes a checkout but is refused the placement
      - 'refuses a call with no security context, 401'
      - 'refuses a context that covers only tenant A in tenant B, 403'
      - 'answers 404 in tenant B to a checkout and an order of tenant A, to a context that covers both'
scenario_coverage:
  - scenario: ATS-COM-ORD-005-12
    test_cases:
      - a clerk without commerce.orders.create changes a checkout but is refused the placement
    scope: >-
      The cited cases exercise the scenario’s listed fixture outcomes; this register makes no verified
      conformance claim.
  - scenario: ATS-COM-ORD-010-01
    test_cases:
      - 'a reader lists every order of the tenant with no buyer named, newest first, 50 a page'
    scope: >-
      The cited cases exercise the scenario’s listed fixture outcomes; this register makes no verified
      conformance claim.
  - scenario: ATS-COM-ORD-010-04
    test_cases:
      - 'is refused the list of every order, 403, and still lists their own'
    scope: >-
      The cited cases exercise the scenario’s listed fixture outcomes; this register makes no verified
      conformance claim.
  - scenario: ATS-COM-ORD-011-01
    test_cases:
      - 'refuses a call with no security context, 401'
      - 'refuses a context that covers only tenant A in tenant B, 403'
      - 'answers 404 in tenant B to a checkout and an order of tenant A, to a context that covers both'
    scope: >-
      The cited cases exercise the scenario’s listed fixture outcomes; this register makes no verified
      conformance claim.
  - scenario: ATS-COM-ORD-011-02
    test_cases:
      - 'a reader reads any checkout and order of the tenant, and lists any buyer’s orders'
      - 'a reader is refused every write, 403 permission_missing, leaving the checkout as it was'
    scope: >-
      The cited cases exercise the scenario’s listed fixture outcomes; this register makes no verified
      conformance claim.
  - scenario: ATS-COM-ORD-011-03
    test_cases:
      - reads their own checkout and order
      - 'is refused another member’s checkout and order, 403 not_your_party, and a change of it'
      - 'is refused another member’s order list, 403'
    scope: >-
      The cited cases exercise the scenario’s listed fixture outcomes; this register makes no verified
      conformance claim.
dependency_evidence:
  provenance: test
  source: 'services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js'
  declared_by_test: >-
    the composed handler, the routes, the signed context's verification and the evaluation of each route's
    declared requirement, the workflows, the persistence services and PostgreSQL. Doubled: the signing key
    pair and the other services' tables (local stand-ins). `tests/unit/route-authorization.spec.ts` proves the
    permission each route publishes.
---

# Checkout and order security

## Verification Boundary

The suite drives the composed local API dispatcher and its registered routes.

## What This Suite Proves

The registered cases check checkout and order security with their fixture records and assertions. Scenario bindings name only the examples those cases exercise.

## What It Does Not Prove

A registered file supplies no run result or verified conformance by itself. Local fixtures do not establish deployed cross-service behavior or complete browser journeys.

## Real Dependencies and Test Doubles

PostgreSQL and the exercised Commerce persistence or workflow code are real. Remote service records, clocks and transports follow the suite’s fixtures.

## Must Not Be Doubled

The database constraints, role restrictions, locks and transactions exercised by this suite must use PostgreSQL.