--- id: CAP-COM-ORD-011 title: Protect orders and carts by workspace and authority feature: FEAT-COM-ORD-03 product_area: commerce module: orders revision: 1 status: draft product_intent: confirmed implementation_evidence: observed supersedes: - CAP-COM-CFG-025 source_sha: services-commerce: c8b66a98e2490617aec38ba5c8165dd9bd0a8f9b react-console: baf6dae382d6f41dce976c7f848667ccc37e076f intent_sources: - 'services-commerce:docs/milestones/COMM-M2-take-a-staff-order.md#M2-S2' - 'services-commerce:docs/milestones/plans/COMM-M2-plan.md#9. Acceptance scenarios' purpose: Commerce keeps each customer’s records within its workspace and respects the caller’s purchasing authority. outcomes: - A separate workspace cannot obtain these purchase records. - 'Read-only staff cannot change, price, place or pay an order.' concepts: - CON-COM-ORD-001 - CON-COM-ORD-002 actors: - ACT-COM-014 - ACT-COM-015 - ACT-COM-016 - ACT-COM-017 surfaces: - console - portal - api preconditions: [] postconditions: [] permissions: - key: commerce.application.access where_checked: api scope: tenant - key: commerce.checkouts.read where_checked: api scope: tenant - key: commerce.checkouts.create where_checked: api scope: tenant - key: commerce.checkouts.update where_checked: api scope: tenant - key: commerce.orders.read where_checked: api scope: tenant - key: commerce.orders.create where_checked: api scope: tenant - key: commerce.orders.tender where_checked: api scope: tenant - key: commerce.orders.void where_checked: api scope: tenant - key: commerce.checkouts.delete where_checked: api scope: tenant - key: commerce.checkouts.bulk where_checked: api scope: tenant - key: commerce.orders.update where_checked: api scope: tenant - key: commerce.orders.delete where_checked: api scope: tenant - key: commerce.orders.bulk where_checked: api scope: tenant rules: - id: BR-CAP-COM-ORD-011-01 proved_by: [ATS-COM-ORD-001-19, ATS-COM-ORD-001-20, ATS-COM-ORD-011-01, TST-COM-ORD-025] statement: >- Requests require security context and workspace authority, and a record from another workspace remains not found even for a principal authorized in both. kind: permission enforced_at: - api - database must_prove: true provenance: test source: >- services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#answers 404 in tenant B to a checkout and an order of tenant A, to a context that covers both origin: 'services-commerce:docs/milestones/plans/COMM-M2-plan.md#9. Acceptance scenarios' - id: BR-CAP-COM-ORD-011-02 proved_by: [ATS-COM-ORD-001-18, ATS-COM-ORD-011-02, ATS-COM-ORD-011-07, ATS-COM-ORD-011-08, TST-COM-ORD-025] statement: >- Read authority permits cart and order reads and buyer lists but rejects mutations without changing the cart. kind: permission enforced_at: - api must_prove: true provenance: test source: >- services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#a reader is refused every write, 403 permission_missing, leaving the checkout as it was origin: 'services-commerce:docs/milestones/plans/COMM-M2-plan.md#9. Acceptance scenarios' - id: BR-CAP-COM-ORD-011-03 proved_by: [ATS-COM-ORD-010-10, ATS-COM-ORD-011-03, ATS-COM-ORD-011-09, ATS-COM-ORD-011-10, TST-COM-ORD-025] statement: >- Portal callers can act only where their linked contact is the buyer or acting contact, and attempts to reach another party’s carts, orders or lists are refused. kind: permission enforced_at: - service must_prove: true provenance: test source: >- services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#is refused another member’s checkout and order, 403 not_your_party, and a change of it origin: none - id: BR-CAP-COM-ORD-011-04 proved_by: [] statement: >- The portal purchasing contact comes from the Platform user link, and purchasing is unavailable without that linked contact. kind: permission enforced_at: - service must_prove: true provenance: documented source: >- services-commerce:docs/migrations/order-domain/README.md#D16. A portal caller's contact comes from Platform's user directory origin: none - id: BR-CAP-COM-ORD-011-05 proved_by: [ATS-COM-ORD-011-04, TST-COM-ORD-048] statement: >- Rhythm support can administer customer carts under its acting identity, which is retained on events and record stamps. kind: permission enforced_at: - service - database must_prove: true provenance: test source: >- services-commerce:modules/checkout/tests/unit/checkout/checkout-event-actor.spec.js#names the support identity in the record system columns origin: 'services-commerce:docs/milestones/COMM-M2-take-a-staff-order.md#M2-S2' - id: BR-CAP-COM-ORD-011-06 proved_by: [ATS-COM-ORD-011-05, TST-COM-ORD-155] statement: An operation permission is insufficient without access to the Commerce application itself. kind: permission enforced_at: - api must_prove: true provenance: test source: >- services-commerce:modules/purchasing/tests/e2e/purchasing.e2e.spec.js#lets a reader list and read, refuses the reader every write 403 permission_missing, a denied principal 403 app_not_permitted, no context 401, and another tenant 404 origin: none - id: BR-CAP-COM-ORD-011-07 proved_by: [ATS-COM-ORD-011-06, TST-COM-ORD-040, TST-COM-ORD-104] statement: >- Sweeps discover records using a limited cross-workspace read policy and perform each mutation under the owning workspace’s context. kind: invariant enforced_at: - database - service must_prove: true provenance: test source: >- services-commerce:modules/orders/tests/integration/services/persistence/orders.queries.integration.spec.js#lists, across tenants, every placed order past its window as references, oldest window first, under the sweep policy alone origin: none - id: BR-CAP-COM-ORD-011-08 proved_by: [] statement: >- Checkout and order permission catalogues include unused deletion, bulk and order-update permissions without corresponding operations. kind: permission enforced_at: - api must_prove: false provenance: observed source: 'services-commerce:aws/commerce.service.ts:OrdersPermissions' origin: none note: Finding 018 identifies the published permissions that protect no operation. scenarios: - id: SC-CAP-COM-ORD-011-01 given: An administrator from a different customer knows a purchase identifier. when: 'They attempt to read, pay or void it through their own workspace.' then: The attempted cross-workspace access is refused. provenance: unknown source: FND-COM-ORD-032 edge_cases: [] constraints: [] depends_on: [] related: - CAP-COM-ORD-001 - CAP-COM-ORD-005 - CAP-COM-ORD-007 - CAP-COM-ORD-010 journeys: [] open_questions: [] evidence: - 'Examined reference: services-commerce:aws/commerce.service.ts:OrdersPermissions' - >- Examined reference: services-commerce:docs/migrations/order-domain/README.md#D16. A portal caller's contact comes from Platform's user directory - 'Examined reference: services-commerce:docs/milestones/COMM-M2-take-a-staff-order.md#M2-S2' - 'Examined reference: services-commerce:docs/milestones/plans/COMM-M2-plan.md#9. Acceptance scenarios' - >- Examined reference: services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#a reader is refused every write, 403 permission_missing, leaving the checkout as it was - >- Examined reference: services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#answers 404 in tenant B to a checkout and an order of tenant A, to a context that covers both - >- Examined reference: services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#is refused another member’s checkout and order, 403 not_your_party, and a change of it - >- Examined reference: services-commerce:modules/checkout/tests/unit/checkout/checkout-event-actor.spec.js#names the support identity in the record system columns - >- Examined reference: services-commerce:modules/orders/tests/integration/services/persistence/orders.queries.integration.spec.js#lists, across tenants, every placed order past its window as references, oldest window first, under the sweep policy alone - >- Examined reference: services-commerce:modules/purchasing/tests/e2e/purchasing.e2e.spec.js#lets a reader list and read, refuses the reader every write 403 permission_missing, a denied principal 403 app_not_permitted, no context 401, and another tenant 404 controls: [TC-IAM-001, TC-IAM-002, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-AZ-006, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-TEN-004, TC-CRY-001, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-AVL-004, TC-MON-001, TC-MON-002, TC-MON-004, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-004, TC-PRV-001, TC-PRV-002] exercised_by: [FAS-COM-ORD-01-04, FAS-COM-ORD-02-04, FAS-COM-ORD-03-01, FAS-COM-ORD-03-02, FAS-COM-ORD-03-03, FAS-COM-ORD-03-04, FAS-COM-ORD-03-05, FAS-COM-ORD-04-04, FAS-COM-ORD-05-04] suites: [TST-COM-ORD-025, TST-COM-ORD-040, TST-COM-ORD-048, TST-COM-ORD-104, TST-COM-ORD-155] --- # Protect orders and carts by workspace and authority ## Purpose Commerce keeps each customer’s records within its workspace and respects the caller’s purchasing authority. Audit attribution distinguishes staff, buyers and system work. ## How It Works Commerce identifies the caller and workspace before it reads purchase records. Staff permission controls determine whether an operation can proceed. Portal purchasing also depends on the linked contact and the parties named by the record. A refusal leaves the caller without authority to make the attempted change. Support actions remain attributed to the support identity. Background processing discovers eligible work across workspaces and enters each owning workspace before changing it. ## Relationships Cart construction, placement, payment and order inspection all use the workspace and party boundaries; system processing uses the same owning records.