--- id: ATS-CRM-REG-013 scope: CAP-CRM-REG-013 product_area: crm module: regions revision: 3 status: proposed approved_by: null approved_at: null source_sha: services-crm: a8d1364f1dd44b723bb5f9acba12f983e9ec8d69 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f scenarios: - id: ATS-CRM-REG-013-01 title: Route declarations identify the required authority level: unit proves: - BR-CAP-CRM-REG-013-01 - BR-CAP-CRM-REG-013-03 preconditions: The regional route catalogue is available. steps: Inspect regional operation access and permissions. expected: >- The catalogue associates read, create, update, delete and recalculate work with their corresponding keys and console access. negative: true data_needs: Published regional route metadata. bound_to: - TST-CRM-REG-067 provenance: test source: 'services-crm:tests/unit/regions-authorization.spec.ts#requires crm.regions.read to list regions' category: permission test_assertions: - 'services-crm:tests/unit/regions-authorization.spec.ts#requires crm.regions.read to list regions' - >- services-crm:tests/unit/regions-authorization.spec.ts#requires crm.regions.create to create a region - >- services-crm:tests/unit/regions-authorization.spec.ts#requires crm.regions.update to replace a region - >- services-crm:tests/unit/regions-authorization.spec.ts#requires crm.regions.delete to delete a region - >- services-crm:tests/unit/regions-authorization.spec.ts#requires crm.regions.update to save the assignment settings - >- services-crm:tests/unit/regions-authorization.spec.ts#requires crm.regions.update to reorder the assignment rules - >- services-crm:tests/unit/regions-authorization.spec.ts#requires crm.regions.read to list and read recalculations - >- services-crm:tests/unit/regions-authorization.spec.ts#serves every regions route to console users only - id: ATS-CRM-REG-013-02 title: Role tiers distinguish edits from admin work level: browser proves: - BR-CAP-CRM-REG-013-02 preconditions: A coordinator has user-tier regional authority. steps: 'Create and edit a region, then attempt deletion and recalculation.' expected: Ordinary edits succeed and the administrator-tier actions are refused. negative: true data_needs: An identity with standard user-tier authority. bound_to: - TST-CRM-REG-014 provenance: test source: 'react-console:acceptance/crm/playwright/journeys/configuration/CRM-ACC-0366.spec.ts#CRM-ACC-0366' category: permission test_assertions: - 'react-console:acceptance/crm/playwright/journeys/configuration/CRM-ACC-0366.spec.ts#CRM-ACC-0366' - id: ATS-CRM-REG-013-03 title: Authentication and workspace access are required level: api proves: - BR-CAP-CRM-REG-013-04 preconditions: A regional record exists. steps: Request it anonymously and with access only to another workspace. expected: The responses reject unauthenticated and out-of-scope access. negative: true data_needs: Authenticated and out-of-scope execution contexts. bound_to: - TST-CRM-REG-047 provenance: test source: 'services-crm:modules/regions/tests/e2e/regions.e2e.spec.js#answers 401 to an anonymous call' category: boundary test_assertions: - 'services-crm:modules/regions/tests/e2e/regions.e2e.spec.js#answers 401 to an anonymous call' - >- services-crm:modules/regions/tests/e2e/regions.e2e.spec.js#the regions › answers 403 when the signed context does not cover the path's tenant - id: ATS-CRM-REG-013-04 title: Read-only views have no usable edits level: browser proves: - BR-CAP-CRM-REG-013-05 preconditions: The signed-in user has read-only authority. steps: Visit both regional tabs. expected: 'The view explains read-only access and provides no usable Add, Edit, Delete or Recalculate actions.' negative: false data_needs: An identity limited to read authority. bound_to: - TST-CRM-REG-045 - TST-CRM-REG-041 - TST-CRM-REG-037 provenance: test source: >- react-console:e2e/dev/regions.dev.spec.ts#shows a read-only user the regions, and offers them nothing that changes one category: permission test_assertions: - >- react-console:e2e/dev/regions.dev.spec.ts#shows a read-only user the regions, and offers them nothing that changes one - >- react-console:components/regions/__tests__/regions-screen.test.tsx#the regions table › offers nothing that changes a region to somebody who may only look - >- react-console:components/regions/__tests__/assignment-rules-view.test.tsx#Edit Assignment Rules › is not offered to somebody who may only look - id: ATS-CRM-REG-013-05 title: Partial aliases expose mismatched controls level: browser proves: - BR-CAP-CRM-REG-013-07 preconditions: 'Users separately hold regional create, contact-role update and contact-role read authority.' steps: Visit Regions and attempt a policy save with each authority set. expected: Record the controls exposed and the regional requests refused by the service. negative: true data_needs: Three policies exposing the partial-key combinations. bound_to: [] provenance: proposed source: >- react-console:lib/authz/backend-aliases.ts:crm.settings.view, crm.settings.manage, maintenance.operations.run category: permission - id: ATS-CRM-REG-013-06 title: Read permits listing but cannot create rules level: api proves: - BR-CAP-CRM-REG-013-08 preconditions: The caller holds regional read alone. steps: List rules and submit rule creation. expected: Listing succeeds and creation is denied. negative: true data_needs: Execution limited to regional reading. bound_to: - TST-CRM-REG-047 provenance: test source: >- services-crm:modules/regions/tests/e2e/regions.e2e.spec.js#the rules, one at a time › answers 200 to a list for a context carrying only the read permission category: permission test_assertions: - >- services-crm:modules/regions/tests/e2e/regions.e2e.spec.js#the rules, one at a time › answers 200 to a list for a context carrying only the read permission - >- services-crm:modules/regions/tests/e2e/regions.e2e.spec.js#the rules, one at a time › answers 403 to a create for that same read-only context - id: ATS-CRM-REG-013-07 title: Regional authority spans catalogue preview recalculation and imports category: interaction level: api proves: - BR-CAP-CRM-REG-013-01 - BR-CAP-CRM-REG-013-04 - BR-CAP-CRM-REG-007-04 - BR-CAP-CRM-REG-011-01 - BR-CAP-CRM-REG-014-01 preconditions: >- A reader, ordinary regional editor and full regional administrator share a workspace containing saved policy. steps: >- Each identity lists regions, previews an address, attempts catalogue creation and deletion, starts recalculation and submits a regional file. expected: >- Every request is checked against its regional action keys; console controls cannot grant authority absent from the service. negative: false data_needs: >- A reader, ordinary regional editor and full regional administrator share a workspace containing saved policy. bound_to: [] provenance: proposed source: SVC-CRM-REG-regions exercises: - CAP-CRM-REG-001 - CAP-CRM-REG-007 - CAP-CRM-REG-011 - CAP-CRM-REG-013 - CAP-CRM-REG-014 - id: ATS-CRM-REG-013-08 title: Direct editor access respects the management gate category: edge level: browser proves: - BR-CAP-CRM-REG-013-06 preconditions: An identity has regional viewing authority alone. steps: Open the policy editor directly rather than through its read-only tab. expected: The editor supplies no usable policy-editing surface. negative: true data_needs: An identity has regional viewing authority alone. bound_to: - TST-CRM-REG-036 provenance: test source: >- react-console:components/regions/__tests__/assignment-rules-editor.test.tsx#who may open the editor › is not somebody who may only look, whatever the URL test_assertions: - >- react-console:components/regions/__tests__/assignment-rules-editor.test.tsx#who may open the editor › is not somebody who may only look, whatever the URL evidence: - >- services-crm: Examined the pinned regional implementation, its declared constraints and the supporting records. - 'react-console: Examined the pinned regional configuration surfaces and their available test evidence.' - 'services-crm:tests/unit/regions-authorization.spec.ts' - 'react-console:acceptance/crm/playwright/journeys/configuration/CRM-ACC-0366.spec.ts' - 'services-crm:modules/regions/tests/e2e/regions.e2e.spec.js' - 'react-console:e2e/dev/regions.dev.spec.ts' - 'react-console:components/regions/__tests__/regions-screen.test.tsx' - 'react-console:components/regions/__tests__/assignment-rules-view.test.tsx' - 'react-console:lib/authz/backend-aliases.ts' coverage: rule: 'gap: FND-CRM-REG-058' transition: not-applicable validation: 'gap: FND-CRM-REG-058' permission: covered edge: covered failure: 'gap: FND-CRM-REG-058' boundary: covered concurrency: 'gap: FND-CRM-REG-058' invariant: 'gap: FND-CRM-REG-058' interaction: covered coverage_notes: transition: This capability checks authority and owns no persisted regional lifecycle. --- # Restrict regional work to authorised users: Capability Test Specification ## Coverage Each row links a required rule to its authored proof. A covered category records a specification; executable and remaining variant gaps stay in the finding register. | Rule | Proved By | |---|---| | `BR-CAP-CRM-REG-013-01` | `ATS-CRM-REG-013-01`, `ATS-CRM-REG-013-07` | | `BR-CAP-CRM-REG-013-02` | `ATS-CRM-REG-013-02` | | `BR-CAP-CRM-REG-013-03` | `ATS-CRM-REG-013-01` | | `BR-CAP-CRM-REG-013-04` | `ATS-CRM-REG-013-03`, `ATS-CRM-REG-013-07` | | `BR-CAP-CRM-REG-013-05` | `ATS-CRM-REG-013-04` | | `BR-CAP-CRM-REG-013-07` | `ATS-CRM-REG-013-05` | | `BR-CAP-CRM-REG-013-08` | `ATS-CRM-REG-013-06` | ## Interactions With Related Capabilities Regional authority spans catalogue preview recalculation and imports. The interaction scenario connects maintain the region catalogue, retire regions while preserving their references, configure automatic placement and its address sources, apply the current policy across existing records, import a catalogue of regions with this capability. Cross-workflow expectations are proposed where no executable binding is present.