--- id: ATS-CRM-REG-013 scope: CAP-CRM-REG-013 product_area: crm module: regions revision: 2 status: proposed approved_by: null approved_at: null source_sha: services-crm: a8d1364f1dd44b723bb5f9acba12f983e9ec8d69 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f scenarios: - id: ATS-CRM-REG-013-01 title: Route declarations identify the required authority level: unit proves: - BR-CAP-CRM-REG-013-01 - BR-CAP-CRM-REG-013-03 preconditions: The regional route catalogue is available. steps: Inspect regional operation access and permissions. expected: >- The catalogue associates read, create, update, delete and recalculate work with their corresponding keys and console access. negative: true data_needs: Published regional route metadata. bound_to: - 'services-crm:tests/unit/regions-authorization.spec.ts#requires crm.regions.read to list regions' - 'services-crm:tests/unit/regions-authorization.spec.ts#requires crm.regions.create to create a region' - 'services-crm:tests/unit/regions-authorization.spec.ts#requires crm.regions.update to replace a region' - 'services-crm:tests/unit/regions-authorization.spec.ts#requires crm.regions.delete to delete a region' - >- services-crm:tests/unit/regions-authorization.spec.ts#requires crm.regions.update to save the assignment settings - >- services-crm:tests/unit/regions-authorization.spec.ts#requires crm.regions.update to reorder the assignment rules - >- services-crm:tests/unit/regions-authorization.spec.ts#requires crm.regions.read to list and read recalculations - 'services-crm:tests/unit/regions-authorization.spec.ts#serves every regions route to console users only' provenance: test source: 'services-crm:tests/unit/regions-authorization.spec.ts#requires crm.regions.read to list regions' - id: ATS-CRM-REG-013-02 title: Role tiers distinguish edits from admin work level: browser proves: - BR-CAP-CRM-REG-013-02 preconditions: A coordinator has user-tier regional authority. steps: 'Create and edit a region, then attempt deletion and recalculation.' expected: Ordinary edits succeed and the administrator-tier actions are refused. negative: true data_needs: An identity with standard user-tier authority. bound_to: - 'react-console:acceptance/crm/playwright/journeys/configuration/CRM-ACC-0366.spec.ts#CRM-ACC-0366' provenance: test source: 'react-console:acceptance/crm/playwright/journeys/configuration/CRM-ACC-0366.spec.ts#CRM-ACC-0366' - id: ATS-CRM-REG-013-03 title: Authentication and workspace access are required level: api proves: - BR-CAP-CRM-REG-013-04 preconditions: A regional record exists. steps: Request it anonymously and with access only to another workspace. expected: The responses reject unauthenticated and out-of-scope access. negative: true data_needs: Authenticated and out-of-scope execution contexts. bound_to: - 'services-crm:modules/regions/tests/e2e/regions.e2e.spec.js#answers 401 to an anonymous call' - >- services-crm:modules/regions/tests/e2e/regions.e2e.spec.js#the regions › answers 403 when the signed context does not cover the path's tenant provenance: test source: 'services-crm:modules/regions/tests/e2e/regions.e2e.spec.js#answers 401 to an anonymous call' - id: ATS-CRM-REG-013-04 title: Read-only views have no usable edits level: browser proves: - BR-CAP-CRM-REG-013-05 preconditions: The signed-in user has read-only authority. steps: Visit both regional tabs. expected: 'The view explains read-only access and provides no usable Add, Edit, Delete or Recalculate actions.' negative: false data_needs: An identity limited to read authority. bound_to: - >- react-console:e2e/dev/regions.dev.spec.ts#shows a read-only user the regions, and offers them nothing that changes one - >- react-console:components/regions/__tests__/regions-screen.test.tsx#the regions table › offers nothing that changes a region to somebody who may only look - >- react-console:components/regions/__tests__/assignment-rules-view.test.tsx#Edit Assignment Rules › is not offered to somebody who may only look provenance: test source: >- react-console:e2e/dev/regions.dev.spec.ts#shows a read-only user the regions, and offers them nothing that changes one - id: ATS-CRM-REG-013-05 title: Partial aliases expose mismatched controls level: browser proves: - BR-CAP-CRM-REG-013-07 preconditions: 'Users separately hold regional create, contact-role update and contact-role read authority.' steps: Visit Regions and attempt a policy save with each authority set. expected: Record the controls exposed and the regional requests refused by the service. negative: true data_needs: Three policies exposing the partial-key combinations. bound_to: [] provenance: proposed source: >- react-console:lib/authz/backend-aliases.ts:crm.settings.view, crm.settings.manage, maintenance.operations.run - id: ATS-CRM-REG-013-06 title: Read permits listing but cannot create rules level: api proves: - BR-CAP-CRM-REG-013-08 preconditions: The caller holds regional read alone. steps: List rules and submit rule creation. expected: Listing succeeds and creation is denied. negative: true data_needs: Execution limited to regional reading. bound_to: - >- services-crm:modules/regions/tests/e2e/regions.e2e.spec.js#the rules, one at a time › answers 200 to a list for a context carrying only the read permission - >- services-crm:modules/regions/tests/e2e/regions.e2e.spec.js#the rules, one at a time › answers 403 to a create for that same read-only context provenance: test source: >- services-crm:modules/regions/tests/e2e/regions.e2e.spec.js#the rules, one at a time › answers 200 to a list for a context carrying only the read permission evidence: - >- services-crm: Examined the pinned regional implementation, its declared constraints and the supporting records. - 'react-console: Examined the pinned regional configuration surfaces and their available test evidence.' - 'services-crm:tests/unit/regions-authorization.spec.ts' - 'react-console:acceptance/crm/playwright/journeys/configuration/CRM-ACC-0366.spec.ts' - 'services-crm:modules/regions/tests/e2e/regions.e2e.spec.js' - 'react-console:e2e/dev/regions.dev.spec.ts' - 'react-console:components/regions/__tests__/regions-screen.test.tsx' - 'react-console:components/regions/__tests__/assignment-rules-view.test.tsx' - 'react-console:lib/authz/backend-aliases.ts' --- # Restrict regional work to authorised users: Acceptance Test Set ## Coverage | Rule | Proved by | |---|---| | `BR-CAP-CRM-REG-013-01` | `ATS-CRM-REG-013-01` | | `BR-CAP-CRM-REG-013-02` | `ATS-CRM-REG-013-02` | | `BR-CAP-CRM-REG-013-03` | `ATS-CRM-REG-013-01` | | `BR-CAP-CRM-REG-013-04` | `ATS-CRM-REG-013-03` | | `BR-CAP-CRM-REG-013-05` | `ATS-CRM-REG-013-04` | | `BR-CAP-CRM-REG-013-07` | `ATS-CRM-REG-013-05`; see `FND-CRM-REG-004`, `FND-CRM-REG-012` | | `BR-CAP-CRM-REG-013-08` | `ATS-CRM-REG-013-06` |