--- id: CAP-CRM-REG-013 title: Restrict regional work to authorised users feature: FEAT-CRM-REG-01 product_area: crm module: regions revision: 2 status: draft product_intent: proposed implementation_evidence: inconsistent supersedes: [] source_sha: services-crm: a8d1364f1dd44b723bb5f9acba12f983e9ec8d69 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f intent_sources: [] purpose: Regional operations are available according to the user’s authority in the selected workspace. outcomes: - Readers can inspect regional configuration without usable edit controls. - Published permission tiers distinguish ordinary edits from destructive or bulk work. - The product should align console gates with the service authority they represent. concepts: - CON-CRM-REG-001 - CON-CRM-REG-002 - CON-CRM-REG-004 actors: - ACT-CRM-002 - ACT-CRM-001 - ACT-CRM-003 surfaces: - console - api preconditions: [] postconditions: [] permissions: - key: crm.regions.read where_checked: api scope: tenant - key: crm.regions.create where_checked: api scope: tenant - key: crm.regions.update where_checked: api scope: tenant - key: crm.regions.delete where_checked: api scope: tenant - key: crm.regions.bulk where_checked: api scope: tenant - key: crm.regions.recalculate where_checked: api scope: tenant - key: crm.regions.read where_checked: console scope: tenant - key: crm.regions.update where_checked: console scope: tenant - key: crm.regions.delete where_checked: console scope: tenant - key: crm.regions.recalculate where_checked: console scope: tenant rules: - id: BR-CAP-CRM-REG-013-01 statement: >- Region reads, settings, rules, previews and run reads require read authority; region creation requires create, region and policy changes require update, deletion requires delete and recalculation requires recalculate. kind: permission enforced_at: - api must_prove: true provenance: test source: >- services-crm:tests/unit/regions-authorization.spec.ts#requires crm.regions.update to save the assignment settings origin: none - id: BR-CAP-CRM-REG-013-02 statement: >- Regional read is read-tier authority, creation and update are user-tier authority, and deletion, bulk work and recalculation are admin-tier authority. kind: permission enforced_at: - api must_prove: true provenance: observed source: 'services-crm:aws/crm.service.ts:RegionsPermissions' origin: none - id: BR-CAP-CRM-REG-013-03 statement: Regional routes grant console access only. kind: permission enforced_at: - api must_prove: true provenance: test source: 'services-crm:tests/unit/regions-authorization.spec.ts#serves every regions route to console users only' origin: none - id: BR-CAP-CRM-REG-013-04 statement: Anonymous requests and signed requests outside the caller’s workspace access are rejected. kind: permission enforced_at: - api must_prove: true provenance: test source: 'services-crm:modules/regions/tests/e2e/regions.e2e.spec.js#answers 401 to an anonymous call' origin: none - id: BR-CAP-CRM-REG-013-05 statement: >- A read-only console user can inspect regions and policy, receives a read-only explanation and has no usable regional edit actions. kind: permission enforced_at: - console must_prove: true provenance: test source: >- react-console:e2e/dev/regions.dev.spec.ts#shows a read-only user the regions, and offers them nothing that changes one origin: none - id: BR-CAP-CRM-REG-013-06 statement: The console protects direct access to the policy editor with its settings-management gate. kind: permission enforced_at: - console must_prove: false provenance: test source: >- react-console:components/regions/__tests__/assignment-rules-editor.test.tsx#who may open the editor › is not somebody who may only look, whatever the URL origin: none - id: BR-CAP-CRM-REG-013-07 statement: >- The console’s view and management aliases accept alternative keys that can expose regional controls whose API requests are refused; the recalculation alias maps directly to the recalculation key. kind: permission enforced_at: - console must_prove: true provenance: observed source: >- react-console:lib/authz/backend-aliases.ts:crm.settings.view, crm.settings.manage, maintenance.operations.run origin: none - id: BR-CAP-CRM-REG-013-08 statement: Read-only API authority permits listing rules but does not permit creating them. kind: permission enforced_at: - api must_prove: true provenance: test source: >- services-crm:modules/regions/tests/e2e/regions.e2e.spec.js#the rules, one at a time › answers 403 to a create for that same read-only context origin: none scenarios: - id: SC-CAP-CRM-REG-013-01 given: A reader visits regional configuration. when: They inspect both tabs. then: They can read the information and see the read-only explanation without usable edit actions. provenance: test source: >- react-console:e2e/dev/regions.dev.spec.ts#shows a read-only user the regions, and offers them nothing that changes one edge_cases: - id: SC-CAP-CRM-REG-013-02 given: A user holds contact-role read authority but lacks regional read authority. when: They enter the Regions page. then: The console gate permits entry but regional requests are refused. provenance: inferred source: 'react-console:lib/authz/backend-aliases.ts' constraints: [] depends_on: [] related: - CAP-CRM-REG-001 - CAP-CRM-REG-002 - CAP-CRM-REG-003 - CAP-CRM-REG-011 - CAP-CRM-REG-014 journeys: [] open_questions: [] evidence: - >- services-crm: Examined the pinned regional implementation, its declared constraints and the supporting records. - 'react-console: Examined the pinned regional configuration surfaces and their available test evidence.' - 'services-crm:tests/unit/regions-authorization.spec.ts' - 'services-crm:aws/crm.service.ts' - 'services-crm:modules/regions/tests/e2e/regions.e2e.spec.js' - 'react-console:e2e/dev/regions.dev.spec.ts' - 'react-console:components/regions/__tests__/assignment-rules-editor.test.tsx' - 'react-console:lib/authz/backend-aliases.ts' controls: [TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-AZ-006, TC-DAT-001, TC-DAT-003, TC-LOG-004, TC-LOG-005, TC-PI-001, TC-TEN-001, TC-TEN-002, TC-TEN-003] --- # Restrict regional work to authorised users ## Purpose Regional operations are available according to the user’s authority in the selected workspace. ## How It Works The API checks a regional permission for each operation and requires console access. Regional read authority supports inspection and address preview. Creation and update are ordinary user-tier powers; deletion, bulk work and recalculation are administrator-tier powers. Workspace access is checked independently of the regional permission. The console removes or disables actions for read-only users and protects the editor route. Its broader settings aliases can nevertheless grant entry or controls to users lacking the exact regional service key. Those requests are then refused by the API. The product should align those gates before treating the console as an accurate guide to the user’s authority. ## Relationships - Maintain the region catalogue supplies the regional catalogue used by the surrounding work. - Retire regions while preserving their references handles retirement and reference-sensitive removal of regional definitions. - Configure automatic placement and its address sources establishes participation and address-source choices for placement. - Apply the current policy across existing records applies policy changes to existing records. - Import a catalogue of regions loads regional definitions through shared data-job processing.