--- id: ATS-PFM-CSH-017 scope: CAP-PFM-CSH-017 product_area: platform module: console-shell revision: 2 status: proposed approved_by: null approved_at: null source_sha: react-console: baf6dae382d6f41dce976c7f848667ccc37e076f services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 scenarios: - id: ATS-PFM-CSH-017-01 title: 'The administrator API separates permitted, forbidden and anonymous callers' level: api proves: - BR-CAP-PFM-CSH-017-14 preconditions: 'Callers cover a permitted administrator, a user without the read key and an anonymous session.' steps: Request the workspace application list with each caller. expected: >- The administrator receives the list; the other callers receive forbidden and unauthenticated responses respectively. negative: true data_needs: Licensing fixtures and an unsigned request. bound_to: - >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#serves an administrator of the customer holding platform.tenant-applications.read - >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#refuses a console user who does not hold that key, with 403 - >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#refuses an anonymous caller with 401 provenance: test source: >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#serves an administrator of the customer holding platform.tenant-applications.read - id: ATS-PFM-CSH-017-02 title: Ordering and reasons are understandable level: unit proves: - BR-CAP-PFM-CSH-017-02 - BR-CAP-PFM-CSH-017-03 - BR-CAP-PFM-CSH-017-04 preconditions: Application inputs cover available products and each unavailable state. steps: Sort the inputs and generate labels and explanations. expected: >- Available entries lead each name-ordered group, reasons are sentences, codes stay hidden and an ending licence does not change availability. negative: false data_needs: Availability-state and date variants. bound_to: - >- react-console:lib/applications/availability.test.ts#lists the available applications first, then by name - >- react-console:lib/applications/availability.test.ts#gives a plain sentence for each way an application is unavailable - >- react-console:lib/applications/availability.test.ts#turns Platform's reason code into English and never shows the code - >- react-console:lib/applications/availability.test.ts#says nothing about an application that is simply working - >- react-console:lib/applications/availability.test.ts#tells somebody a licence is ending without calling the application unavailable - >- react-console:lib/applications/availability.test.ts#shows no enum token and no unreadable date provenance: test source: >- react-console:lib/applications/availability.test.ts#lists the available applications first, then by name - id: ATS-PFM-CSH-017-03 title: The administrative page explains listed products level: browser proves: - BR-CAP-PFM-CSH-017-02 - BR-CAP-PFM-CSH-017-03 - AS-JNY-PFM-CSH-005-03 preconditions: The workspace has available and unavailable products. steps: Open the Applications overview. expected: All returned products appear with labels and the unavailable product has an explanation. negative: false data_needs: Mock application responses. bound_to: - >- react-console:e2e/mock/application-access.mock.spec.ts#the Applications page says which applications there are and why one cannot be used provenance: test source: >- react-console:e2e/mock/application-access.mock.spec.ts#the Applications page says which applications there are and why one cannot be used - id: ATS-PFM-CSH-017-04 title: The administrator overview presents an available application in plain words level: browser proves: - BR-CAP-PFM-CSH-017-03 preconditions: The development fixture supplies an available application. steps: Open the customer administrator’s Applications overview. expected: >- The fixture’s application displays Available, the list contains several applications and no enum tokens are displayed. negative: false data_needs: The development application fixture. bound_to: - >- react-console:e2e/dev/hq-licensing.dev.spec.ts#the tenant's own administrator reads Configuration › Applications with the same words provenance: test source: >- react-console:e2e/dev/hq-licensing.dev.spec.ts#the tenant's own administrator reads Configuration › Applications with the same words - id: ATS-PFM-CSH-017-05 title: 'Initial loading, failure and empty results remain understandable' level: browser proves: - BR-CAP-PFM-CSH-017-08 preconditions: 'The application read is delayed, fails or returns no entries.' steps: Open the overview for each response. expected: 'The body presents progress, retry after failure and the empty-list explanation respectively.' negative: true data_needs: Controlled initial application responses. bound_to: [] provenance: proposed source: >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#refuses a console user who does not hold that key, with 403 - id: ATS-PFM-CSH-017-06 title: Incomplete records reveal the permissive availability default level: unit proves: - BR-CAP-PFM-CSH-017-11 preconditions: A keyed entry omits availability and has unreadable companion states. steps: Parse that entry and one explicitly marked unavailable. expected: The incomplete entry defaults to available; exactly false remains unavailable. negative: true data_needs: Incomplete application records. bound_to: [] provenance: proposed source: 'react-console:lib/applications/types.ts:parseTenantApplication' - id: ATS-PFM-CSH-017-07 title: Date formatting preserves a licence’s calendar day level: unit proves: - BR-CAP-PFM-CSH-017-05 preconditions: The formatter is loaded in a time zone behind UTC. steps: Format the supplied licence date. expected: The displayed calendar day agrees with Platform’s date. negative: false data_needs: A date whose local midnight conversion could change the day. bound_to: - >- react-console:lib/applications/availability.test.ts#reads a licence date as the day Platform sent it, in a zone behind UTC provenance: test source: >- react-console:lib/applications/availability.test.ts#reads a licence date as the day Platform sent it, in a zone behind UTC - id: ATS-PFM-CSH-017-08 title: Parser fallback preserves only identifiable entries level: unit proves: - BR-CAP-PFM-CSH-017-09 preconditions: Inputs include missing keys and unrecognized licence and operational states. steps: Parse the collection. expected: Missing-key entries are removed; unknown states become unlicensed and not set up. negative: true data_needs: Parser boundary inputs. bound_to: - >- react-console:lib/applications/availability.test.ts#takes the records it understands and leaves out the ones it does not - >- react-console:lib/applications/availability.test.ts#treats a state it cannot read as no licence and an operation it cannot read as never set up provenance: test source: >- react-console:lib/applications/availability.test.ts#takes the records it understands and leaves out the ones it does not - id: ATS-PFM-CSH-017-09 title: The overview menu entry requires its view authority level: unit proves: - BR-CAP-PFM-CSH-017-10 preconditions: Navigation inputs include and omit the application-view key. steps: Build Configuration application links. expected: The overview appears first when permitted and is omitted otherwise. negative: true data_needs: Permission inputs for the overview link. bound_to: [] provenance: proposed source: 'react-console:components/console/nav-config.ts:configurationArea' - id: ATS-PFM-CSH-017-10 title: Disabled workspace reads retain the explicit reach boundary level: api proves: - BR-CAP-PFM-CSH-017-12 preconditions: The requested workspace is disabled; callers cover permitted and unrelated customer scopes. steps: Read the workspace application list with both callers. expected: The permitted caller receives the list and the unrelated caller receives not found. negative: true data_needs: A disabled workspace and two scoped administrator fixtures. bound_to: [] provenance: proposed source: >- services-platform:modules/tenants/aws/api/tenant-applications.routes.ts:tenantApplicationsRoutes - id: ATS-PFM-CSH-017-11 title: The customer answer withholds staff and commercial detail level: api proves: - BR-CAP-PFM-CSH-017-13 preconditions: 'The API fixtures include a staff grant, withholding and a suspension with a staff reason.' steps: Read the application answer as a customer administrator for each fixture. expected: >- Application facts remain available while overrides, staff identities and staff reasons are absent; withholding is described as unlicensed. negative: false data_needs: 'Licensing grant, withholding and suspension fixtures.' bound_to: - >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#answers each application with its key, name, licence state and dates, operation state and availability - >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#carries no override at all, which is where every commercial detail would be - >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#names nobody: not the staff member who decided, nor anyone who changed a state - >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#says a withheld application is simply not licensed, never that Rhythm withheld it - >- services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js#says a suspended application is unavailable without saying why Rhythm stopped it provenance: test source: 'services-platform:modules/licensing/tests/e2e/licensing.e2e.spec.js' - id: ATS-PFM-CSH-017-12 title: The administrative overview requires console view authority level: browser proves: - BR-CAP-PFM-CSH-017-01 preconditions: Two workspace sessions differ in application-view authority. steps: Open Configuration home in both sessions. expected: >- The permitted session receives the overview and the other receives the console permission explanation. negative: true data_needs: Permitted and refused mock sessions. bound_to: [] provenance: proposed source: >- react-console:components/configuration/applications/tenant-applications.tsx:TenantApplications; lib/authz/backend-aliases.ts:BACKEND_ALIASES evidence: - >- react-console at baf6dae: app/(console)/console/[tenantId]/configuration/page.tsx, components/configuration/applications/{tenant-applications,applications-page}.tsx, lib/applications/{api,availability,availability.test,types}.ts, lib/authz/backend-aliases.ts (configuration.applications.view), e2e/mock/application-access.mock.spec.ts, e2e/dev/hq-licensing.dev.spec.ts. - >- services-platform at ad3f6a6: modules/tenants/aws/api/tenant-applications.routes.ts (listTenantApplicationsForTenant), modules/licensing/aws/api/licensing-api-mapper.ts (toTenantApplications), modules/licensing/services/persistence/{applications,tenant-applications}.ts, modules/licensing/db/{applications,tenant-applications,licence-windows,licence-overrides}.table.ts (read through the availability answer; MOD-PFM-OPS), modules/licensing/tests/e2e/licensing.e2e.spec.js, docs/proposals/application-access-and-entitlements.md §6.4 and §7.2. --- # Understand the workspace’s application availability — acceptance ## Coverage The table separates scenarios with test bindings from proposed proof. A binding records a static examination of the test; it does not record a passing product test run. | Rule | Acceptance scenario | |---|---| | `BR-CAP-PFM-CSH-017-01` | `ATS-PFM-CSH-017-12` (proposed) | | `BR-CAP-PFM-CSH-017-02` | `ATS-PFM-CSH-017-02` (bound), `ATS-PFM-CSH-017-03` (bound) | | `BR-CAP-PFM-CSH-017-03` | `ATS-PFM-CSH-017-02` (bound), `ATS-PFM-CSH-017-03` (bound), `ATS-PFM-CSH-017-04` (bound) | | `BR-CAP-PFM-CSH-017-04` | `ATS-PFM-CSH-017-02` (bound) | | `BR-CAP-PFM-CSH-017-05` | `ATS-PFM-CSH-017-07` (bound) | | `BR-CAP-PFM-CSH-017-08` | `ATS-PFM-CSH-017-05` (proposed) | | `BR-CAP-PFM-CSH-017-09` | `ATS-PFM-CSH-017-08` (bound) | | `BR-CAP-PFM-CSH-017-10` | `ATS-PFM-CSH-017-09` (proposed) | | `BR-CAP-PFM-CSH-017-11` | `ATS-PFM-CSH-017-06` (proposed) | | `BR-CAP-PFM-CSH-017-12` | `ATS-PFM-CSH-017-10` (proposed) | | `BR-CAP-PFM-CSH-017-13` | `ATS-PFM-CSH-017-11` (bound) | | `BR-CAP-PFM-CSH-017-14` | `ATS-PFM-CSH-017-01` (bound) |