--- id: ATS-PFM-DJE-011 scope: CAP-PFM-DJE-011 product_area: platform module: data-job-engine revision: 2 status: proposed approved_by: null approved_at: null source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f scenarios: - id: ATS-PFM-DJE-011-01 title: Upload operations require their shared permission level: api proves: - BR-CAP-PFM-DJE-011-01 preconditions: Prepare a session and a caller lacking upload access. steps: - do: 'Attempt creation, signing, read, completion and abort.' expect: Each request is refused and the existing session remains open. provenance: test source: >- services-platform:modules/data-jobs/tests/e2e/data-jobs.e2e.spec.js#refuses opening a session to a console user without the key expected: Each request is refused and the existing session remains open. negative: true data_needs: Permission personas. bound_to: - TST-PFM-DJE-164 - TST-PFM-DJE-193 provenance: test source: >- services-platform:modules/data-jobs/tests/e2e/data-jobs.e2e.spec.js#refuses opening a session to a console user without the key category: permission binding_evidence: - >- services-platform:modules/data-jobs/tests/e2e/data-jobs.e2e.spec.js#refuses opening a session to a console user without the key - >- services-platform:modules/data-jobs/tests/e2e/data-jobs.e2e.spec.js#refuses reading a session, because which files a tenant loaded is not a read-only user’s business - >- services-platform:modules/data-jobs/tests/e2e/data-jobs.e2e.spec.js#left the session open after every refusal, so none of them half-happened - >- services-platform:modules/data-jobs/tests/unit/upload-permission.spec.ts#requires this one key on every one of them, opening and listing included - id: ATS-PFM-DJE-011-02 title: Invalid declarations create no upload level: api proves: - BR-CAP-PFM-DJE-011-02 preconditions: No session setup is required. steps: - do: 'Submit invalid name, type, size, digest and extra-property declarations.' expect: The response identifies the invalid property without creating an upload. provenance: test source: >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#refuses a declaration before it creates anything in S3, so a refused request leaves no upload behind expected: The response identifies the invalid property without creating an upload. negative: true data_needs: No additional fixture is needed. bound_to: - TST-PFM-DJE-178 - TST-PFM-DJE-164 provenance: test source: >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#refuses a declaration before it creates anything in S3, so a refused request leaves no upload behind category: validation binding_evidence: - >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#refuses a declaration before it creates anything in S3, so a refused request leaves no upload behind - >- services-platform:modules/data-jobs/tests/e2e/data-jobs.e2e.spec.js#refuses a declaration no data job can read, naming the property the caller sent - >- services-platform:modules/data-jobs/tests/e2e/data-jobs.e2e.spec.js#refuses a body carrying a property the request does not have - id: ATS-PFM-DJE-011-03 title: Part sizing remains within supported limits level: unit proves: - BR-CAP-PFM-DJE-011-03 preconditions: Use sizes between one byte and 5 TiB. steps: - do: Calculate their part sizes. expect: 'Sizes round to whole MiB, retain the 16 MiB floor and require at most 9,000 parts.' provenance: test source: >- services-platform:modules/data-jobs/tests/unit/part-sizing.spec.ts#holds the 16 MiB floor for every file the floor can divide into the allowed number of parts expected: 'Sizes round to whole MiB, retain the 16 MiB floor and require at most 9,000 parts.' negative: false data_needs: No additional fixture is needed. bound_to: - TST-PFM-DJE-190 provenance: test source: >- services-platform:modules/data-jobs/tests/unit/part-sizing.spec.ts#holds the 16 MiB floor for every file the floor can divide into the allowed number of parts category: boundary binding_evidence: - >- services-platform:modules/data-jobs/tests/unit/part-sizing.spec.ts#holds the 16 MiB floor for every file the floor can divide into the allowed number of parts - >- services-platform:modules/data-jobs/tests/unit/part-sizing.spec.ts#rounds a part size the division leaves between whole MiB up to the next whole MiB - >- services-platform:modules/data-jobs/tests/unit/part-sizing.spec.ts#leaves a thousand parts of headroom against S3’s own limit of ten thousand - id: ATS-PFM-DJE-011-04 title: Signed-part requests are bounded and repeatable level: api proves: - BR-CAP-PFM-DJE-011-04 preconditions: Prepare an open session. steps: - do: 'Request valid, out-of-range, repeated and excessive part lists, then use a closed session.' expect: Valid addresses expire after one hour and invalid requests are refused. provenance: test source: >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#signs each URL for one hour, which is how long a client has to use it expected: Valid addresses expire after one hour and invalid requests are refused. negative: true data_needs: No additional fixture is needed. bound_to: - TST-PFM-DJE-178 provenance: test source: >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#signs each URL for one hour, which is how long a client has to use it category: boundary binding_evidence: - >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#signs each URL for one hour, which is how long a client has to use it - >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#refuses more than a hundred parts at a time, which is the page the protocol presigns - >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#refuses to presign a session that is no longer open - id: ATS-PFM-DJE-011-05 title: Completion checks assembled size and part receipts level: api proves: - BR-CAP-PFM-DJE-011-05 preconditions: Prepare a session whose assembled object is short. steps: - do: Complete it and separately test missing parts and missing receipts. expect: Wrong size aborts the session; incomplete part declarations are refused. provenance: test source: >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#refuses a completion whose object is not the size that was declared expected: Wrong size aborts the session; incomplete part declarations are refused. negative: true data_needs: A storage test double. bound_to: - TST-PFM-DJE-178 provenance: test source: >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#refuses a completion whose object is not the size that was declared category: validation binding_evidence: - >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#refuses a completion whose object is not the size that was declared - >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#aborts the session after refusing it for its size, so no client is left holding the wrong file open - >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#refuses a completion that does not name every part of the file - id: ATS-PFM-DJE-011-06 title: Digest evidence distinguishes measured and declared values level: api proves: - BR-CAP-PFM-DJE-011-06 preconditions: 'Prepare matching, mismatching and oversized objects with declared digests.' steps: - do: Complete each upload. expect: >- Matching input has a verified digest; mismatch is refused and aborted; oversized input without measurement remains unverified. provenance: test source: >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#records the digest it measured over the stored object when it is the one that was declared expected: >- Matching input has a verified digest; mismatch is refused and aborted; oversized input without measurement remains unverified. negative: true data_needs: A storage test double. bound_to: - TST-PFM-DJE-178 provenance: test source: >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#records the digest it measured over the stored object when it is the one that was declared category: boundary binding_evidence: - >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#records the digest it measured over the stored object when it is the one that was declared - >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#refuses a completion whose object is not the file the declared SHA-256 describes, naming sha256 - >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#completes a file over the measured size with its declared digest recorded and no verified digest - id: ATS-PFM-DJE-011-07 title: Settled sessions have stable outcomes level: api proves: - BR-CAP-PFM-DJE-011-07 preconditions: 'Prepare completed, aborted and storage-abandoned sessions.' steps: - do: 'Repeat completion, abort a completion, repeat abort and inspect abandoned input.' expect: >- Invalid transitions are refused, repeated abort returns its settled result and abandoned input expires. provenance: test source: >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#refuses a second completion of a session that is already completed expected: >- Invalid transitions are refused, repeated abort returns its settled result and abandoned input expires. negative: true data_needs: A storage test double. bound_to: - TST-PFM-DJE-178 provenance: test source: >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#refuses a second completion of a session that is already completed category: transition binding_evidence: - >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#refuses a second completion of a session that is already completed - >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#refuses to abort a completed session, whose object a job may already be reading - >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#answers the same session a second time rather than refusing a client that aborts twice - >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#settles a session S3 has already abandoned as expired, rather than leaving it open for ever - id: ATS-PFM-DJE-011-08 title: Missing storage parts allow repair level: api proves: - BR-CAP-PFM-DJE-011-08 preconditions: Prepare completion input naming an unavailable part. steps: - do: Request completion. expect: A descriptive 400 leaves the session open. provenance: test source: >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#refuses in words a completion naming a part S3 does not hold, rather than failing as a server fault expected: A descriptive 400 leaves the session open. negative: true data_needs: A storage test double. bound_to: - TST-PFM-DJE-178 provenance: test source: >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#refuses in words a completion naming a part S3 does not hold, rather than failing as a server fault category: failure binding_evidence: - >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#refuses in words a completion naming a part S3 does not hold, rather than failing as a server fault - >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#leaves the session open after refusing parts S3 does not hold, so the client can upload them again - id: ATS-PFM-DJE-011-09 title: Upload metadata and workspace boundaries conceal internal state level: api proves: - BR-CAP-PFM-DJE-011-09 preconditions: Prepare sessions in two workspaces. steps: - do: 'Inspect metadata and attempt cross-workspace reads, completion and abort.' expect: >- Metadata omits internal storage fields; cross-workspace input is not found without a storage call. provenance: test source: >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#answers nothing about where the file is going: no bucket, no key, no S3 upload id expected: >- Metadata omits internal storage fields; cross-workspace input is not found without a storage call. negative: true data_needs: Two independent workspaces. bound_to: - TST-PFM-DJE-178 - TST-PFM-DJE-164 provenance: test source: >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#answers nothing about where the file is going: no bucket, no key, no S3 upload id category: invariant binding_evidence: - >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#answers nothing about where the file is going: no bucket, no key, no S3 upload id - >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#refuses to complete another tenant’s session, and makes no S3 call for it - >- services-platform:modules/data-jobs/tests/e2e/data-jobs.e2e.spec.js#never answers the key or the S3 upload id of a session, which are the server’s - id: ATS-PFM-DJE-011-10 title: Only a completed workspace upload supplies file work category: interaction level: api exercises: - CAP-PFM-DJE-011 - CAP-PFM-DJE-014 proves: - BR-CAP-PFM-DJE-011-07 - BR-CAP-PFM-DJE-011-09 - BR-CAP-PFM-DJE-014-01 preconditions: 'Create open, completed and foreign-workspace upload sessions.' steps: - do: Submit equivalent file jobs against each session and process the accepted job. expect: >- Only the completed local session supplies input; unavailable sessions create no processing work and foreign input is concealed. provenance: proposed source: >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#refuses to abort a completed session, whose object a job may already be reading; services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#refuses to complete another tenant’s session, and makes no S3 call for it; services-platform:modules/data-jobs/services/uploads/upload-sessions.ts:presignUploadParts; services-crm:modules/data-jobs/tests/e2e/bulk-data-jobs.e2e.spec.js#refuses an upload id of no upload at all in the same words, so neither answer tells a caller whose it is expected: >- Only the completed local session supplies input; unavailable sessions create no processing work and foreign input is concealed. negative: true data_needs: 'Create open, completed and foreign-workspace upload sessions.' bound_to: [] provenance: proposed source: >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#refuses to abort a completed session, whose object a job may already be reading; services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#refuses to complete another tenant’s session, and makes no S3 call for it; services-platform:modules/data-jobs/services/uploads/upload-sessions.ts:presignUploadParts; services-crm:modules/data-jobs/tests/e2e/bulk-data-jobs.e2e.spec.js#refuses an upload id of no upload at all in the same words, so neither answer tells a caller whose it is - id: ATS-PFM-DJE-011-11 title: Package registration checks recorded upload integrity category: interaction level: api exercises: - CAP-PFM-DJE-011 - CAP-PFM-DJE-016 proves: - BR-CAP-PFM-DJE-011-05 - BR-CAP-PFM-DJE-011-06 - BR-CAP-PFM-DJE-016-03 preconditions: Complete manifest and dataset uploads with known sizes and a checkable digest. steps: - do: >- Register a package with a mismatched dataset digest, then one matching the saved upload evidence. expect: The mismatch leaves no run; the matching package registers before any dataset job starts. provenance: proposed source: >- services-platform:modules/data-jobs/services/uploads/upload-sessions.ts:requireCompletedParts; services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#refuses a completion whose object is not the file the declared SHA-256 describes, naming sha256; services-platform:modules/data-jobs/services/uploads/upload-sessions.ts:verifiedDigestOf; services-platform:modules/data-jobs/services/runs/register-run.ts:registerRun expected: The mismatch leaves no run; the matching package registers before any dataset job starts. negative: false data_needs: Complete manifest and dataset uploads with known sizes and a checkable digest. bound_to: [] provenance: proposed source: >- services-platform:modules/data-jobs/services/uploads/upload-sessions.ts:requireCompletedParts; services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#refuses a completion whose object is not the file the declared SHA-256 describes, naming sha256; services-platform:modules/data-jobs/services/uploads/upload-sessions.ts:verifiedDigestOf; services-platform:modules/data-jobs/services/runs/register-run.ts:registerRun - id: ATS-PFM-DJE-011-12 title: Reset keeps input available while deletion removes it category: interaction level: api exercises: - CAP-PFM-DJE-011 - CAP-PFM-DJE-017 proves: - BR-CAP-PFM-DJE-011-11 - BR-CAP-PFM-DJE-017-02 - BR-CAP-PFM-DJE-017-04 preconditions: Prepare completed uploads and loaded records in a loading workspace. steps: - do: >- Reset the workspace, inspect retained uploads, reload from them, then invoke workspace deletion on a separate disposable fixture. expect: >- Reset retains input for another load; deletion removes its upload records and stored versions. provenance: proposed source: >- services-platform:docs/data-jobs/uploads.md#Deletion; services-crm:modules/data-jobs/tests/integration/services/jobs/initial-import-guarantees.integration.spec.js#removes everything the load wrote: no contact, organization, imported type or crosswalk row is left; services-crm:modules/data-jobs/tests/integration/services/jobs/initial-import-guarantees.integration.spec.js#reloads the same records as the load before the reset, numbers included expected: Reset retains input for another load; deletion removes its upload records and stored versions. negative: false data_needs: Prepare completed uploads and loaded records in a loading workspace. bound_to: [] provenance: proposed source: >- services-platform:docs/data-jobs/uploads.md#Deletion; services-crm:modules/data-jobs/tests/integration/services/jobs/initial-import-guarantees.integration.spec.js#removes everything the load wrote: no contact, organization, imported type or crosswalk row is left; services-crm:modules/data-jobs/tests/integration/services/jobs/initial-import-guarantees.integration.spec.js#reloads the same records as the load before the reset, numbers included evidence: - >- Reviewed evidence: services-platform (ad3f6a65): docs/data-jobs/uploads.md; modules/data-jobs/aws/api/data-jobs.routes.ts; services/uploads/upload-sessions.ts, upload-storage.ts; services/persistence/uploads.ts; db/data-job-uploads.table.ts; data-jobs.settings.ts; aws/resources/data-jobs-storage.s3.ts; tests upload-sessions.integration.spec.js, uploads.integration.spec.js, uploads.queries.integration.spec.js, data-jobs.e2e.spec.js, unit/part-sizing.spec.ts, unit/upload-permission.spec.ts. - >- Reviewed evidence: react-console (baf6dae3): lib/api/data-jobs/uploads.ts, multipart.ts, sha256.ts; components/data-management/data-jobs/new/upload-progress.tsx. - >- Testing back-fill: related capability rules, domain invariants, state transitions and crossing workflows at the pinned source revisions. coverage: rule: 'gap: FND-PFM-DJE-071' transition: 'gap: FND-PFM-DJE-071' validation: covered permission: covered edge: 'gap: FND-PFM-DJE-071' failure: covered boundary: covered concurrency: 'gap: FND-PFM-DJE-071' invariant: covered interaction: covered coverage_notes: transition: >- Selected lifecycle examples do not cover every applicable object and batch transition. The linked finding retains the remaining matrix. execution: >- Covered means a specification scenario exists. Proposed scenarios and registered suites with no run result do not establish executed conformance. related: - CAP-PFM-DJE-014 - CAP-PFM-DJE-016 workflows: - WF-PFM-DJE-008 - WF-PFM-DJE-010 - WF-PFM-DJE-014 - WF-PFM-DJE-020 coverage_evidence: - rule: BR-CAP-PFM-DJE-011-01 scenarios: - ATS-PFM-DJE-011-01 provenance: proposed source: >- services-platform:modules/data-jobs/tests/e2e/data-jobs.e2e.spec.js#refuses reading a session, because which files a tenant loaded is not a read-only user’s business - rule: BR-CAP-PFM-DJE-011-02 scenarios: - ATS-PFM-DJE-011-02 provenance: proposed source: >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#refuses a declaration before it creates anything in S3, so a refused request leaves no upload behind - rule: BR-CAP-PFM-DJE-011-03 scenarios: - ATS-PFM-DJE-011-03 provenance: proposed source: >- services-platform:modules/data-jobs/tests/unit/part-sizing.spec.ts#rounds a part size the division leaves between whole MiB up to the next whole MiB - rule: BR-CAP-PFM-DJE-011-04 scenarios: - ATS-PFM-DJE-011-04 provenance: proposed source: >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#refuses more than a hundred parts at a time, which is the page the protocol presigns - rule: BR-CAP-PFM-DJE-011-05 scenarios: - ATS-PFM-DJE-011-05 - ATS-PFM-DJE-011-11 provenance: proposed source: 'services-platform:modules/data-jobs/services/uploads/upload-sessions.ts:requireCompletedParts' - rule: BR-CAP-PFM-DJE-011-06 scenarios: - ATS-PFM-DJE-011-06 - ATS-PFM-DJE-011-11 provenance: proposed source: >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#refuses a completion whose object is not the file the declared SHA-256 describes, naming sha256; services-platform:modules/data-jobs/services/uploads/upload-sessions.ts:verifiedDigestOf - rule: BR-CAP-PFM-DJE-011-07 scenarios: - ATS-PFM-DJE-011-07 - ATS-PFM-DJE-011-10 provenance: proposed source: >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#refuses to abort a completed session, whose object a job may already be reading - rule: BR-CAP-PFM-DJE-011-08 scenarios: - ATS-PFM-DJE-011-08 provenance: proposed source: >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#refuses in words a completion naming a part S3 does not hold, rather than failing as a server fault - rule: BR-CAP-PFM-DJE-011-09 scenarios: - ATS-PFM-DJE-011-09 - ATS-PFM-DJE-011-10 provenance: proposed source: >- services-platform:modules/data-jobs/tests/integration/services/uploads/upload-sessions.integration.spec.js#refuses to complete another tenant’s session, and makes no S3 call for it; services-platform:modules/data-jobs/services/uploads/upload-sessions.ts:presignUploadParts --- # Upload a bounded file for reliable job input: Capability Test Specification ## Coverage The structured coverage rows link required rules to their scenarios. A covered category has a defined check; executable coverage and successful execution require separate evidence. The category map keeps incomplete lifecycle matrices and other missing checks visible as findings. ## Interactions With Related Capabilities Only a completed workspace upload supplies file work. Package registration checks recorded upload integrity. Reset keeps input available while deletion removes it. The interaction scenarios use the related capabilities' rule references and identify the shared fixture and observable outcome.