--- id: ATS-PFM-INT-003 scope: CAP-PFM-INT-003 product_area: platform module: integrations revision: 3 status: proposed source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 macroservice-libraries: 54536a441935c6e09fdb7f96f0bec71c52ba4e03 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f scenarios: - id: ATS-PFM-INT-003-01 title: Duplicate or hidden installations are rejected level: api proves: - BR-CAP-PFM-INT-003-01 preconditions: One public provider is installed and another provider is internal. steps: Try to install the first again and the internal provider as a customer administrator. expected: 'The repeat conflicts, the hidden offer is not found and neither attempt creates an installation.' negative: true data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-551 - TST-PFM-INT-505 provenance: test source: >- services-platform:modules/integrations/tests/integration/services/installations/installation-lifecycle.integration.spec.js#refuses an integration installed already, and writes no second category: validation binding_evidence: - >- services-platform:modules/integrations/tests/integration/services/installations/installation-lifecycle.integration.spec.js#refuses an integration installed already, and writes no second - >- services-platform:modules/integrations/tests/integration/services/installations/installation-lifecycle.integration.spec.js#refuses an integration the tenant may not see (internal), as not found - >- services-platform:modules/integrations/tests/integration/db/integration-installations.table.integration.spec.js#refuses a second installation of the definition in the tenant binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-003-02 title: Installation acceptance is limited to declared access level: browser proves: - BR-CAP-PFM-INT-003-02 - AS-JNY-PFM-INT-001-01 preconditions: The available test provider has not been installed. steps: Untick two access choices during install and later submit a permission outside its declaration. expected: >- Saved access matches the selected choices; undeclared access is identified and refused without a change. negative: true data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-551 - TST-PFM-INT-550 - TST-PFM-INT-581 - TST-PFM-INT-347 provenance: test source: >- services-platform:modules/integrations/tests/integration/services/installations/installation-lifecycle.integration.spec.js#refuses an acceptance wider than the manifest declares, naming it, and writes nothing category: validation binding_evidence: - >- services-platform:modules/integrations/tests/integration/services/installations/installation-lifecycle.integration.spec.js#refuses an acceptance wider than the manifest declares, naming it, and writes nothing - >- services-platform:modules/integrations/tests/integration/services/installations/history-and-security-trail.integration.spec.js#is never widened beyond what the integration declares: refused, naming it, and nothing is written - >- services-platform:modules/integrations/tests/unit/services/installation-acceptance.spec.ts#refuses a field beyond the manifest’s for the dataset, naming it - >- react-console:acceptance/integrations/playwright/journeys/library/INT-ACC-0006.spec.ts#INT-ACC-0006 binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-003-03 title: Provider settings errors are actionable level: browser proves: - BR-CAP-PFM-INT-003-03 preconditions: The installation form includes an optional statement prefix. steps: Submit an invalid prefix and then correct it. expected: The form explains the invalid value and saves the corrected settings. negative: true data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-551 - TST-PFM-INT-581 - TST-PFM-INT-350 provenance: test source: >- services-platform:modules/integrations/tests/integration/services/installations/installation-lifecycle.integration.spec.js#refuses settings the manifest’s schema refuses, and writes nothing category: validation binding_evidence: - >- services-platform:modules/integrations/tests/integration/services/installations/installation-lifecycle.integration.spec.js#refuses settings the manifest’s schema refuses, and writes nothing - >- services-platform:modules/integrations/tests/unit/services/installation-acceptance.spec.ts#refuses settings the schema refuses, naming the field - >- react-console:acceptance/integrations/playwright/journeys/library/INT-ACC-0009.spec.ts#INT-ACC-0009 binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-003-04 title: Concurrent installation edits preserve the newer save level: api proves: - BR-CAP-PFM-INT-003-04 preconditions: An installation was read before another change advanced its version. steps: Save settings using the earlier version. expected: The stale save is refused and the latest saved values remain intact. negative: true data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-551 provenance: test source: >- services-platform:modules/integrations/tests/integration/services/installations/installation-lifecycle.integration.spec.js#refuses a stale version and leaves the settings as they were category: concurrency binding_evidence: - >- services-platform:modules/integrations/tests/integration/services/installations/installation-lifecycle.integration.spec.js#refuses a stale version and leaves the settings as they were binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-003-05 title: Consent withdrawal prevents provider contact level: api proves: - BR-CAP-PFM-INT-003-05 preconditions: A refund-capable connection is bound and refunds are accepted. steps: Withdraw refund acceptance and invoke a refund through that binding. expected: 'Authorization fails in the trace, the binding refuses and no provider call or execution is created.' negative: true data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-539 - TST-PFM-INT-531 provenance: test source: >- services-platform:modules/integrations/tests/integration/services/executions/consent-narrowing.integration.spec.js#INT-ACC-0509 step 4: refuses the refund 409 binding_ineligible category: interaction binding_evidence: - >- services-platform:modules/integrations/tests/integration/services/executions/consent-narrowing.integration.spec.js#INT-ACC-0509 step 4: refuses the refund 409 binding_ineligible - >- services-platform:modules/integrations/tests/integration/services/executions/consent-narrowing.integration.spec.js#INT-ACC-0509 step 4: the adapter receives no call - >- services-platform:modules/integrations/tests/integration/services/credentials/lease-accepted-permissions.integration.spec.js#a lease carries no Rhythm permission the installation withdrew after install binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-003-06 title: Installation pause respects independently paused accounts level: api proves: - BR-CAP-PFM-INT-003-06 preconditions: 'The installation has active, degraded and separately suspended connections.' steps: 'Suspend without a reason, suspend with a reason and resume.' expected: >- The empty reason fails; the valid pause suspends the first two connections, and resume restores only those two. negative: false data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-551 provenance: test source: >- services-platform:modules/integrations/tests/integration/services/installations/installation-lifecycle.integration.spec.js#suspends the active and degraded connections of the installation when it is suspended category: transition binding_evidence: - >- services-platform:modules/integrations/tests/integration/services/installations/installation-lifecycle.integration.spec.js#suspends the active and degraded connections of the installation when it is suspended - >- services-platform:modules/integrations/tests/integration/services/installations/installation-lifecycle.integration.spec.js#refuses to suspend without a reason - >- services-platform:modules/integrations/tests/integration/services/installations/installation-lifecycle.integration.spec.js#resumes the connections its suspension suspended, and only those - >- services-platform:modules/integrations/tests/integration/services/installations/installation-lifecycle.integration.spec.js#refuses to suspend a suspended installation, and leaves it as it was binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-003-07 title: Removal requires account disconnection level: browser proves: - BR-CAP-PFM-INT-003-07 - AS-JNY-PFM-INT-002-03 preconditions: A suspended installation retains a connected account. steps: 'Attempt uninstall, disconnect the account and uninstall again.' expected: >- The first refusal names the account; the second removes the suspended installation and records the accepted change in both trails. negative: true data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-522 - TST-PFM-INT-487 - TST-PFM-INT-151 provenance: test source: >- services-platform:modules/integrations/tests/integration/services/connections/disconnect-discard-uninstall.integration.spec.js#is refused while a connection is not disconnected, naming each by id, name and status category: transition binding_evidence: - >- services-platform:modules/integrations/tests/integration/services/connections/disconnect-discard-uninstall.integration.spec.js#is refused while a connection is not disconnected, naming each by id, name and status - >- services-platform:modules/integrations/tests/integration/services/connections/disconnect-discard-uninstall.integration.spec.js#uninstalls a suspended installation once every connection is disconnected, recording where it came from - >- services-platform:modules/integrations/tests/e2e/disconnect-and-uninstall.e2e.spec.js#answers an uninstallation 409, code installation_has_connections, naming each connection that remains - >- react-console:acceptance/integrations/playwright/journeys/catalog/INT-ACC-0124.spec.ts#INT-ACC-0124 binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-003-08 title: Removal stops only its own subscriptions level: api proves: - BR-CAP-PFM-INT-003-08 preconditions: Two installations subscribe to contact changes. steps: Uninstall one and change a contact. expected: >- Its subscriptions are deleted and receive no new delivery; the other installation still receives the change. negative: false data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-522 provenance: test source: >- services-platform:modules/integrations/tests/integration/services/connections/disconnect-discard-uninstall.integration.spec.js#removes every subscription of the installation with the uninstallation, and no other installation’s category: interaction binding_evidence: - >- services-platform:modules/integrations/tests/integration/services/connections/disconnect-discard-uninstall.integration.spec.js#removes every subscription of the installation with the uninstallation, and no other installation’s - >- services-platform:modules/integrations/tests/integration/services/connections/disconnect-discard-uninstall.integration.spec.js#writes no further delivery for the installation, while another installation’s subscription still receives one binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-003-09 title: Accepted access changes retain an audit trail level: api proves: - BR-CAP-PFM-INT-003-10 preconditions: An enabled installation is available for edits. steps: 'Reduce acceptance, restore declared access, suspend, repeat suspension and resume.' expected: >- Accepted changes appear in integration history and security history with widening classification; the repeated suspension appears in neither. negative: false data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-550 provenance: test source: >- services-platform:modules/integrations/tests/integration/services/installations/history-and-security-trail.integration.spec.js#writes the narrowing to the history and to the security trail category: invariant binding_evidence: - >- services-platform:modules/integrations/tests/integration/services/installations/history-and-security-trail.integration.spec.js#writes the narrowing to the history and to the security trail - >- services-platform:modules/integrations/tests/integration/services/installations/history-and-security-trail.integration.spec.js#flags a later acceptance of something the previous one lacked as a widening, and a mere re-statement as none - >- services-platform:modules/integrations/tests/integration/services/installations/history-and-security-trail.integration.spec.js#records a refused suspension in neither trail - >- services-platform:modules/integrations/tests/integration/services/installations/history-and-security-trail.integration.spec.js#writes the resumption to the history and to the security trail, as a widening binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-003-10 title: Workspace purge preserves its neighbour level: api proves: - BR-CAP-PFM-INT-003-11 preconditions: 'Two workspaces have provider records, audit history and binding revisions.' steps: Purge one through the deletion participant. expected: Its integration records are absent and the neighbouring workspace’s history and revisions remain. negative: false data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-553 provenance: test source: >- services-platform:modules/integrations/tests/integration/services/maintenance/tenant-participant.integration.spec.js#leaves every table of the module empty of the tenant, the ones the application can delete included category: boundary binding_evidence: - >- services-platform:modules/integrations/tests/integration/services/maintenance/tenant-participant.integration.spec.js#leaves every table of the module empty of the tenant, the ones the application can delete included - >- services-platform:modules/integrations/tests/integration/services/maintenance/tenant-participant.integration.spec.js#leaves the other tenant’s audit events and revisions untouched binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-003-11 title: Known identifiers do not cross workspace boundaries level: api proves: - BR-CAP-PFM-INT-003-12 preconditions: A different workspace’s administrator holds all integration permissions there. steps: Request reads and edits for this workspace through lists and known record identifiers. expected: Every cross-workspace request is refused and the target records remain unchanged. negative: true data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-491 - TST-PFM-INT-505 provenance: test source: >- services-platform:modules/integrations/tests/e2e/reader-access.e2e.spec.js#is refused every tenant route of this tenant, by id as by list (403) category: permission binding_evidence: - >- services-platform:modules/integrations/tests/e2e/reader-access.e2e.spec.js#is refused every tenant route of this tenant, by id as by list (403) - >- services-platform:modules/integrations/tests/e2e/reader-access.e2e.spec.js#is refused every change of this tenant (403) - >- services-platform:modules/integrations/tests/integration/db/integration-installations.table.integration.spec.js#answers another tenant nothing of it, with no predicate binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-003-12 level: api negative: true data_needs: Run-owned records and principals in an isolated workspace. bound_to: [] provenance: proposed title: Exercise the complete installation lifecycle category: transition proves: - BR-CAP-PFM-INT-003-01 - BR-CAP-PFM-INT-003-04 - BR-CAP-PFM-INT-003-06 - BR-CAP-PFM-INT-003-07 - BR-CAP-PFM-INT-003-09 preconditions: >- Prepare one independent record in each starting state, including absent-record cases where the model defines creation. steps: >- Run each listed transition once with its guard satisfied, then repeat it with the guard denied. Inspect the resulting record and listed side effects after commit. expected: >- Each positive case reaches its listed destination and records its defined side effects. Each denied case preserves the starting record and creates no transition side effects. source: >- rhythm-v2-docs:specs/platform/integrations/design/state-models/STATE-PFM-INT-002-installation-lifecycle.md#transitions state_model: STATE-PFM-INT-002 transition_cases: - from: absent to: enabled trigger: Adopt the integration guard: The offer is visible with a published current release and valid settings and accepted access side_effects: - Commit adoption values and both audit entries. provenance: proposed source: >- services-platform:modules/integrations/tests/integration/services/installations/installation-lifecycle.integration.spec.js#refuses an integration installed already, and writes no second - from: enabled to: enabled trigger: Edit adopted configuration guard: The supplied version matches and values fit the current declaration side_effects: - Clear notices affected by settings - Pause subscriptions to withdrawn event types - Commit both audit entries. provenance: proposed source: >- services-platform:modules/integrations/tests/integration/services/installations/installation-lifecycle.integration.spec.js#refuses a stale version and leaves the settings as they were - from: enabled to: suspended trigger: Pause adoption guard: The request includes a suspension reason side_effects: - Pause active and degraded accounts with installation attribution - Invalidate their bindings and retain audit entries. provenance: proposed source: >- services-platform:modules/integrations/tests/integration/services/installations/installation-lifecycle.integration.spec.js#suspends the active and degraded connections of the installation when it is suspended - from: suspended to: enabled trigger: Restore adoption guard: The installation remains suspended side_effects: - Restore only accounts paused by this installation and bindings eligible again. provenance: proposed source: >- services-platform:modules/integrations/tests/integration/services/installations/installation-lifecycle.integration.spec.js#suspends the active and degraded connections of the installation when it is suspended - from: enabled to: uninstalled trigger: Remove adoption guard: Every account link has reached disconnected side_effects: - Delete subscriptions and commit both audit entries. provenance: proposed source: >- services-platform:modules/integrations/tests/integration/services/connections/disconnect-discard-uninstall.integration.spec.js#is refused while a connection is not disconnected, naming each by id, name and status - from: suspended to: uninstalled trigger: Remove paused adoption guard: Every account link has reached disconnected side_effects: - Delete the installation’s subscriptions with removal. provenance: proposed source: >- services-platform:modules/integrations/services/installations/installation-lifecycle.ts:uninstallInstallation - from: uninstalled to: enabled trigger: Adopt after prior removal guard: Ordinary offer and configuration validation passes again side_effects: - Reuse the retained record with new acceptance and record reinstallation. provenance: proposed source: >- services-platform:modules/integrations/tests/integration/services/installations/installation-lifecycle.integration.spec.js#installs again as the same row, enabled with the new acceptance, audited as a reinstallation proof_boundary: >- The parameterized cases prove the listed lifecycle outcomes. Separate assertions are needed for independent object invariants, numeric limits and simultaneous requests. - id: ATS-PFM-INT-003-13 level: api negative: false data_needs: Run-owned records and principals in an isolated workspace. bound_to: [] provenance: proposed title: Installation pause distinguishes independent account pauses category: interaction proves: - BR-CAP-PFM-INT-003-06 - BR-CAP-PFM-INT-004-06 exercises: - CAP-PFM-INT-003 - CAP-PFM-INT-004 preconditions: 'An installation has active, degraded and independently suspended accounts.' steps: Suspend and resume the installation; inspect account state and actor history. expected: Only accounts paused by the installation return to use. source: - >- services-platform:modules/integrations/tests/integration/services/installations/installation-lifecycle.integration.spec.js#suspends the active and degraded connections of the installation when it is suspended - >- services-platform:modules/integrations/tests/integration/services/installations/history-and-security-trail.integration.spec.js#refuses a suspension of a connection that is not active, recording it in neither trail workflows: [] - id: ATS-PFM-INT-003-14 level: api negative: false data_needs: Run-owned records and principals in an isolated workspace. bound_to: [] provenance: proposed title: Uninstall removes only its own delivery interests category: interaction proves: - BR-CAP-PFM-INT-003-08 - BR-CAP-PFM-INT-014-07 exercises: - CAP-PFM-INT-003 - CAP-PFM-INT-014 preconditions: Two installations subscribe to one business change and all accounts of the first are disconnected. steps: Uninstall the first installation and generate the subscribed change. expected: Only the surviving installation receives a delivery record. source: - >- services-platform:modules/integrations/tests/integration/services/connections/disconnect-discard-uninstall.integration.spec.js#removes every subscription of the installation with the uninstallation, and no other installation’s - >- services-platform:modules/integrations/tests/integration/services/subscriptions/subscription-consent.integration.spec.js#skips a subscription whose installation is suspended, and delivers again once it is resumed workflows: - WF-PFM-INT-002 - id: ATS-PFM-INT-003-15 level: api negative: false data_needs: Run-owned records and principals in an isolated workspace. bound_to: [] provenance: proposed title: An installation change is visible in operational history category: interaction proves: - BR-CAP-PFM-INT-003-10 - BR-CAP-PFM-INT-006-08 exercises: - CAP-PFM-INT-003 - CAP-PFM-INT-006 preconditions: An installation can be edited and its history is readable. steps: 'Save an accepted access change, then submit a stale edit and read history.' expected: The saved change appears once and the refused edit contributes no history entry. source: - >- services-platform:modules/integrations/tests/integration/services/installations/history-and-security-trail.integration.spec.js#writes the narrowing to the history and to the security trail - >- services-platform:modules/integrations/tests/e2e/audit-events-paging.e2e.spec.js#INT-ACC-0530 step 2: the pages run newest first across the boundary workflows: [] - id: ATS-PFM-INT-003-16 level: api negative: false data_needs: Run-owned records and principals in an isolated workspace. bound_to: [] provenance: proposed title: Workspace lifecycle separates defaults from retained history category: interaction proves: - BR-CAP-PFM-INT-003-11 - BR-CAP-PFM-INT-022-02 exercises: - CAP-PFM-INT-003 - CAP-PFM-INT-022 preconditions: Two workspaces have installations and seeded calendars. steps: >- Retry provisioning, delete one workspace through its participants and inspect the remaining workspace. expected: >- Provisioning creates no duplicate seed and deletion removes only the selected workspace records, with protected history removed last. source: - >- services-platform:modules/integrations/tests/integration/services/maintenance/tenant-participant.integration.spec.js#leaves every table of the module empty of the tenant, the ones the application can delete included - >- services-platform:modules/workflow-actions/tests/integration/services/maintenance/tenant-participant.integration.spec.js#gives the tenant Standard week in its own zone, as its default workflows: - WF-PFM-INT-023 evidence: - >- Each binding identifies an existing source test at the pinned revision; unbound scenarios remain proposed proof obligations. coverage: rule: 'gap: FND-PFM-INT-056' transition: covered validation: covered permission: covered edge: 'gap: FND-PFM-INT-056' failure: 'gap: FND-PFM-INT-056' boundary: covered concurrency: covered invariant: covered interaction: covered coverage_notes: covered: A designed scenario exists; executable coverage and a passing run require separate evidence. gaps: >- The finding records categories without a designed scenario and remaining permission and rule audit obligations. --- # Adopt an integration with reviewed access: Capability Test Specification ## Coverage | Rule | Proved By | |---|---| | `BR-CAP-PFM-INT-003-01` | `ATS-PFM-INT-003-01`, `ATS-PFM-INT-003-12` | | `BR-CAP-PFM-INT-003-02` | `ATS-PFM-INT-003-02` | | `BR-CAP-PFM-INT-003-03` | `ATS-PFM-INT-003-03` | | `BR-CAP-PFM-INT-003-04` | `ATS-PFM-INT-003-04`, `ATS-PFM-INT-003-12` | | `BR-CAP-PFM-INT-003-05` | `ATS-PFM-INT-003-05` | | `BR-CAP-PFM-INT-003-06` | `ATS-PFM-INT-003-06`, `ATS-PFM-INT-003-12`, `ATS-PFM-INT-003-13` | | `BR-CAP-PFM-INT-003-07` | `ATS-PFM-INT-003-07`, `ATS-PFM-INT-003-12` | | `BR-CAP-PFM-INT-003-08` | `ATS-PFM-INT-003-08`, `ATS-PFM-INT-003-14` | | `BR-CAP-PFM-INT-003-09` | `ATS-PFM-INT-003-12` | | `BR-CAP-PFM-INT-003-10` | `ATS-PFM-INT-003-09`, `ATS-PFM-INT-003-15` | | `BR-CAP-PFM-INT-003-11` | `ATS-PFM-INT-003-10`, `ATS-PFM-INT-003-16` | | `BR-CAP-PFM-INT-003-12` | `ATS-PFM-INT-003-11` | ## Interactions With Related Capabilities Installation establishes the access envelope used by account connections, bindings and calls. The interaction cases follow narrowing and retirement through those dependants, including work already underway and the history left behind. The structured scenarios name the capabilities and rules involved. A bound test contributes only the outcomes it asserts; proposed transition matrices and composed interactions still require executable proof.