--- id: ATS-PFM-INT-005 scope: CAP-PFM-INT-005 product_area: platform module: integrations revision: 3 status: proposed source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 macroservice-libraries: 54536a441935c6e09fdb7f96f0bec71c52ba4e03 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f scenarios: - id: ATS-PFM-INT-005-01 title: Credential reads and traces reveal no key value level: api proves: - BR-CAP-PFM-INT-005-01 preconditions: A key has just been saved for a connection. steps: 'Inspect credential facts, Library responses, integration records and entry logs.' expected: >- Responses retain only non-secret facts and a permitted hint; records and logs omit the entered secret. negative: false data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-529 - TST-PFM-INT-526 - TST-PFM-INT-486 - TST-PFM-INT-491 provenance: test source: >- services-platform:modules/integrations/tests/integration/services/credentials/credential-state.integration.spec.js#answers no secret value, secret name or key version category: invariant binding_evidence: - >- services-platform:modules/integrations/tests/integration/services/credentials/credential-state.integration.spec.js#answers no secret value, secret name or key version - >- services-platform:modules/integrations/tests/integration/services/credentials/credential-hint.integration.spec.js#INT-ACC-0168 step 7: no integration_* row holds any of the keys, though the credentials were stored (the premise) - >- services-platform:modules/integrations/tests/integration/services/credentials/credential-hint.integration.spec.js#INT-ACC-0168 step 1: is absent from the row’s metadata for a key of eight characters - >- services-platform:modules/integrations/tests/e2e/credentials.e2e.spec.js#writes the value to no line the function writes, which it does write (the premise) - >- services-platform:modules/integrations/tests/e2e/reader-access.e2e.spec.js#reads the key’s last four characters and no more, in any answer binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-005-02 title: Connection management does not grant credential writes level: api proves: - BR-CAP-PFM-INT-005-02 preconditions: A manager lacks credential authority and a separate reader can inspect integrations. steps: Attempt key entry as the manager and read facts as the reader. expected: Entry is denied while the reader obtains only credential facts. negative: true data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-486 provenance: test source: >- services-platform:modules/integrations/tests/e2e/credentials.e2e.spec.js#is refused to a caller who manages connections but not their credentials category: permission binding_evidence: - >- services-platform:modules/integrations/tests/e2e/credentials.e2e.spec.js#is refused to a caller who manages connections but not their credentials - >- services-platform:modules/integrations/tests/e2e/credentials.e2e.spec.js#is read with platform.integrations.read alone binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-005-03 title: Invalid credentials fail without disclosure level: api proves: - BR-CAP-PFM-INT-005-03 preconditions: An entered-key connection expects declared fields. steps: >- Submit an 8193-character value, twenty-one fields, a 101-character name, a different method and a missing required field. expected: Each refusal identifies the problem without repeating the secret or writing credential data. negative: true data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-485 - TST-PFM-INT-525 provenance: test source: >- services-platform:modules/integrations/tests/e2e/credential-entry-limits.e2e.spec.js#INT-ACC-0166 step 5: refuses a value of 8193 characters with 400 naming the field and the limit, and stores nothing category: boundary binding_evidence: - >- services-platform:modules/integrations/tests/e2e/credential-entry-limits.e2e.spec.js#INT-ACC-0166 step 5: refuses a value of 8193 characters with 400 naming the field and the limit, and stores nothing - >- services-platform:modules/integrations/tests/e2e/credential-entry-limits.e2e.spec.js#INT-ACC-0166 step 7: refuses a credential of 21 value fields with 400 and stores nothing - >- services-platform:modules/integrations/tests/integration/services/credentials/broker.integration.spec.js#is refused for another method than the connection’s - >- services-platform:modules/integrations/tests/integration/services/credentials/broker.integration.spec.js#is refused when it lacks a field the method declares, naming the field binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-005-04 title: Replacement and destruction follow the recovery window level: api proves: - BR-CAP-PFM-INT-005-04 preconditions: A connection currently uses its first key. steps: 'Replace it, invoke immediately and run maintenance before and after the one-week deletion date.' expected: >- The call leases the replacement; the superseded key remains before the date and is destroyed after it. negative: false data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-527 - TST-PFM-INT-525 provenance: test source: >- services-platform:modules/integrations/tests/integration/services/credentials/credential-lifecycle.integration.spec.js#INT-ACC-0163 step 5: svc_accounting’s payments.authorize right after the replacement, before the re-verification runs, leases the new credential category: transition binding_evidence: - >- services-platform:modules/integrations/tests/integration/services/credentials/credential-lifecycle.integration.spec.js#INT-ACC-0163 step 5: svc_accounting’s payments.authorize right after the replacement, before the re-verification runs, leases the new credential - >- services-platform:modules/integrations/tests/integration/services/credentials/credential-lifecycle.integration.spec.js#INT-ACC-0163 step 3: the previous credential is superseded with its deletion due seven days after the replacement and not destroyed - >- services-platform:modules/integrations/tests/integration/services/credentials/credential-lifecycle.integration.spec.js#INT-ACC-0163 step 7: eight days later the maintenance destroys the superseded credential, audits it once and leaves the active one - >- services-platform:modules/integrations/tests/integration/services/credentials/broker.integration.spec.js#leases the new credential at once binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-005-05 title: Credential entry verifies only appropriate states level: api proves: - BR-CAP-PFM-INT-005-05 preconditions: 'Prepare waiting, failed-verification, re-authorization-required, active and suspended connections.' steps: Enter credentials for each. expected: >- The first three move to verifying with a job, active stays active with a check and suspended remains paused without a job. negative: false data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: [] provenance: proposed source: >- services-platform:modules/integrations/services/credentials/credential-store.ts:verification_retried category: transition binding_evidence: [] - id: ATS-PFM-INT-005-06 title: Leases are short-lived and state-aware level: api proves: - BR-CAP-PFM-INT-005-06 preconditions: 'Prepare active, suspended and verifying connections.' steps: Request normal and over-limit leases and inspect their audit records. expected: >- Active receives the default five-minute lease; suspension and a lifetime above sixty minutes refuse, verifying requires verification purpose and no audit value is retained. negative: true data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-525 - TST-PFM-INT-531 provenance: test source: >- services-platform:modules/integrations/tests/integration/services/credentials/broker.integration.spec.js#is refused as connection_unavailable for a suspended connection category: boundary binding_evidence: - >- services-platform:modules/integrations/tests/integration/services/credentials/broker.integration.spec.js#is refused as connection_unavailable for a suspended connection - >- services-platform:modules/integrations/tests/integration/services/credentials/broker.integration.spec.js#lives five minutes unless the caller asks otherwise - >- services-platform:modules/integrations/tests/integration/services/credentials/broker.integration.spec.js#is refused for a lifetime beyond sixty minutes - >- services-platform:modules/integrations/tests/integration/services/credentials/broker.integration.spec.js#is given a verifying connection only for its verification - >- services-platform:modules/integrations/tests/integration/services/credentials/broker.integration.spec.js#writes an audit row naming the lease, the execution and the principal, and no value - >- services-platform:modules/integrations/tests/integration/services/credentials/lease-accepted-permissions.integration.spec.js#a lease carries only the installation’s accepted Rhythm permissions: the declined one is in no part of the lease binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-005-07 title: Lease renewal follows the issuing execution level: api proves: - BR-CAP-PFM-INT-005-07 preconditions: A running execution has an issued credential lease. steps: >- Renew as its adapter, as a different principal, after settlement and with an unknown lease reference. expected: Only renewal by the issuing adapter while that execution runs succeeds. negative: true data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-509 provenance: test source: >- services-platform:modules/integrations/tests/integration/services/adapter-callbacks/adapter-callbacks.integration.spec.js#refuses a lease whose execution is not running, execution_not_running category: permission binding_evidence: - >- services-platform:modules/integrations/tests/integration/services/adapter-callbacks/adapter-callbacks.integration.spec.js#refuses a lease whose execution is not running, execution_not_running - >- services-platform:modules/integrations/tests/integration/services/adapter-callbacks/adapter-callbacks.integration.spec.js#renews a lease another container issued to this principal for a running execution - >- services-platform:modules/integrations/tests/integration/services/adapter-callbacks/adapter-callbacks.integration.spec.js#refuses a lease issued to another principal, AccessDenied - >- services-platform:modules/integrations/tests/integration/services/adapter-callbacks/adapter-callbacks.integration.spec.js#refuses a lease nobody issued on this connection, lease_unknown binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-005-08 title: OAuth requests only accepted capability scopes level: api proves: - BR-CAP-PFM-INT-005-08 preconditions: A sign-in connection accepts meetings only and another connection uses an entered key. steps: Begin authorization for each. expected: >- OAuth returns state, proof-key challenge and meeting scopes; the entered-key connection refuses OAuth. negative: false data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-532 provenance: test source: >- services-platform:modules/integrations/tests/integration/services/credentials/oauth-flow.integration.spec.js#answers the provider’s URL with the client, the one redirect, the state and the accepted capabilities’ scopes category: rule binding_evidence: - >- services-platform:modules/integrations/tests/integration/services/credentials/oauth-flow.integration.spec.js#answers the provider’s URL with the client, the one redirect, the state and the accepted capabilities’ scopes - >- services-platform:modules/integrations/tests/integration/services/credentials/oauth-flow.integration.spec.js#stores the state by its hash, bound to the connection and the user, for ten minutes - >- services-platform:modules/integrations/tests/integration/services/credentials/oauth-flow.integration.spec.js#is refused for a connection that authenticates with an entered credential binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-005-09 title: Issued state can complete authorization once level: api proves: - BR-CAP-PFM-INT-005-09 preconditions: A sign-in flow has a valid outstanding state. steps: 'Submit its callback, repeat the state and submit an unknown state.' expected: >- The initial callback saves tokens and returns to connection detail; repeats and unknown state show the restart page without further storage. negative: true data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-486 - TST-PFM-INT-532 provenance: test source: >- services-platform:modules/integrations/tests/e2e/credentials.e2e.spec.js#answers the public callback a page for a state nobody issued, with no signed context category: concurrency binding_evidence: - >- services-platform:modules/integrations/tests/e2e/credentials.e2e.spec.js#answers the public callback a page for a state nobody issued, with no signed context - >- services-platform:modules/integrations/tests/integration/services/credentials/oauth-flow.integration.spec.js#exchanges the code with the verifier and the one redirect, and stores the tokens as the connection’s credential - >- services-platform:modules/integrations/tests/integration/services/credentials/oauth-flow.integration.spec.js#sends the browser to the console’s connection page with connected=1 and nothing else - >- services-platform:modules/integrations/tests/integration/services/credentials/oauth-flow.integration.spec.js#answers a page, not a redirect, for a state used once already binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-005-10 title: Refresh serializes work and reports lost authorization level: api proves: - BR-CAP-PFM-INT-005-11 preconditions: 'One token expires shortly, another in an hour.' steps: 'Run concurrent refresh passes, then return invalid grant from the provider.' expected: >- Only one token request runs for the due connection, none for the later token, and refusal requires re-authorization with an administrator notice. negative: false data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-535 provenance: test source: >- services-platform:modules/integrations/tests/integration/services/credentials/refresh.integration.spec.js#makes one token request when two refreshes of a connection run at once category: concurrency binding_evidence: - >- services-platform:modules/integrations/tests/integration/services/credentials/refresh.integration.spec.js#makes one token request when two refreshes of a connection run at once - >- services-platform:modules/integrations/tests/integration/services/credentials/refresh.integration.spec.js#sweeps the tokens expiring within ten minutes and leaves the others - >- services-platform:modules/integrations/tests/integration/services/credentials/refresh.integration.spec.js#moves the connection to reauth_required on invalid_grant and tells the administrators binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-005-11 title: Maintenance avoids repeated notices level: api proves: - BR-CAP-PFM-INT-005-12 preconditions: >- A revoked credential has no remaining secret, a refresh token expires in ten days and a sign-in is abandoned. steps: Run daily maintenance on consecutive days. expected: 'Destruction is audited, the expiry produces one notice and the abandoned attempt is removed.' negative: false data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-528 provenance: test source: >- services-platform:modules/integrations/tests/integration/services/credentials/credential-maintenance.integration.spec.js#sends nothing and audits nothing more on the next day’s pass for the same expiry category: edge binding_evidence: - >- services-platform:modules/integrations/tests/integration/services/credentials/credential-maintenance.integration.spec.js#sends nothing and audits nothing more on the next day’s pass for the same expiry - >- services-platform:modules/integrations/tests/integration/services/credentials/credential-maintenance.integration.spec.js#marks a revoked credential destroyed once its secret is gone, and audits it - >- services-platform:modules/integrations/tests/integration/services/credentials/credential-maintenance.integration.spec.js#reports a refresh token expiring within fourteen days to the tenant’s administrators - >- services-platform:modules/integrations/tests/integration/services/credentials/credential-maintenance.integration.spec.js#deletes an attempt abandoned more than a day ago, with its verifier binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-005-12 title: Reject an oversized authorization scope list level: api proves: - BR-CAP-PFM-INT-005-14 preconditions: A credential record with valid account ownership is prepared. steps: 'Write one hundred scopes, then attempt to write one hundred and one scopes.' expected: >- The limit-sized scope list is accepted and the larger list is refused without changing the stored credential. negative: true data_needs: Valid direct-writer fixtures in an isolated workspace. bound_to: [] provenance: proposed source: >- services-platform:modules/integrations/db/integration-credentials.table.ts:integration_credentials_scopes_check category: boundary binding_evidence: [] - id: ATS-PFM-INT-005-13 level: api negative: true data_needs: Run-owned records and principals in an isolated workspace. bound_to: [] provenance: proposed title: Exercise the complete credential lifecycle category: transition proves: - BR-CAP-PFM-INT-005-04 - BR-CAP-PFM-INT-005-12 - BR-CAP-PFM-INT-004-09 preconditions: >- Prepare one independent record in each starting state, including absent-record cases where the model defines creation. steps: >- Run each listed transition once with its guard satisfied, then repeat it with the guard denied. Inspect the resulting record and listed side effects after commit. expected: >- Each positive case reaches its listed destination and records its defined side effects. Each denied case preserves the starting record and creates no transition side effects. source: >- rhythm-v2-docs:specs/platform/integrations/design/state-models/STATE-PFM-INT-004-credential-lifecycle.md#transitions state_model: STATE-PFM-INT-004 transition_cases: - from: active to: superseded trigger: Supply a replacement credential guard: The store commits a new credential for this account side_effects: - Request old-secret deletion with seven days of recovery - Submit verification unless the account is paused. provenance: proposed source: 'services-platform:modules/integrations/services/credentials/credential-passes.ts' - from: active to: revoked trigger: End the provider account link guard: Disconnection or discard revokes its credential side_effects: - Request secret deletion. provenance: proposed source: 'services-platform:modules/integrations/services/persistence/integration-credentials.ts' - from: superseded to: destroyed trigger: Observe deletion of a replaced secret guard: Secret storage reports that the value is absent side_effects: - Save destroyed status. provenance: proposed source: 'services-platform:modules/integrations/services/credentials/credential-passes.ts' - from: revoked to: destroyed trigger: Observe deletion of a revoked secret guard: Secret storage reports that the value is absent side_effects: - Save destroyed status. provenance: proposed source: 'services-platform:modules/integrations/services/credentials/credential-passes.ts' proof_boundary: >- The parameterized cases prove the listed lifecycle outcomes. Separate assertions are needed for independent object invariants, numeric limits and simultaneous requests. - id: ATS-PFM-INT-005-14 level: api negative: false data_needs: Run-owned records and principals in an isolated workspace. bound_to: [] provenance: proposed title: The next call uses a replacement credential category: interaction proves: - BR-CAP-PFM-INT-005-04 - BR-CAP-PFM-INT-009-07 exercises: - CAP-PFM-INT-005 - CAP-PFM-INT-009 preconditions: A callable account has an existing entered key. steps: 'Replace its key, invoke an authorized operation and inspect the adapter lease and execution trail.' expected: >- Provider contact uses the new credential while execution summaries and history contain no credential value. source: - >- services-platform:modules/integrations/tests/integration/services/credentials/credential-lifecycle.integration.spec.js#INT-ACC-0163 step 5: svc_accounting’s payments.authorize right after the replacement, before the re-verification runs, leases the new credential - >- services-platform:modules/integrations/tests/integration/services/executions/invoke-capability.integration.spec.js#refuses with 503 provider_unavailable while the circuit is open, and releases the key workflows: [] - id: ATS-PFM-INT-005-15 level: api negative: false data_needs: Run-owned records and principals in an isolated workspace. bound_to: [] provenance: proposed title: Lost authorization becomes an actionable account problem category: interaction proves: - BR-CAP-PFM-INT-005-11 - BR-CAP-PFM-INT-006-06 exercises: - CAP-PFM-INT-005 - CAP-PFM-INT-006 preconditions: A due sign-in token has an active account and administrator recipients. steps: 'Run refresh with provider refusal, then inspect health and delivered administrator notices.' expected: The account requires re-authorization and the saved result remains even when mail delivery fails. source: - >- services-platform:modules/integrations/tests/integration/services/credentials/refresh.integration.spec.js#makes one token request when two refreshes of a connection run at once - >- services-platform:modules/integrations/tests/integration/services/connections/connection-feature-changes.integration.spec.js#INT-ACC-0113 step 3: the loss tells each administrator of the tenant once, two notices in all, each with the features-lost subject workflows: - WF-PFM-INT-005 - id: ATS-PFM-INT-005-16 level: api negative: false data_needs: Run-owned records and principals in an isolated workspace. bound_to: [] provenance: proposed title: Corrected credentials recover account setup category: interaction proves: - BR-CAP-PFM-INT-004-05 - BR-CAP-PFM-INT-005-05 exercises: - CAP-PFM-INT-005 - CAP-PFM-INT-004 preconditions: An entered-key account fails its first verification. steps: 'Replace the key, run verification and read safe credential facts and connection detail.' expected: >- Successful verification reaches active with provider features; safe facts identify the replacement without its value. source: - >- services-platform:modules/integrations/tests/integration/services/connections/connection-jobs.integration.spec.js#becomes active with the account and every declared feature verified - >- services-platform:modules/integrations/services/credentials/credential-store.ts:verification_retried workflows: - WF-PFM-INT-003 - id: ATS-PFM-INT-005-17 level: api negative: false data_needs: Run-owned records and principals in an isolated workspace. bound_to: [] provenance: proposed title: Credential verification establishes endpoint setup category: interaction proves: - BR-CAP-PFM-INT-005-05 - BR-CAP-PFM-INT-013-06 exercises: - CAP-PFM-INT-005 - CAP-PFM-INT-013 preconditions: An initial key account declares a manual endpoint. steps: 'Enter valid credentials, finish verification and inspect endpoint setup twice.' expected: >- The verification job activates the account and provisions its endpoint; ordinary reads reveal no signing secret. source: - >- services-platform:modules/integrations/services/credentials/credential-store.ts:verification_retried - >- services-platform:modules/integrations/tests/e2e-adapters/events-dummy.adapters.spec.js#never answers the secret again workflows: - WF-PFM-INT-003 evidence: - >- Each binding identifies an existing source test at the pinned revision; unbound scenarios remain proposed proof obligations. coverage: rule: covered transition: covered validation: 'gap: FND-PFM-INT-060' permission: covered edge: covered failure: 'gap: FND-PFM-INT-060' boundary: covered concurrency: covered invariant: covered interaction: covered coverage_notes: covered: A designed scenario exists; executable coverage and a passing run require separate evidence. gaps: >- The finding records categories without a designed scenario and remaining permission and rule audit obligations. --- # Protect credentials throughout their useful life: Capability Test Specification ## Coverage | Rule | Proved By | |---|---| | `BR-CAP-PFM-INT-005-01` | `ATS-PFM-INT-005-01` | | `BR-CAP-PFM-INT-005-02` | `ATS-PFM-INT-005-02` | | `BR-CAP-PFM-INT-005-03` | `ATS-PFM-INT-005-03` | | `BR-CAP-PFM-INT-005-04` | `ATS-PFM-INT-005-04`, `ATS-PFM-INT-005-13`, `ATS-PFM-INT-005-14` | | `BR-CAP-PFM-INT-005-05` | `ATS-PFM-INT-005-05`, `ATS-PFM-INT-005-16`, `ATS-PFM-INT-005-17` | | `BR-CAP-PFM-INT-005-06` | `ATS-PFM-INT-005-06` | | `BR-CAP-PFM-INT-005-07` | `ATS-PFM-INT-005-07` | | `BR-CAP-PFM-INT-005-08` | `ATS-PFM-INT-005-08` | | `BR-CAP-PFM-INT-005-09` | `ATS-PFM-INT-005-09` | | `BR-CAP-PFM-INT-005-10` | `FND-PFM-INT-060` | | `BR-CAP-PFM-INT-005-11` | `ATS-PFM-INT-005-10`, `ATS-PFM-INT-005-15` | | `BR-CAP-PFM-INT-005-12` | `ATS-PFM-INT-005-11`, `ATS-PFM-INT-005-13` | | `BR-CAP-PFM-INT-005-13` | `FND-PFM-INT-060` | | `BR-CAP-PFM-INT-005-14` | `ATS-PFM-INT-005-12` | ## Interactions With Related Capabilities Credential replacement and refresh connect secret handling to account verification and health. The interaction cases check the resulting connection state and operational visibility while keeping secret values outside customer-facing records. The structured scenarios name the capabilities and rules involved. A bound test contributes only the outcomes it asserts; proposed transition matrices and composed interactions still require executable proof.