--- id: ATS-PFM-MTD-007 scope: CAP-PFM-MTD-007 product_area: platform module: metadata revision: 2 status: proposed source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f scenarios: - id: ATS-PFM-MTD-007-01 title: Only upload-authorized callers receive staging level: api proves: - BR-CAP-PFM-MTD-007-01 preconditions: 'Administrator, User and Read Only contexts are available.' steps: - do: 'Request staging as authorized, unauthorized and unsigned callers.' provenance: test source: >- services-platform:modules/files/tests/e2e/files.e2e.spec.js#is refused 403 by the dispatcher, and nothing is issued expected: >- Authorized tiers receive an issue; unauthorized and unsigned requests fail without issuance. Read Only lacks the upload grant. negative: true data_needs: 'Administrator, User and Read Only contexts are available.' bound_to: - >- services-platform:modules/files/tests/e2e/files.e2e.spec.js#is refused 403 by the dispatcher, and nothing is issued - >- services-platform:modules/files/tests/e2e/files.e2e.spec.js#is refused 401 without a signed context, and nothing is issued - >- services-platform:modules/files/tests/unit/upload-permission.spec.ts#keeps it out of Platform Read Only - TST-PFM-MTD-078 - TST-PFM-MTD-084 provenance: test source: >- services-platform:modules/files/tests/e2e/files.e2e.spec.js#is refused 403 by the dispatcher, and nothing is issued category: permission assertions: - expect: >- Authorized tiers receive an issue; unauthorized and unsigned requests fail without issuance. Read Only lacks the upload grant. provenance: test source: >- services-platform:modules/files/tests/e2e/files.e2e.spec.js#is refused 403 by the dispatcher, and nothing is issued - id: ATS-PFM-MTD-007-02 title: The route workspace cannot be substituted level: api proves: - BR-CAP-PFM-MTD-007-02 preconditions: Signed contexts belong to distinct customers. steps: - do: Name a workspace in the body and request another customer’s workspace. provenance: test source: >- services-platform:modules/files/tests/e2e/files.e2e.spec.js#refuses a body that names a workspace of its own expected: Both attempts fail and no upload issue is created. negative: true data_needs: Signed contexts belong to distinct customers. bound_to: - >- services-platform:modules/files/tests/e2e/files.e2e.spec.js#refuses a body that names a workspace of its own - >- services-platform:modules/files/tests/e2e/files.e2e.spec.js#is refused the tenant, and nothing is issued - >- services-platform:modules/files/tests/integration/services/uploads/issue-upload.integration.spec.js#issues in the execution’s tenant only, whatever else exists - TST-PFM-MTD-078 - TST-PFM-MTD-082 provenance: test source: >- services-platform:modules/files/tests/e2e/files.e2e.spec.js#refuses a body that names a workspace of its own category: permission assertions: - expect: Both attempts fail and no upload issue is created. provenance: test source: >- services-platform:modules/files/tests/e2e/files.e2e.spec.js#refuses a body that names a workspace of its own - id: ATS-PFM-MTD-007-03 title: Declared sizes are positive and within kind limits level: unit proves: - BR-CAP-PFM-MTD-007-03 preconditions: The signer and upload ledger are observable. steps: - do: >- Request pictures at ten MiB and one byte above, documents at twenty-five MiB and one byte above, and zero or fractional sizes. provenance: test source: >- services-platform:modules/files/tests/integration/services/uploads/issue-upload.integration.spec.js#refuses a picture over 10 MiB, naming size, and signs and records nothing expected: 'Boundary sizes succeed; over-limit, zero and fractional sizes fail by size without signing or recording.' negative: true data_needs: The signer and upload ledger are observable. bound_to: - 'services-platform:modules/files/tests/unit/upload-keys.spec.ts#accepts a picture at exactly 10 MiB' - >- services-platform:modules/files/tests/unit/upload-keys.spec.ts#refuses a picture one byte over 10 MiB, naming size - >- services-platform:modules/files/tests/unit/upload-keys.spec.ts#refuses a document one byte over 25 MiB, naming size - 'services-platform:modules/files/tests/unit/upload-keys.spec.ts#refuses a fractional size, naming size' - >- services-platform:modules/files/tests/integration/services/uploads/issue-upload.integration.spec.js#refuses a document over 25 MiB, naming size, and signs and records nothing - TST-PFM-MTD-083 - TST-PFM-MTD-082 provenance: test source: >- services-platform:modules/files/tests/integration/services/uploads/issue-upload.integration.spec.js#refuses a picture over 10 MiB, naming size, and signs and records nothing category: boundary assertions: - expect: >- Boundary sizes succeed; over-limit, zero and fractional sizes fail by size without signing or recording. provenance: test source: >- services-platform:modules/files/tests/integration/services/uploads/issue-upload.integration.spec.js#refuses a picture over 10 MiB, naming size, and signs and records nothing - id: ATS-PFM-MTD-007-04 title: Media types match the declared kind level: unit proves: - BR-CAP-PFM-MTD-007-04 preconditions: Upload requests can be issued. steps: - do: 'Request SVG and document images, an executable file and permitted formats.' provenance: test source: >- services-platform:modules/files/tests/unit/upload-keys.spec.ts#refuses SVG for a picture by its type, naming content_type expected: Disallowed declarations fail by media type and permitted formats are accepted. negative: true data_needs: Upload requests can be issued. bound_to: - >- services-platform:modules/files/tests/unit/upload-keys.spec.ts#refuses SVG for a picture by its type, naming content_type - >- services-platform:modules/files/tests/unit/upload-keys.spec.ts#refuses a PDF in a picture field, naming content_type - >- services-platform:modules/files/tests/unit/upload-keys.spec.ts#refuses an executable in a document field, naming content_type - >- services-platform:modules/files/tests/unit/upload-keys.spec.ts#accepts a picture type in a document field - TST-PFM-MTD-083 provenance: test source: >- services-platform:modules/files/tests/unit/upload-keys.spec.ts#refuses SVG for a picture by its type, naming content_type category: validation assertions: - expect: Disallowed declarations fail by media type and permitted formats are accepted. provenance: test source: >- services-platform:modules/files/tests/unit/upload-keys.spec.ts#refuses SVG for a picture by its type, naming content_type - id: ATS-PFM-MTD-007-05 title: The server chooses a safe staging location level: unit proves: - BR-CAP-PFM-MTD-007-05 preconditions: Workspace and upload declarations are available. steps: - do: Build image and file keys and submit a path-like filename. provenance: test source: >- services-platform:modules/files/tests/unit/upload-keys.spec.ts#is tmp, the workspace, the object folder, a public- upload directory for a picture, and the file name expected: 'Keys contain server-selected workspace, folder and upload identity; unsafe filenames fail.' negative: true data_needs: Workspace and upload declarations are available. bound_to: - >- services-platform:modules/files/tests/unit/upload-keys.spec.ts#is tmp, the workspace, the object folder, a public- upload directory for a picture, and the file name - 'services-platform:modules/files/tests/unit/upload-keys.spec.ts#has no public- prefix for a document' - >- services-platform:modules/files/tests/unit/upload-keys.spec.ts#sanitises the file name the way the pipeline does, and adds an extension a bare name lacks - >- services-platform:modules/files/tests/unit/upload-keys.spec.ts#refuses a file name that is a path, naming file_name - TST-PFM-MTD-083 provenance: test source: >- services-platform:modules/files/tests/unit/upload-keys.spec.ts#is tmp, the workspace, the object folder, a public- upload directory for a picture, and the file name category: edge assertions: - expect: 'Keys contain server-selected workspace, folder and upload identity; unsafe filenames fail.' provenance: test source: >- services-platform:modules/files/tests/unit/upload-keys.spec.ts#is tmp, the workspace, the object folder, a public- upload directory for a picture, and the file name - id: ATS-PFM-MTD-007-06 title: Signatures bind headers and expiry level: unit proves: - BR-CAP-PFM-MTD-007-06 preconditions: A real local signer has credentials supplied by a test fixture. steps: - do: Sign an upload and inspect its signature and returned headers. provenance: test source: >- services-platform:modules/files/tests/unit/upload-presign.spec.ts#signs the type, the length and both metadata headers, so S3 refuses a PUT that changes any expected: 'Type, length and uploader metadata are signed and expiry is fifteen minutes.' negative: false data_needs: A real local signer has credentials supplied by a test fixture. bound_to: - >- services-platform:modules/files/tests/unit/upload-presign.spec.ts#names the bucket, the staging key and a 15-minute lifetime - >- services-platform:modules/files/tests/unit/upload-presign.spec.ts#signs the type, the length and both metadata headers, so S3 refuses a PUT that changes any - >- services-platform:modules/files/tests/e2e/files.e2e.spec.js#signs the uploader named by the verified token, not by anything in the body - TST-PFM-MTD-085 - TST-PFM-MTD-078 provenance: test source: >- services-platform:modules/files/tests/unit/upload-presign.spec.ts#signs the type, the length and both metadata headers, so S3 refuses a PUT that changes any category: invariant assertions: - expect: 'Type, length and uploader metadata are signed and expiry is fifteen minutes.' provenance: test source: >- services-platform:modules/files/tests/unit/upload-presign.spec.ts#signs the type, the length and both metadata headers, so S3 refuses a PUT that changes any - id: ATS-PFM-MTD-007-07 title: Issuance is recorded and audited level: api proves: - BR-CAP-PFM-MTD-007-07 preconditions: An authorized caller requests staging. steps: - do: Issue an upload and inspect the ledger and audit. provenance: test source: >- services-platform:modules/files/tests/integration/services/uploads/issue-upload.integration.spec.js#appends one file_upload audit event naming who was given the upload and for what expected: One issue and one audit identify the requester and declared destination. negative: false data_needs: An authorized caller requests staging. bound_to: - >- services-platform:modules/files/tests/integration/services/uploads/issue-upload.integration.spec.js#records one row for the caller, the object, the field and the key signed - >- services-platform:modules/files/tests/integration/services/uploads/issue-upload.integration.spec.js#appends one file_upload audit event naming who was given the upload and for what - TST-PFM-MTD-082 provenance: test source: >- services-platform:modules/files/tests/integration/services/uploads/issue-upload.integration.spec.js#appends one file_upload audit event naming who was given the upload and for what category: rule assertions: - expect: One issue and one audit identify the requester and declared destination. provenance: test source: >- services-platform:modules/files/tests/integration/services/uploads/issue-upload.integration.spec.js#appends one file_upload audit event naming who was given the upload and for what - id: ATS-PFM-MTD-007-08 title: A staged file is checked by the owning save category: interaction level: browser exercises: - CAP-PFM-MTD-007 - CAP-PFM-MTD-005 - CAP-PFM-MTD-012 proves: - BR-CAP-PFM-MTD-007-08 - BR-CAP-PFM-MTD-012-13 preconditions: A file property exists and two authorized people can obtain staging. steps: - do: >- Issue and upload as the first person, save as that person, then attempt a new save using another person’s staging identity. provenance: proposed source: &ref_0 - 'services-platform:docs/files.md#The signature' - >- services-platform:modules/custom-objects/tests/integration/services/persistence/custom-object-records.integration.spec.js#names a create’s missing upload at properties., without the address sent expected: Read the managed attachment after success and inspect the rejected property after the second attempt. negative: false data_needs: A file property exists and two authorized people can obtain staging. bound_to: [] provenance: proposed source: *ref_0 assertions: - expect: >- Read the managed attachment after success and inspect the rejected property after the second attempt. provenance: proposed source: *ref_0 evidence: - 'services-platform at ad3f6a6582843008ed0f5a17b131878d15829af1: the files specs named in each scenario.' - >- Codex testing back-fill: pinned capability, domain object, state model and workflow obligations reviewed; existing bound test files and exact case titles checked. coverage: rule: covered transition: 'gap: FND-PFM-MTD-069' validation: covered permission: covered edge: covered failure: 'gap: FND-PFM-MTD-069' boundary: covered concurrency: 'gap: FND-PFM-MTD-069' invariant: covered interaction: covered coverage_obligations: - rule: BR-CAP-PFM-MTD-007-01 scenarios: - ATS-PFM-MTD-007-01 finding: null provenance: documented source: >- specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-007-give-a-person-a-safe-short-lived-place-to-upload-a-picture-or.md - rule: BR-CAP-PFM-MTD-007-02 scenarios: - ATS-PFM-MTD-007-02 finding: null provenance: documented source: >- specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-007-give-a-person-a-safe-short-lived-place-to-upload-a-picture-or.md - rule: BR-CAP-PFM-MTD-007-03 scenarios: - ATS-PFM-MTD-007-03 finding: null provenance: documented source: >- specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-007-give-a-person-a-safe-short-lived-place-to-upload-a-picture-or.md - rule: BR-CAP-PFM-MTD-007-04 scenarios: - ATS-PFM-MTD-007-04 finding: null provenance: documented source: >- specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-007-give-a-person-a-safe-short-lived-place-to-upload-a-picture-or.md - rule: BR-CAP-PFM-MTD-007-05 scenarios: - ATS-PFM-MTD-007-05 finding: null provenance: documented source: >- specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-007-give-a-person-a-safe-short-lived-place-to-upload-a-picture-or.md - rule: BR-CAP-PFM-MTD-007-06 scenarios: - ATS-PFM-MTD-007-06 finding: null provenance: documented source: >- specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-007-give-a-person-a-safe-short-lived-place-to-upload-a-picture-or.md - rule: BR-CAP-PFM-MTD-007-07 scenarios: - ATS-PFM-MTD-007-07 finding: null provenance: documented source: >- specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-007-give-a-person-a-safe-short-lived-place-to-upload-a-picture-or.md - rule: BR-CAP-PFM-MTD-007-08 scenarios: - ATS-PFM-MTD-007-08 finding: null provenance: documented source: >- specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-007-give-a-person-a-safe-short-lived-place-to-upload-a-picture-or.md interactions: - with: CAP-PFM-MTD-005 scenarios: - ATS-PFM-MTD-007-08 finding: null provenance: proposed source: >- specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-007-give-a-person-a-safe-short-lived-place-to-upload-a-picture-or.md - with: CAP-PFM-MTD-012 scenarios: - ATS-PFM-MTD-007-08 finding: null provenance: proposed source: >- specs/platform/metadata/planning/capabilities/CAP-PFM-MTD-007-give-a-person-a-safe-short-lived-place-to-upload-a-picture-or.md --- # Prepare Image and File Uploads: Capability Test Specification ## Coverage - Obligation 01: 1 scenario cite this obligation. - Obligation 02: 1 scenario cite this obligation. - Obligation 03: 1 scenario cite this obligation. - Obligation 04: 1 scenario cite this obligation. - Obligation 05: 1 scenario cite this obligation. - Obligation 06: 1 scenario cite this obligation. - Obligation 07: 1 scenario cite this obligation. - Obligation 08: 1 scenario cite this obligation. Category coverage identifies the kind of proof present. Detailed transition, permission and invariant obligations and unbound proposals remain in the coverage finding until their individual cases are accounted for. ## Interactions With Related Capabilities The owning save accepts the authorized upload and refuses the mismatched uploader. The structured interaction rows identify the related capabilities exercised and any remaining gap. Cross-capability workflow seams remain subject to the detailed coverage audit.