--- id: JNY-PFM-SEC-002 title: Join the console through an invitation feature: FEAT-PFM-SEC-02 product_area: platform module: security revision: 1 status: draft product_intent: confirmed implementation_evidence: observed supersedes: [] source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f actor: ACT-PFM-002 goal: Accept the invitation and reach the console experience permitted by the offered access. capabilities: - CAP-PFM-SEC-005 - CAP-PFM-SEC-006 - CAP-PFM-SEC-007 screens: - /acceptInvite?token=… - /login - '/console/{tenantId}' steps: - 'n': 1 surface: /acceptInvite?token=… action: Open the invitation message’s link. capability: CAP-PFM-SEC-005 expected: The acceptance page displays organization information and a masked email before sign-in. provenance: test source: >- react-console:e2e/dev/invitations.dev.spec.ts#shows who invited them, then sets their password and opens the console - 'n': 2 surface: acceptInvitation action: Accept with a password that satisfies policy. capability: CAP-PFM-SEC-005 expected: The tested password acceptance activates the account. provenance: test source: >- services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#accepts the e-mailed token with a password and makes the account active (the invite created the account before it sent the link) - 'n': 3 surface: getMySecurityContext action: Request the current security context as the console loads. capability: CAP-PFM-SEC-007 expected: >- The backend response identifies the caller, organization, reachable workspaces and evaluated default workspace. provenance: test source: >- services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#answers the caller, their organization and the tenants they reach, with the default tenant evaluated - 'n': 4 surface: '/console/{tenantId}' action: Use an application from the console. capability: CAP-PFM-SEC-007 expected: The tested create action appears for Administrator and is absent for Read Only. provenance: test source: >- react-console:e2e/dev/permissions.dev.spec.ts#offers the administrator an action it does not offer the read-only user - 'n': 5 surface: /login action: 'Visit a protected page after signing out, then sign in.' capability: CAP-PFM-SEC-006 expected: The login return flow restores the originally requested page. provenance: test source: >- react-console:e2e/dev/session.dev.spec.ts#sends a signed-out visitor to the login screen and back to the page they wanted alternates: - from_step: 1 condition: A resend replaced the opened invitation. path: Show the replacement-link guidance. outcome: The browser directs the person to the latest invitation message. provenance: test source: >- react-console:e2e/dev/invitations.dev.spec.ts#sends somebody to their newest e-mail when a resend superseded the link they opened - from_step: 3 condition: The authenticated person has no role. path: Display No Access when context cannot provide access. outcome: The person can sign out without a repeated login redirect. provenance: test source: >- react-console:e2e/dev/permissions.dev.spec.ts#shows a person with no role the No Access screen, and does not loop back to the login screen failures: - from_step: 1 condition: The invitation has expired. path: Show expiry guidance on the acceptance page. outcome: The person is told how to request another invitation. provenance: test source: >- react-console:e2e/controlled/invitation-expired.controlled.spec.ts#tells somebody their invitation has expired, and what to do about it - from_step: 2 condition: The browser already holds another person’s console session. path: Require that session to be signed out before acceptance. outcome: The invitation is not accepted in that other session. provenance: test source: >- react-console:e2e/dev/invitations.dev.spec.ts#refuses to accept an invitation while somebody else's console is on the screen rules_in_play: - BR-CAP-PFM-SEC-005-02 - BR-CAP-PFM-SEC-005-03 - BR-CAP-PFM-SEC-005-04 - BR-CAP-PFM-SEC-005-06 - BR-CAP-PFM-SEC-005-10 - BR-CAP-PFM-SEC-007-02 - BR-CAP-PFM-SEC-007-03 - BR-CAP-PFM-SEC-007-08 - BR-CAP-PFM-SEC-007-09 - BR-CAP-PFM-SEC-006-02 assertions: - id: AS-JNY-PFM-SEC-002-01 statement: 'The acceptance browser flow shows invitation information, sets the password and opens the console.' provenance: test source: >- react-console:e2e/dev/invitations.dev.spec.ts#shows who invited them, then sets their password and opens the console - id: AS-JNY-PFM-SEC-002-02 statement: The tested acceptance permits sign-in and removes the membership from the Invited filter. provenance: test source: >- react-console:e2e/security/invitations.spec.ts#lets them set a password and sign in, and clears them off the Invited filter - id: AS-JNY-PFM-SEC-002-03 statement: The access browser test observes a changed available action after a role change. provenance: test source: 'react-console:e2e/security/access.spec.ts#a role change alters what somebody can actually do' e2e_policy: required e2e_reason: >- Acceptance, authentication and console permissions cross public and protected screens. Backend tests establish individual rules; real-service browser evidence is required for the combined path. evidence: - >- Pinned react-console references for the structured rows: e2e/controlled/invitation-expired.controlled.spec.ts; e2e/dev/invitations.dev.spec.ts; e2e/dev/permissions.dev.spec.ts; e2e/dev/session.dev.spec.ts; e2e/security/access.spec.ts; e2e/security/invitations.spec.ts. - >- Pinned services-platform references for the structured rows: modules/security/tests/e2e/invitations.e2e.spec.js; modules/security/tests/e2e/security-context.e2e.spec.js. --- # Join the console through an invitation ## Story An invited colleague opens the emailed link and checks the organization shown on the acceptance page. They set a password and continue into the console. The console obtains their security context before presenting the application actions tested for their role. A later sign-in can return them to the protected page they originally requested.