Rhythm 2.0 Specifications

Appearance

ATS-COM-ORD-011Protect orders and carts by workspace and authority: Capability Test Specification

Markdown

ATS-COM-ORD-011

Protect orders and carts by workspace and authority: Capability Test Specification

Markdown
  • DocumentProposed

Planning

Proves capability
CAP-COM-ORD-011

Design

Executed by
TST-COM-ORD-025, TST-COM-ORD-040, TST-COM-ORD-048, TST-COM-ORD-104, TST-COM-ORD-155

KindAcceptance test setProduct areaCommerceModuleCustomer purchases, purchased benefits and vendor stockRevision2

Read atservices-commerce c8b66a98macroservice-libraries 54536a44react-console baf6dae3

Protect orders and carts by workspace and authority: Capability Test Specification ​

Coverage ​

RuleScenario or finding
BR-CAP-COM-ORD-011-01ATS-COM-ORD-011-01
BR-CAP-COM-ORD-011-02ATS-COM-ORD-011-02, ATS-COM-ORD-011-07, ATS-COM-ORD-011-08
BR-CAP-COM-ORD-011-03ATS-COM-ORD-011-03, ATS-COM-ORD-011-09, ATS-COM-ORD-011-10
BR-CAP-COM-ORD-011-04no scenario: FND-COM-ORD-068
BR-CAP-COM-ORD-011-05ATS-COM-ORD-011-04
BR-CAP-COM-ORD-011-06ATS-COM-ORD-011-05
BR-CAP-COM-ORD-011-07ATS-COM-ORD-011-06

A reader cannot change another authorized cart. A workspace reader can read a staff-created cart. Read the cart, attempt an item addition and read its version again.

Cart editing permission does not authorize a sale. A clerk can edit carts but cannot place orders. Change an item and request placement.

Portal ownership is checked before charging. One member’s placed sale is addressed by another member. Attempt payment and inspect the sale’s attempts.

A member’s list stays inside their buyer scope. Two contacts in one workspace each have an order. List the first buyer as that member, request the other buyer and request the workspace list.

Crossing workflow examples also cover preparation, commitment and recovery at their service handoffs. Their structured bindings distinguish specified outcomes from executable evidence.

Coverage

  • Rule gap: FND-COM-ORD-068
  • Transition gap: FND-COM-ORD-068
  • Validation gap: FND-COM-ORD-068
  • Permission gap: FND-COM-ORD-068
  • Edge covered
  • Failure gap: FND-COM-ORD-068
  • Boundary covered
  • Concurrency gap: FND-COM-ORD-068
  • Invariant gap: FND-COM-ORD-068
  • Interaction covered

Test Scenarios

10 scenarios proving CAP-COM-ORD-011; 6 bound to an existing test.

01 Workspace authority never exposes another workspace’s recordboundaryapinegativetest
Proves
BR-CAP-COM-ORD-011-01
Preconditions
A cart and order belong to workspace A, with A-only, dual-workspace and absent contexts.
Steps
[ { "do": "Request them through workspace B.", "provenance": "test", "source": "services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#refuses a call with no security context, 401" } ]
Expected
Missing context returns 401, insufficient workspace authority returns 403 and authorized B scope still finds no A record.
Data
Use the controlled records and transports established by the cited tests.
Bound to
services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#refuses a context that covers only tenant A in tenant B, 403
services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#answers 404 in tenant B to a checkout and an order of tenant A, to a context that covers both
Source
services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#refuses a call with no security context, 401
02 Read-only contexts preserve purchase statepermissionapinegativetest
Proves
BR-CAP-COM-ORD-011-02
Preconditions
A reader inspects a member’s existing cart.
Steps
[ { "do": "Read it and attempt addition, preview and placement.", "provenance": "test", "source": "services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#a reader reads any checkout and order of the tenant, and lists any buyer’s orders" } ]
Expected
Reads succeed and writes return permission_missing with the cart version unchanged.
Data
Use the controlled records and transports established by the cited tests.
Bound to
services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#a reader reads any checkout and order of the tenant, and lists any buyer’s orders
services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#a reader is refused every write, 403 permission_missing, leaving the checkout as it was
Source
services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#a reader reads any checkout and order of the tenant, and lists any buyer’s orders
03 Portal party checks separate two buyerspermissionapinegativetest
Proves
BR-CAP-COM-ORD-011-03
Preconditions
Two linked contacts own different carts and orders.
Steps
[ { "do": "Read and mutate the other contact’s purchase as one member.", "provenance": "test", "source": "services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#reads their own checkout and order" } ]
Expected
The attempt receives not_your_party and the caller’s own purchase stays reachable.
Data
Use the controlled records and transports established by the cited tests.
Bound to
services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#is refused another member’s checkout and order, 403 not_your_party, and a change of it
Source
services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#reads their own checkout and order
04 Support attribution is retained by event and stamp helpersedgeunittest
Proves
BR-CAP-COM-ORD-011-05
Preconditions
The helper inputs carry a stand-in support identity.
Steps
[ { "do": "Build the event actor and record-system values.", "provenance": "test", "source": "services-commerce:modules/checkout/tests/unit/checkout/checkout-event-actor.spec.js#names the support identity as the actor of the event" } ]
Expected
Both outputs retain the supplied support actor without proving a live Platform identity.
Data
Use the controlled records and transports established by the cited tests.
Bound to
services-commerce:modules/checkout/tests/unit/checkout/checkout-event-actor.spec.js#names the support identity in the record system columns
Source
services-commerce:modules/checkout/tests/unit/checkout/checkout-event-actor.spec.js#names the support identity as the actor of the event
05 Commerce application denial overrides operation accesspermissionapinegativetest
Proves
BR-CAP-COM-ORD-011-06
Preconditions
The principal is denied Commerce application access.
Steps
[ { "do": "Invoke a protected Commerce operation.", "provenance": "test", "source": "services-commerce:modules/purchasing/tests/e2e/purchasing.e2e.spec.js#lets a reader list and read, refuses the reader every write 403 permission_missing, a denied principal 403 app_not_permitted, no context 401, and another tenant 404" } ]
Expected
The response identifies app_not_permitted.
Data
Use the controlled records and transports established by the cited tests.
Bound to
services-commerce:modules/purchasing/tests/e2e/purchasing.e2e.spec.js#lets a reader list and read, refuses the reader every write 403 permission_missing, a denied principal 403 app_not_permitted, no context 401, and another tenant 404
Source
services-commerce:modules/purchasing/tests/e2e/purchasing.e2e.spec.js#lets a reader list and read, refuses the reader every write 403 permission_missing, a denied principal 403 app_not_permitted, no context 401, and another tenant 404
06 Sweep reads and writes use separate scopesinvariantapitest
Proves
BR-CAP-COM-ORD-011-07
Preconditions
Expired purchases belong to two workspaces.
Steps
[ { "do": "Invoke the bounded sweep cases.", "provenance": "test", "source": "services-commerce:modules/orders/tests/integration/services/persistence/orders.queries.integration.spec.js#lists, across tenants, every placed order past its window as references, oldest window first, under the sweep policy alone" } ]
Expected
Cross-workspace discovery yields references and each mutation uses its record’s workspace.
Data
Use the controlled records and transports established by the cited tests.
Bound to
services-commerce:modules/orders/tests/integration/services/persistence/orders.queries.integration.spec.js#lists, across tenants, every placed order past its window as references, oldest window first, under the sweep policy alone
services-commerce:modules/checkout/tests/integration/services/checkout/checkout-sweeper.integration.spec.js#abandoned each expired open checkout in its own tenant, with the system as the actor and expired as the reason
Source
services-commerce:modules/orders/tests/integration/services/persistence/orders.queries.integration.spec.js#lists, across tenants, every placed order past its window as references, oldest window first, under the sweep policy alone
07 A reader cannot change another authorized cartinteractionapiproposed
Proves
BR-CAP-COM-ORD-001-01 BR-CAP-COM-ORD-011-02
Preconditions
A workspace reader can read a staff-created cart.
Steps
[ { "do": "Read the cart, attempt an item addition and read its version again.", "provenance": "proposed", "source": [ "services-commerce:modules/checkout/tests/e2e/checkouts.e2e.spec.js#refuses a member opening a checkout for another contact, 403", "services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#a reader is refused every write, 403 permission_missing, leaving the checkout as it was" ] } ]
Expected
The read succeeds, the write is refused and the version stays unchanged.
Data
Use an isolated workspace with the records and responses named in the preconditions.
Source
services-commerce:modules/checkout/tests/e2e/checkouts.e2e.spec.js#refuses a member opening a checkout for another contact, 403,services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#a reader is refused every write, 403 permission_missing, leaving the checkout as it was
08 Cart editing permission does not authorize a saleinteractionapiproposed
Proves
BR-CAP-COM-ORD-005-12 BR-CAP-COM-ORD-011-02
Preconditions
A clerk can edit carts but cannot place orders.
Steps
[ { "do": "Change an item and request placement.", "provenance": "proposed", "source": [ "services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#a clerk without commerce.orders.create changes a checkout but is refused the placement", "services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#a reader is refused every write, 403 permission_missing, leaving the checkout as it was" ] } ]
Expected
The item changes and placement is refused without creating an order.
Data
Use an isolated workspace with the records and responses named in the preconditions.
Source
services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#a clerk without commerce.orders.create changes a checkout but is refused the placement,services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#a reader is refused every write, 403 permission_missing, leaving the checkout as it was
09 Portal ownership is checked before charginginteractionapiproposed
Proves
BR-CAP-COM-ORD-007-03 BR-CAP-COM-ORD-011-03
Preconditions
One member’s placed sale is addressed by another member.
Steps
[ { "do": "Attempt payment and inspect the sale’s attempts.", "provenance": "proposed", "source": [ "services-commerce:modules/orders/tests/e2e/billing-and-tender.e2e.spec.js#refuses an offline tender by a member, 403 tender_kind_staff_only, and a kind the profile does not allow, 409, read from the ORDER’s snapshot: the order placed before the change still allows it (22 §9)", "services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#is refused another member’s checkout and order, 403 not_your_party, and a change of it" ] } ]
Expected
The other-party request is refused and creates no payment attempt.
Data
Use an isolated workspace with the records and responses named in the preconditions.
Source
services-commerce:modules/orders/tests/e2e/billing-and-tender.e2e.spec.js#refuses an offline tender by a member, 403 tender_kind_staff_only, and a kind the profile does not allow, 409, read from the ORDER’s snapshot: the order placed before the change still allows it (22 §9),services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#is refused another member’s checkout and order, 403 not_your_party, and a change of it
10 A member’s list stays inside their buyer scopeinteractionapiproposed
Proves
BR-CAP-COM-ORD-010-04 BR-CAP-COM-ORD-011-03
Preconditions
Two contacts in one workspace each have an order.
Steps
[ { "do": "List the first buyer as that member, request the other buyer and request the workspace list.", "provenance": "proposed", "source": [ "services-commerce:modules/orders/tests/unit/orders/orders-list-query.spec.js#refuses a search beside a buyer", "services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#is refused another member’s checkout and order, 403 not_your_party, and a change of it" ] } ]
Expected
The own-buyer list succeeds and both broader requests are refused.
Data
Use an isolated workspace with the records and responses named in the preconditions.
Source
services-commerce:modules/orders/tests/unit/orders/orders-list-query.spec.js#refuses a search beside a buyer,services-commerce:modules/checkout/tests/e2e/checkout-security.e2e.spec.js#is refused another member’s checkout and order, 403 not_your_party, and a change of it

The Markdown files under specs/ in rhythmsoftware/rhythm-v2-docs are the canonical source of truth. This reader is a generated, read-only projection of them.

Rhythm Software