Rhythm 2.0 Specifications

Appearance

ATS-CRM-ACT-019Apply workspace access and maintenance permissions: Capability Test Specification

Markdown

ATS-CRM-ACT-019

Apply workspace access and maintenance permissions: Capability Test Specification

Markdown
  • DocumentProposed

Planning

Proves capability
CAP-CRM-ACT-019

Design

Executed by
TST-CRM-ACT-002, TST-CRM-ACT-003, TST-CRM-ACT-015, TST-CRM-ACT-025, TST-CRM-ACT-043, TST-CRM-ACT-059, TST-CRM-ACT-060, TST-CRM-ACT-062

KindAcceptance test setProduct areaCRMModuleActivities, Follow-ups and Task WorkRevision3

Read atservices-crm a8d1364freact-console baf6dae3rhythm-v2-docs 18a49edf

Apply workspace access and maintenance permissions: Capability Test Specification ​

Coverage ​

Category coverage counts specified proof. Unbound cases remain proposed; registered assertions do not establish a passing run.

RuleProof Scenario Or Finding
BR-CAP-CRM-ACT-019-01ATS-CRM-ACT-019-01
BR-CAP-CRM-ACT-019-02ATS-CRM-ACT-019-01
BR-CAP-CRM-ACT-019-03ATS-CRM-ACT-019-02
BR-CAP-CRM-ACT-019-04ATS-CRM-ACT-019-03, ATS-CRM-ACT-019-07
BR-CAP-CRM-ACT-019-05ATS-CRM-ACT-019-04, ATS-CRM-ACT-019-07
BR-CAP-CRM-ACT-019-06ATS-CRM-ACT-019-05, ATS-CRM-ACT-019-07
BR-CAP-CRM-ACT-019-07ATS-CRM-ACT-019-08
BR-CAP-CRM-ACT-019-08ATS-CRM-ACT-019-06
BR-CAP-CRM-ACT-019-10FND-CRM-ACT-065

Readers, contributors and administrators exist in two workspaces. Exercise reads, activity correction, task deletion and both classification catalogs using each persona; retry with foreign record references.

The interaction scenario names the capabilities and rules it exercises. The coverage finding retains incomplete permission combinations and failure variants.

Coverage

  • Rule gap: FND-CRM-ACT-065
  • Transition gap: FND-CRM-ACT-065
  • Validation gap: FND-CRM-ACT-065
  • Permission covered
  • Edge gap: FND-CRM-ACT-065
  • Failure covered
  • Boundary gap: FND-CRM-ACT-065
  • Concurrency gap: FND-CRM-ACT-065
  • Invariant covered
  • Interaction covered

Test Scenarios

8 scenarios proving CAP-CRM-ACT-019; 7 bound to an existing test.

01 Enforce workspace boundaries on records and local referencesinvariantapinegativetest
Proves
BR-CAP-CRM-ACT-019-01 BR-CAP-CRM-ACT-019-02
Preconditions
Two workspaces hold activities, tasks and related records.
Steps
Read and mutate foreign records and attempt foreign contact links.
Expected
Foreign data appears absent, writes and links fail, and original records remain unchanged.
Data
Each run creates and isolates the records it needs.
Bound to
services-crm:modules/activities/tests/integration/db/activities.table.integration.spec.js#shows the tenant none of the other tenant’s activities, links or types, with no predicate of its own
services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#answers tenant B 404 for tenant A’s activity
services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses tenant B a link to tenant A’s contact: 400
services-crm:modules/tasks/tests/integration/services/persistence/tasks.integration.spec.js#reads as absent to this tenant, rather than as a task it may not have
services-crm:modules/tasks/tests/integration/services/persistence/tasks.integration.spec.js#is left exactly as the other tenant had it, every refusal above having written nothing
Source
services-crm:modules/activities/tests/integration/db/activities.table.integration.spec.js#shows the tenant none of the other tenant’s activities, links or types, with no predicate of its own
02 Reject a mismatched signed contextpermissionapinegativetest
Proves
BR-CAP-CRM-ACT-019-03
Preconditions
A context names one workspace.
Steps
Use it against another workspace’s activity and task addresses.
Expected
The boundary returns Forbidden.
Data
Each run creates and isolates the records it needs.
Bound to
services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses a context for tenant B on tenant A’s path: 403
services-crm:modules/tasks/tests/e2e/tasks.e2e.spec.js#answers 403 for a tenant the context does not cover
Source
services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses a context for tenant B on tenant A’s path: 403
03 Apply activity permissions to each operationpermissionapinegativetest
Proves
BR-CAP-CRM-ACT-019-04
Preconditions
Callers have read-only, user and missing-read authority.
Steps
Exercise activity creation, reads, edits and deletion.
Expected
Each operation requires its declared activity permission.
Data
Each run creates and isolates the records it needs.
Bound to
services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses a create to a caller who may only read activities: 403
services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses a read to a caller without crm.activities.read: 403
services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses a replace to a caller without crm.activities.update: 403
services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses a patch to a caller without crm.activities.update: 403
services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses a delete to a caller without crm.activities.delete: 403
Source
services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses a create to a caller who may only read activities: 403
04 Permit task reads without granting task changespermissionapinegativetest
Proves
BR-CAP-CRM-ACT-019-05
Preconditions
A caller holds task read only.
Steps
Read a task, edit it and claim it.
Expected
Reading succeeds and mutation requests are forbidden.
Data
Each run creates and isolates the records it needs.
Bound to
services-crm:modules/tasks/tests/e2e/tasks.e2e.spec.js#lets a caller who may only read tasks read one
services-crm:modules/tasks/tests/e2e/tasks.e2e.spec.js#answers 403 to a caller who may only read tasks
services-crm:modules/tasks/tests/e2e/tasks.e2e.spec.js#answers 403 to a caller who may only read tasks claiming one
Source
services-crm:modules/tasks/tests/e2e/tasks.e2e.spec.js#lets a caller who may only read tasks read one
05 Reserve configuration maintenance for administratorspermissionapinegativetest
Proves
BR-CAP-CRM-ACT-019-06
Preconditions
Callers may inspect activity and task configuration only.
Steps
Create an activity type and reorder task types.
Expected
Both maintenance requests are forbidden.
Data
Each run creates and isolates the records it needs.
Bound to
services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses a type’s create to a caller who may only read types: 403
services-crm:modules/tasks/tests/e2e/tasks.e2e.spec.js#answers 403 to a caller who may only read task types
Source
services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses a type’s create to a caller who may only read types: 403
06 Demonstrate a full activity lock’s missing release pathfailureapinegativetest
Proves
BR-CAP-CRM-ACT-019-08
Preconditions
An activity permits an ordinary edit.
Steps
Save a full lock and attempt to clear it through editing.
Expected
Setting succeeds and clearing fails; the recorded audited lock operations remain unimplemented.
Data
Each run creates and isolates the records it needs.
Bound to
Source
react-console:acceptance/crm/playwright/journeys/cross-application/CRM-ACC-0699.spec.ts#CRM-ACC-0699
07 Access restrictions span logging work and configurationinteractionapiproposed
Proves
BR-CAP-CRM-ACT-019-04 BR-CAP-CRM-ACT-019-05 BR-CAP-CRM-ACT-019-06
Preconditions
Readers, contributors and administrators exist in two workspaces.
Steps
Exercise reads, activity correction, task deletion and both classification catalogs using each persona; retry with foreign record references.
Expected
Each operation follows its own declared authority; forbidden and foreign requests leave all records and configuration unchanged.
Data
Run-owned records in an isolated workspace; fixed clock for calendar checks.
Source
services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses a create to a caller who may only read activities: 403; services-crm:modules/tasks/tests/e2e/tasks.e2e.spec.js#answers 403 to a caller who may only read tasks claiming one; services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses a type’s create to a caller who may only read types: 403
08 Reject unauthenticated entry before any writepermissionapinegativetest
Proves
BR-CAP-CRM-ACT-019-07
Preconditions
No signed execution context is supplied.
Steps
Invoke an activity route without a context.
Expected
The route returns Unauthenticated and retains no write.
Data
Run-owned records in an isolated workspace; fixed clock for calendar checks.
Bound to
Source
services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#answers 401 without a context

The Markdown files under specs/ in rhythmsoftware/rhythm-v2-docs are the canonical source of truth. This reader is a generated, read-only projection of them.

Rhythm Software