ATS-CRM-ACT-019Apply workspace access and maintenance permissions: Acceptance Test Set

ATS-CRM-ACT-019

Apply workspace access and maintenance permissions: Acceptance Test Set

KindAcceptance test setProduct areaCRMModuleActivities, Follow-ups and Task WorkRevision2

Read atservices-crm a8d1364freact-console baf6dae3

Apply workspace access and maintenance permissions: Acceptance Test Set

Coverage

Bound scenarios identify existing assertions; unbound scenarios remain proposed proof. Static inspection does not establish a passing execution.

Show evidence (sources, provenance, origins, pinned commits)

6 scenarios proving CAP-CRM-ACT-019; 6 bound to an existing test.

01 Enforce workspace boundaries on records and local referencesapinegativetest

Proves: BR-CAP-CRM-ACT-019-01 BR-CAP-CRM-ACT-019-02
Preconditions: Two workspaces hold activities, tasks and related records.
Steps: Read and mutate foreign records and attempt foreign contact links.
Expected: Foreign data appears absent, writes and links fail, and original records remain unchanged.
Data: Each run creates and isolates the records it needs.
Bound to: services-crm:modules/activities/tests/integration/db/activities.table.integration.spec.js#shows the tenant none of the other tenant’s activities, links or types, with no predicate of its own
services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#answers tenant B 404 for tenant A’s activity
services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses tenant B a link to tenant A’s contact: 400
services-crm:modules/tasks/tests/integration/services/persistence/tasks.integration.spec.js#reads as absent to this tenant, rather than as a task it may not have
services-crm:modules/tasks/tests/integration/services/persistence/tasks.integration.spec.js#is left exactly as the other tenant had it, every refusal above having written nothing
react-console:acceptance/crm/playwright/journeys/cross-application/CRM-ACC-0718.spec.ts#CRM-ACC-0718
Source: services-crm:modules/activities/tests/integration/db/activities.table.integration.spec.js#shows the tenant none of the other tenant’s activities, links or types, with no predicate of its own

02 Reject a mismatched signed contextapinegativetest

Proves: BR-CAP-CRM-ACT-019-03
Preconditions: A context names one workspace.
Steps: Use it against another workspace’s activity and task addresses.
Expected: The boundary returns Forbidden.
Data: Each run creates and isolates the records it needs.
Bound to: services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses a context for tenant B on tenant A’s path: 403
services-crm:modules/tasks/tests/e2e/tasks.e2e.spec.js#answers 403 for a tenant the context does not cover
Source: services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses a context for tenant B on tenant A’s path: 403

03 Apply activity permissions to each operationapinegativetest

Proves: BR-CAP-CRM-ACT-019-04
Preconditions: Callers have read-only, user and missing-read authority.
Steps: Exercise activity creation, reads, edits and deletion.
Expected: Each operation requires its declared activity permission.
Data: Each run creates and isolates the records it needs.
Bound to: services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses a create to a caller who may only read activities: 403
services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses a read to a caller without crm.activities.read: 403
services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses a replace to a caller without crm.activities.update: 403
services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses a patch to a caller without crm.activities.update: 403
services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses a delete to a caller without crm.activities.delete: 403
react-console:acceptance/crm/playwright/journeys/cross-application/CRM-ACC-0715.spec.ts#CRM-ACC-0715
Source: services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses a create to a caller who may only read activities: 403

04 Permit task reads without granting task changesapinegativetest

Proves: BR-CAP-CRM-ACT-019-05
Preconditions: A caller holds task read only.
Steps: Read a task, edit it and claim it.
Expected: Reading succeeds and mutation requests are forbidden.
Data: Each run creates and isolates the records it needs.
Bound to: services-crm:modules/tasks/tests/e2e/tasks.e2e.spec.js#lets a caller who may only read tasks read one
services-crm:modules/tasks/tests/e2e/tasks.e2e.spec.js#answers 403 to a caller who may only read tasks
services-crm:modules/tasks/tests/e2e/tasks.e2e.spec.js#answers 403 to a caller who may only read tasks claiming one
react-console:acceptance/crm/playwright/journeys/cross-application/CRM-ACC-0716.spec.ts#CRM-ACC-0716
Source: services-crm:modules/tasks/tests/e2e/tasks.e2e.spec.js#lets a caller who may only read tasks read one

05 Reserve configuration maintenance for administratorsapinegativetest

Proves: BR-CAP-CRM-ACT-019-06
Preconditions: Callers may inspect activity and task configuration only.
Steps: Create an activity type and reorder task types.
Expected: Both maintenance requests are forbidden.
Data: Each run creates and isolates the records it needs.
Bound to: services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses a type’s create to a caller who may only read types: 403
services-crm:modules/tasks/tests/e2e/tasks.e2e.spec.js#answers 403 to a caller who may only read task types
Source: services-crm:modules/activities/tests/e2e/activities.e2e.spec.js#refuses a type’s create to a caller who may only read types: 403

06 Demonstrate a full activity lock’s missing release pathapinegativetest

Proves: BR-CAP-CRM-ACT-019-08
Preconditions: An activity permits an ordinary edit.
Steps: Save a full lock and attempt to clear it through editing.
Expected: Setting succeeds and clearing fails; the recorded audited lock operations remain unimplemented.
Data: Each run creates and isolates the records it needs.
Bound to: react-console:acceptance/crm/playwright/journeys/cross-application/CRM-ACC-0699.spec.ts#CRM-ACC-0699
Source: react-console:acceptance/crm/playwright/journeys/cross-application/CRM-ACC-0699.spec.ts#CRM-ACC-0699