ATS-CRM-REG-013 Restrict regional work to authorised users: Capability Test Specification
Markdown Design / CRM / Regions / Regional Catalogue / Capability Test Specification Restrict regional work to authorised users: Capability Test Specification Coverage Each row links a required rule to its authored proof. A covered category records a specification; executable and remaining variant gaps stay in the finding register.
Regional authority spans catalogue preview recalculation and imports. The interaction scenario connects maintain the region catalogue, retire regions while preserving their references, configure automatic placement and its address sources, apply the current policy across existing records, import a catalogue of regions with this capability. Cross-workflow expectations are proposed where no executable binding is present.
Coverage Rule gap: FND-CRM-REG-058 Transition not-applicable Validation gap: FND-CRM-REG-058 Permission covered Edge covered Failure gap: FND-CRM-REG-058 Boundary covered Concurrency gap: FND-CRM-REG-058 Invariant gap: FND-CRM-REG-058 Interaction covered Test Scenarios 8 scenarios proving CAP-CRM-REG-013
01 Route declarations identify the required authority permission unit negative test
Proves BR-CAP-CRM-REG-013-01BR-CAP-CRM-REG-013-03Preconditions The regional route catalogue is available. Steps Inspect regional operation access and permissions. Expected The catalogue associates read, create, update, delete and recalculate work with their corresponding keys and console access. Data Published regional route metadata. Bound to Source services-crm:tests/unit/regions-authorization.spec.ts #requires crm.regions.read to list regions 03 Authentication and workspace access are required boundary api negative test
Proves BR-CAP-CRM-REG-013-04Preconditions A regional record exists. Steps Request it anonymously and with access only to another workspace. Expected The responses reject unauthenticated and out-of-scope access. Data Authenticated and out-of-scope execution contexts. Bound to Source services-crm:modules/regions/tests/e2e/regions.e2e.spec.js #answers 401 to an anonymous call 04 Read-only views have no usable edits permission browser test
Proves BR-CAP-CRM-REG-013-05Preconditions The signed-in user has read-only authority. Steps Visit both regional tabs. Expected The view explains read-only access and provides no usable Add, Edit, Delete or Recalculate actions. Data An identity limited to read authority. Bound to Source react-console:e2e/dev/regions.dev.spec.ts #shows a read-only user the regions, and offers them nothing that changes one 05 Partial aliases expose mismatched controls permission browser negative proposed
Proves BR-CAP-CRM-REG-013-07Preconditions Users separately hold regional create, contact-role update and contact-role read authority. Steps Visit Regions and attempt a policy save with each authority set. Expected Record the controls exposed and the regional requests refused by the service. Data Three policies exposing the partial-key combinations. Source react-console:lib/authz/backend-aliases.ts:crm.settings.view, crm.settings.manage, maintenance.operations.run 06 Read permits listing but cannot create rules permission api negative test
Proves BR-CAP-CRM-REG-013-08Preconditions The caller holds regional read alone. Steps List rules and submit rule creation. Expected Listing succeeds and creation is denied. Data Execution limited to regional reading. Bound to Source services-crm:modules/regions/tests/e2e/regions.e2e.spec.js #the rules, one at a time › answers 200 to a list for a context carrying only the read permission 07 Regional authority spans catalogue preview recalculation and imports interaction api proposed
Proves BR-CAP-CRM-REG-013-01BR-CAP-CRM-REG-013-04BR-CAP-CRM-REG-007-04BR-CAP-CRM-REG-011-01BR-CAP-CRM-REG-014-01Preconditions A reader, ordinary regional editor and full regional administrator share a workspace containing saved policy. Steps Each identity lists regions, previews an address, attempts catalogue creation and deletion, starts recalculation and submits a regional file. Expected Every request is checked against its regional action keys; console controls cannot grant authority absent from the service. Data A reader, ordinary regional editor and full regional administrator share a workspace containing saved policy. Source SVC-CRM-REG-regions 08 Direct editor access respects the management gate edge browser negative test
Proves BR-CAP-CRM-REG-013-06Preconditions An identity has regional viewing authority alone. Steps Open the policy editor directly rather than through its read-only tab. Expected The editor supplies no usable policy-editing surface. Data An identity has regional viewing authority alone. Bound to Source react-console:components/regions/__tests__/assignment-rules-editor.test.tsx #who may open the editor › is not somebody who may only look, whatever the URL ← Previous Capability Test Specification ATS-CRM-REG-012 · Monitor recalculation and recover from failure: Capability Test Specification Next Capability Test Specification → ATS-CRM-REG-014 · Import a catalogue of regions: Capability Test Specification