Restrict regional work to authorised users: Acceptance Test Set

Coverage

Rule	Proved by
`BR-CAP-CRM-REG-013-01`	`ATS-CRM-REG-013-01`
`BR-CAP-CRM-REG-013-02`	`ATS-CRM-REG-013-02`
`BR-CAP-CRM-REG-013-03`	`ATS-CRM-REG-013-01`
`BR-CAP-CRM-REG-013-04`	`ATS-CRM-REG-013-03`
`BR-CAP-CRM-REG-013-05`	`ATS-CRM-REG-013-04`
`BR-CAP-CRM-REG-013-07`	`ATS-CRM-REG-013-05`; see `FND-CRM-REG-004`, `FND-CRM-REG-012`
`BR-CAP-CRM-REG-013-08`	`ATS-CRM-REG-013-06`

Test Scenarios

6 scenarios proving CAP-CRM-REG-013; 5 bound to an existing test.

01 Route declarations identify the required authorityunitnegativetest

Proves: BR-CAP-CRM-REG-013-01 BR-CAP-CRM-REG-013-03
Preconditions: The regional route catalogue is available.
Steps: Inspect regional operation access and permissions.
Expected: The catalogue associates read, create, update, delete and recalculate work with their corresponding keys and console access.
Data: Published regional route metadata.
Bound to: services-crm:tests/unit/regions-authorization.spec.ts#requires crm.regions.read to list regions
services-crm:tests/unit/regions-authorization.spec.ts#requires crm.regions.create to create a region
services-crm:tests/unit/regions-authorization.spec.ts#requires crm.regions.update to replace a region
services-crm:tests/unit/regions-authorization.spec.ts#requires crm.regions.delete to delete a region
services-crm:tests/unit/regions-authorization.spec.ts#requires crm.regions.update to save the assignment settings
services-crm:tests/unit/regions-authorization.spec.ts#requires crm.regions.update to reorder the assignment rules
services-crm:tests/unit/regions-authorization.spec.ts#requires crm.regions.read to list and read recalculations
services-crm:tests/unit/regions-authorization.spec.ts#serves every regions route to console users only
Source: services-crm:tests/unit/regions-authorization.spec.ts#requires crm.regions.read to list regions

02 Role tiers distinguish edits from admin workbrowsernegativetest

Proves: BR-CAP-CRM-REG-013-02
Preconditions: A coordinator has user-tier regional authority.
Steps: Create and edit a region, then attempt deletion and recalculation.
Expected: Ordinary edits succeed and the administrator-tier actions are refused.
Data: An identity with standard user-tier authority.
Bound to: react-console:acceptance/crm/playwright/journeys/configuration/CRM-ACC-0366.spec.ts#CRM-ACC-0366
Source: react-console:acceptance/crm/playwright/journeys/configuration/CRM-ACC-0366.spec.ts#CRM-ACC-0366

03 Authentication and workspace access are requiredapinegativetest

Proves: BR-CAP-CRM-REG-013-04
Preconditions: A regional record exists.
Steps: Request it anonymously and with access only to another workspace.
Expected: The responses reject unauthenticated and out-of-scope access.
Data: Authenticated and out-of-scope execution contexts.
Bound to: services-crm:modules/regions/tests/e2e/regions.e2e.spec.js#answers 401 to an anonymous call
services-crm:modules/regions/tests/e2e/regions.e2e.spec.js#the regions › answers 403 when the signed context does not cover the path's tenant
Source: services-crm:modules/regions/tests/e2e/regions.e2e.spec.js#answers 401 to an anonymous call

04 Read-only views have no usable editsbrowsertest

Proves: BR-CAP-CRM-REG-013-05
Preconditions: The signed-in user has read-only authority.
Steps: Visit both regional tabs.
Expected: The view explains read-only access and provides no usable Add, Edit, Delete or Recalculate actions.
Data: An identity limited to read authority.
Bound to: react-console:e2e/dev/regions.dev.spec.ts#shows a read-only user the regions, and offers them nothing that changes one
react-console:components/regions/__tests__/regions-screen.test.tsx#the regions table › offers nothing that changes a region to somebody who may only look
react-console:components/regions/__tests__/assignment-rules-view.test.tsx#Edit Assignment Rules › is not offered to somebody who may only look
Source: react-console:e2e/dev/regions.dev.spec.ts#shows a read-only user the regions, and offers them nothing that changes one

05 Partial aliases expose mismatched controlsbrowsernegativeproposed

Proves: BR-CAP-CRM-REG-013-07
Preconditions: Users separately hold regional create, contact-role update and contact-role read authority.
Steps: Visit Regions and attempt a policy save with each authority set.
Expected: Record the controls exposed and the regional requests refused by the service.
Data: Three policies exposing the partial-key combinations.
Source: react-console:lib/authz/backend-aliases.ts:crm.settings.view, crm.settings.manage, maintenance.operations.run

06 Read permits listing but cannot create rulesapinegativetest

Proves: BR-CAP-CRM-REG-013-08
Preconditions: The caller holds regional read alone.
Steps: List rules and submit rule creation.
Expected: Listing succeeds and creation is denied.
Data: Execution limited to regional reading.
Bound to: services-crm:modules/regions/tests/e2e/regions.e2e.spec.js#the rules, one at a time › answers 200 to a list for a context carrying only the read permission
services-crm:modules/regions/tests/e2e/regions.e2e.spec.js#the rules, one at a time › answers 403 to a create for that same read-only context
Source: services-crm:modules/regions/tests/e2e/regions.e2e.spec.js#the rules, one at a time › answers 200 to a list for a context carrying only the read permission