ATS-PFM-CSH-014 Apply the workspace and person’s application access — acceptance
Markdown Planning / Platform / Console Shell and Navigation / Application access in the console / Capability Test Specification Test Scenarios 8 scenarios proving CAP-PFM-CSH-014
01 The context application list determines enabled sections unit negative test
Proves BR-CAP-PFM-CSH-014-01Preconditions The context lists selected known products and an unknown product. Steps Derive console entitlements and inspect the application mapping. Expected Only listed known products enable their mapped domains; the mapping names existing domains and covers the console catalogue. Data Known and unknown application keys. Bound to Source react-console:lib/security-context/entitlements.test.ts #enables only the domains of the applications the context lists 02 A staff wildcard does not enable unlisted products unit negative test
Proves BR-CAP-PFM-CSH-014-03Preconditions The staff context grants all actions but lists CRM alone. Steps Derive console entitlements. Expected CRM is enabled and no unlisted application domain is enabled. Data A staff wildcard context listing CRM. Bound to Source react-console:lib/security-context/entitlements.test.ts #gives a staff wildcard no domain the applications did not give 03 Backend aliases supply their mapped console permissions unit test
Proves BR-CAP-PFM-CSH-014-04Preconditions The context grants recognized backend permissions. Steps Evaluate the console keys associated with each backend key. Expected Mapped console checks pass, including one backend key supplying several console keys. Data Backend permission and alias inputs. Bound to Source react-console:lib/authz/__tests__/authz.test.ts #maps aliases onto registry keys 04 Synthetic permissions require an enabled keyless domain unit test
Proves BR-CAP-PFM-CSH-014-05Preconditions A domain has no backend aliases; variants enable it, omit it or deny an item. Steps Derive console entitlements for each variant. Expected Enabled variants receive the synthetic keys except denied items; omitted domains receive none and mapped domains still need backend grants. Data Keyless and mapped-domain inputs. Bound to Source react-console:lib/security-context/entitlements.test.ts #grants a keyless domain's item keys when its application is enabled 05 Explicit refusal wins over grants unit negative test
Proves BR-CAP-PFM-CSH-014-07BR-CAP-PFM-CSH-014-08Preconditions Inputs include exact grants, a prefix grant, explicit denial and no entitlements. Steps Evaluate the relevant permission and page checks. Expected Explicit denial prevails, prefix grants cover their descendants and absent authority refuses a requested permission. Data Permission-rule boundary inputs. Bound to Source react-console:lib/authz/__tests__/authz.test.ts #grants exact keys and prefix wildcards, and denies win 06 Removing a product from the context removes its domain unit negative test
Proves BR-CAP-PFM-CSH-014-01Preconditions Two context answers differ by whether CRM is listed. Steps Derive entitlements from each answer. Expected CRM is enabled only in the answer that lists it. Data Contexts with and without CRM. Bound to Source react-console:lib/security-context/entitlements.test.ts #takes an application away with the access key that named it 07 Scoped grants restrict records while permitting the surface unit negative test
Proves BR-CAP-PFM-CSH-014-10Preconditions One custom type has a scoped grant, with a separate workspace-wide variant. Steps Check the surface, granted type and another type; repeat with the wider grant. Expected The surface and named type pass, another type fails and the workspace-wide grant removes the scope restriction. Data Scoped and unrestricted permission contexts. Bound to Source react-console:lib/security-context/entitlements.test.ts #holds the key on that object and nowhere else 08 Backend allowed authority overrides a stale contrary rule unit test
Proves BR-CAP-PFM-CSH-014-11Preconditions The context both allows contact read and carries a contrary stale rule. Steps Derive allowed and denied console keys. Expected Contact view remains allowed and is absent from the derived denied set. Data A context with contradictory allowed and rule inputs. Bound to Source react-console:lib/authz/__tests__/backend-aliases.test.ts #lets allowed win over a stale deny rule, because allowed is the authority ← Previous Capability Test Specification ATS-PFM-CSH-013 · Keep staff work and workspace work in distinct contexts — acceptance Next Capability Test Specification → ATS-PFM-CSH-015 · Explain why an application page cannot open — acceptance