Rhythm 2.0 Specifications

Appearance

ATS-PFM-INT-005Protect credentials throughout their useful life: Capability Test Specification

Markdown

ATS-PFM-INT-005

Protect credentials throughout their useful life: Capability Test Specification

Markdown
  • DocumentProposed

Planning

Proves capability
CAP-PFM-INT-005

Design

Executed by
TST-PFM-INT-485, TST-PFM-INT-486, TST-PFM-INT-491, TST-PFM-INT-509, TST-PFM-INT-525, TST-PFM-INT-526, TST-PFM-INT-527, TST-PFM-INT-528, TST-PFM-INT-529, TST-PFM-INT-531, TST-PFM-INT-532, TST-PFM-INT-535

KindAcceptance test setProduct areaPlatformModuleIntegration access, customer extensions and shared workflow configurationRevision3

Read atservices-platform ad3f6a65macroservice-libraries 54536a44react-console baf6dae3

Protect credentials throughout their useful life: Capability Test Specification ​

Coverage ​

RuleProved By
BR-CAP-PFM-INT-005-01ATS-PFM-INT-005-01
BR-CAP-PFM-INT-005-02ATS-PFM-INT-005-02
BR-CAP-PFM-INT-005-03ATS-PFM-INT-005-03
BR-CAP-PFM-INT-005-04ATS-PFM-INT-005-04, ATS-PFM-INT-005-13, ATS-PFM-INT-005-14
BR-CAP-PFM-INT-005-05ATS-PFM-INT-005-05, ATS-PFM-INT-005-16, ATS-PFM-INT-005-17
BR-CAP-PFM-INT-005-06ATS-PFM-INT-005-06
BR-CAP-PFM-INT-005-07ATS-PFM-INT-005-07
BR-CAP-PFM-INT-005-08ATS-PFM-INT-005-08
BR-CAP-PFM-INT-005-09ATS-PFM-INT-005-09
BR-CAP-PFM-INT-005-10FND-PFM-INT-060
BR-CAP-PFM-INT-005-11ATS-PFM-INT-005-10, ATS-PFM-INT-005-15
BR-CAP-PFM-INT-005-12ATS-PFM-INT-005-11, ATS-PFM-INT-005-13
BR-CAP-PFM-INT-005-13FND-PFM-INT-060
BR-CAP-PFM-INT-005-14ATS-PFM-INT-005-12

Credential replacement and refresh connect secret handling to account verification and health. The interaction cases check the resulting connection state and operational visibility while keeping secret values outside customer-facing records.

The structured scenarios name the capabilities and rules involved. A bound test contributes only the outcomes it asserts; proposed transition matrices and composed interactions still require executable proof.

Coverage

  • Rule covered
  • Transition covered
  • Validation gap: FND-PFM-INT-060
  • Permission covered
  • Edge covered
  • Failure gap: FND-PFM-INT-060
  • Boundary covered
  • Concurrency covered
  • Invariant covered
  • Interaction covered

Test Scenarios

17 scenarios proving CAP-PFM-INT-005; 10 bound to an existing test.

01 Credential reads and traces reveal no key valueinvariantapitest
Proves
BR-CAP-PFM-INT-005-01
Preconditions
A key has just been saved for a connection.
Steps
Inspect credential facts, Library responses, integration records and entry logs.
Expected
Responses retain only non-secret facts and a permitted hint; records and logs omit the entered secret.
Data
Fixtures establishing the stated accounts, declarations and history in an isolated workspace.
Bound to
Source
services-platform:modules/integrations/tests/integration/services/credentials/credential-state.integration.spec.js#answers no secret value, secret name or key version
02 Connection management does not grant credential writespermissionapinegativetest
Proves
BR-CAP-PFM-INT-005-02
Preconditions
A manager lacks credential authority and a separate reader can inspect integrations.
Steps
Attempt key entry as the manager and read facts as the reader.
Expected
Entry is denied while the reader obtains only credential facts.
Data
Fixtures establishing the stated accounts, declarations and history in an isolated workspace.
Bound to
Source
services-platform:modules/integrations/tests/e2e/credentials.e2e.spec.js#is refused to a caller who manages connections but not their credentials
03 Invalid credentials fail without disclosureboundaryapinegativetest
Proves
BR-CAP-PFM-INT-005-03
Preconditions
An entered-key connection expects declared fields.
Steps
Submit an 8193-character value, twenty-one fields, a 101-character name, a different method and a missing required field.
Expected
Each refusal identifies the problem without repeating the secret or writing credential data.
Data
Fixtures establishing the stated accounts, declarations and history in an isolated workspace.
Bound to
Source
services-platform:modules/integrations/tests/e2e/credential-entry-limits.e2e.spec.js#INT-ACC-0166 step 5: refuses a value of 8193 characters with 400 naming the field and the limit, and stores nothing
04 Replacement and destruction follow the recovery windowtransitionapitest
Proves
BR-CAP-PFM-INT-005-04
Preconditions
A connection currently uses its first key.
Steps
Replace it, invoke immediately and run maintenance before and after the one-week deletion date.
Expected
The call leases the replacement; the superseded key remains before the date and is destroyed after it.
Data
Fixtures establishing the stated accounts, declarations and history in an isolated workspace.
Bound to
Source
services-platform:modules/integrations/tests/integration/services/credentials/credential-lifecycle.integration.spec.js#INT-ACC-0163 step 5: svc_accounting’s payments.authorize right after the replacement, before the re-verification runs, leases the new credential
05 Credential entry verifies only appropriate statestransitionapiproposed
Proves
BR-CAP-PFM-INT-005-05
Preconditions
Prepare waiting, failed-verification, re-authorization-required, active and suspended connections.
Steps
Enter credentials for each.
Expected
The first three move to verifying with a job, active stays active with a check and suspended remains paused without a job.
Data
Fixtures establishing the stated accounts, declarations and history in an isolated workspace.
Source
services-platform:modules/integrations/services/credentials/credential-store.ts:verification_retried
06 Leases are short-lived and state-awareboundaryapinegativetest
Proves
BR-CAP-PFM-INT-005-06
Preconditions
Prepare active, suspended and verifying connections.
Steps
Request normal and over-limit leases and inspect their audit records.
Expected
Active receives the default five-minute lease; suspension and a lifetime above sixty minutes refuse, verifying requires verification purpose and no audit value is retained.
Data
Fixtures establishing the stated accounts, declarations and history in an isolated workspace.
Bound to
Source
services-platform:modules/integrations/tests/integration/services/credentials/broker.integration.spec.js#is refused as connection_unavailable for a suspended connection
07 Lease renewal follows the issuing executionpermissionapinegativetest
Proves
BR-CAP-PFM-INT-005-07
Preconditions
A running execution has an issued credential lease.
Steps
Renew as its adapter, as a different principal, after settlement and with an unknown lease reference.
Expected
Only renewal by the issuing adapter while that execution runs succeeds.
Data
Fixtures establishing the stated accounts, declarations and history in an isolated workspace.
Bound to
Source
services-platform:modules/integrations/tests/integration/services/adapter-callbacks/adapter-callbacks.integration.spec.js#refuses a lease whose execution is not running, execution_not_running
08 OAuth requests only accepted capability scopesruleapitest
Proves
BR-CAP-PFM-INT-005-08
Preconditions
A sign-in connection accepts meetings only and another connection uses an entered key.
Steps
Begin authorization for each.
Expected
OAuth returns state, proof-key challenge and meeting scopes; the entered-key connection refuses OAuth.
Data
Fixtures establishing the stated accounts, declarations and history in an isolated workspace.
Bound to
Source
services-platform:modules/integrations/tests/integration/services/credentials/oauth-flow.integration.spec.js#answers the provider’s URL with the client, the one redirect, the state and the accepted capabilities’ scopes
09 Issued state can complete authorization onceconcurrencyapinegativetest
Proves
BR-CAP-PFM-INT-005-09
Preconditions
A sign-in flow has a valid outstanding state.
Steps
Submit its callback, repeat the state and submit an unknown state.
Expected
The initial callback saves tokens and returns to connection detail; repeats and unknown state show the restart page without further storage.
Data
Fixtures establishing the stated accounts, declarations and history in an isolated workspace.
Bound to
Source
services-platform:modules/integrations/tests/e2e/credentials.e2e.spec.js#answers the public callback a page for a state nobody issued, with no signed context
10 Refresh serializes work and reports lost authorizationconcurrencyapitest
Proves
BR-CAP-PFM-INT-005-11
Preconditions
One token expires shortly, another in an hour.
Steps
Run concurrent refresh passes, then return invalid grant from the provider.
Expected
Only one token request runs for the due connection, none for the later token, and refusal requires re-authorization with an administrator notice.
Data
Fixtures establishing the stated accounts, declarations and history in an isolated workspace.
Bound to
Source
services-platform:modules/integrations/tests/integration/services/credentials/refresh.integration.spec.js#makes one token request when two refreshes of a connection run at once
11 Maintenance avoids repeated noticesedgeapitest
Proves
BR-CAP-PFM-INT-005-12
Preconditions
A revoked credential has no remaining secret, a refresh token expires in ten days and a sign-in is abandoned.
Steps
Run daily maintenance on consecutive days.
Expected
Destruction is audited, the expiry produces one notice and the abandoned attempt is removed.
Data
Fixtures establishing the stated accounts, declarations and history in an isolated workspace.
Bound to
Source
services-platform:modules/integrations/tests/integration/services/credentials/credential-maintenance.integration.spec.js#sends nothing and audits nothing more on the next day’s pass for the same expiry
12 Reject an oversized authorization scope listboundaryapinegativeproposed
Proves
BR-CAP-PFM-INT-005-14
Preconditions
A credential record with valid account ownership is prepared.
Steps
Write one hundred scopes, then attempt to write one hundred and one scopes.
Expected
The limit-sized scope list is accepted and the larger list is refused without changing the stored credential.
Data
Valid direct-writer fixtures in an isolated workspace.
Source
services-platform:modules/integrations/db/integration-credentials.table.ts:integration_credentials_scopes_check
13 Exercise the complete credential lifecycletransitionapinegativeproposed
Proves
BR-CAP-PFM-INT-005-04 BR-CAP-PFM-INT-005-12 BR-CAP-PFM-INT-004-09
Preconditions
Prepare one independent record in each starting state, including absent-record cases where the model defines creation.
Steps
Run each listed transition once with its guard satisfied, then repeat it with the guard denied. Inspect the resulting record and listed side effects after commit.
Expected
Each positive case reaches its listed destination and records its defined side effects. Each denied case preserves the starting record and creates no transition side effects.
Data
Run-owned records and principals in an isolated workspace.
Source
rhythm-v2-docs:specs/platform/integrations/design/state-models/STATE-PFM-INT-004-credential-lifecycle.md#transitions
14 The next call uses a replacement credentialinteractionapiproposed
Proves
BR-CAP-PFM-INT-005-04 BR-CAP-PFM-INT-009-07
Preconditions
A callable account has an existing entered key.
Steps
Replace its key, invoke an authorized operation and inspect the adapter lease and execution trail.
Expected
Provider contact uses the new credential while execution summaries and history contain no credential value.
Data
Run-owned records and principals in an isolated workspace.
Source
services-platform:modules/integrations/tests/integration/services/credentials/credential-lifecycle.integration.spec.js#INT-ACC-0163 step 5: svc_accounting’s payments.authorize right after the replacement, before the re-verification runs, leases the new credential,services-platform:modules/integrations/tests/integration/services/executions/invoke-capability.integration.spec.js#refuses with 503 provider_unavailable while the circuit is open, and releases the key
15 Lost authorization becomes an actionable account probleminteractionapiproposed
Proves
BR-CAP-PFM-INT-005-11 BR-CAP-PFM-INT-006-06
Preconditions
A due sign-in token has an active account and administrator recipients.
Steps
Run refresh with provider refusal, then inspect health and delivered administrator notices.
Expected
The account requires re-authorization and the saved result remains even when mail delivery fails.
Data
Run-owned records and principals in an isolated workspace.
Source
services-platform:modules/integrations/tests/integration/services/credentials/refresh.integration.spec.js#makes one token request when two refreshes of a connection run at once,services-platform:modules/integrations/tests/integration/services/connections/connection-feature-changes.integration.spec.js#INT-ACC-0113 step 3: the loss tells each administrator of the tenant once, two notices in all, each with the features-lost subject
16 Corrected credentials recover account setupinteractionapiproposed
Proves
BR-CAP-PFM-INT-004-05 BR-CAP-PFM-INT-005-05
Preconditions
An entered-key account fails its first verification.
Steps
Replace the key, run verification and read safe credential facts and connection detail.
Expected
Successful verification reaches active with provider features; safe facts identify the replacement without its value.
Data
Run-owned records and principals in an isolated workspace.
Source
services-platform:modules/integrations/tests/integration/services/connections/connection-jobs.integration.spec.js#becomes active with the account and every declared feature verified,services-platform:modules/integrations/services/credentials/credential-store.ts:verification_retried
17 Credential verification establishes endpoint setupinteractionapiproposed
Proves
BR-CAP-PFM-INT-005-05 BR-CAP-PFM-INT-013-06
Preconditions
An initial key account declares a manual endpoint.
Steps
Enter valid credentials, finish verification and inspect endpoint setup twice.
Expected
The verification job activates the account and provisions its endpoint; ordinary reads reveal no signing secret.
Data
Run-owned records and principals in an isolated workspace.
Source
services-platform:modules/integrations/services/credentials/credential-store.ts:verification_retried,services-platform:modules/integrations/tests/e2e-adapters/events-dummy.adapters.spec.js#never answers the secret again

The Markdown files under specs/ in rhythmsoftware/rhythm-v2-docs are the canonical source of truth. This reader is a generated, read-only projection of them.

Rhythm Software