Test Scenarios
24 scenarios proving CAP-PFM-SEC-002; 13 bound to an existing test.
01 Workspace reach across customer boundariesboundaryapinegativetest
- Proves
BR-CAP-PFM-SEC-002-01 - Preconditions
- Prepare two customers with a workspace each.
- Steps
- Read and list workspaces using one customer’s administrator.
- Expected
- The list contains only reachable workspaces; another customer’s default returns 404.
- Data
- Use the records described in the setup.
- Bound to
- Source
- services-platform:modules/tenants/tests/e2e/tenants.e2e.spec.js#lists no tenant of another customer, which is what the reach reduction means
02 The HQ authority for status changespermissionapinegativetest
- Proves
BR-CAP-PFM-SEC-002-02 - Preconditions
- Prepare an implementation workspace.
- Steps
- Attempt console patch and replacement status changes, then an HQ staff patch.
- Expected
- Console changes fail with HQ guidance and leave status intact; the staff patch succeeds.
- Data
- Use the records described in the setup.
- Bound to
- Source
- services-platform:modules/tenants/tests/e2e/tenants.e2e.spec.js#refuses a customer administrator the same change on the console route, naming where it is made
03 Lifecycle ownership on ordinary writesinvariantapinegativetest
- Proves
BR-CAP-PFM-SEC-002-03 INV-DOM-PFM-SEC-002-03 INV-DOM-PFM-SEC-002-04 - Preconditions
- Prepare an active workspace.
- Steps
- Send lifecycle values in a patch and replacement, then attempt a status prohibited by lifecycle constraints.
- Expected
- Client lifecycle values have no effect; the prohibited status fails without changing the record.
- Data
- Use the records described in the setup.
- Bound to
- Source
- services-platform:modules/tenants/tests/e2e/tenants.e2e.spec.js#leaves the lifecycle state where the server put it after such a patch
04 Accepted time-zone formsvalidationapinegativetest
- Proves
BR-CAP-PFM-SEC-002-04 INV-DOM-PFM-SEC-002-05 - Preconditions
- Prepare a workspace to create and edit.
- Steps
- Try an abbreviation, offset, Etc location and wrong case; also omit the zone.
- Expected
- Invalid forms return 400 without storage changes; omission uses Eastern time.
- Data
- Use the records described in the setup.
- Bound to
- Source
- services-platform:modules/tenants/tests/e2e/tenants.e2e.spec.js#refuses a time zone given as an abbreviation as 400
06 Sandbox parent constraintsinvariantunitnegativetest
- Proves
BR-CAP-PFM-SEC-002-06 INV-DOM-PFM-SEC-002-02 - Preconditions
- Prepare a customer-type workspace and sandbox.
- Steps
- Try absent, wrong-type and cross-customer parents, nested sandboxes and a customer change on the parent.
- Expected
- Invalid relationships fail at the database; a same-customer pair succeeds.
- Data
- Use the records described in the setup.
- Bound to
- Source
- services-platform:modules/tenants/tests/integration/db/tenants.table.integration.spec.js#refuses a sandbox that names no parent by tenants_sandbox_parent_check
07 The dedicated commercial-account actionpermissionapinegativetest
- Proves
BR-CAP-PFM-SEC-002-07 INV-DOM-PFM-SEC-002-06 - Preconditions
- Prepare a commercially linked workspace.
- Steps
- Attempt ordinary link edits and replacement omission; perform and repeat a versioned staff move, then clear the link.
- Expected
- Ordinary changes return 400; the move succeeds once and then returns 409; a customer administrator receives 403; moving requests licence synchronization, while clearing requests none.
- Data
- Use the records described in the setup.
- Bound to
- Source
- services-platform:modules/tenants/tests/e2e/tenant-hubspot-link.e2e.spec.js#refuses a patch that moves the link as 400, even for Rhythm staff in their own editor
08 Version and lock refusals; add a valid clearing proofconcurrencyapinegativeproposed
- Proves
BR-CAP-PFM-SEC-002-08 - Preconditions
- Read a workspace at version n with a populated optional field.
- Steps
- Replace at n omitting that field, repeat at n, and replace an update-locked record; read back the current field spelling.
- Expected
- Stale and locked replacements fail. The proposed clearing check must assert the current stored field is absent or cleared, rather than inspect an obsolete property name.
- Data
- Use the records described in the setup.
- Source
- FND-PFM-SEC-035
09 Workspace availability by route and callerboundaryapinegativetest
- Proves
BR-CAP-PFM-SEC-002-09 INV-DOM-PFM-SEC-002-07 - Preconditions
- Prepare disabled, provisioning, loading and deleting workspaces.
- Steps
- Request ordinary routes as customer users and staff, HQ routes as staff, and an initial-import route during loading.
- Expected
- Ordinary blocked requests return 403 with the generic refusal; HQ staff pass subject to read-only deletion, and loading permits the authorized import route.
- Data
- Use the records described in the setup.
- Bound to
- Source
- services-platform:modules/tenants/tests/e2e/tenant-availability-gate.e2e.spec.js#is refused 403 in a tenant whose customer has been cut off
10 Direct deletion gives recovery guidancetransitionapinegativetest
- Proves
BR-CAP-PFM-SEC-002-11 - Preconditions
- Prepare an existing workspace.
- Steps
- Call its direct delete operation.
- Expected
- The operation returns 405, points to deletion requests and leaves the workspace unchanged.
- Data
- Use the records described in the setup.
- Bound to
- Source
- services-platform:modules/tenants/tests/e2e/tenants.e2e.spec.js#answers the gone status the error contract can express
11 HQ workspace search, filtering and paginationboundaryapinegativetest
- Proves
BR-CAP-PFM-SEC-002-12 - Preconditions
- Prepare workspaces for several customers.
- Steps
- Search an identifier in different case, filter by type, follow a cursor and call as a customer administrator.
- Expected
- Search and filtering select the expected records, the cursor continues the list and the administrator receives 403.
- Data
- Use the records described in the setup.
- Bound to
- Source
- services-platform:modules/tenants/tests/e2e/hq-tenants.e2e.spec.js#finds a tenant by its id, the association's domain, whatever its case
13 Dedicated and shared sender informationruleapitest
- Proves
BR-CAP-PFM-SEC-002-14 - Preconditions
- Prepare one dedicated sender and one shared-sender workspace.
- Steps
- Read sender information as staff and as the customer administrator.
- Expected
- Staff receive DNS and verification details or a null shared-sender result; the administrator receives 403.
- Data
- Use the records described in the setup.
- Bound to
- Source
- services-platform:modules/tenants/tests/e2e/tenant-email-sender.e2e.spec.js#answers the DNS records the customer must publish, so a support person can read them out
14 The HQ edit sheet and disable confirmationpermissionbrowsertest
- Proves
AS-JNY-PFM-SEC-001-03 - Preconditions
- Prepare an HQ staff session and an existing workspace.
- Steps
- Edit the workspace name, save it, then attempt disabled status through the confirmation dialog.
- Expected
- The sheet omits an identifier editor, reflects the saved name and asks for confirmation before disabling; this mock test does not establish go-live behavior.
- Data
- Use the records described in the setup.
- Bound to
- Source
- react-console:e2e/mock/hq-ops.mock.spec.ts#the edit sheet saves, has no identifier to change, and confirms before disabling the tenant
15 Workspace business status: implementation to livetransitionapiproposed
- Proves
BR-CAP-PFM-SEC-002-02 - Preconditions
- Prepare a run-owned workspace business status in implementation state with the authority and inputs required by the cited transition.
- Steps
- [
{
"do": "Save live status with the current version as authorized staff.",
"expect": "After the stated action, observe the workspace business status in live state. This case does not require an additional history event unless the transition explicitly defines one.",
"provenance": "proposed",
"source": [
"services-platform:modules/tenants/tests/integration/services/persistence/tenants.integration.spec.js#lets a sandbox tenant go live, the data-import check being recorded as debt",
"services-platform at ad3f6a65: modules/tenants/db/tenants.table.ts; aws/api/tenants.routes.ts, tenant-api-mapper.ts; services/access/tenant-availability.ts."
]
}
]
- Expected
- After the stated action, observe the workspace business status in live state. This case does not require an additional history event unless the transition explicitly defines one.
- Data
- A disposable customer, workspace and named actor; a controllable clock where the transition depends on time.
- Source
- services-platform:modules/tenants/tests/integration/services/persistence/tenants.integration.spec.js#lets a sandbox tenant go live, the data-import check being recorded as debt,services-platform at ad3f6a65: modules/tenants/db/tenants.table.ts; aws/api/tenants.routes.ts, tenant-api-mapper.ts; services/access/tenant-availability.ts.
16 Workspace business status: live to disabledtransitionapiproposed
- Proves
BR-CAP-PFM-SEC-002-02 - Preconditions
- Prepare a run-owned workspace business status in live state with the authority and inputs required by the cited transition.
- Steps
- [
{
"do": "Disable the live workspace using the dedicated staff edit.",
"expect": "After the stated action, observe the workspace business status in disabled state. This case does not require an additional history event unless the transition explicitly defines one.",
"provenance": "proposed",
"source": [
"services-platform:modules/tenants/aws/api/tenants.routes.ts:patchHqTenant (requireStatusAuthority)",
"services-platform at ad3f6a65: modules/tenants/db/tenants.table.ts; aws/api/tenants.routes.ts, tenant-api-mapper.ts; services/access/tenant-availability.ts."
]
}
]
- Expected
- After the stated action, observe the workspace business status in disabled state. This case does not require an additional history event unless the transition explicitly defines one.
- Data
- A disposable customer, workspace and named actor; a controllable clock where the transition depends on time.
- Source
- services-platform:modules/tenants/aws/api/tenants.routes.ts:patchHqTenant (requireStatusAuthority),services-platform at ad3f6a65: modules/tenants/db/tenants.table.ts; aws/api/tenants.routes.ts, tenant-api-mapper.ts; services/access/tenant-availability.ts.
17 Workspace business status: implementation to disabledtransitionapiproposed
- Proves
BR-CAP-PFM-SEC-002-02 - Preconditions
- Prepare a run-owned workspace business status in implementation state with the authority and inputs required by the cited transition.
- Steps
- [
{
"do": "Disable the implementation workspace while no load is open.",
"expect": "After the stated action, observe the workspace business status in disabled state. This case does not require an additional history event unless the transition explicitly defines one.",
"provenance": "proposed",
"source": [
"services-platform:modules/tenants/aws/api/tenants.routes.ts:patchHqTenant (requireStatusAuthority)",
"services-platform at ad3f6a65: modules/tenants/db/tenants.table.ts; aws/api/tenants.routes.ts, tenant-api-mapper.ts; services/access/tenant-availability.ts."
]
}
]
- Expected
- After the stated action, observe the workspace business status in disabled state. This case does not require an additional history event unless the transition explicitly defines one.
- Data
- A disposable customer, workspace and named actor; a controllable clock where the transition depends on time.
- Source
- services-platform:modules/tenants/aws/api/tenants.routes.ts:patchHqTenant (requireStatusAuthority),services-platform at ad3f6a65: modules/tenants/db/tenants.table.ts; aws/api/tenants.routes.ts, tenant-api-mapper.ts; services/access/tenant-availability.ts.
18 Workspace business status: disabled to livetransitionapiproposed
- Proves
BR-CAP-PFM-SEC-002-02 - Preconditions
- Prepare a run-owned workspace business status in disabled state with the authority and inputs required by the cited transition.
- Steps
- [
{
"do": "Save live status on the disabled workspace when no retirement is open.",
"expect": "After the stated action, observe the workspace business status in live state. This case does not require an additional history event unless the transition explicitly defines one.",
"provenance": "proposed",
"source": [
"services-platform:modules/tenants/db/tenants.table.ts:tenants (tenants_deletion_pending_status_check)",
"services-platform at ad3f6a65: modules/tenants/db/tenants.table.ts; aws/api/tenants.routes.ts, tenant-api-mapper.ts; services/access/tenant-availability.ts."
]
}
]
- Expected
- After the stated action, observe the workspace business status in live state. This case does not require an additional history event unless the transition explicitly defines one.
- Data
- A disposable customer, workspace and named actor; a controllable clock where the transition depends on time.
- Source
- services-platform:modules/tenants/db/tenants.table.ts:tenants (tenants_deletion_pending_status_check),services-platform at ad3f6a65: modules/tenants/db/tenants.table.ts; aws/api/tenants.routes.ts, tenant-api-mapper.ts; services/access/tenant-availability.ts.
19 Workspace business status: disabled to implementationtransitionapiproposed
- Proves
BR-CAP-PFM-SEC-002-02 - Preconditions
- Prepare a run-owned workspace business status in disabled state with the authority and inputs required by the cited transition.
- Steps
- [
{
"do": "Save implementation status on the disabled workspace when no retirement is open.",
"expect": "After the stated action, observe the workspace business status in implementation state. This case does not require an additional history event unless the transition explicitly defines one.",
"provenance": "proposed",
"source": [
"services-platform:modules/tenants/db/tenants.table.ts:tenants (tenants_deletion_pending_status_check)",
"services-platform at ad3f6a65: modules/tenants/db/tenants.table.ts; aws/api/tenants.routes.ts, tenant-api-mapper.ts; services/access/tenant-availability.ts."
]
}
]
- Expected
- After the stated action, observe the workspace business status in implementation state. This case does not require an additional history event unless the transition explicitly defines one.
- Data
- A disposable customer, workspace and named actor; a controllable clock where the transition depends on time.
- Source
- services-platform:modules/tenants/db/tenants.table.ts:tenants (tenants_deletion_pending_status_check),services-platform at ad3f6a65: modules/tenants/db/tenants.table.ts; aws/api/tenants.routes.ts, tenant-api-mapper.ts; services/access/tenant-availability.ts.
20 Workspace business status: live to implementationtransitionapiproposed
- Proves
BR-CAP-PFM-SEC-002-02 - Preconditions
- Prepare a run-owned workspace business status in live state with the authority and inputs required by the cited transition.
- Steps
- [
{
"do": "Save implementation status on the live workspace as authorized staff.",
"expect": "After the stated action, observe the workspace business status in implementation state. This case does not require an additional history event unless the transition explicitly defines one.",
"provenance": "proposed",
"source": [
"services-platform:modules/tenants/db/tenants.table.ts:TENANT_STATUSES",
"services-platform at ad3f6a65: modules/tenants/db/tenants.table.ts; aws/api/tenants.routes.ts, tenant-api-mapper.ts; services/access/tenant-availability.ts."
]
}
]
- Expected
- After the stated action, observe the workspace business status in implementation state. This case does not require an additional history event unless the transition explicitly defines one.
- Data
- A disposable customer, workspace and named actor; a controllable clock where the transition depends on time.
- Source
- services-platform:modules/tenants/db/tenants.table.ts:TENANT_STATUSES,services-platform at ad3f6a65: modules/tenants/db/tenants.table.ts; aws/api/tenants.routes.ts, tenant-api-mapper.ts; services/access/tenant-availability.ts.
21 Maintain workspace information and operating status with establish and administer a customerinteractionapinegativeproposed
- Proves
BR-CAP-PFM-SEC-001-11 BR-CAP-PFM-SEC-002-01 - Preconditions
- A customer has one active workspace.
- Steps
- Try deleting the customer, then read the workspace and customer.
- Expected
- Deletion is refused and both records retain their identities.
- Data
- An isolated customer with two workspaces, ordinary and staff identities, and records owned by this run.
- Source
- services-platform:modules/customers/tests/e2e/customers.e2e.spec.js#refuses a customer that still has tenants as 409,services-platform:modules/tenants/tests/e2e/tenants.e2e.spec.js#lists no tenant of another customer, which is what the reach reduction means
22 Maintain workspace information and operating status with prepare a workspace for customer useinteractionapinegativeproposed
- Proves
BR-CAP-PFM-SEC-002-09 BR-CAP-PFM-SEC-003-13 - Preconditions
- An active implementation workspace has an ordinary caller and an import operator.
- Steps
- Open an initial load, try ordinary work, then activate with a separate authorized staff identity.
- Expected
- Ordinary work is refused during loading and resumes after activation; implementation status remains unchanged.
- Data
- An isolated customer with two workspaces, ordinary and staff identities, and records owned by this run.
- Source
- services-platform:modules/tenants/services/access/tenant-availability.ts:tenantAvailabilityOf,services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses a live tenant, an initial import going only into an implementation tenant
23 Maintain workspace information and operating status with manage a workspace retirement requestinteractionapinegativeproposed
- Proves
BR-CAP-PFM-SEC-002-03 BR-CAP-PFM-SEC-004-07 - Preconditions
- A disabled active workspace is eligible for retirement.
- Steps
- Request retirement, try enabling the workspace, cancel before destruction, and read both axes.
- Expected
- The enabling attempt fails; cancellation restores active lifecycle while business status remains disabled.
- Data
- An isolated customer with two workspaces, ordinary and staff identities, and records owned by this run.
- Source
- services-platform:modules/tenants/tests/integration/services/persistence/tenants.integration.spec.js#ignores a lifecycle state a write input carries, rather than letting a client set the system axis,services-platform:modules/tenants/tests/integration/services/deletion/deletion-holds.integration.spec.js#leaves the tenant disabled: calling off a deletion restores nobody access
24 Maintain workspace information and operating status with enforce access at request boundariesinteractionapinegativeproposed
- Proves
BR-CAP-PFM-SEC-002-09 BR-CAP-PFM-SEC-015-06 - Preconditions
- An ordinary caller has valid authority over an active workspace.
- Steps
- Disable the workspace and issue a new protected request after the availability cache expires.
- Expected
- The new request is refused even though the role assignment remains present.
- Data
- An isolated customer with two workspaces, ordinary and staff identities, and records owned by this run.
- Source
- services-platform:modules/tenants/services/access/tenant-availability.ts:tenantAvailabilityOf,services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#returns a Deny for the whole route when no grant could apply anywhere