Rhythm 2.0 Specifications

Appearance

ATS-PFM-SEC-007Understand available workspace access: Capability Test Specification

Markdown

ATS-PFM-SEC-007

Understand available workspace access: Capability Test Specification

Markdown
  • DocumentProposed

Planning

Proves capability
CAP-PFM-SEC-007

Design

Executed by
TST-PFM-SEC-006, TST-PFM-SEC-015, TST-PFM-SEC-020, TST-PFM-SEC-030, TST-PFM-SEC-046, TST-PFM-SEC-047, TST-PFM-SEC-065, TST-PFM-SEC-068, TST-PFM-SEC-182, TST-PFM-SEC-199, TST-PFM-SEC-230

KindAcceptance test setProduct areaPlatformModuleSecurity, Customers and WorkspacesRevision2

Read atservices-platform ad3f6a65react-console baf6dae3

Understand available workspace access: Capability Test Specification ​

Coverage ​

RuleProved by
BR-CAP-PFM-SEC-007-01ATS-PFM-SEC-007-01
BR-CAP-PFM-SEC-007-02ATS-PFM-SEC-007-02
BR-CAP-PFM-SEC-007-03ATS-PFM-SEC-007-03
BR-CAP-PFM-SEC-007-04ATS-PFM-SEC-007-04, ATS-PFM-SEC-007-16
BR-CAP-PFM-SEC-007-05ATS-PFM-SEC-007-05
BR-CAP-PFM-SEC-007-06ATS-PFM-SEC-007-06
BR-CAP-PFM-SEC-007-07ATS-PFM-SEC-007-07
BR-CAP-PFM-SEC-007-08ATS-PFM-SEC-007-08, ATS-PFM-SEC-007-14
BR-CAP-PFM-SEC-007-09ATS-PFM-SEC-007-09
BR-CAP-PFM-SEC-007-10ATS-PFM-SEC-007-10
BR-CAP-PFM-SEC-007-11ATS-PFM-SEC-007-11
BR-CAP-PFM-SEC-007-13ATS-PFM-SEC-007-13

The coverage map distinguishes a dedicated scenario from an unresolved category. Proposed scenarios define proof to build; bindings retain the exact assertion references and identify their executable suite.

  • Use and recover a console sign-in: Reload the browser, wait for context, and then repeat with a person whose assignments are ineffective.
  • Assign roles within a controlled scope: Withdraw the assignment, wait out the gateway cache, and reload access and the protected page.
  • Control staff access to customer workspaces: Read HQ and workspace contexts, revoke the entry, and read again after cached authority expires.

Coverage

  • Rule covered
  • Transition covered
  • Validation covered
  • Permission covered
  • Edge covered
  • Failure covered
  • Boundary covered
  • Concurrency gap: FND-PFM-SEC-064
  • Invariant gap: FND-PFM-SEC-064
  • Interaction covered

Test Scenarios

16 scenarios proving CAP-PFM-SEC-007; 13 bound to an existing test.

01 Check caller identity and no-store responsespermissionapinegativetest
Proves
BR-CAP-PFM-SEC-007-01
Preconditions
Prepare two users and a suspended membership.
Steps
Request context as each user and without authentication.
Expected
Each active caller receives their own identity; suspended and anonymous requests fail, and responses include no-store guidance.
Data
Use the records described in the setup.
Bound to
services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#answers the user the signed context names and no other, so one person can never read another’s document
services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#refuses a suspended user, whose slice carries no grant of reading themselves at all
services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#tells every cache not to keep a document about who the caller is
services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#refuses an anonymous caller, and says so with the header still on the refusal
Source
services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#answers the user the signed context names and no other, so one person can never read another’s document
02 Check no-access handling for ineffective grantsedgeapinegativetest
Proves
BR-CAP-PFM-SEC-007-02
Preconditions
Prepare users with no assignment, pending assignment and future-only assignment.
Steps
Request context, then add or activate an applicable grant.
Expected
Ineffective grants produce the no-access refusal and screen; a current grant permits context.
Data
Use the records described in the setup.
Bound to
services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#is refused 403 under the code the console reads as no access
react-console:e2e/dev/permissions.dev.spec.ts#shows a person with no role the No Access screen, and does not loop back to the login screen
Source
services-platform:modules/security/tests/integration/services/security-context/get-security-context.integration.spec.js#is refused their own document rather than answered an empty one
03 Check effective permission expansion and deniesruleapitest
Proves
BR-CAP-PFM-SEC-007-03
Preconditions
Prepare a Read Only member with a deny and another member with a custom role.
Steps
Read both contexts.
Expected
The first receives allowed read keys except the denied key; the second receives the custom role’s allowed key.
Data
Use the records described in the setup.
Bound to
services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#answers every key the database says Read Only allows, not only the key the signed slice was resolved for
Source
services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#answers every key the database says Read Only allows, not only the key the signed slice was resolved for
04 Check separation of HQ and workspace authorityboundaryapinegativetest
Proves
BR-CAP-PFM-SEC-007-04
Preconditions
Prepare a Rhythm Administrator with a platform-scope grant.
Steps
Read the staff member’s context.
Expected
HQ contains staff permissions, while that platform grant contributes no customer-console permission.
Data
Use the records described in the setup.
Bound to
services-platform:modules/security/tests/integration/services/security-context/get-security-context.integration.spec.js#expands the wildcard to every concrete key of the catalog in Rhythm HQ, the staff-only one included
services-platform:modules/security/tests/integration/services/security-context/get-security-context.integration.spec.js#allows the same person nothing on a console route, because a platform-scope grant counts on `system` alone
Source
services-platform:modules/security/tests/integration/services/security-context/get-security-context.integration.spec.js#expands the wildcard to every concrete key of the catalog in Rhythm HQ, the staff-only one included
05 Check unavailable workspace selectionboundaryapinegativetest
Proves
BR-CAP-PFM-SEC-007-05
Preconditions
Prepare a customer with a workspace still provisioning.
Steps
Read ordinary context and request the provisioning workspace strictly as its user and as staff without an applicable customer-access grant.
Expected
The workspace is not offered or selected as default; strict selection fails for the tested callers.
Data
Use the records described in the setup.
Bound to
services-platform:modules/security/tests/integration/services/security-context/get-security-context.integration.spec.js#refuses Rhythm staff it by path, because staff enter another customer’s tenant only through a grant
Source
services-platform:modules/security/tests/integration/services/security-context/get-security-context.integration.spec.js#offers the customer’s own person only the tenants they can work in
06 Check strict and preferred workspace parametersvalidationapinegativetest
Proves
BR-CAP-PFM-SEC-007-06
Preconditions
Prepare reachable, unreachable and missing identifiers.
Steps
Request each strictly, try an unreachable preference and combine strict and preferred parameters.
Expected
Results are 200, access-denied 403 and not-found 404; preference falls back and the conflicting parameters return 400.
Data
Use the records described in the setup.
Bound to
services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#evaluates the tenant the query names, when the caller reaches it
services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#refuses the same tenant named strictly by tenant_id, the console URL never falling back
services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#ignores a preferred tenant out of the caller's reach rather than refusing it
services-platform:modules/tenants/tests/e2e/tenants.e2e.spec.js#answers 404 tenant_not_found for ?tenant_id=nobody.org
Source
services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#evaluates the tenant the query names, when the caller reaches it
07 Check application access and licence gatespermissionapinegativetest
Proves
BR-CAP-PFM-SEC-007-07
Preconditions
Prepare missing licensing and an application-access deny.
Steps
Inspect context and call application routes.
Expected
Unavailable applications are absent and refused, while exempt Platform routes remain available subject to their own authorization.
Data
Use the records described in the setup.
Bound to
services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#answers the application that follows from those keys
services-platform:modules/security/tests/e2e/application-access-enforced.e2e.spec.js#is refused it once a deny names the access key, though the allow beside it is untouched
services-platform:modules/security/tests/e2e/application-access-enforced.e2e.spec.js#serves a Platform route in the withheld tenant, because Platform is exempt from the licence step
react-console:e2e/mock/application-access.mock.spec.ts#an application the organization does not have is absent from the sidebar
Source
services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#answers the application that follows from those keys
08 Check context loading and recovery before console workfailurebrowsernegativetest
Proves
BR-CAP-PFM-SEC-007-08
Preconditions
Arrange a context failure and an expired token.
Steps
Open the console and use retry after failure.
Expected
Application content waits for context; retry opens it, and token renewal can proceed without another user sign-in.
Data
Use the records described in the setup.
Bound to
react-console:e2e/controlled/security-context.controlled.spec.ts#will not open the console when the Platform cannot say what somebody may do, and opens it on the retry
react-console:e2e/controlled/security-context.controlled.spec.ts#refreshes and retries by itself when the access token has aged out
Source
react-console:e2e/controlled/security-context.controlled.spec.ts#will not open the console when the Platform cannot say what somebody may do, and opens it on the retry
09 Check actions and deep links against console permissionspermissionbrowsernegativetest
Proves
BR-CAP-PFM-SEC-007-09
Preconditions
Prepare administrator and read-only sessions.
Steps
Compare available actions and enter a page address that lacks the required permission.
Expected
The read-only session omits the unavailable action and the protected deep link displays access denial.
Data
Use the records described in the setup.
Bound to
react-console:e2e/dev/permissions.dev.spec.ts#offers the administrator an action it does not offer the read-only user
react-console:e2e/dev/permissions.dev.spec.ts#denies a page whose permission nobody holds, when its URL is typed
react-console:e2e/security/access.spec.ts#lets somebody into the console and still refuses them the Security screens
Source
react-console:e2e/dev/permissions.dev.spec.ts#offers the administrator an action it does not offer the read-only user
10 Check pending and revoked assignments in the access documenttransitionapitest
Proves
BR-CAP-PFM-SEC-007-10 INV-DOM-PFM-SEC-003-08
Preconditions
Prepare pending-only and revoked-grant members.
Steps
Read their access documents.
Expected
Pending assignments appear without permission; revoked assignments are absent.
Data
Use the records described in the setup.
Bound to
services-platform:modules/security/tests/e2e/access.e2e.spec.js#answers a caller whose only grant is pending with a document allowing nothing, rather than refusing them
services-platform:modules/security/tests/e2e/access.e2e.spec.js#leaves a member's revoked grant out of the document, and allows nothing on the strength of a slice alone
Source
services-platform:modules/security/tests/e2e/access.e2e.spec.js#answers a caller whose only grant is pending with a document allowing nothing, rather than refusing them
11 Check name-lookup limits and disclosureboundaryapinegativetest
Proves
BR-CAP-PFM-SEC-007-11
Preconditions
Prepare identities from two customers and Rhythm staff.
Steps
Request 101 and 100 identities, include another customer’s user and call as a portal member.
Expected
The excessive request returns 400, valid permitted identities return only the presentation fields, outside identities are omitted and the portal caller receives 403.
Data
Use the records described in the setup.
Bound to
services-platform:modules/security/tests/e2e/user-names.e2e.spec.js#leaves out another customer's user and an id that names nobody, rather than nulling or refusing them
services-platform:modules/security/tests/e2e/user-names.e2e.spec.js#carries the id, the display name and the avatar of each person, and nothing else about anybody
services-platform:modules/security/tests/e2e/user-names.e2e.spec.js#refuses a request naming more than the hundred people it takes, rather than answering the first of them
services-platform:modules/security/tests/e2e/user-names.e2e.spec.js#is refused by the access tier, because the route is console
Source
services-platform:modules/security/tests/e2e/user-names.e2e.spec.js#leaves out another customer's user and an id that names nobody, rather than nulling or refusing them
12 Check console access after a role changeinteractionbrowsertest
Proves
AS-JNY-PFM-SEC-002-03
Preconditions
Prepare a member holding a role.
Steps
Sign in, change the role and request fresh context.
Expected
Fresh context and its resulting console presentation reflect the changed grant; this does not establish immediate eviction of every cached request decision.
Data
Use the records described in the setup.
Bound to
react-console:e2e/security/access.spec.ts#a role change alters what somebody can actually do
Source
react-console:e2e/security/access.spec.ts#a role change alters what somebody can actually do
13 Check authentication bookkeeping during context readsedgeapitest
Proves
BR-CAP-PFM-SEC-007-13
Preconditions
Prepare an active member with effective access and a controlled execution clock.
Steps
Build context, repeat within a minute and after it; call bookkeeping as a job and with a failing database.
Expected
Authentication time is throttled while status and version stay fixed; the job does not stamp, and stamp failure is logged without propagating.
Data
Use an active member, fixed clock and database failure fixture.
Bound to
services-platform:modules/security/tests/integration/services/security-context/get-security-context.integration.spec.js#records the instant the document was built, and leaves the status and the version where they were
services-platform:modules/security/tests/integration/services/security-context/get-security-context.integration.spec.js#writes again once a minute has passed, so the column still says when the person was last here
services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#answers rather than raising when the stamp cannot be written, and says in the log which user it was about
services-platform:modules/security/tests/unit/services/access/security-context.spec.ts#writes nothing for an unattended job acting for the person, the report renderer’s boot call (the case above is its control)
Source
services-platform:modules/security/tests/integration/services/security-context/get-security-context.integration.spec.js#records the instant the document was built, and leaves the status and the version where they were
14 Understand available workspace access with use and recover a console sign-ininteractionapiproposed
Proves
BR-CAP-PFM-SEC-006-03 BR-CAP-PFM-SEC-007-08
Preconditions
A signed-in person has an in-force workspace assignment.
Steps
Reload the browser, wait for context, and then repeat with a person whose assignments are ineffective.
Expected
Restoration admits protected content only after context succeeds; the second person receives No Access.
Data
An isolated customer with two workspaces, ordinary and staff identities, and records owned by this run.
Source
react-console:lib/auth/__tests__/session.test.ts#keeps the access token in memory and the refresh token nowhere,react-console:e2e/controlled/security-context.controlled.spec.ts#will not open the console when the Platform cannot say what somebody may do, and opens it on the retry
15 Understand available workspace access with assign roles within a controlled scopeinteractionapinegativeproposed
Proves
BR-CAP-PFM-SEC-007-12 BR-CAP-PFM-SEC-010-07
Preconditions
A member holds a role granting access to one security area.
Steps
Withdraw the assignment, wait out the gateway cache, and reload access and the protected page.
Expected
Fresh context omits the permission and the protected page is refused.
Data
An isolated customer with two workspaces, ordinary and staff identities, and records owned by this run.
Source
react-console:e2e/controlled/tenant-unavailable.controlled.spec.ts#falls back to the default tenant, with a word of explanation, rather than refusing access,services-platform:modules/security/tests/integration/services/membership/manage-assignments.integration.spec.js#revokes the grant, keeps the row, and audits what was withdrawn
16 Understand available workspace access with control staff access to customer workspacesinteractionapinegativeproposed
Proves
BR-CAP-PFM-SEC-007-04 BR-CAP-PFM-SEC-017-06
Preconditions
A staff member has approved entry to one customer workspace.
Steps
Read HQ and workspace contexts, revoke the entry, and read again after cached authority expires.
Expected
HQ authority remains separate; the customer workspace is unavailable after revocation.
Data
An isolated customer with two workspaces, ordinary and staff identities, and records owned by this run.
Source
services-platform:modules/security/tests/integration/services/security-context/get-security-context.integration.spec.js#expands the wildcard to every concrete key of the catalog in Rhythm HQ, the staff-only one included,services-platform:modules/security/tests/integration/services/staff-access/approved-tenant-access.integration.spec.js#leaves that standing grant revoked when standing access is ensured again

The Markdown files under specs/ in rhythmsoftware/rhythm-v2-docs are the canonical source of truth. This reader is a generated, read-only projection of them.

Rhythm Software