Test Scenarios
22 scenarios proving CAP-PFM-SEC-010; 13 bound to an existing test.
01 Role writes require management authoritypermissionapinegativetest
- Proves
BR-CAP-PFM-SEC-010-01 - Preconditions
- Prepare a reader and an access manager.
- Steps
- Attempt the same grant with both identities.
- Expected
- The reader receives 403 without a write; the authorized manager succeeds.
- Data
- Use the records described in the setup.
- Bound to
- Source
- services-platform:modules/security/tests/e2e/console-users.e2e.spec.js#refuses the reader’s attempt to grant as 403, and grants nothing
02 Delegation keys, scopes and self-wideningpermissionapinegativetest
- Proves
BR-CAP-PFM-SEC-010-02 INV-DOM-PFM-SEC-003-11 - Preconditions
- Prepare an administrator with limited workspace authority.
- Steps
- Grant within that authority, beyond its keys, at an unmanaged scope and to the administrator.
- Expected
- The permitted grant succeeds; failures identify missing authority or self-widening without creating grants.
- Data
- Use the records described in the setup.
- Bound to
- Source
- services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#refuses a role that grants more than the caller may do there, and names what was missing
08 Atomic role-scope reconciliationtransitionapinegativetest
- Proves
BR-CAP-PFM-SEC-010-08 - Preconditions
- Prepare a customer-wide Read Only assignment.
- Steps
- Select two workspaces, return to customer-wide scope and try an outside-customer workspace.
- Expected
- The expected two and then one scope rows remain; matching rows retain identity, revocation submits a flush request and the outside workspace fails.
- Data
- Use the records described in the setup.
- Bound to
- Source
- services-platform:modules/security/tests/integration/services/membership/set-role-scope.integration.spec.js#turns the customer grant into one active grant per tenant asked for, revoking the customer grant
09 Deny weakening uses widening checkspermissionapinegativetest
- Proves
BR-CAP-PFM-SEC-010-09 - Preconditions
- Prepare a deny-bearing grant and an editor lacking the denied key.
- Steps
- Narrow or shorten the grant and add conditions, then extend it and remove a restriction.
- Expected
- The tested weakening operations fail and are recorded; the tested strengthening operations succeed.
- Data
- Use the records described in the setup.
- Bound to
- Source
- services-platform:modules/security/tests/integration/services/membership/amend-grant.integration.spec.js#refuses a narrowing of the scope for an editor who is not allowed the key the grant was denying
13 Grant presentation and role membershipinteractionbrowsertest
- Proves
AS-JNY-PFM-SEC-003-02 AS-JNY-PFM-SEC-004-03 - Preconditions
- Prepare a security administrator and colleague.
- Steps
- Grant from the user page, inspect the role’s Members view and withdraw the grant.
- Expected
- Presentation names the grantor and lists the colleague while assigned; withdrawal removes that membership from the live view.
- Data
- Use the records described in the setup.
- Bound to
- Source
- react-console:e2e/security/users.spec.ts#gives a role, says who granted it, and takes it away again
14 Role assignment: scheduled to livetransitionapiproposed
- Proves
BR-CAP-PFM-SEC-010-05 - Preconditions
- Prepare a run-owned role assignment in scheduled state with the authority and inputs required by the cited transition.
- Steps
- [
{
"do": "Advance the clock to the assignment’s start and read effective permissions.",
"expect": "After the stated action, observe the role assignment in live state. This case does not require an additional history event unless the transition explicitly defines one.",
"provenance": "proposed",
"source": [
"services-platform:modules/security/db/security-assignments.table.ts (valid_from)",
"services-platform at ad3f6a65: modules/security/db/security-assignments.table.ts; services/persistence/assignments.ts; services/membership/manage-assignments.ts; services/invitations/widening.ts."
]
}
]
- Expected
- After the stated action, observe the role assignment in live state. This case does not require an additional history event unless the transition explicitly defines one.
- Data
- A disposable customer, workspace and named actor; a controllable clock where the transition depends on time.
- Source
- services-platform:modules/security/db/security-assignments.table.ts (valid_from),services-platform at ad3f6a65: modules/security/db/security-assignments.table.ts; services/persistence/assignments.ts; services/membership/manage-assignments.ts; services/invitations/widening.ts.
15 Role assignment: live to endedtransitionapiproposed
- Proves
BR-CAP-PFM-SEC-010-05 - Preconditions
- Prepare a run-owned role assignment in live state with the authority and inputs required by the cited transition.
- Steps
- [
{
"do": "Advance the clock to the assignment’s end and attempt the previously allowed operation.",
"expect": "After the stated action, observe the role assignment in ended state. This case does not require an additional history event unless the transition explicitly defines one.",
"provenance": "proposed",
"source": [
"services-platform:modules/security/db/security-assignments.table.ts (valid_until)",
"services-platform at ad3f6a65: modules/security/db/security-assignments.table.ts; services/persistence/assignments.ts; services/membership/manage-assignments.ts; services/invitations/widening.ts."
]
}
]
- Expected
- After the stated action, observe the role assignment in ended state. This case does not require an additional history event unless the transition explicitly defines one.
- Data
- A disposable customer, workspace and named actor; a controllable clock where the transition depends on time.
- Source
- services-platform:modules/security/db/security-assignments.table.ts (valid_until),services-platform at ad3f6a65: modules/security/db/security-assignments.table.ts; services/persistence/assignments.ts; services/membership/manage-assignments.ts; services/invitations/widening.ts.
16 Role assignment: live to revokedtransitionapiproposed
- Proves
BR-CAP-PFM-SEC-010-07 - Preconditions
- Prepare a run-owned role assignment in live state with the authority and inputs required by the cited transition.
- Steps
- [
{
"do": "Withdraw the active assignment and inspect its retained row and current access.",
"expect": "After the stated action, observe the role assignment in revoked state. This case does not require an additional history event unless the transition explicitly defines one.",
"provenance": "proposed",
"source": [
"services-platform:modules/security/services/persistence/assignments.ts:revokeAssignment",
"services-platform at ad3f6a65: modules/security/db/security-assignments.table.ts; services/persistence/assignments.ts; services/membership/manage-assignments.ts; services/invitations/widening.ts."
]
}
]
- Expected
- After the stated action, observe the role assignment in revoked state. This case does not require an additional history event unless the transition explicitly defines one.
- Data
- A disposable customer, workspace and named actor; a controllable clock where the transition depends on time.
- Source
- services-platform:modules/security/services/persistence/assignments.ts:revokeAssignment,services-platform at ad3f6a65: modules/security/db/security-assignments.table.ts; services/persistence/assignments.ts; services/membership/manage-assignments.ts; services/invitations/widening.ts.
17 Role assignment: scheduled to revokedtransitionapiproposed
- Proves
BR-CAP-PFM-SEC-010-07 - Preconditions
- Prepare a run-owned role assignment in scheduled state with the authority and inputs required by the cited transition.
- Steps
- [
{
"do": "Withdraw a future assignment before its start and inspect the retained row.",
"expect": "After the stated action, observe the role assignment in revoked state. This case does not require an additional history event unless the transition explicitly defines one.",
"provenance": "proposed",
"source": [
"services-platform:modules/security/services/persistence/assignments.ts:revokeAssignment",
"services-platform at ad3f6a65: modules/security/db/security-assignments.table.ts; services/persistence/assignments.ts; services/membership/manage-assignments.ts; services/invitations/widening.ts."
]
}
]
- Expected
- After the stated action, observe the role assignment in revoked state. This case does not require an additional history event unless the transition explicitly defines one.
- Data
- A disposable customer, workspace and named actor; a controllable clock where the transition depends on time.
- Source
- services-platform:modules/security/services/persistence/assignments.ts:revokeAssignment,services-platform at ad3f6a65: modules/security/db/security-assignments.table.ts; services/persistence/assignments.ts; services/membership/manage-assignments.ts; services/invitations/widening.ts.
18 Role assignment: live to livetransitionapiproposed
- Proves
BR-CAP-PFM-SEC-010-09 - Preconditions
- Prepare a run-owned role assignment in live state with the authority and inputs required by the cited transition.
- Steps
- [
{
"do": "Amend the assignment window within delegated authority and read its identity, version and history.",
"expect": "After the stated action, observe the role assignment in live state. This case does not require an additional history event unless the transition explicitly defines one.",
"provenance": "proposed",
"source": [
"services-platform:modules/security/services/persistence/assignments.ts:amendAssignment",
"services-platform at ad3f6a65: modules/security/db/security-assignments.table.ts; services/persistence/assignments.ts; services/membership/manage-assignments.ts; services/invitations/widening.ts."
]
}
]
- Expected
- After the stated action, observe the role assignment in live state. This case does not require an additional history event unless the transition explicitly defines one.
- Data
- A disposable customer, workspace and named actor; a controllable clock where the transition depends on time.
- Source
- services-platform:modules/security/services/persistence/assignments.ts:amendAssignment,services-platform at ad3f6a65: modules/security/db/security-assignments.table.ts; services/persistence/assignments.ts; services/membership/manage-assignments.ts; services/invitations/widening.ts.
19 Assign roles within a controlled scope with offer and manage an invitationinteractionapinegativeproposed
- Proves
BR-CAP-PFM-SEC-008-05 BR-CAP-PFM-SEC-010-02 - Preconditions
- An access manager can delegate one role but lacks another role’s powers.
- Steps
- Invite with the permitted role, then attempt another invitation carrying the unavailable role.
- Expected
- The first creates pending assignments; the second creates neither invitation nor assignment.
- Data
- An isolated customer with two workspaces, ordinary and staff identities, and records owned by this run.
- Source
- services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#refuses a role that grants more than the caller may do there, and names what was missing,services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#refuses a scope the caller does not manage, and says which scope rather than which role
20 Assign roles within a controlled scope with maintain console membershipsinteractionapiproposed
- Proves
BR-CAP-PFM-SEC-009-07 BR-CAP-PFM-SEC-010-07 - Preconditions
- Only one active qualifying customer administrator remains.
- Steps
- Try withdrawing the qualifying assignment and suspending its holder; read membership and assignments after each refusal.
- Expected
- Both operations leave the active administrator and qualifying assignment intact.
- Data
- An isolated customer with two workspaces, ordinary and staff identities, and records owned by this run.
- Source
- services-platform:modules/security/services/membership/lockout.ts:assertNotLockedOut,services-platform:modules/security/tests/integration/services/membership/manage-assignments.integration.spec.js#revokes the grant, keeps the row, and audits what was withdrawn
21 Assign roles within a controlled scope with model customer responsibilities with roles and policiesinteractionapinegativeproposed
- Proves
BR-CAP-PFM-SEC-010-07 BR-CAP-PFM-SEC-012-09 - Preconditions
- A custom role is assigned to an active member.
- Steps
- Try archiving the role, withdraw its assignment, and archive again.
- Expected
- The held role cannot be archived; after withdrawal it can leave the active list while history remains.
- Data
- An isolated customer with two workspaces, ordinary and staff identities, and records owned by this run.
- Source
- services-platform:modules/security/tests/integration/services/membership/manage-assignments.integration.spec.js#revokes the grant, keeps the row, and audits what was withdrawn,services-platform:modules/security/tests/integration/services/definitions/manage-roles.integration.spec.js#refuses to archive a role somebody still holds, names them, and leaves it active
22 Assign roles within a controlled scope with derive member access from appointments and eligibilityinteractionapinegativeproposed
- Proves
BR-CAP-PFM-SEC-010-08 BR-CAP-PFM-SEC-014-04 - Preconditions
- One member has a manual grant and a linked contact has source-owned access.
- Steps
- Change the manual role scope, try editing the derived assignment, then synchronize its source.
- Expected
- Manual scope changes preserve the derived row; direct derived editing is refused and source synchronization alone changes it.
- Data
- An isolated customer with two workspaces, ordinary and staff identities, and records owned by this run.
- Source
- services-platform:modules/security/tests/integration/services/membership/set-role-scope.integration.spec.js#turns the customer grant into one active grant per tenant asked for, revoking the customer grant,services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#refuses an amendment 409 derived_assignment, naming where to change it