Rhythm 2.0 Specifications

Appearance

ATS-PFM-SEC-011Review security changes and refused attempts: Capability Test Specification

Markdown

ATS-PFM-SEC-011

Review security changes and refused attempts: Capability Test Specification

Markdown
  • DocumentProposed

Planning

Proves capability
CAP-PFM-SEC-011

Design

Executed by
TST-PFM-SEC-051, TST-PFM-SEC-069, TST-PFM-SEC-083, TST-PFM-SEC-117, TST-PFM-SEC-121, TST-PFM-SEC-141, TST-PFM-SEC-142

KindAcceptance test setProduct areaPlatformModuleSecurity, Customers and WorkspacesRevision3ExaminercodexExamined on2026-10-23

Read atservices-platform ad3f6a65react-console baf6dae3

Review security changes and refused attempts: Capability Test Specification ​

Coverage ​

Required ruleScenario or finding
BR-CAP-PFM-SEC-011-01ATS-PFM-SEC-011-01
BR-CAP-PFM-SEC-011-02ATS-PFM-SEC-011-02, ATS-PFM-SEC-011-10
BR-CAP-PFM-SEC-011-03ATS-PFM-SEC-011-03, ATS-PFM-SEC-011-07
BR-CAP-PFM-SEC-011-04ATS-PFM-SEC-011-04, ATS-PFM-SEC-011-09
BR-CAP-PFM-SEC-011-05ATS-PFM-SEC-011-05
BR-CAP-PFM-SEC-011-07ATS-PFM-SEC-011-06, ATS-PFM-SEC-011-08

The category map records specified proof. A covered category can contain proposed scenarios; it does not mean the checks have run. The bindings identify individual executable contributions, while findings retain missing rules, permissions, transitions and assertions.

The interaction scenarios connect this capability to the related actions and workflow handoffs named in their proof references. Each case observes the outcome after the connected action changes records or available authority. A collection of separately bound checks does not establish an ordered feature journey.

Source revisions and assertion references are recorded in frontmatter. Steps and expected observations carry separate evidence annotations. Proposed checks remain distinct from executable test statements, and static review supplies no run result.

Coverage

  • Rule covered
  • Transition covered
  • Validation gap: FND-PFM-SEC-068
  • Permission covered
  • Edge gap: FND-PFM-SEC-068
  • Failure covered
  • Boundary covered
  • Concurrency gap: FND-PFM-SEC-068
  • Invariant covered
  • Interaction covered

Test Scenarios

10 scenarios proving CAP-PFM-SEC-011; 6 bound to an existing test.

01 The recorded security-event fieldsruleapitest
Proves
BR-CAP-PFM-SEC-011-01
Preconditions
Prepare an audited administration mutation.
Steps
Perform the mutation and read its event.
Expected
The event presents actor, customer/workspace context, affected keys, before/after information and request identity.
Data
Use the records described in the setup.
Bound to
services-platform:modules/security/tests/integration/services/persistence/audit-events.integration.spec.js#records the actor in their wall, the session, the keys, before and after, and the request
services-platform:modules/security/tests/integration/services/persistence/audit-events.integration.spec.js#takes the actor, the customer and the request from the execution context when the capability names none
services-platform:modules/security/tests/e2e/console-users.e2e.spec.js#answers the customer’s history, newest first, with the row the grant it made wrote
Source
services-platform:modules/security/tests/integration/services/persistence/audit-events.integration.spec.js#records the actor in their wall, the session, the keys, before and after, and the request
02 Refusal events survive rollbackfailureapinegativetest
Proves
BR-CAP-PFM-SEC-011-02 INV-DOM-PFM-SEC-003-20
Preconditions
Prepare lockout and delegation refusals.
Steps
Attempt both mutations and read the trail afterward.
Expected
Refused events carry machine reasons while the rejected mutations leave their target records unchanged.
Data
Use the records described in the setup.
Bound to
services-platform:modules/security/tests/integration/services/invitations/revoke-lockout.integration.spec.js#records the refused attempt with the guard’s reason, outside the transaction that was rolled back
services-platform:modules/security/tests/e2e/console-users.e2e.spec.js#records the refused attempt too, so an access review sees what was tried
services-platform:modules/security/tests/integration/services/persistence/audit-events.integration.spec.js#records a refusal with its reason, and the operator behind an impersonated session
Source
services-platform:modules/security/tests/integration/services/invitations/revoke-lockout.integration.spec.js#records the refused attempt with the guard’s reason, outside the transaction that was rolled back
03 Invitation secrets are absent from auditinvariantapinegativetest
Proves
BR-CAP-PFM-SEC-011-03 INV-DOM-PFM-SEC-003-20
Preconditions
Complete an invitation lifecycle using a password.
Steps
Search the captured security trail.
Expected
The raw token, its hash and the password do not appear.
Data
Use the records described in the setup.
Bound to
services-platform:modules/security/tests/integration/lifecycle/invitation/invitation-arc.integration.spec.js#carries neither the raw token nor its hash anywhere in what it recorded
Source
services-platform:modules/security/tests/integration/lifecycle/invitation/invitation-arc.integration.spec.js#carries neither the raw token nor its hash anywhere in what it recorded
04 History scope, filters and cursor continuationboundaryapitest
Proves
BR-CAP-PFM-SEC-011-04
Preconditions
Prepare events under two customers.
Steps
Read pages and filter by entity kind and identity.
Expected
Results are newest first, satisfy the filters, do not repeat page rows and omit the other customer’s history.
Data
Use the records described in the setup.
Bound to
Source
services-platform:modules/security/tests/integration/services/persistence/audit-events.queries.integration.spec.js#answers the customer's events newest first, the newest of them whole
05 History requires explanation permissionpermissionapinegativetest
Proves
BR-CAP-PFM-SEC-011-05
Preconditions
Prepare a caller with read authority but no access-explanation permission.
Steps
Request customer history.
Expected
The request returns 403.
Data
Use the records described in the setup.
Bound to
services-platform:modules/security/tests/e2e/console-users.e2e.spec.js#refuses the reader, who may not read the history either
Source
services-platform:modules/security/tests/e2e/console-users.e2e.spec.js#refuses the reader, who may not read the history either
06 Deletion success and refusal eventstransitionapinegativetest
Proves
BR-CAP-PFM-SEC-011-07
Preconditions
Prepare one deletable and one protected identity.
Steps
Attempt both deletions and inspect the trail.
Expected
Both tested outcomes appear, including the machine reason for refusal.
Data
Use the records described in the setup.
Bound to
services-platform:modules/security/tests/e2e/users.e2e.spec.js#writes the deletion to the security trail, naming who deleted whom
services-platform:modules/security/tests/integration/services/invitations/delete-user.integration.spec.js#records the refused attempt under the code the database’s refusal carried
Source
services-platform:modules/security/tests/e2e/users.e2e.spec.js#writes the deletion to the security trail, naming who deleted whom
07 Review security changes and refused attempts with offer and manage an invitationinteractionapiproposed
Proves
BR-CAP-PFM-SEC-008-04 BR-CAP-PFM-SEC-011-03
Preconditions
An administrator sends an invitation with a usable token.
Steps
Read the invitation history and security events after delivery, resend and withdrawal.
Expected
Events identify the administrative actions without exposing invitation tokens.
Data
An isolated customer with two workspaces, ordinary and staff identities, and records owned by this run.
Source
services-platform:modules/security/tests/unit/services/invitations/invite-user.spec.js#keeps the user and the invitation when the e-mail could not be sent, and says why so the administrator can resend,services-platform:modules/security/tests/integration/lifecycle/invitation/invitation-arc.integration.spec.js#carries neither the raw token nor its hash anywhere in what it recorded
08 Review security changes and refused attempts with maintain console membershipsinteractionapiproposed
Proves
BR-CAP-PFM-SEC-009-08 BR-CAP-PFM-SEC-011-07
Preconditions
A reachable member has a retained history and can be deleted.
Steps
Delete the member and read security history with explanation permission.
Expected
The successful deletion event remains attributable through the former-user identity.
Data
An isolated customer with two workspaces, ordinary and staff identities, and records owned by this run.
Source
services-platform:modules/security/tests/unit/services/invitations/user-deletion.spec.js#refuses a delete that would leave the customer with nobody who can administer its security,services-platform:modules/security/tests/e2e/users.e2e.spec.js#writes the deletion to the security trail, naming who deleted whom
09 Review security changes and refused attempts with assign roles within a controlled scopeinteractionapiproposed
Proves
BR-CAP-PFM-SEC-010-13 BR-CAP-PFM-SEC-011-04
Preconditions
A member has no custom role assignment and history is readable.
Steps
Grant, move and withdraw a role, then page through that member’s history.
Expected
Each event names the corresponding assignment and the relevant widening classification.
Data
An isolated customer with two workspaces, ordinary and staff identities, and records owned by this run.
Source
services-platform:modules/security/tests/integration/services/membership/grant-history.integration.spec.js#lists the grant, the move and the withdrawal, each naming the grant it was about,services-platform:modules/security/tests/integration/services/persistence/audit-events.queries.integration.spec.js#leaves out another customer's events, whoever wrote them
10 Review security changes and refused attempts with model customer responsibilities with roles and policiesinteractionapinegativeproposed
Proves
BR-CAP-PFM-SEC-011-02 BR-CAP-PFM-SEC-012-10
Preconditions
A role editor lacks authority for a requested widening change.
Steps
Attempt the edit and inspect the definition and refusal history.
Expected
The definition is unchanged and the classified refusal survives rollback.
Data
An isolated customer with two workspaces, ordinary and staff identities, and records owned by this run.
Source
services-platform:modules/security/services/audit/refused-attempts.ts:auditedAttempt,services-platform:modules/security/tests/integration/services/definitions/manage-roles.integration.spec.js#refuses an edit that would widen a role the editor holds themselves, whoever else holds it

The Markdown files under specs/ in rhythmsoftware/rhythm-v2-docs are the canonical source of truth. This reader is a generated, read-only projection of them.

Rhythm Software