ATS-PFM-SEC-014 Derive member access from appointments and eligibility: Capability Test Specification
Markdown Design / Platform / Security, Customers and Workspaces / Access Definitions and Authorization / Capability Test Specification Coverage Rule gap: FND-PFM-SEC-071 Transition covered Validation covered Permission covered Edge gap: FND-PFM-SEC-071 Failure gap: FND-PFM-SEC-071 Boundary covered Concurrency covered Invariant covered Interaction covered Test Scenarios 13 scenarios proving CAP-PFM-SEC-014
01 Check derived access uses the contact claim invariant api negative test
Proves BR-CAP-PFM-SEC-014-01INV-DOM-PFM-SEC-003-06 Preconditions Prepare a derived contact assignment and a linked portal member. Steps Evaluate the member, remove the link and evaluate a fresh member context. Expected The linked claim receives scoped access; the newly unlinked claim does not. The test does not establish immediate replacement of a cached contact claim. Data Use the records described in the setup. Bound to Source services-platform:modules/security/tests/e2e/derived-assignments.e2e.spec.js #is allowed by the authorizer inside its validity, for the tenant of the grant 05 Check expiry against an earlier signed context boundary api negative test
Proves BR-CAP-PFM-SEC-014-05Preconditions Prepare a derived assignment reaching its end time. Steps Call the dispatcher after expiry with a still-valid context signed before it. Expected Request-time evaluation refuses the expired assignment. Data Use the records described in the setup. Bound to Source services-platform:modules/security/tests/e2e/derived-assignments.e2e.spec.js #refuses the same still-unexpired context once valid_until has passed, because validity is read per request 06 Check eligibility role-binding restrictions rule api negative test
Proves BR-CAP-PFM-SEC-014-07Preconditions Prepare custom/built-in roles and bindings of different kinds. Steps Bind them, try four-minute, five-minute and thirty-one-day intervals and reuse a binding. Expected The valid custom binding succeeds; built-ins, wrong kinds, out-of-range intervals and duplicate bindings fail. Data Use the records described in the setup. Bound to Source services-platform:modules/security/tests/e2e/role-eligibility.e2e.spec.js #refuses a built-in role as a conflict, because no tenant’s rule may assign Rhythm’s role 07 Check eligibility outcomes preserve manual work interaction api negative test
Proves BR-CAP-PFM-SEC-014-08Preconditions Prepare eligible, ineligible and indeterminate contacts, a manual assignment and an organization. Steps Reconcile repeatedly under each outcome. Expected Derived grants are created, confirmed or revoked as appropriate; indeterminate and manual rows remain intact and organizations receive no derived grants. Data Use the records described in the setup. Bound to Source services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js #creates one active, tenant-scoped, contact-keyed row of the role through the function, keyed by binding and contact 11 Derive member access from appointments and eligibility with assign roles within a controlled scope interaction api negative proposed
Proves BR-CAP-PFM-SEC-010-08BR-CAP-PFM-SEC-014-04Preconditions One member has a manual grant and a linked contact has source-owned access. Steps Change the manual role scope, try editing the derived assignment, then synchronize its source. Expected Manual scope changes preserve the derived row; direct derived editing is refused and source synchronization alone changes it. Data An isolated customer with two workspaces, ordinary and staff identities, and records owned by this run. Source services-platform:modules/security/tests/integration/services/membership/set-role-scope.integration.spec.js #turns the customer grant into one active grant per tenant asked for, revoking the customer grant,services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#refuses an amendment 409 derived_assignment, naming where to change it 12 Derive member access from appointments and eligibility with register and authenticate portal members interaction api negative proposed
Proves BR-CAP-PFM-SEC-014-09BR-CAP-PFM-SEC-019-05Preconditions A confirmed portal member links to a contact with an eligibility-derived role. Steps Sign in by password, change eligibility, and sign in again; repeat with an evaluator failure. Expected Reconciliation updates derived access before tokens return; evaluator failure is logged without blocking valid sign-in. Data An isolated customer with two workspaces, ordinary and staff identities, and records owned by this run. Source services-platform:modules/security/tests/integration/services/derived-assignments/sign-in-reconcile.integration.spec.js #signs a member in even when the evaluator fails, which it was asked,services-platform:modules/security/tests/integration/services/provisioning/post-confirmation.integration.spec.js#grants the Portal Member role, active, at the tenant’s scope 13 Derive member access from appointments and eligibility with match portal memberships to crm contacts interaction api proposed
Proves BR-CAP-PFM-SEC-014-01BR-CAP-PFM-SEC-020-08Preconditions An unlinked portal member has a contact carrying derived authority. Steps Complete contact possession proof and request a fresh authorization context. Expected The linked contact claim enables its applicable derived assignments; a console context carries no contact claim. Data An isolated customer with two workspaces, ordinary and staff identities, and records owned by this run. Source services-platform:modules/security/tests/e2e/derived-assignments.e2e.spec.js #is refused once the member is no longer linked to the contact, so the link is what carries the grant,services-platform:docs/security/portal-contact-claim.md#When a change is seen ← Previous Capability Test Specification ATS-PFM-SEC-013 · Publish shared access definitions from releases: Capability Test Specification Next Capability Test Specification → ATS-PFM-SEC-015 · Enforce access at request boundaries: Capability Test Specification