ATS-PFM-SEC-015 Enforce access at request boundaries: Capability Test Specification
Markdown Design / Platform / Security, Customers and Workspaces / Access Definitions and Authorization / Capability Test Specification Coverage Rule gap: FND-PFM-SEC-072 Transition gap: FND-PFM-SEC-072 Validation covered Permission covered Edge covered Failure gap: FND-PFM-SEC-072 Boundary covered Concurrency gap: FND-PFM-SEC-072 Invariant covered Interaction covered Test Scenarios 15 scenarios proving CAP-PFM-SEC-015
02 Require an existing active identity validation unit negative test
Proves BR-CAP-PFM-SEC-015-02INV-DOM-PFM-SEC-003-02 INV-DOM-PFM-SEC-003-05 Preconditions Prepare an unknown identity, revoked identity and suspended user. Steps Attempt authorization and inspect writes. Expected Reject the requests without creating or updating identities. Data Use the records described in the setup. Bound to Source services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts #refuses an unknown identity with 401 and writes nothing: the authorizer never creates one 03 Separate portal, console and customer reach boundary unit negative test
Proves BR-CAP-PFM-SEC-015-03Preconditions Prepare portal and ordinary console callers. Steps Use portal credentials on console, system and another workspace’s routes; use console credentials across customers. Expected Reject every boundary crossing. Data Use the records described in the setup. Bound to Source services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts #refuses a portal token on a console route before any identity is read 04 Limit staff grants to HQ boundary api negative test
Proves BR-CAP-PFM-SEC-015-04Preconditions Load the declared operations and callers for customer Administrator and the three staff roles. Steps Exercise console and portal routes with staff authority, then HQ routes with each caller. Expected Staff grants do not open console or portal routes. HQ admits authorized staff, rejects customer authority as non-staff, and enforces each staff role’s keys. Data Use the records described in the setup. Bound to Source services-platform:modules/security/tests/e2e/staff-separation.e2e.spec.js #refuses the widest grant Rhythm holds, every one of them 06 Restrict authorization to grant reach permission unit negative test
Proves BR-CAP-PFM-SEC-015-06Preconditions Give a caller grants for selected workspaces. Steps Authorize reached and unreached paths and an operation no grant covers. Expected The grant slice lists only reachable workspaces; inaccessible paths and uncovered operations are denied. Data Use the records described in the setup. Bound to Source services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts #lists only the tenants a grant could reach, not every tenant of the customer 07 Sign bounded authority and fail closed invariant unit negative test
Proves BR-CAP-PFM-SEC-015-07Preconditions Prepare a valid request, an oversized slice and registry, grant-store and signing failures. Steps Authorize each case and inspect the signed context. Expected The context contains no address or raw token and expires at cache lifetime plus thirty seconds. Oversize and unavailable inputs prevent an Allow. Data Use the records described in the setup. Bound to Source services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts #the context expires at iat + the gateway TTL + 30 s and carries no IP address 08 Describe refusals without identity data edge unit negative test
Proves BR-CAP-PFM-SEC-015-08Preconditions Arrange missing-permission, workspace-boundary and system-access refusals. Steps Inspect their metadata. Expected Return the relevant cause and required keys without caller identity data. Data Use the records described in the setup. Bound to Source services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts #names the keys the route requires and the cause permission on a route Deny for a missing grant 09 Apply application access and licensing checks permission api negative test
Proves BR-CAP-PFM-SEC-015-09Preconditions Prepare an application-access denial and a withheld workspace licence. Steps Request the affected application and Platform in each case. Expected The application returns the appropriate access or licensing code; Platform still serves its route. Data Use the records described in the setup. Bound to Source services-platform:modules/security/tests/e2e/application-access-enforced.e2e.spec.js #evaluates the application access step in enforce, which is what every case below is about 11 Validate service-function route ownership permission unit negative test
Proves BR-CAP-PFM-SEC-015-13Preconditions Prepare service operations and function declarations. Steps Validate an unserved route, sensitive route behind an ordinary function and function naming an unknown route. Expected Reject each declaration and identify the offending route or permission. Data Use the records described in the setup. Bound to Source services-platform:modules/security/tests/unit/authorizer/service-function-rules.spec.ts #refuses a service route no service function lists, naming it 12 Enforce access at request boundaries with maintain workspace information and operating status interaction api negative proposed
Proves BR-CAP-PFM-SEC-002-09BR-CAP-PFM-SEC-015-06Preconditions An ordinary caller has valid authority over an active workspace. Steps Disable the workspace and issue a new protected request after the availability cache expires. Expected The new request is refused even though the role assignment remains present. Data An isolated customer with two workspaces, ordinary and staff identities, and records owned by this run. Source services-platform:modules/tenants/services/access/tenant-availability.ts:tenantAvailabilityOf,services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#returns a Deny for the whole route when no grant could apply anywhere 13 Enforce access at request boundaries with understand available workspace access interaction api negative proposed
Proves BR-CAP-PFM-SEC-007-03BR-CAP-PFM-SEC-015-07Preconditions A member has an allow and a matching deny. Steps Read effective access and issue the denied operation through fresh gateway evaluation. Expected The access explanation and gateway agree that the denied permission is absent. Data An isolated customer with two workspaces, ordinary and staff identities, and records owned by this run. Source services-platform:modules/security/tests/integration/services/security-context/get-security-context.integration.spec.js #takes the denied key out of the allowed keys, though another grant allows it,services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#refuses a grant slice over 6 KB rather than truncating it 14 Enforce access at request boundaries with assign roles within a controlled scope interaction api proposed
Proves BR-CAP-PFM-SEC-010-03BR-CAP-PFM-SEC-015-12Preconditions A member holds a record-type grant for one customer record type. Steps Request the permitted type and another type through the public operation. Expected The gateway permits applicable passage while the resource service hides the unrelated record type. Data An isolated customer with two workspaces, ordinary and staff identities, and records owned by this run. Source services-platform:modules/security/tests/integration/services/membership/resource-scopes.integration.spec.js #refuses an archived custom object, naming the object key, and writes nothing,services-platform:modules/security/tests/unit/authorizer/authorize.spec.ts#the gateway lets the holder through to an object the scope does not name, so the service answers it as not found 15 Enforce access at request boundaries with suspend and resume service principals interaction api negative proposed
Proves BR-CAP-PFM-SEC-015-13BR-CAP-PFM-SEC-018-04Preconditions An active registered service principal can call its declared operation. Steps Suspend it, wait for registry refresh, call again, resume it, and repeat after refresh. Expected The suspended caller is refused; the resumed eligible caller succeeds without deployment. Data An isolated customer with two workspaces, ordinary and staff identities, and records owned by this run. Source services-platform:modules/security/tests/unit/authorizer/service-function-rules.spec.ts #refuses a route whose catalog permission is sensitive behind a function that is not, naming the key,services-platform:modules/security/tests/integration/services/service-principals/registered-principals.integration.spec.js#is refused 403 ← Previous Capability Test Specification ATS-PFM-SEC-014 · Derive member access from appointments and eligibility: Capability Test Specification Next Capability Test Specification → ATS-PFM-SEC-016 · Administer Rhythm staff memberships: Capability Test Specification