Rhythm 2.0 Specifications

Appearance

ATS-PFM-SEC-016Administer Rhythm staff memberships: Capability Test Specification

Markdown

ATS-PFM-SEC-016

Administer Rhythm staff memberships: Capability Test Specification

Markdown
  • DocumentProposed

Planning

Proves capability
CAP-PFM-SEC-016

Design

Executed by
TST-PFM-SEC-023, TST-PFM-SEC-056, TST-PFM-SEC-058, TST-PFM-SEC-094, TST-PFM-SEC-117, TST-PFM-SEC-119, TST-PFM-SEC-176

KindAcceptance test setProduct areaPlatformModuleSecurity, Customers and WorkspacesRevision2

Read atservices-platform ad3f6a65react-console baf6dae3

Administer Rhythm staff memberships: Capability Test Specification ​

Coverage ​

RuleProved by
BR-CAP-PFM-SEC-016-01ATS-PFM-SEC-016-01
BR-CAP-PFM-SEC-016-03ATS-PFM-SEC-016-02
BR-CAP-PFM-SEC-016-04ATS-PFM-SEC-016-03
BR-CAP-PFM-SEC-016-05ATS-PFM-SEC-016-04, ATS-PFM-SEC-016-09
BR-CAP-PFM-SEC-016-06ATS-PFM-SEC-016-05, ATS-PFM-SEC-016-08
BR-CAP-PFM-SEC-016-07ATS-PFM-SEC-016-06
BR-CAP-PFM-SEC-016-08ATS-PFM-SEC-016-07, ATS-PFM-SEC-016-10

The coverage map distinguishes a dedicated scenario from an unresolved category. Proposed scenarios define proof to build; bindings retain the exact assertion references and identify their executable suite.

  • Maintain console memberships: Attempt a removal that would strand each administration boundary.
  • Control staff access to customer workspaces: Suspend the staff membership and inspect customer entry and its standing assignments; reinstate through authorized staff administration.
  • Publish shared access definitions from releases: Reconcile the release and founding staff twice, then read HQ role permissions and memberships.

Coverage

  • Rule covered
  • Transition covered
  • Validation gap: FND-PFM-SEC-073
  • Permission covered
  • Edge gap: FND-PFM-SEC-073
  • Failure gap: FND-PFM-SEC-073
  • Boundary gap: FND-PFM-SEC-073
  • Concurrency gap: FND-PFM-SEC-073
  • Invariant covered
  • Interaction covered

Test Scenarios

10 scenarios proving CAP-PFM-SEC-016; 6 bound to an existing test.

01 Require both staff status and operation permissionpermissionapinegativetest
Proves
BR-CAP-PFM-SEC-016-01
Preconditions
Prepare a customer administrator and staff callers with and without the relevant keys.
Steps
Request staff listing, role listing and staff invitation resend.
Expected
Reject customer authority as non-staff and staff callers missing a key; serve authorized staff.
Data
Use the records described in the setup.
Bound to
services-platform:modules/security/tests/e2e/hq-staff-and-roles.e2e.spec.js#refuses an administrator of a customer, holding every key at that customer, as 403
services-platform:modules/security/tests/e2e/hq-staff-and-roles.e2e.spec.js#refuses a staff member who holds another HQ key but not hq.staff.read as 403
services-platform:modules/security/tests/e2e/hq-staff-resend.e2e.spec.js#is refused 403 and told they are not staff, rather than that a permission is missing
services-platform:modules/security/tests/e2e/hq-staff-resend.e2e.spec.js#is refused 403, for want of the one key the route names
Source
services-platform:modules/security/tests/e2e/hq-staff-and-roles.e2e.spec.js#refuses an administrator of a customer, holding every key at that customer, as 403
02 Restrict the staff invitation rolepermissionapinegativeproposed
Proves
BR-CAP-PFM-SEC-016-03
Preconditions
Prepare a customer role and a caller lacking authority to assign Rhythm Administrator.
Steps
Attempt those invitations, then invite a Support Representative with sufficient authority.
Expected
Reject invalid or unauthorized roles; allow the authorized staff invitation.
Data
Use the records described in the setup.
Source
services-platform:modules/security/services/invitations/invite-staff.ts#assertStaffRole
03 Resend only outstanding staff invitationstransitionapinegativetest
Proves
BR-CAP-PFM-SEC-016-04
Preconditions
Prepare invited and accepted staff members and an invited customer member.
Steps
Request HQ resend for all three.
Expected
Replace the invited staff link; direct the accepted member toward password recovery; return not found for the customer member without delivery.
Data
Use the records described in the setup.
Bound to
services-platform:modules/security/tests/e2e/hq-staff-resend.e2e.spec.js#is answered a new invitation, superseding the one that was outstanding
services-platform:modules/security/tests/integration/services/invitations/resend-staff-invitation.integration.spec.js#is refused, and told to reset the password instead of inviting the person again
services-platform:modules/security/tests/e2e/hq-staff-resend.e2e.spec.js#is not found, so the route reports nothing about who exists
services-platform:modules/security/tests/e2e/hq-staff-resend.e2e.spec.js#is sent nothing, where the staff member was sent a second link
Source
services-platform:modules/security/tests/e2e/hq-staff-resend.e2e.spec.js#is answered a new invitation, superseding the one that was outstanding
04 Show staff lifecycle actions in the consoleinteractionbrowsernegativetest
Proves
BR-CAP-PFM-SEC-016-05
Preconditions
Load the mocked staff page.
Steps
Suspend, reinstate and revoke through its controls.
Expected
Show the mocked status changes and require a revocation confirmation naming the member. This binding does not establish backend propagation.
Data
Use the records described in the setup.
Bound to
react-console:e2e/mock/hq-ops.mock.spec.ts#resends an invitation, suspends and reinstates, and names the last administrator
react-console:e2e/mock/hq-ops.mock.spec.ts#revokes access behind a confirmation that names the person
Source
react-console:e2e/mock/hq-ops.mock.spec.ts#resends an invitation, suspends and reinstates, and names the last administrator
05 Prevent deletion of the sole administratorinvariantapinegativetest
Proves
BR-CAP-PFM-SEC-016-06 INV-DOM-PFM-SEC-003-12
Preconditions
Begin with one active Rhythm Administrator, then add another.
Steps
Attempt deletion before and after the second administrator exists.
Expected
Initially refuse and preserve the grant; subsequently allow deletion while retaining one administrator.
Data
Use the records described in the setup.
Bound to
services-platform:modules/security/tests/integration/services/invitations/delete-user.integration.spec.js#leaves their Rhythm Administrator grant standing, so somebody can still hand the role out
Source
services-platform:modules/security/tests/integration/services/invitations/delete-user.integration.spec.js#refuses the delete as the staff guard does, naming its machine code
06 Read staff-role permissions from the catalogruleapitest
Proves
BR-CAP-PFM-SEC-016-07
Preconditions
Load the shared catalog and HQ role listing.
Steps
Read each staff role and attempt emergency access with Support and Engineer.
Expected
The HQ listing returns reconciled staff roles with their stored permission keys. The partial integration fixture proves policy expansion and omission of an unreconciled role, rather than the full released key set. Backend emergency tests deny Support and Engineer.
Data
Use the records described in the setup.
Bound to
services-platform:modules/security/tests/e2e/hq-staff-and-roles.e2e.spec.js#answers the HQ roles the catalog holds, each with a name, a description and its permission keys
services-platform:modules/security/tests/e2e/hq-staff-and-roles.e2e.spec.js#answers every HQ role it names as one of the staff roles, and nothing else
services-platform:modules/security/tests/integration/services/catalog/hq-roles.integration.spec.js#answers the keys of a role's attached policy, which is where Rhythm Support's come from
Source
services-platform:modules/security/tests/e2e/hq-staff-and-roles.e2e.spec.js#answers the HQ roles the catalog holds, each with a name, a description and its permission keys
07 Reconcile founders without duplicate activationtransitionapitest
Proves
BR-CAP-PFM-SEC-016-08
Preconditions
Prepare an empty environment and an already invited founder.
Steps
Run founding-staff reconciliation twice in each setup.
Expected
Create or activate the membership once, supersede an existing invitation, retain one platform assignment and avoid duplicate activation audit events.
Data
Use the records described in the setup.
Bound to
services-platform:modules/security/tests/integration/services/provisioning/ensure-founding-staff.integration.spec.js#leaves exactly one assignment: Rhythm Administrator at platform scope, active
Source
services-platform:modules/security/tests/integration/services/provisioning/ensure-founding-staff.integration.spec.js#answers the first run as created
08 Administer Rhythm staff memberships with maintain console membershipsinteractionapinegativeproposed
Proves
BR-CAP-PFM-SEC-009-07 BR-CAP-PFM-SEC-016-06
Preconditions
A customer administrator and a sole Rhythm Administrator each have active memberships.
Steps
Attempt a removal that would strand each administration boundary.
Expected
Each removal is refused within its own boundary without treating one administrator as the other boundary’s replacement.
Data
An isolated customer with two workspaces, ordinary and staff identities, and records owned by this run.
Source
services-platform:modules/security/services/membership/lockout.ts:assertNotLockedOut,services-platform:modules/security/tests/integration/services/invitations/delete-user.integration.spec.js#refuses the delete as the staff guard does, naming its machine code
09 Administer Rhythm staff memberships with control staff access to customer workspacesinteractionapiproposed
Proves
BR-CAP-PFM-SEC-016-05 BR-CAP-PFM-SEC-017-08
Preconditions
A Rhythm Administrator has standing access to a customer.
Steps
Suspend the staff membership and inspect customer entry and its standing assignments; reinstate through authorized staff administration.
Expected
Suspension ends usable customer entry; fresh access follows the retained or reconciled assignment state rather than staff status alone.
Data
An isolated customer with two workspaces, ordinary and staff identities, and records owned by this run.
Source
services-platform:modules/security/aws/api/hq-staff.routes.ts:hqStaffRoutes,services-platform:modules/security/tests/integration/services/staff-access/rhythm-administrator-standing-access.integration.spec.js#gives each Rhythm Administrator one active customer-level standing grant in every customer but Rhythm’s own
10 Administer Rhythm staff memberships with publish shared access definitions from releasesinteractionapiproposed
Proves
BR-CAP-PFM-SEC-013-07 BR-CAP-PFM-SEC-016-08
Preconditions
Founding staff are configured and the shared role catalog is present.
Steps
Reconcile the release and founding staff twice, then read HQ role permissions and memberships.
Expected
Founders and catalog roles retain identity without duplicate activation or customer-console powers from HQ grants.
Data
An isolated customer with two workspaces, ordinary and staff identities, and records owned by this run.
Source
services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#publishes the eight roles the catalog ships, in the order it ships them,services-platform:modules/security/tests/integration/services/provisioning/ensure-founding-staff.integration.spec.js#leaves exactly one assignment: Rhythm Administrator at platform scope, active

The Markdown files under specs/ in rhythmsoftware/rhythm-v2-docs are the canonical source of truth. This reader is a generated, read-only projection of them.

Rhythm Software