Rhythm 2.0 Specifications

Appearance

ATS-PFM-SEC-019Register and authenticate portal members: Capability Test Specification

Markdown

ATS-PFM-SEC-019

Register and authenticate portal members: Capability Test Specification

Markdown
  • DocumentProposed

Planning

Proves capability
CAP-PFM-SEC-019

Design

Executed by
TST-PFM-SEC-046, TST-PFM-SEC-060, TST-PFM-SEC-069, TST-PFM-SEC-132, TST-PFM-SEC-178, TST-PFM-SEC-218

KindAcceptance test setProduct areaPlatformModuleSecurity, Customers and WorkspacesRevision2

Read atservices-platform ad3f6a65

Coverage

  • Rule gap: FND-PFM-SEC-076
  • Transition gap: FND-PFM-SEC-076
  • Validation covered
  • Permission covered
  • Edge covered
  • Failure covered
  • Boundary covered
  • Concurrency covered
  • Invariant gap: FND-PFM-SEC-076
  • Interaction covered

Test Scenarios

13 scenarios proving CAP-PFM-SEC-019; 8 bound to an existing test.

01 Reconcile one portal build per workspaceconcurrencyapinegativetest
Proves
BR-CAP-PFM-SEC-019-01
Preconditions
Prepare workspaces with active pools, running builds, failed builds and no provisioning.
Steps
Call portal reconciliation twice for each setup.
Expected
Reuse the active pool, preserve a running build, retry a failed build and start only one new build.
Data
Use the records described in the setup.
Bound to
services-platform:modules/security/tests/integration/services/onboarding/ensure-tenant-portal.integration.spec.js#starts a new onboarding, whose reservation step clears what the failed one left
services-platform:modules/security/tests/integration/services/onboarding/ensure-tenant-portal.integration.spec.js#answers a second call with the onboarding already under way rather than a second job
Source
services-platform:modules/security/tests/integration/services/onboarding/ensure-tenant-portal.integration.spec.js#answers the pool as active
02 Limit information from pool discoveryboundaryapinegativetest
Proves
BR-CAP-PFM-SEC-019-03
Preconditions
Prepare an active portal, a workspace without one and an unknown workspace.
Steps
Invoke discovery without authentication.
Expected
Return pool, client, region and domain for the active portal; the handler gives identical refusals in the other cases.
Data
Use the records described in the setup.
Bound to
services-platform:modules/security/tests/e2e/access.e2e.spec.js#answers the pool, client, region and domain of a tenant with an active portal, to a caller with no context
services-platform:modules/security/tests/e2e/access.e2e.spec.js#refuses an unknown tenant and a tenant with no portal pool with the same sentence, saying nothing about either
Source
services-platform:modules/security/tests/e2e/access.e2e.spec.js#answers the pool, client, region and domain of a tenant with an active portal, to a caller with no context
03 Validate signup address and passwordvalidationunitnegativetest
Proves
BR-CAP-PFM-SEC-019-04
Preconditions
Prepare a member holding an email address and a new address.
Steps
Register the held address, a weak password and valid new credentials.
Expected
Reject the duplicate as 409 and the weak password as 400 password_policy; register an unconfirmed account and send its code for the valid input.
Data
Use the records described in the setup.
Bound to
services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#refuses an address a member of the tenant already holds as 409 email_address_taken, asking Cognito nothing
services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#refuses a password the pool policy refuses as 400 password_policy
services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#registers an unconfirmed account named by a new user id and says the code was e-mailed
Source
services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#refuses an address a member of the tenant already holds as 409 email_address_taken, asking Cognito nothing
04 Create membership only for signup confirmationtransitionapinegativetest
Proves
BR-CAP-PFM-SEC-019-05
Preconditions
Prepare a portal signup confirmation, console confirmation and recovery confirmation.
Steps
Deliver the portal event twice and the other events once.
Expected
Create one active verified portal member and assignment, with no membership created by the console or recovery events.
Data
Use the records described in the setup.
Bound to
Source
services-platform:modules/security/tests/integration/services/provisioning/post-confirmation.integration.spec.js#grants the Portal Member role, active, at the tenant’s scope
05 Constrain information in password refusalsfailureunitnegativetest
Proves
BR-CAP-PFM-SEC-019-06
Preconditions
Prepare unknown, wrong-password, unconfirmed, suspended and revoked accounts.
Steps
Attempt password sign-in for each case.
Expected
Match unknown-address and wrong-password responses; reveal unverified status only with the correct password. Reject disabled memberships and revoke tokens issued to a revoked member.
Data
Use the records described in the setup.
Bound to
services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#refuses an address nobody holds as 401 incorrect_credentials
services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#refuses a wrong password exactly as it refuses an address nobody holds
services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#refuses an unconfirmed account with a wrong password as incorrect_credentials, never email_unverified
services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#revokes the tokens Cognito issued to a revoked member before refusing them
Source
services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#refuses an address nobody holds as 401 incorrect_credentials
06 Keep recovery and resend responses neutraledgeunitnegativetest
Proves
BR-CAP-PFM-SEC-019-07
Preconditions
Prepare known and unknown addresses.
Steps
Start recovery, resend verification and confirm recovery with an incorrect code.
Expected
Return equivalent initiation and resend answers; treat an unknown address and incorrect recovery code alike.
Data
Use the records described in the setup.
Bound to
services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#answers an address nobody holds exactly as it answers a member, having asked Cognito for both
services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#refuses an address nobody holds exactly as it refuses a wrong code
services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#answers an address nobody holds exactly as one an unconfirmed account holds, sending only to that account
Source
services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#answers an address nobody holds exactly as it answers a member, having asked Cognito for both
07 Use the caller’s token for sign-outpermissionunitnegativetest
Proves
BR-CAP-PFM-SEC-019-08
Preconditions
Prepare an authenticated portal member and another member’s token.
Steps
Request sign-out with each token.
Expected
Revoke all caller sessions with the matching token; perform no revocation with the other member’s token.
Data
Use the records described in the setup.
Bound to
services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#ends every session of the caller with their own access token
services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#refuses an access token issued to somebody other than the caller, ending no session
Source
services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#ends every session of the caller with their own access token
08 Keep member administration inside the workspaceboundaryapinegativetest
Proves
BR-CAP-PFM-SEC-019-09
Preconditions
Prepare an administrator and two portal members.
Steps
Invite and list members, then read self and another member through portal authority.
Expected
Include workspace portal members and exclude console memberships; allow only the caller’s own record read.
Data
Use the records described in the setup.
Bound to
services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#invites a member of the tenant's portal and lists the tenant's members, the console users left out
services-platform:modules/security/tests/e2e/users.e2e.spec.js#reads a user in scope, answers 404 for another customer's user (row-level security hides it) and an unknown one, and a portal user reads only itself
Source
services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#invites a member of the tenant's portal and lists the tenant's members, the console users left out
09 Portal sign-in pool: provisioning to activetransitionapiproposed
Proves
BR-CAP-PFM-SEC-019-01
Preconditions
Use an isolated portal sign-in pool in provisioning state, with the required authority and guard fixtures.
Steps
[ { "do": "Finish the onboarding stack, read its outputs and register the matching pool reservation.", "expect": "Read the resulting portal sign-in pool as active; inspect the associated records and recorded history for this transition.", "provenance": "proposed", "source": [ "services-platform:modules/security/services/persistence/identity-pools.ts:completePortalPoolReservation", "services-platform at ad3f6a65: modules/security/db/identity-pools.table.ts; services/persistence/identity-pools.ts; services/onboarding/*; authorizer/authorize.ts (step 2)." ] } ]
Expected
Read the resulting portal sign-in pool as active; inspect the associated records and recorded history for this transition.
Data
A disposable customer, workspace and named actor; a controllable clock where the transition depends on time.
Source
services-platform:modules/security/services/persistence/identity-pools.ts:completePortalPoolReservation,services-platform at ad3f6a65: modules/security/db/identity-pools.table.ts; services/persistence/identity-pools.ts; services/onboarding/*; authorizer/authorize.ts (step 2).
10 Portal sign-in pool: provisioning to provisioningtransitionapiproposed
Proves
BR-CAP-PFM-SEC-019-01
Preconditions
Use an isolated portal sign-in pool in provisioning state, with the required authority and guard fixtures.
Steps
[ { "do": "Recover a failed reservation with no members and create replacement onboarding work.", "expect": "Read the resulting portal sign-in pool as provisioning; inspect the associated records and recorded history for this transition.", "provenance": "proposed", "source": [ "services-platform:modules/security/services/onboarding/failed-portal-stack.ts", "services-platform at ad3f6a65: modules/security/db/identity-pools.table.ts; services/persistence/identity-pools.ts; services/onboarding/*; authorizer/authorize.ts (step 2)." ] } ]
Expected
Read the resulting portal sign-in pool as provisioning; inspect the associated records and recorded history for this transition.
Data
A disposable customer, workspace and named actor; a controllable clock where the transition depends on time.
Source
services-platform:modules/security/services/onboarding/failed-portal-stack.ts,services-platform at ad3f6a65: modules/security/db/identity-pools.table.ts; services/persistence/identity-pools.ts; services/onboarding/*; authorizer/authorize.ts (step 2).
11 Register and authenticate portal members with match portal memberships to crm contactsinteractionapiproposed
Proves
BR-CAP-PFM-SEC-019-05 BR-CAP-PFM-SEC-020-06
Preconditions
A portal signup is confirmed and candidate contact proof is available.
Steps
Confirm twice, finish contact verification, and read the linked membership.
Expected
One active workspace membership and one contact link remain, without creating a console membership.
Data
An isolated customer with two workspaces, ordinary and staff identities, and records owned by this run.
Source
services-platform:modules/security/tests/integration/services/provisioning/post-confirmation.integration.spec.js#grants the Portal Member role, active, at the tenant’s scope,services-platform:modules/security/tests/integration/services/portal/contact-match.integration.spec.js#links the member to the contact on the right code
12 Register and authenticate portal members with derive member access from appointments and eligibilityinteractionapinegativeproposed
Proves
BR-CAP-PFM-SEC-014-09 BR-CAP-PFM-SEC-019-05
Preconditions
A confirmed portal member links to a contact with an eligibility-derived role.
Steps
Sign in by password, change eligibility, and sign in again; repeat with an evaluator failure.
Expected
Reconciliation updates derived access before tokens return; evaluator failure is logged without blocking valid sign-in.
Data
An isolated customer with two workspaces, ordinary and staff identities, and records owned by this run.
Source
services-platform:modules/security/tests/integration/services/derived-assignments/sign-in-reconcile.integration.spec.js#signs a member in even when the evaluator fails, which it was asked,services-platform:modules/security/tests/integration/services/provisioning/post-confirmation.integration.spec.js#grants the Portal Member role, active, at the tenant’s scope
13 Register and authenticate portal members with maintain workspace information and operating statusinteractionapinegativeproposed
Proves
BR-CAP-PFM-SEC-002-09 BR-CAP-PFM-SEC-019-10
Preconditions
A workspace has an active portal pool and a member with correct credentials.
Steps
Disable the workspace and try portal discovery and password sign-in after the availability cache expires.
Expected
The workspace gate refuses the requests before the identity handler admits the member.
Data
An isolated customer with two workspaces, ordinary and staff identities, and records owned by this run.
Source
services-platform:modules/tenants/services/access/tenant-availability.ts:tenantAvailabilityOf,services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#refuses a tenant whose portal pool is suspended exactly as an unknown tenant

The Markdown files under specs/ in rhythmsoftware/rhythm-v2-docs are the canonical source of truth. This reader is a generated, read-only projection of them.

Rhythm Software