The category map records specified proof. A covered category can contain proposed scenarios; it does not mean the checks have run. The bindings identify individual executable contributions, while findings retain missing rules, permissions, transitions and assertions.
The interaction scenarios connect this capability to the related actions and workflow handoffs named in their proof references. Each case observes the outcome after the connected action changes records or available authority. A collection of separately bound checks does not establish an ordered feature journey.
Source revisions and assertion references are recorded in frontmatter. Steps and expected observations carry separate evidence annotations. Proposed checks remain distinct from executable test statements, and static review supplies no run result.
Coverage
Rulecovered
Transitioncovered
Validationcovered
Permissiongap: FND-PFM-SEC-077
Edgegap: FND-PFM-SEC-077
Failuregap: FND-PFM-SEC-077
Boundarycovered
Concurrencygap: FND-PFM-SEC-077
Invariantcovered
Interactioncovered
Test Scenarios
13 scenarios proving CAP-PFM-SEC-020; 8 bound to an existing test.
01Link an exact address match or create a contactruleapitest
Evaluate the portal caller, change and clear its contact link and evaluate again without gateway cache reuse; also evaluate the console caller.
Expected
Fresh portal contexts carry the current link or omit a cleared link. Console contexts omit the contact claim. The binding does not establish gateway propagation timing.
Prepare a run-owned portal contact challenge in live state with the authority and inputs required by the cited transition.
Steps
[
{
"do": "Submit the code delivered for this member’s selected contact and read the link.",
"expect": "After the stated action, observe the portal contact challenge in verified state. This case does not require an additional history event unless the transition explicitly defines one.",
"provenance": "proposed",
"source": [
"services-platform:modules/security/services/portal/contact-match.ts:verifyContactChallenge",
"services-platform at ad3f6a65: modules/security/db/portal-contact-challenges.table.ts; services/portal/contact-match.ts, contact-match-rules.ts, verification-code-sender.ts."
]
}
]
Expected
After the stated action, observe the portal contact challenge in verified state. This case does not require an additional history event unless the transition explicitly defines one.
Data
A disposable customer, workspace and named actor; a controllable clock where the transition depends on time.
Source
services-platform:modules/security/services/portal/contact-match.ts:verifyContactChallenge,services-platform at ad3f6a65: modules/security/db/portal-contact-challenges.table.ts; services/portal/contact-match.ts, contact-match-rules.ts, verification-code-sender.ts.
10Portal contact challenge: live to exhaustedtransitionapiproposed
Prepare a run-owned portal contact challenge in live state with the authority and inputs required by the cited transition.
Steps
[
{
"do": "Submit five incorrect codes and try the correct code after the fifth failure.",
"expect": "After the stated action, observe the portal contact challenge in exhausted state. This case does not require an additional history event unless the transition explicitly defines one.",
"provenance": "proposed",
"source": [
"services-platform:modules/security/db/portal-contact-challenges.table.ts:PORTAL_CHALLENGE_MAX_ATTEMPTS",
"services-platform at ad3f6a65: modules/security/db/portal-contact-challenges.table.ts; services/portal/contact-match.ts, contact-match-rules.ts, verification-code-sender.ts."
]
}
]
Expected
After the stated action, observe the portal contact challenge in exhausted state. This case does not require an additional history event unless the transition explicitly defines one.
Data
A disposable customer, workspace and named actor; a controllable clock where the transition depends on time.
Source
services-platform:modules/security/db/portal-contact-challenges.table.ts:PORTAL_CHALLENGE_MAX_ATTEMPTS,services-platform at ad3f6a65: modules/security/db/portal-contact-challenges.table.ts; services/portal/contact-match.ts, contact-match-rules.ts, verification-code-sender.ts.
11Portal contact challenge: live to expiredtransitionapiproposed
Prepare a run-owned portal contact challenge in live state with the authority and inputs required by the cited transition.
Steps
[
{
"do": "Advance ten minutes from challenge creation and submit the previously correct code.",
"expect": "After the stated action, observe the portal contact challenge in expired state. This case does not require an additional history event unless the transition explicitly defines one.",
"provenance": "proposed",
"source": [
"services-platform:modules/security/db/portal-contact-challenges.table.ts:PORTAL_CHALLENGE_OUTCOMES",
"services-platform at ad3f6a65: modules/security/db/portal-contact-challenges.table.ts; services/portal/contact-match.ts, contact-match-rules.ts, verification-code-sender.ts."
]
}
]
Expected
After the stated action, observe the portal contact challenge in expired state. This case does not require an additional history event unless the transition explicitly defines one.
Data
A disposable customer, workspace and named actor; a controllable clock where the transition depends on time.
Source
services-platform:modules/security/db/portal-contact-challenges.table.ts:PORTAL_CHALLENGE_OUTCOMES,services-platform at ad3f6a65: modules/security/db/portal-contact-challenges.table.ts; services/portal/contact-match.ts, contact-match-rules.ts, verification-code-sender.ts.
12Portal contact challenge: live to supersededtransitionapiproposed
Prepare a run-owned portal contact challenge in live state with the authority and inputs required by the cited transition.
Steps
[
{
"do": "Start a replacement challenge and try verifying the earlier challenge.",
"expect": "After the stated action, observe the portal contact challenge in superseded state. This case does not require an additional history event unless the transition explicitly defines one.",
"provenance": "proposed",
"source": [
"services-platform:modules/security/services/portal/contact-match.ts:startContactChallenge",
"services-platform at ad3f6a65: modules/security/db/portal-contact-challenges.table.ts; services/portal/contact-match.ts, contact-match-rules.ts, verification-code-sender.ts."
]
}
]
Expected
After the stated action, observe the portal contact challenge in superseded state. This case does not require an additional history event unless the transition explicitly defines one.
Data
A disposable customer, workspace and named actor; a controllable clock where the transition depends on time.
Source
services-platform:modules/security/services/portal/contact-match.ts:startContactChallenge,services-platform at ad3f6a65: modules/security/db/portal-contact-challenges.table.ts; services/portal/contact-match.ts, contact-match-rules.ts, verification-code-sender.ts.
13Match portal memberships to CRM contacts with derive member access from appointments and eligibilityinteractionapiproposed