The suite follows an invitation into a console session and usable workspace access. It includes restoration, sign-out and refusal so successful identity verification is checked alongside the authority needed at the destination.
Invitation acceptance supplies membership and assignments for subsequent access evaluation. The console must wait for that evaluation before presenting protected work, and spent links must leave the accepted account intact. The referenced capability scenarios supply detailed observations. These ordered feature cases remain proposed until a registered suite executes the whole chain and its result is retained.
Prepare a current invitation for a browser without a console session.
Steps
[object Object]
Expected
The activated membership and evaluated permissions permit entry; no self-registration path is needed.
Data
Disposable customer, workspace and membership fixtures owned by the run; fixed clocks, failure controls or provider prerequisites as required by the case.
Source
react-console:e2e/security/invitations.spec.ts#lets them set a password and sign in, and clears them off the Invited filter,react-console:e2e/dev/session.dev.spec.ts#sends a signed-out visitor to the login screen and back to the page they wanted,react-console:e2e/controlled/security-context.controlled.spec.ts#will not open the console when the Platform cannot say what somebody may do, and opens it on the retry
02Separate current permission from future offered accessinteractionnegativeproposed
Offer a role effective now and another beginning the next day.
Steps
[object Object]
Expected
The current assignment contributes permission; future or ineffective assignments supply no current authority.
Data
Disposable customer, workspace and membership fixtures owned by the run; fixed clocks, failure controls or provider prerequisites as required by the case.
Source
services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js#sets the chosen password in Cognito, then accepts, activates and makes the pending roles real in one transaction,services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#answers every key the database says Read Only allows, not only the key the signed slice was resolved for,services-platform:modules/security/tests/e2e/access.e2e.spec.js#answers a caller whose only grant is pending with a document allowing nothing, rather than refusing them
03Restoration and sign-out preserve the session boundarylifecycleproposed
Open two browser tabs with a session whose workspace context has loaded.
Steps
[object Object]
Expected
Reload restores through the session endpoint; protected navigation after sign-out requires a new sign-in.
Data
Disposable customer, workspace and membership fixtures owned by the run; fixed clocks, failure controls or provider prerequisites as required by the case.
Source
react-console:lib/auth/__tests__/session.test.ts#keeps the access token in memory and the refresh token nowhere,react-console:e2e/dev/session.dev.spec.ts#leaves nothing of the console behind, by URL or by the back button,react-console:e2e/controlled/security-context.controlled.spec.ts#will not open the console when the Platform cannot say what somebody may do, and opens it on the retry
04An authenticated account without usable grants sees refusalpermissionproposed
Prepare an active account without an effective workspace assignment.
Steps
[object Object]
Expected
The console presents No Access without protected data or a sign-in redirect loop.
Data
Disposable customer, workspace and membership fixtures owned by the run; fixed clocks, failure controls or provider prerequisites as required by the case.
Source
react-console:e2e/dev/session.dev.spec.ts#sends a signed-out visitor to the login screen and back to the page they wanted,services-platform:modules/security/tests/integration/services/security-context/get-security-context.integration.spec.js#is refused their own document rather than answered an empty one,react-console:e2e/dev/permissions.dev.spec.ts#offers the administrator an action it does not offer the read-only user
05A spent invitation leaves the accepted credential intactregressionproposed
Accept an invitation and verify sign-in with the chosen password.
Steps
[object Object]
Expected
The original activation and credential remain in effect; replay performs no second activation.
Data
Disposable customer, workspace and membership fixtures owned by the run; fixed clocks, failure controls or provider prerequisites as required by the case.
Source
services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js#answers a reused token as the success it already was, without touching Cognito again,react-console:e2e/security/invitations.spec.ts#lets them set a password and sign in, and clears them off the Invited filter,react-console:e2e/dev/sign-in.dev.spec.ts#refuses a wrong password with one message that does not say whether the account exists