The suite follows mailbox confirmation into a workspace membership and then into contact possession proof. It tests identity retention, boundary protection and challenge retirement as one feature.
A verified contact changes the claim used by fresh authorization. Confirmation and challenge replays must preserve the established membership and link. The interaction rows identify the participating capabilities and the detailed proofs they assume. A complete feature chain needs its own executable evidence even when its individual outcomes already have bindings.
An active portal member has a selected candidate and possession proof.
Steps
[object Object]
Expected
The context carries the current linked contact; another workspace and console membership cannot inherit that link.
Data
A disposable customer and workspace with run-owned memberships, assignments and definitions; clock-controlled expiry fixtures where needed.
Source
services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#invites a member of the tenant's portal and lists the tenant's members, the console users left out,services-platform:modules/security/tests/integration/services/portal/contact-match.integration.spec.js#refuses a wrong code, saying how many attempts are left,services-platform:modules/security/tests/integration/services/authorizer-portal-contact.integration.spec.js#carries the linked contact as `cid`, read from the user’s row under the deployed role
03Expired and replaced challenges never establish a linklifecycleproposed
A confirmed member has no linked contact and can receive challenge codes.
Steps
[object Object]
Expected
Neither superseded nor expired challenge establishes a contact link.
Data
A disposable customer and workspace with run-owned memberships, assignments and definitions; clock-controlled expiry fixtures where needed.
Source
services-platform:modules/security/tests/integration/services/provisioning/post-confirmation.integration.spec.js#grants the Portal Member role, active, at the tenant’s scope,services-platform:modules/security/tests/integration/services/persistence/portal-contact-challenges.integration.spec.js#records the member, the contact, the channel and a ten-minute expiry, with the digest of the code and never the code,services-platform:modules/security/tests/integration/services/portal/contact-match.integration.spec.js#refuses a wrong code, saying how many attempts are left
04Members see only their own workspace identity and offerspermissionnegativeproposed
Two portal members in separate workspaces have candidate offers.
Steps
[object Object]
Expected
The foreign membership and candidate proof are refused without leaking contact identity.
Data
A disposable customer and workspace with run-owned memberships, assignments and definitions; clock-controlled expiry fixtures where needed.
Source
services-platform:modules/security/tests/e2e/invitations.e2e.spec.js#invites a member of the tenant's portal and lists the tenant's members, the console users left out,services-platform:modules/security/tests/unit/services/portal/candidate-token.spec.ts#refuses a token with one character changed
05Confirmation and verification replays preserve identityregressionproposed
A mailbox is confirmed and a contact verification succeeds.
Steps
[object Object]
Expected
No second membership or contact link is created and the established link remains unchanged.
Data
A disposable customer and workspace with run-owned memberships, assignments and definitions; clock-controlled expiry fixtures where needed.
Source
services-platform:modules/security/tests/integration/services/provisioning/post-confirmation.integration.spec.js#grants the Portal Member role, active, at the tenant’s scope,services-platform:modules/security/tests/integration/services/portal/contact-match.integration.spec.js#refuses a wrong code, saying how many attempts are left,services-platform:modules/security/tests/integration/services/portal/contact-match.integration.spec.js#is linked to a contact CRM created from the sign-up details