Rhythm 2.0 Specifications

Appearance

CAP-PFM-SEC-002Maintain workspace information and operating status

Markdown

CAP-PFM-SEC-002

Maintain workspace information and operating status

Markdown
  • DocumentDraft
  • Product intentConfirmed
  • ImplementationObserved

Planning

Feature
FEAT-PFM-SEC-01
Exercised by
FAS-PFM-SEC-01-01, FAS-PFM-SEC-01-02, FAS-PFM-SEC-01-03, FAS-PFM-SEC-01-04
Key concepts
CON-PFM-SEC-002, CON-PFM-SEC-001
Actors
ACT-PFM-001, ACT-PFM-004, ACT-PFM-005, ACT-PFM-006
Journeys
JNY-PFM-SEC-001
Related
CAP-PFM-SEC-001, CAP-PFM-SEC-003, CAP-PFM-SEC-004, CAP-PFM-SEC-015
Open questions
OQ-PFM-SEC-002
Proved by
ATS-PFM-SEC-002
Executed by
TST-PFM-SEC-023

Implementation

Executable suites
TST-PFM-SEC-221, TST-PFM-SEC-222, TST-PFM-SEC-223, TST-PFM-SEC-225, TST-PFM-SEC-226, TST-PFM-SEC-227, TST-PFM-SEC-230, TST-PFM-SEC-232, TST-PFM-SEC-243, TST-PFM-SEC-253, TST-PFM-SEC-264, TST-PFM-SEC-266

KindCapabilityProduct areaPlatformModuleSecurity, Customers and WorkspacesRevision1

Read atservices-platform ad3f6a65react-console baf6dae3

Maintain workspace information and operating status ​

Purpose ​

Staff need a recognizable workspace and the right business calendar when administering an association. This capability separates customer-maintained information from the operational decisions Rhythm makes in HQ.

How It Works ​

A customer administrator locates the workspace within the customer’s permitted reach and opens its details. The editor presents the information that person is allowed to maintain. Saving can fail when the version has changed or an update lock applies, so the administrator reviews the refusal before trying again. Rhythm staff use the HQ list to find workspaces across customers and inspect their operational context. Sender information helps support explain which publication records the customer needs. Personal pins and recent entries help staff return to ongoing work. A commercial-account move uses a separate action because it affects licensing. Provisioning, import and deletion work provide the lifecycle context for these screens. Availability checks use cached facts, so an ordinary save should not be described as a global immediate cut-off.

Relationships ​

  • Customer records supply the commercial and ownership context.
  • Provisioning and deletion control lifecycle progress.
  • Request authorization and availability determine whether work can proceed.
  • Licensing owns the applications enabled by the commercial account.

The Formal Contract

The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.

Outcomes
Administrators keep workspace names and calendars current within their customer.Rhythm staff inspect and manage workspaces through HQ.Availability checks distinguish ordinary work, HQ operations and initial-import routes.
Surfaces
consoleapi
Intent sources
services-platform:docs/tenants/tenant-lifecycle-plan.md#2.2 One record, two axesservices-platform:docs/hq/rhythm-hq-plan.md#D10services-platform:docs/hq/rhythm-hq-plan.md#D1services-platform:docs/tenants/tenant-lifecycle-plan.md#5.6 Tenant access and background work while pendingservices-platform:docs/hq/rhythm-hq-plan.md#K8

Controls

33 controls apply, from the corpus control catalogue.

TC-AVL-001 TC-AVL-005 TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-AZ-005 TC-AZ-006 TC-DAT-001 TC-DAT-002 TC-DAT-003 TC-DAT-004 TC-IAM-001 TC-IAM-002 TC-IAM-003 TC-IAM-004 TC-IAM-005 TC-LOG-001 TC-LOG-004 TC-LOG-005 TC-MON-001 TC-PI-001 TC-PI-003 TC-PI-005 TC-PRV-001 TC-PRV-002 TC-TEN-001 TC-TEN-002 TC-TEN-003 TC-TEN-004 TC-VEN-001 TC-VEN-002 TC-VEN-003

Permissions

KeyChecked atScope
platform.tenants.readapirecord
platform.tenants.updateapirecord
platform.tenants.bulkapitenant
platform.tenants.manage-statusapiglobal
platform.tenants.manage-commercial-linkapiglobal
hq.tenants.readapiglobal
hq.tenants.updateapiglobal

Business Rules

15 rules, 12 to be proved before approval. A rule's product intent is derived from its origin: 15 confirmed by a product decision, the rest inheriting this capability's confirmed.

IdRuleKindEnforced atProvenance
01must prove
Confirmed
Customer administrators access their own customer’s reachable workspaces; lists respect the caller’s reach, and reading another customer’s workspace returns not found.
origin: services-platform:docs/hq/rhythm-hq-plan.md#D1
proved by ATS-PFM-SEC-001-12, ATS-PFM-SEC-002-01, ATS-PFM-SEC-002-21, TST-PFM-SEC-230
permissionapi, servicetest
services-platform:modules/tenants/tests/e2e/tenants.e2e.spec.js#lists no tenant of another customer, which is what the reach reduction means
02must prove
Confirmed
Only Rhythm staff change business status through HQ; a console request to set live, implementation or disabled is refused with guidance to the HQ action.
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#2.2 One record, two axes
proved by ATS-PFM-SEC-002-02, ATS-PFM-SEC-002-15, ATS-PFM-SEC-002-16, ATS-PFM-SEC-002-17, ATS-PFM-SEC-002-18, ATS-PFM-SEC-002-19, ATS-PFM-SEC-002-20, TST-PFM-SEC-225, TST-PFM-SEC-230
permissionapitest
services-platform:modules/tenants/tests/e2e/tenants.e2e.spec.js#refuses a customer administrator the same change on the console route, naming where it is made
03must prove
Confirmed
Ordinary writes leave the system-managed lifecycle unchanged, and database constraints require a workspace awaiting deletion to remain disabled.
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#2.2 One record, two axes
proved by ATS-PFM-SEC-002-03, ATS-PFM-SEC-002-23, ATS-PFM-SEC-004-25, TST-PFM-SEC-230, TST-PFM-SEC-253
invariantservice, databasetest
services-platform:modules/tenants/tests/integration/services/persistence/tenants.integration.spec.js#ignores a lifecycle state a write input carries, rather than letting a client set the system axis
04must prove
Confirmed
Time zones accept UTC or an exactly spelled, recognized location; abbreviations, fixed offsets and Etc locations fail validation, and omission selects Eastern time.
proved by ATS-PFM-SEC-002-04, TST-PFM-SEC-230
validationapi, service, databaseobserved
services-platform:modules/tenants/services/persistence/tenants.ts:withValidTimeZone
05must prove
Confirmed
Saving a workspace adds its acronym to the display name without repeating an existing suffix.
proved by ATS-PFM-SEC-002-05, TST-PFM-SEC-253
calculationservicetest
services-platform:modules/tenants/tests/integration/services/persistence/tenants.integration.spec.js#does not double an existing suffix on a later update
06must prove
Confirmed
A sandbox requires a customer-type parent from the same customer; other types have no parent, and a parent with sandboxes cannot become a sandbox or change customers.
origin: services-platform:docs/hq/rhythm-hq-plan.md#D10
proved by ATS-PFM-SEC-002-06, TST-PFM-SEC-232
invariantdatabasetest
services-platform:modules/tenants/tests/integration/db/tenants.table.integration.spec.js#refuses a sandbox whose parent belongs to another customer
07must prove
Confirmed
Commercial-account changes require the separate versioned staff action; ordinary saves cannot change or clear that link, and selecting an account requests a licence refresh.
proved by ATS-PFM-SEC-002-07, TST-PFM-SEC-227
permissionapi, servicetest
services-platform:modules/tenants/tests/e2e/tenant-hubspot-link.e2e.spec.js#refuses a patch that moves the link as 400, even for Rhythm staff in their own editor
08must prove
Confirmed
Workspace replacement requires the version read and rejects update-locked records; clearing omitted editable fields remains unproved.
origin: services-platform:docs/standards/record-write-contracts.md#D-05
proved by ATS-PFM-SEC-002-08
validationapi, serviceunknown
FND-PFM-SEC-035
09must prove
Confirmed
Ordinary workspace requests are refused during provisioning, provisioning failure, initial loading, pending deletion, deletion and disabled status; HQ staff operations remain available with reads only during deletion, and initial-import routes have a loading exception.
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#5.6 Tenant access and background work while pending
proved by ATS-PFM-SEC-002-09, ATS-PFM-SEC-002-22, ATS-PFM-SEC-002-24, ATS-PFM-SEC-003-21, ATS-PFM-SEC-015-12, ATS-PFM-SEC-019-13, TST-PFM-SEC-223, TST-PFM-SEC-266
policyapi, serviceobserved
services-platform:modules/tenants/services/access/tenant-availability.ts:tenantAvailabilityOf
10
Confirmed
Availability facts are cached for thirty seconds in each process; a process that explicitly invalidates those facts reads them again on its next check.
policyserviceobserved
services-platform:modules/tenants/services/access/tenant-availability.ts:TENANT_AVAILABILITY_TTL_MS
11must prove
Confirmed
Direct workspace deletion leaves records intact and directs the caller to request deletion.
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#5.2 Who may do what
proved by ATS-PFM-SEC-002-10, TST-PFM-SEC-230
lifecycleapitest
services-platform:modules/tenants/tests/e2e/tenants.e2e.spec.js#points the caller at the deletion request route
12must prove
Confirmed
The HQ workspace list is staff-only, includes customer names, supports identifier, name and customer-name searches and status/type filters, and returns 25 records by default with a maximum of 100.
origin: services-platform:docs/hq/rhythm-hq-plan.md#D7
proved by ATS-PFM-SEC-002-11, TST-PFM-SEC-222, TST-PFM-SEC-264
policyapi, servicetest
services-platform:modules/tenants/tests/e2e/hq-tenants.e2e.spec.js#refuses an administrator of a customer as 403, even for their own tenant
13must prove
Confirmed
Each staff member has a private list of up to twenty pinned workspaces and ten recently opened workspaces; pinning does not count as opening.
proved by ATS-PFM-SEC-002-12, TST-PFM-SEC-221, TST-PFM-SEC-243
policyservice, databasetest
services-platform:modules/tenants/tests/integration/services/persistence/staff-tenant-shortcuts.integration.spec.js#refuses the pin that would be one too many, naming the maximum
14
Confirmed
HQ returns a workspace’s sender identity, publication records and verification state, or indicates that the shared Rhythm sender applies.
origin: services-platform:docs/hq/rhythm-hq-plan.md#K3
proved by ATS-PFM-SEC-002-13, TST-PFM-SEC-226
policyservicetest
services-platform:modules/tenants/tests/e2e/tenant-email-sender.e2e.spec.js#answers the DNS records the customer must publish, so a support person can read them out
15
Confirmed
The default workspace is the reachable one sharing the customer’s identifier, otherwise the first reachable identifier in order, or no workspace if reach is empty.
calculationservicetest
services-platform:modules/tenants/tests/integration/services/default/get-default-tenant.integration.spec.js#answers the tenant the caller’s reach names rather than the first one listed

Scenarios

IdGivenWhenThenProvenance
01A customer administrator wants to stop using a workspace.They request disabled status through the console.The request fails, explains that Rhythm staff handle the change, and preserves the status.test
services-platform:modules/tenants/tests/e2e/tenant-deletion-requests.e2e.spec.js#may not disable it, because cutting an association off is a staff act
02A workspace has been disabled by Rhythm staff.A customer user attempts to open one of its contacts.The refusal describes the workspace as unavailable without disclosing its internal condition.test
services-platform:modules/tenants/tests/e2e/tenant-availability-gate.e2e.spec.js#is told only that the tenant is not available

The Markdown files under specs/ in rhythmsoftware/rhythm-v2-docs are the canonical source of truth. This reader is a generated, read-only projection of them.

Rhythm Software