Skip to content

ATS-PFM-TNL-004Prepare the customer’s first access and sender: Capability Test Specification

Markdown

ATS-PFM-TNL-004

Prepare the customer’s first access and sender: Capability Test Specification

Markdown
  • DocumentProposed

Planning

Proves capability
CAP-PFM-TNL-004

Design

Executed by
TST-PFM-TNL-082, TST-PFM-TNL-085, TST-PFM-TNL-097

KindAcceptance test setProduct areaPlatformModuleWorkspace Lifecycle Across ApplicationsRevision3

Read atservices-platform ad3f6a65services-crm a8d1364fservices-commerce c8b66a98services-committees 36129c24services-membership 5994c270services-submissions 64236c19services-websites 5fc6823cservices-marketing d071a159rhythm-v2-docs d318a948

Coverage

  • Rule covered
  • Transition gap: FND-PFM-TNL-069
  • Validation covered
  • Permission gap: FND-PFM-TNL-069
  • Edge gap: FND-PFM-TNL-069
  • Failure gap: FND-PFM-TNL-069
  • Boundary covered
  • Concurrency gap: FND-PFM-TNL-069
  • Invariant covered
  • Interaction covered

Test Scenarios

10 scenarios proving CAP-PFM-TNL-004; 9 bound to an existing test.

01 Existing customers receive no first-admin invitationruleapinegativetest
Proves
BR-CAP-PFM-TNL-004-01
Preconditions
The request names a person for an existing customer.
Steps
Complete provisioning.
Expected
No first-administrator invitation is sent.
Data
Use the run-owned records and caller contexts created by the cited tests; use their provider and clock seams only where declared.
Bound to
Source
services-platform:modules/tenants/tests/integration/services/provisioning/provision-tenant.integration.spec.js#invites nobody when the request did not create the customer
02 New-customer invitation establishes the intended roleruleapitest
Proves
BR-CAP-PFM-TNL-004-02
Preconditions
A new customer request names its first administrator.
Steps
Run the administration participant.
Expected
One invited console identity receives customer-scoped Administrator authority and one invitation.
Data
Use the run-owned records and caller contexts created by the cited tests; use their provider and clock seams only where declared.
Bound to
services-platform:modules/tenants/tests/integration/services/lifecycle/first-administrator.integration.spec.js#grants that user the Administrator role at the customer, waiting on their acceptance
services-platform:modules/tenants/tests/unit/services/lifecycle/first-administrator.spec.ts#grants the built-in Administrator role, by the product key the catalog publishes it under
Source
services-platform:modules/tenants/tests/integration/services/lifecycle/first-administrator.integration.spec.js#leaves an invited console user of the customer holding the address
03 Administration invitation survives retryinvariantapitest
Proves
BR-CAP-PFM-TNL-004-03
Preconditions
The original build recorded its administrator invitation.
Steps
Repeat the provisioning work.
Expected
The ledger retains that invitation without a second send.
Data
Use the run-owned records and caller contexts created by the cited tests; use their provider and clock seams only where declared.
Bound to
Source
services-platform:modules/tenants/tests/integration/services/provisioning/provision-tenant.integration.spec.js#invites them once, and records the invitation in the ledger
04 Unusable administration authority is refusedvalidationunitnegativetest
Proves
BR-CAP-PFM-TNL-004-04
Preconditions
Existing identities exercise suspension, incorrect role or scope and ineffective validity periods.
Steps
Attempt to adopt each identity.
Expected
Each incompatible state reports a refusal that directs staff toward correction.
Data
Use the run-owned records and caller contexts created by the cited tests; use their provider and clock seams only where declared.
Bound to
services-platform:modules/tenants/tests/unit/services/lifecycle/first-administrator.spec.ts#refuses a SUSPENDED user, whatever they hold: an administrator nobody can use is none
services-platform:modules/tenants/tests/unit/services/lifecycle/first-administrator.spec.ts#refuses when the grant is of another role, which administers nothing
services-platform:modules/tenants/tests/unit/services/lifecycle/first-administrator.spec.ts#refuses when the Administrator grant is at tenant scope rather than the customer’s own
services-platform:modules/tenants/tests/integration/services/lifecycle/first-administrator.integration.spec.js#refuses the job rather than reporting an administrator the customer does not have
Source
services-platform:modules/tenants/tests/unit/services/lifecycle/first-administrator.spec.ts#refuses a SUSPENDED user, whatever they hold: an administrator nobody can use is none
05 Invalid sender inputs retain no workspacevalidationapinegativetest
Proves
BR-CAP-PFM-TNL-004-05
Preconditions
Sender variants violate strategy, domain or address requirements.
Steps
Submit each request.
Expected
The response identifies invalid input and creation leaves no workspace.
Data
Use the run-owned records and caller contexts created by the cited tests; use their provider and clock seams only where declared.
Bound to
services-platform:modules/tenants/tests/integration/services/provisioning/tenant-email-strategy.integration.spec.js#refuses the domain strategy without a domain when the tenant has none of its own to lend it
services-platform:modules/tenants/tests/integration/services/provisioning/tenant-email-strategy.integration.spec.js#refuses a domain under the address strategy, which proves the one mailbox and nothing else
services-platform:modules/tenants/tests/integration/services/provisioning/tenant-email-strategy.integration.spec.js#refuses an address outside the domain, because an identity proved for one domain may not send as another
Source
services-platform:modules/tenants/tests/integration/services/provisioning/tenant-email-strategy.integration.spec.js#refuses the domain strategy without a domain when the tenant has none of its own to lend it
06 Hostname identity supplies a sender domainboundaryapitest
Proves
BR-CAP-PFM-TNL-004-06
Preconditions
A hostname workspace identifier accompanies a domain strategy with no supplied domain.
Steps
Submit the sender-bearing request.
Expected
The requested identity uses the workspace hostname as its domain.
Data
Use the run-owned records and caller contexts created by the cited tests; use their provider and clock seams only where declared.
Bound to
services-platform:modules/tenants/tests/e2e/tenant-email-sender.e2e.spec.js#proves the tenant’s own domain, because the request left the strategy’s domain to it
Source
services-platform:modules/tenants/tests/integration/services/provisioning/tenant-email-strategy.integration.spec.js#proves the tenant’s id as the domain, the id being a hostname
07 Pending DNS does not block openingtransitionapitest
Proves
BR-CAP-PFM-TNL-004-07
Preconditions
A domain sender request remains unverified.
Steps
Finish construction and inspect its sender.
Expected
The workspace opens while the pending identity exposes required DNS records.
Data
Use the run-owned records and caller contexts created by the cited tests; use their provider and clock seams only where declared.
Bound to
services-platform:modules/tenants/tests/integration/services/provisioning/tenant-email-strategy.integration.spec.js#leaves its sender identity pending, for the customer to finish in their own time
services-platform:modules/tenants/tests/e2e/tenant-email-sender.e2e.spec.js#answers the DNS records the customer must publish, so a support person can read them out
Source
services-platform:modules/tenants/tests/integration/services/provisioning/tenant-email-strategy.integration.spec.js#opens the tenant anyway, which is what option A promises
08 Portal construction is deferredruleunittest
Proves
BR-CAP-PFM-TNL-004-09
Preconditions
The portal participant receives a workspace with recorded portal interest.
Steps
Invoke provisioning.
Expected
The response is not applicable and no pool is built.
Data
Use the run-owned records and caller contexts created by the cited tests; use their provider and clock seams only where declared.
Bound to
services-platform:modules/tenants/tests/unit/services/lifecycle/participants.spec.js#creates nothing when a tenant is provisioned, because the pool is built when Websites is enabled
Source
services-platform:modules/tenants/tests/unit/services/lifecycle/participants.spec.js#creates nothing when a tenant is provisioned, because the pool is built when Websites is enabled
09 First access and sender setup coexistinteractionapitest
Proves
AS-JNY-PFM-TNL-001-04
Preconditions
The new-customer journey includes an administrator and domain sender.
Steps
Complete its provisioning fixture.
Expected
The invitation is recorded once and the workspace opens with verification pending.
Data
Use the run-owned records and caller contexts created by the cited tests; use their provider and clock seams only where declared.
Bound to
Source
services-platform:modules/tenants/tests/integration/services/provisioning/provision-tenant.integration.spec.js#invites them once, and records the invitation in the ledger
10 Refused first-access input leaves no accepted constructioninteractionapinegativeproposed
Proves
BR-CAP-PFM-TNL-004-04
Preconditions
A staff request creates a customer and names an administrator whose existing identity has incompatible authority.
Steps
Submit the request, let first-administrator provisioning reach its authority check and inspect the build and invitation records.
Expected
The participant refuses, the build remains failed for staff recovery and no second invitation is sent. This checks a build-stage refusal rather than submission rollback.
Data
Create a separate run-owned workspace for each decision branch and an unaffected comparison workspace. Use a controlled clock, paused task or injected fault at the boundary named in the scenario.
Source
rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-004-give-a-new-customer-its-first-administrator-and-its-own-e.md; rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-001-ask-for-a-new-workspace-and-have-every-application-build-it.md; rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-003-follow-a-provisioning-retry-it-and-hear-how-it-ended.md

The Markdown files under specs/ in rhythmsoftware/rhythm-v2-docs are the canonical source of truth. This reader is a generated, read-only projection of them.