nilesh.pandClaude Opus 4.8
45b5b34680
A complete loop for defining, generating, running and gating tests: - qa/: scenario-card template + examples (API/UI/binding), the Claude generation prompt, and a QA runbook tying it together - e2e/CLAUDE.md: conventions that keep AI-generated tests consistent - run-tests.ps1: one runner for every layer (backend/api/web/ui/binding), logs per run under .testlogs/, JUnit output, evidence report, and a re-seed guard against stale demo data - .githooks/ + scripts/install-hooks.ps1: pre-commit secret scan and pre-push unit tests (shift-left before CI) - evidence report now captures each API call's request, payload and response (Authorization redacted); JUnit reporter added for CI - scripts/db.mjs: db:check freshness guard Azure DevOps pipeline deferred; the runner already emits JUnit + the evidence report for any CI to publish. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
28 lines
875 B
YAML
28 lines
875 B
YAML
id: API-005
|
|
title: One agency cannot read another agency's booking by id
|
|
layer: api
|
|
area: Keeping agencies separate
|
|
risk: high
|
|
owner: qa
|
|
|
|
preconditions:
|
|
- a confirmed booking exists under the Globetrotter tenant
|
|
- valid credentials for the Skyline tenant
|
|
|
|
steps:
|
|
given: Skyline holds a valid booking id that belongs to Globetrotter
|
|
when: Skyline requests GET /api/bookings/{that-id}
|
|
then: the API responds 404 Not Found (not 403), leaking nothing about the record
|
|
|
|
evidence:
|
|
- the GET /api/bookings/{id} request (X-Tenant skyline) and the 404 response
|
|
- the same id fetched successfully as Globetrotter, for contrast (recorded data)
|
|
|
|
data:
|
|
owning_tenant: globetrotter
|
|
requesting_tenant: skyline
|
|
|
|
must_not:
|
|
- the response body must not contain the other tenant's passenger or contact data
|
|
- the status must not be 200 or 403 (404 keeps existence hidden)
|