Bite 30I.2 Manual Promotion Test Suite - RodrigoMattosoSilveira/EnterpriseRemoteSystems GitHub Wiki

Enterprise Remote Systems — Bite 30I.2 Manual Promotion Test Suite

Bite 30I.2 — Tenant Support Access Lease Domain and Backend

Branch: 756-bite-30i2-tenant-support-access-lease-domain-and-backendd
Current reviewed SHA: dd13b05171b8f13bbe56cd6dabf5a3ced3f7e7e7
Promotion target: Bite 30I integration branch
753-bite-30i-global-administration-control-plane-and-tenant-support-access-lease

1. Purpose of this manual suite

This suite manually verifies the Bite 30I.2 Tenant Support Access Lease domain and backend before promotion into Bite 30I.

The suite must prove that an existing GLOBAL Application Administrator may receive temporary, explicitly permission-scoped access to exactly one Tenant without becoming a Tenant user or receiving standing Tenant authority.

The suite verifies:

no standing Tenant business-data access for the GLOBAL Application Administrator;
request lifecycle beginning at PENDING;
exact-Tenant canonical Tenant Administrator approval;
explicit support-permission allowlisting;
lease-backed APPLICATION scope;
preservation of the same GLOBAL Application Administrator Actor;
no creation of Person, Membership, Tenant Actor, Collaborator, or Tenant Role Grant;
exact-Tenant boundary enforcement;
inability to use a leased Tenant context as GLOBAL * control-plane authority;
immediate termination;
fixed expiration and derived EXPIRED behavior;
lifecycle auditability;
duplicate-open-lease protection;
lapsed-PENDING replacement behavior.

2. Manual-test execution standard

Every test in this document explicitly identifies:

the account that must be used;
the required role;
the required Tenant or Administration context;
the exact UI navigation;
any DevTools/API step that is unavoidable because Bite 30I.2 intentionally has no lease-management UI;
the exact result that constitutes PASS;
any condition that blocks promotion.

Do not infer a required identity or context from a previous test.

Where a test depends on a lease created earlier, that dependency is stated explicitly.

Do not navigate directly to an internal application route when the same destination can be reached through ERS navigation.

3. Bite 30I.2 UX boundary

Bite 30I.2 is a domain/backend bite.

The following lease-management operations intentionally do not yet have a complete user interface:

request a Tenant Support Access Lease;
list Tenant Support Access Leases;
approve a Tenant Support Access Lease;
terminate a Tenant Support Access Lease;
inspect raw lease provenance.

Those management workflows belong to Bite 30I.3.

Therefore:

Use the ERS UI for:
- authentication;
- Administration/Tenant context selection;
- navigation;
- People access;
- Authentication account inspection;
- Tenant catalog inspection;
- Audit Log Viewer verification.

Use DevTools only for:
- lease request;
- lease list;
- lease approval;
- lease termination;
- raw authorization-context verification.

Use SQL only as supplemental integrity evidence.

A missing lease badge, missing lease-expiration display, or visible-but-denied page link is a 30I.3 UX issue unless it causes unauthorized data or authority to be granted.

4. Required local test identities

Use the corrected Bite 30I.2 fixture helper before running this suite.

From the ERS repository root, with the local backend stopped:

python3 ~/Downloads/prepare-bite30i2-manual-fixtures-v2.py

The corrected helper:

reuses [email protected] when it is already bound to an existing GLOBAL APPLICATION_ADMIN Actor such as bootstrap-admin;
does not rebind that login to a different Actor;
provisions/reconciles the deterministic Tenant Administrator fixtures;
uses the following default local password.

Application Administrator

Login:    [email protected]
Password: Local-E2E-Administrator-28D!
Role:     APPLICATION_ADMIN
Scope:    APPLICATION
Global Tenant context: *

The Actor Key may be:

bootstrap-admin

when that Actor already owns the local [email protected] account.

Tenant A canonical Tenant Administrator

Tenant ID: default
Login:     [email protected]
Password:  Local-E2E-Administrator-28D!
Role:      TENANT_ADMIN

Tenant B canonical Tenant Administrator

Tenant ID: e2e-authz-admin-tenant
Login:     [email protected]
Password:  Local-E2E-Administrator-28D!
Role:      TENANT_ADMIN

If your local deterministic fixture values intentionally differ, record the replacements before beginning and substitute them consistently throughout this document.

5. Start ERS

After fixture preparation, start the backend from the repository root:

make local-backend

Start the frontend in a second terminal:

make local-frontend

Open the ERS frontend root in the browser.

Do not begin Test 01 until the login page or authenticated application shell loads normally.

6. Recommended browser sessions

Use three separate browser profiles/windows so the three identities remain independently authenticated.

Browser Session A

Identity: Application Administrator
Login:    [email protected]

Browser Session B

Identity: Tenant A canonical Tenant Administrator
Login:    [email protected]
Tenant:   default

Browser Session C

Identity: Tenant B canonical Tenant Administrator
Login:    [email protected]
Tenant:   e2e-authz-admin-tenant

If you do not use three sessions, explicitly sign out before switching identities.

Never assume that merely opening another tab changes the authenticated account.

7. Reusable DevTools helper

Whenever a test says to use the DevTools helper:

use the browser session identified by that test;
open browser DevTools;
select Console;
run:
```
typeof window.m30i2
```
if the result is "undefined", paste the helper below and press Enter;
if the helper is already present, do not redefine it unless the Tenant IDs changed.

window.m30i2 = {
  ...(window.m30i2 || {}),
  TENANT_A: "default",
  TENANT_B: "e2e-authz-admin-tenant",
  api: async function (path, {
    method = "GET",
    tenantId = "*",
    body
  } = {}) {
    const response = await fetch(`/api/v1${path}`, {
      method,
      credentials: "include",
      headers: {
        "X-Tenant-ID": tenantId,
        ...(body === undefined ? {} : { "Content-Type": "application/json" })
      },
      body: body === undefined ? undefined : JSON.stringify(body)
    });

    const payload = await response.json().catch(() => null);

    const result = {
      status: response.status,
      ok: response.ok,
      payload
    };

    console.log(JSON.stringify(result, null, 2));
    return result;
  }
};

Expected result after defining it:

typeof window.m30i2

must return:

"object"

8. Test record

Record values as they are discovered.

Application Administrator login: [email protected]
Application Administrator Actor ID:
Application Administrator Actor Key:
Application Administrator Person bound?:

Tenant A ID: default
Tenant A name:
Tenant A canonical Tenant Administrator Actor ID:

Tenant B ID: e2e-authz-admin-tenant
Tenant B name:
Tenant B canonical Tenant Administrator Actor ID:

Lease A ID:
Lease A requested expiration:

Short-expiration Lease ID:
Short-expiration time:

Lapsed-PENDING Lease ID:
Lapsed-PENDING expiration:

Replacement Lease ID:

Test 01 — GLOBAL Application Administrator has no standing Tenant workspace

Objective

Verify that the Application Administrator begins in the GLOBAL control plane and does not have standing Tenant business-data access before any support lease exists.

Identity and required context

Identity: Application Administrator
Login:    [email protected]
Context:  Global administration

Preconditions

Fixture preparation completed.
ERS backend and frontend are running.
No unexpired PENDING or APPROVED support lease exists for [email protected] and Tenant A.

If an old manual-test lease is still active, terminate it through the authorized lifecycle or allow it to expire before beginning this test.

Procedure

In Browser Session A, open the ERS frontend root.
If another user is signed in, sign out through the ERS UI.

[email protected]
Local-E2E-Administrator-28D!

After authentication completes, locate the selector at the top of the application.
Verify its label is Administration context.
Open Administration context.
Select Global administration if it is not already selected.
Reopen the selector.
Verify Global administration is present.
Verify Tenant A is not present as a selectable Administration context before a lease is approved.
Using the left-side navigation, click Tenants.
Verify the Tenant catalog loads.
In the Tenant filter field, enter part of Tenant A's name, code, or ID.
Verify Tenant A can be found through the filter.
Clear the filter.
Using the left-side navigation, click Authentication.
Verify Authentication Administration loads.
Using the left-side navigation, click Authorization.
Verify Authorization Administration loads.
Using the left-side navigation, click Audit logs.
Verify the Audit Log Viewer loads.
Open DevTools → Console.
Ensure the m30i2 helper from §7 is defined.
Run:

await m30i2.api("/authz/current-actor", {
  tenantId: "*"
});

Expected result

The DevTools result must show:

HTTP 200.
ok = true.
scope = APPLICATION.
tenantId = "*".
roleCodes includes APPLICATION_ADMIN.
supportLeaseId is absent, empty, or otherwise not populated.
No Tenant A support context is available in the selector.
Global control-plane pages are available.
No Tenant business-data access has been granted merely because this is an Application Administrator.

Record:

Application Administrator Actor ID:
Application Administrator Actor Key:

If the raw response uses actorRecordId, record that value as the Actor ID.

Promotion blocker

Do not promote if Tenant A is selectable or Tenant A business data is accessible without an approved support lease.

Test 02 — Application Administrator Authentication Account exposes explicit Actor identity

Objective

Verify that the Authentication Account displays separate Actor ID and Actor Key labels before any lease is created, and verify no Person/Tenant identity is attached to the GLOBAL Application Administrator.

Identity and required context

Identity: Application Administrator
Login:    [email protected]
Context:  Global administration

Preconditions

Test 01 passed.
No approved Tenant A support lease exists.

Procedure

In Browser Session A, confirm the signed-in account is [email protected].
Open Administration context.
Select Global administration.
Using the left-side navigation, click Authentication.
Wait for the Authentication Accounts list to finish loading.
Use the Authentication Administration search/filter control to find:
```
[email protected]
```
Open or inspect the [email protected] Authentication Account.
Locate the Actor presentation for the Application Administrator.
Verify there is an explicit label:
```
Actor ID
```
Record the value shown next to Actor ID.
Verify there is a separate explicit label:

Actor Key

Record the value shown next to Actor Key.
Inspect the Account's Person presentation.
Record whether a Person is bound.
Inspect the Actor scope/role presentation.

Expected result

The Account is [email protected].
Actor ID is visible and has a non-empty value.
Actor Key is visible and has a non-empty value.
Actor ID and Actor Key are displayed as distinct fields.
Actor Key may be bootstrap-admin when that existing Actor owns the local account.
The Actor is GLOBAL/Application scoped.
APPLICATION_ADMIN is represented.
No Tenant A Actor is attached.
No Tenant Person/Membership identity is presented for the Application Administrator.

Record:

Application Administrator Actor ID:
Application Administrator Actor Key:
Application Administrator Person bound?: YES / NO

Promotion blocker

Do not promote if Actor ID or Actor Key is missing, if they are ambiguously collapsed into a single Actor: field, or if the GLOBAL Application Administrator has acquired a Tenant identity.

Test 03 — Invalid lease requests are rejected

Objective

Verify that the support-lease request endpoint rejects invalid authority and invalid lease shape with explicit validation responses.

Identity and required context

Identity: Application Administrator
Login:    [email protected]
Context:  Global administration

Preconditions

Browser Session A can sign in as [email protected].
Global administration is available.
DevTools helper from §7 is available.

Sign-in and context procedure

Perform these steps before running 03A:

In Browser Session A, open ERS.
If another account is signed in, sign out.

[email protected]
Local-E2E-Administrator-28D!

Locate Administration context.
Open it.
Select Global administration.
Verify the selector displays Global administration.
Open DevTools → Console.
Ensure window.m30i2 is defined using §7.

03A — GLOBAL/control-plane permission cannot be leased

Run:

await m30i2.api("/authz/support-access-leases", {
  method: "POST",
  tenantId: "*",
  body: {
    tenantId: m30i2.TENANT_A,
    expiresAt: new Date(Date.now() + 30 * 60 * 1000).toISOString(),
    reason: "30I.2 manual validation — invalid control-plane permission",
    permissions: ["authz.manage"]
  }
});

Expected result

DevTools Network/Console may show the POST in red because the response is non-2xx. That is expected for this negative test.
HTTP status is exactly 400.
ok = false.
payload.error.code = "validation_failed".

[xx] payload.error.fields.permissions states that:

Permission "authz.manage" is not eligible for Tenant Support Access

No lease is created.
No HTTP 500 occurs.

03A result: [✔︎] PASS only if all checks above are true.

03B — Wildcard `*` cannot be leased as a Tenant

Run:

await m30i2.api("/authz/support-access-leases", {
  method: "POST",
  tenantId: "*",
  body: {
    tenantId: "*",
    expiresAt: new Date(Date.now() + 30 * 60 * 1000).toISOString(),
    reason: "30I.2 manual validation — wildcard Tenant",
    permissions: ["people.read"]
  }
});

Expected result

HTTP status is 400.
ok = false.
payload.error.code = "validation_failed".
payload.error.fields.tenantId states:
```
A specific Tenant is required
```
No lease is created.
No HTTP 500 occurs.

03C — At least one support permission is required

Run:

await m30i2.api("/authz/support-access-leases", {
  method: "POST",
  tenantId: "*",
  body: {
    tenantId: m30i2.TENANT_A,
    expiresAt: new Date(Date.now() + 30 * 60 * 1000).toISOString(),
    reason: "30I.2 manual validation — no permissions",
    permissions: []
  }
});

Expected result

HTTP status is 400.
ok = false.
payload.error.code = "validation_failed".

payload.error.fields.permissions states:

At least one Tenant support permission is required

No lease is created.
No HTTP 500 occurs.

Promotion blocker

Do not promote if authz.manage, Tenant *, or an empty permission set is accepted.

Test 04 — Application Administrator requests a permission-scoped Tenant A lease

Objective

Create the primary manual-test lease, Lease A, with only the Tenant permissions required to read the People page.

Identity and required context

Identity: Application Administrator
Login:    [email protected]
Context:  Global administration

Required permission set

people.read
reference_data.read

reference_data.read is required because the People page loads Tenant person-status reference data.

Preconditions

Test 03 passed.
There is no unexpired PENDING or APPROVED lease for this Application Administrator and Tenant A.
Browser Session A is authenticated as [email protected].

Procedure

In Browser Session A, open Administration context.
Select Global administration.
Verify Global administration is displayed.
Open DevTools → Console.
Ensure the m30i2 helper from §7 is defined.
Run:

const leaseARequest = await m30i2.api("/authz/support-access-leases", {
  method: "POST",
  tenantId: "*",
  body: {
    tenantId: m30i2.TENANT_A,
    expiresAt: new Date(Date.now() + 30 * 60 * 1000).toISOString(),
    reason: "Bite 30I.2 manual promotion — Tenant A People read-only support",
    permissions: [
      "people.read",
      "reference_data.read"
    ]
  }
});

console.log("LEASE A ID:", leaseARequest?.payload?.data?.id);
console.log("LEASE A EXPIRES:", leaseARequest?.payload?.data?.expiresAt);

Copy the returned Lease ID into the Test Record in §8.
Copy the returned expiration into the Test Record in §8.

Expected result

HTTP status is 201.
ok = true.
payload.data.id is non-empty.
payload.data.status = "PENDING".
payload.data.effectiveStatus = "PENDING".
payload.data.tenantId = "default" unless you intentionally substituted another Tenant A ID.
payload.data.permissions contains exactly:
```
people.read
reference_data.read
```
applicationActorId equals requestedByActorId.
reason matches the submitted support reason.
expiresAt is returned and is later than the request time.

Record:

Lease A ID:
Lease A requested expiration:

Promotion blocker

Do not promote if a valid request does not create a PENDING lease or if permissions/expiration are altered during creation.

Test 05 — PENDING lease grants no Tenant authority

Objective

Verify that a requested but unapproved lease is historical/control-plane data only and does not become an effective Tenant context.

Identity and required context

Identity: Application Administrator
Login:    [email protected]
Context:  Global administration

Preconditions

Test 04 created Lease A.
Lease A is still PENDING.
Lease A has not expired.

Procedure

In Browser Session A, confirm [email protected] is still signed in.
Refresh the ERS page.
Open Administration context.
Verify Global administration is present.
Verify Tenant A is not present as a selectable context while Lease A is PENDING.
Select Global administration.
Open DevTools → Console.
Ensure the m30i2 helper is defined.
Run:

await m30i2.api("/authz/current-actor", {
  tenantId: m30i2.TENANT_A
});

Run:

await m30i2.api(
  `/authz/support-access-leases?tenantId=${encodeURIComponent(m30i2.TENANT_A)}&status=PENDING`,
  {
    tenantId: "*"
  }
);

Expected result

For /authz/current-actor against Tenant A:

HTTP status is 403.
ok = false.
payload.error.code = "tenant_actor_unavailable".
No Tenant A effective authorization context is returned.

For lease listing:

HTTP status is 200.
Lease A appears.
Lease A remains PENDING.

Promotion blocker

Do not promote if a PENDING lease appears as a selectable Tenant context or authorizes Tenant data.

Test 06 — Tenant B Administrator cannot approve Tenant A's lease

Objective

Verify exact-Tenant approval authority.

Identity and required context

Identity: Tenant B canonical Tenant Administrator
Login:    [email protected]
Tenant:   e2e-authz-admin-tenant
Context selector type: Tenant

Preconditions

Lease A exists.
Lease A belongs to Tenant A (default).
Lease A is still PENDING.
Lease A has not expired.
Lease A ID from Test 04 is available.

Procedure

In Browser Session C, open ERS.
If another user is signed in, sign out.

[email protected]
Local-E2E-Administrator-28D!

Locate the top context selector.
Verify it is the ordinary Tenant selector, not Administration context.
Open the Tenant selector.
Select Tenant B:
```
e2e-authz-admin-tenant
```
Verify Tenant B is displayed as selected.
Open DevTools → Console.
Define the m30i2 helper from §7 if necessary.
Replace PASTE-LEASE-A-ID below with the actual Lease A ID.
Run:

const LEASE_A_ID = "PASTE-LEASE-A-ID";

await m30i2.api(
  `/authz/support-access-leases/${encodeURIComponent(LEASE_A_ID)}/approve`,
  {
    method: "POST",
    tenantId: m30i2.TENANT_B
  }
);

Expected result

HTTP status is 403.
ok = false.
payload.error.code = "forbidden".
No HTTP 500 occurs.
Lease A remains PENDING.
Tenant B Administrator cannot approve Tenant A's lease.

Promotion blocker

Do not promote if a Tenant Administrator can approve a lease belonging to a different Tenant.

Test 07 — Tenant A Administrator lists and approves the exact-Tenant lease

Objective

Verify that the canonical Tenant A Administrator may view and approve Tenant A's request.

Identity and required context

Identity: Tenant A canonical Tenant Administrator
Login:    [email protected]
Tenant:   default
Context selector type: Tenant

Preconditions

Test 06 passed.
Lease A is still PENDING.
Lease A has not expired.
Lease A ID is available.

Procedure

In Browser Session B, open ERS.
If another user is signed in, sign out.

[email protected]
Local-E2E-Administrator-28D!

Locate the ordinary Tenant selector.
Open it.
Select Tenant A:
```
default
```
Verify Tenant A is displayed as selected.
Using the normal side navigation, open People.
Verify the People page loads, establishing that this is a functioning Tenant A Administrator session.
Open DevTools → Console.
Define the m30i2 helper from §7 if necessary.
Run:

await m30i2.api(
  `/authz/support-access-leases?tenantId=${encodeURIComponent(m30i2.TENANT_A)}&status=PENDING`,
  {
    tenantId: m30i2.TENANT_A
  }
);

Verify Lease A is present in the response.
Replace PASTE-LEASE-A-ID below with the actual Lease A ID.
Run:

const LEASE_A_ID = "PASTE-LEASE-A-ID";

await m30i2.api(
  `/authz/support-access-leases/${encodeURIComponent(LEASE_A_ID)}/approve`,
  {
    method: "POST",
    tenantId: m30i2.TENANT_A
  }
);

Expected result

Lease listing:

HTTP 200.
Lease A appears.

Approval:

HTTP 200.
ok = true.
payload.data.status = "APPROVED".
payload.data.effectiveStatus = "APPROVED".
approvedByActorId is non-empty and belongs to the current Tenant A Administrator.
expiresAt is unchanged from Test 04.
Permission set remains exactly:
```
people.read
reference_data.read
```

Record:

Tenant A canonical Tenant Administrator Actor ID:

Promotion blocker

Do not promote if an exact-Tenant canonical Tenant Administrator cannot approve, or if approval changes the lease's requested permission scope or expiration.

Test 08 — Approved lease becomes a selectable Administration context

Objective

Verify that approval exposes exactly Tenant A as a temporary Administration context for the existing Application Administrator.

Identity and required context

Identity: Application Administrator
Login:    [email protected]
Starting context: Global administration

Preconditions

Test 07 approved Lease A.
Lease A has not expired.

Procedure

Return to Browser Session A.
Verify the signed-in account is still [email protected].
Refresh ERS.
Locate Administration context.
Open the selector.
Verify Global administration is present.
Verify Tenant A appears by its Tenant name/code.
Verify Tenant B does not appear merely because Tenant A was leased.
Select Tenant A.
Verify the selector now displays Tenant A.
Verify no new login prompt occurs.
Verify the signed-in account remains [email protected].

Expected result

Tenant A is selectable only after approval.
Tenant B is not exposed by Tenant A's lease.
The account remains the Application Administrator account.
The selector remains an Administration context selector.

30I.3 UX observation

It is acceptable in Bite 30I.2 if Tenant A is not yet visibly labeled “Support Access Lease” and the expiration is not shown in the selector. Record that as a 30I.3 UX follow-up.

Promotion blocker

Do not promote if approval exposes unrelated Tenants or requires a synthetic Tenant login/identity.

Test 09 — Lease-backed authorization keeps the same GLOBAL Application Administrator Actor

Objective

Verify raw authorization provenance for the approved Tenant A context.

Identity and required context

Identity: Application Administrator
Login:    [email protected]
Context:  Tenant A selected through Administration context

Preconditions

Test 08 passed.
Tenant A is currently selected.
Lease A is still APPROVED and unexpired.
Application Administrator Actor ID from Test 02 is recorded.

Procedure

In Browser Session A, verify Tenant A is displayed in Administration context.
Open DevTools → Console.
Ensure the m30i2 helper is defined.
Run:

const currentLeaseActor = await m30i2.api("/authz/current-actor", {
  tenantId: m30i2.TENANT_A
});

Expand the returned payload.
Compare its Actor record ID with the Actor ID recorded in Test 02.
Compare supportLeaseId with Lease A ID.

Expected result

HTTP 200.
ok = true.
scope = "APPLICATION".
tenantId = Tenant A.
Actor record ID equals the same Application Administrator Actor ID recorded in Test 02.
supportLeaseId = Lease A ID.
supportLeaseExpiresAt equals Lease A's fixed expiration.
supportLeasePermissions contains exactly:
```
people.read
reference_data.read
```
personId is absent/empty.
membershipId is absent/empty.
collaboratorId is absent/empty.
roleCodes still includes APPLICATION_ADMIN.
roleCodes does not gain TENANT_ADMIN.

Conceptually:

same GLOBAL Application Administrator Actor
scope = APPLICATION
tenantId = Tenant A
supportLeaseId = Lease A

Promotion blocker

Do not promote if the Actor changes, scope becomes TENANT, a Tenant identity appears, or TENANT_ADMIN is inherited.

Test 10 — Lease permission allowlist permits intended People read access and denies unrequested authority

Objective

Verify that the leased context can perform only the requested Tenant operations.

Identity and required context

Identity: Application Administrator
Login:    [email protected]
Context:  Tenant A selected through Administration context
Lease permissions:
  people.read
  reference_data.read

Preconditions

Test 09 passed.
Lease A remains approved and unexpired.
Tenant A is selected.

Procedure

In Browser Session A, verify Tenant A is selected in Administration context.
Using the ERS side navigation, click People.
Wait for the People page to finish loading.
Verify the People tenant boundary identifies Tenant A by name/code and Tenant ID. [x] Verify Tenant Support Access Lease and the expected Support Lease ID are shown.
Use the People search/filter to find a known Tenant A Person, such as the Tenant A Administrator.
Verify the matching Person can be viewed through normal UI navigation.
Inspect the page for New Person.
Verify New Person is not available because the lease does not include people.create.
Inspect the page for Add existing.
Verify the leased Application Administrator does not acquire Tenant Administrator-only Person-management authority.
If an Expenses link is visible from the page or navigation, click it through the UI.
Observe the result without using a direct internal URL.

Expected result

Tenant A People read works.
Tenant reference/status data needed by the People page loads.
Person creation is not granted.
expenses.read is not granted.
If an unauthorized Expenses link is visible, the backend denies it cleanly.
No Expense data is rendered.
No HTTP 500 occurs.

30I.3 UX observation

A visible link to an unauthorized capability may be recorded as a 30I.3 usability defect. It is a 30I.2 promotion blocker only if the operation succeeds or exposes data.

Promotion blocker

Do not promote if any Tenant authority outside Lease A's explicit permission set becomes usable.

Test 11 — Tenant A lease cannot be used against Tenant B

Objective

Verify the exact-Tenant boundary.

Identity and required context

Identity: Application Administrator
Login:    [email protected]
Approved lease Tenant: Tenant A

Preconditions

Lease A remains approved and unexpired.

Procedure

In Browser Session A, open Administration context.
Verify Tenant A is present.
Verify Tenant B is absent.
Select Global administration.
Reopen Administration context.
Select Tenant A again.
Verify Tenant B never appears during these switches.
Open DevTools → Console.
Ensure the m30i2 helper is defined.
Run:

await m30i2.api("/authz/current-actor", {
  tenantId: m30i2.TENANT_B
});

Expected result

Tenant B is not a selectable Administration context.
DevTools request returns HTTP 403.
ok = false.
payload.error.code = "tenant_actor_unavailable".
No Tenant B context or data is returned.

Promotion blocker

Do not promote if Tenant A's lease can be used against Tenant B.

Test 12 — Lease-backed Tenant context cannot satisfy GLOBAL control-plane authorization

Objective

Verify that an APPLICATION Actor operating under a Tenant Support Access Lease does not satisfy operations requiring the GLOBAL tenantId = "*" context.

Identity and required context

Identity: Application Administrator
Login:    [email protected]
Starting context: Tenant A leased Administration context

Preconditions

Lease A remains approved and unexpired.
Tenant A support context is selectable.

Procedure

In Browser Session A, open Administration context.
Select Tenant A.
Verify Tenant A is displayed as the current context.
From the existing ERS navigation, click Tenants if the link is visible.
If Authentication is visible, click it.
If Authorization is visible, click it.
[s] If Audit logs is visible, click it.
For every control-plane page attempted while Tenant A is selected, record whether ERS denied access or prevented the page from loading.
Open Administration context.
Select Global administration.
Using the same normal side navigation, open Tenants.
Open Authentication.
Verify these GLOBAL control-plane pages work again.

Expected result

While Tenant A leased context is selected:

The leased context does not satisfy GLOBAL * authorization.
No GLOBAL control-plane mutation is permitted.
No control-plane data is incorrectly exposed because the Actor happens to hold standing GLOBAL permissions.

After switching back to Global administration:

GLOBAL control-plane navigation works again.

30I.3 UX observation

Some control-plane links may remain visible because navigation presentation is not yet fully lease-aware. Record visibility as a 30I.3 UX issue unless access actually succeeds.

Promotion blocker

Do not promote if a leased Tenant context can execute an operation that requires the GLOBAL * context.

Test 13 — Lease creation/approval did not create Tenant identity records

Objective

Verify both UI presentation and database evidence that the lease did not create a Person, Membership-backed Tenant Actor, Collaborator, or Tenant Role Grant.

Identity and required context

Identity: Application Administrator
Login:    [email protected]
Context:  Global administration

Preconditions

Lease A is approved and still exists historically.
Application Administrator Actor ID/Key were recorded in Test 02.

UI procedure

In Browser Session A, open Administration context.
Select Global administration.
Using the side navigation, click Authentication.
Find [email protected].
Inspect the same Account/Actor presentation used in Test 02.
Verify the Actor ID still equals the value recorded in Test 02.
Verify the Actor Key still equals the value recorded in Test 02.
Verify no Tenant A Actor has appeared on the Account.
Verify no Person has appeared merely because a support lease was approved.

Supplemental SQL procedure

From the repository root, set the actual Lease A ID:

LEASE_ID='PASTE-LEASE-A-ID'

Run:

sqlite3 -header -column backend/data/app.db "
SELECT
    l.id AS lease_id,
    l.tenant_id,
    l.application_actor_id,
    a.actor_key,
    a.person_id AS application_actor_person_id
FROM tenant_support_access_leases l
JOIN authz_actors a
  ON a.id = l.application_actor_id
WHERE l.id = '$LEASE_ID';

SELECT
    aa.account_id,
    aa.actor_id,
    aa.scope_type,
    aa.tenant_id,
    aa.membership_id,
    aa.is_primary
FROM auth_account_actors aa
WHERE aa.actor_id = (
    SELECT application_actor_id
    FROM tenant_support_access_leases
    WHERE id = '$LEASE_ID'
)
ORDER BY aa.scope_type, aa.tenant_id;

SELECT
    r.code AS role_code,
    g.tenant_id,
    g.active,
    g.lifecycle_suspended
FROM authz_actor_role_grants g
JOIN authz_roles r
  ON r.id = g.role_id
WHERE g.actor_id = (
    SELECT application_actor_id
    FROM tenant_support_access_leases
    WHERE id = '$LEASE_ID'
)
ORDER BY g.tenant_id, r.code;
"

Expected result

Same Authentication Account.
Same GLOBAL Application Administrator Actor.
application_actor_person_id is NULL/empty.
No new TENANT Account/Actor binding for Tenant A exists.
No Tenant A Role Grant was created for the Application Administrator Actor.
The lease itself is the authorization mechanism.

Promotion blocker

Do not promote if the lease creates or requires a synthetic Tenant identity.

Test 14 — Lease listing is scope-restricted

Objective

Verify who can list Tenant Support Access Lease history.

Preconditions

Lease A exists.
Lease A belongs to Tenant A.

14A — GLOBAL Application Administrator may list Tenant A lease history

Identity and context

Identity: Application Administrator
Login:    [email protected]
Context:  Global administration

Procedure

In Browser Session A, sign in as [email protected] if necessary.
Select Global administration.
Open DevTools → Console.
Ensure the m30i2 helper is defined.
Run:

await m30i2.api(
  `/authz/support-access-leases?tenantId=${encodeURIComponent(m30i2.TENANT_A)}`,
  {
    tenantId: "*"
  }
);

Expected

HTTP 200.
Lease A is present.

14B — Tenant A Administrator may list Tenant A lease history

Identity and context

Identity: Tenant A canonical Tenant Administrator
Login:    [email protected]
Tenant:   default

Procedure

In Browser Session B, sign in as [email protected] if necessary.
Select Tenant A (default) in the ordinary Tenant selector.
Open DevTools → Console.
Ensure the m30i2 helper is defined.
Run:

await m30i2.api(
  `/authz/support-access-leases?tenantId=${encodeURIComponent(m30i2.TENANT_A)}`,
  {
    tenantId: m30i2.TENANT_A
  }
);

Expected

HTTP 200.
Lease A is present.

14C — Tenant B Administrator may not list Tenant A history

Identity and context

Identity: Tenant B canonical Tenant Administrator
Login:    [email protected]
Tenant:   e2e-authz-admin-tenant

Procedure

In Browser Session C, sign in as the Tenant B Administrator if necessary.
Select Tenant B in the ordinary Tenant selector.
Open DevTools → Console.
Ensure the m30i2 helper is defined.
Run:

await m30i2.api(
  `/authz/support-access-leases?tenantId=${encodeURIComponent(m30i2.TENANT_A)}`,
  {
    tenantId: m30i2.TENANT_B
  }
);

Expected

HTTP 403.
ok = false.
No Tenant A lease payload is returned.

Promotion blocker

Do not promote if a Tenant Administrator can list another Tenant's lease history.

Test 15 — Request and approval are visible in the authorization Audit Log Viewer

Objective

Verify that lifecycle authorization operations are visible and attributable through the UI Audit Log Viewer before termination.

Identity and required context

Identity: Application Administrator
Login:    [email protected]
Context:  Global administration

Preconditions

Lease A exists.
Lease A has been requested and approved.
Lease A ID is recorded.

Procedure

In Browser Session A, sign in as [email protected] if necessary.
Open Administration context.
Select Global administration.
Using the left-side navigation, click Audit logs.
Wait for the Audit Log Viewer to load.
In Selected Tenant ID, enter:
```
*
```
In Target type, enter:
```
tenant_support_access_lease
```
In Target ID, enter the actual Lease A ID.
Leave Decision set to All decisions.
x ] Apply the filters.
Inspect the resulting rows.

Expected result

At least these authorized lifecycle operations must be present for Lease A:

support_access_leases.request
support_access_leases.approve

Verify:

request is attributed to the Application Administrator Actor;
approval is attributed to the Tenant A Administrator Actor;
target type is tenant_support_access_lease;
target ID is Lease A ID;
the records are read-only;
Tenant provenance is present;
no unrelated lease is substituted.

Promotion blocker

Do not promote if request/approval actions are absent or attributed to the wrong Actor/Tenant.

Test 16 — Tenant B Administrator cannot terminate Tenant A's lease

Objective

Verify exact-Tenant termination authority.

Identity and required context

Identity: Tenant B canonical Tenant Administrator
Login:    [email protected]
Tenant:   e2e-authz-admin-tenant

Preconditions

Lease A remains APPROVED.
Lease A has not expired.
Lease A ID is recorded.

Procedure

In Browser Session C, sign in as:
```
[email protected]
Local-E2E-Administrator-28D!
```
if not already authenticated.
Select Tenant B in the ordinary Tenant selector.
Verify Tenant B is displayed.
Open DevTools → Console.
Ensure the m30i2 helper is defined.
Substitute the actual Lease A ID.
Run:

const LEASE_A_ID = "PASTE-LEASE-A-ID";

await m30i2.api(
  `/authz/support-access-leases/${encodeURIComponent(LEASE_A_ID)}/terminate`,
  {
    method: "POST",
    tenantId: m30i2.TENANT_B,
    body: {
      reason: "Cross-Tenant termination attempt — must be denied"
    }
  }
);

Expected result

HTTP 403.
ok = false.
payload.error.code = "forbidden".
Lease A remains APPROVED.
No HTTP 500 occurs.

Promotion blocker

Do not promote if Tenant B Administrator can terminate Tenant A's lease.

Test 17 — Tenant A Administrator terminates Lease A

Objective

Verify authorized immediate termination.

Identity and required context

Identity: Tenant A canonical Tenant Administrator
Login:    [email protected]
Tenant:   default

Preconditions

Test 16 passed.
Lease A is still APPROVED and unexpired.
Lease A ID is recorded.

Procedure

In Browser Session B, sign in as:
```
[email protected]
Local-E2E-Administrator-28D!
```
if not already authenticated.
Select Tenant A (default) in the Tenant selector.
Verify Tenant A is displayed.
Open DevTools → Console.
Ensure the m30i2 helper is defined.
Substitute the actual Lease A ID.
Run:

const LEASE_A_ID = "PASTE-LEASE-A-ID";

const leasesResult = await m30i2.api(
  `/authz/support-access-leases?tenantId=${encodeURIComponent(m30i2.TENANT_A)}&status=APPROVED`,
  {
    tenantId: m30i2.TENANT_A
  }
);

const approvedLeases = Array.isArray(leasesResult?.payload?.data)
  ? leasesResult.payload.data
  : [];

const activeLease = approvedLeases.find(
  (lease) => lease.effectiveStatus === "APPROVED"
);

if (!activeLease) {
  throw new Error(
    "No effective APPROVED Tenant A support lease was found."
  );
}

console.log("Terminating lease:", activeLease.id);

await m30i2.api(
  `/authz/support-access-leases/${encodeURIComponent(activeLease.id)}/terminate`,
  {
    method: "POST",
    tenantId: m30i2.TENANT_A,
    body: {
      reason: "Bite 30I.2 manual promotion support session complete"
    }
  }
);

Expected result

HTTP 200.
ok = true.
payload.data.status = "TERMINATED".
payload.data.effectiveStatus = "TERMINATED".
terminatedByActorId identifies the current Tenant A Administrator.

terminationReason exactly retains:

Bite 30I.2 manual promotion support session complete

Promotion blocker

Do not promote if the exact-Tenant canonical Tenant Administrator cannot terminate an approved lease.

Test 18 — Termination removes Tenant authority on the next authorization decision

Objective

Verify that termination immediately ends effective Tenant authority while preserving the Application Administrator's GLOBAL session.

Identity and required context

Identity: Application Administrator
Login:    [email protected]
Prior context: Tenant A may still be displayed from before termination

Preconditions

Test 17 terminated Lease A.
Browser Session A is still authenticated as [email protected].

Procedure

Return to Browser Session A.
Verify the signed-in account remains [email protected].
If the browser still displays Tenant A as the selected Administration context, use a normal People interaction such as changing a search/filter or refreshing the page.
Verify ERS does not continue serving newly authorized Tenant A data.
Refresh the ERS application.
Open Administration context.
Verify Global administration remains present.
Verify Tenant A no longer appears as an available support context.
Select Global administration.
Open DevTools → Console.
Ensure m30i2 is defined.
Run:

await m30i2.api("/authz/current-actor", {
  tenantId: m30i2.TENANT_A
});

Run:

await m30i2.api("/authz/current-actor", {
  tenantId: "*"
});

Expected result

Tenant A request:

HTTP 403.
payload.error.code = "tenant_actor_unavailable".

GLOBAL request:

HTTP 200.
scope = APPLICATION.
tenantId = "*".
Application Administrator session remains valid.

UI:

Tenant A support context disappears after refresh/reconciliation.
Global administration remains usable.

Promotion blocker

Do not promote if a terminated lease continues authorizing Tenant data or if termination destroys the Application Administrator's GLOBAL control-plane session.

Test 19 — Audit history contains request → approval → termination

Objective

Verify complete lifecycle auditability.

Identity and required context

Identity: Application Administrator
Login:    [email protected]
Context:  Global administration

Preconditions

Lease A was requested, approved, and terminated.
Lease A ID is recorded.

UI procedure

In Browser Session A, sign in as [email protected] if necessary.
Select Global administration.
Using the left-side navigation, click Audit logs.
Set Selected Tenant ID to:
```
*
```
Set Target type to:
```
tenant_support_access_lease
```
Set Target ID to Lease A ID.
Leave Decision = All decisions.
Apply the filters.
Inspect all rows for Lease A.

Expected UI result

The Audit Log Viewer must contain:

support_access_leases.request
support_access_leases.approve
support_access_leases.terminate

Verify:

request Actor = Application Administrator;
approval Actor = Tenant A Administrator;
termination Actor = Tenant A Administrator;
all three target the same Lease A ID;
target type = tenant_support_access_lease.

Supplemental immutable lifecycle-event check

From the repository root:

LEASE_ID='PASTE-LEASE-A-ID'

sqlite3 -header -column backend/data/app.db "
SELECT
    event_type,
    actor_id,
    occurred_at
FROM tenant_support_access_lease_events
WHERE lease_id = '$LEASE_ID'
ORDER BY occurred_at, id;
"

Expected event sequence:

REQUESTED
APPROVED
TERMINATED

Promotion blocker

Do not promote if lifecycle audit records/events are missing, mutable, or attributed to the wrong Actor.

Test 20 — Expiration removes authority without rewriting persisted APPROVED history

Objective

Verify fixed expiration and derived EXPIRED behavior.

Identities

Request:

Application Administrator
[email protected]
Global administration

Approval:

Tenant A canonical Tenant Administrator
[email protected]
Tenant default

Use Browser Session A for request/use and Browser Session B for approval.

Preconditions

Lease A has been terminated.
No other unexpired PENDING or APPROVED lease exists for the Application Administrator and Tenant A.

Step A — Request a short lease

In Browser Session A, sign in as [email protected] if necessary.
Select Global administration.
Open DevTools → Console.
Ensure the m30i2 helper is defined.
Run:

const shortLease = await m30i2.api("/authz/support-access-leases", {
  method: "POST",
  tenantId: "*",
  body: {
    tenantId: m30i2.TENANT_A,
    expiresAt: new Date(Date.now() + 3 * 60 * 1000).toISOString(),
    reason: "Bite 30I.2 manual expiration verification",
    permissions: [
      "people.read",
      "reference_data.read"
    ]
  }
});

console.log("SHORT LEASE ID:", shortLease?.payload?.data?.id);
console.log("SHORT LEASE EXPIRES:", shortLease?.payload?.data?.expiresAt);

Verify HTTP 201.
Record Short-expiration Lease ID.
Record its exact expiresAt.

Step B — Approve before expiration

In Browser Session B, sign in as [email protected] if necessary.
Select Tenant A (default).
Open DevTools → Console.
Ensure m30i2 is defined.
Substitute the Short-expiration Lease ID.
Run:

const leases = await m30i2.api(
  "/authz/support-access-leases?tenantId=" +
    encodeURIComponent(m30i2.TENANT_A) +
    "&status=APPROVED",
  {
    tenantId: m30i2.TENANT_A
  }
);

const activeLease = (Array.isArray(leases?.payload?.data)
  ? leases.payload.data
  : []
).find(function (lease) {
  return lease.effectiveStatus === "APPROVED";
});

if (!activeLease) {
  throw new Error(
    "No effective APPROVED Tenant A support lease was found."
  );
}

console.log("Terminating lease:", activeLease.id);

await m30i2.api(
  "/authz/support-access-leases/" +
    encodeURIComponent(activeLease.id) +
    "/terminate",
  {
    method: "POST",
    tenantId: m30i2.TENANT_A,
    body: {
      reason: "Bite 30I.2 manual promotion support session complete"
    }
  }
);

Verify HTTP 200.
Verify status = APPROVED.

Step C — Verify authority before expiration

Return to Browser Session A.
Refresh ERS.
Open Administration context.
Verify Tenant A appears.
Select Tenant A.
Using side navigation, open People.
Verify Tenant A People read access works.

Step D — Verify authority after the recorded expiration

After the exact expiresAt time recorded in Step A has passed:

In Browser Session A, refresh the People page or perform the next People interaction.
Verify Tenant A data is no longer newly authorized.
Refresh ERS.
Open Administration context.
Verify Tenant A no longer appears.
Select Global administration.
Open DevTools → Console.
Run:

await m30i2.api(
  `/authz/support-access-leases?tenantId=${encodeURIComponent(m30i2.TENANT_A)}&status=EXPIRED`,
  {
    tenantId: "*"
  }
);

Locate the Short-expiration Lease by its ID.

Expected result

Before expiration, approved access works.
After expiration, Tenant access no longer works.
Tenant A disappears from the support context list after reconciliation.
Historical record still has:
```
status = APPROVED
```
Historical record has:
```
effectiveStatus = EXPIRED
```
expiresAt is unchanged.
No persisted TERMINATED transition was invented merely because time passed.

Promotion blocker

Do not promote if expired access remains effective or persisted status is rewritten from APPROVED to EXPIRED.

Test 21 — Lapsed PENDING request does not permanently block a replacement request

Objective

Verify the regression that an expired/lapsed PENDING historical request no longer counts as an open conflict.

Identity and required context

Identity: Application Administrator
Login:    [email protected]
Context:  Global administration

Preconditions

Test 20's short approved lease has expired.
No other unexpired PENDING or APPROVED lease exists for Tenant A.

Step A — Create a short PENDING request and deliberately do not approve it

In Browser Session A, sign in as [email protected] if necessary.
Select Global administration.
Open DevTools → Console.
Ensure m30i2 is defined.
Run:

const pendingLease = await m30i2.api("/authz/support-access-leases", {
  method: "POST",
  tenantId: "*",
  body: {
    tenantId: m30i2.TENANT_A,
    expiresAt: new Date(Date.now() + 2 * 60 * 1000).toISOString(),
    reason: "Bite 30I.2 lapsed PENDING regression verification",
    permissions: ["people.read"]
  }
});

console.log("LAPSED-PENDING LEASE ID:", pendingLease?.payload?.data?.id);
console.log("PENDING EXPIRES:", pendingLease?.payload?.data?.expiresAt);

Verify HTTP 201.
Verify status = PENDING.
Record the Lease ID.
Record its exact expiration.

Step B — While the first request is still unexpired, verify duplicate-open conflict

Immediately run:

await m30i2.api("/authz/support-access-leases", {
  method: "POST",
  tenantId: "*",
  body: {
    tenantId: m30i2.TENANT_A,
    expiresAt: new Date(Date.now() + 10 * 60 * 1000).toISOString(),
    reason: "Duplicate open lease — must conflict",
    permissions: ["people.read"]
  }
});

Expected:

HTTP 409.
ok = false.
payload.error.code = "support_access_lease_conflict".
No second lease is created while the first is still open.

Step C — After the recorded PENDING expiration, create a replacement

After the exact expiration time from Step A has passed, run:

const replacement = await m30i2.api("/authz/support-access-leases", {
  method: "POST",
  tenantId: "*",
  body: {
    tenantId: m30i2.TENANT_A,
    expiresAt: new Date(Date.now() + 30 * 60 * 1000).toISOString(),
    reason: "Replacement after lapsed PENDING request",
    permissions: ["people.read"]
  }
});

console.log("REPLACEMENT LEASE ID:", replacement?.payload?.data?.id);

Expected result

Replacement request returns HTTP 201.
Replacement has a new, different Lease ID.
Replacement status is PENDING.
Historical lapsed PENDING lease remains stored.
The lapsed historical request no longer causes support_access_lease_conflict.

Record:

Replacement Lease ID:

Cleanup

Because the replacement is PENDING, leave it to expire naturally unless you specifically want to exercise another approval/termination cycle.

Do not manually delete lease history.

Promotion blocker

Do not promote if a lapsed PENDING lease permanently blocks later support requests.

Test 22 — Browser Console, Network, and backend-log sanity review

Objective

Verify that all expected negative-security responses were cleanly handled and that no unexpected server failures occurred during the manual suite.

Identities

Review all three browser sessions:

Session A: [email protected]
Session B: [email protected]
Session C: [email protected]

Procedure

Browser Session A

Open DevTools → Console.
Review errors generated during Tests 01–21.
Open DevTools → Network.
Review failed /api/v1/... requests.

Browser Session B

Open DevTools → Console.
Review errors generated during approval/termination tests.
Open Network.
Review failed /api/v1/... requests.

Browser Session C

Open DevTools → Console.
Review errors generated during cross-Tenant denial tests.
Open Network.
Review failed /api/v1/... requests.

Backend log

If the backend was captured to:

/tmp/ers-30i2-local-backend.log

run:

grep -Ei \
  'panic|internal API error|support_access_lease|tenant_actor_unavailable|forbidden' \
  /tmp/ers-30i2-local-backend.log

If you did not capture the backend log, review the active backend terminal output for the same categories.

Expected result

Expected negative tests may contain:

400 validation_failed
403 forbidden
403 tenant_actor_unavailable
409 support_access_lease_conflict

Those responses are PASS conditions when they occur in the tests that explicitly expect them.

Verify:

No unexpected HTTP 500.
No backend panic.
No cross-Tenant payload is returned in a denied response.
No stale Tenant business data is newly served after termination or expiration.
No unexpected React/application exception prevents the test flow.

Known browser-extension noise, such as LastPass duplicate context-menu ID errors originating from chrome-extension://..., is not an ERS defect.

Promotion blocker

Do not promote if an unexpected server 500, panic, cross-Tenant data leak, or application-breaking exception occurred.

Test 23 — Supplemental database integrity and retained-history verification

Objective

Verify relational integrity and retained lease history after the full lifecycle suite.

Required execution context

Shell: ERS repository root
Database: backend/data/app.db

No browser identity is required for this supplemental database-only verification.

Step A — Foreign-key integrity

Run:

sqlite3 backend/data/app.db "
PRAGMA foreign_key_check;
"

Expected

No rows are returned.

Step B — Review retained lease history

Run:

sqlite3 -header -column backend/data/app.db "
SELECT
    id,
    tenant_id,
    application_actor_id,
    status,
    requested_at,
    expires_at,
    approved_at,
    approved_by_actor_id,
    terminated_at,
    terminated_by_actor_id,
    termination_reason
FROM tenant_support_access_leases
ORDER BY requested_at DESC
LIMIT 30;
"

Expected

Verify the rows created by this suite:

Lease A remains present as TERMINATED.
Short-expiration approved lease remains persisted as APPROVED.
Its expiration time is historical and unchanged.
The lapsed PENDING lease remains persisted as PENDING.
Replacement PENDING lease exists unless it has since expired naturally.
No lease has:
```
tenant_id = *
```
No historical lease row was deleted to make the tests pass.

Promotion blocker

Do not promote if PRAGMA foreign_key_check returns violations or lease history has been destructively rewritten/deleted.

Promotion Gate

Bite 30I.2 is ready to promote into Bite 30I only when every applicable item below is checked.

Source and automated verification

Current tested branch is 756-bite-30i2-tenant-support-access-lease-domain-and-backendd.
Current tested SHA is recorded.
Local automated tests pass.
CI tests pass.

GLOBAL Application Administrator baseline

Application Administrator signs in through the UI.
Administration context → Global administration is explicitly selected.
No Tenant support context exists without an approved lease.
Authentication Account exposes separate Actor ID and Actor Key labels.
Application Administrator has no Tenant Person/Membership identity.

Lease request validation

authz.manage request returns expected HTTP 400 validation_failed.
Tenant * request returns expected HTTP 400 validation_failed.
Empty permission list returns expected HTTP 400 validation_failed.
A valid request returns HTTP 201.
Valid request starts PENDING.

PENDING boundary

PENDING lease is visible as history/control-plane data.
PENDING lease is not a selectable Tenant context.
PENDING lease does not authorize Tenant data.

Approval boundary

Tenant B Administrator cannot approve Tenant A's lease.
Tenant A canonical Tenant Administrator can list Tenant A request.
Tenant A canonical Tenant Administrator can approve it.
Approval does not alter permissions.
Approval does not alter expiration.

Effective authorization context

Approved Tenant A appears in Administration context.
Tenant B does not appear.
Effective Actor remains the same Actor ID recorded before the lease.
Actor scope remains APPLICATION.
supportLeaseId identifies the approved lease.
supportLeaseExpiresAt is present.
supportLeasePermissions is exactly the explicit allowlist.
No Person/Membership/Collaborator/Tenant Actor/Tenant Role Grant is synthesized.
TENANT_ADMIN is not inherited.

Permission and Tenant isolation

People read works because it was requested.
Unrequested Tenant permissions remain denied.
Tenant A lease cannot access Tenant B.
Leased Tenant context cannot satisfy GLOBAL tenantId = "*" control-plane operations.

Listing/audit

GLOBAL Application Administrator can list Tenant A lease history.
Tenant A Administrator can list Tenant A lease history.
Tenant B Administrator cannot list Tenant A lease history.
Request is present in Audit Log Viewer.
Approval is present in Audit Log Viewer.

Termination

Tenant B Administrator cannot terminate Tenant A's lease.
Tenant A Administrator can terminate it.
Termination immediately removes Tenant authority on next authorization decision.
Tenant A support context disappears after reconciliation.
GLOBAL Application Administrator session remains usable.
Termination is present in Audit Log Viewer.

Expiration

Approved access works before fixed expiration.
Access is denied after expiration.
Persisted status remains APPROVED.
Derived effective status is EXPIRED.
Expiration does not invent a persisted TERMINATED event.

Open-request conflict behavior

A duplicate request while an existing PENDING lease is unexpired returns 409 support_access_lease_conflict.
A lapsed PENDING request no longer blocks a new request.
Historical PENDING record remains retained.

Integrity

No unexpected HTTP 500.
No backend panic.
No cross-Tenant data leak.
PRAGMA foreign_key_check returns no rows.
Lease history remains retained and auditable.

Promotion-Blocking Defects

Do not promote Bite 30I.2 if any of the following occur:

Application Administrator receives standing Tenant business-data access without an approved lease.
/admin/authentication does not expose explicit Actor ID and Actor Key values for the Application Administrator.
A control-plane permission such as authz.manage can be leased.
Tenant * can be leased.
A permissionless lease can be created.
A PENDING lease authorizes Tenant access.
A PENDING lease appears as an effective Tenant context.
Tenant B Administrator can approve Tenant A's lease.
Tenant B Administrator can terminate Tenant A's lease.
Approval creates a Person, Person–Tenant Membership, Tenant Actor, Collaborator, or Tenant Role Grant.
Effective Actor ID changes from the GLOBAL Application Administrator Actor.
Effective scope becomes TENANT.
TENANT_ADMIN is inherited through the lease.
An unrequested Tenant permission works.
Tenant A's lease can authorize Tenant B.
A leased Tenant context can perform GLOBAL control-plane operations requiring tenantId = "*".
Termination does not remove Tenant authority on the next authorization decision.
Expiration does not remove Tenant authority.
Expiration rewrites the persisted APPROVED lifecycle state instead of deriving EXPIRED.
A lapsed PENDING request permanently blocks future support requests.
Request/approval/termination audit evidence is missing or misattributed.
Any unexpected HTTP 500 occurs in the lifecycle.
Any backend panic occurs.
Any cross-Tenant data is exposed after an authorization denial.
Database foreign-key integrity fails.
Lease history is deleted or destructively rewritten.

30I.3 UX follow-ups to record during 30I.2 testing

These are useful findings to carry into Bite 30I.3 and are not automatically 30I.2 blockers:

Leased Tenant context is not visibly labeled Tenant Support Access Lease.
Lease expiration is not displayed in the Administration context selector.
Lease permission scope is not displayed in the main UI.
supportLeaseId provenance is not exposed through normal UI.
Request requires DevTools.
Approval requires DevTools.
Termination requires DevTools.
A page link may remain visible when the current lease lacks its permission.
Remote termination/expiration may require the next authorization decision or refresh before selector reconciliation.
Any additional UI navigation, labeling, discoverability, confirmation, or audit-presentation issue found while executing this suite.

When recording these issues, describe the UI path used to discover them. Do not replace the UI path with an internal deep URL.

Final Promotion Record

Bite:
30I.2 — Tenant Support Access Lease Domain and Backend

Branch:
756-bite-30i2-tenant-support-access-lease-domain-and-backendd

SHA tested:
________________________________________

Local automated tests:
PASS / FAIL

CI automated tests:
PASS / FAIL

Manual Test 01:
PASS / FAIL

Manual Test 02:
PASS / FAIL

Manual Test 03:
PASS / FAIL

Manual Test 04:
PASS / FAIL

Manual Test 05:
PASS / FAIL

Manual Test 06:
PASS / FAIL

Manual Test 07:
PASS / FAIL

Manual Test 08:
PASS / FAIL

Manual Test 09:
PASS / FAIL

Manual Test 10:
PASS / FAIL

Manual Test 11:
PASS / FAIL

Manual Test 12:
PASS / FAIL

Manual Test 13:
PASS / FAIL

Manual Test 14:
PASS / FAIL

Manual Test 15:
PASS / FAIL

Manual Test 16:
PASS / FAIL

Manual Test 17:
PASS / FAIL

Manual Test 18:
PASS / FAIL

Manual Test 19:
PASS / FAIL

Manual Test 20:
PASS / FAIL

Manual Test 21:
PASS / FAIL

Manual Test 22:
PASS / FAIL

Manual Test 23:
PASS / FAIL

30I.3 UX follow-ups recorded:
YES / NO

Promotion decision:
PROMOTE / DO NOT PROMOTE

Tester:
________________________________________

Date:
________________________________________

Bite 30I.2 Manual Promotion Test Suite - RodrigoMattosoSilveira/EnterpriseRemoteSystems GitHub Wiki

Enterprise Remote Systems — Bite 30I.2 Manual Promotion Test Suite

Bite 30I.2 — Tenant Support Access Lease Domain and Backend

1. Purpose of this manual suite

2. Manual-test execution standard

3. Bite 30I.2 UX boundary

4. Required local test identities

Application Administrator

Tenant A canonical Tenant Administrator

Tenant B canonical Tenant Administrator

5. Start ERS

6. Recommended browser sessions

Browser Session A

Browser Session B

Browser Session C

7. Reusable DevTools helper

8. Test record

Test 01 — GLOBAL Application Administrator has no standing Tenant workspace

Objective

Identity and required context

Preconditions

Procedure

Expected result

Promotion blocker

Test 02 — Application Administrator Authentication Account exposes explicit Actor identity

Objective

Identity and required context

Preconditions

Procedure

Expected result

Promotion blocker

Test 03 — Invalid lease requests are rejected

Objective

Identity and required context

Preconditions

Sign-in and context procedure

03A — GLOBAL/control-plane permission cannot be leased

Expected result

03B — Wildcard * cannot be leased as a Tenant

Expected result

03C — At least one support permission is required

Expected result

Promotion blocker

Test 04 — Application Administrator requests a permission-scoped Tenant A lease

Objective

Identity and required context

Required permission set

Preconditions

Procedure

Expected result

Promotion blocker

Test 05 — PENDING lease grants no Tenant authority

Objective

Identity and required context

Preconditions

Procedure

Expected result

Promotion blocker

Test 06 — Tenant B Administrator cannot approve Tenant A's lease

Objective

Identity and required context

Preconditions

Procedure

Expected result

Promotion blocker

Test 07 — Tenant A Administrator lists and approves the exact-Tenant lease

Objective

Identity and required context

Preconditions

Procedure

Expected result

Promotion blocker

Test 08 — Approved lease becomes a selectable Administration context

Objective

Identity and required context

Preconditions

Procedure

Expected result

30I.3 UX observation

Promotion blocker

03B — Wildcard `*` cannot be leased as a Tenant