Bite 32.6.2 — Manual Promotion Test Suite - RodrigoMattosoSilveira/EnterpriseRemoteSystems GitHub Wiki

Bite 32.6.2 — Manual Promotion Test Suite

Promotion Candidate

Bite:   32.6.2 — Entity Executive Read-Only Tenant Role
Branch: 910-bite-3262-entity-executive-read-only-tenant-role
SHA:    554516e417ff7da2e1df7b3d5825df7b73ded1b3

The attached ZIP was verified to contain the exact committed SHA above.

Because all LOCAL and CI tests pass, perform the following 4 targeted manual tests before promotion.

The suite is deliberately UI-driven.

No SQL, direct API calls, DevTools commands, or manually entered application URLs are required.

Test 01 — Tenant Administrator Grants the Entity Executive Read-Only Role

Purpose

Verify that a Tenant Administrator can provision a Person with authentication and grant the new Tenant-scoped:

TENANT_VIEWER

Role entirely through the ERS UI.

Also verify that the Role is presented to users as:

Entity Executive (Read Only)

and remains distinct from the existing operator Roles.

Sign-In Identity

Name:     Mariana Alves
Role:     Tenant Administrator
Login:    [email protected]
Password: Demo-31.4-Brasil!

Required Context

Entity: Mineração Serra Dourada — DEMO
Locale: en-US

Prerequisites

Use the Brazilian demo database.

If a clean database is required:

make brazilian-demo-local-reset
make brazilian-demo-local-verify

Start the backend:

ERS_DATABASE_PATH=data/brazilian-demo.db make local-backend

Start the frontend in another terminal:

make local-frontend

√ Before starting, confirm no Person named:

Manual Executive 32.6.2

already exists.

Test Data

Create the Person using:

First name: Manual
Last name:  Executive 32.6.2
Nickname:   Executive Read Only
CPF:        32620000190
RG:         MANUAL-3262-EXEC
Cellular:   +55 11 99876-3262
Email:      [email protected]
Status:     Active

Use these authentication values if the UI requires them:

Temporary password:
Manual-32.6.2-Temp!

Permanent password:
Manual-32.6.2-Exec!

Steps

Open ERS normally.
Sign in as Mariana Alves.
Confirm the selected Entity is Mineração Serra Dourada — DEMO.
Confirm the language is English (United States).
Using the normal navigation, open People.
Select the UI action for creating a new Person.
Enter the exact test data above.
Save the Person.
Confirm creation succeeds.
Open the newly created Person through the People UI.
Locate the Authentication section.
Confirm the Person does not yet have usable authentication.
Use the UI to enable authentication.
If asked for a temporary password, enter Manual-32.6.2-Temp!.
Confirm the temporary password.
Complete the authentication-provisioning action.
Record the Authentication Account login shown by ERS.
Confirm the login is [email protected].
Confirm ERS shows the Authentication Account and Tenant Actor associated with the Person.
Using normal navigation, open Authorization.
Confirm the page heading is Tenant Authorization.
Locate Filter People / Actors.
Enter Executive Read Only.
Confirm the newly created Person/Actor appears.
Confirm the Actor belongs to Mineração Serra Dourada — DEMO.
Locate Grant a Role for this Actor.
Click the Role selector.
Confirm the selector includes TENANT_VIEWER, EARNINGS_OPERATOR, and EXPENSE_OPERATOR.
Confirm TENANT_ADMIN is not offered in this selector.
Select TENANT_VIEWER.
Confirm its user-facing presentation is Entity Executive (Read Only).
Click Grant Role.
Wait for the success confirmation.
Confirm Current Role Grants now includes TENANT_VIEWER.
Confirm the Role is associated with the correct Person and selected Entity.

Values to Record

Person:
Authentication Account login:
Actor ID or Actor Key:
Selected Entity:
Granted Role:
Displayed Role label:

Expected Results

The Person has:

ACTIVE Person
+
ACTIVE same-Entity Membership
+
Authentication Account
+
Tenant Actor
+
TENANT_VIEWER Role Grant

The Role is presented as Entity Executive (Read Only).

PASS Criteria

PASS only if the Role can be granted entirely through the normal UI and the Actor clearly shows an active TENANT_VIEWER Role Grant.

Promotion-Blocking Conditions

Block promotion if:

TENANT_VIEWER is missing from the Role selector;
TENANT_ADMIN incorrectly appears as an ordinary delegable Role;
the Role is assigned to the wrong Person or Entity;
authentication provisioning fails;
Role granting produces an unexpected authorization or validation error;
another Entity's confidential Role information is exposed.

Test 02 — Entity Executive Can Read Entity Records but Cannot Modify Them

Purpose

Verify the primary Bite 32.6.2 requirement:

An Entity Executive can inspect Entity records broadly but cannot change them.

Sign-In Identity

First sign out completely from Mariana.

Then sign in as:

Role:  Entity Executive / TENANT_VIEWER
Login: [email protected]
Initial password: Manual-32.6.2-Temp!

First-Login Password Change

If ERS requires a password change:

Complete the password-change workflow.
Set Manual-32.6.2-Exec!.
Use that password for the remaining tests.

Required Context

Entity: Mineração Serra Dourada — DEMO
Locale: en-US

Steps

A. Identity and Entity Context

Confirm sign-in succeeds.
Confirm the selected Entity is Mineração Serra Dourada — DEMO.
Confirm the executive is not placed in the global Application Administration context.
Inspect the normal navigation.

B. People

Open People.
Confirm the People list loads.
Search for Rafael.
Open Rafael's Person record.
Confirm Person details are readable.
Confirm Journey History is readable if exposed from the Person page.
Inspect the available actions.
Confirm the executive cannot perform actions such as:
- Edit Person;
- change Person lifecycle status;
- modify Authentication;
- create/remove Membership authority.

C. Collaborators and Journeys

Navigate to Collaborators.
Confirm the Collaborator list loads.
Open an active Collaborator.
Confirm the current Journey is readable.
Confirm existing earnings/payment information is readable.
Confirm Journey history is readable where available.
Confirm the executive cannot:
- create a Collaborator;
- edit assignment/payment terms;
- extend a Journey;
- close a Journey;
- perform settlement.

D. Expenses

Navigate to Expenses.
Confirm existing Expenses can be listed.
Open an existing Expense.
Confirm its details are readable.
Confirm the executive cannot:
- create an Expense;
- edit an Expense;
- cancel/delete an Expense.

E. Work Periods / Planning

Navigate to Work Periods.
Open an existing Work Period.
Confirm assignments and planning information are readable.
Confirm controls for changing planning/work data are unavailable or disabled.

F. Gold Production

Navigate to Gold Production.
Confirm existing Gold Production records are visible.
Confirm there is no usable action to:
- record new production;
- edit production;
- deactivate/delete production.

This validates the separation between gold_production.read and gold_production.manage.

G. Gold Prices

Navigate to Gold Prices.
Confirm existing Gold Price history is visible.
Confirm there is no usable action to:
- record a new Gold Price;
- replace an existing Gold Price;
- deactivate a Gold Price.

H. Reference Data

Navigate to Reference Data.
Confirm existing reference-data values are visible.
Change the visible type/filter if available.
Confirm records continue to load normally.
Confirm the executive cannot:
- create a Reference Data item;
- edit an item;
- deactivate an item;
- reactivate an item.

I. Price List

Navigate to Price List.
Confirm existing Price List records are visible.
Confirm mutation controls are unavailable.

J. Current Account

Through the normal UI, navigate to a Collaborator's Current Account.
Confirm:
- summary information is readable;
- ledger entries are readable;
- receipt information is readable where applicable.
Confirm the executive cannot perform:
- payment;
- correction;
- settlement;
- receipt lifecycle mutation.

Values to Record

People:                  readable / not readable
Collaborators:           readable / not readable
Expenses:                readable / not readable
Work Periods:            readable / not readable
Gold Production:         readable / not readable
Gold Prices:             readable / not readable
Reference Data:          readable / not readable
Price List:              readable / not readable
Current Account:         readable / not readable

Any mutation control unexpectedly enabled:

Expected Results

The Entity Executive can inspect representative business records within Mineração Serra Dourada — DEMO but cannot modify those records.

PASS Criteria

PASS only if all representative Entity records can be inspected and no tested business mutation can be initiated successfully.

Promotion-Blocking Conditions

Block promotion if:

representative Entity records required for executive oversight are inaccessible;
a mutation succeeds;
the executive receives TENANT_ADMIN-equivalent authority;
Application-level administration becomes accessible;
records belonging to another Entity are exposed;
ordinary read operations produce authorization failures.

Test 03 — Entity Executive Can Inspect Authorization and Audit State Without Administering It

Purpose

Verify that the Entity Executive can inspect security and governance information without obtaining authorization-administration authority.

Sign-In Identity

Remain signed in as:

Login: [email protected]
Role:  TENANT_VIEWER

Required Context

Entity: Mineração Serra Dourada — DEMO
Locale: en-US

Steps

A. Authorization

Open Authorization through normal navigation.
Confirm the page loads.
Confirm Tenant Actors are visible.
Locate Mariana Alves or another known Entity Actor.
Inspect the Actor's current Role Grants.
Confirm Role information is readable.
Confirm the executive cannot:
- activate an Actor;
- deactivate an Actor;
- grant TENANT_VIEWER;
- grant EARNINGS_OPERATOR;
- grant EXPENSE_OPERATOR;
- revoke an existing Role Grant.
If a Role selector is displayed for informational purposes, confirm it cannot be used to submit a Role change.

B. Authorization Audit

Navigate to Audit Logs.
Confirm the page loads.
Inspect several existing audit entries.
Use any visible filter controls.
Confirm results remain scoped to Mineração Serra Dourada — DEMO.
Confirm no other Entity identity or confidential Role information is exposed.

C. Support Access

Navigate to Support Access.
Confirm existing Support Access Lease history can be inspected if records exist.
Open a Lease or its evidence if available.
Confirm the executive cannot:
- request an Application Administrator support lease;
- approve a lease;
- terminate a lease;
- otherwise alter lease state.

D. Application Control Plane

Inspect normal navigation.
Confirm the executive does not have navigation entries for Application-level:
- Tenants administration;
- Authentication administration.
Do not manually type direct URLs. Normal UI verification is sufficient because server-side denial is already covered by passing automated authorization tests.

Values to Record

Authorization page readable:
Role Grants readable:
Actor lifecycle mutation available:
Role Grant mutation available:
Audit Logs readable:
Support Access history readable:
Application-level Tenants navigation visible:
Application-level Authentication navigation visible:

Expected Results

The Entity Executive has:

READ:
- Tenant Actors
- Tenant Role Grants
- Tenant authorization audit
- Support Access history

NO MUTATION:
- Actor lifecycle
- Role granting
- Role revocation
- Support Access approval/termination
- Application administration

PASS Criteria

PASS if authorization and audit evidence are readable while all corresponding administrative mutation capabilities remain unavailable.

Promotion-Blocking Conditions

Block promotion if:

Role Grant mutation is available;
Actor activation/deactivation is available;
Support Access lifecycle mutation is available;
Application Administration is exposed;
another Entity's confidential authorization information appears.

Test 04 — Brazilian Portuguese Presentation and Explicit Role Revocation

Purpose

Verify:

the new Role is correctly presented in pt-BR;
Bite 32.6.1 Entidade terminology is preserved;
explicit Role Grant revocation removes executive authority without damaging the underlying identity.

Phase A — Portuguese Executive Experience

Identity

Remain signed in as:

[email protected]

Steps

Change the language to Português (Brasil).
Confirm the selected Entity remains Mineração Serra Dourada — DEMO.
Confirm ERS uses Entidade rather than Locatário.
Open Authorization.
Confirm the TENANT_VIEWER user-facing Role label is Executivo da Entidade (Somente Leitura).
Navigate through the normal UI to at least:
- Pessoas;
- Colaboradores;
- Despesas;
- Produção de ouro;
- Dados de referência;
- Logs de auditoria, or the corresponding translated navigation item.
Confirm each screen remains readable.
Confirm mutation actions remain unavailable.
Confirm no untranslated semantic keys appear, such as authz.tenantRoleDelegation.tenantViewer.
Confirm the English phrase Entity Executive (Read Only) does not appear where the Portuguese Role label should be displayed.

Phase B — Revoke the Role

Sign out from the executive account.

Name:     Mariana Alves
Login:    [email protected]
Password: Demo-31.4-Brasil!

Confirm Mineração Serra Dourada — DEMO is selected.
Navigate to Authorization.
Find Executive Read Only.
Open the Actor's Current Role Grants.
Locate TENANT_VIEWER.
Use the normal UI to revoke/remove the Role Grant.
Confirm ERS reports successful revocation.
Confirm TENANT_VIEWER no longer appears as an active current Role Grant.

Phase C — Verify Executive Authority Is Gone

Sign out from Mariana.
Sign back in as [email protected].
Use the permanent password Manual-32.6.2-Exec!.
Confirm authentication still succeeds.
Observe the first permitted page after login.
Confirm the former executive no longer has Tenant-wide navigation that depended on TENANT_VIEWER.
Confirm ERS did not:
- delete the Person;
- delete the Authentication Account;
- silently restore another delegated Role;
- silently grant TENANT_ADMIN.

Values to Record

pt-BR Role label:
Any untranslated key observed:
Any Locatário wording observed:
Role revocation result:
Account still authenticates after revocation:
Tenant-wide Viewer navigation remaining after revocation:

Expected Results

Before revocation:

TENANT_VIEWER
→ Executivo da Entidade (Somente Leitura)
→ read-only Entity authority

After revocation:

Authentication Account remains
Person remains
Membership remains
TENANT_VIEWER authority disappears

PASS Criteria

PASS if the Portuguese presentation is correct and explicit Role revocation removes executive authority without deleting or disabling the underlying Person/Account identity.

Promotion-Blocking Conditions

Block promotion if:

the Portuguese Role label is incorrect;
Locatário reappears;
untranslated translation keys appear;
TENANT_VIEWER authority remains after revocation;
revocation disables or deletes the Authentication Account;
another delegated Role is silently restored or granted.

Cross-Tenant Isolation

No additional manual cross-Tenant test is required for this promotion.

TENANT_VIEWER is defined as:

scope_type = TENANT

and therefore participates automatically in the Bite 32 generic cross-Tenant delegated Role-isolation invariant.

LOCAL and CI already provide database, backend, and browser-level coverage for this behavior.

Promotion Decision

Bite 32.6.2 is ready for promotion if:

[ ] Test 01 PASS — TENANT_VIEWER can be provisioned through the UI
[ ] Test 02 PASS — executive can read Entity records but cannot mutate them
[ ] Test 03 PASS — authorization/audit data is readable but not administrable
[ ] Test 04 PASS — pt-BR presentation and explicit Role revocation behave correctly

Any successful Tenant-record mutation while authenticated solely as TENANT_VIEWER is an immediate promotion blocker.

Glossary Impact

Glossary impact: none

The previously defined Bite 32.6.2 TENANT_VIEWER glossary entry, including gold_production.read, remains unchanged.