sechmachine/labtimesheet
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

docs(test): scope calendar authorization evidence

Browse Source
This commit is contained in:
sechmachine
2026-08-15 14:36:29 +07:00
parent c8d4e9eecc
commit ef08717ce5
1 changed files with 13 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/tests/web/admin-calendar-authentication.md
+13 -3
View File
@@ -1,10 +1,20 @@
# Test Evidence: form-authenticated global calendar access
- **Test type:** Web
- **Requirement IDs:** `AUTH-001`, `AUTH-002`, `CAL-001`, `SEC-001`, `TST-001`, `TST-003`-`TST-008`
- **Scenario IDs:** `AC-CAL-003`, `AC-SEC-005`, `AC-TST-001`
- **Requirement IDs:** `AUTH-002`, `CAL-001`, `SEC-001`, `SEC-013`
- **Scenario IDs:** `AC-SEC-005`
- **Test class/method:** `com.lab.labtimesheet.feature.attendance.controller.CalendarAuthorizationWebIntegrationTest#formAuthenticatedAdminCanOpenCalendarWhileMentorAndInternAreDenied`
- **Implementation commit:** No production implementation change; this regression and its evidence are committed locally for the incident handoff.
- **Implementation commit:** `c8d4e9eecc59c78941769487af30953fb31a83c5`
## Incident scope
This record covers only the reported HTTP 403 for a fresh Admin session on
`GET /attendance/calendar`. The separately supplied 500 about policy
materialization is not a calendar-session or identity-mapping claim. It is
cross-referenced to
`.superpowers/sdd/access-navigation-icon-intern-picker/task-4-intern-dashboard-report.md`,
which independently records valid current PostgreSQL policy/constraint state
and no reproduction of that 500.
## Protected behavior