[ { "sourceId": "EMAIL-001", "variantId": "V251-EMAIL-001", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Email Integration", "role": "Firm Admin", "scenario": "Email settings page loads", "steps": "Execute GET /email/settings as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/email/settings", "variantName": "Email settings page loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "email-integration.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "EMAIL-002", "variantId": "V251-EMAIL-002", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Email Integration", "role": "Firm Admin", "scenario": "Email test settings endpoint visible/safe", "steps": "Execute GET /email/settings/test as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/email/settings/test", "variantName": "Email test settings endpoint visible/safe", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "email-integration.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "EMAIL-003", "variantId": "V251-EMAIL-003", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Email Integration", "role": "Firm Admin", "scenario": "Email logs page loads", "steps": "Execute GET /email/logs as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/email/logs", "variantName": "Email logs page loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "email-integration.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "EMAIL-004", "variantId": "V251-EMAIL-004", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Email Integration", "role": "Firm Admin", "scenario": "Email queue page loads", "steps": "Execute GET /email/queue as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/email/queue", "variantName": "Email queue page loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "email-integration.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "EMAIL-005", "variantId": "V251-EMAIL-005", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Email Integration", "role": "Firm Admin", "scenario": "Email inbox page loads", "steps": "Execute GET /email/inbox as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/email/inbox", "variantName": "Email inbox page loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "email-integration.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "EMAIL-006", "variantId": "V251-EMAIL-006", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Email Integration", "role": "Firm Admin", "scenario": "Email templates page loads", "steps": "Execute GET /email/templates as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/email/templates", "variantName": "Email templates page loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "email-integration.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "EMAIL-007", "variantId": "V251-EMAIL-007", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Email Integration", "role": "Firm Admin", "scenario": "Email template detail invalid ID safe", "steps": "Execute GET /email/templates/999999 as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/email/templates/999999", "variantName": "Email template detail invalid ID safe", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "email-integration.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "EMAIL-008", "variantId": "V251-EMAIL-008", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Email Integration", "role": "Firm Admin", "scenario": "Email inbox invalid message detail safe", "steps": "Execute GET /email/inbox/999999 as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/email/inbox/999999", "variantName": "Email inbox invalid message detail safe", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "email-integration.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "EMAIL-009", "variantId": "V251-EMAIL-009", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Email Integration", "role": "Anonymous/Attacker", "scenario": "SMTP settings CSRF-less save rejected", "steps": "Execute POST /email/settings as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/email/settings", "variantName": "SMTP settings CSRF-less save rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "POST", "_file": "email-integration.spec.js", "_login_role": null }, { "sourceId": "EMAIL-010", "variantId": "V251-EMAIL-010", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Email Integration", "role": "Anonymous/Attacker", "scenario": "SMTP test CSRF-less POST rejected", "steps": "Execute POST /email/settings/test as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/email/settings/test", "variantName": "SMTP test CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "POST", "_file": "email-integration.spec.js", "_login_role": null }, { "sourceId": "EMAIL-011", "variantId": "V251-EMAIL-011", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Email Integration", "role": "Anonymous/Attacker", "scenario": "Email queue process CSRF-less POST rejected", "steps": "Execute POST /email/queue/process as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/email/queue/process", "variantName": "Email queue process CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "POST", "_file": "email-integration.spec.js", "_login_role": null }, { "sourceId": "EMAIL-012", "variantId": "V251-EMAIL-012", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Email Integration", "role": "Anonymous/Attacker", "scenario": "Inbox fetch CSRF-less POST rejected", "steps": "Execute POST /email/inbox/fetch as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/email/inbox/fetch", "variantName": "Inbox fetch CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "POST", "_file": "email-integration.spec.js", "_login_role": null }, { "sourceId": "EMAIL-013", "variantId": "V251-EMAIL-013", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Email Integration", "role": "Anonymous/Attacker", "scenario": "Inbox map-all CSRF-less POST rejected", "steps": "Execute POST /email/inbox/map-all as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/email/inbox/map-all", "variantName": "Inbox map-all CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "POST", "_file": "email-integration.spec.js", "_login_role": null }, { "sourceId": "EMAIL-014", "variantId": "V251-EMAIL-014", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Email Integration", "role": "Anonymous/Attacker", "scenario": "Inbox message map CSRF-less POST rejected", "steps": "Execute POST /email/inbox/999999/map as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/email/inbox/999999/map", "variantName": "Inbox message map CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "POST", "_file": "email-integration.spec.js", "_login_role": null }, { "sourceId": "EMAIL-015", "variantId": "V251-EMAIL-015", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Email Integration", "role": "Anonymous/Attacker", "scenario": "Email template save CSRF-less POST rejected", "steps": "Execute POST /email/templates as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/email/templates", "variantName": "Email template save CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "POST", "_file": "email-integration.spec.js", "_login_role": null }, { "sourceId": "EMAIL-016", "variantId": "V251-EMAIL-016", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Email Integration", "role": "Anonymous/Attacker", "scenario": "Email template update invalid ID CSRF-less POST rejected", "steps": "Execute POST /email/templates/999999 as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/email/templates/999999", "variantName": "Email template update invalid ID CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "POST", "_file": "email-integration.spec.js", "_login_role": null }, { "sourceId": "EMAIL-017", "variantId": "V251-EMAIL-017", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Email Integration", "role": "Staff", "scenario": "Staff cannot access email settings", "steps": "Execute GET /email/settings as Staff and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/email/settings", "variantName": "Staff cannot access email settings", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "email-integration.spec.js", "_login_role": "Staff" }, { "sourceId": "EMAIL-018", "variantId": "V251-EMAIL-018", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Email Integration", "role": "Client", "scenario": "Client cannot access email logs", "steps": "Execute GET /email/logs as Client and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/email/logs", "variantName": "Client cannot access email logs", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "email-integration.spec.js", "_login_role": "Client" }, { "sourceId": "EMAIL-019", "variantId": "V251-EMAIL-019", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Email Integration", "role": "Consultant", "scenario": "Consultant cannot access email inbox", "steps": "Execute GET /email/inbox as Consultant and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/email/inbox", "variantName": "Consultant cannot access email inbox", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "email-integration.spec.js", "_login_role": "Consultant" }, { "sourceId": "EMAIL-020", "variantId": "V251-EMAIL-020", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Email Integration", "role": "Partner", "scenario": "Partner email queue access is blocked or safe", "steps": "Execute GET /email/queue as Partner and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/email/queue", "variantName": "Partner email queue access is blocked or safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "email-integration.spec.js", "_login_role": "Partner" }, { "sourceId": "EMAIL-021", "variantId": "V251-EMAIL-021", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Email Integration", "role": "Firm Admin", "scenario": "Invalid email attachment download does not crash", "steps": "Execute GET /email/inbox/999999/attachments/999999/download as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/email/inbox/999999/attachments/999999/download", "variantName": "Invalid email attachment download does not crash", "variantType": "positive", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "email-integration.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "EMAIL-022", "variantId": "V251-EMAIL-022", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Email Integration", "role": "Firm Admin", "scenario": "Email logs do not expose SMTP password", "steps": "Execute GET /email/logs as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/email/logs", "variantName": "Email logs do not expose SMTP password", "variantType": "security", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "email-integration.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "EMAIL-023", "variantId": "V251-EMAIL-023", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Email Integration", "role": "Firm Admin", "scenario": "Email settings page does not render SMTP password in clear text", "steps": "Execute GET /email/settings as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/email/settings", "variantName": "Email settings page does not render SMTP password in clear text", "variantType": "security", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "email-integration.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "EMAIL-024", "variantId": "V251-EMAIL-024", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Email Integration", "role": "Firm Admin", "scenario": "Email queue invalid retry action safe", "steps": "Execute GET /email/queue/999999/retry as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/email/queue/999999/retry", "variantName": "Email queue invalid retry action safe", "variantType": "positive", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "email-integration.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "EMAIL-025", "variantId": "V251-EMAIL-025", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Email Integration", "role": "Firm Admin", "scenario": "Email queue invalid delete action safe", "steps": "Execute GET /email/queue/999999/delete as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/email/queue/999999/delete", "variantName": "Email queue invalid delete action safe", "variantType": "positive", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "email-integration.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "EMAIL-026", "variantId": "V251-EMAIL-026", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Email Integration", "role": "Firm Admin", "scenario": "Email template preview invalid ID safe", "steps": "Execute GET /email/templates/999999/preview as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/email/templates/999999/preview", "variantName": "Email template preview invalid ID safe", "variantType": "positive", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "email-integration.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "MKT-001", "variantId": "V251-MKT-001", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Marketplace / Leads", "role": "Firm Admin", "scenario": "Marketplace dashboard loads", "steps": "Execute GET /marketplace as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/marketplace", "variantName": "Marketplace dashboard loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "marketplace-leads.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "MKT-002", "variantId": "V251-MKT-002", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Marketplace / Leads", "role": "Firm Admin", "scenario": "Leads list loads", "steps": "Execute GET /marketplace/leads as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/marketplace/leads", "variantName": "Leads list loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "marketplace-leads.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "MKT-003", "variantId": "V251-MKT-003", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Marketplace / Leads", "role": "Firm Admin", "scenario": "New lead page loads", "steps": "Execute GET /marketplace/leads/new as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/marketplace/leads/new", "variantName": "New lead page loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "marketplace-leads.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "MKT-004", "variantId": "V251-MKT-004", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Marketplace / Leads", "role": "Public", "scenario": "Public lead page loads without auth", "steps": "Execute GET /marketplace/public-lead as Public and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/marketplace/public-lead", "variantName": "Public lead page loads without auth", "variantType": "positive", "automation": "automated", "_kind": "public", "_method": "GET", "_file": "marketplace-leads.spec.js", "_login_role": null }, { "sourceId": "MKT-005", "variantId": "V251-MKT-005", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Marketplace / Leads", "role": "Firm Admin", "scenario": "Invalid lead detail safe", "steps": "Execute GET /marketplace/leads/999999 as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/marketplace/leads/999999", "variantName": "Invalid lead detail safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "marketplace-leads.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "MKT-006", "variantId": "V251-MKT-006", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Marketplace / Leads", "role": "Firm Admin", "scenario": "Lead assign invalid ID safe", "steps": "Execute GET /marketplace/leads/999999/assign as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/marketplace/leads/999999/assign", "variantName": "Lead assign invalid ID safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "marketplace-leads.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "MKT-007", "variantId": "V251-MKT-007", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Marketplace / Leads", "role": "Firm Admin", "scenario": "Lead status invalid ID safe", "steps": "Execute GET /marketplace/leads/999999/status as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/marketplace/leads/999999/status", "variantName": "Lead status invalid ID safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "marketplace-leads.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "MKT-008", "variantId": "V251-MKT-008", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Marketplace / Leads", "role": "Firm Admin", "scenario": "Lead convert invalid ID safe", "steps": "Execute GET /marketplace/leads/999999/convert-client as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/marketplace/leads/999999/convert-client", "variantName": "Lead convert invalid ID safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "marketplace-leads.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "MKT-009", "variantId": "V251-MKT-009", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Marketplace / Leads", "role": "Staff", "scenario": "Staff lead list access blocked or safe", "steps": "Execute GET /marketplace/leads as Staff and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/marketplace/leads", "variantName": "Staff lead list access blocked or safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "marketplace-leads.spec.js", "_login_role": "Staff" }, { "sourceId": "MKT-010", "variantId": "V251-MKT-010", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Marketplace / Leads", "role": "Client", "scenario": "Client lead list access blocked", "steps": "Execute GET /marketplace/leads as Client and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/marketplace/leads", "variantName": "Client lead list access blocked", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "marketplace-leads.spec.js", "_login_role": "Client" }, { "sourceId": "MKT-011", "variantId": "V251-MKT-011", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Marketplace / Leads", "role": "Consultant", "scenario": "Consultant internal leads access blocked", "steps": "Execute GET /marketplace/leads as Consultant and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/marketplace/leads", "variantName": "Consultant internal leads access blocked", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "marketplace-leads.spec.js", "_login_role": "Consultant" }, { "sourceId": "MKT-012", "variantId": "V251-MKT-012", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Marketplace / Leads", "role": "Public", "scenario": "Public route does not expose internal list", "steps": "Execute GET /marketplace/public-lead as Public and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/marketplace/public-lead", "variantName": "Public route does not expose internal list", "variantType": "security", "automation": "automated", "_kind": "public-no-sensitive", "_method": "GET", "_file": "marketplace-leads.spec.js", "_login_role": null }, { "sourceId": "MKT-013", "variantId": "V251-MKT-013", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Marketplace / Leads", "role": "Anonymous/Attacker", "scenario": "Public lead blank CSRF-less POST handled safely", "steps": "Execute GET /marketplace/public-lead as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/marketplace/public-lead", "variantName": "Public lead blank CSRF-less POST handled safely", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "marketplace-leads.spec.js", "_login_role": null }, { "sourceId": "MKT-014", "variantId": "V251-MKT-014", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Marketplace / Leads", "role": "Anonymous/Attacker", "scenario": "Internal lead create CSRF-less POST rejected", "steps": "Execute GET /marketplace/leads/new as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/marketplace/leads/new", "variantName": "Internal lead create CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "marketplace-leads.spec.js", "_login_role": null }, { "sourceId": "MKT-015", "variantId": "V251-MKT-015", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Marketplace / Leads", "role": "Anonymous/Attacker", "scenario": "Lead assign CSRF-less POST rejected", "steps": "Execute GET /marketplace/leads/999999/assign as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/marketplace/leads/999999/assign", "variantName": "Lead assign CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "marketplace-leads.spec.js", "_login_role": null }, { "sourceId": "MKT-016", "variantId": "V251-MKT-016", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Marketplace / Leads", "role": "Anonymous/Attacker", "scenario": "Lead status CSRF-less POST rejected", "steps": "Execute GET /marketplace/leads/999999/status as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/marketplace/leads/999999/status", "variantName": "Lead status CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "marketplace-leads.spec.js", "_login_role": null }, { "sourceId": "MKT-017", "variantId": "V251-MKT-017", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Marketplace / Leads", "role": "Anonymous/Attacker", "scenario": "Lead convert-client CSRF-less POST rejected", "steps": "Execute GET /marketplace/leads/999999/convert-client as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/marketplace/leads/999999/convert-client", "variantName": "Lead convert-client CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "marketplace-leads.spec.js", "_login_role": null }, { "sourceId": "MKT-018", "variantId": "V251-MKT-018", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Marketplace / Leads", "role": "Anonymous/Attacker", "scenario": "Lead duplicate check invalid POST safe", "steps": "Execute GET /marketplace/leads/check-duplicate as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/marketplace/leads/check-duplicate", "variantName": "Lead duplicate check invalid POST safe", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "marketplace-leads.spec.js", "_login_role": null }, { "sourceId": "MKT-019", "variantId": "V251-MKT-019", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Marketplace / Leads", "role": "Anonymous/Attacker", "scenario": "Lead note add CSRF-less POST rejected", "steps": "Execute GET /marketplace/leads/999999/notes as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/marketplace/leads/999999/notes", "variantName": "Lead note add CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "marketplace-leads.spec.js", "_login_role": null }, { "sourceId": "MKT-020", "variantId": "V251-MKT-020", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Marketplace / Leads", "role": "Anonymous/Attacker", "scenario": "Lead attachment upload CSRF-less POST rejected", "steps": "Execute GET /marketplace/leads/999999/upload as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/marketplace/leads/999999/upload", "variantName": "Lead attachment upload CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "marketplace-leads.spec.js", "_login_role": null }, { "sourceId": "MKT-021", "variantId": "V251-MKT-021", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Marketplace / Leads", "role": "Anonymous/Attacker", "scenario": "Cross-tenant lead probe safe", "steps": "Execute GET /marketplace/leads/999999?tenant_id=999999 as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/marketplace/leads/999999?tenant_id=999999", "variantName": "Cross-tenant lead probe safe", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "marketplace-leads.spec.js", "_login_role": null }, { "sourceId": "MKT-022", "variantId": "V251-MKT-022", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Marketplace / Leads", "role": "Anonymous/Attacker", "scenario": "Lead export requires authorization", "steps": "Execute GET /marketplace/leads/export as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/marketplace/leads/export", "variantName": "Lead export requires authorization", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "marketplace-leads.spec.js", "_login_role": null }, { "sourceId": "PBILL-001", "variantId": "V251-PBILL-001", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Platform Billing", "role": "System Admin", "scenario": "Plans page loads", "steps": "Execute GET /platform-billing/plans as System Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/platform-billing/plans", "variantName": "Plans page loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "platform-billing.spec.js", "_login_role": "System Admin" }, { "sourceId": "PBILL-002", "variantId": "V251-PBILL-002", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Platform Billing", "role": "System Admin", "scenario": "Accounts page loads", "steps": "Execute GET /platform-billing/accounts as System Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/platform-billing/accounts", "variantName": "Accounts page loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "platform-billing.spec.js", "_login_role": "System Admin" }, { "sourceId": "PBILL-003", "variantId": "V251-PBILL-003", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Platform Billing", "role": "System Admin", "scenario": "Audit firm subscriptions page loads", "steps": "Execute GET /platform-billing/audit-firm-subscriptions as System Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/platform-billing/audit-firm-subscriptions", "variantName": "Audit firm subscriptions page loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "platform-billing.spec.js", "_login_role": "System Admin" }, { "sourceId": "PBILL-004", "variantId": "V251-PBILL-004", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Platform Billing", "role": "System Admin", "scenario": "Client dashboard subscriptions page loads", "steps": "Execute GET /platform-billing/client-dashboard-subscriptions as System Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/platform-billing/client-dashboard-subscriptions", "variantName": "Client dashboard subscriptions page loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "platform-billing.spec.js", "_login_role": "System Admin" }, { "sourceId": "PBILL-005", "variantId": "V251-PBILL-005", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Platform Billing", "role": "System Admin", "scenario": "Consultant subscriptions page loads", "steps": "Execute GET /platform-billing/consultant-subscriptions as System Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/platform-billing/consultant-subscriptions", "variantName": "Consultant subscriptions page loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "platform-billing.spec.js", "_login_role": "System Admin" }, { "sourceId": "PBILL-006", "variantId": "V251-PBILL-006", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Platform Billing", "role": "System Admin", "scenario": "Subscriptions page loads", "steps": "Execute GET /platform-billing/subscriptions as System Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/platform-billing/subscriptions", "variantName": "Subscriptions page loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "platform-billing.spec.js", "_login_role": "System Admin" }, { "sourceId": "PBILL-007", "variantId": "V251-PBILL-007", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Platform Billing", "role": "System Admin", "scenario": "Invoices page loads", "steps": "Execute GET /platform-billing/invoices as System Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/platform-billing/invoices", "variantName": "Invoices page loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "platform-billing.spec.js", "_login_role": "System Admin" }, { "sourceId": "PBILL-008", "variantId": "V251-PBILL-008", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Platform Billing", "role": "System Admin", "scenario": "Invalid invoice detail/post safe", "steps": "Execute GET /platform-billing/invoices/999999/post as System Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/platform-billing/invoices/999999/post", "variantName": "Invalid invoice detail/post safe", "variantType": "positive", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "platform-billing.spec.js", "_login_role": "System Admin" }, { "sourceId": "PBILL-009", "variantId": "V251-PBILL-009", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Platform Billing", "role": "System Admin", "scenario": "Invalid invoice payments safe", "steps": "Execute GET /platform-billing/invoices/999999/payments as System Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/platform-billing/invoices/999999/payments", "variantName": "Invalid invoice payments safe", "variantType": "positive", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "platform-billing.spec.js", "_login_role": "System Admin" }, { "sourceId": "PBILL-010", "variantId": "V251-PBILL-010", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Platform Billing", "role": "System Admin", "scenario": "Invalid plan detail safe", "steps": "Execute GET /platform-billing/plans/999999 as System Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/platform-billing/plans/999999", "variantName": "Invalid plan detail safe", "variantType": "positive", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "platform-billing.spec.js", "_login_role": "System Admin" }, { "sourceId": "PBILL-011", "variantId": "V251-PBILL-011", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Platform Billing", "role": "Firm", "scenario": "Firm Admin cannot manage platform plans", "steps": "Execute GET /platform-billing/plans as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/platform-billing/plans", "variantName": "Firm Admin cannot manage platform plans", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "platform-billing.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "PBILL-012", "variantId": "V251-PBILL-012", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Platform Billing", "role": "Staff", "scenario": "Staff cannot access platform accounts", "steps": "Execute GET /platform-billing/accounts as Staff and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/platform-billing/accounts", "variantName": "Staff cannot access platform accounts", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "platform-billing.spec.js", "_login_role": "Staff" }, { "sourceId": "PBILL-013", "variantId": "V251-PBILL-013", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Platform Billing", "role": "Client", "scenario": "Client cannot access platform invoices list", "steps": "Execute GET /platform-billing/invoices as Client and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/platform-billing/invoices", "variantName": "Client cannot access platform invoices list", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "platform-billing.spec.js", "_login_role": "Client" }, { "sourceId": "PBILL-014", "variantId": "V251-PBILL-014", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Platform Billing", "role": "Consultant", "scenario": "Consultant cannot access platform invoice list", "steps": "Execute GET /platform-billing/invoices as Consultant and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/platform-billing/invoices", "variantName": "Consultant cannot access platform invoice list", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "platform-billing.spec.js", "_login_role": "Consultant" }, { "sourceId": "PBILL-015", "variantId": "V251-PBILL-015", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Platform Billing", "role": "Partner", "scenario": "Partner cannot post platform invoice", "steps": "Execute GET /platform-billing/invoices/999999/post as Partner and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/platform-billing/invoices/999999/post", "variantName": "Partner cannot post platform invoice", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "platform-billing.spec.js", "_login_role": "Partner" }, { "sourceId": "PBILL-016", "variantId": "V251-PBILL-016", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Platform Billing", "role": "Anonymous/Attacker", "scenario": "Plan create CSRF-less POST rejected", "steps": "Execute GET /platform-billing/plans as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/platform-billing/plans", "variantName": "Plan create CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "platform-billing.spec.js", "_login_role": null }, { "sourceId": "PBILL-017", "variantId": "V251-PBILL-017", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Platform Billing", "role": "Anonymous/Attacker", "scenario": "Plan update invalid ID CSRF-less POST rejected", "steps": "Execute GET /platform-billing/plans/999999 as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/platform-billing/plans/999999", "variantName": "Plan update invalid ID CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "platform-billing.spec.js", "_login_role": null }, { "sourceId": "PBILL-018", "variantId": "V251-PBILL-018", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Platform Billing", "role": "Anonymous/Attacker", "scenario": "Account create CSRF-less POST rejected", "steps": "Execute GET /platform-billing/accounts as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/platform-billing/accounts", "variantName": "Account create CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "platform-billing.spec.js", "_login_role": null }, { "sourceId": "PBILL-019", "variantId": "V251-PBILL-019", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Platform Billing", "role": "Anonymous/Attacker", "scenario": "Audit firm subscription create CSRF-less POST rejected", "steps": "Execute GET /platform-billing/audit-firm-subscriptions as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/platform-billing/audit-firm-subscriptions", "variantName": "Audit firm subscription create CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "platform-billing.spec.js", "_login_role": null }, { "sourceId": "PBILL-020", "variantId": "V251-PBILL-020", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Platform Billing", "role": "Anonymous/Attacker", "scenario": "Client dashboard subscription create CSRF-less POST rejected", "steps": "Execute GET /platform-billing/client-dashboard-subscriptions as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/platform-billing/client-dashboard-subscriptions", "variantName": "Client dashboard subscription create CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "platform-billing.spec.js", "_login_role": null }, { "sourceId": "PBILL-021", "variantId": "V251-PBILL-021", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Platform Billing", "role": "Anonymous/Attacker", "scenario": "Consultant subscription create CSRF-less POST rejected", "steps": "Execute GET /platform-billing/consultant-subscriptions as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/platform-billing/consultant-subscriptions", "variantName": "Consultant subscription create CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "platform-billing.spec.js", "_login_role": null }, { "sourceId": "PBILL-022", "variantId": "V251-PBILL-022", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Platform Billing", "role": "Anonymous/Attacker", "scenario": "Platform subscription create CSRF-less POST rejected", "steps": "Execute GET /platform-billing/subscriptions as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/platform-billing/subscriptions", "variantName": "Platform subscription create CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "platform-billing.spec.js", "_login_role": null }, { "sourceId": "PBILL-023", "variantId": "V251-PBILL-023", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Platform Billing", "role": "Anonymous/Attacker", "scenario": "Invoice create CSRF-less POST rejected", "steps": "Execute GET /platform-billing/invoices as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/platform-billing/invoices", "variantName": "Invoice create CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "platform-billing.spec.js", "_login_role": null }, { "sourceId": "PBILL-024", "variantId": "V251-PBILL-024", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Platform Billing", "role": "Anonymous/Attacker", "scenario": "Invoice post CSRF-less POST rejected", "steps": "Execute GET /platform-billing/invoices/999999/post as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/platform-billing/invoices/999999/post", "variantName": "Invoice post CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "platform-billing.spec.js", "_login_role": null }, { "sourceId": "PBILL-025", "variantId": "V251-PBILL-025", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Platform Billing", "role": "Anonymous/Attacker", "scenario": "Invoice payment CSRF-less POST rejected", "steps": "Execute GET /platform-billing/invoices/999999/payments as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/platform-billing/invoices/999999/payments", "variantName": "Invoice payment CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "platform-billing.spec.js", "_login_role": null }, { "sourceId": "PBILL-026", "variantId": "V251-PBILL-026", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Platform Billing", "role": "Anonymous/Attacker", "scenario": "Invoice cancel CSRF-less POST rejected", "steps": "Execute GET /platform-billing/invoices/999999/cancel as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/platform-billing/invoices/999999/cancel", "variantName": "Invoice cancel CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "platform-billing.spec.js", "_login_role": null }, { "sourceId": "PBILL-027", "variantId": "V251-PBILL-027", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Platform Billing", "role": "Anonymous/Attacker", "scenario": "Payment over-amount invalid POST safe", "steps": "Execute GET /platform-billing/invoices/999999/payments as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/platform-billing/invoices/999999/payments", "variantName": "Payment over-amount invalid POST safe", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "platform-billing.spec.js", "_login_role": null }, { "sourceId": "PBILL-028", "variantId": "V251-PBILL-028", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Platform Billing", "role": "Anonymous/Attacker", "scenario": "Duplicate plan code invalid POST safe", "steps": "Execute GET /platform-billing/plans as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/platform-billing/plans", "variantName": "Duplicate plan code invalid POST safe", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "platform-billing.spec.js", "_login_role": null }, { "sourceId": "PBILL-029", "variantId": "V251-PBILL-029", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Platform Billing", "role": "Anonymous/Attacker", "scenario": "Duplicate invoice number invalid POST safe", "steps": "Execute GET /platform-billing/invoices as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/platform-billing/invoices", "variantName": "Duplicate invoice number invalid POST safe", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "platform-billing.spec.js", "_login_role": null }, { "sourceId": "PBILL-030", "variantId": "V251-PBILL-030", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Platform Billing", "role": "Anonymous/Attacker", "scenario": "Invoice export requires auth", "steps": "Execute GET /platform-billing/invoices/export as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/platform-billing/invoices/export", "variantName": "Invoice export requires auth", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "platform-billing.spec.js", "_login_role": null }, { "sourceId": "PBILL-031", "variantId": "V251-PBILL-031", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Platform Billing", "role": "Anonymous/Attacker", "scenario": "Invoice PDF invalid ID safe", "steps": "Execute GET /platform-billing/invoices/999999/pdf as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/platform-billing/invoices/999999/pdf", "variantName": "Invoice PDF invalid ID safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "platform-billing.spec.js", "_login_role": null }, { "sourceId": "PBILL-032", "variantId": "V251-PBILL-032", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Platform Billing", "role": "Anonymous/Attacker", "scenario": "Cross-account invoice IDOR blocked", "steps": "Execute GET /platform-billing/invoices/999999?account_id=999999 as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/platform-billing/invoices/999999?account_id=999999", "variantName": "Cross-account invoice IDOR blocked", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "platform-billing.spec.js", "_login_role": null }, { "sourceId": "PBILL-033", "variantId": "V251-PBILL-033", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Platform Billing", "role": "Anonymous/Attacker", "scenario": "Payment receipt invalid ID safe", "steps": "Execute GET /platform-billing/payments/999999/receipt as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/platform-billing/payments/999999/receipt", "variantName": "Payment receipt invalid ID safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "platform-billing.spec.js", "_login_role": null }, { "sourceId": "PBILL-034", "variantId": "V251-PBILL-034", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Platform Billing", "role": "Anonymous/Attacker", "scenario": "Billing account delete CSRF-less POST rejected", "steps": "Execute GET /platform-billing/accounts/999999/delete as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/platform-billing/accounts/999999/delete", "variantName": "Billing account delete CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "platform-billing.spec.js", "_login_role": null }, { "sourceId": "PBILL-035", "variantId": "V251-PBILL-035", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Platform Billing", "role": "Anonymous/Attacker", "scenario": "Plan delete CSRF-less POST rejected", "steps": "Execute GET /platform-billing/plans/999999/delete as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/platform-billing/plans/999999/delete", "variantName": "Plan delete CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "platform-billing.spec.js", "_login_role": null }, { "sourceId": "SYS-001", "variantId": "V251-SYS-001", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "System Settings / Tenancy / FY", "role": "System Admin", "scenario": "Tenants page loads", "steps": "Execute GET /system-settings/tenants as System Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/system-settings/tenants", "variantName": "Tenants page loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "system-settings-tenancy.spec.js", "_login_role": "System Admin" }, { "sourceId": "SYS-002", "variantId": "V251-SYS-002", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "System Settings / Tenancy / FY", "role": "System Admin", "scenario": "Branches page loads", "steps": "Execute GET /system-settings/branches as System Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/system-settings/branches", "variantName": "Branches page loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "system-settings-tenancy.spec.js", "_login_role": "System Admin" }, { "sourceId": "SYS-003", "variantId": "V251-SYS-003", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "System Settings / Tenancy / FY", "role": "System Admin", "scenario": "Branding page loads", "steps": "Execute GET /system-settings/branding as System Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/system-settings/branding", "variantName": "Branding page loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "system-settings-tenancy.spec.js", "_login_role": "System Admin" }, { "sourceId": "SYS-004", "variantId": "V251-SYS-004", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "System Settings / Tenancy / FY", "role": "System Admin", "scenario": "Financial years page loads", "steps": "Execute GET /system-settings/financial-years as System Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/system-settings/financial-years", "variantName": "Financial years page loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "system-settings-tenancy.spec.js", "_login_role": "System Admin" }, { "sourceId": "SYS-005", "variantId": "V251-SYS-005", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "System Settings / Tenancy / FY", "role": "System Admin", "scenario": "RBAC page loads", "steps": "Execute GET /system-settings/rbac as System Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/system-settings/rbac", "variantName": "RBAC page loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "system-settings-tenancy.spec.js", "_login_role": "System Admin" }, { "sourceId": "SYS-006", "variantId": "V251-SYS-006", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "System Settings / Tenancy / FY", "role": "System Admin", "scenario": "Roles page loads", "steps": "Execute GET /system-settings/rbac/roles as System Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/system-settings/rbac/roles", "variantName": "Roles page loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "system-settings-tenancy.spec.js", "_login_role": "System Admin" }, { "sourceId": "SYS-007", "variantId": "V251-SYS-007", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "System Settings / Tenancy / FY", "role": "System Admin", "scenario": "Permissions page loads", "steps": "Execute GET /system-settings/rbac/permissions as System Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/system-settings/rbac/permissions", "variantName": "Permissions page loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "system-settings-tenancy.spec.js", "_login_role": "System Admin" }, { "sourceId": "SYS-008", "variantId": "V251-SYS-008", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "System Settings / Tenancy / FY", "role": "System Admin", "scenario": "Audit logs page loads", "steps": "Execute GET /system-settings/audit-logs as System Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/system-settings/audit-logs", "variantName": "Audit logs page loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "system-settings-tenancy.spec.js", "_login_role": "System Admin" }, { "sourceId": "SYS-009", "variantId": "V251-SYS-009", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "System Settings / Tenancy / FY", "role": "System Admin", "scenario": "Invalid tenant context switch safe", "steps": "Execute GET /system-settings/context/tenant/999999 as System Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/system-settings/context/tenant/999999", "variantName": "Invalid tenant context switch safe", "variantType": "positive", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "system-settings-tenancy.spec.js", "_login_role": "System Admin" }, { "sourceId": "SYS-010", "variantId": "V251-SYS-010", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "System Settings / Tenancy / FY", "role": "System Admin", "scenario": "Invalid branch context switch safe", "steps": "Execute GET /system-settings/context/branch/999999 as System Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/system-settings/context/branch/999999", "variantName": "Invalid branch context switch safe", "variantType": "positive", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "system-settings-tenancy.spec.js", "_login_role": "System Admin" }, { "sourceId": "SYS-011", "variantId": "V251-SYS-011", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "System Settings / Tenancy / FY", "role": "System Admin", "scenario": "Invalid financial year context switch safe", "steps": "Execute GET /system-settings/context/financial-year/INVALID as System Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/system-settings/context/financial-year/INVALID", "variantName": "Invalid financial year context switch safe", "variantType": "positive", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "system-settings-tenancy.spec.js", "_login_role": "System Admin" }, { "sourceId": "SYS-012", "variantId": "V251-SYS-012", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "System Settings / Tenancy / FY", "role": "System Admin", "scenario": "FY backup export page/action safe", "steps": "Execute GET /system-settings/financial-years/backup-export as System Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/system-settings/financial-years/backup-export", "variantName": "FY backup export page/action safe", "variantType": "positive", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "system-settings-tenancy.spec.js", "_login_role": "System Admin" }, { "sourceId": "SYS-013", "variantId": "V251-SYS-013", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "System Settings / Tenancy / FY", "role": "Staff", "scenario": "Staff cannot access tenants", "steps": "Execute GET /system-settings/tenants as Staff and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/system-settings/tenants", "variantName": "Staff cannot access tenants", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "system-settings-tenancy.spec.js", "_login_role": "Staff" }, { "sourceId": "SYS-014", "variantId": "V251-SYS-014", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "System Settings / Tenancy / FY", "role": "Client", "scenario": "Client cannot access branches", "steps": "Execute GET /system-settings/branches as Client and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/system-settings/branches", "variantName": "Client cannot access branches", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "system-settings-tenancy.spec.js", "_login_role": "Client" }, { "sourceId": "SYS-015", "variantId": "V251-SYS-015", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "System Settings / Tenancy / FY", "role": "Consultant", "scenario": "Consultant cannot access financial years", "steps": "Execute GET /system-settings/financial-years as Consultant and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/system-settings/financial-years", "variantName": "Consultant cannot access financial years", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "system-settings-tenancy.spec.js", "_login_role": "Consultant" }, { "sourceId": "SYS-016", "variantId": "V251-SYS-016", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "System Settings / Tenancy / FY", "role": "Partner", "scenario": "Partner cannot manage RBAC roles unless permitted", "steps": "Execute GET /system-settings/rbac/roles as Partner and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/system-settings/rbac/roles", "variantName": "Partner cannot manage RBAC roles unless permitted", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "system-settings-tenancy.spec.js", "_login_role": "Partner" }, { "sourceId": "SYS-017", "variantId": "V251-SYS-017", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "System Settings / Tenancy / FY", "role": "Manager", "scenario": "Manager cannot switch unauthorized tenant", "steps": "Execute GET /system-settings/context/tenant/999999 as Manager and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/system-settings/context/tenant/999999", "variantName": "Manager cannot switch unauthorized tenant", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "system-settings-tenancy.spec.js", "_login_role": "Manager" }, { "sourceId": "SYS-018", "variantId": "V251-SYS-018", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "System Settings / Tenancy / FY", "role": "Firm Admin", "scenario": "Firm Admin cannot switch to unauthorized branch", "steps": "Execute GET /system-settings/context/branch/999999 as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/system-settings/context/branch/999999", "variantName": "Firm Admin cannot switch to unauthorized branch", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "system-settings-tenancy.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "SYS-019", "variantId": "V251-SYS-019", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "System Settings / Tenancy / FY", "role": "Anonymous/Attacker", "scenario": "Tenant create CSRF-less POST rejected", "steps": "Execute GET /system-settings/tenants as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/system-settings/tenants", "variantName": "Tenant create CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "system-settings-tenancy.spec.js", "_login_role": null }, { "sourceId": "SYS-020", "variantId": "V251-SYS-020", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "System Settings / Tenancy / FY", "role": "Anonymous/Attacker", "scenario": "Tenant update invalid ID CSRF-less POST rejected", "steps": "Execute GET /system-settings/tenants/999999 as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/system-settings/tenants/999999", "variantName": "Tenant update invalid ID CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "system-settings-tenancy.spec.js", "_login_role": null }, { "sourceId": "SYS-021", "variantId": "V251-SYS-021", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "System Settings / Tenancy / FY", "role": "Anonymous/Attacker", "scenario": "Branch create CSRF-less POST rejected", "steps": "Execute GET /system-settings/branches as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/system-settings/branches", "variantName": "Branch create CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "system-settings-tenancy.spec.js", "_login_role": null }, { "sourceId": "SYS-022", "variantId": "V251-SYS-022", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "System Settings / Tenancy / FY", "role": "Anonymous/Attacker", "scenario": "Branch update invalid ID CSRF-less POST rejected", "steps": "Execute GET /system-settings/branches/999999 as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/system-settings/branches/999999", "variantName": "Branch update invalid ID CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "system-settings-tenancy.spec.js", "_login_role": null }, { "sourceId": "SYS-023", "variantId": "V251-SYS-023", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "System Settings / Tenancy / FY", "role": "Anonymous/Attacker", "scenario": "Branding save CSRF-less POST rejected", "steps": "Execute GET /system-settings/branding as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/system-settings/branding", "variantName": "Branding save CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "system-settings-tenancy.spec.js", "_login_role": null }, { "sourceId": "SYS-024", "variantId": "V251-SYS-024", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "System Settings / Tenancy / FY", "role": "Anonymous/Attacker", "scenario": "Financial year create CSRF-less POST rejected", "steps": "Execute GET /system-settings/financial-years as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/system-settings/financial-years", "variantName": "Financial year create CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "system-settings-tenancy.spec.js", "_login_role": null }, { "sourceId": "SYS-025", "variantId": "V251-SYS-025", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "System Settings / Tenancy / FY", "role": "Anonymous/Attacker", "scenario": "Make current FY CSRF-less POST rejected", "steps": "Execute GET /system-settings/financial-years/999999/make-current as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/system-settings/financial-years/999999/make-current", "variantName": "Make current FY CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "system-settings-tenancy.spec.js", "_login_role": null }, { "sourceId": "SYS-026", "variantId": "V251-SYS-026", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "System Settings / Tenancy / FY", "role": "Anonymous/Attacker", "scenario": "Lock FY CSRF-less POST rejected", "steps": "Execute GET /system-settings/financial-years/999999/lock as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/system-settings/financial-years/999999/lock", "variantName": "Lock FY CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "system-settings-tenancy.spec.js", "_login_role": null }, { "sourceId": "SYS-027", "variantId": "V251-SYS-027", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "System Settings / Tenancy / FY", "role": "Anonymous/Attacker", "scenario": "Unlock FY CSRF-less POST rejected", "steps": "Execute GET /system-settings/financial-years/999999/unlock as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/system-settings/financial-years/999999/unlock", "variantName": "Unlock FY CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "system-settings-tenancy.spec.js", "_login_role": null }, { "sourceId": "SYS-028", "variantId": "V251-SYS-028", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "System Settings / Tenancy / FY", "role": "Anonymous/Attacker", "scenario": "FY backup export CSRF-less POST rejected", "steps": "Execute GET /system-settings/financial-years/999999/backup-export as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/system-settings/financial-years/999999/backup-export", "variantName": "FY backup export CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "system-settings-tenancy.spec.js", "_login_role": null }, { "sourceId": "SYS-029", "variantId": "V251-SYS-029", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "System Settings / Tenancy / FY", "role": "Anonymous/Attacker", "scenario": "FY backup download invalid ID safe", "steps": "Execute GET /system-settings/financial-years/backups/999999/download as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/system-settings/financial-years/backups/999999/download", "variantName": "FY backup download invalid ID safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "system-settings-tenancy.spec.js", "_login_role": null }, { "sourceId": "SYS-030", "variantId": "V251-SYS-030", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "System Settings / Tenancy / FY", "role": "Anonymous/Attacker", "scenario": "Role create CSRF-less POST rejected", "steps": "Execute GET /system-settings/rbac/roles as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/system-settings/rbac/roles", "variantName": "Role create CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "system-settings-tenancy.spec.js", "_login_role": null }, { "sourceId": "SYS-031", "variantId": "V251-SYS-031", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "System Settings / Tenancy / FY", "role": "Anonymous/Attacker", "scenario": "Role update invalid ID CSRF-less POST rejected", "steps": "Execute GET /system-settings/rbac/roles/999999 as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/system-settings/rbac/roles/999999", "variantName": "Role update invalid ID CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "system-settings-tenancy.spec.js", "_login_role": null }, { "sourceId": "SYS-032", "variantId": "V251-SYS-032", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "System Settings / Tenancy / FY", "role": "Anonymous/Attacker", "scenario": "Permission assign CSRF-less POST rejected", "steps": "Execute GET /system-settings/rbac/roles/999999/permissions as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/system-settings/rbac/roles/999999/permissions", "variantName": "Permission assign CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "system-settings-tenancy.spec.js", "_login_role": null }, { "sourceId": "SYS-033", "variantId": "V251-SYS-033", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "System Settings / Tenancy / FY", "role": "Anonymous/Attacker", "scenario": "Permission remove CSRF-less POST rejected", "steps": "Execute GET /system-settings/rbac/roles/999999/permissions/999999/remove as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/system-settings/rbac/roles/999999/permissions/999999/remove", "variantName": "Permission remove CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "system-settings-tenancy.spec.js", "_login_role": null }, { "sourceId": "SYS-034", "variantId": "V251-SYS-034", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "System Settings / Tenancy / FY", "role": "Anonymous/Attacker", "scenario": "Duplicate role invalid POST safe", "steps": "Execute GET /system-settings/rbac/roles as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/system-settings/rbac/roles", "variantName": "Duplicate role invalid POST safe", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "system-settings-tenancy.spec.js", "_login_role": null }, { "sourceId": "SYS-035", "variantId": "V251-SYS-035", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "System Settings / Tenancy / FY", "role": "Anonymous/Attacker", "scenario": "Unauthorized branch context query safe", "steps": "Execute GET /system-settings/context/branch/999999?tenant_id=999999 as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/system-settings/context/branch/999999?tenant_id=999999", "variantName": "Unauthorized branch context query safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "system-settings-tenancy.spec.js", "_login_role": null }, { "sourceId": "SYS-036", "variantId": "V251-SYS-036", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "System Settings / Tenancy / FY", "role": "Anonymous/Attacker", "scenario": "Audit log export requires authorization", "steps": "Execute GET /system-settings/audit-logs/export as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/system-settings/audit-logs/export", "variantName": "Audit log export requires authorization", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "system-settings-tenancy.spec.js", "_login_role": null }, { "sourceId": "API-001", "variantId": "V251-API-001", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "API Auth / RBAC", "role": "API/Anonymous", "scenario": "API auth token rejects blank credentials", "steps": "Execute POST /api/auth/token as API/Anonymous and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/api/auth/token", "variantName": "API auth token rejects blank credentials", "variantType": "security", "automation": "automated", "_kind": "api", "_method": "POST", "_file": "api-auth-rbac.spec.js", "_login_role": null }, { "sourceId": "API-002", "variantId": "V251-API-002", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "API Auth / RBAC", "role": "API/Anonymous", "scenario": "API refresh rejects missing refresh token", "steps": "Execute POST /api/auth/refresh as API/Anonymous and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/api/auth/refresh", "variantName": "API refresh rejects missing refresh token", "variantType": "security", "automation": "automated", "_kind": "api", "_method": "POST", "_file": "api-auth-rbac.spec.js", "_login_role": null }, { "sourceId": "API-003", "variantId": "V251-API-003", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "API Auth / RBAC", "role": "API/Anonymous", "scenario": "API logout without token handled safely", "steps": "Execute POST /api/auth/logout as API/Anonymous and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/api/auth/logout", "variantName": "API logout without token handled safely", "variantType": "security", "automation": "automated", "_kind": "api", "_method": "POST", "_file": "api-auth-rbac.spec.js", "_login_role": null }, { "sourceId": "API-004", "variantId": "V251-API-004", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "API Auth / RBAC", "role": "API/Anonymous", "scenario": "API me requires authentication", "steps": "Execute GET /api/auth/me as API/Anonymous and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/api/auth/me", "variantName": "API me requires authentication", "variantType": "security", "automation": "automated", "_kind": "api", "_method": "GET", "_file": "api-auth-rbac.spec.js", "_login_role": null }, { "sourceId": "API-005", "variantId": "V251-API-005", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "API Auth / RBAC", "role": "API/Anonymous", "scenario": "API forgot-password rejects invalid email safely", "steps": "Execute POST /api/auth/forgot-password as API/Anonymous and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/api/auth/forgot-password", "variantName": "API forgot-password rejects invalid email safely", "variantType": "security", "automation": "automated", "_kind": "api", "_method": "POST", "_file": "api-auth-rbac.spec.js", "_login_role": null }, { "sourceId": "API-006", "variantId": "V251-API-006", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "API Auth / RBAC", "role": "API/Anonymous", "scenario": "API reset-password rejects bogus token", "steps": "Execute POST /api/auth/reset-password as API/Anonymous and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/api/auth/reset-password", "variantName": "API reset-password rejects bogus token", "variantType": "security", "automation": "automated", "_kind": "api", "_method": "POST", "_file": "api-auth-rbac.spec.js", "_login_role": null }, { "sourceId": "API-007", "variantId": "V251-API-007", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "API Auth / RBAC", "role": "API/Anonymous", "scenario": "API invite accept rejects bogus token", "steps": "Execute POST /api/auth/invite/accept as API/Anonymous and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/api/auth/invite/accept", "variantName": "API invite accept rejects bogus token", "variantType": "security", "automation": "automated", "_kind": "api", "_method": "POST", "_file": "api-auth-rbac.spec.js", "_login_role": null }, { "sourceId": "API-008", "variantId": "V251-API-008", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "API Auth / RBAC", "role": "API/Anonymous", "scenario": "API users requires authorization", "steps": "Execute GET /api/users as API/Anonymous and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/api/users", "variantName": "API users requires authorization", "variantType": "security", "automation": "automated", "_kind": "api", "_method": "GET", "_file": "api-auth-rbac.spec.js", "_login_role": null }, { "sourceId": "API-009", "variantId": "V251-API-009", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "API Auth / RBAC", "role": "API/Anonymous", "scenario": "API users create CSRF/auth rejected", "steps": "Execute POST /api/users as API/Anonymous and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/api/users", "variantName": "API users create CSRF/auth rejected", "variantType": "security", "automation": "automated", "_kind": "api", "_method": "POST", "_file": "api-auth-rbac.spec.js", "_login_role": null }, { "sourceId": "API-010", "variantId": "V251-API-010", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "API Auth / RBAC", "role": "API/Anonymous", "scenario": "API RBAC roles requires authorization", "steps": "Execute GET /api/rbac/roles as API/Anonymous and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/api/rbac/roles", "variantName": "API RBAC roles requires authorization", "variantType": "security", "automation": "automated", "_kind": "api", "_method": "GET", "_file": "api-auth-rbac.spec.js", "_login_role": null }, { "sourceId": "API-011", "variantId": "V251-API-011", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "API Auth / RBAC", "role": "API/Anonymous", "scenario": "API RBAC roles create auth rejected", "steps": "Execute POST /api/rbac/roles as API/Anonymous and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/api/rbac/roles", "variantName": "API RBAC roles create auth rejected", "variantType": "security", "automation": "automated", "_kind": "api", "_method": "POST", "_file": "api-auth-rbac.spec.js", "_login_role": null }, { "sourceId": "API-012", "variantId": "V251-API-012", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "API Auth / RBAC", "role": "API/Anonymous", "scenario": "API RBAC permissions requires authorization", "steps": "Execute GET /api/rbac/permissions as API/Anonymous and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/api/rbac/permissions", "variantName": "API RBAC permissions requires authorization", "variantType": "security", "automation": "automated", "_kind": "api", "_method": "GET", "_file": "api-auth-rbac.spec.js", "_login_role": null }, { "sourceId": "API-013", "variantId": "V251-API-013", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "API Auth / RBAC", "role": "API/Anonymous", "scenario": "API tenancy tenants requires authorization", "steps": "Execute GET /api/tenancy/tenants as API/Anonymous and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/api/tenancy/tenants", "variantName": "API tenancy tenants requires authorization", "variantType": "security", "automation": "automated", "_kind": "api", "_method": "GET", "_file": "api-auth-rbac.spec.js", "_login_role": null }, { "sourceId": "API-014", "variantId": "V251-API-014", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "API Auth / RBAC", "role": "API/Anonymous", "scenario": "API tenancy branches requires authorization", "steps": "Execute GET /api/tenancy/branches as API/Anonymous and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/api/tenancy/branches", "variantName": "API tenancy branches requires authorization", "variantType": "security", "automation": "automated", "_kind": "api", "_method": "GET", "_file": "api-auth-rbac.spec.js", "_login_role": null }, { "sourceId": "API-015", "variantId": "V251-API-015", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "API Auth / RBAC", "role": "API/Anonymous", "scenario": "API clients requires authorization", "steps": "Execute GET /api/v1/clients as API/Anonymous and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/api/v1/clients", "variantName": "API clients requires authorization", "variantType": "security", "automation": "automated", "_kind": "api", "_method": "GET", "_file": "api-auth-rbac.spec.js", "_login_role": null }, { "sourceId": "API-016", "variantId": "V251-API-016", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "API Auth / RBAC", "role": "API/Anonymous", "scenario": "API clients create auth rejected", "steps": "Execute POST /api/v1/clients as API/Anonymous and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/api/v1/clients", "variantName": "API clients create auth rejected", "variantType": "security", "automation": "automated", "_kind": "api", "_method": "POST", "_file": "api-auth-rbac.spec.js", "_login_role": null }, { "sourceId": "API-017", "variantId": "V251-API-017", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "API Auth / RBAC", "role": "API/Anonymous", "scenario": "API client invalid ID safe", "steps": "Execute GET /api/v1/clients/999999 as API/Anonymous and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/api/v1/clients/999999", "variantName": "API client invalid ID safe", "variantType": "security", "automation": "automated", "_kind": "api", "_method": "GET", "_file": "api-auth-rbac.spec.js", "_login_role": null }, { "sourceId": "API-018", "variantId": "V251-API-018", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "API Auth / RBAC", "role": "API/Anonymous", "scenario": "API client update invalid ID auth rejected", "steps": "Execute PUT /api/v1/clients/999999 as API/Anonymous and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/api/v1/clients/999999", "variantName": "API client update invalid ID auth rejected", "variantType": "security", "automation": "automated", "_kind": "api", "_method": "PUT", "_file": "api-auth-rbac.spec.js", "_login_role": null }, { "sourceId": "API-019", "variantId": "V251-API-019", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "API Auth / RBAC", "role": "API/Anonymous", "scenario": "API client delete invalid ID auth rejected", "steps": "Execute DELETE /api/v1/clients/999999 as API/Anonymous and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/api/v1/clients/999999", "variantName": "API client delete invalid ID auth rejected", "variantType": "security", "automation": "automated", "_kind": "api", "_method": "DELETE", "_file": "api-auth-rbac.spec.js", "_login_role": null }, { "sourceId": "API-020", "variantId": "V251-API-020", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "API Auth / RBAC", "role": "API/Anonymous", "scenario": "API cross-tenant query does not leak", "steps": "Execute GET /api/v1/clients?tenant_id=999999 as API/Anonymous and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/api/v1/clients?tenant_id=999999", "variantName": "API cross-tenant query does not leak", "variantType": "security", "automation": "automated", "_kind": "api", "_method": "GET", "_file": "api-auth-rbac.spec.js", "_login_role": null }, { "sourceId": "API-021", "variantId": "V251-API-021", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "API Auth / RBAC", "role": "API/Anonymous", "scenario": "API roles duplicate invalid POST safe", "steps": "Execute POST /api/rbac/roles as API/Anonymous and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/api/rbac/roles", "variantName": "API roles duplicate invalid POST safe", "variantType": "security", "automation": "automated", "_kind": "api", "_method": "POST", "_file": "api-auth-rbac.spec.js", "_login_role": null }, { "sourceId": "API-022", "variantId": "V251-API-022", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "API Auth / RBAC", "role": "API/Anonymous", "scenario": "API permission elevation attempt rejected", "steps": "Execute POST /api/rbac/roles/999999/permissions as API/Anonymous and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/api/rbac/roles/999999/permissions", "variantName": "API permission elevation attempt rejected", "variantType": "security", "automation": "automated", "_kind": "api", "_method": "POST", "_file": "api-auth-rbac.spec.js", "_login_role": null }, { "sourceId": "API-023", "variantId": "V251-API-023", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "API Auth / RBAC", "role": "API/Anonymous", "scenario": "API tenant create auth rejected", "steps": "Execute POST /api/tenancy/tenants as API/Anonymous and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/api/tenancy/tenants", "variantName": "API tenant create auth rejected", "variantType": "security", "automation": "automated", "_kind": "api", "_method": "POST", "_file": "api-auth-rbac.spec.js", "_login_role": null }, { "sourceId": "API-024", "variantId": "V251-API-024", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "API Auth / RBAC", "role": "API/Anonymous", "scenario": "API branch create auth rejected", "steps": "Execute POST /api/tenancy/branches as API/Anonymous and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/api/tenancy/branches", "variantName": "API branch create auth rejected", "variantType": "security", "automation": "automated", "_kind": "api", "_method": "POST", "_file": "api-auth-rbac.spec.js", "_login_role": null }, { "sourceId": "API-025", "variantId": "V251-API-025", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "API Auth / RBAC", "role": "API/Anonymous", "scenario": "API malformed JSON safe", "steps": "Execute POST /api/auth/token as API/Anonymous and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/api/auth/token", "variantName": "API malformed JSON safe", "variantType": "security", "automation": "automated", "_kind": "api", "_method": "POST", "_file": "api-auth-rbac.spec.js", "_login_role": null }, { "sourceId": "API-026", "variantId": "V251-API-026", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "API Auth / RBAC", "role": "API/Anonymous", "scenario": "API token response does not leak password", "steps": "Execute POST /api/auth/token as API/Anonymous and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/api/auth/token", "variantName": "API token response does not leak password", "variantType": "security", "automation": "automated", "_kind": "api", "_method": "POST", "_file": "api-auth-rbac.spec.js", "_login_role": null }, { "sourceId": "API-027", "variantId": "V251-API-027", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "API Auth / RBAC", "role": "API/Anonymous", "scenario": "API forgot password does not disclose account existence", "steps": "Execute POST /api/auth/forgot-password as API/Anonymous and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/api/auth/forgot-password", "variantName": "API forgot password does not disclose account existence", "variantType": "security", "automation": "automated", "_kind": "api", "_method": "POST", "_file": "api-auth-rbac.spec.js", "_login_role": null }, { "sourceId": "API-028", "variantId": "V251-API-028", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "API Auth / RBAC", "role": "API/Anonymous", "scenario": "API reset token replay rejected", "steps": "Execute POST /api/auth/reset-password as API/Anonymous and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/api/auth/reset-password", "variantName": "API reset token replay rejected", "variantType": "security", "automation": "automated", "_kind": "api", "_method": "POST", "_file": "api-auth-rbac.spec.js", "_login_role": null }, { "sourceId": "API-029", "variantId": "V251-API-029", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "API Auth / RBAC", "role": "API/Anonymous", "scenario": "API rate-limit/bruteforce endpoint safe", "steps": "Execute POST /api/auth/token as API/Anonymous and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/api/auth/token", "variantName": "API rate-limit/bruteforce endpoint safe", "variantType": "security", "automation": "automated", "_kind": "api", "_method": "POST", "_file": "api-auth-rbac.spec.js", "_login_role": null }, { "sourceId": "API-030", "variantId": "V251-API-030", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "API Auth / RBAC", "role": "API/Anonymous", "scenario": "API CORS preflight handled safely", "steps": "Execute OPTIONS /api/auth/me as API/Anonymous and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/api/auth/me", "variantName": "API CORS preflight handled safely", "variantType": "security", "automation": "automated", "_kind": "api", "_method": "OPTIONS", "_file": "api-auth-rbac.spec.js", "_login_role": null }, { "sourceId": "API-031", "variantId": "V251-API-031", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "API Auth / RBAC", "role": "API/Anonymous", "scenario": "API export clients requires authorization", "steps": "Execute GET /api/v1/clients/export as API/Anonymous and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/api/v1/clients/export", "variantName": "API export clients requires authorization", "variantType": "security", "automation": "automated", "_kind": "api", "_method": "GET", "_file": "api-auth-rbac.spec.js", "_login_role": null }, { "sourceId": "API-032", "variantId": "V251-API-032", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "API Auth / RBAC", "role": "API/Anonymous", "scenario": "API users invalid ID safe", "steps": "Execute GET /api/users/999999 as API/Anonymous and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/api/users/999999", "variantName": "API users invalid ID safe", "variantType": "security", "automation": "automated", "_kind": "api", "_method": "GET", "_file": "api-auth-rbac.spec.js", "_login_role": null }, { "sourceId": "API-033", "variantId": "V251-API-033", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "API Auth / RBAC", "role": "API/Anonymous", "scenario": "API users role update auth rejected", "steps": "Execute POST /api/users/999999/roles as API/Anonymous and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/api/users/999999/roles", "variantName": "API users role update auth rejected", "variantType": "security", "automation": "automated", "_kind": "api", "_method": "POST", "_file": "api-auth-rbac.spec.js", "_login_role": null }, { "sourceId": "API-034", "variantId": "V251-API-034", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "API Auth / RBAC", "role": "API/Anonymous", "scenario": "API permission denied response does not include stack trace", "steps": "Execute GET /api/users as API/Anonymous and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/api/users", "variantName": "API permission denied response does not include stack trace", "variantType": "security", "automation": "automated", "_kind": "api", "_method": "GET", "_file": "api-auth-rbac.spec.js", "_login_role": null }, { "sourceId": "API-035", "variantId": "V251-API-035", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "API Auth / RBAC", "role": "API/Anonymous", "scenario": "API unknown endpoint returns safe 404", "steps": "Execute GET /api/does-not-exist-uat-vapt as API/Anonymous and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/api/does-not-exist-uat-vapt", "variantName": "API unknown endpoint returns safe 404", "variantType": "security", "automation": "automated", "_kind": "api", "_method": "GET", "_file": "api-auth-rbac.spec.js", "_login_role": null }, { "sourceId": "AUD-001", "variantId": "V251-AUD-001", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Audit Logs", "role": "System Admin", "scenario": "Audit logs page loads for System Admin", "steps": "Execute GET /system-settings/audit-logs as System Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/system-settings/audit-logs", "variantName": "Audit logs page loads for System Admin", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "audit-logs.spec.js", "_login_role": "System Admin" }, { "sourceId": "AUD-002", "variantId": "V251-AUD-002", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Audit Logs", "role": "Firm Admin", "scenario": "Firm Admin audit logs page loads or safely restricted", "steps": "Execute GET /system-settings/audit-logs as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/system-settings/audit-logs", "variantName": "Firm Admin audit logs page loads or safely restricted", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "audit-logs.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "AUD-003", "variantId": "V251-AUD-003", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Audit Logs", "role": "Staff", "scenario": "Staff cannot access audit logs", "steps": "Execute GET /system-settings/audit-logs as Staff and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/system-settings/audit-logs", "variantName": "Staff cannot access audit logs", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "audit-logs.spec.js", "_login_role": "Staff" }, { "sourceId": "AUD-004", "variantId": "V251-AUD-004", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Audit Logs", "role": "Client", "scenario": "Client cannot access audit logs", "steps": "Execute GET /system-settings/audit-logs as Client and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/system-settings/audit-logs", "variantName": "Client cannot access audit logs", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "audit-logs.spec.js", "_login_role": "Client" }, { "sourceId": "AUD-005", "variantId": "V251-AUD-005", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Audit Logs", "role": "System Admin", "scenario": "Audit log invalid detail safe", "steps": "Execute GET /system-settings/audit-logs/999999 as System Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/system-settings/audit-logs/999999", "variantName": "Audit log invalid detail safe", "variantType": "positive", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "audit-logs.spec.js", "_login_role": "System Admin" }, { "sourceId": "AUD-006", "variantId": "V251-AUD-006", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Audit Logs", "role": "Staff", "scenario": "Audit log export requires permission", "steps": "Execute GET /system-settings/audit-logs/export as Staff and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/system-settings/audit-logs/export", "variantName": "Audit log export requires permission", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "audit-logs.spec.js", "_login_role": "Staff" }, { "sourceId": "AUD-007", "variantId": "V251-AUD-007", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Audit Logs", "role": "System Admin", "scenario": "Audit log filters do not crash", "steps": "Execute GET /system-settings/audit-logs?module=clients&action=create as System Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/system-settings/audit-logs?module=clients&action=create", "variantName": "Audit log filters do not crash", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "audit-logs.spec.js", "_login_role": "System Admin" }, { "sourceId": "AUD-008", "variantId": "V251-AUD-008", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Audit Logs", "role": "System Admin", "scenario": "Audit logs do not expose password", "steps": "Execute GET /system-settings/audit-logs as System Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/system-settings/audit-logs", "variantName": "Audit logs do not expose password", "variantType": "security", "automation": "automated", "_kind": "no-secret", "_method": "GET", "_file": "audit-logs.spec.js", "_login_role": "System Admin" }, { "sourceId": "AUD-009", "variantId": "V251-AUD-009", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Audit Logs", "role": "System Admin", "scenario": "Audit logs do not expose OTP", "steps": "Execute GET /system-settings/audit-logs as System Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/system-settings/audit-logs", "variantName": "Audit logs do not expose OTP", "variantType": "security", "automation": "automated", "_kind": "no-secret", "_method": "GET", "_file": "audit-logs.spec.js", "_login_role": "System Admin" }, { "sourceId": "AUD-010", "variantId": "V251-AUD-010", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Audit Logs", "role": "System Admin", "scenario": "Audit logs do not expose reset token", "steps": "Execute GET /system-settings/audit-logs as System Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/system-settings/audit-logs", "variantName": "Audit logs do not expose reset token", "variantType": "security", "automation": "automated", "_kind": "no-secret", "_method": "GET", "_file": "audit-logs.spec.js", "_login_role": "System Admin" }, { "sourceId": "AUD-011", "variantId": "V251-AUD-011", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Audit Logs", "role": "Anonymous/Attacker", "scenario": "Audit log export CSRF-less POST rejected", "steps": "Execute GET /system-settings/audit-logs/export as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/system-settings/audit-logs/export", "variantName": "Audit log export CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "audit-logs.spec.js", "_login_role": null }, { "sourceId": "AUD-012", "variantId": "V251-AUD-012", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Audit Logs", "role": "Anonymous/Attacker", "scenario": "Audit log delete invalid ID rejected", "steps": "Execute GET /system-settings/audit-logs/999999/delete as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/system-settings/audit-logs/999999/delete", "variantName": "Audit log delete invalid ID rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "audit-logs.spec.js", "_login_role": null }, { "sourceId": "AUD-013", "variantId": "V251-AUD-013", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Audit Logs", "role": "Anonymous/Attacker", "scenario": "Audit log tamper invalid POST rejected", "steps": "Execute GET /system-settings/audit-logs/999999 as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/system-settings/audit-logs/999999", "variantName": "Audit log tamper invalid POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "audit-logs.spec.js", "_login_role": null }, { "sourceId": "AUD-014", "variantId": "V251-AUD-014", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Audit Logs", "role": "Anonymous/Attacker", "scenario": "Permission denied event generated safely by blocked route", "steps": "Execute GET /system-settings/rbac/roles as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/system-settings/rbac/roles", "variantName": "Permission denied event generated safely by blocked route", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "audit-logs.spec.js", "_login_role": null }, { "sourceId": "AUD-015", "variantId": "V251-AUD-015", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Audit Logs", "role": "Anonymous/Attacker", "scenario": "Login failure is handled without stack trace", "steps": "Execute GET /login as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/login", "variantName": "Login failure is handled without stack trace", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "audit-logs.spec.js", "_login_role": null }, { "sourceId": "AUD-016", "variantId": "V251-AUD-016", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Audit Logs", "role": "Anonymous/Attacker", "scenario": "Document download audit invalid ID safe", "steps": "Execute GET /documents/999999/download as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/documents/999999/download", "variantName": "Document download audit invalid ID safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "audit-logs.spec.js", "_login_role": null }, { "sourceId": "AUD-017", "variantId": "V251-AUD-017", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Audit Logs", "role": "Anonymous/Attacker", "scenario": "Billing payment audit invalid ID safe", "steps": "Execute GET /billing/invoices/999999/payments as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/billing/invoices/999999/payments", "variantName": "Billing payment audit invalid ID safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "audit-logs.spec.js", "_login_role": null }, { "sourceId": "AUD-018", "variantId": "V251-AUD-018", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Audit Logs", "role": "Anonymous/Attacker", "scenario": "Notice case audit invalid ID safe", "steps": "Execute GET /notice-cases/999999 as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/notice-cases/999999", "variantName": "Notice case audit invalid ID safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "audit-logs.spec.js", "_login_role": null }, { "sourceId": "AUD-019", "variantId": "V251-AUD-019", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Audit Logs", "role": "Anonymous/Attacker", "scenario": "Audit log tenant scope query safe", "steps": "Execute GET /system-settings/audit-logs?tenant_id=999999 as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/system-settings/audit-logs?tenant_id=999999", "variantName": "Audit log tenant scope query safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "audit-logs.spec.js", "_login_role": null }, { "sourceId": "AUD-020", "variantId": "V251-AUD-020", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Audit Logs", "role": "Anonymous/Attacker", "scenario": "Audit log branch scope query safe", "steps": "Execute GET /system-settings/audit-logs?branch_id=999999 as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/system-settings/audit-logs?branch_id=999999", "variantName": "Audit log branch scope query safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "audit-logs.spec.js", "_login_role": null }, { "sourceId": "DSEC-001", "variantId": "V251-DSEC-001", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Document Security Deep", "role": "Firm Admin", "scenario": "Invalid document download returns safe response", "steps": "Execute GET /documents/999999/download as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/documents/999999/download", "variantName": "Invalid document download returns safe response", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "document-security-deep.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "DSEC-002", "variantId": "V251-DSEC-002", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Document Security Deep", "role": "Firm Admin", "scenario": "Invalid document version download safe", "steps": "Execute GET /documents/999999/versions/999999/download as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/documents/999999/versions/999999/download", "variantName": "Invalid document version download safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "document-security-deep.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "DSEC-003", "variantId": "V251-DSEC-003", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Document Security Deep", "role": "Firm Admin", "scenario": "Invalid permanent document download safe", "steps": "Execute GET /documents/permanent/999999/download as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/documents/permanent/999999/download", "variantName": "Invalid permanent document download safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "document-security-deep.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "DSEC-004", "variantId": "V251-DSEC-004", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Document Security Deep", "role": "Firm Admin", "scenario": "Deleted document invalid download safe", "steps": "Execute GET /documents/999999/deleted/download as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/documents/999999/deleted/download", "variantName": "Deleted document invalid download safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "document-security-deep.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "DSEC-005", "variantId": "V251-DSEC-005", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Document Security Deep", "role": "Client", "scenario": "Client cannot download other document ID", "steps": "Execute GET /documents/999999/download as Client and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/documents/999999/download", "variantName": "Client cannot download other document ID", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "document-security-deep.spec.js", "_login_role": "Client" }, { "sourceId": "DSEC-006", "variantId": "V251-DSEC-006", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Document Security Deep", "role": "Consultant", "scenario": "Consultant cannot download unshared document", "steps": "Execute GET /documents/999999/download as Consultant and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/documents/999999/download", "variantName": "Consultant cannot download unshared document", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "document-security-deep.spec.js", "_login_role": "Consultant" }, { "sourceId": "DSEC-007", "variantId": "V251-DSEC-007", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Document Security Deep", "role": "Staff", "scenario": "Staff cannot access storage admin", "steps": "Execute GET /documents/storage/nodes as Staff and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/documents/storage/nodes", "variantName": "Staff cannot access storage admin", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "document-security-deep.spec.js", "_login_role": "Staff" }, { "sourceId": "DSEC-008", "variantId": "V251-DSEC-008", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Document Security Deep", "role": "Public", "scenario": "Storage agent jobs require auth", "steps": "Execute GET /storage-agent/jobs as Public and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/storage-agent/jobs", "variantName": "Storage agent jobs require auth", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "document-security-deep.spec.js", "_login_role": null }, { "sourceId": "DSEC-009", "variantId": "V251-DSEC-009", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Document Security Deep", "role": "Public", "scenario": "Storage agent heartbeat without secret rejected", "steps": "Execute GET /storage-agent/heartbeat as Public and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/storage-agent/heartbeat", "variantName": "Storage agent heartbeat without secret rejected", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "document-security-deep.spec.js", "_login_role": null }, { "sourceId": "DSEC-010", "variantId": "V251-DSEC-010", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Document Security Deep", "role": "Public", "scenario": "Download token invalid safe", "steps": "Execute GET /documents/download-token/invalid-token as Public and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/documents/download-token/invalid-token", "variantName": "Download token invalid safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "document-security-deep.spec.js", "_login_role": null }, { "sourceId": "DSEC-011", "variantId": "V251-DSEC-011", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Document Security Deep", "role": "Firm Admin", "scenario": "Document search route does not leak across tenant", "steps": "Execute GET /documents?tenant_id=999999 as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/documents?tenant_id=999999", "variantName": "Document search route does not leak across tenant", "variantType": "security", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "document-security-deep.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "DSEC-012", "variantId": "V251-DSEC-012", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Document Security Deep", "role": "Firm Admin", "scenario": "Document repository loads for Firm Admin", "steps": "Execute GET /documents as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/documents", "variantName": "Document repository loads for Firm Admin", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "document-security-deep.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "DSEC-013", "variantId": "V251-DSEC-013", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Document Security Deep", "role": "Anonymous/Attacker", "scenario": "Document upload double extension rejected", "steps": "Execute GET /documents/upload as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/documents/upload", "variantName": "Document upload double extension rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "document-security-deep.spec.js", "_login_role": null }, { "sourceId": "DSEC-014", "variantId": "V251-DSEC-014", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Document Security Deep", "role": "Anonymous/Attacker", "scenario": "Document upload MIME mismatch rejected", "steps": "Execute GET /documents/upload as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/documents/upload", "variantName": "Document upload MIME mismatch rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "document-security-deep.spec.js", "_login_role": null }, { "sourceId": "DSEC-015", "variantId": "V251-DSEC-015", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Document Security Deep", "role": "Anonymous/Attacker", "scenario": "Document upload large file rejected or handled", "steps": "Execute GET /documents/upload as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/documents/upload", "variantName": "Document upload large file rejected or handled", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "document-security-deep.spec.js", "_login_role": null }, { "sourceId": "DSEC-016", "variantId": "V251-DSEC-016", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Document Security Deep", "role": "Anonymous/Attacker", "scenario": "Document upload path traversal filename rejected", "steps": "Execute GET /documents/upload as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/documents/upload", "variantName": "Document upload path traversal filename rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "document-security-deep.spec.js", "_login_role": null }, { "sourceId": "DSEC-017", "variantId": "V251-DSEC-017", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Document Security Deep", "role": "Anonymous/Attacker", "scenario": "Document delete CSRF-less POST rejected", "steps": "Execute GET /documents/999999/delete as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/documents/999999/delete", "variantName": "Document delete CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "document-security-deep.spec.js", "_login_role": null }, { "sourceId": "DSEC-018", "variantId": "V251-DSEC-018", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Document Security Deep", "role": "Anonymous/Attacker", "scenario": "Document version delete CSRF-less POST rejected", "steps": "Execute GET /documents/999999/versions/999999/delete as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/documents/999999/versions/999999/delete", "variantName": "Document version delete CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "document-security-deep.spec.js", "_login_role": null }, { "sourceId": "DSEC-019", "variantId": "V251-DSEC-019", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Document Security Deep", "role": "Anonymous/Attacker", "scenario": "Permanent document delete CSRF-less POST rejected", "steps": "Execute GET /documents/permanent/999999/delete as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/documents/permanent/999999/delete", "variantName": "Permanent document delete CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "document-security-deep.spec.js", "_login_role": null }, { "sourceId": "DSEC-020", "variantId": "V251-DSEC-020", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Document Security Deep", "role": "Anonymous/Attacker", "scenario": "Document move cross-tenant CSRF-less POST rejected", "steps": "Execute GET /documents/999999/move as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/documents/999999/move", "variantName": "Document move cross-tenant CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "document-security-deep.spec.js", "_login_role": null }, { "sourceId": "DSEC-021", "variantId": "V251-DSEC-021", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Document Security Deep", "role": "Anonymous/Attacker", "scenario": "Document share with client invalid ID rejected", "steps": "Execute GET /documents/999999/share-client as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/documents/999999/share-client", "variantName": "Document share with client invalid ID rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "document-security-deep.spec.js", "_login_role": null }, { "sourceId": "DSEC-022", "variantId": "V251-DSEC-022", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Document Security Deep", "role": "Anonymous/Attacker", "scenario": "Document share with consultant invalid ID rejected", "steps": "Execute GET /documents/999999/share-consultant as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/documents/999999/share-consultant", "variantName": "Document share with consultant invalid ID rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "document-security-deep.spec.js", "_login_role": null }, { "sourceId": "DSEC-023", "variantId": "V251-DSEC-023", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Document Security Deep", "role": "Anonymous/Attacker", "scenario": "Storage node create CSRF-less POST rejected", "steps": "Execute GET /documents/storage/nodes as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/documents/storage/nodes", "variantName": "Storage node create CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "document-security-deep.spec.js", "_login_role": null }, { "sourceId": "DSEC-024", "variantId": "V251-DSEC-024", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Document Security Deep", "role": "Anonymous/Attacker", "scenario": "Storage agent ack without secret rejected", "steps": "Execute GET /storage-agent/jobs/999999/ack as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/storage-agent/jobs/999999/ack", "variantName": "Storage agent ack without secret rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "document-security-deep.spec.js", "_login_role": null }, { "sourceId": "DSEC-025", "variantId": "V251-DSEC-025", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Document Security Deep", "role": "Anonymous/Attacker", "scenario": "Storage agent upload without secret rejected", "steps": "Execute GET /storage-agent/jobs/999999/upload as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/storage-agent/jobs/999999/upload", "variantName": "Storage agent upload without secret rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "document-security-deep.spec.js", "_login_role": null }, { "sourceId": "DSEC-026", "variantId": "V251-DSEC-026", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Document Security Deep", "role": "Anonymous/Attacker", "scenario": "Download request expiry invalid safe", "steps": "Execute GET /documents/download-requests/999999 as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/documents/download-requests/999999", "variantName": "Download request expiry invalid safe", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "document-security-deep.spec.js", "_login_role": null }, { "sourceId": "DSEC-027", "variantId": "V251-DSEC-027", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Document Security Deep", "role": "Anonymous/Attacker", "scenario": "Document tag update CSRF-less POST rejected", "steps": "Execute GET /documents/999999/tags as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/documents/999999/tags", "variantName": "Document tag update CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "document-security-deep.spec.js", "_login_role": null }, { "sourceId": "DSEC-028", "variantId": "V251-DSEC-028", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Document Security Deep", "role": "Anonymous/Attacker", "scenario": "Document metadata update invalid ID rejected", "steps": "Execute GET /documents/999999/edit as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/documents/999999/edit", "variantName": "Document metadata update invalid ID rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "document-security-deep.spec.js", "_login_role": null }, { "sourceId": "WORK2-001", "variantId": "V251-WORK2-001", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Work Lifecycle E2E", "role": "Firm Admin", "scenario": "Engagement create page/list loads", "steps": "Execute GET /work/engagements as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/work/engagements", "variantName": "Engagement create page/list loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "work-lifecycle-e2e.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "WORK2-002", "variantId": "V251-WORK2-002", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Work Lifecycle E2E", "role": "Firm Admin", "scenario": "Existing engagement detail loads", "steps": "Execute GET /work/engagements/1 as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/work/engagements/1", "variantName": "Existing engagement detail loads", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "work-lifecycle-e2e.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "WORK2-003", "variantId": "V251-WORK2-003", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Work Lifecycle E2E", "role": "Staff", "scenario": "Staff work board loads", "steps": "Execute GET /work as Staff and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/work", "variantName": "Staff work board loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "work-lifecycle-e2e.spec.js", "_login_role": "Staff" }, { "sourceId": "WORK2-004", "variantId": "V251-WORK2-004", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Work Lifecycle E2E", "role": "Manager", "scenario": "Manager team work board loads", "steps": "Execute GET /manager/work as Manager and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/manager/work", "variantName": "Manager team work board loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "work-lifecycle-e2e.spec.js", "_login_role": "Manager" }, { "sourceId": "WORK2-005", "variantId": "V251-WORK2-005", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Work Lifecycle E2E", "role": "Partner", "scenario": "Partner reviews page loads", "steps": "Execute GET /partner/reviews as Partner and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/partner/reviews", "variantName": "Partner reviews page loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "work-lifecycle-e2e.spec.js", "_login_role": "Partner" }, { "sourceId": "WORK2-006", "variantId": "V251-WORK2-006", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Work Lifecycle E2E", "role": "Client", "scenario": "Client dashboard compliance item list loads", "steps": "Execute GET /client/dashboard as Client and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/client/dashboard", "variantName": "Client dashboard compliance item list loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "work-lifecycle-e2e.spec.js", "_login_role": "Client" }, { "sourceId": "WORK2-007", "variantId": "V251-WORK2-007", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Work Lifecycle E2E", "role": "Consultant", "scenario": "Consultant assignment area loads", "steps": "Execute GET /consultants as Consultant and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/consultants", "variantName": "Consultant assignment area loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "work-lifecycle-e2e.spec.js", "_login_role": "Consultant" }, { "sourceId": "WORK2-008", "variantId": "V251-WORK2-008", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Work Lifecycle E2E", "role": "Staff", "scenario": "Invalid engagement ID is safe", "steps": "Execute GET /work/engagements/999999 as Staff and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/work/engagements/999999", "variantName": "Invalid engagement ID is safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "work-lifecycle-e2e.spec.js", "_login_role": "Staff" }, { "sourceId": "WORK2-009", "variantId": "V251-WORK2-009", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Work Lifecycle E2E", "role": "Client", "scenario": "Client cannot access internal engagement detail", "steps": "Execute GET /work/engagements/999999 as Client and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/work/engagements/999999", "variantName": "Client cannot access internal engagement detail", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "work-lifecycle-e2e.spec.js", "_login_role": "Client" }, { "sourceId": "WORK2-010", "variantId": "V251-WORK2-010", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Work Lifecycle E2E", "role": "Consultant", "scenario": "Consultant cannot access internal engagement detail", "steps": "Execute GET /work/engagements/999999 as Consultant and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/work/engagements/999999", "variantName": "Consultant cannot access internal engagement detail", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "work-lifecycle-e2e.spec.js", "_login_role": "Consultant" }, { "sourceId": "WORK2-011", "variantId": "V251-WORK2-011", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Work Lifecycle E2E", "role": "Anonymous/Attacker", "scenario": "Create engagement CSRF-less POST rejected", "steps": "Execute GET /work/engagements as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/work/engagements", "variantName": "Create engagement CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "work-lifecycle-e2e.spec.js", "_login_role": null }, { "sourceId": "WORK2-012", "variantId": "V251-WORK2-012", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Work Lifecycle E2E", "role": "Anonymous/Attacker", "scenario": "Generate tasks CSRF-less POST rejected", "steps": "Execute GET /work/engagements/999999/generate-tasks as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/work/engagements/999999/generate-tasks", "variantName": "Generate tasks CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "work-lifecycle-e2e.spec.js", "_login_role": null }, { "sourceId": "WORK2-013", "variantId": "V251-WORK2-013", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Work Lifecycle E2E", "role": "Anonymous/Attacker", "scenario": "Assign task CSRF-less POST rejected", "steps": "Execute GET /work/tasks/999999/assign as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/work/tasks/999999/assign", "variantName": "Assign task CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "work-lifecycle-e2e.spec.js", "_login_role": null }, { "sourceId": "WORK2-014", "variantId": "V251-WORK2-014", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Work Lifecycle E2E", "role": "Anonymous/Attacker", "scenario": "Staff start task invalid ID safe", "steps": "Execute GET /work/tasks/999999/start as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/work/tasks/999999/start", "variantName": "Staff start task invalid ID safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "work-lifecycle-e2e.spec.js", "_login_role": null }, { "sourceId": "WORK2-015", "variantId": "V251-WORK2-015", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Work Lifecycle E2E", "role": "Anonymous/Attacker", "scenario": "Staff complete task invalid ID safe", "steps": "Execute GET /work/tasks/999999/complete as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/work/tasks/999999/complete", "variantName": "Staff complete task invalid ID safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "work-lifecycle-e2e.spec.js", "_login_role": null }, { "sourceId": "WORK2-016", "variantId": "V251-WORK2-016", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Work Lifecycle E2E", "role": "Anonymous/Attacker", "scenario": "Task upload document invalid ID rejected", "steps": "Execute GET /work/tasks/999999/documents/upload as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/work/tasks/999999/documents/upload", "variantName": "Task upload document invalid ID rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "work-lifecycle-e2e.spec.js", "_login_role": null }, { "sourceId": "WORK2-017", "variantId": "V251-WORK2-017", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Work Lifecycle E2E", "role": "Anonymous/Attacker", "scenario": "Manager review invalid task rejected", "steps": "Execute GET /work/tasks/999999/review as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/work/tasks/999999/review", "variantName": "Manager review invalid task rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "work-lifecycle-e2e.spec.js", "_login_role": null }, { "sourceId": "WORK2-018", "variantId": "V251-WORK2-018", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Work Lifecycle E2E", "role": "Anonymous/Attacker", "scenario": "Partner approve invalid engagement rejected", "steps": "Execute GET /work/engagements/999999/approve as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/work/engagements/999999/approve", "variantName": "Partner approve invalid engagement rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "work-lifecycle-e2e.spec.js", "_login_role": null }, { "sourceId": "WORK2-019", "variantId": "V251-WORK2-019", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Work Lifecycle E2E", "role": "Anonymous/Attacker", "scenario": "Partner reject invalid engagement rejected", "steps": "Execute GET /work/engagements/999999/reject as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/work/engagements/999999/reject", "variantName": "Partner reject invalid engagement rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "work-lifecycle-e2e.spec.js", "_login_role": null }, { "sourceId": "WORK2-020", "variantId": "V251-WORK2-020", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Work Lifecycle E2E", "role": "Anonymous/Attacker", "scenario": "Add internal comment CSRF-less POST rejected", "steps": "Execute GET /work/engagements/999999/comments as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/work/engagements/999999/comments", "variantName": "Add internal comment CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "work-lifecycle-e2e.spec.js", "_login_role": null }, { "sourceId": "WORK2-021", "variantId": "V251-WORK2-021", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Work Lifecycle E2E", "role": "Anonymous/Attacker", "scenario": "Add client-visible comment invalid route safe", "steps": "Execute GET /work/engagements/999999/client-comments as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/work/engagements/999999/client-comments", "variantName": "Add client-visible comment invalid route safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "work-lifecycle-e2e.spec.js", "_login_role": null }, { "sourceId": "WORK2-022", "variantId": "V251-WORK2-022", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Work Lifecycle E2E", "role": "Anonymous/Attacker", "scenario": "Blocked task without reason rejected", "steps": "Execute GET /work/tasks/999999/block as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/work/tasks/999999/block", "variantName": "Blocked task without reason rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "work-lifecycle-e2e.spec.js", "_login_role": null }, { "sourceId": "WORK2-023", "variantId": "V251-WORK2-023", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Work Lifecycle E2E", "role": "Anonymous/Attacker", "scenario": "Completed task edit invalid ID safe", "steps": "Execute GET /work/tasks/999999/edit as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/work/tasks/999999/edit", "variantName": "Completed task edit invalid ID safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "work-lifecycle-e2e.spec.js", "_login_role": null }, { "sourceId": "WORK2-024", "variantId": "V251-WORK2-024", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Work Lifecycle E2E", "role": "Anonymous/Attacker", "scenario": "Locked FY task change rejected or safe", "steps": "Execute GET /work/tasks/999999/status as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/work/tasks/999999/status", "variantName": "Locked FY task change rejected or safe", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "work-lifecycle-e2e.spec.js", "_login_role": null }, { "sourceId": "WORK2-025", "variantId": "V251-WORK2-025", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Work Lifecycle E2E", "role": "Anonymous/Attacker", "scenario": "Task priority update CSRF-less POST rejected", "steps": "Execute GET /work/tasks/999999/priority as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/work/tasks/999999/priority", "variantName": "Task priority update CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "work-lifecycle-e2e.spec.js", "_login_role": null }, { "sourceId": "WORK2-026", "variantId": "V251-WORK2-026", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Work Lifecycle E2E", "role": "Anonymous/Attacker", "scenario": "Task due date update CSRF-less POST rejected", "steps": "Execute GET /work/tasks/999999/due-date as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/work/tasks/999999/due-date", "variantName": "Task due date update CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "work-lifecycle-e2e.spec.js", "_login_role": null }, { "sourceId": "WORK2-027", "variantId": "V251-WORK2-027", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Work Lifecycle E2E", "role": "Anonymous/Attacker", "scenario": "Work document download invalid ID safe", "steps": "Execute GET /work/documents/999999/download as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/work/documents/999999/download", "variantName": "Work document download invalid ID safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "work-lifecycle-e2e.spec.js", "_login_role": null }, { "sourceId": "WORK2-028", "variantId": "V251-WORK2-028", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Work Lifecycle E2E", "role": "Anonymous/Attacker", "scenario": "Work communication internal note hidden from client route safe", "steps": "Execute GET /client/work/engagements/999999/comments as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/client/work/engagements/999999/comments", "variantName": "Work communication internal note hidden from client route safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "work-lifecycle-e2e.spec.js", "_login_role": null }, { "sourceId": "WORK2-029", "variantId": "V251-WORK2-029", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Work Lifecycle E2E", "role": "Anonymous/Attacker", "scenario": "Cross-tenant engagement IDOR safe", "steps": "Execute GET /work/engagements/999999?tenant_id=999999 as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/work/engagements/999999?tenant_id=999999", "variantName": "Cross-tenant engagement IDOR safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "work-lifecycle-e2e.spec.js", "_login_role": null }, { "sourceId": "WORK2-030", "variantId": "V251-WORK2-030", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Work Lifecycle E2E", "role": "Anonymous/Attacker", "scenario": "Engagement delete CSRF-less POST rejected", "steps": "Execute GET /work/engagements/999999/delete as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/work/engagements/999999/delete", "variantName": "Engagement delete CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "work-lifecycle-e2e.spec.js", "_login_role": null }, { "sourceId": "BIZBILL-001", "variantId": "V251-BIZBILL-001", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Billing Business Rules", "role": "Firm Admin", "scenario": "Billing dashboard loads", "steps": "Execute GET /billing as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/billing", "variantName": "Billing dashboard loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "billing-business-rules.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "BIZBILL-002", "variantId": "V251-BIZBILL-002", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Billing Business Rules", "role": "Firm Admin", "scenario": "Invoices list loads", "steps": "Execute GET /billing/invoices as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/billing/invoices", "variantName": "Invoices list loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "billing-business-rules.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "BIZBILL-003", "variantId": "V251-BIZBILL-003", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Billing Business Rules", "role": "Firm Admin", "scenario": "Invoice create page loads", "steps": "Execute GET /billing/invoices/new as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/billing/invoices/new", "variantName": "Invoice create page loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "billing-business-rules.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "BIZBILL-004", "variantId": "V251-BIZBILL-004", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Billing Business Rules", "role": "Firm Admin", "scenario": "Payments list loads", "steps": "Execute GET /billing/payments as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/billing/payments", "variantName": "Payments list loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "billing-business-rules.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "BIZBILL-005", "variantId": "V251-BIZBILL-005", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Billing Business Rules", "role": "Firm Admin", "scenario": "Invalid invoice detail safe", "steps": "Execute GET /billing/invoices/999999 as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/billing/invoices/999999", "variantName": "Invalid invoice detail safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "billing-business-rules.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "BIZBILL-006", "variantId": "V251-BIZBILL-006", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Billing Business Rules", "role": "Client", "scenario": "Client cannot access all invoices", "steps": "Execute GET /billing/invoices as Client and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/billing/invoices", "variantName": "Client cannot access all invoices", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "billing-business-rules.spec.js", "_login_role": "Client" }, { "sourceId": "BIZBILL-007", "variantId": "V251-BIZBILL-007", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Billing Business Rules", "role": "Staff", "scenario": "Staff cannot access billing", "steps": "Execute GET /billing as Staff and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/billing", "variantName": "Staff cannot access billing", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "billing-business-rules.spec.js", "_login_role": "Staff" }, { "sourceId": "BIZBILL-008", "variantId": "V251-BIZBILL-008", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Billing Business Rules", "role": "Consultant", "scenario": "Consultant cannot access billing", "steps": "Execute GET /billing as Consultant and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/billing", "variantName": "Consultant cannot access billing", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "billing-business-rules.spec.js", "_login_role": "Consultant" }, { "sourceId": "BIZBILL-009", "variantId": "V251-BIZBILL-009", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Billing Business Rules", "role": "Client", "scenario": "Client own invoice invalid ID safe", "steps": "Execute GET /client/invoices/999999 as Client and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/client/invoices/999999", "variantName": "Client own invoice invalid ID safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "billing-business-rules.spec.js", "_login_role": "Client" }, { "sourceId": "BIZBILL-010", "variantId": "V251-BIZBILL-010", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Billing Business Rules", "role": "Anonymous/Attacker", "scenario": "Invoice create without line items rejected", "steps": "Execute GET /billing/invoices as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/billing/invoices", "variantName": "Invoice create without line items rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "billing-business-rules.spec.js", "_login_role": null }, { "sourceId": "BIZBILL-011", "variantId": "V251-BIZBILL-011", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Billing Business Rules", "role": "Anonymous/Attacker", "scenario": "Invoice duplicate number invalid POST safe", "steps": "Execute GET /billing/invoices as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/billing/invoices", "variantName": "Invoice duplicate number invalid POST safe", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "billing-business-rules.spec.js", "_login_role": null }, { "sourceId": "BIZBILL-012", "variantId": "V251-BIZBILL-012", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Billing Business Rules", "role": "Anonymous/Attacker", "scenario": "Invoice invalid GST/tax values rejected", "steps": "Execute GET /billing/invoices as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/billing/invoices", "variantName": "Invoice invalid GST/tax values rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "billing-business-rules.spec.js", "_login_role": null }, { "sourceId": "BIZBILL-013", "variantId": "V251-BIZBILL-013", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Billing Business Rules", "role": "Anonymous/Attacker", "scenario": "Invoice issue CSRF-less POST rejected", "steps": "Execute GET /billing/invoices/999999/issue as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/billing/invoices/999999/issue", "variantName": "Invoice issue CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "billing-business-rules.spec.js", "_login_role": null }, { "sourceId": "BIZBILL-014", "variantId": "V251-BIZBILL-014", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Billing Business Rules", "role": "Anonymous/Attacker", "scenario": "Invoice cancel CSRF-less POST rejected", "steps": "Execute GET /billing/invoices/999999/cancel as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/billing/invoices/999999/cancel", "variantName": "Invoice cancel CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "billing-business-rules.spec.js", "_login_role": null }, { "sourceId": "BIZBILL-015", "variantId": "V251-BIZBILL-015", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Billing Business Rules", "role": "Anonymous/Attacker", "scenario": "Void invoice cannot accept payment", "steps": "Execute GET /billing/invoices/999999/payments as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/billing/invoices/999999/payments", "variantName": "Void invoice cannot accept payment", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "billing-business-rules.spec.js", "_login_role": null }, { "sourceId": "BIZBILL-016", "variantId": "V251-BIZBILL-016", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Billing Business Rules", "role": "Anonymous/Attacker", "scenario": "Partial payment invalid ID safe", "steps": "Execute GET /billing/invoices/999999/payments as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/billing/invoices/999999/payments", "variantName": "Partial payment invalid ID safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "billing-business-rules.spec.js", "_login_role": null }, { "sourceId": "BIZBILL-017", "variantId": "V251-BIZBILL-017", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Billing Business Rules", "role": "Anonymous/Attacker", "scenario": "Overpayment blocked", "steps": "Execute GET /billing/invoices/999999/payments as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/billing/invoices/999999/payments", "variantName": "Overpayment blocked", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "billing-business-rules.spec.js", "_login_role": null }, { "sourceId": "BIZBILL-018", "variantId": "V251-BIZBILL-018", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Billing Business Rules", "role": "Anonymous/Attacker", "scenario": "Payment receipt invalid ID safe", "steps": "Execute GET /billing/payments/999999/receipt as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/billing/payments/999999/receipt", "variantName": "Payment receipt invalid ID safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "billing-business-rules.spec.js", "_login_role": null }, { "sourceId": "BIZBILL-019", "variantId": "V251-BIZBILL-019", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Billing Business Rules", "role": "Anonymous/Attacker", "scenario": "Invoice PDF invalid ID safe", "steps": "Execute GET /billing/invoices/999999/pdf as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/billing/invoices/999999/pdf", "variantName": "Invoice PDF invalid ID safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "billing-business-rules.spec.js", "_login_role": null }, { "sourceId": "BIZBILL-020", "variantId": "V251-BIZBILL-020", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Billing Business Rules", "role": "Anonymous/Attacker", "scenario": "Invoice print invalid ID safe", "steps": "Execute GET /billing/invoices/999999/print as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/billing/invoices/999999/print", "variantName": "Invoice print invalid ID safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "billing-business-rules.spec.js", "_login_role": null }, { "sourceId": "BIZBILL-021", "variantId": "V251-BIZBILL-021", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Billing Business Rules", "role": "Anonymous/Attacker", "scenario": "Invoice internal notes hidden from client route safe", "steps": "Execute GET /client/invoices/999999 as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/client/invoices/999999", "variantName": "Invoice internal notes hidden from client route safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "billing-business-rules.spec.js", "_login_role": null }, { "sourceId": "BIZBILL-022", "variantId": "V251-BIZBILL-022", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Billing Business Rules", "role": "Anonymous/Attacker", "scenario": "Payment delete CSRF-less POST rejected", "steps": "Execute GET /billing/payments/999999/delete as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/billing/payments/999999/delete", "variantName": "Payment delete CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "billing-business-rules.spec.js", "_login_role": null }, { "sourceId": "BIZBILL-023", "variantId": "V251-BIZBILL-023", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Billing Business Rules", "role": "Anonymous/Attacker", "scenario": "Invoice line update invalid ID rejected", "steps": "Execute GET /billing/invoices/999999/lines/999999 as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/billing/invoices/999999/lines/999999", "variantName": "Invoice line update invalid ID rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "billing-business-rules.spec.js", "_login_role": null }, { "sourceId": "BIZBILL-024", "variantId": "V251-BIZBILL-024", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Billing Business Rules", "role": "Anonymous/Attacker", "scenario": "Invoice export requires authorization", "steps": "Execute GET /billing/invoices/export as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/billing/invoices/export", "variantName": "Invoice export requires authorization", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "billing-business-rules.spec.js", "_login_role": null }, { "sourceId": "BIZBILL-025", "variantId": "V251-BIZBILL-025", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Billing Business Rules", "role": "Anonymous/Attacker", "scenario": "Payment export requires authorization", "steps": "Execute GET /billing/payments/export as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/billing/payments/export", "variantName": "Payment export requires authorization", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "billing-business-rules.spec.js", "_login_role": null }, { "sourceId": "BIZBILL-026", "variantId": "V251-BIZBILL-026", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Billing Business Rules", "role": "Anonymous/Attacker", "scenario": "Cross-client invoice IDOR safe", "steps": "Execute GET /billing/invoices/999999?client_id=999999 as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/billing/invoices/999999?client_id=999999", "variantName": "Cross-client invoice IDOR safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "billing-business-rules.spec.js", "_login_role": null }, { "sourceId": "BIZBILL-027", "variantId": "V251-BIZBILL-027", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Billing Business Rules", "role": "Anonymous/Attacker", "scenario": "Invoice number sequence endpoint safe", "steps": "Execute GET /billing/invoices/next-number as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/billing/invoices/next-number", "variantName": "Invoice number sequence endpoint safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "billing-business-rules.spec.js", "_login_role": null }, { "sourceId": "NCASE-001", "variantId": "V251-NCASE-001", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Notice Case Business Rules", "role": "Firm Admin", "scenario": "Notice cases list loads", "steps": "Execute GET /notice-cases as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/notice-cases", "variantName": "Notice cases list loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "notice-case-business-rules.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "NCASE-002", "variantId": "V251-NCASE-002", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Notice Case Business Rules", "role": "Firm Admin", "scenario": "Notice case new page loads", "steps": "Execute GET /notice-cases/new as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/notice-cases/new", "variantName": "Notice case new page loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "notice-case-business-rules.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "NCASE-003", "variantId": "V251-NCASE-003", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Notice Case Business Rules", "role": "Firm Admin", "scenario": "Invalid case detail safe", "steps": "Execute GET /notice-cases/999999 as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/notice-cases/999999", "variantName": "Invalid case detail safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "notice-case-business-rules.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "NCASE-004", "variantId": "V251-NCASE-004", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Notice Case Business Rules", "role": "Client", "scenario": "Client cannot access internal case list", "steps": "Execute GET /notice-cases as Client and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/notice-cases", "variantName": "Client cannot access internal case list", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "notice-case-business-rules.spec.js", "_login_role": "Client" }, { "sourceId": "NCASE-005", "variantId": "V251-NCASE-005", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Notice Case Business Rules", "role": "Consultant", "scenario": "Consultant cannot access internal case list", "steps": "Execute GET /notice-cases as Consultant and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/notice-cases", "variantName": "Consultant cannot access internal case list", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "notice-case-business-rules.spec.js", "_login_role": "Consultant" }, { "sourceId": "NCASE-006", "variantId": "V251-NCASE-006", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Notice Case Business Rules", "role": "Staff", "scenario": "Staff case list access safe", "steps": "Execute GET /notice-cases as Staff and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/notice-cases", "variantName": "Staff case list access safe", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "notice-case-business-rules.spec.js", "_login_role": "Staff" }, { "sourceId": "NCASE-007", "variantId": "V251-NCASE-007", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Notice Case Business Rules", "role": "Firm Admin", "scenario": "Invalid case events safe", "steps": "Execute GET /notice-cases/999999/events as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/notice-cases/999999/events", "variantName": "Invalid case events safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "notice-case-business-rules.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "NCASE-008", "variantId": "V251-NCASE-008", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Notice Case Business Rules", "role": "Firm Admin", "scenario": "Invalid case hearing safe", "steps": "Execute GET /notice-cases/999999/hearings as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/notice-cases/999999/hearings", "variantName": "Invalid case hearing safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "notice-case-business-rules.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "NCASE-009", "variantId": "V251-NCASE-009", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Notice Case Business Rules", "role": "Firm Admin", "scenario": "Invalid case order safe", "steps": "Execute GET /notice-cases/999999/orders as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/notice-cases/999999/orders", "variantName": "Invalid case order safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "notice-case-business-rules.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "NCASE-010", "variantId": "V251-NCASE-010", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Notice Case Business Rules", "role": "Anonymous/Attacker", "scenario": "Create notice case CSRF-less POST rejected", "steps": "Execute GET /notice-cases/new as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/notice-cases/new", "variantName": "Create notice case CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "notice-case-business-rules.spec.js", "_login_role": null }, { "sourceId": "NCASE-011", "variantId": "V251-NCASE-011", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Notice Case Business Rules", "role": "Anonymous/Attacker", "scenario": "Notice date/hearing date invalid POST safe", "steps": "Execute GET /notice-cases/999999/hearings as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/notice-cases/999999/hearings", "variantName": "Notice date/hearing date invalid POST safe", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "notice-case-business-rules.spec.js", "_login_role": null }, { "sourceId": "NCASE-012", "variantId": "V251-NCASE-012", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Notice Case Business Rules", "role": "Anonymous/Attacker", "scenario": "Order date before hearing invalid POST safe", "steps": "Execute GET /notice-cases/999999/orders as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/notice-cases/999999/orders", "variantName": "Order date before hearing invalid POST safe", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "notice-case-business-rules.spec.js", "_login_role": null }, { "sourceId": "NCASE-013", "variantId": "V251-NCASE-013", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Notice Case Business Rules", "role": "Anonymous/Attacker", "scenario": "Invalid case status transition rejected", "steps": "Execute GET /notice-cases/999999/status as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/notice-cases/999999/status", "variantName": "Invalid case status transition rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "notice-case-business-rules.spec.js", "_login_role": null }, { "sourceId": "NCASE-014", "variantId": "V251-NCASE-014", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Notice Case Business Rules", "role": "Anonymous/Attacker", "scenario": "Case document upload invalid ID rejected", "steps": "Execute GET /notice-cases/999999/documents/upload as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/notice-cases/999999/documents/upload", "variantName": "Case document upload invalid ID rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "notice-case-business-rules.spec.js", "_login_role": null }, { "sourceId": "NCASE-015", "variantId": "V251-NCASE-015", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Notice Case Business Rules", "role": "Anonymous/Attacker", "scenario": "Cross-case document IDOR safe", "steps": "Execute GET /notice-cases/999999/documents/999999/download as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/notice-cases/999999/documents/999999/download", "variantName": "Cross-case document IDOR safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "notice-case-business-rules.spec.js", "_login_role": null }, { "sourceId": "NCASE-016", "variantId": "V251-NCASE-016", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Notice Case Business Rules", "role": "Anonymous/Attacker", "scenario": "Client-visible document invalid route safe", "steps": "Execute GET /client/notice-cases/999999/documents/999999/download as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/client/notice-cases/999999/documents/999999/download", "variantName": "Client-visible document invalid route safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "notice-case-business-rules.spec.js", "_login_role": null }, { "sourceId": "NCASE-017", "variantId": "V251-NCASE-017", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Notice Case Business Rules", "role": "Anonymous/Attacker", "scenario": "Internal note hidden from client route safe", "steps": "Execute GET /client/notice-cases/999999/notes as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/client/notice-cases/999999/notes", "variantName": "Internal note hidden from client route safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "notice-case-business-rules.spec.js", "_login_role": null }, { "sourceId": "NCASE-018", "variantId": "V251-NCASE-018", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Notice Case Business Rules", "role": "Anonymous/Attacker", "scenario": "Case deadline reminder invalid ID safe", "steps": "Execute GET /notice-cases/999999/reminders as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/notice-cases/999999/reminders", "variantName": "Case deadline reminder invalid ID safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "notice-case-business-rules.spec.js", "_login_role": null }, { "sourceId": "NCASE-019", "variantId": "V251-NCASE-019", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Notice Case Business Rules", "role": "Anonymous/Attacker", "scenario": "Case assignment CSRF-less POST rejected", "steps": "Execute GET /notice-cases/999999/assign as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/notice-cases/999999/assign", "variantName": "Case assignment CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "notice-case-business-rules.spec.js", "_login_role": null }, { "sourceId": "NCASE-020", "variantId": "V251-NCASE-020", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Notice Case Business Rules", "role": "Anonymous/Attacker", "scenario": "Case event delete CSRF-less POST rejected", "steps": "Execute GET /notice-cases/events/999999/delete as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/notice-cases/events/999999/delete", "variantName": "Case event delete CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "notice-case-business-rules.spec.js", "_login_role": null }, { "sourceId": "NCASE-021", "variantId": "V251-NCASE-021", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Notice Case Business Rules", "role": "Anonymous/Attacker", "scenario": "Case hearing delete CSRF-less POST rejected", "steps": "Execute GET /notice-cases/hearings/999999/delete as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/notice-cases/hearings/999999/delete", "variantName": "Case hearing delete CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "notice-case-business-rules.spec.js", "_login_role": null }, { "sourceId": "NCASE-022", "variantId": "V251-NCASE-022", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Notice Case Business Rules", "role": "Anonymous/Attacker", "scenario": "Case order delete CSRF-less POST rejected", "steps": "Execute GET /notice-cases/orders/999999/delete as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/notice-cases/orders/999999/delete", "variantName": "Case order delete CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "notice-case-business-rules.spec.js", "_login_role": null }, { "sourceId": "NCASE-023", "variantId": "V251-NCASE-023", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Notice Case Business Rules", "role": "Anonymous/Attacker", "scenario": "Cross-tenant notice case IDOR safe", "steps": "Execute GET /notice-cases/999999?tenant_id=999999 as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/notice-cases/999999?tenant_id=999999", "variantName": "Cross-tenant notice case IDOR safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "notice-case-business-rules.spec.js", "_login_role": null }, { "sourceId": "HRRULE-001", "variantId": "V251-HRRULE-001", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Employee HR Business Rules", "role": "Staff", "scenario": "Attendance page loads", "steps": "Execute GET /employee/attendance as Staff and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/employee/attendance", "variantName": "Attendance page loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "employee-hr-business-rules.spec.js", "_login_role": "Staff" }, { "sourceId": "HRRULE-002", "variantId": "V251-HRRULE-002", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Employee HR Business Rules", "role": "Staff", "scenario": "Leave page loads", "steps": "Execute GET /employee/leaves as Staff and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/employee/leaves", "variantName": "Leave page loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "employee-hr-business-rules.spec.js", "_login_role": "Staff" }, { "sourceId": "HRRULE-003", "variantId": "V251-HRRULE-003", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Employee HR Business Rules", "role": "Manager", "scenario": "Manager team attendance loads", "steps": "Execute GET /employees/attendance as Manager and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/employees/attendance", "variantName": "Manager team attendance loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "employee-hr-business-rules.spec.js", "_login_role": "Manager" }, { "sourceId": "HRRULE-004", "variantId": "V251-HRRULE-004", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Employee HR Business Rules", "role": "Manager", "scenario": "Manager team leave loads", "steps": "Execute GET /employees/leave as Manager and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/employees/leave", "variantName": "Manager team leave loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "employee-hr-business-rules.spec.js", "_login_role": "Manager" }, { "sourceId": "HRRULE-005", "variantId": "V251-HRRULE-005", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Employee HR Business Rules", "role": "Firm Admin", "scenario": "Payroll page loads for Firm Admin", "steps": "Execute GET /employees/payroll as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/employees/payroll", "variantName": "Payroll page loads for Firm Admin", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "employee-hr-business-rules.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "HRRULE-006", "variantId": "V251-HRRULE-006", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Employee HR Business Rules", "role": "Firm Admin", "scenario": "Employee documents page loads", "steps": "Execute GET /employees/documents as Firm Admin and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "UAT", "route": "/employees/documents", "variantName": "Employee documents page loads", "variantType": "positive", "automation": "automated", "_kind": "page", "_method": "GET", "_file": "employee-hr-business-rules.spec.js", "_login_role": "Firm Admin" }, { "sourceId": "HRRULE-007", "variantId": "V251-HRRULE-007", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Employee HR Business Rules", "role": "Client", "scenario": "Client cannot access attendance", "steps": "Execute GET /employee/attendance as Client and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/employee/attendance", "variantName": "Client cannot access attendance", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "employee-hr-business-rules.spec.js", "_login_role": "Client" }, { "sourceId": "HRRULE-008", "variantId": "V251-HRRULE-008", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Employee HR Business Rules", "role": "Consultant", "scenario": "Consultant cannot access payroll", "steps": "Execute GET /employees/payroll as Consultant and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/employees/payroll", "variantName": "Consultant cannot access payroll", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "employee-hr-business-rules.spec.js", "_login_role": "Consultant" }, { "sourceId": "HRRULE-009", "variantId": "V251-HRRULE-009", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Employee HR Business Rules", "role": "Anonymous/Attacker", "scenario": "Duplicate attendance same date rejected", "steps": "Execute GET /employee/attendance as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/employee/attendance", "variantName": "Duplicate attendance same date rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "employee-hr-business-rules.spec.js", "_login_role": null }, { "sourceId": "HRRULE-010", "variantId": "V251-HRRULE-010", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Employee HR Business Rules", "role": "Anonymous/Attacker", "scenario": "Manual attendance CSRF-less POST rejected", "steps": "Execute GET /employees/attendance/manual as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/employees/attendance/manual", "variantName": "Manual attendance CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "employee-hr-business-rules.spec.js", "_login_role": null }, { "sourceId": "HRRULE-011", "variantId": "V251-HRRULE-011", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Employee HR Business Rules", "role": "Anonymous/Attacker", "scenario": "Leave exceeding balance rejected", "steps": "Execute GET /employee/leaves as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/employee/leaves", "variantName": "Leave exceeding balance rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "employee-hr-business-rules.spec.js", "_login_role": null }, { "sourceId": "HRRULE-012", "variantId": "V251-HRRULE-012", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Employee HR Business Rules", "role": "Anonymous/Attacker", "scenario": "Leave approve invalid ID rejected", "steps": "Execute GET /employees/leave/999999/approve as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/employees/leave/999999/approve", "variantName": "Leave approve invalid ID rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "employee-hr-business-rules.spec.js", "_login_role": null }, { "sourceId": "HRRULE-013", "variantId": "V251-HRRULE-013", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Employee HR Business Rules", "role": "Anonymous/Attacker", "scenario": "Leave reject invalid ID rejected", "steps": "Execute GET /employees/leave/999999/reject as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/employees/leave/999999/reject", "variantName": "Leave reject invalid ID rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "employee-hr-business-rules.spec.js", "_login_role": null }, { "sourceId": "HRRULE-014", "variantId": "V251-HRRULE-014", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Employee HR Business Rules", "role": "Anonymous/Attacker", "scenario": "Payroll generate CSRF-less POST rejected", "steps": "Execute GET /employees/payroll/generate as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/employees/payroll/generate", "variantName": "Payroll generate CSRF-less POST rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "employee-hr-business-rules.spec.js", "_login_role": null }, { "sourceId": "HRRULE-015", "variantId": "V251-HRRULE-015", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Employee HR Business Rules", "role": "Anonymous/Attacker", "scenario": "Payroll approve before generate invalid safe", "steps": "Execute GET /employees/payroll/999999/approve as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/employees/payroll/999999/approve", "variantName": "Payroll approve before generate invalid safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "employee-hr-business-rules.spec.js", "_login_role": null }, { "sourceId": "HRRULE-016", "variantId": "V251-HRRULE-016", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Employee HR Business Rules", "role": "Anonymous/Attacker", "scenario": "Payroll paid before approval invalid safe", "steps": "Execute GET /employees/payroll/999999/mark-paid as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/employees/payroll/999999/mark-paid", "variantName": "Payroll paid before approval invalid safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "employee-hr-business-rules.spec.js", "_login_role": null }, { "sourceId": "HRRULE-017", "variantId": "V251-HRRULE-017", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Employee HR Business Rules", "role": "Anonymous/Attacker", "scenario": "Payslip invalid ID safe", "steps": "Execute GET /employees/payroll/999999/payslip as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/employees/payroll/999999/payslip", "variantName": "Payslip invalid ID safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "employee-hr-business-rules.spec.js", "_login_role": null }, { "sourceId": "HRRULE-018", "variantId": "V251-HRRULE-018", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Employee HR Business Rules", "role": "Anonymous/Attacker", "scenario": "Offboarding complete invalid employee safe", "steps": "Execute GET /employees/999999/offboarding/complete as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/employees/999999/offboarding/complete", "variantName": "Offboarding complete invalid employee safe", "variantType": "security", "automation": "automated", "_kind": "safe-page", "_method": "GET", "_file": "employee-hr-business-rules.spec.js", "_login_role": null }, { "sourceId": "HRRULE-019", "variantId": "V251-HRRULE-019", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Employee HR Business Rules", "role": "Anonymous/Attacker", "scenario": "Employee document approve invalid ID rejected", "steps": "Execute GET /employees/documents/999999/approve as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/employees/documents/999999/approve", "variantName": "Employee document approve invalid ID rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "employee-hr-business-rules.spec.js", "_login_role": null }, { "sourceId": "HRRULE-020", "variantId": "V251-HRRULE-020", "sheet": "UAT_VAPT_v2_5_1_Additions", "module": "Employee HR Business Rules", "role": "Anonymous/Attacker", "scenario": "Employee document reject invalid ID rejected", "steps": "Execute GET /employees/documents/999999/reject as Anonymous/Attacker and verify expected security/business outcome.", "expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.", "priority": "High", "type": "VAPT", "route": "/employees/documents/999999/reject", "variantName": "Employee document reject invalid ID rejected", "variantType": "security", "automation": "automated", "_kind": "post", "_method": "GET", "_file": "employee-hr-business-rules.spec.js", "_login_role": null } ]