A R R R Associates
6042 lines
235 KiB
JSON
6042 lines
235 KiB
JSON
[
|
|
{
|
|
"sourceId": "EMAIL-001",
|
|
"variantId": "V251-EMAIL-001",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Email Integration",
|
|
"role": "Firm Admin",
|
|
"scenario": "Email settings page loads",
|
|
"steps": "Execute GET /email/settings as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/email/settings",
|
|
"variantName": "Email settings page loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "email-integration.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "EMAIL-002",
|
|
"variantId": "V251-EMAIL-002",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Email Integration",
|
|
"role": "Firm Admin",
|
|
"scenario": "Email test settings endpoint visible/safe",
|
|
"steps": "Execute GET /email/settings/test as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/email/settings/test",
|
|
"variantName": "Email test settings endpoint visible/safe",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "email-integration.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "EMAIL-003",
|
|
"variantId": "V251-EMAIL-003",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Email Integration",
|
|
"role": "Firm Admin",
|
|
"scenario": "Email logs page loads",
|
|
"steps": "Execute GET /email/logs as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/email/logs",
|
|
"variantName": "Email logs page loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "email-integration.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "EMAIL-004",
|
|
"variantId": "V251-EMAIL-004",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Email Integration",
|
|
"role": "Firm Admin",
|
|
"scenario": "Email queue page loads",
|
|
"steps": "Execute GET /email/queue as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/email/queue",
|
|
"variantName": "Email queue page loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "email-integration.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "EMAIL-005",
|
|
"variantId": "V251-EMAIL-005",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Email Integration",
|
|
"role": "Firm Admin",
|
|
"scenario": "Email inbox page loads",
|
|
"steps": "Execute GET /email/inbox as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/email/inbox",
|
|
"variantName": "Email inbox page loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "email-integration.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "EMAIL-006",
|
|
"variantId": "V251-EMAIL-006",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Email Integration",
|
|
"role": "Firm Admin",
|
|
"scenario": "Email templates page loads",
|
|
"steps": "Execute GET /email/templates as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/email/templates",
|
|
"variantName": "Email templates page loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "email-integration.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "EMAIL-007",
|
|
"variantId": "V251-EMAIL-007",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Email Integration",
|
|
"role": "Firm Admin",
|
|
"scenario": "Email template detail invalid ID safe",
|
|
"steps": "Execute GET /email/templates/999999 as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/email/templates/999999",
|
|
"variantName": "Email template detail invalid ID safe",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "email-integration.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "EMAIL-008",
|
|
"variantId": "V251-EMAIL-008",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Email Integration",
|
|
"role": "Firm Admin",
|
|
"scenario": "Email inbox invalid message detail safe",
|
|
"steps": "Execute GET /email/inbox/999999 as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/email/inbox/999999",
|
|
"variantName": "Email inbox invalid message detail safe",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "email-integration.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "EMAIL-009",
|
|
"variantId": "V251-EMAIL-009",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Email Integration",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "SMTP settings CSRF-less save rejected",
|
|
"steps": "Execute POST /email/settings as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/email/settings",
|
|
"variantName": "SMTP settings CSRF-less save rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "POST",
|
|
"_file": "email-integration.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "EMAIL-010",
|
|
"variantId": "V251-EMAIL-010",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Email Integration",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "SMTP test CSRF-less POST rejected",
|
|
"steps": "Execute POST /email/settings/test as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/email/settings/test",
|
|
"variantName": "SMTP test CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "POST",
|
|
"_file": "email-integration.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "EMAIL-011",
|
|
"variantId": "V251-EMAIL-011",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Email Integration",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Email queue process CSRF-less POST rejected",
|
|
"steps": "Execute POST /email/queue/process as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/email/queue/process",
|
|
"variantName": "Email queue process CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "POST",
|
|
"_file": "email-integration.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "EMAIL-012",
|
|
"variantId": "V251-EMAIL-012",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Email Integration",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Inbox fetch CSRF-less POST rejected",
|
|
"steps": "Execute POST /email/inbox/fetch as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/email/inbox/fetch",
|
|
"variantName": "Inbox fetch CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "POST",
|
|
"_file": "email-integration.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "EMAIL-013",
|
|
"variantId": "V251-EMAIL-013",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Email Integration",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Inbox map-all CSRF-less POST rejected",
|
|
"steps": "Execute POST /email/inbox/map-all as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/email/inbox/map-all",
|
|
"variantName": "Inbox map-all CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "POST",
|
|
"_file": "email-integration.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "EMAIL-014",
|
|
"variantId": "V251-EMAIL-014",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Email Integration",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Inbox message map CSRF-less POST rejected",
|
|
"steps": "Execute POST /email/inbox/999999/map as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/email/inbox/999999/map",
|
|
"variantName": "Inbox message map CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "POST",
|
|
"_file": "email-integration.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "EMAIL-015",
|
|
"variantId": "V251-EMAIL-015",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Email Integration",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Email template save CSRF-less POST rejected",
|
|
"steps": "Execute POST /email/templates as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/email/templates",
|
|
"variantName": "Email template save CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "POST",
|
|
"_file": "email-integration.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "EMAIL-016",
|
|
"variantId": "V251-EMAIL-016",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Email Integration",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Email template update invalid ID CSRF-less POST rejected",
|
|
"steps": "Execute POST /email/templates/999999 as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/email/templates/999999",
|
|
"variantName": "Email template update invalid ID CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "POST",
|
|
"_file": "email-integration.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "EMAIL-017",
|
|
"variantId": "V251-EMAIL-017",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Email Integration",
|
|
"role": "Staff",
|
|
"scenario": "Staff cannot access email settings",
|
|
"steps": "Execute GET /email/settings as Staff and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/email/settings",
|
|
"variantName": "Staff cannot access email settings",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "email-integration.spec.js",
|
|
"_login_role": "Staff"
|
|
},
|
|
{
|
|
"sourceId": "EMAIL-018",
|
|
"variantId": "V251-EMAIL-018",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Email Integration",
|
|
"role": "Client",
|
|
"scenario": "Client cannot access email logs",
|
|
"steps": "Execute GET /email/logs as Client and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/email/logs",
|
|
"variantName": "Client cannot access email logs",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "email-integration.spec.js",
|
|
"_login_role": "Client"
|
|
},
|
|
{
|
|
"sourceId": "EMAIL-019",
|
|
"variantId": "V251-EMAIL-019",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Email Integration",
|
|
"role": "Consultant",
|
|
"scenario": "Consultant cannot access email inbox",
|
|
"steps": "Execute GET /email/inbox as Consultant and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/email/inbox",
|
|
"variantName": "Consultant cannot access email inbox",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "email-integration.spec.js",
|
|
"_login_role": "Consultant"
|
|
},
|
|
{
|
|
"sourceId": "EMAIL-020",
|
|
"variantId": "V251-EMAIL-020",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Email Integration",
|
|
"role": "Partner",
|
|
"scenario": "Partner email queue access is blocked or safe",
|
|
"steps": "Execute GET /email/queue as Partner and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/email/queue",
|
|
"variantName": "Partner email queue access is blocked or safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "email-integration.spec.js",
|
|
"_login_role": "Partner"
|
|
},
|
|
{
|
|
"sourceId": "EMAIL-021",
|
|
"variantId": "V251-EMAIL-021",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Email Integration",
|
|
"role": "Firm Admin",
|
|
"scenario": "Invalid email attachment download does not crash",
|
|
"steps": "Execute GET /email/inbox/999999/attachments/999999/download as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/email/inbox/999999/attachments/999999/download",
|
|
"variantName": "Invalid email attachment download does not crash",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "email-integration.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "EMAIL-022",
|
|
"variantId": "V251-EMAIL-022",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Email Integration",
|
|
"role": "Firm Admin",
|
|
"scenario": "Email logs do not expose SMTP password",
|
|
"steps": "Execute GET /email/logs as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/email/logs",
|
|
"variantName": "Email logs do not expose SMTP password",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "email-integration.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "EMAIL-023",
|
|
"variantId": "V251-EMAIL-023",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Email Integration",
|
|
"role": "Firm Admin",
|
|
"scenario": "Email settings page does not render SMTP password in clear text",
|
|
"steps": "Execute GET /email/settings as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/email/settings",
|
|
"variantName": "Email settings page does not render SMTP password in clear text",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "email-integration.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "EMAIL-024",
|
|
"variantId": "V251-EMAIL-024",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Email Integration",
|
|
"role": "Firm Admin",
|
|
"scenario": "Email queue invalid retry action safe",
|
|
"steps": "Execute GET /email/queue/999999/retry as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/email/queue/999999/retry",
|
|
"variantName": "Email queue invalid retry action safe",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "email-integration.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "EMAIL-025",
|
|
"variantId": "V251-EMAIL-025",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Email Integration",
|
|
"role": "Firm Admin",
|
|
"scenario": "Email queue invalid delete action safe",
|
|
"steps": "Execute GET /email/queue/999999/delete as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/email/queue/999999/delete",
|
|
"variantName": "Email queue invalid delete action safe",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "email-integration.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "EMAIL-026",
|
|
"variantId": "V251-EMAIL-026",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Email Integration",
|
|
"role": "Firm Admin",
|
|
"scenario": "Email template preview invalid ID safe",
|
|
"steps": "Execute GET /email/templates/999999/preview as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/email/templates/999999/preview",
|
|
"variantName": "Email template preview invalid ID safe",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "email-integration.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "MKT-001",
|
|
"variantId": "V251-MKT-001",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Marketplace / Leads",
|
|
"role": "Firm Admin",
|
|
"scenario": "Marketplace dashboard loads",
|
|
"steps": "Execute GET /marketplace as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/marketplace",
|
|
"variantName": "Marketplace dashboard loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "marketplace-leads.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "MKT-002",
|
|
"variantId": "V251-MKT-002",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Marketplace / Leads",
|
|
"role": "Firm Admin",
|
|
"scenario": "Leads list loads",
|
|
"steps": "Execute GET /marketplace/leads as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/marketplace/leads",
|
|
"variantName": "Leads list loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "marketplace-leads.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "MKT-003",
|
|
"variantId": "V251-MKT-003",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Marketplace / Leads",
|
|
"role": "Firm Admin",
|
|
"scenario": "New lead page loads",
|
|
"steps": "Execute GET /marketplace/leads/new as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/marketplace/leads/new",
|
|
"variantName": "New lead page loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "marketplace-leads.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "MKT-004",
|
|
"variantId": "V251-MKT-004",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Marketplace / Leads",
|
|
"role": "Public",
|
|
"scenario": "Public lead page loads without auth",
|
|
"steps": "Execute GET /marketplace/public-lead as Public and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/marketplace/public-lead",
|
|
"variantName": "Public lead page loads without auth",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "public",
|
|
"_method": "GET",
|
|
"_file": "marketplace-leads.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "MKT-005",
|
|
"variantId": "V251-MKT-005",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Marketplace / Leads",
|
|
"role": "Firm Admin",
|
|
"scenario": "Invalid lead detail safe",
|
|
"steps": "Execute GET /marketplace/leads/999999 as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/marketplace/leads/999999",
|
|
"variantName": "Invalid lead detail safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "marketplace-leads.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "MKT-006",
|
|
"variantId": "V251-MKT-006",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Marketplace / Leads",
|
|
"role": "Firm Admin",
|
|
"scenario": "Lead assign invalid ID safe",
|
|
"steps": "Execute GET /marketplace/leads/999999/assign as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/marketplace/leads/999999/assign",
|
|
"variantName": "Lead assign invalid ID safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "marketplace-leads.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "MKT-007",
|
|
"variantId": "V251-MKT-007",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Marketplace / Leads",
|
|
"role": "Firm Admin",
|
|
"scenario": "Lead status invalid ID safe",
|
|
"steps": "Execute GET /marketplace/leads/999999/status as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/marketplace/leads/999999/status",
|
|
"variantName": "Lead status invalid ID safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "marketplace-leads.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "MKT-008",
|
|
"variantId": "V251-MKT-008",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Marketplace / Leads",
|
|
"role": "Firm Admin",
|
|
"scenario": "Lead convert invalid ID safe",
|
|
"steps": "Execute GET /marketplace/leads/999999/convert-client as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/marketplace/leads/999999/convert-client",
|
|
"variantName": "Lead convert invalid ID safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "marketplace-leads.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "MKT-009",
|
|
"variantId": "V251-MKT-009",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Marketplace / Leads",
|
|
"role": "Staff",
|
|
"scenario": "Staff lead list access blocked or safe",
|
|
"steps": "Execute GET /marketplace/leads as Staff and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/marketplace/leads",
|
|
"variantName": "Staff lead list access blocked or safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "marketplace-leads.spec.js",
|
|
"_login_role": "Staff"
|
|
},
|
|
{
|
|
"sourceId": "MKT-010",
|
|
"variantId": "V251-MKT-010",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Marketplace / Leads",
|
|
"role": "Client",
|
|
"scenario": "Client lead list access blocked",
|
|
"steps": "Execute GET /marketplace/leads as Client and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/marketplace/leads",
|
|
"variantName": "Client lead list access blocked",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "marketplace-leads.spec.js",
|
|
"_login_role": "Client"
|
|
},
|
|
{
|
|
"sourceId": "MKT-011",
|
|
"variantId": "V251-MKT-011",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Marketplace / Leads",
|
|
"role": "Consultant",
|
|
"scenario": "Consultant internal leads access blocked",
|
|
"steps": "Execute GET /marketplace/leads as Consultant and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/marketplace/leads",
|
|
"variantName": "Consultant internal leads access blocked",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "marketplace-leads.spec.js",
|
|
"_login_role": "Consultant"
|
|
},
|
|
{
|
|
"sourceId": "MKT-012",
|
|
"variantId": "V251-MKT-012",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Marketplace / Leads",
|
|
"role": "Public",
|
|
"scenario": "Public route does not expose internal list",
|
|
"steps": "Execute GET /marketplace/public-lead as Public and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/marketplace/public-lead",
|
|
"variantName": "Public route does not expose internal list",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "public-no-sensitive",
|
|
"_method": "GET",
|
|
"_file": "marketplace-leads.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "MKT-013",
|
|
"variantId": "V251-MKT-013",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Marketplace / Leads",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Public lead blank CSRF-less POST handled safely",
|
|
"steps": "Execute GET /marketplace/public-lead as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/marketplace/public-lead",
|
|
"variantName": "Public lead blank CSRF-less POST handled safely",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "marketplace-leads.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "MKT-014",
|
|
"variantId": "V251-MKT-014",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Marketplace / Leads",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Internal lead create CSRF-less POST rejected",
|
|
"steps": "Execute GET /marketplace/leads/new as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/marketplace/leads/new",
|
|
"variantName": "Internal lead create CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "marketplace-leads.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "MKT-015",
|
|
"variantId": "V251-MKT-015",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Marketplace / Leads",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Lead assign CSRF-less POST rejected",
|
|
"steps": "Execute GET /marketplace/leads/999999/assign as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/marketplace/leads/999999/assign",
|
|
"variantName": "Lead assign CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "marketplace-leads.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "MKT-016",
|
|
"variantId": "V251-MKT-016",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Marketplace / Leads",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Lead status CSRF-less POST rejected",
|
|
"steps": "Execute GET /marketplace/leads/999999/status as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/marketplace/leads/999999/status",
|
|
"variantName": "Lead status CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "marketplace-leads.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "MKT-017",
|
|
"variantId": "V251-MKT-017",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Marketplace / Leads",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Lead convert-client CSRF-less POST rejected",
|
|
"steps": "Execute GET /marketplace/leads/999999/convert-client as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/marketplace/leads/999999/convert-client",
|
|
"variantName": "Lead convert-client CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "marketplace-leads.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "MKT-018",
|
|
"variantId": "V251-MKT-018",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Marketplace / Leads",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Lead duplicate check invalid POST safe",
|
|
"steps": "Execute GET /marketplace/leads/check-duplicate as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/marketplace/leads/check-duplicate",
|
|
"variantName": "Lead duplicate check invalid POST safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "marketplace-leads.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "MKT-019",
|
|
"variantId": "V251-MKT-019",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Marketplace / Leads",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Lead note add CSRF-less POST rejected",
|
|
"steps": "Execute GET /marketplace/leads/999999/notes as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/marketplace/leads/999999/notes",
|
|
"variantName": "Lead note add CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "marketplace-leads.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "MKT-020",
|
|
"variantId": "V251-MKT-020",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Marketplace / Leads",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Lead attachment upload CSRF-less POST rejected",
|
|
"steps": "Execute GET /marketplace/leads/999999/upload as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/marketplace/leads/999999/upload",
|
|
"variantName": "Lead attachment upload CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "marketplace-leads.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "MKT-021",
|
|
"variantId": "V251-MKT-021",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Marketplace / Leads",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Cross-tenant lead probe safe",
|
|
"steps": "Execute GET /marketplace/leads/999999?tenant_id=999999 as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/marketplace/leads/999999?tenant_id=999999",
|
|
"variantName": "Cross-tenant lead probe safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "marketplace-leads.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "MKT-022",
|
|
"variantId": "V251-MKT-022",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Marketplace / Leads",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Lead export requires authorization",
|
|
"steps": "Execute GET /marketplace/leads/export as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/marketplace/leads/export",
|
|
"variantName": "Lead export requires authorization",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "marketplace-leads.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "PBILL-001",
|
|
"variantId": "V251-PBILL-001",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Platform Billing",
|
|
"role": "System Admin",
|
|
"scenario": "Plans page loads",
|
|
"steps": "Execute GET /platform-billing/plans as System Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/platform-billing/plans",
|
|
"variantName": "Plans page loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "platform-billing.spec.js",
|
|
"_login_role": "System Admin"
|
|
},
|
|
{
|
|
"sourceId": "PBILL-002",
|
|
"variantId": "V251-PBILL-002",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Platform Billing",
|
|
"role": "System Admin",
|
|
"scenario": "Accounts page loads",
|
|
"steps": "Execute GET /platform-billing/accounts as System Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/platform-billing/accounts",
|
|
"variantName": "Accounts page loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "platform-billing.spec.js",
|
|
"_login_role": "System Admin"
|
|
},
|
|
{
|
|
"sourceId": "PBILL-003",
|
|
"variantId": "V251-PBILL-003",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Platform Billing",
|
|
"role": "System Admin",
|
|
"scenario": "Audit firm subscriptions page loads",
|
|
"steps": "Execute GET /platform-billing/audit-firm-subscriptions as System Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/platform-billing/audit-firm-subscriptions",
|
|
"variantName": "Audit firm subscriptions page loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "platform-billing.spec.js",
|
|
"_login_role": "System Admin"
|
|
},
|
|
{
|
|
"sourceId": "PBILL-004",
|
|
"variantId": "V251-PBILL-004",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Platform Billing",
|
|
"role": "System Admin",
|
|
"scenario": "Client dashboard subscriptions page loads",
|
|
"steps": "Execute GET /platform-billing/client-dashboard-subscriptions as System Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/platform-billing/client-dashboard-subscriptions",
|
|
"variantName": "Client dashboard subscriptions page loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "platform-billing.spec.js",
|
|
"_login_role": "System Admin"
|
|
},
|
|
{
|
|
"sourceId": "PBILL-005",
|
|
"variantId": "V251-PBILL-005",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Platform Billing",
|
|
"role": "System Admin",
|
|
"scenario": "Consultant subscriptions page loads",
|
|
"steps": "Execute GET /platform-billing/consultant-subscriptions as System Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/platform-billing/consultant-subscriptions",
|
|
"variantName": "Consultant subscriptions page loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "platform-billing.spec.js",
|
|
"_login_role": "System Admin"
|
|
},
|
|
{
|
|
"sourceId": "PBILL-006",
|
|
"variantId": "V251-PBILL-006",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Platform Billing",
|
|
"role": "System Admin",
|
|
"scenario": "Subscriptions page loads",
|
|
"steps": "Execute GET /platform-billing/subscriptions as System Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/platform-billing/subscriptions",
|
|
"variantName": "Subscriptions page loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "platform-billing.spec.js",
|
|
"_login_role": "System Admin"
|
|
},
|
|
{
|
|
"sourceId": "PBILL-007",
|
|
"variantId": "V251-PBILL-007",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Platform Billing",
|
|
"role": "System Admin",
|
|
"scenario": "Invoices page loads",
|
|
"steps": "Execute GET /platform-billing/invoices as System Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/platform-billing/invoices",
|
|
"variantName": "Invoices page loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "platform-billing.spec.js",
|
|
"_login_role": "System Admin"
|
|
},
|
|
{
|
|
"sourceId": "PBILL-008",
|
|
"variantId": "V251-PBILL-008",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Platform Billing",
|
|
"role": "System Admin",
|
|
"scenario": "Invalid invoice detail/post safe",
|
|
"steps": "Execute GET /platform-billing/invoices/999999/post as System Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/platform-billing/invoices/999999/post",
|
|
"variantName": "Invalid invoice detail/post safe",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "platform-billing.spec.js",
|
|
"_login_role": "System Admin"
|
|
},
|
|
{
|
|
"sourceId": "PBILL-009",
|
|
"variantId": "V251-PBILL-009",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Platform Billing",
|
|
"role": "System Admin",
|
|
"scenario": "Invalid invoice payments safe",
|
|
"steps": "Execute GET /platform-billing/invoices/999999/payments as System Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/platform-billing/invoices/999999/payments",
|
|
"variantName": "Invalid invoice payments safe",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "platform-billing.spec.js",
|
|
"_login_role": "System Admin"
|
|
},
|
|
{
|
|
"sourceId": "PBILL-010",
|
|
"variantId": "V251-PBILL-010",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Platform Billing",
|
|
"role": "System Admin",
|
|
"scenario": "Invalid plan detail safe",
|
|
"steps": "Execute GET /platform-billing/plans/999999 as System Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/platform-billing/plans/999999",
|
|
"variantName": "Invalid plan detail safe",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "platform-billing.spec.js",
|
|
"_login_role": "System Admin"
|
|
},
|
|
{
|
|
"sourceId": "PBILL-011",
|
|
"variantId": "V251-PBILL-011",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Platform Billing",
|
|
"role": "Firm",
|
|
"scenario": "Firm Admin cannot manage platform plans",
|
|
"steps": "Execute GET /platform-billing/plans as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/platform-billing/plans",
|
|
"variantName": "Firm Admin cannot manage platform plans",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "platform-billing.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "PBILL-012",
|
|
"variantId": "V251-PBILL-012",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Platform Billing",
|
|
"role": "Staff",
|
|
"scenario": "Staff cannot access platform accounts",
|
|
"steps": "Execute GET /platform-billing/accounts as Staff and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/platform-billing/accounts",
|
|
"variantName": "Staff cannot access platform accounts",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "platform-billing.spec.js",
|
|
"_login_role": "Staff"
|
|
},
|
|
{
|
|
"sourceId": "PBILL-013",
|
|
"variantId": "V251-PBILL-013",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Platform Billing",
|
|
"role": "Client",
|
|
"scenario": "Client cannot access platform invoices list",
|
|
"steps": "Execute GET /platform-billing/invoices as Client and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/platform-billing/invoices",
|
|
"variantName": "Client cannot access platform invoices list",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "platform-billing.spec.js",
|
|
"_login_role": "Client"
|
|
},
|
|
{
|
|
"sourceId": "PBILL-014",
|
|
"variantId": "V251-PBILL-014",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Platform Billing",
|
|
"role": "Consultant",
|
|
"scenario": "Consultant cannot access platform invoice list",
|
|
"steps": "Execute GET /platform-billing/invoices as Consultant and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/platform-billing/invoices",
|
|
"variantName": "Consultant cannot access platform invoice list",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "platform-billing.spec.js",
|
|
"_login_role": "Consultant"
|
|
},
|
|
{
|
|
"sourceId": "PBILL-015",
|
|
"variantId": "V251-PBILL-015",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Platform Billing",
|
|
"role": "Partner",
|
|
"scenario": "Partner cannot post platform invoice",
|
|
"steps": "Execute GET /platform-billing/invoices/999999/post as Partner and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/platform-billing/invoices/999999/post",
|
|
"variantName": "Partner cannot post platform invoice",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "platform-billing.spec.js",
|
|
"_login_role": "Partner"
|
|
},
|
|
{
|
|
"sourceId": "PBILL-016",
|
|
"variantId": "V251-PBILL-016",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Platform Billing",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Plan create CSRF-less POST rejected",
|
|
"steps": "Execute GET /platform-billing/plans as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/platform-billing/plans",
|
|
"variantName": "Plan create CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "platform-billing.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "PBILL-017",
|
|
"variantId": "V251-PBILL-017",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Platform Billing",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Plan update invalid ID CSRF-less POST rejected",
|
|
"steps": "Execute GET /platform-billing/plans/999999 as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/platform-billing/plans/999999",
|
|
"variantName": "Plan update invalid ID CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "platform-billing.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "PBILL-018",
|
|
"variantId": "V251-PBILL-018",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Platform Billing",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Account create CSRF-less POST rejected",
|
|
"steps": "Execute GET /platform-billing/accounts as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/platform-billing/accounts",
|
|
"variantName": "Account create CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "platform-billing.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "PBILL-019",
|
|
"variantId": "V251-PBILL-019",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Platform Billing",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Audit firm subscription create CSRF-less POST rejected",
|
|
"steps": "Execute GET /platform-billing/audit-firm-subscriptions as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/platform-billing/audit-firm-subscriptions",
|
|
"variantName": "Audit firm subscription create CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "platform-billing.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "PBILL-020",
|
|
"variantId": "V251-PBILL-020",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Platform Billing",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Client dashboard subscription create CSRF-less POST rejected",
|
|
"steps": "Execute GET /platform-billing/client-dashboard-subscriptions as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/platform-billing/client-dashboard-subscriptions",
|
|
"variantName": "Client dashboard subscription create CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "platform-billing.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "PBILL-021",
|
|
"variantId": "V251-PBILL-021",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Platform Billing",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Consultant subscription create CSRF-less POST rejected",
|
|
"steps": "Execute GET /platform-billing/consultant-subscriptions as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/platform-billing/consultant-subscriptions",
|
|
"variantName": "Consultant subscription create CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "platform-billing.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "PBILL-022",
|
|
"variantId": "V251-PBILL-022",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Platform Billing",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Platform subscription create CSRF-less POST rejected",
|
|
"steps": "Execute GET /platform-billing/subscriptions as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/platform-billing/subscriptions",
|
|
"variantName": "Platform subscription create CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "platform-billing.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "PBILL-023",
|
|
"variantId": "V251-PBILL-023",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Platform Billing",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Invoice create CSRF-less POST rejected",
|
|
"steps": "Execute GET /platform-billing/invoices as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/platform-billing/invoices",
|
|
"variantName": "Invoice create CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "platform-billing.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "PBILL-024",
|
|
"variantId": "V251-PBILL-024",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Platform Billing",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Invoice post CSRF-less POST rejected",
|
|
"steps": "Execute GET /platform-billing/invoices/999999/post as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/platform-billing/invoices/999999/post",
|
|
"variantName": "Invoice post CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "platform-billing.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "PBILL-025",
|
|
"variantId": "V251-PBILL-025",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Platform Billing",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Invoice payment CSRF-less POST rejected",
|
|
"steps": "Execute GET /platform-billing/invoices/999999/payments as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/platform-billing/invoices/999999/payments",
|
|
"variantName": "Invoice payment CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "platform-billing.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "PBILL-026",
|
|
"variantId": "V251-PBILL-026",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Platform Billing",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Invoice cancel CSRF-less POST rejected",
|
|
"steps": "Execute GET /platform-billing/invoices/999999/cancel as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/platform-billing/invoices/999999/cancel",
|
|
"variantName": "Invoice cancel CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "platform-billing.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "PBILL-027",
|
|
"variantId": "V251-PBILL-027",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Platform Billing",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Payment over-amount invalid POST safe",
|
|
"steps": "Execute GET /platform-billing/invoices/999999/payments as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/platform-billing/invoices/999999/payments",
|
|
"variantName": "Payment over-amount invalid POST safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "platform-billing.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "PBILL-028",
|
|
"variantId": "V251-PBILL-028",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Platform Billing",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Duplicate plan code invalid POST safe",
|
|
"steps": "Execute GET /platform-billing/plans as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/platform-billing/plans",
|
|
"variantName": "Duplicate plan code invalid POST safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "platform-billing.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "PBILL-029",
|
|
"variantId": "V251-PBILL-029",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Platform Billing",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Duplicate invoice number invalid POST safe",
|
|
"steps": "Execute GET /platform-billing/invoices as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/platform-billing/invoices",
|
|
"variantName": "Duplicate invoice number invalid POST safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "platform-billing.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "PBILL-030",
|
|
"variantId": "V251-PBILL-030",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Platform Billing",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Invoice export requires auth",
|
|
"steps": "Execute GET /platform-billing/invoices/export as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/platform-billing/invoices/export",
|
|
"variantName": "Invoice export requires auth",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "platform-billing.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "PBILL-031",
|
|
"variantId": "V251-PBILL-031",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Platform Billing",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Invoice PDF invalid ID safe",
|
|
"steps": "Execute GET /platform-billing/invoices/999999/pdf as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/platform-billing/invoices/999999/pdf",
|
|
"variantName": "Invoice PDF invalid ID safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "platform-billing.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "PBILL-032",
|
|
"variantId": "V251-PBILL-032",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Platform Billing",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Cross-account invoice IDOR blocked",
|
|
"steps": "Execute GET /platform-billing/invoices/999999?account_id=999999 as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/platform-billing/invoices/999999?account_id=999999",
|
|
"variantName": "Cross-account invoice IDOR blocked",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "platform-billing.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "PBILL-033",
|
|
"variantId": "V251-PBILL-033",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Platform Billing",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Payment receipt invalid ID safe",
|
|
"steps": "Execute GET /platform-billing/payments/999999/receipt as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/platform-billing/payments/999999/receipt",
|
|
"variantName": "Payment receipt invalid ID safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "platform-billing.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "PBILL-034",
|
|
"variantId": "V251-PBILL-034",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Platform Billing",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Billing account delete CSRF-less POST rejected",
|
|
"steps": "Execute GET /platform-billing/accounts/999999/delete as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/platform-billing/accounts/999999/delete",
|
|
"variantName": "Billing account delete CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "platform-billing.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "PBILL-035",
|
|
"variantId": "V251-PBILL-035",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Platform Billing",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Plan delete CSRF-less POST rejected",
|
|
"steps": "Execute GET /platform-billing/plans/999999/delete as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/platform-billing/plans/999999/delete",
|
|
"variantName": "Plan delete CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "platform-billing.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "SYS-001",
|
|
"variantId": "V251-SYS-001",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "System Settings / Tenancy / FY",
|
|
"role": "System Admin",
|
|
"scenario": "Tenants page loads",
|
|
"steps": "Execute GET /system-settings/tenants as System Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/system-settings/tenants",
|
|
"variantName": "Tenants page loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "system-settings-tenancy.spec.js",
|
|
"_login_role": "System Admin"
|
|
},
|
|
{
|
|
"sourceId": "SYS-002",
|
|
"variantId": "V251-SYS-002",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "System Settings / Tenancy / FY",
|
|
"role": "System Admin",
|
|
"scenario": "Branches page loads",
|
|
"steps": "Execute GET /system-settings/branches as System Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/system-settings/branches",
|
|
"variantName": "Branches page loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "system-settings-tenancy.spec.js",
|
|
"_login_role": "System Admin"
|
|
},
|
|
{
|
|
"sourceId": "SYS-003",
|
|
"variantId": "V251-SYS-003",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "System Settings / Tenancy / FY",
|
|
"role": "System Admin",
|
|
"scenario": "Branding page loads",
|
|
"steps": "Execute GET /system-settings/branding as System Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/system-settings/branding",
|
|
"variantName": "Branding page loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "system-settings-tenancy.spec.js",
|
|
"_login_role": "System Admin"
|
|
},
|
|
{
|
|
"sourceId": "SYS-004",
|
|
"variantId": "V251-SYS-004",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "System Settings / Tenancy / FY",
|
|
"role": "System Admin",
|
|
"scenario": "Financial years page loads",
|
|
"steps": "Execute GET /system-settings/financial-years as System Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/system-settings/financial-years",
|
|
"variantName": "Financial years page loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "system-settings-tenancy.spec.js",
|
|
"_login_role": "System Admin"
|
|
},
|
|
{
|
|
"sourceId": "SYS-005",
|
|
"variantId": "V251-SYS-005",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "System Settings / Tenancy / FY",
|
|
"role": "System Admin",
|
|
"scenario": "RBAC page loads",
|
|
"steps": "Execute GET /system-settings/rbac as System Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/system-settings/rbac",
|
|
"variantName": "RBAC page loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "system-settings-tenancy.spec.js",
|
|
"_login_role": "System Admin"
|
|
},
|
|
{
|
|
"sourceId": "SYS-006",
|
|
"variantId": "V251-SYS-006",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "System Settings / Tenancy / FY",
|
|
"role": "System Admin",
|
|
"scenario": "Roles page loads",
|
|
"steps": "Execute GET /system-settings/rbac/roles as System Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/system-settings/rbac/roles",
|
|
"variantName": "Roles page loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "system-settings-tenancy.spec.js",
|
|
"_login_role": "System Admin"
|
|
},
|
|
{
|
|
"sourceId": "SYS-007",
|
|
"variantId": "V251-SYS-007",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "System Settings / Tenancy / FY",
|
|
"role": "System Admin",
|
|
"scenario": "Permissions page loads",
|
|
"steps": "Execute GET /system-settings/rbac/permissions as System Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/system-settings/rbac/permissions",
|
|
"variantName": "Permissions page loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "system-settings-tenancy.spec.js",
|
|
"_login_role": "System Admin"
|
|
},
|
|
{
|
|
"sourceId": "SYS-008",
|
|
"variantId": "V251-SYS-008",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "System Settings / Tenancy / FY",
|
|
"role": "System Admin",
|
|
"scenario": "Audit logs page loads",
|
|
"steps": "Execute GET /system-settings/audit-logs as System Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/system-settings/audit-logs",
|
|
"variantName": "Audit logs page loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "system-settings-tenancy.spec.js",
|
|
"_login_role": "System Admin"
|
|
},
|
|
{
|
|
"sourceId": "SYS-009",
|
|
"variantId": "V251-SYS-009",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "System Settings / Tenancy / FY",
|
|
"role": "System Admin",
|
|
"scenario": "Invalid tenant context switch safe",
|
|
"steps": "Execute GET /system-settings/context/tenant/999999 as System Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/system-settings/context/tenant/999999",
|
|
"variantName": "Invalid tenant context switch safe",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "system-settings-tenancy.spec.js",
|
|
"_login_role": "System Admin"
|
|
},
|
|
{
|
|
"sourceId": "SYS-010",
|
|
"variantId": "V251-SYS-010",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "System Settings / Tenancy / FY",
|
|
"role": "System Admin",
|
|
"scenario": "Invalid branch context switch safe",
|
|
"steps": "Execute GET /system-settings/context/branch/999999 as System Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/system-settings/context/branch/999999",
|
|
"variantName": "Invalid branch context switch safe",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "system-settings-tenancy.spec.js",
|
|
"_login_role": "System Admin"
|
|
},
|
|
{
|
|
"sourceId": "SYS-011",
|
|
"variantId": "V251-SYS-011",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "System Settings / Tenancy / FY",
|
|
"role": "System Admin",
|
|
"scenario": "Invalid financial year context switch safe",
|
|
"steps": "Execute GET /system-settings/context/financial-year/INVALID as System Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/system-settings/context/financial-year/INVALID",
|
|
"variantName": "Invalid financial year context switch safe",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "system-settings-tenancy.spec.js",
|
|
"_login_role": "System Admin"
|
|
},
|
|
{
|
|
"sourceId": "SYS-012",
|
|
"variantId": "V251-SYS-012",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "System Settings / Tenancy / FY",
|
|
"role": "System Admin",
|
|
"scenario": "FY backup export page/action safe",
|
|
"steps": "Execute GET /system-settings/financial-years/backup-export as System Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/system-settings/financial-years/backup-export",
|
|
"variantName": "FY backup export page/action safe",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "system-settings-tenancy.spec.js",
|
|
"_login_role": "System Admin"
|
|
},
|
|
{
|
|
"sourceId": "SYS-013",
|
|
"variantId": "V251-SYS-013",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "System Settings / Tenancy / FY",
|
|
"role": "Staff",
|
|
"scenario": "Staff cannot access tenants",
|
|
"steps": "Execute GET /system-settings/tenants as Staff and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/system-settings/tenants",
|
|
"variantName": "Staff cannot access tenants",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "system-settings-tenancy.spec.js",
|
|
"_login_role": "Staff"
|
|
},
|
|
{
|
|
"sourceId": "SYS-014",
|
|
"variantId": "V251-SYS-014",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "System Settings / Tenancy / FY",
|
|
"role": "Client",
|
|
"scenario": "Client cannot access branches",
|
|
"steps": "Execute GET /system-settings/branches as Client and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/system-settings/branches",
|
|
"variantName": "Client cannot access branches",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "system-settings-tenancy.spec.js",
|
|
"_login_role": "Client"
|
|
},
|
|
{
|
|
"sourceId": "SYS-015",
|
|
"variantId": "V251-SYS-015",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "System Settings / Tenancy / FY",
|
|
"role": "Consultant",
|
|
"scenario": "Consultant cannot access financial years",
|
|
"steps": "Execute GET /system-settings/financial-years as Consultant and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/system-settings/financial-years",
|
|
"variantName": "Consultant cannot access financial years",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "system-settings-tenancy.spec.js",
|
|
"_login_role": "Consultant"
|
|
},
|
|
{
|
|
"sourceId": "SYS-016",
|
|
"variantId": "V251-SYS-016",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "System Settings / Tenancy / FY",
|
|
"role": "Partner",
|
|
"scenario": "Partner cannot manage RBAC roles unless permitted",
|
|
"steps": "Execute GET /system-settings/rbac/roles as Partner and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/system-settings/rbac/roles",
|
|
"variantName": "Partner cannot manage RBAC roles unless permitted",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "system-settings-tenancy.spec.js",
|
|
"_login_role": "Partner"
|
|
},
|
|
{
|
|
"sourceId": "SYS-017",
|
|
"variantId": "V251-SYS-017",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "System Settings / Tenancy / FY",
|
|
"role": "Manager",
|
|
"scenario": "Manager cannot switch unauthorized tenant",
|
|
"steps": "Execute GET /system-settings/context/tenant/999999 as Manager and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/system-settings/context/tenant/999999",
|
|
"variantName": "Manager cannot switch unauthorized tenant",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "system-settings-tenancy.spec.js",
|
|
"_login_role": "Manager"
|
|
},
|
|
{
|
|
"sourceId": "SYS-018",
|
|
"variantId": "V251-SYS-018",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "System Settings / Tenancy / FY",
|
|
"role": "Firm Admin",
|
|
"scenario": "Firm Admin cannot switch to unauthorized branch",
|
|
"steps": "Execute GET /system-settings/context/branch/999999 as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/system-settings/context/branch/999999",
|
|
"variantName": "Firm Admin cannot switch to unauthorized branch",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "system-settings-tenancy.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "SYS-019",
|
|
"variantId": "V251-SYS-019",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "System Settings / Tenancy / FY",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Tenant create CSRF-less POST rejected",
|
|
"steps": "Execute GET /system-settings/tenants as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/system-settings/tenants",
|
|
"variantName": "Tenant create CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "system-settings-tenancy.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "SYS-020",
|
|
"variantId": "V251-SYS-020",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "System Settings / Tenancy / FY",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Tenant update invalid ID CSRF-less POST rejected",
|
|
"steps": "Execute GET /system-settings/tenants/999999 as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/system-settings/tenants/999999",
|
|
"variantName": "Tenant update invalid ID CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "system-settings-tenancy.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "SYS-021",
|
|
"variantId": "V251-SYS-021",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "System Settings / Tenancy / FY",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Branch create CSRF-less POST rejected",
|
|
"steps": "Execute GET /system-settings/branches as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/system-settings/branches",
|
|
"variantName": "Branch create CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "system-settings-tenancy.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "SYS-022",
|
|
"variantId": "V251-SYS-022",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "System Settings / Tenancy / FY",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Branch update invalid ID CSRF-less POST rejected",
|
|
"steps": "Execute GET /system-settings/branches/999999 as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/system-settings/branches/999999",
|
|
"variantName": "Branch update invalid ID CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "system-settings-tenancy.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "SYS-023",
|
|
"variantId": "V251-SYS-023",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "System Settings / Tenancy / FY",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Branding save CSRF-less POST rejected",
|
|
"steps": "Execute GET /system-settings/branding as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/system-settings/branding",
|
|
"variantName": "Branding save CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "system-settings-tenancy.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "SYS-024",
|
|
"variantId": "V251-SYS-024",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "System Settings / Tenancy / FY",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Financial year create CSRF-less POST rejected",
|
|
"steps": "Execute GET /system-settings/financial-years as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/system-settings/financial-years",
|
|
"variantName": "Financial year create CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "system-settings-tenancy.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "SYS-025",
|
|
"variantId": "V251-SYS-025",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "System Settings / Tenancy / FY",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Make current FY CSRF-less POST rejected",
|
|
"steps": "Execute GET /system-settings/financial-years/999999/make-current as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/system-settings/financial-years/999999/make-current",
|
|
"variantName": "Make current FY CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "system-settings-tenancy.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "SYS-026",
|
|
"variantId": "V251-SYS-026",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "System Settings / Tenancy / FY",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Lock FY CSRF-less POST rejected",
|
|
"steps": "Execute GET /system-settings/financial-years/999999/lock as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/system-settings/financial-years/999999/lock",
|
|
"variantName": "Lock FY CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "system-settings-tenancy.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "SYS-027",
|
|
"variantId": "V251-SYS-027",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "System Settings / Tenancy / FY",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Unlock FY CSRF-less POST rejected",
|
|
"steps": "Execute GET /system-settings/financial-years/999999/unlock as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/system-settings/financial-years/999999/unlock",
|
|
"variantName": "Unlock FY CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "system-settings-tenancy.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "SYS-028",
|
|
"variantId": "V251-SYS-028",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "System Settings / Tenancy / FY",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "FY backup export CSRF-less POST rejected",
|
|
"steps": "Execute GET /system-settings/financial-years/999999/backup-export as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/system-settings/financial-years/999999/backup-export",
|
|
"variantName": "FY backup export CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "system-settings-tenancy.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "SYS-029",
|
|
"variantId": "V251-SYS-029",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "System Settings / Tenancy / FY",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "FY backup download invalid ID safe",
|
|
"steps": "Execute GET /system-settings/financial-years/backups/999999/download as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/system-settings/financial-years/backups/999999/download",
|
|
"variantName": "FY backup download invalid ID safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "system-settings-tenancy.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "SYS-030",
|
|
"variantId": "V251-SYS-030",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "System Settings / Tenancy / FY",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Role create CSRF-less POST rejected",
|
|
"steps": "Execute GET /system-settings/rbac/roles as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/system-settings/rbac/roles",
|
|
"variantName": "Role create CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "system-settings-tenancy.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "SYS-031",
|
|
"variantId": "V251-SYS-031",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "System Settings / Tenancy / FY",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Role update invalid ID CSRF-less POST rejected",
|
|
"steps": "Execute GET /system-settings/rbac/roles/999999 as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/system-settings/rbac/roles/999999",
|
|
"variantName": "Role update invalid ID CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "system-settings-tenancy.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "SYS-032",
|
|
"variantId": "V251-SYS-032",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "System Settings / Tenancy / FY",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Permission assign CSRF-less POST rejected",
|
|
"steps": "Execute GET /system-settings/rbac/roles/999999/permissions as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/system-settings/rbac/roles/999999/permissions",
|
|
"variantName": "Permission assign CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "system-settings-tenancy.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "SYS-033",
|
|
"variantId": "V251-SYS-033",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "System Settings / Tenancy / FY",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Permission remove CSRF-less POST rejected",
|
|
"steps": "Execute GET /system-settings/rbac/roles/999999/permissions/999999/remove as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/system-settings/rbac/roles/999999/permissions/999999/remove",
|
|
"variantName": "Permission remove CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "system-settings-tenancy.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "SYS-034",
|
|
"variantId": "V251-SYS-034",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "System Settings / Tenancy / FY",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Duplicate role invalid POST safe",
|
|
"steps": "Execute GET /system-settings/rbac/roles as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/system-settings/rbac/roles",
|
|
"variantName": "Duplicate role invalid POST safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "system-settings-tenancy.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "SYS-035",
|
|
"variantId": "V251-SYS-035",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "System Settings / Tenancy / FY",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Unauthorized branch context query safe",
|
|
"steps": "Execute GET /system-settings/context/branch/999999?tenant_id=999999 as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/system-settings/context/branch/999999?tenant_id=999999",
|
|
"variantName": "Unauthorized branch context query safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "system-settings-tenancy.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "SYS-036",
|
|
"variantId": "V251-SYS-036",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "System Settings / Tenancy / FY",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Audit log export requires authorization",
|
|
"steps": "Execute GET /system-settings/audit-logs/export as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/system-settings/audit-logs/export",
|
|
"variantName": "Audit log export requires authorization",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "system-settings-tenancy.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "API-001",
|
|
"variantId": "V251-API-001",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "API Auth / RBAC",
|
|
"role": "API/Anonymous",
|
|
"scenario": "API auth token rejects blank credentials",
|
|
"steps": "Execute POST /api/auth/token as API/Anonymous and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/api/auth/token",
|
|
"variantName": "API auth token rejects blank credentials",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "api",
|
|
"_method": "POST",
|
|
"_file": "api-auth-rbac.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "API-002",
|
|
"variantId": "V251-API-002",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "API Auth / RBAC",
|
|
"role": "API/Anonymous",
|
|
"scenario": "API refresh rejects missing refresh token",
|
|
"steps": "Execute POST /api/auth/refresh as API/Anonymous and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/api/auth/refresh",
|
|
"variantName": "API refresh rejects missing refresh token",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "api",
|
|
"_method": "POST",
|
|
"_file": "api-auth-rbac.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "API-003",
|
|
"variantId": "V251-API-003",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "API Auth / RBAC",
|
|
"role": "API/Anonymous",
|
|
"scenario": "API logout without token handled safely",
|
|
"steps": "Execute POST /api/auth/logout as API/Anonymous and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/api/auth/logout",
|
|
"variantName": "API logout without token handled safely",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "api",
|
|
"_method": "POST",
|
|
"_file": "api-auth-rbac.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "API-004",
|
|
"variantId": "V251-API-004",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "API Auth / RBAC",
|
|
"role": "API/Anonymous",
|
|
"scenario": "API me requires authentication",
|
|
"steps": "Execute GET /api/auth/me as API/Anonymous and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/api/auth/me",
|
|
"variantName": "API me requires authentication",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "api",
|
|
"_method": "GET",
|
|
"_file": "api-auth-rbac.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "API-005",
|
|
"variantId": "V251-API-005",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "API Auth / RBAC",
|
|
"role": "API/Anonymous",
|
|
"scenario": "API forgot-password rejects invalid email safely",
|
|
"steps": "Execute POST /api/auth/forgot-password as API/Anonymous and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/api/auth/forgot-password",
|
|
"variantName": "API forgot-password rejects invalid email safely",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "api",
|
|
"_method": "POST",
|
|
"_file": "api-auth-rbac.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "API-006",
|
|
"variantId": "V251-API-006",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "API Auth / RBAC",
|
|
"role": "API/Anonymous",
|
|
"scenario": "API reset-password rejects bogus token",
|
|
"steps": "Execute POST /api/auth/reset-password as API/Anonymous and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/api/auth/reset-password",
|
|
"variantName": "API reset-password rejects bogus token",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "api",
|
|
"_method": "POST",
|
|
"_file": "api-auth-rbac.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "API-007",
|
|
"variantId": "V251-API-007",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "API Auth / RBAC",
|
|
"role": "API/Anonymous",
|
|
"scenario": "API invite accept rejects bogus token",
|
|
"steps": "Execute POST /api/auth/invite/accept as API/Anonymous and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/api/auth/invite/accept",
|
|
"variantName": "API invite accept rejects bogus token",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "api",
|
|
"_method": "POST",
|
|
"_file": "api-auth-rbac.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "API-008",
|
|
"variantId": "V251-API-008",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "API Auth / RBAC",
|
|
"role": "API/Anonymous",
|
|
"scenario": "API users requires authorization",
|
|
"steps": "Execute GET /api/users as API/Anonymous and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/api/users",
|
|
"variantName": "API users requires authorization",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "api",
|
|
"_method": "GET",
|
|
"_file": "api-auth-rbac.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "API-009",
|
|
"variantId": "V251-API-009",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "API Auth / RBAC",
|
|
"role": "API/Anonymous",
|
|
"scenario": "API users create CSRF/auth rejected",
|
|
"steps": "Execute POST /api/users as API/Anonymous and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/api/users",
|
|
"variantName": "API users create CSRF/auth rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "api",
|
|
"_method": "POST",
|
|
"_file": "api-auth-rbac.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "API-010",
|
|
"variantId": "V251-API-010",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "API Auth / RBAC",
|
|
"role": "API/Anonymous",
|
|
"scenario": "API RBAC roles requires authorization",
|
|
"steps": "Execute GET /api/rbac/roles as API/Anonymous and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/api/rbac/roles",
|
|
"variantName": "API RBAC roles requires authorization",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "api",
|
|
"_method": "GET",
|
|
"_file": "api-auth-rbac.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "API-011",
|
|
"variantId": "V251-API-011",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "API Auth / RBAC",
|
|
"role": "API/Anonymous",
|
|
"scenario": "API RBAC roles create auth rejected",
|
|
"steps": "Execute POST /api/rbac/roles as API/Anonymous and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/api/rbac/roles",
|
|
"variantName": "API RBAC roles create auth rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "api",
|
|
"_method": "POST",
|
|
"_file": "api-auth-rbac.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "API-012",
|
|
"variantId": "V251-API-012",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "API Auth / RBAC",
|
|
"role": "API/Anonymous",
|
|
"scenario": "API RBAC permissions requires authorization",
|
|
"steps": "Execute GET /api/rbac/permissions as API/Anonymous and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/api/rbac/permissions",
|
|
"variantName": "API RBAC permissions requires authorization",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "api",
|
|
"_method": "GET",
|
|
"_file": "api-auth-rbac.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "API-013",
|
|
"variantId": "V251-API-013",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "API Auth / RBAC",
|
|
"role": "API/Anonymous",
|
|
"scenario": "API tenancy tenants requires authorization",
|
|
"steps": "Execute GET /api/tenancy/tenants as API/Anonymous and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/api/tenancy/tenants",
|
|
"variantName": "API tenancy tenants requires authorization",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "api",
|
|
"_method": "GET",
|
|
"_file": "api-auth-rbac.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "API-014",
|
|
"variantId": "V251-API-014",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "API Auth / RBAC",
|
|
"role": "API/Anonymous",
|
|
"scenario": "API tenancy branches requires authorization",
|
|
"steps": "Execute GET /api/tenancy/branches as API/Anonymous and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/api/tenancy/branches",
|
|
"variantName": "API tenancy branches requires authorization",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "api",
|
|
"_method": "GET",
|
|
"_file": "api-auth-rbac.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "API-015",
|
|
"variantId": "V251-API-015",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "API Auth / RBAC",
|
|
"role": "API/Anonymous",
|
|
"scenario": "API clients requires authorization",
|
|
"steps": "Execute GET /api/v1/clients as API/Anonymous and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/api/v1/clients",
|
|
"variantName": "API clients requires authorization",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "api",
|
|
"_method": "GET",
|
|
"_file": "api-auth-rbac.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "API-016",
|
|
"variantId": "V251-API-016",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "API Auth / RBAC",
|
|
"role": "API/Anonymous",
|
|
"scenario": "API clients create auth rejected",
|
|
"steps": "Execute POST /api/v1/clients as API/Anonymous and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/api/v1/clients",
|
|
"variantName": "API clients create auth rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "api",
|
|
"_method": "POST",
|
|
"_file": "api-auth-rbac.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "API-017",
|
|
"variantId": "V251-API-017",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "API Auth / RBAC",
|
|
"role": "API/Anonymous",
|
|
"scenario": "API client invalid ID safe",
|
|
"steps": "Execute GET /api/v1/clients/999999 as API/Anonymous and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/api/v1/clients/999999",
|
|
"variantName": "API client invalid ID safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "api",
|
|
"_method": "GET",
|
|
"_file": "api-auth-rbac.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "API-018",
|
|
"variantId": "V251-API-018",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "API Auth / RBAC",
|
|
"role": "API/Anonymous",
|
|
"scenario": "API client update invalid ID auth rejected",
|
|
"steps": "Execute PUT /api/v1/clients/999999 as API/Anonymous and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/api/v1/clients/999999",
|
|
"variantName": "API client update invalid ID auth rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "api",
|
|
"_method": "PUT",
|
|
"_file": "api-auth-rbac.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "API-019",
|
|
"variantId": "V251-API-019",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "API Auth / RBAC",
|
|
"role": "API/Anonymous",
|
|
"scenario": "API client delete invalid ID auth rejected",
|
|
"steps": "Execute DELETE /api/v1/clients/999999 as API/Anonymous and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/api/v1/clients/999999",
|
|
"variantName": "API client delete invalid ID auth rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "api",
|
|
"_method": "DELETE",
|
|
"_file": "api-auth-rbac.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "API-020",
|
|
"variantId": "V251-API-020",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "API Auth / RBAC",
|
|
"role": "API/Anonymous",
|
|
"scenario": "API cross-tenant query does not leak",
|
|
"steps": "Execute GET /api/v1/clients?tenant_id=999999 as API/Anonymous and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/api/v1/clients?tenant_id=999999",
|
|
"variantName": "API cross-tenant query does not leak",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "api",
|
|
"_method": "GET",
|
|
"_file": "api-auth-rbac.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "API-021",
|
|
"variantId": "V251-API-021",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "API Auth / RBAC",
|
|
"role": "API/Anonymous",
|
|
"scenario": "API roles duplicate invalid POST safe",
|
|
"steps": "Execute POST /api/rbac/roles as API/Anonymous and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/api/rbac/roles",
|
|
"variantName": "API roles duplicate invalid POST safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "api",
|
|
"_method": "POST",
|
|
"_file": "api-auth-rbac.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "API-022",
|
|
"variantId": "V251-API-022",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "API Auth / RBAC",
|
|
"role": "API/Anonymous",
|
|
"scenario": "API permission elevation attempt rejected",
|
|
"steps": "Execute POST /api/rbac/roles/999999/permissions as API/Anonymous and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/api/rbac/roles/999999/permissions",
|
|
"variantName": "API permission elevation attempt rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "api",
|
|
"_method": "POST",
|
|
"_file": "api-auth-rbac.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "API-023",
|
|
"variantId": "V251-API-023",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "API Auth / RBAC",
|
|
"role": "API/Anonymous",
|
|
"scenario": "API tenant create auth rejected",
|
|
"steps": "Execute POST /api/tenancy/tenants as API/Anonymous and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/api/tenancy/tenants",
|
|
"variantName": "API tenant create auth rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "api",
|
|
"_method": "POST",
|
|
"_file": "api-auth-rbac.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "API-024",
|
|
"variantId": "V251-API-024",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "API Auth / RBAC",
|
|
"role": "API/Anonymous",
|
|
"scenario": "API branch create auth rejected",
|
|
"steps": "Execute POST /api/tenancy/branches as API/Anonymous and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/api/tenancy/branches",
|
|
"variantName": "API branch create auth rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "api",
|
|
"_method": "POST",
|
|
"_file": "api-auth-rbac.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "API-025",
|
|
"variantId": "V251-API-025",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "API Auth / RBAC",
|
|
"role": "API/Anonymous",
|
|
"scenario": "API malformed JSON safe",
|
|
"steps": "Execute POST /api/auth/token as API/Anonymous and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/api/auth/token",
|
|
"variantName": "API malformed JSON safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "api",
|
|
"_method": "POST",
|
|
"_file": "api-auth-rbac.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "API-026",
|
|
"variantId": "V251-API-026",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "API Auth / RBAC",
|
|
"role": "API/Anonymous",
|
|
"scenario": "API token response does not leak password",
|
|
"steps": "Execute POST /api/auth/token as API/Anonymous and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/api/auth/token",
|
|
"variantName": "API token response does not leak password",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "api",
|
|
"_method": "POST",
|
|
"_file": "api-auth-rbac.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "API-027",
|
|
"variantId": "V251-API-027",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "API Auth / RBAC",
|
|
"role": "API/Anonymous",
|
|
"scenario": "API forgot password does not disclose account existence",
|
|
"steps": "Execute POST /api/auth/forgot-password as API/Anonymous and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/api/auth/forgot-password",
|
|
"variantName": "API forgot password does not disclose account existence",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "api",
|
|
"_method": "POST",
|
|
"_file": "api-auth-rbac.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "API-028",
|
|
"variantId": "V251-API-028",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "API Auth / RBAC",
|
|
"role": "API/Anonymous",
|
|
"scenario": "API reset token replay rejected",
|
|
"steps": "Execute POST /api/auth/reset-password as API/Anonymous and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/api/auth/reset-password",
|
|
"variantName": "API reset token replay rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "api",
|
|
"_method": "POST",
|
|
"_file": "api-auth-rbac.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "API-029",
|
|
"variantId": "V251-API-029",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "API Auth / RBAC",
|
|
"role": "API/Anonymous",
|
|
"scenario": "API rate-limit/bruteforce endpoint safe",
|
|
"steps": "Execute POST /api/auth/token as API/Anonymous and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/api/auth/token",
|
|
"variantName": "API rate-limit/bruteforce endpoint safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "api",
|
|
"_method": "POST",
|
|
"_file": "api-auth-rbac.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "API-030",
|
|
"variantId": "V251-API-030",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "API Auth / RBAC",
|
|
"role": "API/Anonymous",
|
|
"scenario": "API CORS preflight handled safely",
|
|
"steps": "Execute OPTIONS /api/auth/me as API/Anonymous and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/api/auth/me",
|
|
"variantName": "API CORS preflight handled safely",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "api",
|
|
"_method": "OPTIONS",
|
|
"_file": "api-auth-rbac.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "API-031",
|
|
"variantId": "V251-API-031",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "API Auth / RBAC",
|
|
"role": "API/Anonymous",
|
|
"scenario": "API export clients requires authorization",
|
|
"steps": "Execute GET /api/v1/clients/export as API/Anonymous and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/api/v1/clients/export",
|
|
"variantName": "API export clients requires authorization",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "api",
|
|
"_method": "GET",
|
|
"_file": "api-auth-rbac.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "API-032",
|
|
"variantId": "V251-API-032",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "API Auth / RBAC",
|
|
"role": "API/Anonymous",
|
|
"scenario": "API users invalid ID safe",
|
|
"steps": "Execute GET /api/users/999999 as API/Anonymous and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/api/users/999999",
|
|
"variantName": "API users invalid ID safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "api",
|
|
"_method": "GET",
|
|
"_file": "api-auth-rbac.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "API-033",
|
|
"variantId": "V251-API-033",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "API Auth / RBAC",
|
|
"role": "API/Anonymous",
|
|
"scenario": "API users role update auth rejected",
|
|
"steps": "Execute POST /api/users/999999/roles as API/Anonymous and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/api/users/999999/roles",
|
|
"variantName": "API users role update auth rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "api",
|
|
"_method": "POST",
|
|
"_file": "api-auth-rbac.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "API-034",
|
|
"variantId": "V251-API-034",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "API Auth / RBAC",
|
|
"role": "API/Anonymous",
|
|
"scenario": "API permission denied response does not include stack trace",
|
|
"steps": "Execute GET /api/users as API/Anonymous and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/api/users",
|
|
"variantName": "API permission denied response does not include stack trace",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "api",
|
|
"_method": "GET",
|
|
"_file": "api-auth-rbac.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "API-035",
|
|
"variantId": "V251-API-035",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "API Auth / RBAC",
|
|
"role": "API/Anonymous",
|
|
"scenario": "API unknown endpoint returns safe 404",
|
|
"steps": "Execute GET /api/does-not-exist-uat-vapt as API/Anonymous and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/api/does-not-exist-uat-vapt",
|
|
"variantName": "API unknown endpoint returns safe 404",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "api",
|
|
"_method": "GET",
|
|
"_file": "api-auth-rbac.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "AUD-001",
|
|
"variantId": "V251-AUD-001",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Audit Logs",
|
|
"role": "System Admin",
|
|
"scenario": "Audit logs page loads for System Admin",
|
|
"steps": "Execute GET /system-settings/audit-logs as System Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/system-settings/audit-logs",
|
|
"variantName": "Audit logs page loads for System Admin",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "audit-logs.spec.js",
|
|
"_login_role": "System Admin"
|
|
},
|
|
{
|
|
"sourceId": "AUD-002",
|
|
"variantId": "V251-AUD-002",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Audit Logs",
|
|
"role": "Firm Admin",
|
|
"scenario": "Firm Admin audit logs page loads or safely restricted",
|
|
"steps": "Execute GET /system-settings/audit-logs as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/system-settings/audit-logs",
|
|
"variantName": "Firm Admin audit logs page loads or safely restricted",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "audit-logs.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "AUD-003",
|
|
"variantId": "V251-AUD-003",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Audit Logs",
|
|
"role": "Staff",
|
|
"scenario": "Staff cannot access audit logs",
|
|
"steps": "Execute GET /system-settings/audit-logs as Staff and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/system-settings/audit-logs",
|
|
"variantName": "Staff cannot access audit logs",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "audit-logs.spec.js",
|
|
"_login_role": "Staff"
|
|
},
|
|
{
|
|
"sourceId": "AUD-004",
|
|
"variantId": "V251-AUD-004",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Audit Logs",
|
|
"role": "Client",
|
|
"scenario": "Client cannot access audit logs",
|
|
"steps": "Execute GET /system-settings/audit-logs as Client and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/system-settings/audit-logs",
|
|
"variantName": "Client cannot access audit logs",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "audit-logs.spec.js",
|
|
"_login_role": "Client"
|
|
},
|
|
{
|
|
"sourceId": "AUD-005",
|
|
"variantId": "V251-AUD-005",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Audit Logs",
|
|
"role": "System Admin",
|
|
"scenario": "Audit log invalid detail safe",
|
|
"steps": "Execute GET /system-settings/audit-logs/999999 as System Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/system-settings/audit-logs/999999",
|
|
"variantName": "Audit log invalid detail safe",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "audit-logs.spec.js",
|
|
"_login_role": "System Admin"
|
|
},
|
|
{
|
|
"sourceId": "AUD-006",
|
|
"variantId": "V251-AUD-006",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Audit Logs",
|
|
"role": "Staff",
|
|
"scenario": "Audit log export requires permission",
|
|
"steps": "Execute GET /system-settings/audit-logs/export as Staff and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/system-settings/audit-logs/export",
|
|
"variantName": "Audit log export requires permission",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "audit-logs.spec.js",
|
|
"_login_role": "Staff"
|
|
},
|
|
{
|
|
"sourceId": "AUD-007",
|
|
"variantId": "V251-AUD-007",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Audit Logs",
|
|
"role": "System Admin",
|
|
"scenario": "Audit log filters do not crash",
|
|
"steps": "Execute GET /system-settings/audit-logs?module=clients&action=create as System Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/system-settings/audit-logs?module=clients&action=create",
|
|
"variantName": "Audit log filters do not crash",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "audit-logs.spec.js",
|
|
"_login_role": "System Admin"
|
|
},
|
|
{
|
|
"sourceId": "AUD-008",
|
|
"variantId": "V251-AUD-008",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Audit Logs",
|
|
"role": "System Admin",
|
|
"scenario": "Audit logs do not expose password",
|
|
"steps": "Execute GET /system-settings/audit-logs as System Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/system-settings/audit-logs",
|
|
"variantName": "Audit logs do not expose password",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "no-secret",
|
|
"_method": "GET",
|
|
"_file": "audit-logs.spec.js",
|
|
"_login_role": "System Admin"
|
|
},
|
|
{
|
|
"sourceId": "AUD-009",
|
|
"variantId": "V251-AUD-009",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Audit Logs",
|
|
"role": "System Admin",
|
|
"scenario": "Audit logs do not expose OTP",
|
|
"steps": "Execute GET /system-settings/audit-logs as System Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/system-settings/audit-logs",
|
|
"variantName": "Audit logs do not expose OTP",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "no-secret",
|
|
"_method": "GET",
|
|
"_file": "audit-logs.spec.js",
|
|
"_login_role": "System Admin"
|
|
},
|
|
{
|
|
"sourceId": "AUD-010",
|
|
"variantId": "V251-AUD-010",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Audit Logs",
|
|
"role": "System Admin",
|
|
"scenario": "Audit logs do not expose reset token",
|
|
"steps": "Execute GET /system-settings/audit-logs as System Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/system-settings/audit-logs",
|
|
"variantName": "Audit logs do not expose reset token",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "no-secret",
|
|
"_method": "GET",
|
|
"_file": "audit-logs.spec.js",
|
|
"_login_role": "System Admin"
|
|
},
|
|
{
|
|
"sourceId": "AUD-011",
|
|
"variantId": "V251-AUD-011",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Audit Logs",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Audit log export CSRF-less POST rejected",
|
|
"steps": "Execute GET /system-settings/audit-logs/export as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/system-settings/audit-logs/export",
|
|
"variantName": "Audit log export CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "audit-logs.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "AUD-012",
|
|
"variantId": "V251-AUD-012",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Audit Logs",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Audit log delete invalid ID rejected",
|
|
"steps": "Execute GET /system-settings/audit-logs/999999/delete as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/system-settings/audit-logs/999999/delete",
|
|
"variantName": "Audit log delete invalid ID rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "audit-logs.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "AUD-013",
|
|
"variantId": "V251-AUD-013",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Audit Logs",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Audit log tamper invalid POST rejected",
|
|
"steps": "Execute GET /system-settings/audit-logs/999999 as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/system-settings/audit-logs/999999",
|
|
"variantName": "Audit log tamper invalid POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "audit-logs.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "AUD-014",
|
|
"variantId": "V251-AUD-014",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Audit Logs",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Permission denied event generated safely by blocked route",
|
|
"steps": "Execute GET /system-settings/rbac/roles as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/system-settings/rbac/roles",
|
|
"variantName": "Permission denied event generated safely by blocked route",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "audit-logs.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "AUD-015",
|
|
"variantId": "V251-AUD-015",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Audit Logs",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Login failure is handled without stack trace",
|
|
"steps": "Execute GET /login as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/login",
|
|
"variantName": "Login failure is handled without stack trace",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "audit-logs.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "AUD-016",
|
|
"variantId": "V251-AUD-016",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Audit Logs",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Document download audit invalid ID safe",
|
|
"steps": "Execute GET /documents/999999/download as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/documents/999999/download",
|
|
"variantName": "Document download audit invalid ID safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "audit-logs.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "AUD-017",
|
|
"variantId": "V251-AUD-017",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Audit Logs",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Billing payment audit invalid ID safe",
|
|
"steps": "Execute GET /billing/invoices/999999/payments as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/billing/invoices/999999/payments",
|
|
"variantName": "Billing payment audit invalid ID safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "audit-logs.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "AUD-018",
|
|
"variantId": "V251-AUD-018",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Audit Logs",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Notice case audit invalid ID safe",
|
|
"steps": "Execute GET /notice-cases/999999 as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/notice-cases/999999",
|
|
"variantName": "Notice case audit invalid ID safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "audit-logs.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "AUD-019",
|
|
"variantId": "V251-AUD-019",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Audit Logs",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Audit log tenant scope query safe",
|
|
"steps": "Execute GET /system-settings/audit-logs?tenant_id=999999 as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/system-settings/audit-logs?tenant_id=999999",
|
|
"variantName": "Audit log tenant scope query safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "audit-logs.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "AUD-020",
|
|
"variantId": "V251-AUD-020",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Audit Logs",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Audit log branch scope query safe",
|
|
"steps": "Execute GET /system-settings/audit-logs?branch_id=999999 as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/system-settings/audit-logs?branch_id=999999",
|
|
"variantName": "Audit log branch scope query safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "audit-logs.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "DSEC-001",
|
|
"variantId": "V251-DSEC-001",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Document Security Deep",
|
|
"role": "Firm Admin",
|
|
"scenario": "Invalid document download returns safe response",
|
|
"steps": "Execute GET /documents/999999/download as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/documents/999999/download",
|
|
"variantName": "Invalid document download returns safe response",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "document-security-deep.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "DSEC-002",
|
|
"variantId": "V251-DSEC-002",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Document Security Deep",
|
|
"role": "Firm Admin",
|
|
"scenario": "Invalid document version download safe",
|
|
"steps": "Execute GET /documents/999999/versions/999999/download as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/documents/999999/versions/999999/download",
|
|
"variantName": "Invalid document version download safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "document-security-deep.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "DSEC-003",
|
|
"variantId": "V251-DSEC-003",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Document Security Deep",
|
|
"role": "Firm Admin",
|
|
"scenario": "Invalid permanent document download safe",
|
|
"steps": "Execute GET /documents/permanent/999999/download as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/documents/permanent/999999/download",
|
|
"variantName": "Invalid permanent document download safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "document-security-deep.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "DSEC-004",
|
|
"variantId": "V251-DSEC-004",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Document Security Deep",
|
|
"role": "Firm Admin",
|
|
"scenario": "Deleted document invalid download safe",
|
|
"steps": "Execute GET /documents/999999/deleted/download as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/documents/999999/deleted/download",
|
|
"variantName": "Deleted document invalid download safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "document-security-deep.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "DSEC-005",
|
|
"variantId": "V251-DSEC-005",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Document Security Deep",
|
|
"role": "Client",
|
|
"scenario": "Client cannot download other document ID",
|
|
"steps": "Execute GET /documents/999999/download as Client and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/documents/999999/download",
|
|
"variantName": "Client cannot download other document ID",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "document-security-deep.spec.js",
|
|
"_login_role": "Client"
|
|
},
|
|
{
|
|
"sourceId": "DSEC-006",
|
|
"variantId": "V251-DSEC-006",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Document Security Deep",
|
|
"role": "Consultant",
|
|
"scenario": "Consultant cannot download unshared document",
|
|
"steps": "Execute GET /documents/999999/download as Consultant and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/documents/999999/download",
|
|
"variantName": "Consultant cannot download unshared document",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "document-security-deep.spec.js",
|
|
"_login_role": "Consultant"
|
|
},
|
|
{
|
|
"sourceId": "DSEC-007",
|
|
"variantId": "V251-DSEC-007",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Document Security Deep",
|
|
"role": "Staff",
|
|
"scenario": "Staff cannot access storage admin",
|
|
"steps": "Execute GET /documents/storage/nodes as Staff and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/documents/storage/nodes",
|
|
"variantName": "Staff cannot access storage admin",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "document-security-deep.spec.js",
|
|
"_login_role": "Staff"
|
|
},
|
|
{
|
|
"sourceId": "DSEC-008",
|
|
"variantId": "V251-DSEC-008",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Document Security Deep",
|
|
"role": "Public",
|
|
"scenario": "Storage agent jobs require auth",
|
|
"steps": "Execute GET /storage-agent/jobs as Public and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/storage-agent/jobs",
|
|
"variantName": "Storage agent jobs require auth",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "document-security-deep.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "DSEC-009",
|
|
"variantId": "V251-DSEC-009",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Document Security Deep",
|
|
"role": "Public",
|
|
"scenario": "Storage agent heartbeat without secret rejected",
|
|
"steps": "Execute GET /storage-agent/heartbeat as Public and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/storage-agent/heartbeat",
|
|
"variantName": "Storage agent heartbeat without secret rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "document-security-deep.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "DSEC-010",
|
|
"variantId": "V251-DSEC-010",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Document Security Deep",
|
|
"role": "Public",
|
|
"scenario": "Download token invalid safe",
|
|
"steps": "Execute GET /documents/download-token/invalid-token as Public and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/documents/download-token/invalid-token",
|
|
"variantName": "Download token invalid safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "document-security-deep.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "DSEC-011",
|
|
"variantId": "V251-DSEC-011",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Document Security Deep",
|
|
"role": "Firm Admin",
|
|
"scenario": "Document search route does not leak across tenant",
|
|
"steps": "Execute GET /documents?tenant_id=999999 as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/documents?tenant_id=999999",
|
|
"variantName": "Document search route does not leak across tenant",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "document-security-deep.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "DSEC-012",
|
|
"variantId": "V251-DSEC-012",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Document Security Deep",
|
|
"role": "Firm Admin",
|
|
"scenario": "Document repository loads for Firm Admin",
|
|
"steps": "Execute GET /documents as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/documents",
|
|
"variantName": "Document repository loads for Firm Admin",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "document-security-deep.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "DSEC-013",
|
|
"variantId": "V251-DSEC-013",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Document Security Deep",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Document upload double extension rejected",
|
|
"steps": "Execute GET /documents/upload as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/documents/upload",
|
|
"variantName": "Document upload double extension rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "document-security-deep.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "DSEC-014",
|
|
"variantId": "V251-DSEC-014",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Document Security Deep",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Document upload MIME mismatch rejected",
|
|
"steps": "Execute GET /documents/upload as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/documents/upload",
|
|
"variantName": "Document upload MIME mismatch rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "document-security-deep.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "DSEC-015",
|
|
"variantId": "V251-DSEC-015",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Document Security Deep",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Document upload large file rejected or handled",
|
|
"steps": "Execute GET /documents/upload as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/documents/upload",
|
|
"variantName": "Document upload large file rejected or handled",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "document-security-deep.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "DSEC-016",
|
|
"variantId": "V251-DSEC-016",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Document Security Deep",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Document upload path traversal filename rejected",
|
|
"steps": "Execute GET /documents/upload as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/documents/upload",
|
|
"variantName": "Document upload path traversal filename rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "document-security-deep.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "DSEC-017",
|
|
"variantId": "V251-DSEC-017",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Document Security Deep",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Document delete CSRF-less POST rejected",
|
|
"steps": "Execute GET /documents/999999/delete as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/documents/999999/delete",
|
|
"variantName": "Document delete CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "document-security-deep.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "DSEC-018",
|
|
"variantId": "V251-DSEC-018",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Document Security Deep",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Document version delete CSRF-less POST rejected",
|
|
"steps": "Execute GET /documents/999999/versions/999999/delete as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/documents/999999/versions/999999/delete",
|
|
"variantName": "Document version delete CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "document-security-deep.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "DSEC-019",
|
|
"variantId": "V251-DSEC-019",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Document Security Deep",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Permanent document delete CSRF-less POST rejected",
|
|
"steps": "Execute GET /documents/permanent/999999/delete as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/documents/permanent/999999/delete",
|
|
"variantName": "Permanent document delete CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "document-security-deep.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "DSEC-020",
|
|
"variantId": "V251-DSEC-020",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Document Security Deep",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Document move cross-tenant CSRF-less POST rejected",
|
|
"steps": "Execute GET /documents/999999/move as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/documents/999999/move",
|
|
"variantName": "Document move cross-tenant CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "document-security-deep.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "DSEC-021",
|
|
"variantId": "V251-DSEC-021",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Document Security Deep",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Document share with client invalid ID rejected",
|
|
"steps": "Execute GET /documents/999999/share-client as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/documents/999999/share-client",
|
|
"variantName": "Document share with client invalid ID rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "document-security-deep.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "DSEC-022",
|
|
"variantId": "V251-DSEC-022",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Document Security Deep",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Document share with consultant invalid ID rejected",
|
|
"steps": "Execute GET /documents/999999/share-consultant as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/documents/999999/share-consultant",
|
|
"variantName": "Document share with consultant invalid ID rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "document-security-deep.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "DSEC-023",
|
|
"variantId": "V251-DSEC-023",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Document Security Deep",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Storage node create CSRF-less POST rejected",
|
|
"steps": "Execute GET /documents/storage/nodes as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/documents/storage/nodes",
|
|
"variantName": "Storage node create CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "document-security-deep.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "DSEC-024",
|
|
"variantId": "V251-DSEC-024",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Document Security Deep",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Storage agent ack without secret rejected",
|
|
"steps": "Execute GET /storage-agent/jobs/999999/ack as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/storage-agent/jobs/999999/ack",
|
|
"variantName": "Storage agent ack without secret rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "document-security-deep.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "DSEC-025",
|
|
"variantId": "V251-DSEC-025",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Document Security Deep",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Storage agent upload without secret rejected",
|
|
"steps": "Execute GET /storage-agent/jobs/999999/upload as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/storage-agent/jobs/999999/upload",
|
|
"variantName": "Storage agent upload without secret rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "document-security-deep.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "DSEC-026",
|
|
"variantId": "V251-DSEC-026",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Document Security Deep",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Download request expiry invalid safe",
|
|
"steps": "Execute GET /documents/download-requests/999999 as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/documents/download-requests/999999",
|
|
"variantName": "Download request expiry invalid safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "document-security-deep.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "DSEC-027",
|
|
"variantId": "V251-DSEC-027",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Document Security Deep",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Document tag update CSRF-less POST rejected",
|
|
"steps": "Execute GET /documents/999999/tags as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/documents/999999/tags",
|
|
"variantName": "Document tag update CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "document-security-deep.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "DSEC-028",
|
|
"variantId": "V251-DSEC-028",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Document Security Deep",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Document metadata update invalid ID rejected",
|
|
"steps": "Execute GET /documents/999999/edit as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/documents/999999/edit",
|
|
"variantName": "Document metadata update invalid ID rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "document-security-deep.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "WORK2-001",
|
|
"variantId": "V251-WORK2-001",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Work Lifecycle E2E",
|
|
"role": "Firm Admin",
|
|
"scenario": "Engagement create page/list loads",
|
|
"steps": "Execute GET /work/engagements as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/work/engagements",
|
|
"variantName": "Engagement create page/list loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "work-lifecycle-e2e.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "WORK2-002",
|
|
"variantId": "V251-WORK2-002",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Work Lifecycle E2E",
|
|
"role": "Firm Admin",
|
|
"scenario": "Existing engagement detail loads",
|
|
"steps": "Execute GET /work/engagements/1 as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/work/engagements/1",
|
|
"variantName": "Existing engagement detail loads",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "work-lifecycle-e2e.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "WORK2-003",
|
|
"variantId": "V251-WORK2-003",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Work Lifecycle E2E",
|
|
"role": "Staff",
|
|
"scenario": "Staff work board loads",
|
|
"steps": "Execute GET /work as Staff and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/work",
|
|
"variantName": "Staff work board loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "work-lifecycle-e2e.spec.js",
|
|
"_login_role": "Staff"
|
|
},
|
|
{
|
|
"sourceId": "WORK2-004",
|
|
"variantId": "V251-WORK2-004",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Work Lifecycle E2E",
|
|
"role": "Manager",
|
|
"scenario": "Manager team work board loads",
|
|
"steps": "Execute GET /manager/work as Manager and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/manager/work",
|
|
"variantName": "Manager team work board loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "work-lifecycle-e2e.spec.js",
|
|
"_login_role": "Manager"
|
|
},
|
|
{
|
|
"sourceId": "WORK2-005",
|
|
"variantId": "V251-WORK2-005",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Work Lifecycle E2E",
|
|
"role": "Partner",
|
|
"scenario": "Partner reviews page loads",
|
|
"steps": "Execute GET /partner/reviews as Partner and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/partner/reviews",
|
|
"variantName": "Partner reviews page loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "work-lifecycle-e2e.spec.js",
|
|
"_login_role": "Partner"
|
|
},
|
|
{
|
|
"sourceId": "WORK2-006",
|
|
"variantId": "V251-WORK2-006",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Work Lifecycle E2E",
|
|
"role": "Client",
|
|
"scenario": "Client dashboard compliance item list loads",
|
|
"steps": "Execute GET /client/dashboard as Client and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/client/dashboard",
|
|
"variantName": "Client dashboard compliance item list loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "work-lifecycle-e2e.spec.js",
|
|
"_login_role": "Client"
|
|
},
|
|
{
|
|
"sourceId": "WORK2-007",
|
|
"variantId": "V251-WORK2-007",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Work Lifecycle E2E",
|
|
"role": "Consultant",
|
|
"scenario": "Consultant assignment area loads",
|
|
"steps": "Execute GET /consultants as Consultant and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/consultants",
|
|
"variantName": "Consultant assignment area loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "work-lifecycle-e2e.spec.js",
|
|
"_login_role": "Consultant"
|
|
},
|
|
{
|
|
"sourceId": "WORK2-008",
|
|
"variantId": "V251-WORK2-008",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Work Lifecycle E2E",
|
|
"role": "Staff",
|
|
"scenario": "Invalid engagement ID is safe",
|
|
"steps": "Execute GET /work/engagements/999999 as Staff and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/work/engagements/999999",
|
|
"variantName": "Invalid engagement ID is safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "work-lifecycle-e2e.spec.js",
|
|
"_login_role": "Staff"
|
|
},
|
|
{
|
|
"sourceId": "WORK2-009",
|
|
"variantId": "V251-WORK2-009",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Work Lifecycle E2E",
|
|
"role": "Client",
|
|
"scenario": "Client cannot access internal engagement detail",
|
|
"steps": "Execute GET /work/engagements/999999 as Client and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/work/engagements/999999",
|
|
"variantName": "Client cannot access internal engagement detail",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "work-lifecycle-e2e.spec.js",
|
|
"_login_role": "Client"
|
|
},
|
|
{
|
|
"sourceId": "WORK2-010",
|
|
"variantId": "V251-WORK2-010",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Work Lifecycle E2E",
|
|
"role": "Consultant",
|
|
"scenario": "Consultant cannot access internal engagement detail",
|
|
"steps": "Execute GET /work/engagements/999999 as Consultant and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/work/engagements/999999",
|
|
"variantName": "Consultant cannot access internal engagement detail",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "work-lifecycle-e2e.spec.js",
|
|
"_login_role": "Consultant"
|
|
},
|
|
{
|
|
"sourceId": "WORK2-011",
|
|
"variantId": "V251-WORK2-011",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Work Lifecycle E2E",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Create engagement CSRF-less POST rejected",
|
|
"steps": "Execute GET /work/engagements as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/work/engagements",
|
|
"variantName": "Create engagement CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "work-lifecycle-e2e.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "WORK2-012",
|
|
"variantId": "V251-WORK2-012",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Work Lifecycle E2E",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Generate tasks CSRF-less POST rejected",
|
|
"steps": "Execute GET /work/engagements/999999/generate-tasks as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/work/engagements/999999/generate-tasks",
|
|
"variantName": "Generate tasks CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "work-lifecycle-e2e.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "WORK2-013",
|
|
"variantId": "V251-WORK2-013",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Work Lifecycle E2E",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Assign task CSRF-less POST rejected",
|
|
"steps": "Execute GET /work/tasks/999999/assign as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/work/tasks/999999/assign",
|
|
"variantName": "Assign task CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "work-lifecycle-e2e.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "WORK2-014",
|
|
"variantId": "V251-WORK2-014",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Work Lifecycle E2E",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Staff start task invalid ID safe",
|
|
"steps": "Execute GET /work/tasks/999999/start as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/work/tasks/999999/start",
|
|
"variantName": "Staff start task invalid ID safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "work-lifecycle-e2e.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "WORK2-015",
|
|
"variantId": "V251-WORK2-015",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Work Lifecycle E2E",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Staff complete task invalid ID safe",
|
|
"steps": "Execute GET /work/tasks/999999/complete as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/work/tasks/999999/complete",
|
|
"variantName": "Staff complete task invalid ID safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "work-lifecycle-e2e.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "WORK2-016",
|
|
"variantId": "V251-WORK2-016",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Work Lifecycle E2E",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Task upload document invalid ID rejected",
|
|
"steps": "Execute GET /work/tasks/999999/documents/upload as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/work/tasks/999999/documents/upload",
|
|
"variantName": "Task upload document invalid ID rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "work-lifecycle-e2e.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "WORK2-017",
|
|
"variantId": "V251-WORK2-017",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Work Lifecycle E2E",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Manager review invalid task rejected",
|
|
"steps": "Execute GET /work/tasks/999999/review as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/work/tasks/999999/review",
|
|
"variantName": "Manager review invalid task rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "work-lifecycle-e2e.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "WORK2-018",
|
|
"variantId": "V251-WORK2-018",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Work Lifecycle E2E",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Partner approve invalid engagement rejected",
|
|
"steps": "Execute GET /work/engagements/999999/approve as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/work/engagements/999999/approve",
|
|
"variantName": "Partner approve invalid engagement rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "work-lifecycle-e2e.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "WORK2-019",
|
|
"variantId": "V251-WORK2-019",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Work Lifecycle E2E",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Partner reject invalid engagement rejected",
|
|
"steps": "Execute GET /work/engagements/999999/reject as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/work/engagements/999999/reject",
|
|
"variantName": "Partner reject invalid engagement rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "work-lifecycle-e2e.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "WORK2-020",
|
|
"variantId": "V251-WORK2-020",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Work Lifecycle E2E",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Add internal comment CSRF-less POST rejected",
|
|
"steps": "Execute GET /work/engagements/999999/comments as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/work/engagements/999999/comments",
|
|
"variantName": "Add internal comment CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "work-lifecycle-e2e.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "WORK2-021",
|
|
"variantId": "V251-WORK2-021",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Work Lifecycle E2E",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Add client-visible comment invalid route safe",
|
|
"steps": "Execute GET /work/engagements/999999/client-comments as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/work/engagements/999999/client-comments",
|
|
"variantName": "Add client-visible comment invalid route safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "work-lifecycle-e2e.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "WORK2-022",
|
|
"variantId": "V251-WORK2-022",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Work Lifecycle E2E",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Blocked task without reason rejected",
|
|
"steps": "Execute GET /work/tasks/999999/block as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/work/tasks/999999/block",
|
|
"variantName": "Blocked task without reason rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "work-lifecycle-e2e.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "WORK2-023",
|
|
"variantId": "V251-WORK2-023",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Work Lifecycle E2E",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Completed task edit invalid ID safe",
|
|
"steps": "Execute GET /work/tasks/999999/edit as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/work/tasks/999999/edit",
|
|
"variantName": "Completed task edit invalid ID safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "work-lifecycle-e2e.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "WORK2-024",
|
|
"variantId": "V251-WORK2-024",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Work Lifecycle E2E",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Locked FY task change rejected or safe",
|
|
"steps": "Execute GET /work/tasks/999999/status as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/work/tasks/999999/status",
|
|
"variantName": "Locked FY task change rejected or safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "work-lifecycle-e2e.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "WORK2-025",
|
|
"variantId": "V251-WORK2-025",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Work Lifecycle E2E",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Task priority update CSRF-less POST rejected",
|
|
"steps": "Execute GET /work/tasks/999999/priority as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/work/tasks/999999/priority",
|
|
"variantName": "Task priority update CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "work-lifecycle-e2e.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "WORK2-026",
|
|
"variantId": "V251-WORK2-026",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Work Lifecycle E2E",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Task due date update CSRF-less POST rejected",
|
|
"steps": "Execute GET /work/tasks/999999/due-date as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/work/tasks/999999/due-date",
|
|
"variantName": "Task due date update CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "work-lifecycle-e2e.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "WORK2-027",
|
|
"variantId": "V251-WORK2-027",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Work Lifecycle E2E",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Work document download invalid ID safe",
|
|
"steps": "Execute GET /work/documents/999999/download as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/work/documents/999999/download",
|
|
"variantName": "Work document download invalid ID safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "work-lifecycle-e2e.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "WORK2-028",
|
|
"variantId": "V251-WORK2-028",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Work Lifecycle E2E",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Work communication internal note hidden from client route safe",
|
|
"steps": "Execute GET /client/work/engagements/999999/comments as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/client/work/engagements/999999/comments",
|
|
"variantName": "Work communication internal note hidden from client route safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "work-lifecycle-e2e.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "WORK2-029",
|
|
"variantId": "V251-WORK2-029",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Work Lifecycle E2E",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Cross-tenant engagement IDOR safe",
|
|
"steps": "Execute GET /work/engagements/999999?tenant_id=999999 as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/work/engagements/999999?tenant_id=999999",
|
|
"variantName": "Cross-tenant engagement IDOR safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "work-lifecycle-e2e.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "WORK2-030",
|
|
"variantId": "V251-WORK2-030",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Work Lifecycle E2E",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Engagement delete CSRF-less POST rejected",
|
|
"steps": "Execute GET /work/engagements/999999/delete as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/work/engagements/999999/delete",
|
|
"variantName": "Engagement delete CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "work-lifecycle-e2e.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "BIZBILL-001",
|
|
"variantId": "V251-BIZBILL-001",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Billing Business Rules",
|
|
"role": "Firm Admin",
|
|
"scenario": "Billing dashboard loads",
|
|
"steps": "Execute GET /billing as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/billing",
|
|
"variantName": "Billing dashboard loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "billing-business-rules.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "BIZBILL-002",
|
|
"variantId": "V251-BIZBILL-002",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Billing Business Rules",
|
|
"role": "Firm Admin",
|
|
"scenario": "Invoices list loads",
|
|
"steps": "Execute GET /billing/invoices as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/billing/invoices",
|
|
"variantName": "Invoices list loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "billing-business-rules.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "BIZBILL-003",
|
|
"variantId": "V251-BIZBILL-003",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Billing Business Rules",
|
|
"role": "Firm Admin",
|
|
"scenario": "Invoice create page loads",
|
|
"steps": "Execute GET /billing/invoices/new as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/billing/invoices/new",
|
|
"variantName": "Invoice create page loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "billing-business-rules.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "BIZBILL-004",
|
|
"variantId": "V251-BIZBILL-004",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Billing Business Rules",
|
|
"role": "Firm Admin",
|
|
"scenario": "Payments list loads",
|
|
"steps": "Execute GET /billing/payments as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/billing/payments",
|
|
"variantName": "Payments list loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "billing-business-rules.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "BIZBILL-005",
|
|
"variantId": "V251-BIZBILL-005",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Billing Business Rules",
|
|
"role": "Firm Admin",
|
|
"scenario": "Invalid invoice detail safe",
|
|
"steps": "Execute GET /billing/invoices/999999 as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/billing/invoices/999999",
|
|
"variantName": "Invalid invoice detail safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "billing-business-rules.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "BIZBILL-006",
|
|
"variantId": "V251-BIZBILL-006",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Billing Business Rules",
|
|
"role": "Client",
|
|
"scenario": "Client cannot access all invoices",
|
|
"steps": "Execute GET /billing/invoices as Client and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/billing/invoices",
|
|
"variantName": "Client cannot access all invoices",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "billing-business-rules.spec.js",
|
|
"_login_role": "Client"
|
|
},
|
|
{
|
|
"sourceId": "BIZBILL-007",
|
|
"variantId": "V251-BIZBILL-007",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Billing Business Rules",
|
|
"role": "Staff",
|
|
"scenario": "Staff cannot access billing",
|
|
"steps": "Execute GET /billing as Staff and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/billing",
|
|
"variantName": "Staff cannot access billing",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "billing-business-rules.spec.js",
|
|
"_login_role": "Staff"
|
|
},
|
|
{
|
|
"sourceId": "BIZBILL-008",
|
|
"variantId": "V251-BIZBILL-008",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Billing Business Rules",
|
|
"role": "Consultant",
|
|
"scenario": "Consultant cannot access billing",
|
|
"steps": "Execute GET /billing as Consultant and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/billing",
|
|
"variantName": "Consultant cannot access billing",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "billing-business-rules.spec.js",
|
|
"_login_role": "Consultant"
|
|
},
|
|
{
|
|
"sourceId": "BIZBILL-009",
|
|
"variantId": "V251-BIZBILL-009",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Billing Business Rules",
|
|
"role": "Client",
|
|
"scenario": "Client own invoice invalid ID safe",
|
|
"steps": "Execute GET /client/invoices/999999 as Client and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/client/invoices/999999",
|
|
"variantName": "Client own invoice invalid ID safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "billing-business-rules.spec.js",
|
|
"_login_role": "Client"
|
|
},
|
|
{
|
|
"sourceId": "BIZBILL-010",
|
|
"variantId": "V251-BIZBILL-010",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Billing Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Invoice create without line items rejected",
|
|
"steps": "Execute GET /billing/invoices as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/billing/invoices",
|
|
"variantName": "Invoice create without line items rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "billing-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "BIZBILL-011",
|
|
"variantId": "V251-BIZBILL-011",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Billing Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Invoice duplicate number invalid POST safe",
|
|
"steps": "Execute GET /billing/invoices as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/billing/invoices",
|
|
"variantName": "Invoice duplicate number invalid POST safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "billing-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "BIZBILL-012",
|
|
"variantId": "V251-BIZBILL-012",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Billing Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Invoice invalid GST/tax values rejected",
|
|
"steps": "Execute GET /billing/invoices as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/billing/invoices",
|
|
"variantName": "Invoice invalid GST/tax values rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "billing-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "BIZBILL-013",
|
|
"variantId": "V251-BIZBILL-013",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Billing Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Invoice issue CSRF-less POST rejected",
|
|
"steps": "Execute GET /billing/invoices/999999/issue as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/billing/invoices/999999/issue",
|
|
"variantName": "Invoice issue CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "billing-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "BIZBILL-014",
|
|
"variantId": "V251-BIZBILL-014",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Billing Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Invoice cancel CSRF-less POST rejected",
|
|
"steps": "Execute GET /billing/invoices/999999/cancel as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/billing/invoices/999999/cancel",
|
|
"variantName": "Invoice cancel CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "billing-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "BIZBILL-015",
|
|
"variantId": "V251-BIZBILL-015",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Billing Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Void invoice cannot accept payment",
|
|
"steps": "Execute GET /billing/invoices/999999/payments as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/billing/invoices/999999/payments",
|
|
"variantName": "Void invoice cannot accept payment",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "billing-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "BIZBILL-016",
|
|
"variantId": "V251-BIZBILL-016",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Billing Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Partial payment invalid ID safe",
|
|
"steps": "Execute GET /billing/invoices/999999/payments as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/billing/invoices/999999/payments",
|
|
"variantName": "Partial payment invalid ID safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "billing-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "BIZBILL-017",
|
|
"variantId": "V251-BIZBILL-017",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Billing Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Overpayment blocked",
|
|
"steps": "Execute GET /billing/invoices/999999/payments as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/billing/invoices/999999/payments",
|
|
"variantName": "Overpayment blocked",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "billing-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "BIZBILL-018",
|
|
"variantId": "V251-BIZBILL-018",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Billing Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Payment receipt invalid ID safe",
|
|
"steps": "Execute GET /billing/payments/999999/receipt as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/billing/payments/999999/receipt",
|
|
"variantName": "Payment receipt invalid ID safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "billing-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "BIZBILL-019",
|
|
"variantId": "V251-BIZBILL-019",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Billing Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Invoice PDF invalid ID safe",
|
|
"steps": "Execute GET /billing/invoices/999999/pdf as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/billing/invoices/999999/pdf",
|
|
"variantName": "Invoice PDF invalid ID safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "billing-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "BIZBILL-020",
|
|
"variantId": "V251-BIZBILL-020",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Billing Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Invoice print invalid ID safe",
|
|
"steps": "Execute GET /billing/invoices/999999/print as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/billing/invoices/999999/print",
|
|
"variantName": "Invoice print invalid ID safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "billing-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "BIZBILL-021",
|
|
"variantId": "V251-BIZBILL-021",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Billing Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Invoice internal notes hidden from client route safe",
|
|
"steps": "Execute GET /client/invoices/999999 as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/client/invoices/999999",
|
|
"variantName": "Invoice internal notes hidden from client route safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "billing-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "BIZBILL-022",
|
|
"variantId": "V251-BIZBILL-022",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Billing Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Payment delete CSRF-less POST rejected",
|
|
"steps": "Execute GET /billing/payments/999999/delete as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/billing/payments/999999/delete",
|
|
"variantName": "Payment delete CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "billing-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "BIZBILL-023",
|
|
"variantId": "V251-BIZBILL-023",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Billing Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Invoice line update invalid ID rejected",
|
|
"steps": "Execute GET /billing/invoices/999999/lines/999999 as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/billing/invoices/999999/lines/999999",
|
|
"variantName": "Invoice line update invalid ID rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "billing-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "BIZBILL-024",
|
|
"variantId": "V251-BIZBILL-024",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Billing Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Invoice export requires authorization",
|
|
"steps": "Execute GET /billing/invoices/export as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/billing/invoices/export",
|
|
"variantName": "Invoice export requires authorization",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "billing-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "BIZBILL-025",
|
|
"variantId": "V251-BIZBILL-025",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Billing Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Payment export requires authorization",
|
|
"steps": "Execute GET /billing/payments/export as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/billing/payments/export",
|
|
"variantName": "Payment export requires authorization",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "billing-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "BIZBILL-026",
|
|
"variantId": "V251-BIZBILL-026",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Billing Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Cross-client invoice IDOR safe",
|
|
"steps": "Execute GET /billing/invoices/999999?client_id=999999 as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/billing/invoices/999999?client_id=999999",
|
|
"variantName": "Cross-client invoice IDOR safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "billing-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "BIZBILL-027",
|
|
"variantId": "V251-BIZBILL-027",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Billing Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Invoice number sequence endpoint safe",
|
|
"steps": "Execute GET /billing/invoices/next-number as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/billing/invoices/next-number",
|
|
"variantName": "Invoice number sequence endpoint safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "billing-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "NCASE-001",
|
|
"variantId": "V251-NCASE-001",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Notice Case Business Rules",
|
|
"role": "Firm Admin",
|
|
"scenario": "Notice cases list loads",
|
|
"steps": "Execute GET /notice-cases as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/notice-cases",
|
|
"variantName": "Notice cases list loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "notice-case-business-rules.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "NCASE-002",
|
|
"variantId": "V251-NCASE-002",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Notice Case Business Rules",
|
|
"role": "Firm Admin",
|
|
"scenario": "Notice case new page loads",
|
|
"steps": "Execute GET /notice-cases/new as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/notice-cases/new",
|
|
"variantName": "Notice case new page loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "notice-case-business-rules.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "NCASE-003",
|
|
"variantId": "V251-NCASE-003",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Notice Case Business Rules",
|
|
"role": "Firm Admin",
|
|
"scenario": "Invalid case detail safe",
|
|
"steps": "Execute GET /notice-cases/999999 as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/notice-cases/999999",
|
|
"variantName": "Invalid case detail safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "notice-case-business-rules.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "NCASE-004",
|
|
"variantId": "V251-NCASE-004",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Notice Case Business Rules",
|
|
"role": "Client",
|
|
"scenario": "Client cannot access internal case list",
|
|
"steps": "Execute GET /notice-cases as Client and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/notice-cases",
|
|
"variantName": "Client cannot access internal case list",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "notice-case-business-rules.spec.js",
|
|
"_login_role": "Client"
|
|
},
|
|
{
|
|
"sourceId": "NCASE-005",
|
|
"variantId": "V251-NCASE-005",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Notice Case Business Rules",
|
|
"role": "Consultant",
|
|
"scenario": "Consultant cannot access internal case list",
|
|
"steps": "Execute GET /notice-cases as Consultant and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/notice-cases",
|
|
"variantName": "Consultant cannot access internal case list",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "notice-case-business-rules.spec.js",
|
|
"_login_role": "Consultant"
|
|
},
|
|
{
|
|
"sourceId": "NCASE-006",
|
|
"variantId": "V251-NCASE-006",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Notice Case Business Rules",
|
|
"role": "Staff",
|
|
"scenario": "Staff case list access safe",
|
|
"steps": "Execute GET /notice-cases as Staff and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/notice-cases",
|
|
"variantName": "Staff case list access safe",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "notice-case-business-rules.spec.js",
|
|
"_login_role": "Staff"
|
|
},
|
|
{
|
|
"sourceId": "NCASE-007",
|
|
"variantId": "V251-NCASE-007",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Notice Case Business Rules",
|
|
"role": "Firm Admin",
|
|
"scenario": "Invalid case events safe",
|
|
"steps": "Execute GET /notice-cases/999999/events as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/notice-cases/999999/events",
|
|
"variantName": "Invalid case events safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "notice-case-business-rules.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "NCASE-008",
|
|
"variantId": "V251-NCASE-008",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Notice Case Business Rules",
|
|
"role": "Firm Admin",
|
|
"scenario": "Invalid case hearing safe",
|
|
"steps": "Execute GET /notice-cases/999999/hearings as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/notice-cases/999999/hearings",
|
|
"variantName": "Invalid case hearing safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "notice-case-business-rules.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "NCASE-009",
|
|
"variantId": "V251-NCASE-009",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Notice Case Business Rules",
|
|
"role": "Firm Admin",
|
|
"scenario": "Invalid case order safe",
|
|
"steps": "Execute GET /notice-cases/999999/orders as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/notice-cases/999999/orders",
|
|
"variantName": "Invalid case order safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "notice-case-business-rules.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "NCASE-010",
|
|
"variantId": "V251-NCASE-010",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Notice Case Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Create notice case CSRF-less POST rejected",
|
|
"steps": "Execute GET /notice-cases/new as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/notice-cases/new",
|
|
"variantName": "Create notice case CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "notice-case-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "NCASE-011",
|
|
"variantId": "V251-NCASE-011",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Notice Case Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Notice date/hearing date invalid POST safe",
|
|
"steps": "Execute GET /notice-cases/999999/hearings as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/notice-cases/999999/hearings",
|
|
"variantName": "Notice date/hearing date invalid POST safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "notice-case-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "NCASE-012",
|
|
"variantId": "V251-NCASE-012",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Notice Case Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Order date before hearing invalid POST safe",
|
|
"steps": "Execute GET /notice-cases/999999/orders as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/notice-cases/999999/orders",
|
|
"variantName": "Order date before hearing invalid POST safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "notice-case-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "NCASE-013",
|
|
"variantId": "V251-NCASE-013",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Notice Case Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Invalid case status transition rejected",
|
|
"steps": "Execute GET /notice-cases/999999/status as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/notice-cases/999999/status",
|
|
"variantName": "Invalid case status transition rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "notice-case-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "NCASE-014",
|
|
"variantId": "V251-NCASE-014",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Notice Case Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Case document upload invalid ID rejected",
|
|
"steps": "Execute GET /notice-cases/999999/documents/upload as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/notice-cases/999999/documents/upload",
|
|
"variantName": "Case document upload invalid ID rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "notice-case-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "NCASE-015",
|
|
"variantId": "V251-NCASE-015",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Notice Case Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Cross-case document IDOR safe",
|
|
"steps": "Execute GET /notice-cases/999999/documents/999999/download as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/notice-cases/999999/documents/999999/download",
|
|
"variantName": "Cross-case document IDOR safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "notice-case-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "NCASE-016",
|
|
"variantId": "V251-NCASE-016",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Notice Case Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Client-visible document invalid route safe",
|
|
"steps": "Execute GET /client/notice-cases/999999/documents/999999/download as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/client/notice-cases/999999/documents/999999/download",
|
|
"variantName": "Client-visible document invalid route safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "notice-case-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "NCASE-017",
|
|
"variantId": "V251-NCASE-017",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Notice Case Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Internal note hidden from client route safe",
|
|
"steps": "Execute GET /client/notice-cases/999999/notes as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/client/notice-cases/999999/notes",
|
|
"variantName": "Internal note hidden from client route safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "notice-case-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "NCASE-018",
|
|
"variantId": "V251-NCASE-018",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Notice Case Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Case deadline reminder invalid ID safe",
|
|
"steps": "Execute GET /notice-cases/999999/reminders as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/notice-cases/999999/reminders",
|
|
"variantName": "Case deadline reminder invalid ID safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "notice-case-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "NCASE-019",
|
|
"variantId": "V251-NCASE-019",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Notice Case Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Case assignment CSRF-less POST rejected",
|
|
"steps": "Execute GET /notice-cases/999999/assign as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/notice-cases/999999/assign",
|
|
"variantName": "Case assignment CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "notice-case-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "NCASE-020",
|
|
"variantId": "V251-NCASE-020",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Notice Case Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Case event delete CSRF-less POST rejected",
|
|
"steps": "Execute GET /notice-cases/events/999999/delete as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/notice-cases/events/999999/delete",
|
|
"variantName": "Case event delete CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "notice-case-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "NCASE-021",
|
|
"variantId": "V251-NCASE-021",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Notice Case Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Case hearing delete CSRF-less POST rejected",
|
|
"steps": "Execute GET /notice-cases/hearings/999999/delete as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/notice-cases/hearings/999999/delete",
|
|
"variantName": "Case hearing delete CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "notice-case-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "NCASE-022",
|
|
"variantId": "V251-NCASE-022",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Notice Case Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Case order delete CSRF-less POST rejected",
|
|
"steps": "Execute GET /notice-cases/orders/999999/delete as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/notice-cases/orders/999999/delete",
|
|
"variantName": "Case order delete CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "notice-case-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "NCASE-023",
|
|
"variantId": "V251-NCASE-023",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Notice Case Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Cross-tenant notice case IDOR safe",
|
|
"steps": "Execute GET /notice-cases/999999?tenant_id=999999 as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/notice-cases/999999?tenant_id=999999",
|
|
"variantName": "Cross-tenant notice case IDOR safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "notice-case-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "HRRULE-001",
|
|
"variantId": "V251-HRRULE-001",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Employee HR Business Rules",
|
|
"role": "Staff",
|
|
"scenario": "Attendance page loads",
|
|
"steps": "Execute GET /employee/attendance as Staff and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/employee/attendance",
|
|
"variantName": "Attendance page loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "employee-hr-business-rules.spec.js",
|
|
"_login_role": "Staff"
|
|
},
|
|
{
|
|
"sourceId": "HRRULE-002",
|
|
"variantId": "V251-HRRULE-002",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Employee HR Business Rules",
|
|
"role": "Staff",
|
|
"scenario": "Leave page loads",
|
|
"steps": "Execute GET /employee/leaves as Staff and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/employee/leaves",
|
|
"variantName": "Leave page loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "employee-hr-business-rules.spec.js",
|
|
"_login_role": "Staff"
|
|
},
|
|
{
|
|
"sourceId": "HRRULE-003",
|
|
"variantId": "V251-HRRULE-003",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Employee HR Business Rules",
|
|
"role": "Manager",
|
|
"scenario": "Manager team attendance loads",
|
|
"steps": "Execute GET /employees/attendance as Manager and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/employees/attendance",
|
|
"variantName": "Manager team attendance loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "employee-hr-business-rules.spec.js",
|
|
"_login_role": "Manager"
|
|
},
|
|
{
|
|
"sourceId": "HRRULE-004",
|
|
"variantId": "V251-HRRULE-004",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Employee HR Business Rules",
|
|
"role": "Manager",
|
|
"scenario": "Manager team leave loads",
|
|
"steps": "Execute GET /employees/leave as Manager and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/employees/leave",
|
|
"variantName": "Manager team leave loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "employee-hr-business-rules.spec.js",
|
|
"_login_role": "Manager"
|
|
},
|
|
{
|
|
"sourceId": "HRRULE-005",
|
|
"variantId": "V251-HRRULE-005",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Employee HR Business Rules",
|
|
"role": "Firm Admin",
|
|
"scenario": "Payroll page loads for Firm Admin",
|
|
"steps": "Execute GET /employees/payroll as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/employees/payroll",
|
|
"variantName": "Payroll page loads for Firm Admin",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "employee-hr-business-rules.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "HRRULE-006",
|
|
"variantId": "V251-HRRULE-006",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Employee HR Business Rules",
|
|
"role": "Firm Admin",
|
|
"scenario": "Employee documents page loads",
|
|
"steps": "Execute GET /employees/documents as Firm Admin and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "UAT",
|
|
"route": "/employees/documents",
|
|
"variantName": "Employee documents page loads",
|
|
"variantType": "positive",
|
|
"automation": "automated",
|
|
"_kind": "page",
|
|
"_method": "GET",
|
|
"_file": "employee-hr-business-rules.spec.js",
|
|
"_login_role": "Firm Admin"
|
|
},
|
|
{
|
|
"sourceId": "HRRULE-007",
|
|
"variantId": "V251-HRRULE-007",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Employee HR Business Rules",
|
|
"role": "Client",
|
|
"scenario": "Client cannot access attendance",
|
|
"steps": "Execute GET /employee/attendance as Client and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/employee/attendance",
|
|
"variantName": "Client cannot access attendance",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "employee-hr-business-rules.spec.js",
|
|
"_login_role": "Client"
|
|
},
|
|
{
|
|
"sourceId": "HRRULE-008",
|
|
"variantId": "V251-HRRULE-008",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Employee HR Business Rules",
|
|
"role": "Consultant",
|
|
"scenario": "Consultant cannot access payroll",
|
|
"steps": "Execute GET /employees/payroll as Consultant and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/employees/payroll",
|
|
"variantName": "Consultant cannot access payroll",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "employee-hr-business-rules.spec.js",
|
|
"_login_role": "Consultant"
|
|
},
|
|
{
|
|
"sourceId": "HRRULE-009",
|
|
"variantId": "V251-HRRULE-009",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Employee HR Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Duplicate attendance same date rejected",
|
|
"steps": "Execute GET /employee/attendance as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/employee/attendance",
|
|
"variantName": "Duplicate attendance same date rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "employee-hr-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "HRRULE-010",
|
|
"variantId": "V251-HRRULE-010",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Employee HR Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Manual attendance CSRF-less POST rejected",
|
|
"steps": "Execute GET /employees/attendance/manual as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/employees/attendance/manual",
|
|
"variantName": "Manual attendance CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "employee-hr-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "HRRULE-011",
|
|
"variantId": "V251-HRRULE-011",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Employee HR Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Leave exceeding balance rejected",
|
|
"steps": "Execute GET /employee/leaves as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/employee/leaves",
|
|
"variantName": "Leave exceeding balance rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "employee-hr-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "HRRULE-012",
|
|
"variantId": "V251-HRRULE-012",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Employee HR Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Leave approve invalid ID rejected",
|
|
"steps": "Execute GET /employees/leave/999999/approve as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/employees/leave/999999/approve",
|
|
"variantName": "Leave approve invalid ID rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "employee-hr-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "HRRULE-013",
|
|
"variantId": "V251-HRRULE-013",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Employee HR Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Leave reject invalid ID rejected",
|
|
"steps": "Execute GET /employees/leave/999999/reject as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/employees/leave/999999/reject",
|
|
"variantName": "Leave reject invalid ID rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "employee-hr-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "HRRULE-014",
|
|
"variantId": "V251-HRRULE-014",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Employee HR Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Payroll generate CSRF-less POST rejected",
|
|
"steps": "Execute GET /employees/payroll/generate as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/employees/payroll/generate",
|
|
"variantName": "Payroll generate CSRF-less POST rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "employee-hr-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "HRRULE-015",
|
|
"variantId": "V251-HRRULE-015",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Employee HR Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Payroll approve before generate invalid safe",
|
|
"steps": "Execute GET /employees/payroll/999999/approve as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/employees/payroll/999999/approve",
|
|
"variantName": "Payroll approve before generate invalid safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "employee-hr-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "HRRULE-016",
|
|
"variantId": "V251-HRRULE-016",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Employee HR Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Payroll paid before approval invalid safe",
|
|
"steps": "Execute GET /employees/payroll/999999/mark-paid as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/employees/payroll/999999/mark-paid",
|
|
"variantName": "Payroll paid before approval invalid safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "employee-hr-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "HRRULE-017",
|
|
"variantId": "V251-HRRULE-017",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Employee HR Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Payslip invalid ID safe",
|
|
"steps": "Execute GET /employees/payroll/999999/payslip as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/employees/payroll/999999/payslip",
|
|
"variantName": "Payslip invalid ID safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "employee-hr-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "HRRULE-018",
|
|
"variantId": "V251-HRRULE-018",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Employee HR Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Offboarding complete invalid employee safe",
|
|
"steps": "Execute GET /employees/999999/offboarding/complete as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/employees/999999/offboarding/complete",
|
|
"variantName": "Offboarding complete invalid employee safe",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "safe-page",
|
|
"_method": "GET",
|
|
"_file": "employee-hr-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "HRRULE-019",
|
|
"variantId": "V251-HRRULE-019",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Employee HR Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Employee document approve invalid ID rejected",
|
|
"steps": "Execute GET /employees/documents/999999/approve as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/employees/documents/999999/approve",
|
|
"variantName": "Employee document approve invalid ID rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "employee-hr-business-rules.spec.js",
|
|
"_login_role": null
|
|
},
|
|
{
|
|
"sourceId": "HRRULE-020",
|
|
"variantId": "V251-HRRULE-020",
|
|
"sheet": "UAT_VAPT_v2_5_1_Additions",
|
|
"module": "Employee HR Business Rules",
|
|
"role": "Anonymous/Attacker",
|
|
"scenario": "Employee document reject invalid ID rejected",
|
|
"steps": "Execute GET /employees/documents/999999/reject as Anonymous/Attacker and verify expected security/business outcome.",
|
|
"expected": "Route/page responds without backend 500 and follows expected authorization/validation rules.",
|
|
"priority": "High",
|
|
"type": "VAPT",
|
|
"route": "/employees/documents/999999/reject",
|
|
"variantName": "Employee document reject invalid ID rejected",
|
|
"variantType": "security",
|
|
"automation": "automated",
|
|
"_kind": "post",
|
|
"_method": "GET",
|
|
"_file": "employee-hr-business-rules.spec.js",
|
|
"_login_role": null
|
|
}
|
|
] |