{ "ursId": "URS-005", "title": "Prevent Uncertified Reps from Creating Orders", "timestamp": "2026-04-21T05:56:54.462Z", "durationMs": 92197, "config": { "inboxUrl": "http://localhost:61056", "dbHost": "localhost", "dbPort": 61057, "dbName": "cc_repinbox_dev" }, "setup": { "status": "pass" }, "scenarios": [ { "name": "Step 1: Uncertified rep blocked", "status": "pass", "description": "Step 1: Uncertified rep blocked", "screenshots": [ "/Users/jason/projects/casecohort/code/validation_test_results/urs-005-uncertified-rep-orders/2026-04-21T05-56-54-461Z/screenshots/step-01-ryan-logged-in.png", "/Users/jason/projects/casecohort/code/validation_test_results/urs-005-uncertified-rep-orders/2026-04-21T05-56-54-461Z/screenshots/step-01-order-blocked.png", "/Users/jason/projects/casecohort/code/validation_test_results/urs-005-uncertified-rep-orders/2026-04-21T05-56-54-461Z/screenshots/step-01-order-request-blocked.png" ], "explanation": "Proves the system correctly prevents an uncertified representative from creating orders. Ryan Delauintana has no active manufacturer approval, so the bill-only order creation form displays a \"Manufacturer Approval Required\" warning and presents no selectable manufacturers. The same block appears on both the /billing/new and /orders/requests/new routes, confirming the enforcement is applied consistently across order entry points.", "expectedAuditActions": [ "user_log:user:login" ] }, { "name": "Step 2: Certified rep control", "status": "pass", "description": "Step 2: Certified rep control", "screenshots": [ "/Users/jason/projects/casecohort/code/validation_test_results/urs-005-uncertified-rep-orders/2026-04-21T05-56-54-461Z/screenshots/step-02-bob-logged-in.png", "/Users/jason/projects/casecohort/code/validation_test_results/urs-005-uncertified-rep-orders/2026-04-21T05-56-54-461Z/screenshots/step-02-order-form-accessible.png" ], "explanation": "Control condition confirming that the blocking behavior is targeted at uncertified reps only. Bob Kauffman, whose representation relationship is active, can access the order creation form without any approval warning. The form auto-advances to Step 2 with ZuriMED pre-selected. This eliminates the possibility that the block in Step 1 is a general UI defect.", "expectedAuditActions": [ "user_log:user:login" ] }, { "name": "Step 3: Manufacturer approval", "status": "pass", "description": "Step 3: Manufacturer approval", "screenshots": [ "/Users/jason/projects/casecohort/code/validation_test_results/urs-005-uncertified-rep-orders/2026-04-21T05-56-54-461Z/screenshots/step-03-mark-logged-in.png", "/Users/jason/projects/casecohort/code/validation_test_results/urs-005-uncertified-rep-orders/2026-04-21T05-56-54-461Z/screenshots/step-03-ryan-pending-status.png", "/Users/jason/projects/casecohort/code/validation_test_results/urs-005-uncertified-rep-orders/2026-04-21T05-56-54-461Z/screenshots/step-03-approval-dialog.png", "/Users/jason/projects/casecohort/code/validation_test_results/urs-005-uncertified-rep-orders/2026-04-21T05-56-54-461Z/screenshots/step-03-ryan-active-status.png" ], "explanation": "The ZuriMED manufacturer user (Mark) navigates to Ryan's representative detail page, confirms the status shows \"Pending Approval\", and clicks the \"Approve Representative\" button. After submission the status badge updates to \"Active\", demonstrating that the approval workflow functions end-to-end and transitions the relationship to the certified state required for order creation.", "expectedAuditActions": [ "user_log:rep_onboarding_request_approved" ] }, { "name": "Step 4: Certified order creation", "status": "pass", "description": "Step 4: Certified order creation", "screenshots": [ "/Users/jason/projects/casecohort/code/validation_test_results/urs-005-uncertified-rep-orders/2026-04-21T05-56-54-461Z/screenshots/step-04-ryan-logged-in-certified.png", "/Users/jason/projects/casecohort/code/validation_test_results/urs-005-uncertified-rep-orders/2026-04-21T05-56-54-461Z/screenshots/step-04-form-accessible.png", "/Users/jason/projects/casecohort/code/validation_test_results/urs-005-uncertified-rep-orders/2026-04-21T05-56-54-461Z/screenshots/step-04-account-selected.png", "/Users/jason/projects/casecohort/code/validation_test_results/urs-005-uncertified-rep-orders/2026-04-21T05-56-54-461Z/screenshots/step-04-devices-selected.png", "/Users/jason/projects/casecohort/code/validation_test_results/urs-005-uncertified-rep-orders/2026-04-21T05-56-54-461Z/screenshots/step-04-documents.png", "/Users/jason/projects/casecohort/code/validation_test_results/urs-005-uncertified-rep-orders/2026-04-21T05-56-54-461Z/screenshots/step-04-review.png", "/Users/jason/projects/casecohort/code/validation_test_results/urs-005-uncertified-rep-orders/2026-04-21T05-56-54-461Z/screenshots/step-04-order-submitted.png" ], "explanation": "Validates that the now-approved representative can create and submit a bill-only order without restriction. Ryan logs in after certification, accesses /billing/new without any approval warning, selects an account, adds a product with lot number, and successfully submits the order. The system redirects to /billing, confirming the requirement gate is lifted after manufacturer approval.", "expectedAuditActions": [ "decision:bill_only_order.enqueue_upload_classification" ] } ], "dbValidations": [ { "name": "Ryan relationship now active", "query": "SELECT id, status, active, responded_at, responded_by_user_id\n FROM organization_representation_relationships\n WHERE id = $1", "status": "pass", "rows": [ { "id": "95d6e7f8-a9b0-1234-9012-345678901234", "status": "active", "active": true, "responded_at": "2026-04-21T05:57:40.841Z", "responded_by_user_id": "d4e5f6a7-b8c9-0123-def1-234567890123" } ], "assertion": "Ryan's representation relationship should be active after manufacturer approval" }, { "name": "Bob relationship still active (control)", "query": "SELECT id, status, active\n FROM organization_representation_relationships\n WHERE id = $1", "status": "pass", "rows": [ { "id": "84c5d6e7-f8a9-0123-8901-234567890123", "status": "proposed_pending_onboarding", "active": true } ], "assertion": "Bob's active flag should remain true and unaffected by Ryan's approval flow" }, { "name": "Status change history recorded", "query": "SELECT id, to_status, from_status, changed_by_user_id, created_at\n FROM organization_representation_request_status_changes\n WHERE relationship_id = $1\n AND created_at > NOW() - INTERVAL '30 minutes'\n ORDER BY created_at DESC\n LIMIT 5", "status": "pass", "rows": [ { "id": "019dae9d-a76a-7c0a-bfbc-cd4caccb59b0", "to_status": "active", "from_status": "proposed", "changed_by_user_id": "d4e5f6a7-b8c9-0123-def1-234567890123", "created_at": "2026-04-21T05:57:40.823Z" } ], "assertion": "Status change to \"active\" should be recorded in history table" }, { "name": "Billing order created by Ryan after certification", "query": "SELECT bo.id, bo.order_number, bo.status, bo.created_at, bo.created_by_user_id\n FROM billing_orders bo\n WHERE bo.created_by_user_id = $1\n AND bo.created_at > NOW() - INTERVAL '30 minutes'\n ORDER BY bo.created_at DESC\n LIMIT 5", "status": "pass", "rows": [ { "id": "019dae9e-446a-78c2-87d9-1c3aad356e87", "order_number": "BO-1", "status": "submitted", "created_at": "2026-04-21T05:58:21.012Z", "created_by_user_id": "28c9d0e1-f2a3-4567-2345-678901234567" } ], "assertion": "At least one billing order should have been created by Ryan after being certified" }, { "name": "Audit trail for representative approval", "query": "SELECT ae.id, ae.event_type, ae.action, ae.created_at, ae.user_id, ae.object_id,\n substring(ae.payload::text, 1, 500) as payload_preview\n FROM audit_events ae\n WHERE ae.created_at > NOW() - INTERVAL '30 minutes'\n AND (ae.object_id = $1 OR ae.object_id = $2)\n ORDER BY ae.created_at DESC\n LIMIT 10", "status": "pass", "rows": [ { "id": "019dae9d-a76b-73f3-9c81-4352ec9332e4", "event_type": "user_log", "action": "rep_onboarding_request_approved", "created_at": "2026-04-21T05:57:40.849Z", "user_id": "d4e5f6a7-b8c9-0123-def1-234567890123", "object_id": "95d6e7f8-a9b0-1234-9012-345678901234", "payload_preview": "{\"userId\": \"28c9d0e1-f2a3-4567-2345-678901234567\", \"userName\": \"Ryan Delauintana\", \"userEmail\": \"ryan.delauintana@stellartech.com\", \"distributorOrganizationId\": \"b2c3d4e5-f6a7-8901-bcde-f12345678901\", \"manufacturerOrganizationId\": \"a1b2c3d4-e5f6-7890-abcd-ef1234567890\"}" } ], "assertion": "Audit/decision events should exist referencing Ryan after the approval action" } ], "overallStatus": "pass", "outputDir": "/Users/jason/projects/casecohort/code/validation_test_results/urs-005-uncertified-rep-orders/2026-04-21T05-56-54-461Z", "auditStartTime": "2026-04-21T05:56:52.491Z", "auditEventEvidence": [ { "createdAt": "2026-04-21T05:56:56.528Z", "eventType": "user_log", "action": "user:login", "userEmail": "ryan.delauintana@stellartech.com", "userId": "28c9d0e1-f2a3-4567-2345-678901234567", "organizationName": "StellarTech Medical Solutions", "organizationId": "b2c3d4e5-f6a7-8901-bcde-f12345678901", "objectId": null, "secondaryObjectId": null, "payload": { "email": "ryan.delauintana@stellartech.com" }, "route": "/login", "traceId": "00000000000000000000000000000000" }, { "createdAt": "2026-04-21T05:57:14.185Z", "eventType": "user_log", "action": "user:login", "userEmail": "bob.kauffman@stellartech.com", "userId": "17b8c9d0-e1f2-3456-1234-567890123456", "organizationName": "StellarTech Medical Solutions", "organizationId": "b2c3d4e5-f6a7-8901-bcde-f12345678901", "objectId": null, "secondaryObjectId": null, "payload": { "email": "bob.kauffman@stellartech.com" }, "route": "/login", "traceId": "00000000000000000000000000000000" }, { "createdAt": "2026-04-21T05:57:28.639Z", "eventType": "user_log", "action": "user:login", "userEmail": "mark.manufacturer@zurimed.com", "userId": "d4e5f6a7-b8c9-0123-def1-234567890123", "organizationName": "ZuriMED", "organizationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890", "objectId": null, "secondaryObjectId": null, "payload": { "email": "mark.manufacturer@zurimed.com" }, "route": "/login", "traceId": "00000000000000000000000000000000" }, { "createdAt": "2026-04-21T05:57:40.849Z", "eventType": "user_log", "action": "rep_onboarding_request_approved", "userEmail": "mark.manufacturer@zurimed.com", "userId": "d4e5f6a7-b8c9-0123-def1-234567890123", "organizationName": "ZuriMED", "organizationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890", "objectId": "95d6e7f8-a9b0-1234-9012-345678901234", "secondaryObjectId": "95d6e7f8-a9b0-1234-9012-345678901234", "payload": { "userId": "28c9d0e1-f2a3-4567-2345-678901234567", "userName": "Ryan Delauintana", "userEmail": "ryan.delauintana@stellartech.com", "distributorOrganizationId": "b2c3d4e5-f6a7-8901-bcde-f12345678901", "manufacturerOrganizationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890" }, "route": "/representatives/[userId]", "traceId": "00000000000000000000000000000000" }, { "createdAt": "2026-04-21T05:57:52.604Z", "eventType": "user_log", "action": "user:login", "userEmail": "ryan.delauintana@stellartech.com", "userId": "28c9d0e1-f2a3-4567-2345-678901234567", "organizationName": "StellarTech Medical Solutions", "organizationId": "b2c3d4e5-f6a7-8901-bcde-f12345678901", "objectId": null, "secondaryObjectId": null, "payload": { "email": "ryan.delauintana@stellartech.com" }, "route": "/login", "traceId": "00000000000000000000000000000000" }, { "createdAt": "2026-04-21T05:58:21.012Z", "eventType": "decision", "action": "bill_only_order.enqueue_upload_classification", "userEmail": "ryan.delauintana@stellartech.com", "userId": "28c9d0e1-f2a3-4567-2345-678901234567", "organizationName": "ZuriMED", "organizationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890", "objectId": "019dae9e-446a-78c2-87d9-1c3aad356e87", "secondaryObjectId": null, "payload": { "reason": "No uploaded PO documents", "performed": false, "entityType": "billing_order", "fileSourceOrganizationId": "b2c3d4e5-f6a7-8901-bcde-f12345678901", "hasSelectedPurchaseOrderId": false, "purchaseOrderDocumentCount": 0 }, "route": null, "traceId": null } ], "auditQuery": "SELECT\n ae.created_at,\n ae.event_type,\n ae.action,\n ae.user_id,\n u.email AS user_email,\n ae.organization_id,\n o.name AS organization_name,\n ae.object_id,\n ae.secondary_object_id,\n ae.payload,\n ae.route,\n ae.trace_id\n FROM audit_events ae\n LEFT JOIN users u ON u.id = ae.user_id\n LEFT JOIN organizations o ON o.id = ae.organization_id\n WHERE ae.created_at >= $1\n AND ae.organization_id = ANY($2::uuid[])\n ORDER BY ae.created_at ASC", "videoPath": "/Users/jason/projects/casecohort/code/validation_test_results/urs-005-uncertified-rep-orders/2026-04-21T05-56-54-461Z/videos/step-01-uncertified-blocked.webm" }