# Validation Report: URS-031 **Title:** Record all transactions with timestamps and user IDs **Date:** 2026-04-23T03:40:21.350Z **Duration:** 105.1s **Overall Status:** ✅ PASS ## User Requirement > The system shall record all transactions (orders, edits, returns) with timestamps and user IDs. *Source: `User_Requirement_Specifications_ZuriMED_DeviceFlow.xlsx` — the run below proves the system meets this requirement.* ## Environment - **Inbox URL:** http://localhost:63922 - **Database:** localhost:63923/cc_repinbox_dev ## Setup Status: ✅ PASS ## Test Steps Each step below corresponds to one Playwright test that ran sequentially. Screenshots and video recordings provide visual evidence of the UI behaviour. ### 1. Step 1: Logged in as Bob Kauffman — ✅ PASS **What this step proves:** Authenticates as Bob Kauffman (StellarTech sales rep), establishing the user identity that will be recorded against subsequent transactions. **Audit events generated by this step:** *(Evidence matched by declared name — step timing not available or no events fell in window)* | Time | Type | Action | User | Org | Performed | |------|------|--------|------|-----|-----------| | 2026-04-23 03:40:24Z | user_log | user:login | bob.kauffman@stellartech.com | StellarTech Medical Solutions | — | | 2026-04-23 03:40:28Z | user_log | user:login | bob.kauffman@stellartech.com | StellarTech Medical Solutions | — | | 2026-04-23 03:40:59Z | user_log | user:login | bob.kauffman@stellartech.com | StellarTech Medical Solutions | — | | 2026-04-23 03:41:28Z | user_log | user:login | bob.kauffman@stellartech.com | StellarTech Medical Solutions | — | | 2026-04-23 03:41:37Z | user_log | user:login | bob.kauffman@stellartech.com | StellarTech Medical Solutions | — | | 2026-04-23 03:41:47Z | user_log | user:login | mark.manufacturer@zurimed.com | ZuriMED | — | **Screenshots:** ![step 01 logged in](screenshots/step-01-logged-in.png) **Video recording:** [▶ Watch step recording](videos/step-01-login-bob.webm) --- ### 2. Step 2: First order — ✅ PASS **What this step proves:** Submits the first bill-only order as Bob Kauffman. The system records the order in billing_orders with created_by_user_id and a server-side created_at timestamp. **Audit events generated by this step:** *(Evidence scoped to step execution window: 2026-04-23T03:40:38.555Z → 2026-04-23T03:40:55.374Z)* | Time | Type | Action | User | Org | Performed | |------|------|--------|------|-----|-----------| | 2026-04-23 03:40:52Z | decision | bill_only_order.enqueue_upload_classification | bob.kauffman@stellartech.com | ZuriMED | no | | 2026-04-23 03:40:53Z | transactional_email | new_bill_only | — | StellarTech Medical Solutions | — | **Emails triggered by this step:** *(Evidence matched by declared name — step timing not available or no events fell in window)* **Email 1: New Bill-Only Order - 4/22/2026 - ZuriMED BO-1** Template: `New_Bill-Only_Order_-_4_22_2026_-_ZuriMED_BO-1` ![New Bill-Only Order - 4/22/2026 - ZuriMED BO-1](screenshots/emails/2026-04-23T03-40-53-185Z-New_Bill-Only_Order_-_4_22_2026_-_ZuriMED_BO-1.png) **Email 2: New Bill-Only Order - 4/22/2026 - ZuriMED BO-2** Template: `New_Bill-Only_Order_-_4_22_2026_-_ZuriMED_BO-2` ![New Bill-Only Order - 4/22/2026 - ZuriMED BO-2](screenshots/emails/2026-04-23T03-41-23-712Z-New_Bill-Only_Order_-_4_22_2026_-_ZuriMED_BO-2.png) **Screenshots:** ![step 02 account selected](screenshots/step-02-account-selected.png) ![step 02 devices selected](screenshots/step-02-devices-selected.png) ![step 02 documents](screenshots/step-02-documents.png) ![step 02 review](screenshots/step-02-review.png) ![step 02 order submitted](screenshots/step-02-order-submitted.png) **Video recording:** [▶ Watch step recording](videos/step-02-first-order.webm) --- ### 3. Step 3: Second order — ✅ PASS **What this step proves:** Submits a second bill-only order, demonstrating that each transaction is recorded independently with its own user ID and a distinct timestamp. **Audit events generated by this step:** *(Evidence matched by declared name — step timing not available or no events fell in window)* | Time | Type | Action | User | Org | Performed | |------|------|--------|------|-----|-----------| | 2026-04-23 03:40:52Z | decision | bill_only_order.enqueue_upload_classification | bob.kauffman@stellartech.com | ZuriMED | no | | 2026-04-23 03:41:22Z | decision | bill_only_order.enqueue_upload_classification | bob.kauffman@stellartech.com | ZuriMED | no | **Emails triggered by this step:** *(Evidence matched by declared name — step timing not available or no events fell in window)* **Email 1: New Bill-Only Order - 4/22/2026 - ZuriMED BO-1** Template: `New_Bill-Only_Order_-_4_22_2026_-_ZuriMED_BO-1` ![New Bill-Only Order - 4/22/2026 - ZuriMED BO-1](screenshots/emails/2026-04-23T03-40-53-185Z-New_Bill-Only_Order_-_4_22_2026_-_ZuriMED_BO-1.png) **Email 2: New Bill-Only Order - 4/22/2026 - ZuriMED BO-2** Template: `New_Bill-Only_Order_-_4_22_2026_-_ZuriMED_BO-2` ![New Bill-Only Order - 4/22/2026 - ZuriMED BO-2](screenshots/emails/2026-04-23T03-41-23-712Z-New_Bill-Only_Order_-_4_22_2026_-_ZuriMED_BO-2.png) **Screenshots:** ![step 03 second order submitted](screenshots/step-03-second-order-submitted.png) **Video recording:** [▶ Watch step recording](videos/step-03-second-order.webm) --- ### 4. Step 4: Billing list with recorded transactions — ✅ PASS **What this step proves:** Views the billing list as Bob, confirming that the Submitter and Created columns expose the recorded user and timestamp for each transaction in the UI. **Screenshots:** ![step 04 billing list](screenshots/step-04-billing-list.png) **Video recording:** [▶ Watch step recording](videos/step-04-billing-list.webm) --- ### 5. Step 5: Returns list — ✅ PASS **What this step proves:** Views the returns list, confirming that the Created By and Created columns expose user and timestamp attribution for return transactions. **Screenshots:** ![step 05 returns list](screenshots/step-05-returns-list.png) **Video recording:** [▶ Watch step recording](videos/step-05-returns-list.webm) --- ### 6. Step 6a: Cross-user billing view — ✅ PASS **What this step proves:** Logs in as Mark Manufacturer to verify that Bob's order transactions are visible to a different authorized user with the original user attribution intact. **Audit events generated by this step:** *(Evidence matched by declared name — step timing not available or no events fell in window)* | Time | Type | Action | User | Org | Performed | |------|------|--------|------|-----|-----------| | 2026-04-23 03:40:24Z | user_log | user:login | bob.kauffman@stellartech.com | StellarTech Medical Solutions | — | | 2026-04-23 03:40:28Z | user_log | user:login | bob.kauffman@stellartech.com | StellarTech Medical Solutions | — | | 2026-04-23 03:40:59Z | user_log | user:login | bob.kauffman@stellartech.com | StellarTech Medical Solutions | — | | 2026-04-23 03:41:28Z | user_log | user:login | bob.kauffman@stellartech.com | StellarTech Medical Solutions | — | | 2026-04-23 03:41:37Z | user_log | user:login | bob.kauffman@stellartech.com | StellarTech Medical Solutions | — | | 2026-04-23 03:41:47Z | user_log | user:login | mark.manufacturer@zurimed.com | ZuriMED | — | **Screenshots:** ![step 06 cross user billing](screenshots/step-06-cross-user-billing.png) **Video recording:** [▶ Watch step recording](videos/step-06-cross-user.webm) --- ### 7. Step 6b: Cross-user returns view — ✅ PASS **What this step proves:** As Mark Manufacturer, verifies that return transactions are also visible cross-user with Created By and Created columns showing the original submitter. **Screenshots:** ![step 06 cross user returns](screenshots/step-06-cross-user-returns.png) --- ### 8. Step 7: Combined transaction log — ✅ PASS **What this step proves:** Renders a live query from billing_orders, inventory_transactions, audit_events, and returns tables, proving every recorded transaction has a user and timestamp. **Screenshots:** ![step 07 transaction log](screenshots/step-07-transaction-log.png) **Video recording:** [▶ Watch step recording](videos/step-07-transaction-log.webm) --- ## Database Validations The following SQL queries ran against the application database after the Playwright scenarios completed. Each query asserts a specific condition that proves the feature under test persisted its data correctly. ### Bill-only orders recorded with user ID + timestamp — ✅ PASS **Assertion:** At least two billing_orders created by Bob in the test window, each with created_by_user_id and created_at populated ```sql SELECT id, order_number, status, created_by_user_id, created_at FROM billing_orders WHERE created_by_user_id = $1 AND created_at > NOW() - INTERVAL '30 minutes' ORDER BY created_at ASC ``` | id | order_number | status | created_by_user_id | created_at | | --- | --- | --- | --- | --- | | 019db86d-21a6-74a3-8d9f-67abdfa5ad90 | BO-1 | submitted | 17b8c9d0-e1f2-3456-1234-567890123456 | 2026-04-23T03:40:52.988Z | | 019db86d-934d-7cdc-88aa-3991c337a79c | BO-2 | submitted | 17b8c9d0-e1f2-3456-1234-567890123456 | 2026-04-23T03:41:22.105Z | ### Inventory transactions recorded with timestamp — ✅ PASS **Assertion:** inventory_transactions rows exist for the bill-only orders, each with a non-null created_at ```sql SELECT id, source_type, source_id, created_at, distributor_organization_id, manufacturer_organization_id FROM inventory_transactions WHERE source_type = 'bill_only_order' AND created_at > NOW() - INTERVAL '30 minutes' AND (distributor_organization_id = $1 OR manufacturer_organization_id = $1) ORDER BY created_at ASC ``` | id | source_type | source_id | created_at | distributor_organization_id | manufacturer_organization_id | | --- | --- | --- | --- | --- | --- | | 019db86d-21ad-75a3-b84c-afde6725568f | bill_only_order | 019db86d-21a6-74a3-8d9f-67abdfa5ad90 | 2026-04-23T03:40:52.988Z | b2c3d4e5-f6a7-8901-bcde-f12345678901 | NULL | | 019db86d-9350-7721-8240-903fbc5f9d40 | bill_only_order | 019db86d-934d-7cdc-88aa-3991c337a79c | 2026-04-23T03:41:22.105Z | b2c3d4e5-f6a7-8901-bcde-f12345678901 | NULL | ### Inventory history records each change with a timestamp — ✅ PASS **Assertion:** inventory_history contains bill_only_order rows in the test window, each with created_at populated ```sql SELECT ih.id, ih.item_id, ih.quantity, ih.info, ih.created_at FROM inventory_history ih WHERE ih.created_at > NOW() - INTERVAL '30 minutes' AND ih.info->>'reason' = 'bill_only_order' ORDER BY ih.created_at ASC LIMIT 20 ``` | id | item_id | quantity | info | created_at | | --- | --- | --- | --- | --- | | 019db86d-21b5-736c-9727-918b7a2a0aa3 | fc040d7d-bd90-4c8b-bd18-f25925eee646 | 2 | `{"action":"removed","reason":"bill_only_order","bestEffort":true,"billingOrderId":"019db86d-21a6-74a3-8d9f-67abdfa5ad90","shortageQuantity":0,"requestedQuantity":2}` | 2026-04-23T03:40:52.988Z | | 019db86d-21b5-736c-9727-918c1445c1ce | 8106a817-5ccb-4bcb-b312-38de2a4c973b | 3 | `{"action":"removed","reason":"bill_only_order","bestEffort":true,"billingOrderId":"019db86d-21a6-74a3-8d9f-67abdfa5ad90","shortageQuantity":0,"requestedQuantity":3}` | 2026-04-23T03:40:52.988Z | | 019db86d-9352-71ed-9975-11fd8d7ec39d | fc040d7d-bd90-4c8b-bd18-f25925eee646 | 1 | `{"action":"removed","reason":"bill_only_order","bestEffort":true,"billingOrderId":"019db86d-934d-7cdc-88aa-3991c337a79c","shortageQuantity":0,"requestedQuantity":1}` | 2026-04-23T03:41:22.105Z | | 019db86d-9352-71ed-9975-11fedfc060b4 | 8106a817-5ccb-4bcb-b312-38de2a4c973b | 1 | `{"action":"removed","reason":"bill_only_order","bestEffort":true,"billingOrderId":"019db86d-934d-7cdc-88aa-3991c337a79c","shortageQuantity":0,"requestedQuantity":1}` | 2026-04-23T03:41:22.105Z | ### Audit events recorded with user ID + timestamp — ✅ PASS **Assertion:** At least one audit_events row in the test window has both user_id and created_at populated, and no row is missing created_at ```sql SELECT id, organization_id, user_id, event_type, action, object_id, created_at FROM audit_events WHERE created_at > NOW() - INTERVAL '30 minutes' AND organization_id IN ($1, $2) ORDER BY created_at ASC LIMIT 50 ``` | id | organization_id | user_id | event_type | action | object_id | created_at | | --- | --- | --- | --- | --- | --- | --- | | 019db86c-b123-759c-a87e-3e8943060fc7 | b2c3d4e5-f6a7-8901-bcde-f12345678901 | 17b8c9d0-e1f2-3456-1234-567890123456 | user_log | user:login | NULL | 2026-04-23T03:40:24.238Z | | 019db86c-c197-7359-80b3-bc5ef64946cb | b2c3d4e5-f6a7-8901-bcde-f12345678901 | 17b8c9d0-e1f2-3456-1234-567890123456 | user_log | user:login | NULL | 2026-04-23T03:40:28.447Z | | 019db86d-21ba-7786-a46c-811dbca686ea | a1b2c3d4-e5f6-7890-abcd-ef1234567890 | 17b8c9d0-e1f2-3456-1234-567890123456 | decision | bill_only_order.enqueue_upload_classification | 019db86d-21a6-74a3-8d9f-67abdfa5ad90 | 2026-04-23T03:40:52.988Z | | 019db86d-2251-7781-9956-7273e8a616dc | b2c3d4e5-f6a7-8901-bcde-f12345678901 | NULL | transactional_email | new_bill_only | 019db86d-21a6-74a3-8d9f-67abdfa5ad90 | 2026-04-23T03:40:53.241Z | | 019db86d-3a1d-7744-a2bc-460c68e8f1a4 | b2c3d4e5-f6a7-8901-bcde-f12345678901 | 17b8c9d0-e1f2-3456-1234-567890123456 | user_log | user:login | NULL | 2026-04-23T03:40:59.298Z | | 019db86d-9355-7617-9380-af41cc7dd6ff | a1b2c3d4-e5f6-7890-abcd-ef1234567890 | 17b8c9d0-e1f2-3456-1234-567890123456 | decision | bill_only_order.enqueue_upload_classification | 019db86d-934d-7cdc-88aa-3991c337a79c | 2026-04-23T03:41:22.105Z | | 019db86d-9985-7b49-82c4-3890f4728cbf | b2c3d4e5-f6a7-8901-bcde-f12345678901 | NULL | transactional_email | new_bill_only | 019db86d-934d-7cdc-88aa-3991c337a79c | 2026-04-23T03:41:23.730Z | | 019db86d-ab6c-7c51-8bd5-2219bbcac632 | b2c3d4e5-f6a7-8901-bcde-f12345678901 | 17b8c9d0-e1f2-3456-1234-567890123456 | user_log | user:login | NULL | 2026-04-23T03:41:28.319Z | | 019db86d-cea0-7777-b8c6-5d2260ba4d5a | b2c3d4e5-f6a7-8901-bcde-f12345678901 | 17b8c9d0-e1f2-3456-1234-567890123456 | user_log | user:login | NULL | 2026-04-23T03:41:37.323Z | | 019db86d-f48f-7101-8fa7-19c7c866ce29 | a1b2c3d4-e5f6-7890-abcd-ef1234567890 | d4e5f6a7-b8c9-0123-def1-234567890123 | user_log | user:login | NULL | 2026-04-23T03:41:47.031Z | ### Returns have created_by_user_id + created_at populated — ✅ PASS **Assertion:** All pre-seeded returns (and any created during the test) have non-null created_by_user_id and created_at ```sql SELECT r.id, r.return_number, r.status, r.created_by_user_id, r.created_at, u.email AS created_by_email FROM returns r LEFT JOIN users u ON u.id = r.created_by_user_id WHERE r.return_number = ANY($1) OR r.created_at > NOW() - INTERVAL '30 minutes' ORDER BY r.created_at ASC ``` | id | return_number | status | created_by_user_id | created_at | created_by_email | | --- | --- | --- | --- | --- | --- | | ca000003-0000-4000-8000-000000000003 | ZRI-RET-2025-003 | submitted | 17b8c9d0-e1f2-3456-1234-567890123456 | 2026-03-24T02:44:53.534Z | bob.kauffman@stellartech.com | | ca000002-0000-4000-8000-000000000002 | ZRI-RET-2025-002 | submitted | 28c9d0e1-f2a3-4567-2345-678901234567 | 2026-04-09T02:44:53.534Z | ryan.delauintana@stellartech.com | | ca000001-0000-4000-8000-000000000001 | ZRI-RET-2025-001 | submitted | 17b8c9d0-e1f2-3456-1234-567890123456 | 2026-04-20T02:44:53.534Z | bob.kauffman@stellartech.com | ### Inventory transactions timestamped at or after their triggering order — ✅ PASS **Assertion:** For every bill-only order in the test window, the earliest inventory_transaction linked to it has created_at >= billing_order.created_at ```sql SELECT bo.order_number, bo.created_at AS order_created_at, MIN(it.created_at) AS first_txn_created_at FROM billing_orders bo JOIN inventory_transactions it ON it.source_type = 'bill_only_order' AND it.source_id = bo.id WHERE bo.created_by_user_id = $1 AND bo.created_at > NOW() - INTERVAL '30 minutes' GROUP BY bo.id, bo.order_number, bo.created_at ``` | order_number | order_created_at | first_txn_created_at | | --- | --- | --- | | BO-1 | 2026-04-23T03:40:52.988Z | 2026-04-23T03:40:52.988Z | | BO-2 | 2026-04-23T03:41:22.105Z | 2026-04-23T03:41:22.105Z | ### Multiple distinct users represented across transactions — ✅ PASS **Assertion:** The combined transaction set (orders, returns, audit events) contains at least two distinct user IDs ```sql SELECT DISTINCT user_id FROM ( SELECT created_by_user_id AS user_id FROM billing_orders WHERE created_at > NOW() - INTERVAL '30 minutes' AND created_by_user_id IS NOT NULL UNION SELECT created_by_user_id AS user_id FROM returns WHERE return_number = ANY($1) UNION SELECT user_id FROM audit_events WHERE created_at > NOW() - INTERVAL '30 minutes' AND user_id IS NOT NULL ) u ORDER BY user_id ``` | user_id | | --- | | 17b8c9d0-e1f2-3456-1234-567890123456 | | 28c9d0e1-f2a3-4567-2345-678901234567 | | d4e5f6a7-b8c9-0123-def1-234567890123 | ## Audit & Email Assertion Ledger Per-declaration outcome of every `expectedAuditActions` and `expectedEmailTemplates` entry written into the orchestrator. Missing evidence here is a real test failure, not a soft warning. ### Audit Action Assertions Each row asserts that a declared `expectedAuditActions` entry produced a matching row in `audit_events`. A ❌ flips overall status to FAIL — the declaration is real proof, not just an annotation. | Step | Expected Audit Action | Found | |------|-----------------------|-------| | Step 1: Logged in as Bob Kauffman | `user_log:user:login` | ✅ | | Step 2: First order | `decision:bill_only_order.enqueue_upload_classification` | ✅ | | Step 3: Second order | `decision:bill_only_order.enqueue_upload_classification` | ✅ | | Step 6: Cross-user billing view | `user_log:user:login` | ✅ | ### Email Template Assertions Each row asserts that a declared `expectedEmailTemplates` entry was matched (case-insensitive substring) by a captured email subject or template. A ❌ flips overall status to FAIL. | Step | Expected Template | Found | |------|-------------------|-------| | Step 2: First order | `New Bill-Only Order` | ✅ | | Step 3: Second order | `New Bill-Only Order` | ✅ | ## Audit Log Events Every row written to `audit_events` while this test was running (scoped to the demo organizations). Provides compliance evidence that user actions are traced end-to-end (URS-003). **Capture window start:** 2026-04-23T03:40:19.452Z
Query used to capture events ```sql SELECT ae.created_at, ae.event_type, ae.action, ae.user_id, u.email AS user_email, ae.organization_id, o.name AS organization_name, ae.object_id, ae.secondary_object_id, ae.payload, ae.route, ae.trace_id FROM audit_events ae LEFT JOIN users u ON u.id = ae.user_id LEFT JOIN organizations o ON o.id = ae.organization_id WHERE ae.created_at >= $1 AND ae.organization_id = ANY($2::uuid[]) ORDER BY ae.created_at ASC ```
10 event(s) captured: | Time | Type | Action | User | Org | Object ID | Performed | Reason | |------|------|--------|------|-----|-----------|-----------|--------| | 2026-04-23 03:40:24Z | user_log | user:login | bob.kauffman@stellartech.com | StellarTech Medical Solutions | — | — | | | 2026-04-23 03:40:28Z | user_log | user:login | bob.kauffman@stellartech.com | StellarTech Medical Solutions | — | — | | | 2026-04-23 03:40:52Z | decision | bill_only_order.enqueue_upload_classification | bob.kauffman@stellartech.com | ZuriMED | 019db86d-21a6-74a3-8d9f-67abdfa5ad90 | no | No uploaded PO documents | | 2026-04-23 03:40:53Z | transactional_email | new_bill_only | — | StellarTech Medical Solutions | 019db86d-21a6-74a3-8d9f-67abdfa5ad90 | — | | | 2026-04-23 03:40:59Z | user_log | user:login | bob.kauffman@stellartech.com | StellarTech Medical Solutions | — | — | | | 2026-04-23 03:41:22Z | decision | bill_only_order.enqueue_upload_classification | bob.kauffman@stellartech.com | ZuriMED | 019db86d-934d-7cdc-88aa-3991c337a79c | no | No uploaded PO documents | | 2026-04-23 03:41:23Z | transactional_email | new_bill_only | — | StellarTech Medical Solutions | 019db86d-934d-7cdc-88aa-3991c337a79c | — | | | 2026-04-23 03:41:28Z | user_log | user:login | bob.kauffman@stellartech.com | StellarTech Medical Solutions | — | — | | | 2026-04-23 03:41:37Z | user_log | user:login | bob.kauffman@stellartech.com | StellarTech Medical Solutions | — | — | | | 2026-04-23 03:41:47Z | user_log | user:login | mark.manufacturer@zurimed.com | ZuriMED | — | — | | ## Email Evidence 2 notification email(s) were captured during this test run. Each email is rendered as a screenshot for compliance review. ### 1. New Bill-Only Order - 4/22/2026 - ZuriMED BO-1 **Template:** `New_Bill-Only_Order_-_4_22_2026_-_ZuriMED_BO-1` ![New Bill-Only Order - 4/22/2026 - ZuriMED BO-1](screenshots/emails/2026-04-23T03-40-53-185Z-New_Bill-Only_Order_-_4_22_2026_-_ZuriMED_BO-1.png) ### 2. New Bill-Only Order - 4/22/2026 - ZuriMED BO-2 **Template:** `New_Bill-Only_Order_-_4_22_2026_-_ZuriMED_BO-2` ![New Bill-Only Order - 4/22/2026 - ZuriMED BO-2](screenshots/emails/2026-04-23T03-41-23-712Z-New_Bill-Only_Order_-_4_22_2026_-_ZuriMED_BO-2.png)