{ "ursId": "URS-034", "title": "Export Order and Inventory History for Audits", "timestamp": "2026-08-03T23:03:34.983Z", "durationMs": 59720, "config": { "inboxUrl": "http://localhost:40997", "dbHost": "localhost", "dbPort": 32801, "dbName": "cc_repinbox_dev" }, "setup": { "status": "pass" }, "scenarios": [ { "name": "Step 1: Exports page overview", "status": "pass", "description": "Step 1: Exports page overview", "screenshots": [ "/home/runner/_work/code/code/validation_test_results/urs-034-export-audit-history/2026-08-03T23-03-34-982Z/screenshots/step-01-exports-page-overview.png", "/home/runner/_work/code/code/validation_test_results/urs-034-export-audit-history/2026-08-03T23-03-34-982Z/screenshots/step-01-exports-page-all-cards.png" ], "explanation": "Logs in as an admin user (Dan Distributor) and navigates to the /exports page, confirming that export options for Orders and Inventory are visible to authorized users.", "expectedAuditActions": [ "user_log:user:login" ], "startedAt": "2026-08-03T23:03:46.445Z", "finishedAt": "2026-08-03T23:03:48.434Z", "videoPath": "/home/runner/_work/code/code/validation_test_results/urs-034-export-audit-history/2026-08-03T23-03-34-982Z/videos/step-01-exports-page.webm" }, { "name": "Step 2: Export order history", "status": "pass", "description": "Step 2: Export order history", "screenshots": [ "/home/runner/_work/code/code/validation_test_results/urs-034-export-audit-history/2026-08-03T23-03-34-982Z/screenshots/step-02-before-order-export.png", "/home/runner/_work/code/code/validation_test_results/urs-034-export-audit-history/2026-08-03T23-03-34-982Z/screenshots/step-02-orders-csv-content.png" ], "explanation": "Downloads the Orders CSV export, verifying that order history can be exported for audits and that the file contains the expected audit columns including order numbers, status, and creation dates. The download itself is audited: the endpoint writes an `export:orders` audit event capturing the acting user, timestamp, and the number of rows exported, so the act of exporting compliance data is itself traceable.", "expectedAuditActions": [ "export:export:orders" ], "startedAt": "2026-08-03T23:03:56.791Z", "finishedAt": "2026-08-03T23:04:00.703Z", "videoPath": "/home/runner/_work/code/code/validation_test_results/urs-034-export-audit-history/2026-08-03T23-03-34-982Z/videos/step-02-export-orders.webm" }, { "name": "Step 3: Order export verification", "status": "pass", "description": "Step 3: Order export verification", "screenshots": [ "/home/runner/_work/code/code/validation_test_results/urs-034-export-audit-history/2026-08-03T23-03-34-982Z/screenshots/step-03-orders-verification.png" ], "explanation": "Verifies the downloaded order CSV contains all required audit fields with non-empty values, confirming the export provides complete audit-ready data.", "startedAt": "2026-08-03T23:04:02.745Z", "finishedAt": "2026-08-03T23:04:02.745Z", "videoPath": "/home/runner/_work/code/code/validation_test_results/urs-034-export-audit-history/2026-08-03T23-03-34-982Z/videos/step-03-verify-orders.webm" }, { "name": "Step 4: Export inventory", "status": "pass", "description": "Step 4: Export inventory", "screenshots": [ "/home/runner/_work/code/code/validation_test_results/urs-034-export-audit-history/2026-08-03T23-03-34-982Z/screenshots/step-04-after-inventory-export.png", "/home/runner/_work/code/code/validation_test_results/urs-034-export-audit-history/2026-08-03T23-03-34-982Z/screenshots/step-04-inventory-csv-content.png" ], "explanation": "Downloads the Inventory CSV export, verifying that inventory history is exportable for audits with the expected columns including location and quantity data. The download is audited: the endpoint writes an `export:inventory` audit event capturing the acting user, timestamp, and exported row count.", "expectedAuditActions": [ "export:export:inventory" ], "startedAt": "2026-08-03T23:04:14.897Z", "finishedAt": "2026-08-03T23:04:15.512Z", "videoPath": "/home/runner/_work/code/code/validation_test_results/urs-034-export-audit-history/2026-08-03T23-03-34-982Z/videos/step-04-export-inventory.webm" }, { "name": "Step 5: Date range filtering", "status": "pass", "description": "Step 5: Date range filtering", "screenshots": [ "/home/runner/_work/code/code/validation_test_results/urs-034-export-audit-history/2026-08-03T23-03-34-982Z/screenshots/step-05-date-range-comparison.png" ], "explanation": "Confirms that the date range filter on the orders export works correctly: a narrow historical range returns zero results while a wide range spanning the test data returns the expected records. Each filtered download writes its own `export:orders` audit event, and the applied `from`/`to` range is recorded in the event payload (`dateFrom`/`dateTo`) — proving that not only the export but the exact date window queried is captured for audit.", "expectedAuditActions": [ "export:export:orders" ], "startedAt": "2026-08-03T23:04:21.303Z", "finishedAt": "2026-08-03T23:04:21.303Z", "videoPath": "/home/runner/_work/code/code/validation_test_results/urs-034-export-audit-history/2026-08-03T23-03-34-982Z/videos/step-05-date-range-filter.webm" }, { "name": "Step 6: Permission restriction", "status": "pass", "description": "Step 6: Permission restriction", "screenshots": [ "/home/runner/_work/code/code/validation_test_results/urs-034-export-audit-history/2026-08-03T23-03-34-982Z/screenshots/step-06-rep-exports-restricted.png" ], "explanation": "Logs in as Rana Reyes (Sales Rep without export permissions) and verifies that the /exports page and the direct CSV endpoint deny access, enforcing role-based export access control.", "expectedAuditActions": [ "user_log:user:login" ], "startedAt": "2026-08-03T23:04:33.082Z", "finishedAt": "2026-08-03T23:04:33.082Z", "videoPath": "/home/runner/_work/code/code/validation_test_results/urs-034-export-audit-history/2026-08-03T23-03-34-982Z/videos/step-06-permission-restriction.webm" } ], "dbValidations": [ { "name": "Exports feature flag enabled", "query": "SELECT id, value FROM feature_flags\n WHERE id = 'exports' AND organization_id = $1", "status": "pass", "rows": [ { "id": "exports", "value": true } ], "assertion": "The \"exports\" feature flag should be enabled for Corveta" }, { "name": "Admin role has exports:access", "query": "SELECT p.permission FROM permissions p\n WHERE p.actor_id = $1 AND p.permission = 'exports:access'", "status": "pass", "rows": [ { "permission": "exports:access" } ], "assertion": "The Corveta Admin role should have exports:access permission" }, { "name": "Sales rep role lacks exports:access", "query": "SELECT p.permission FROM permissions p\n WHERE p.actor_id = $1 AND p.permission = 'exports:access'", "status": "pass", "rows": [], "assertion": "The Sales Rep role should NOT have exports:access permission" }, { "name": "Order requests exist for organization", "query": "SELECT COUNT(*) as count,\n MIN(created_at) as oldest_order,\n MAX(created_at) as newest_order\n FROM order_requests\n WHERE requesting_organization_id = $1 OR fulfilling_organization_id = $1", "status": "pass", "rows": [ { "count": "3", "oldest_order": "2026-07-04T23:03:35.017Z", "newest_order": "2026-07-29T23:03:35.017Z" } ], "assertion": "At least one order request should exist for Corveta" }, { "name": "Inventory items exist for organization", "query": "SELECT COUNT(*) as count\n FROM inventory_items\n WHERE organization_id = $1\n AND (quantity_ready > 0 OR quantity_backordered > 0 OR quantity_in_transit > 0)", "status": "pass", "rows": [ { "count": "13" } ], "assertion": "At least one inventory item with positive quantity should exist for Corveta" }, { "name": "Admin user has Admin role", "query": "SELECT u.email, u.name, r.name as role_name, r.id as role_id\n FROM users u\n JOIN user_roles ur ON ur.user_id = u.id\n JOIN roles r ON r.id = ur.role_id\n WHERE u.id = $1 AND ur.organization_id = $2", "status": "pass", "rows": [ { "email": "dan.distributor@corvetasurgical.com", "name": "Dan Distributor", "role_name": "Corveta Admin", "role_id": "40e1f2a3-b4c5-6789-4567-890123456789" } ], "assertion": "Dan Distributor should have the Admin role for Corveta" }, { "name": "Orders export download is audited", "query": "SELECT ae.created_at,\n ae.action,\n u.email AS user_email,\n ae.payload->>'exportType' AS export_type,\n ae.payload->>'rowCount' AS row_count,\n ae.payload->>'dateFrom' AS date_from,\n ae.payload->>'dateTo' AS date_to\n FROM audit_events ae\n LEFT JOIN users u ON u.id = ae.user_id\n WHERE ae.organization_id = $1\n AND ae.event_type = 'export'\n AND ae.action = 'export:orders'\n AND ae.created_at >= NOW() - INTERVAL '30 minutes'\n ORDER BY ae.created_at DESC\n LIMIT 10", "status": "pass", "rows": [ { "created_at": "2026-08-03T23:04:20.713Z", "action": "export:orders", "user_email": "dan.distributor@corvetasurgical.com", "export_type": "orders", "row_count": "4", "date_from": "2024-08-03", "date_to": "2026-08-03" }, { "created_at": "2026-08-03T23:04:20.681Z", "action": "export:orders", "user_email": "dan.distributor@corvetasurgical.com", "export_type": "orders", "row_count": "0", "date_from": "2020-01-01", "date_to": "2020-01-02" }, { "created_at": "2026-08-03T23:03:57.403Z", "action": "export:orders", "user_email": "dan.distributor@corvetasurgical.com", "export_type": "orders", "row_count": "4", "date_from": "2026-05-03", "date_to": "2026-08-03" } ], "assertion": "Downloading the orders CSV should write an \"export:orders\" audit event capturing the acting user, row count, and any date range applied" }, { "name": "Inventory export download is audited", "query": "SELECT ae.created_at,\n ae.action,\n u.email AS user_email,\n ae.payload->>'exportType' AS export_type,\n ae.payload->>'rowCount' AS row_count\n FROM audit_events ae\n LEFT JOIN users u ON u.id = ae.user_id\n WHERE ae.organization_id = $1\n AND ae.event_type = 'export'\n AND ae.action = 'export:inventory'\n AND ae.created_at >= NOW() - INTERVAL '30 minutes'\n ORDER BY ae.created_at DESC\n LIMIT 10", "status": "pass", "rows": [ { "created_at": "2026-08-03T23:04:13.400Z", "action": "export:inventory", "user_email": "dan.distributor@corvetasurgical.com", "export_type": "inventory", "row_count": "13" } ], "assertion": "Downloading the inventory CSV should write an \"export:inventory\" audit event capturing the acting user and row count" } ], "overallStatus": "pass", "outputDir": "/home/runner/_work/code/code/validation_test_results/urs-034-export-audit-history/2026-08-03T23-03-34-982Z", "auditStartTime": "2026-08-03T23:03:33.098Z", "auditEventEvidence": [ { "createdAt": "2026-08-03T23:03:41.476Z", "eventType": "user_log", "action": "user:login", "userEmail": "dan.distributor@corvetasurgical.com", "userId": "c3d4e5f6-a7b8-9012-cdef-123456789012", "organizationName": "Corveta Surgical Group", "organizationId": "b2c3d4e5-f6a7-8901-bcde-f12345678901", "objectId": null, "secondaryObjectId": null, "payload": { "email": "dan.distributor@corvetasurgical.com" }, "route": "/login", "traceId": "00000000000000000000000000000000" }, { "createdAt": "2026-08-03T23:03:51.825Z", "eventType": "user_log", "action": "user:login", "userEmail": "dan.distributor@corvetasurgical.com", "userId": "c3d4e5f6-a7b8-9012-cdef-123456789012", "organizationName": "Corveta Surgical Group", "organizationId": "b2c3d4e5-f6a7-8901-bcde-f12345678901", "objectId": null, "secondaryObjectId": null, "payload": { "email": "dan.distributor@corvetasurgical.com" }, "route": "/login", "traceId": "00000000000000000000000000000000" }, { "createdAt": "2026-08-03T23:03:57.403Z", "eventType": "export", "action": "export:orders", "userEmail": "dan.distributor@corvetasurgical.com", "userId": "c3d4e5f6-a7b8-9012-cdef-123456789012", "organizationName": "Corveta Surgical Group", "organizationId": "b2c3d4e5-f6a7-8901-bcde-f12345678901", "objectId": null, "secondaryObjectId": null, "payload": { "dateTo": "2026-08-03", "dateFrom": "2026-05-03", "rowCount": 4, "exportType": "orders" }, "route": null, "traceId": null }, { "createdAt": "2026-08-03T23:04:07.794Z", "eventType": "user_log", "action": "user:login", "userEmail": "dan.distributor@corvetasurgical.com", "userId": "c3d4e5f6-a7b8-9012-cdef-123456789012", "organizationName": "Corveta Surgical Group", "organizationId": "b2c3d4e5-f6a7-8901-bcde-f12345678901", "objectId": null, "secondaryObjectId": null, "payload": { "email": "dan.distributor@corvetasurgical.com" }, "route": "/login", "traceId": "00000000000000000000000000000000" }, { "createdAt": "2026-08-03T23:04:13.400Z", "eventType": "export", "action": "export:inventory", "userEmail": "dan.distributor@corvetasurgical.com", "userId": "c3d4e5f6-a7b8-9012-cdef-123456789012", "organizationName": "Corveta Surgical Group", "organizationId": "b2c3d4e5-f6a7-8901-bcde-f12345678901", "objectId": null, "secondaryObjectId": null, "payload": { "rowCount": 13, "exportType": "inventory" }, "route": null, "traceId": null }, { "createdAt": "2026-08-03T23:04:19.107Z", "eventType": "user_log", "action": "user:login", "userEmail": "dan.distributor@corvetasurgical.com", "userId": "c3d4e5f6-a7b8-9012-cdef-123456789012", "organizationName": "Corveta Surgical Group", "organizationId": "b2c3d4e5-f6a7-8901-bcde-f12345678901", "objectId": null, "secondaryObjectId": null, "payload": { "email": "dan.distributor@corvetasurgical.com" }, "route": "/login", "traceId": "00000000000000000000000000000000" }, { "createdAt": "2026-08-03T23:04:20.681Z", "eventType": "export", "action": "export:orders", "userEmail": "dan.distributor@corvetasurgical.com", "userId": "c3d4e5f6-a7b8-9012-cdef-123456789012", "organizationName": "Corveta Surgical Group", "organizationId": "b2c3d4e5-f6a7-8901-bcde-f12345678901", "objectId": null, "secondaryObjectId": null, "payload": { "dateTo": "2020-01-02", "dateFrom": "2020-01-01", "rowCount": 0, "exportType": "orders" }, "route": null, "traceId": null }, { "createdAt": "2026-08-03T23:04:20.713Z", "eventType": "export", "action": "export:orders", "userEmail": "dan.distributor@corvetasurgical.com", "userId": "c3d4e5f6-a7b8-9012-cdef-123456789012", "organizationName": "Corveta Surgical Group", "organizationId": "b2c3d4e5-f6a7-8901-bcde-f12345678901", "objectId": null, "secondaryObjectId": null, "payload": { "dateTo": "2026-08-03", "dateFrom": "2024-08-03", "rowCount": 4, "exportType": "orders" }, "route": null, "traceId": null }, { "createdAt": "2026-08-03T23:04:27.375Z", "eventType": "user_log", "action": "user:login", "userEmail": "rana.reyes@corvetasurgical.com", "userId": "28c9d0e1-f2a3-4567-2345-678901234567", "organizationName": "Corveta Surgical Group", "organizationId": "b2c3d4e5-f6a7-8901-bcde-f12345678901", "objectId": null, "secondaryObjectId": null, "payload": { "email": "rana.reyes@corvetasurgical.com" }, "route": "/login", "traceId": "00000000000000000000000000000000" } ], "auditQuery": "SELECT\n ae.created_at,\n ae.event_type,\n ae.action,\n ae.user_id,\n u.email AS user_email,\n ae.organization_id,\n o.name AS organization_name,\n ae.object_id,\n ae.secondary_object_id,\n ae.payload,\n ae.route,\n ae.trace_id\n FROM audit_events ae\n LEFT JOIN users u ON u.id = ae.user_id\n LEFT JOIN organizations o ON o.id = ae.organization_id\n WHERE ae.created_at >= $1\n AND ae.organization_id = ANY($2::uuid[])\n ORDER BY ae.created_at ASC", "auditAssertions": [ { "stepName": "Step 1: Exports page overview", "expectedAction": "user_log:user:login", "found": true }, { "stepName": "Step 2: Export order history", "expectedAction": "export:export:orders", "found": true }, { "stepName": "Step 4: Export inventory", "expectedAction": "export:export:inventory", "found": true }, { "stepName": "Step 5: Date range filtering", "expectedAction": "export:export:orders", "found": true }, { "stepName": "Step 6: Permission restriction", "expectedAction": "user_log:user:login", "found": true } ], "emailAssertions": [] }