Skip to content
DeviceFlow Validation

URS-004 · Admin approve or reject a sales representative

Title: Admin approve or reject a sales representative Date: 2026-09-29T02:24:37.412Z Duration: 164.4s Overall Status: ✅ PASS

User Requirement

Section titled “User Requirement”

The system shall allow Vantis admins to approve or reject a sales representative

Source: User_Requirement_Specifications_Vantis_DeviceFlow.xlsx — the run below proves the system meets this requirement.

Environment

Section titled “Environment”

Setup

Section titled “Setup”

Status: ✅ PASS

Test Steps

Section titled “Test Steps”

Each step below corresponds to one Playwright test that ran sequentially. Screenshots and video recordings provide visual evidence of the UI behaviour.

1. Step 1: Admin navigates to rep management — ✅ PASS

Section titled “1. Step 1: Admin navigates to rep management — ✅ PASS”

What this step proves:

Proves that a Vantis admin (Alex) can authenticate and reach the Representatives management page. Both Corveta reps — Blair (pending approval) and Rana (active) — appear in the roster, establishing admin context for the approve/reject actions that follow.

Audit events generated by this step:

(Evidence matched by declared name — step timing not available or no events fell in window)

TimeTypeActionUserOrgPerformed
2026-09-29 02:25:08Zuser_loguser:loginalex.admin@vantismedical.comVantis—
2026-09-29 02:25:24Zuser_loguser:loginalex.admin@vantismedical.comVantis—
2026-09-29 02:25:36Zuser_loguser:loginblair.bennett@corvetasurgical.comCorveta Surgical Group—
2026-09-29 02:25:47Zuser_loguser:loginrana.reyes@corvetasurgical.comCorveta Surgical Group—
2026-09-29 02:25:56Zuser_loguser:loginalex.admin@vantismedical.comVantis—
2026-09-29 02:26:46Zuser_loguser:loginblair.bennett@corvetasurgical.comCorveta Surgical Group—
2026-09-29 02:27:07Zuser_loguser:loginblair.bennett@corvetasurgical.comCorveta Surgical Group—

Screenshots:

step 01 admin logged in

step 01 rep list

Video recording:

2. Step 2: Admin rejects Blair — ✅ PASS

Section titled “2. Step 2: Admin rejects Blair — ✅ PASS”

What this step proves:

Alex opens Blair’s detail page, clicks Reject Representative, supplies a rejection reason, and confirms. Proves that an admin has an in-app control to deny a rep onboarding. The relationship row moves to status=‘rejected’, active=false, and a rep_creation_request_rejected notification is dispatched to the distributor.

Audit events generated by this step:

(Evidence scoped to step execution window: 2026-09-29T02:25:29.218Z → 2026-09-29T02:25:33.094Z)

TimeTypeActionUserOrgPerformed
2026-09-29 02:25:32Zorganization_representationstatus_changealex.admin@vantismedical.comVantis—
2026-09-29 02:25:32Zuser_logrep_onboarding_request_rejectedalex.admin@vantismedical.comVantis—

Emails triggered by this step:

(Evidence matched by declared name — step timing not available or no events fell in window)

Email 1: Representative Request Rejected - Vantis

Template: Representative_Request_Rejected_-_Vantis

Representative Request Rejected - Vantis

Screenshots:

step 02 bob detail pending

step 02 reject dialog

step 02 bob detail rejected

Video recording:

3. Step 3: Blair blocked from creating orders — ✅ PASS

Section titled “3. Step 3: Blair blocked from creating orders — ✅ PASS”

What this step proves:

Blair logs in after being rejected and opens the order creation page. Vantis is filtered out of the manufacturer dropdown because getAvailableFulfillingOrganizations requires an active representation relationship. Proves the admin action is a hard restriction on downstream order creation — not just a cosmetic UI change.

Audit events generated by this step:

(Evidence matched by declared name — step timing not available or no events fell in window)

TimeTypeActionUserOrgPerformed
2026-09-29 02:25:08Zuser_loguser:loginalex.admin@vantismedical.comVantis—
2026-09-29 02:25:24Zuser_loguser:loginalex.admin@vantismedical.comVantis—
2026-09-29 02:25:36Zuser_loguser:loginblair.bennett@corvetasurgical.comCorveta Surgical Group—
2026-09-29 02:25:47Zuser_loguser:loginrana.reyes@corvetasurgical.comCorveta Surgical Group—
2026-09-29 02:25:56Zuser_loguser:loginalex.admin@vantismedical.comVantis—
2026-09-29 02:26:46Zuser_loguser:loginblair.bennett@corvetasurgical.comCorveta Surgical Group—
2026-09-29 02:27:07Zuser_loguser:loginblair.bennett@corvetasurgical.comCorveta Surgical Group—

Screenshots:

step 03 bob no vantis

Video recording:

4. Step 4: Rana (control) can still create orders — ✅ PASS

Section titled “4. Step 4: Rana (control) can still create orders — ✅ PASS”

What this step proves:

Rana, an unrelated Corveta rep, is unaffected by the action taken on Blair. He reaches Step 2 of the order form as normal, proving that admin decisions are scoped to the rep under review and do not inadvertently strip privileges from other reps.

Audit events generated by this step:

(Evidence matched by declared name — step timing not available or no events fell in window)

TimeTypeActionUserOrgPerformed
2026-09-29 02:25:08Zuser_loguser:loginalex.admin@vantismedical.comVantis—
2026-09-29 02:25:24Zuser_loguser:loginalex.admin@vantismedical.comVantis—
2026-09-29 02:25:36Zuser_loguser:loginblair.bennett@corvetasurgical.comCorveta Surgical Group—
2026-09-29 02:25:47Zuser_loguser:loginrana.reyes@corvetasurgical.comCorveta Surgical Group—
2026-09-29 02:25:56Zuser_loguser:loginalex.admin@vantismedical.comVantis—
2026-09-29 02:26:46Zuser_loguser:loginblair.bennett@corvetasurgical.comCorveta Surgical Group—
2026-09-29 02:27:07Zuser_loguser:loginblair.bennett@corvetasurgical.comCorveta Surgical Group—

Screenshots:

step 04 ryan order form

Video recording:

5. Step 5: Admin approves Blair — ✅ PASS

Section titled “5. Step 5: Admin approves Blair — ✅ PASS”

What this step proves:

After the test harness returns Blair’s status to ‘proposed’, Alex approves him through the UI’s Approve Representative flow. The manufacturer requires a certification of all reps and Blair has no completion record, so approval lands the relationship in status=‘pending_certification’, active=false — approval alone no longer grants full access. A rep_created notification is dispatched to Corveta announcing the approval.

Audit events generated by this step:

(Evidence scoped to step execution window: 2026-09-29T02:26:39.497Z → 2026-09-29T02:26:43.283Z)

TimeTypeActionUserOrgPerformed
2026-09-29 02:26:40Zorganization_representationstatus_changealex.admin@vantismedical.comVantis—
2026-09-29 02:26:40Zchecklistchecklists.createalex.admin@vantismedical.comCorveta Surgical Group—
2026-09-29 02:26:40Zdecisionrepresentatives.require_certification_on_approvalalex.admin@vantismedical.comVantisyes
2026-09-29 02:26:40Zuser_logrep_onboarding_request_approvedalex.admin@vantismedical.comVantis—
2026-09-29 02:26:43Ztransactional_emailrep_created—Corveta Surgical Group—

Emails triggered by this step:

(Evidence matched by declared name — step timing not available or no events fell in window)

Email 1: Representative Account Approved - Vantis

Template: Representative_Account_Approved_-_Vantis

Representative Account Approved - Vantis

Screenshots:

step 05 bob detail pending again

step 05 approve dialog

step 05 bob detail approved

Video recording:

6. Step 6: Blair completes the certification — ✅ PASS

Section titled “6. Step 6: Blair completes the certification — ✅ PASS”

What this step proves:

Approval yields pending certification; the rep must certify before acting. Blair logs in, opens the required certification, acknowledges the training document (timestamped server-side), passes the knowledge check, and signs. Completion activates the relationship (status=‘active’, active=true) with reason_code=‘certification_completed’.

Audit events generated by this step:

(Evidence scoped to step execution window: 2026-09-29T02:26:53.195Z → 2026-09-29T02:27:04.314Z)

TimeTypeActionUserOrgPerformed
2026-09-29 02:27:00Zdecisionforms.grade_submissionblair.bennett@corvetasurgical.comVantisyes
2026-09-29 02:27:04Zcertificationsigning_code_consumedblair.bennett@corvetasurgical.comVantis—
2026-09-29 02:27:04Zdecisiontickets.checklist_item_resolve.auto_resolve_ticket—Corveta Surgical Groupno
2026-09-29 02:27:04Zorganization_representationstatus_changeblair.bennett@corvetasurgical.comVantis—
2026-09-29 02:27:04Zcertificationcompletedblair.bennett@corvetasurgical.comVantis—
2026-09-29 02:27:04Zdecisioncertifications.complete_certification.issue_certificateblair.bennett@corvetasurgical.comVantisyes
2026-09-29 02:27:04Zdecisioncertifications.complete_certification.mark_relationship_certifiedblair.bennett@corvetasurgical.comVantisyes
2026-09-29 02:27:04Zuser_logrep_relationship_certifiedblair.bennett@corvetasurgical.comVantis—

Screenshots:

step 06 identity verified

step 06 doc acknowledged

step 06 quiz answers

step 06 signature

step 06 completed

Video recording:

7. Step 7: Blair submits an order after certification — ✅ PASS

Section titled “7. Step 7: Blair submits an order after certification — ✅ PASS”

What this step proves:

Now-certified Blair reaches the order form, picks a delivery location, adds a product, and submits. Proves the restriction lifts immediately when the certification completes — no further admin action is needed. The order request persists in the database for the DB-validation phase to confirm.

Audit events generated by this step:

(Evidence scoped to step execution window: 2026-09-29T02:27:13.585Z → 2026-09-29T02:27:18.382Z)

TimeTypeActionUserOrgPerformed
2026-09-29 02:27:18Zchecklistchecklists.createblair.bennett@corvetasurgical.comVantis—
2026-09-29 02:27:18Zdecisionorder_request_createdblair.bennett@corvetasurgical.comVantisyes
2026-09-29 02:27:18Zdecisionrepresentatives.gate_rep_actionblair.bennett@corvetasurgical.comVantisno

Screenshots:

step 07 order step2

step 07 order review

step 07 order submitted

Video recording:

Database Validations

Section titled “Database Validations”

The following SQL queries ran against the application database after the Playwright scenarios completed. Each query asserts a specific condition that proves the feature under test persisted its data correctly.

Blair’s relationship ended the run as active — ✅ PASS

Section titled “Blair’s relationship ended the run as active — ✅ PASS”

Assertion: After approval and certification completion Blair’s relationship should be status=‘active’, active=true.

SELECT id, status, active, rejection_reason
                   FROM organization_representation_relationships
                  WHERE id = $1
idstatusactiverejection_reason
84c5d6e7-f8a9-0123-8901-234567890123activetrueNULL

Rejection status transition recorded — ✅ PASS

Section titled “Rejection status transition recorded — ✅ PASS”

Assertion: A proposed→rejected transition should have been recorded during the test run.

SELECT from_status, to_status, reason, created_at
                   FROM organization_representation_request_status_changes
                  WHERE relationship_id = $1
                    AND to_status = 'rejected'
                    AND created_at > NOW() - INTERVAL '30 minutes'
                  ORDER BY created_at DESC
from_statusto_statusreasoncreated_at
proposedrejectedURS-004 validation test: admin rejecting rep to verify order-creation is blocked.2026-09-29T02:25:32.433Z

Two-stage approval transitions recorded — ✅ PASS

Section titled “Two-stage approval transitions recorded — ✅ PASS”

Assertion: Approval should record a transition to ‘pending_certification’ with reason_code ‘certification_required_on_approval’, followed by a later transition to ‘active’ with reason_code ‘certification_completed’.

SELECT from_status, to_status, reason_code, created_at
                   FROM organization_representation_request_status_changes
                  WHERE relationship_id = $1
                    AND created_at > NOW() - INTERVAL '30 minutes'
                  ORDER BY created_at DESC
from_statusto_statusreason_codecreated_at
pending_certificationactivecertification_completed2026-09-29T02:27:04.189Z
proposedpending_certificationcertification_required_on_approval2026-09-29T02:26:40.918Z
proposedrejectedNULL2026-09-29T02:25:32.433Z

Blair’s certification record created on completion — ✅ PASS

Section titled “Blair’s certification record created on completion — ✅ PASS”

Assertion: Exactly one certification record should exist for Blair, on the current version, with a completion timestamp and a signature reference.

SELECT rep_user_id, certification_id, certification_version_id,
                        completed_at, signature_ref
                   FROM certification_records
                  WHERE rep_user_id = $1 AND certification_id = $2
rep_user_idcertification_idcertification_version_idcompleted_atsignature_ref
17b8c9d0-e1f2-3456-1234-567890123456ce000100-0000-4000-8000-000000000001ce000200-0000-4000-8000-0000000000022026-09-29T02:27:04.199Z01a0eafc-b187-72fb-802c-f9e2abffd9fb

Approved and certified rep successfully submitted an order — ✅ PASS

Section titled “Approved and certified rep successfully submitted an order — ✅ PASS”

Assertion: At least one order_requests row should exist, tagged with the URS-004 marker.

SELECT id, request_number, status, order_type, created_at
                   FROM order_requests
                  WHERE requested_by_user_id = $1
                    AND notes LIKE $2
                  ORDER BY created_at DESC
idrequest_numberstatusorder_typecreated_at
01a0eafc-e86a-79b6-b898-909bc2869d83OR-1submitteddropship2026-09-29T02:27:18.220Z

Audit events logged for approve and reject — ✅ PASS

Section titled “Audit events logged for approve and reject — ✅ PASS”

Assertion: audit_events should include both rep_onboarding_request_approved and rep_onboarding_request_rejected actions from this run.

SELECT event_type, action, created_at
                   FROM audit_events
                  WHERE event_type = 'user_log'
                    AND action IN ('rep_onboarding_request_approved', 'rep_onboarding_request_rejected')
                    AND created_at > NOW() - INTERVAL '30 minutes'
                  ORDER BY created_at DESC
event_typeactioncreated_at
user_logrep_onboarding_request_approved2026-09-29T02:26:40.978Z
user_logrep_onboarding_request_rejected2026-09-29T02:25:32.747Z

Audit & Email Assertion Ledger

Section titled “Audit & Email Assertion Ledger”

Per-declaration outcome of every expectedAuditActions and expectedEmailTemplates entry written into the orchestrator. Missing evidence here is a real test failure, not a soft warning.

Audit Action Assertions

Section titled “Audit Action Assertions”

Each row asserts that a declared expectedAuditActions entry produced a matching row in audit_events. A ❌ flips overall status to FAIL — the declaration is real proof, not just an annotation.

StepExpected Audit ActionFound
Step 1: Admin navigates to rep managementuser_log:user:login✅
Step 2: Admin rejects Blairuser_log:rep_onboarding_request_rejected✅
Step 3: Blair blocked from creating ordersuser_log:user:login✅
Step 4: Rana (control) can still create ordersuser_log:user:login✅
Step 5: Admin approves Blairuser_log:rep_onboarding_request_approved✅
Step 5: Admin approves Blairdecision:representatives.require_certification_on_approval✅
Step 6: Blair completes the certificationcertification:completed✅
Step 7: Blair submits an order after certificationuser_log:user:login✅
Step 7: Blair submits an order after certificationdecision:order_request_created✅

Email Template Assertions

Section titled “Email Template Assertions”

Each row asserts that a declared expectedEmailTemplates entry was matched (case-insensitive substring) by a captured email subject or template. A ❌ flips overall status to FAIL.

StepExpected TemplateFound
Step 2: Admin rejects BlairRepresentative Request Rejected✅
Step 5: Admin approves BlairRepresentative Account Approved✅

Audit Log Events

Section titled “Audit Log Events”

Every row written to audit_events while this test was running (scoped to the demo organizations). Provides compliance evidence that user actions are traced end-to-end (URS-003).

Capture window start: 2026-09-29T02:24:36.063Z

SELECT
    ae.created_at,
    ae.event_type,
    ae.action,
    ae.user_id,
    u.email AS user_email,
    ae.organization_id,
    o.name AS organization_name,
    ae.object_id,
    ae.secondary_object_id,
    ae.payload,
    ae.route,
    ae.trace_id
  FROM audit_events ae
  LEFT JOIN users u ON u.id = ae.user_id
  LEFT JOIN organizations o ON o.id = ae.organization_id
  WHERE ae.created_at >= $1
    AND ae.organization_id = ANY($2::uuid[])
  ORDER BY ae.created_at ASC

38 event(s) captured:

TimeTypeActionUserOrgObject IDPerformedReason
2026-09-29 02:24:39Zdecisionreturn_overdue_sweep—Vantisa1b2c3d4-e5f6-7890-abcd-ef1234567890nowms_feature_flag_disabled
2026-09-29 02:24:40Zdecisionensure_lot_expiration_cycle_counter_assignment—Corveta Surgical Groupa6e7f8a9-b0c1-2345-0123-456789012345nono_latest_cycle_counter
2026-09-29 02:24:40Zdecisionensure_lot_expiration_cycle_counter_assignment—Corveta Surgical Groupb7f8a9b0-c1d2-3456-1234-567890123456nono_latest_cycle_counter
2026-09-29 02:24:41Zchecklistchecklists.create—Corveta Surgical Group01a0eafa-8244-75bd-b7bd-dfdb309d854e—
2026-09-29 02:24:41Zdecisionupgrade_lot_expiration_checklist_priority—Corveta Surgical Groupb2c3d4e5-f6a7-8901-bcde-f12345678901nono_open_checklists_below_high
2026-09-29 02:24:42Zdecisionensure_lot_expiration_checklist—Corveta Surgical Groupb2c3d4e5-f6a7-8901-bcde-f12345678901yescreated_1_reopened_0_already_open_1_refreshed_1
2026-09-29 02:25:08Zuser_loguser:loginalex.admin@vantismedical.comVantis——
2026-09-29 02:25:24Zuser_loguser:loginalex.admin@vantismedical.comVantis——
2026-09-29 02:25:32Zorganization_representationstatus_changealex.admin@vantismedical.comVantis84c5d6e7-f8a9-0123-8901-234567890123—URS-004 validation test: admin rejecting rep to verify order-creation is blocked.
2026-09-29 02:25:32Zuser_logrep_onboarding_request_rejectedalex.admin@vantismedical.comVantis84c5d6e7-f8a9-0123-8901-234567890123—
2026-09-29 02:25:33Ztransactional_emailrep_creation_request_rejected—Corveta Surgical Group——
2026-09-29 02:25:36Zuser_loguser:loginblair.bennett@corvetasurgical.comCorveta Surgical Group——
2026-09-29 02:25:47Zuser_loguser:loginrana.reyes@corvetasurgical.comCorveta Surgical Group——
2026-09-29 02:25:56Zuser_loguser:loginalex.admin@vantismedical.comVantis——
2026-09-29 02:26:40Zorganization_representationstatus_changealex.admin@vantismedical.comVantis84c5d6e7-f8a9-0123-8901-234567890123—Certification required
2026-09-29 02:26:40Zchecklistchecklists.createalex.admin@vantismedical.comCorveta Surgical Group01a0eafc-56f9-7161-86e8-69370ca781b7—
2026-09-29 02:26:40Zdecisionrepresentatives.require_certification_on_approvalalex.admin@vantismedical.comVantis17b8c9d0-e1f2-3456-1234-567890123456yesmandatory_certifications_outstanding
2026-09-29 02:26:40Zuser_logrep_onboarding_request_approvedalex.admin@vantismedical.comVantis84c5d6e7-f8a9-0123-8901-234567890123—
2026-09-29 02:26:43Ztransactional_emailrep_created—Corveta Surgical Group——
2026-09-29 02:26:46Zuser_loguser:loginblair.bennett@corvetasurgical.comCorveta Surgical Group——
2026-09-29 02:26:49Zdecisioncertifications.signing_challenge.send_smsblair.bennett@corvetasurgical.comVantis01a0eafc-79e8-7187-a6dc-8faa8047c673nono_phone_channel
2026-09-29 02:26:49Zcertificationsigning_code_issuedblair.bennett@corvetasurgical.comVantisce000100-0000-4000-8000-000000000001—
2026-09-29 02:26:51Ztransactional_emailcertification_signing_code—Vantis01a0eafc-79e8-7187-a6dc-8faa8047c673—
2026-09-29 02:26:53Zcertificationsigning_code_verifiedblair.bennett@corvetasurgical.comVantisce000100-0000-4000-8000-000000000001—
2026-09-29 02:27:00Zdecisionforms.grade_submissionblair.bennett@corvetasurgical.comVantisce000300-0000-4000-8000-000000000002yesall_answers_correct
2026-09-29 02:27:04Zcertificationsigning_code_consumedblair.bennett@corvetasurgical.comVantisce000100-0000-4000-8000-000000000001—
2026-09-29 02:27:04Zdecisiontickets.checklist_item_resolve.auto_resolve_ticket—Corveta Surgical Group01a0eafc-56fe-71d9-a174-d792d884e668noChecklist item is not linked to any ticket.
2026-09-29 02:27:04Zorganization_representationstatus_changeblair.bennett@corvetasurgical.comVantis84c5d6e7-f8a9-0123-8901-234567890123—Certification completed
2026-09-29 02:27:04Zcertificationcompletedblair.bennett@corvetasurgical.comVantis01a0eafc-b187-72fb-802c-f9e13f6eed4f—
2026-09-29 02:27:04Zdecisioncertifications.complete_certification.issue_certificateblair.bennett@corvetasurgical.comVantis01a0eafc-b187-72fb-802c-f9e13f6eed4fyesquiz_backed_completion
2026-09-29 02:27:04Zdecisioncertifications.complete_certification.mark_relationship_certifiedblair.bennett@corvetasurgical.comVantis84c5d6e7-f8a9-0123-8901-234567890123yesrelationship_pending_certification
2026-09-29 02:27:04Zuser_logrep_relationship_certifiedblair.bennett@corvetasurgical.comVantis——Certification completed
2026-09-29 02:27:06Zcertification_certificateissuedblair.bennett@corvetasurgical.comVantis01a0eafc-b1b3-703b-8013-29a2a170110a—
2026-09-29 02:27:06Zcertification_completion_recordissuedblair.bennett@corvetasurgical.comVantis01a0eafc-b1b6-7841-ba76-75b3ddcb2d3e—
2026-09-29 02:27:07Zuser_loguser:loginblair.bennett@corvetasurgical.comCorveta Surgical Group——
2026-09-29 02:27:18Zchecklistchecklists.createblair.bennett@corvetasurgical.comVantis01a0eafc-e879-7036-bce7-20222dab3919—
2026-09-29 02:27:18Zdecisionorder_request_createdblair.bennett@corvetasurgical.comVantis01a0eafc-e86a-79b6-b898-909bc2869d83yesOrder request OR-1 created (importSource=manual)
2026-09-29 02:27:18Zdecisionrepresentatives.gate_rep_actionblair.bennett@corvetasurgical.comVantisa1b2c3d4-e5f6-7890-abcd-ef1234567890nono_blocking_relationship

Email Evidence

Section titled “Email Evidence”

3 notification email(s) were captured during this test run. Each email is rendered as a screenshot for compliance review.

1. Representative Request Rejected - Vantis

Section titled “1. Representative Request Rejected - Vantis”

Template: Representative_Request_Rejected_-_Vantis

Representative Request Rejected - Vantis

2. Representative Account Approved - Vantis

Section titled “2. Representative Account Approved - Vantis”

Template: Representative_Account_Approved_-_Vantis

Representative Account Approved - Vantis

3. Your signing code for LiraLock Implant System Certification

Section titled “3. Your signing code for LiraLock Implant System Certification”

Template: Your_signing_code_for_LiraLock_Implant_System_Certification

Your signing code for LiraLock Implant System Certification

Downloads

Section titled “Downloads”

Feedback

Section titled “Feedback”