Skip to content
DeviceFlow Validation

URS-005 · Prevent Uncertified Reps from Creating Orders

Title: Prevent Uncertified Reps from Creating Orders Date: 2026-09-29T02:31:01.775Z Duration: 90.1s Overall Status: ✅ PASS

User Requirement

Section titled “User Requirement”

The system shall prevent uncertified reps from creating orders until approved. (Repeating with URS-055)

Source: User_Requirement_Specifications_Vantis_DeviceFlow.xlsx — the run below proves the system meets this requirement.

Environment

Section titled “Environment”

Setup

Section titled “Setup”

Status: ✅ PASS

Test Steps

Section titled “Test Steps”

Each step below corresponds to one Playwright test that ran sequentially. Screenshots and video recordings provide visual evidence of the UI behaviour.

1. Step 1a: Uncertified rep blocked — ✅ PASS

Section titled “1. Step 1a: Uncertified rep blocked — ✅ PASS”

What this step proves:

Proves the system correctly prevents a representative who has not completed the manufacturer’s required certification from creating orders. Rana Reyes is in pending certification, so the bill-only order creation form displays a “Certification required” notice with a link to complete the certification, and the gated manufacturer is absent from the manufacturer picker. The same block appears on both the /billing/new and /orders/requests/new routes, confirming the enforcement is applied consistently across order entry points.

Audit events generated by this step:

(Evidence matched by declared name — step timing not available or no events fell in window)

TimeTypeActionUserOrgPerformed
2026-09-29 02:31:06Zuser_loguser:loginrana.reyes@corvetasurgical.comCorveta Surgical Group—
2026-09-29 02:31:23Zuser_loguser:loginblair.bennett@corvetasurgical.comCorveta Surgical Group—
2026-09-29 02:31:36Zuser_loguser:loginrana.reyes@corvetasurgical.comCorveta Surgical Group—
2026-09-29 02:31:58Zuser_loguser:loginrana.reyes@corvetasurgical.comCorveta Surgical Group—

Screenshots:

step 01 ryan logged in

step 01 order blocked

Video recording:

2. Step 1b: Trunk order requests allowed while pending — ✅ PASS

Section titled “2. Step 1b: Trunk order requests allowed while pending — ✅ PASS”

Screenshots:

step 01 order request trunk allowed

3. Step 2: Certified rep control — ✅ PASS

Section titled “3. Step 2: Certified rep control — ✅ PASS”

What this step proves:

Control condition confirming that the blocking behavior is targeted at uncertified reps only. Blair Bennett, whose representation relationship is active, can access the order creation form without any certification notice. The form auto-advances to Step 2 with Vantis pre-selected. This eliminates the possibility that the block in Step 1 is a general UI defect.

Audit events generated by this step:

(Evidence matched by declared name — step timing not available or no events fell in window)

TimeTypeActionUserOrgPerformed
2026-09-29 02:31:06Zuser_loguser:loginrana.reyes@corvetasurgical.comCorveta Surgical Group—
2026-09-29 02:31:23Zuser_loguser:loginblair.bennett@corvetasurgical.comCorveta Surgical Group—
2026-09-29 02:31:36Zuser_loguser:loginrana.reyes@corvetasurgical.comCorveta Surgical Group—
2026-09-29 02:31:58Zuser_loguser:loginrana.reyes@corvetasurgical.comCorveta Surgical Group—

Screenshots:

step 02 bob logged in

step 02 order form accessible

Video recording:

4. Step 3: Rep completes certification — ✅ PASS

Section titled “4. Step 3: Rep completes certification — ✅ PASS”

What this step proves:

Rana opens the manufacturer’s required certification and completes it in the UI: opens and acknowledges the training document (timestamped server-side), passes the knowledge check (graded server-side), and signs. Completion activates the representation relationship (status=‘active’, reason_code=‘certification_completed’) — this is what lifts the order gate.

Audit events generated by this step:

(Evidence scoped to step execution window: 2026-09-29T02:31:44.403Z → 2026-09-29T02:31:55.853Z)

TimeTypeActionUserOrgPerformed
2026-09-29 02:31:51Zdecisionforms.grade_submissionrana.reyes@corvetasurgical.comVantisyes
2026-09-29 02:31:55Zdecisioncertifications.complete_certification.issue_certificaterana.reyes@corvetasurgical.comVantisyes
2026-09-29 02:31:55Zcertificationsigning_code_consumedrana.reyes@corvetasurgical.comVantis—
2026-09-29 02:31:55Zcertificationcompletedrana.reyes@corvetasurgical.comVantis—
2026-09-29 02:31:55Zorganization_representationstatus_changerana.reyes@corvetasurgical.comVantis—
2026-09-29 02:31:55Zdecisioncertifications.complete_certification.mark_relationship_certifiedrana.reyes@corvetasurgical.comVantisyes
2026-09-29 02:31:55Zuser_logrep_relationship_certifiedrana.reyes@corvetasurgical.comVantis—

Screenshots:

step 03 identity verified

step 03 doc acknowledged

step 03 quiz answers

step 03 signature

step 03 completed

Video recording:

5. Step 4: Certified order creation — ✅ PASS

Section titled “5. Step 4: Certified order creation — ✅ PASS”

What this step proves:

Validates that the now-certified representative can create and submit a bill-only order without restriction. Rana logs in after completing the certification, accesses /billing/new without any certification notice, selects an account, adds a product with lot number, and successfully submits the order. The system redirects to /billing, confirming the gate is lifted immediately on certification completion.

Audit events generated by this step:

(Evidence scoped to step execution window: 2026-09-29T02:32:00.426Z → 2026-09-29T02:32:30.289Z)

TimeTypeActionUserOrgPerformed
2026-09-29 02:32:12Zdecisionbill_only_order.duplicate_submission_blockrana.reyes@corvetasurgical.comCorveta Surgical Groupno
2026-09-29 02:32:26Zdecisionbill_only_order.direct_po_import_on_createrana.reyes@corvetasurgical.comVantisno
2026-09-29 02:32:26Zdecisionrepresentatives.gate_rep_actionrana.reyes@corvetasurgical.comVantisno
2026-09-29 02:32:26Zdecisionrepresentatives.gate_rep_actionrana.reyes@corvetasurgical.comVantisno
2026-09-29 02:32:26Zdecisionbill_only_order.inventory_items_decrementrana.reyes@corvetasurgical.comVantisyes
2026-09-29 02:32:26Zdecisionbill_only_order.duplicate_submission_blockrana.reyes@corvetasurgical.comCorveta Surgical Groupno
2026-09-29 02:32:26Zscheduled_taskscheduled_task.scheduledrana.reyes@corvetasurgical.comVantis—
2026-09-29 02:32:26Zbilling_orderstatus_changerana.reyes@corvetasurgical.comVantis—
2026-09-29 02:32:26ZdecisionbasicErp.deriveSalesOrderrana.reyes@corvetasurgical.comVantisno
2026-09-29 02:32:26Zscheduled_taskscheduled_task.scheduledrana.reyes@corvetasurgical.comVantis—
2026-09-29 02:32:26Zscheduled_taskscheduled_task.scheduledrana.reyes@corvetasurgical.comVantis—
2026-09-29 02:32:26Zdecisionbill_only.link_purchase_orderrana.reyes@corvetasurgical.comCorveta Surgical Groupno
2026-09-29 02:32:28Zdecisionbill_only.notifications.cc_incident_recipients—Vantisno
2026-09-29 02:32:29Ztransactional_emailnew_bill_only—Corveta Surgical Group—

Emails triggered by this step:

(Evidence matched by declared name — step timing not available or no events fell in window)

Email 1: New Bill-Only Order - 9/28/2026 - Vantis BO-1

Template: New_Bill-Only_Order_-_9_28_2026_-_Vantis_BO-1

New Bill-Only Order - 9/28/2026 - Vantis BO-1

Screenshots:

step 04 ryan logged in certified

step 04 form accessible

step 04 account selected

step 04 devices selected

step 04 documents

step 04 review

step 04 order submitted

Video recording:

Database Validations

Section titled “Database Validations”

The following SQL queries ran against the application database after the Playwright scenarios completed. Each query asserts a specific condition that proves the feature under test persisted its data correctly.

Rana relationship now active — ✅ PASS

Section titled “Rana relationship now active — ✅ PASS”

Assertion: Rana’s representation relationship should be active after certification completion

SELECT id, status, active, responded_at, responded_by_user_id
      FROM organization_representation_relationships
      WHERE id = $1
idstatusactiveresponded_atresponded_by_user_id
95d6e7f8-a9b0-1234-9012-345678901234activetrueNULLNULL

Blair relationship still active (control) — ✅ PASS

Section titled “Blair relationship still active (control) — ✅ PASS”

Assertion: Blair’s active flag should remain true and unaffected by Rana’s approval flow

SELECT id, status, active
      FROM organization_representation_relationships
      WHERE id = $1
idstatusactive
84c5d6e7-f8a9-0123-8901-234567890123proposed_pending_onboardingtrue

Certification completion status change recorded — ✅ PASS

Section titled “Certification completion status change recorded — ✅ PASS”

Assertion: A status change to ‘active’ with reason_code ‘certification_completed’ should be recorded in the history table

SELECT id, to_status, from_status, reason_code, changed_by_user_id, created_at
      FROM organization_representation_request_status_changes
      WHERE relationship_id = $1
        AND created_at > NOW() - INTERVAL '30 minutes'
      ORDER BY created_at DESC
      LIMIT 5
idto_statusfrom_statusreason_codechanged_by_user_idcreated_at
01a0eb01-2461-72de-a98d-202156dbbd38activepending_certificationcertification_completed28c9d0e1-f2a3-4567-2345-6789012345672026-09-29T02:31:55.713Z

Rana’s certification record created on completion — ✅ PASS

Section titled “Rana’s certification record created on completion — ✅ PASS”

Assertion: Exactly one certification record should exist for Rana, on the current version, with a completion timestamp and a signature reference

SELECT rep_user_id, certification_id, certification_version_id,
        completed_at, signature_ref
      FROM certification_records
      WHERE rep_user_id = $1 AND certification_id = $2
rep_user_idcertification_idcertification_version_idcompleted_atsignature_ref
28c9d0e1-f2a3-4567-2345-678901234567ce000100-0000-4000-8000-000000000001ce000200-0000-4000-8000-0000000000022026-09-29T02:31:55.723Z01a0eb01-244b-70e8-9963-4952b5bf708e

Billing order created by Rana after certification — ✅ PASS

Section titled “Billing order created by Rana after certification — ✅ PASS”

Assertion: At least one billing order should have been created by Rana after being certified

SELECT bo.id, bo.order_number, bo.status, bo.created_at, bo.created_by_user_id
      FROM billing_orders bo
      WHERE bo.created_by_user_id = $1
        AND bo.created_at > NOW() - INTERVAL '30 minutes'
      ORDER BY bo.created_at DESC
      LIMIT 5
idorder_numberstatuscreated_atcreated_by_user_id
01a0eb01-9cc1-7f8c-a57c-d51d8d4d62f9BO-1submitted2026-09-29T02:32:26.491Z28c9d0e1-f2a3-4567-2345-678901234567

Audit trail for certification completion — ✅ PASS

Section titled “Audit trail for certification completion — ✅ PASS”

Assertion: Audit/decision events should exist referencing Rana or his relationship after the certification completion

SELECT ae.id, ae.event_type, ae.action, ae.created_at, ae.user_id, ae.object_id,
        substring(ae.payload::text, 1, 500) as payload_preview
      FROM audit_events ae
      WHERE ae.created_at > NOW() - INTERVAL '30 minutes'
        AND (ae.object_id = $1 OR ae.object_id = $2)
      ORDER BY ae.created_at DESC
      LIMIT 10
idevent_typeactioncreated_atuser_idobject_idpayload_preview
01a0eb01-2463-7069-9cbf-6cf121250d28organization_representationstatus_change2026-09-29T02:31:55.713Z28c9d0e1-f2a3-4567-2345-67890123456795d6e7f8-a9b0-1234-9012-345678901234{“reason”: “Certification completed”, “toStatus”: “active”, “fromStatus”: “pending_certification”, “reasonCode”: “certification_completed”, “requestingOrganizationId”: “b2c3d4e5-f6a7-8901-bcde-f12345678901”}
01a0eb01-2469-7de8-b2ae-b2979caaec1adecisioncertifications.complete_certification.mark_relationship_certified2026-09-29T02:31:55.713Z28c9d0e1-f2a3-4567-2345-67890123456795d6e7f8-a9b0-1234-9012-345678901234{“reason”: “relationship_pending_certification”, “performed”: true, “entityType”: “organization_representation_relationship”}

Audit & Email Assertion Ledger

Section titled “Audit & Email Assertion Ledger”

Per-declaration outcome of every expectedAuditActions and expectedEmailTemplates entry written into the orchestrator. Missing evidence here is a real test failure, not a soft warning.

Audit Action Assertions

Section titled “Audit Action Assertions”

Each row asserts that a declared expectedAuditActions entry produced a matching row in audit_events. A ❌ flips overall status to FAIL — the declaration is real proof, not just an annotation.

StepExpected Audit ActionFound
Step 1: Uncertified rep blockeduser_log:user:login✅
Step 2: Certified rep controluser_log:user:login✅
Step 3: Rep completes certificationcertification:completed✅
Step 4: Certified order creationdecision:bill_only_order.direct_po_import_on_create✅

Email Template Assertions

Section titled “Email Template Assertions”

Each row asserts that a declared expectedEmailTemplates entry was matched (case-insensitive substring) by a captured email subject or template. A ❌ flips overall status to FAIL.

StepExpected TemplateFound
Step 4: Certified order creationNew Bill-Only Order✅

Audit Log Events

Section titled “Audit Log Events”

Every row written to audit_events while this test was running (scoped to the demo organizations). Provides compliance evidence that user actions are traced end-to-end (URS-003).

Capture window start: 2026-09-29T02:31:00.048Z

SELECT
    ae.created_at,
    ae.event_type,
    ae.action,
    ae.user_id,
    u.email AS user_email,
    ae.organization_id,
    o.name AS organization_name,
    ae.object_id,
    ae.secondary_object_id,
    ae.payload,
    ae.route,
    ae.trace_id
  FROM audit_events ae
  LEFT JOIN users u ON u.id = ae.user_id
  LEFT JOIN organizations o ON o.id = ae.organization_id
  WHERE ae.created_at >= $1
    AND ae.organization_id = ANY($2::uuid[])
  ORDER BY ae.created_at ASC

31 event(s) captured:

TimeTypeActionUserOrgObject IDPerformedReason
2026-09-29 02:31:06Zuser_loguser:loginrana.reyes@corvetasurgical.comCorveta Surgical Group——
2026-09-29 02:31:23Zuser_loguser:loginblair.bennett@corvetasurgical.comCorveta Surgical Group——
2026-09-29 02:31:36Zuser_loguser:loginrana.reyes@corvetasurgical.comCorveta Surgical Group——
2026-09-29 02:31:40Zcertificationsigning_code_issuedrana.reyes@corvetasurgical.comVantisce000100-0000-4000-8000-000000000001—
2026-09-29 02:31:40Zdecisioncertifications.signing_challenge.send_smsrana.reyes@corvetasurgical.comVantis01a0eb00-ea64-7719-8e9b-e116ce70acd9nono_phone_channel
2026-09-29 02:31:41Ztransactional_emailcertification_signing_code—Vantis01a0eb00-ea64-7719-8e9b-e116ce70acd9—
2026-09-29 02:31:44Zcertificationsigning_code_verifiedrana.reyes@corvetasurgical.comVantisce000100-0000-4000-8000-000000000001—
2026-09-29 02:31:51Zdecisionforms.grade_submissionrana.reyes@corvetasurgical.comVantisce000300-0000-4000-8000-000000000002yesall_answers_correct
2026-09-29 02:31:55Zdecisioncertifications.complete_certification.issue_certificaterana.reyes@corvetasurgical.comVantis01a0eb01-244b-70e8-9963-49514e13bfe6yesquiz_backed_completion
2026-09-29 02:31:55Zcertificationsigning_code_consumedrana.reyes@corvetasurgical.comVantisce000100-0000-4000-8000-000000000001—
2026-09-29 02:31:55Zcertificationcompletedrana.reyes@corvetasurgical.comVantis01a0eb01-244b-70e8-9963-49514e13bfe6—
2026-09-29 02:31:55Zorganization_representationstatus_changerana.reyes@corvetasurgical.comVantis95d6e7f8-a9b0-1234-9012-345678901234—Certification completed
2026-09-29 02:31:55Zdecisioncertifications.complete_certification.mark_relationship_certifiedrana.reyes@corvetasurgical.comVantis95d6e7f8-a9b0-1234-9012-345678901234yesrelationship_pending_certification
2026-09-29 02:31:55Zuser_logrep_relationship_certifiedrana.reyes@corvetasurgical.comVantis——Certification completed
2026-09-29 02:31:56Zcertification_certificateissuedrana.reyes@corvetasurgical.comVantis01a0eb01-246d-71af-a685-d5da18aa74d2—
2026-09-29 02:31:56Zcertification_completion_recordissuedrana.reyes@corvetasurgical.comVantis01a0eb01-2471-742e-9c95-f78d31cb017a—
2026-09-29 02:31:58Zuser_loguser:loginrana.reyes@corvetasurgical.comCorveta Surgical Group——
2026-09-29 02:32:12Zdecisionbill_only_order.duplicate_submission_blockrana.reyes@corvetasurgical.comCorveta Surgical Groupfea7b8c9-d0e1-2345-0123-456789012345nono_same_day_candidates
2026-09-29 02:32:26Zdecisionbill_only_order.direct_po_import_on_createrana.reyes@corvetasurgical.comVantis01a0eb01-9cc1-7f8c-a57c-d51d8d4d62f9noNo uploaded PO documents
2026-09-29 02:32:26Zdecisionrepresentatives.gate_rep_actionrana.reyes@corvetasurgical.comVantisa1b2c3d4-e5f6-7890-abcd-ef1234567890nono_blocking_relationship
2026-09-29 02:32:26Zdecisionrepresentatives.gate_rep_actionrana.reyes@corvetasurgical.comVantisa1b2c3d4-e5f6-7890-abcd-ef1234567890nono_blocking_relationship
2026-09-29 02:32:26Zdecisionbill_only_order.inventory_items_decrementrana.reyes@corvetasurgical.comVantis01a0eb01-9cc1-7f8c-a57c-d51d8d4d62f9yesinventory_items_decremented
2026-09-29 02:32:26Zdecisionbill_only_order.duplicate_submission_blockrana.reyes@corvetasurgical.comCorveta Surgical Groupfea7b8c9-d0e1-2345-0123-456789012345nono_same_day_candidates
2026-09-29 02:32:26Zscheduled_taskscheduled_task.scheduledrana.reyes@corvetasurgical.comVantis01a0eb01-9ced-7f15-9d8b-dbde3f953072—
2026-09-29 02:32:26Zbilling_orderstatus_changerana.reyes@corvetasurgical.comVantis01a0eb01-9cc1-7f8c-a57c-d51d8d4d62f9—
2026-09-29 02:32:26ZdecisionbasicErp.deriveSalesOrderrana.reyes@corvetasurgical.comVantis01a0eb01-9cc1-7f8c-a57c-d51d8d4d62f9noflag_disabled
2026-09-29 02:32:26Zscheduled_taskscheduled_task.scheduledrana.reyes@corvetasurgical.comVantis01a0eb01-9ce5-735d-9aba-1bcae783afa6—
2026-09-29 02:32:26Zscheduled_taskscheduled_task.scheduledrana.reyes@corvetasurgical.comVantis01a0eb01-9cea-7cda-a04e-d84a932b0ac7—
2026-09-29 02:32:26Zdecisionbill_only.link_purchase_orderrana.reyes@corvetasurgical.comCorveta Surgical Group01a0eb01-9cc1-7f8c-a57c-d51d8d4d62f9nono_purchase_order_selected
2026-09-29 02:32:28Zdecisionbill_only.notifications.cc_incident_recipients—Vantis01a0eb01-9cc1-7f8c-a57c-d51d8d4d62f9noorder has no no-charge item with an incident reason
2026-09-29 02:32:29Ztransactional_emailnew_bill_only—Corveta Surgical Group01a0eb01-9cc1-7f8c-a57c-d51d8d4d62f9—

Email Evidence

Section titled “Email Evidence”

2 notification email(s) were captured during this test run. Each email is rendered as a screenshot for compliance review.

1. Your signing code for LiraLock Implant System Certification

Section titled “1. Your signing code for LiraLock Implant System Certification”

Template: Your_signing_code_for_LiraLock_Implant_System_Certification

Your signing code for LiraLock Implant System Certification

2. New Bill-Only Order - 9/28/2026 - Vantis BO-1

Section titled “2. New Bill-Only Order - 9/28/2026 - Vantis BO-1”

Template: New_Bill-Only_Order_-_9_28_2026_-_Vantis_BO-1

New Bill-Only Order - 9/28/2026 - Vantis BO-1

Downloads

Section titled “Downloads”

Feedback

Section titled “Feedback”