Skip to content
DeviceFlow Validation

URS-034 · Export Order and Inventory History for Audits

Title: Export Order and Inventory History for Audits Date: 2026-04-23T03:40:59.668Z Duration: 67.5s Overall Status: ✅ PASS

User Requirement

Section titled “User Requirement”

The system shall support exporting order and inventory history for audits.

Source: User_Requirement_Specifications_ZuriMED_DeviceFlow.xlsx — the run below proves the system meets this requirement.

Environment

Section titled “Environment”

Setup

Section titled “Setup”

Status: ✅ PASS

Test Steps

Section titled “Test Steps”

Each step below corresponds to one Playwright test that ran sequentially. Screenshots and video recordings provide visual evidence of the UI behaviour.

1. Step 1: Exports page overview — ✅ PASS

Section titled “1. Step 1: Exports page overview — ✅ PASS”

What this step proves:

Logs in as an admin user (Dan Distributor) and navigates to the /exports page, confirming that export options for Orders and Inventory are visible to authorized users.

Audit events generated by this step:

(Evidence matched by declared name — step timing not available or no events fell in window)

TimeTypeActionUserOrgPerformed
2026-04-23 03:41:05Zuser_loguser:logindan.distributor@stellartech.comStellarTech Medical Solutions—
2026-04-23 03:41:16Zuser_loguser:logindan.distributor@stellartech.comStellarTech Medical Solutions—
2026-04-23 03:41:35Zuser_loguser:logindan.distributor@stellartech.comStellarTech Medical Solutions—
2026-04-23 03:41:47Zuser_loguser:logindan.distributor@stellartech.comStellarTech Medical Solutions—
2026-04-23 03:41:58Zuser_loguser:loginryan.delauintana@stellartech.comStellarTech Medical Solutions—

Screenshots:

step 01 exports page overview

step 01 exports page all cards

Video recording:

2. Step 2: Export order history — ✅ PASS

Section titled “2. Step 2: Export order history — ✅ PASS”

What this step proves:

Downloads the Orders CSV export, verifying that order history can be exported for audits and that the file contains the expected audit columns including order numbers, status, and creation dates.

Screenshots:

step 02 before order export

step 02 orders csv content

Video recording:

3. Step 3: Order export verification — ✅ PASS

Section titled “3. Step 3: Order export verification — ✅ PASS”

What this step proves:

Verifies the downloaded order CSV contains all required audit fields with non-empty values, confirming the export provides complete audit-ready data.

Screenshots:

step 03 orders verification

Video recording:

4. Step 4: Export inventory — ✅ PASS

Section titled “4. Step 4: Export inventory — ✅ PASS”

What this step proves:

Downloads the Inventory CSV export, verifying that inventory history is exportable for audits with the expected columns including location and quantity data.

Screenshots:

step 04 after inventory export

step 04 inventory csv content

Video recording:

5. Step 5: Date range filtering — ✅ PASS

Section titled “5. Step 5: Date range filtering — ✅ PASS”

What this step proves:

Confirms that the date range filter on the orders export works correctly: a narrow historical range returns zero results while a wide range spanning the test data returns the expected records.

Screenshots:

step 05 date range comparison

Video recording:

6. Step 6: Permission restriction — ✅ PASS

Section titled “6. Step 6: Permission restriction — ✅ PASS”

What this step proves:

Logs in as Ryan Delauintana (Sales Rep without export permissions) and verifies that the /exports page and the direct CSV endpoint deny access, enforcing role-based export access control.

Audit events generated by this step:

(Evidence matched by declared name — step timing not available or no events fell in window)

TimeTypeActionUserOrgPerformed
2026-04-23 03:41:05Zuser_loguser:logindan.distributor@stellartech.comStellarTech Medical Solutions—
2026-04-23 03:41:16Zuser_loguser:logindan.distributor@stellartech.comStellarTech Medical Solutions—
2026-04-23 03:41:35Zuser_loguser:logindan.distributor@stellartech.comStellarTech Medical Solutions—
2026-04-23 03:41:47Zuser_loguser:logindan.distributor@stellartech.comStellarTech Medical Solutions—
2026-04-23 03:41:58Zuser_loguser:loginryan.delauintana@stellartech.comStellarTech Medical Solutions—

Screenshots:

step 06 rep exports restricted

Video recording:

Database Validations

Section titled “Database Validations”

The following SQL queries ran against the application database after the Playwright scenarios completed. Each query asserts a specific condition that proves the feature under test persisted its data correctly.

Exports feature flag enabled — ✅ PASS

Section titled “Exports feature flag enabled — ✅ PASS”

Assertion: The “exports” feature flag should be enabled for StellarTech

SELECT id, value FROM feature_flags
      WHERE id = 'exports' AND organization_id = $1
idvalue
exportstrue

Admin role has exports:access — ✅ PASS

Section titled “Admin role has exports:access — ✅ PASS”

Assertion: The StellarTech Admin role should have exports:access permission

SELECT p.permission FROM permissions p
      WHERE p.actor_id = $1 AND p.permission = 'exports:access'
permission
exports:access

Sales rep role lacks exports:access — ✅ PASS

Section titled “Sales rep role lacks exports:access — ✅ PASS”

Assertion: The Sales Rep role should NOT have exports:access permission

SELECT p.permission FROM permissions p
      WHERE p.actor_id = $1 AND p.permission = 'exports:access'

No rows returned

Order requests exist for organization — ✅ PASS

Section titled “Order requests exist for organization — ✅ PASS”

Assertion: At least one order request should exist for StellarTech

SELECT COUNT(*) as count,
        MIN(created_at) as oldest_order,
        MAX(created_at) as newest_order
      FROM order_requests
      WHERE requesting_organization_id = $1 OR fulfilling_organization_id = $1
countoldest_ordernewest_order
32026-03-24T03:40:59.719Z2026-04-18T03:40:59.719Z

Inventory items exist for organization — ✅ PASS

Section titled “Inventory items exist for organization — ✅ PASS”

Assertion: At least one inventory item with positive quantity should exist for StellarTech

SELECT COUNT(*) as count
      FROM inventory_items
      WHERE organization_id = $1
        AND (quantity_ready > 0 OR quantity_backordered > 0 OR quantity_in_transit > 0)
count
4

Admin user has Admin role — ✅ PASS

Section titled “Admin user has Admin role — ✅ PASS”

Assertion: Dan Distributor should have the Admin role for StellarTech

SELECT u.email, u.name, r.name as role_name, r.id as role_id
      FROM users u
      JOIN user_roles ur ON ur.user_id = u.id
      JOIN roles r ON r.id = ur.role_id
      WHERE u.id = $1 AND ur.organization_id = $2
emailnamerole_namerole_id
dan.distributor@stellartech.comDan DistributorStellarTech Admin40e1f2a3-b4c5-6789-4567-890123456789

Audit & Email Assertion Ledger

Section titled “Audit & Email Assertion Ledger”

Per-declaration outcome of every expectedAuditActions and expectedEmailTemplates entry written into the orchestrator. Missing evidence here is a real test failure, not a soft warning.

Audit Action Assertions

Section titled “Audit Action Assertions”

Each row asserts that a declared expectedAuditActions entry produced a matching row in audit_events. A ❌ flips overall status to FAIL — the declaration is real proof, not just an annotation.

StepExpected Audit ActionFound
Step 1: Exports page overviewuser_log:user:login✅
Step 6: Permission restrictionuser_log:user:login✅

Audit Log Events

Section titled “Audit Log Events”

Every row written to audit_events while this test was running (scoped to the demo organizations). Provides compliance evidence that user actions are traced end-to-end (URS-003).

Capture window start: 2026-04-23T03:40:57.813Z

SELECT
    ae.created_at,
    ae.event_type,
    ae.action,
    ae.user_id,
    u.email AS user_email,
    ae.organization_id,
    o.name AS organization_name,
    ae.object_id,
    ae.secondary_object_id,
    ae.payload,
    ae.route,
    ae.trace_id
  FROM audit_events ae
  LEFT JOIN users u ON u.id = ae.user_id
  LEFT JOIN organizations o ON o.id = ae.organization_id
  WHERE ae.created_at >= $1
    AND ae.organization_id = ANY($2::uuid[])
  ORDER BY ae.created_at ASC

5 event(s) captured:

TimeTypeActionUserOrgObject IDPerformedReason
2026-04-23 03:41:05Zuser_loguser:logindan.distributor@stellartech.comStellarTech Medical Solutions——
2026-04-23 03:41:16Zuser_loguser:logindan.distributor@stellartech.comStellarTech Medical Solutions——
2026-04-23 03:41:35Zuser_loguser:logindan.distributor@stellartech.comStellarTech Medical Solutions——
2026-04-23 03:41:47Zuser_loguser:logindan.distributor@stellartech.comStellarTech Medical Solutions——
2026-04-23 03:41:58Zuser_loguser:loginryan.delauintana@stellartech.comStellarTech Medical Solutions——

Downloads

Section titled “Downloads”

Feedback

Section titled “Feedback”