Prove security server-side: tests that run as each demo user #352

Activity

1. MendixMau commented on Oct 14, 2026

   

   MendixMau

   on Oct 14, 2026

   OwnerAuthor

   More actions

   Gain test case

   Metric: server-side access holes caught before UAT.

   • Bench: in a test model, plant N holes, for example:
     • an entity readable by the wrong role (missing XPath);
     • a microflow executable by the wrong role;
     • a write right on a status attribute.
   • Before: run the UI journey suite. It passes, because the UI hides the hole, so the expected catch is about 0/N.
   • Target: per-role server tests catch N/N, with a generated allow-and-deny pair per role × entity/microflow.
   • Also report: number of tests generated, and run time.

   ---

   Generated by Claude Code
2. MendixMau commented on Oct 14, 2026

   

   MendixMau

   on Oct 14, 2026

   OwnerAuthor

   More actions

   Tier: module close (minutes budget) for the module's own server-side security tests, run as each demo user. The full security report is a release gate item, run before UAT or production. This applies per skills/testing-shape.md §3 "Check tiers" once #364 lands. Until this issue is built, both rows are marked "(planned: #352)".

   ---

   Generated by Claude Code
3. MendixMau commented on Oct 14, 2026

   

   MendixMau

   on Oct 14, 2026

   OwnerAuthor

   More actions

   Correction to my comment above: review of #364 renamed "tiers" to check moments, so that it does not collide with testing-shape.md §1's "No tiers". The placement is unchanged. Per-module security tests run at the module close moment, and the full security report runs at the release gate moment.

   ---

   Generated by Claude Code