Prove it as every role
A supervisor's order board hung on “Loading”. Every proof had run as an administrator.
The bug the proofs could not see
A supervisor's order board hung on "Loading". The desk had been tested at every release, but every proof had run signed in as an administrator, who sees every warehouse. A supervisor sees only the warehouses assigned to them, and that path made 182 extra reads per listing. It had been in production for a week.
Roles are shapes, not names
Permissions are given by position. What a person can see and change depends on their role and their warehouses. So the proofs now run as role shapes instead of one convenient user:
- an administrator who sees every warehouse,
- a supervisor with two warehouses,
- a customer-service rep with one.
Every desk proof runs as each shape, and it runs on the installed release bundle as well as on the source tree, because the bundle is what people actually use.
269 doors
The next release proof walked 269 doors and menus across 7 role shapes. All 269 passed.
Two rules that came with it
The server refuses. The page does not decide. Hiding a button is decoration. If a role must not see a figure, the server must not send it: every route that reads or writes an order checks the person's warehouses and refuses with a reason. Balance figures are shown to no one, so a test planted a distinct value in every credit field of a test ledger and searched every route and every rendered page for them: 899 hits before the fix, 0 after.
A slow desk is not blamed on the ERP. When the page gets no answer, it says "no answer from this desk within N seconds". It names the ERP only when the server's answer does. A slow or failed ERP read never empties the list either. The desk's own cards show first, and the ERP's half of each row says "not read" and why.