[
  {
    "cat": "Authentication",
    "test": "Missing Token -> 401",
    "pass": true,
    "code": 401
  },
  {
    "cat": "Authentication",
    "test": "Invalid Token -> 401",
    "pass": true,
    "code": 401
  },
  {
    "cat": "Authentication",
    "test": "Valid Token PAT-ALICE -> 200",
    "pass": true,
    "code": 200
  },
  {
    "cat": "Authentication",
    "test": "Valid Token PAT-BOB -> 200",
    "pass": true,
    "code": 200
  },
  {
    "cat": "IDOR / Isolation",
    "test": "Bob messaging Alice Session -> 403",
    "pass": true,
    "code": 403,
    "detail": "{'detail': 'Forbidden: You do not have authorization to access or modify this patient onboarding session.'}"
  },
  {
    "cat": "IDOR / Isolation",
    "test": "Alice completing Bob Session -> 403",
    "pass": true,
    "code": 403,
    "detail": "{'detail': 'Forbidden: You do not have authorization to complete this onboarding session.'}"
  },
  {
    "cat": "IDOR / Isolation",
    "test": "Unauthenticated access to Alice Session -> 401",
    "pass": true,
    "code": 401
  },
  {
    "cat": "Session Enumeration",
    "test": "Non-existent (404) vs Unauthorized (403) handling",
    "pass": true,
    "code": "404 vs 403"
  },
  {
    "cat": "Completed Session Security",
    "test": "Bob accessing Alice completed session -> 403",
    "pass": true,
    "code": 403
  },
  {
    "cat": "Idempotency",
    "test": "Alice completing twice -> 200 OK (completed)",
    "pass": true,
    "code": 200
  },
  {
    "cat": "Document Security",
    "test": "Reject executable MIME type -> 400",
    "pass": true,
    "code": 400,
    "detail": "{'detail': 'Unsupported document format: application/x-msdownload. Allowed formats: JPEG, PNG, WEBP, PDF.'}"
  },
  {
    "cat": "Document Security",
    "test": "Reject >10MB document payload -> 413",
    "pass": true,
    "code": 413,
    "detail": "{'detail': 'File size exceeds maximum allowed limit of 10MB.'}"
  },
  {
    "cat": "Document Security",
    "test": "Bob uploading doc to Alice session -> 403",
    "pass": true,
    "code": 403
  },
  {
    "cat": "AI Security",
    "test": "Prompt injection override attempt",
    "pass": true,
    "code": 200
  },
  {
    "cat": "CORS Security",
    "test": "Explicit origin & credentials check",
    "pass": true,
    "code": 200
  },
  {
    "cat": "Secrets Security",
    "test": "No hardcoded production keys in config.py",
    "pass": true,
    "code": 200
  }
]