102 lines
2.4 KiB
JSON
102 lines
2.4 KiB
JSON
[
|
|
{
|
|
"cat": "Authentication",
|
|
"test": "Missing Token -> 401",
|
|
"pass": true,
|
|
"code": 401
|
|
},
|
|
{
|
|
"cat": "Authentication",
|
|
"test": "Invalid Token -> 401",
|
|
"pass": true,
|
|
"code": 401
|
|
},
|
|
{
|
|
"cat": "Authentication",
|
|
"test": "Valid Token PAT-ALICE -> 200",
|
|
"pass": true,
|
|
"code": 200
|
|
},
|
|
{
|
|
"cat": "Authentication",
|
|
"test": "Valid Token PAT-BOB -> 200",
|
|
"pass": true,
|
|
"code": 200
|
|
},
|
|
{
|
|
"cat": "IDOR / Isolation",
|
|
"test": "Bob messaging Alice Session -> 403",
|
|
"pass": true,
|
|
"code": 403,
|
|
"detail": "{'detail': 'Forbidden: You do not have authorization to access or modify this patient onboarding session.'}"
|
|
},
|
|
{
|
|
"cat": "IDOR / Isolation",
|
|
"test": "Alice completing Bob Session -> 403",
|
|
"pass": true,
|
|
"code": 403,
|
|
"detail": "{'detail': 'Forbidden: You do not have authorization to complete this onboarding session.'}"
|
|
},
|
|
{
|
|
"cat": "IDOR / Isolation",
|
|
"test": "Unauthenticated access to Alice Session -> 401",
|
|
"pass": true,
|
|
"code": 401
|
|
},
|
|
{
|
|
"cat": "Session Enumeration",
|
|
"test": "Non-existent (404) vs Unauthorized (403) handling",
|
|
"pass": true,
|
|
"code": "404 vs 403"
|
|
},
|
|
{
|
|
"cat": "Completed Session Security",
|
|
"test": "Bob accessing Alice completed session -> 403",
|
|
"pass": true,
|
|
"code": 403
|
|
},
|
|
{
|
|
"cat": "Idempotency",
|
|
"test": "Alice completing twice -> 200 OK (completed)",
|
|
"pass": true,
|
|
"code": 200
|
|
},
|
|
{
|
|
"cat": "Document Security",
|
|
"test": "Reject executable MIME type -> 400",
|
|
"pass": true,
|
|
"code": 400,
|
|
"detail": "{'detail': 'Unsupported document format: application/x-msdownload. Allowed formats: JPEG, PNG, WEBP, PDF.'}"
|
|
},
|
|
{
|
|
"cat": "Document Security",
|
|
"test": "Reject >10MB document payload -> 413",
|
|
"pass": true,
|
|
"code": 413,
|
|
"detail": "{'detail': 'File size exceeds maximum allowed limit of 10MB.'}"
|
|
},
|
|
{
|
|
"cat": "Document Security",
|
|
"test": "Bob uploading doc to Alice session -> 403",
|
|
"pass": true,
|
|
"code": 403
|
|
},
|
|
{
|
|
"cat": "AI Security",
|
|
"test": "Prompt injection override attempt",
|
|
"pass": true,
|
|
"code": 200
|
|
},
|
|
{
|
|
"cat": "CORS Security",
|
|
"test": "Explicit origin & credentials check",
|
|
"pass": true,
|
|
"code": 200
|
|
},
|
|
{
|
|
"cat": "Secrets Security",
|
|
"test": "No hardcoded production keys in config.py",
|
|
"pass": true,
|
|
"code": 200
|
|
}
|
|
] |