# FORTLESS — Executable Test Matrix & Release Gates **Version:** 1.0.0-PROD **Status:** Approved for Implementation (Phase 0 Baseline) **Standard:** Automated Quality & Security Verification Framework --- ## 1. Test Verification Hierarchy Every vertical slice must be validated across the testing pyramid before being marked complete: ``` ┌──────────────────────┐ │ End-to-End User Sagas│ (Playwright / Multi-Context) ├──────────────────────┤ │ API & RBAC Boundary │ (Supertest / Fastify Inject) ├──────────────────────┤ │ Provider Contract │ (Pterodactyl Mock & Sandbox) ├──────────────────────┤ │ Transactional DB │ (Prisma / SQL Foreign Key / Lock) ├──────────────────────┤ │ Domain Invariant Unit│ (Pure Logic / Money / State Machines) └──────────────────────┘ ``` ### Status Tagging Protocol: - `[NOT_STARTED]` — Specification defined; implementation not yet created. - `[MOCK_ONLY]` — Implemented and validated against local mocks, fixtures, and unit suites. - `[SANDBOX_VERIFIED]` — Validated against official third-party vendor sandbox/staging environments (e.g. Stripe Testmode, Staging Pterodactyl Panel). - `[PRODUCTION_VERIFIED]` — Validated in production under canary or pilot rollout with live audit evidence. --- ## 2. Comprehensive Test Scenarios by Category ### A. Authentication & Tenant Isolation - [ ] `AUTH-01`: Anonymous request to `/api/v1/services` returns `401 Unauthorized`. `[NOT_STARTED]` - [ ] `AUTH-02`: Tenant A cannot view or fetch Tenant B's invoice, order, or service by guessing its UUID (`404 Not Found` or `403 Forbidden`). `[NOT_STARTED]` - [ ] `AUTH-03`: Role revocation takes effect immediately; revoked token fails next request. `[NOT_STARTED]` - [ ] `AUTH-04`: Billing Manager role cannot perform power action (`START`/`STOP`/`KILL`) on a server. `[NOT_STARTED]` - [ ] `AUTH-05`: Technical Admin role cannot view payment methods or trigger refunds. `[NOT_STARTED]` - [ ] `AUTH-06`: Staff member cannot access customer server file editor without signed time-limited consent ticket. `[NOT_STARTED]` - [ ] `AUTH-07`: Password reset token is single-use and expires after 15 minutes. `[NOT_STARTED]` - [ ] `AUTH-08`: Distributed rate limiter restricts brute-force login attempts (max 5 per IP/user per 15 min). `[NOT_STARTED]` ### B. Pricing, Quotes & Catalog Invariants - [ ] `CAT-01`: Retired or draft plan version cannot be purchased via direct API POST. `[NOT_STARTED]` - [ ] `CAT-02`: Manipulated client price payload (`"total": 1`) is rejected; quote total rules. `[NOT_STARTED]` - [ ] `CAT-03`: Expired quote (>15 mins) fails checkout with `422 Quote Expired; Please Refresh`. `[NOT_STARTED]` - [ ] `CAT-04`: 100 concurrent checkout attempts for a coupon with max 100 uses allows exactly 100 redemptions. `[NOT_STARTED]` - [ ] `CAT-05`: Multi-line cart taxes calculate with exact half-up banker's rounding in integer minor units. `[NOT_STARTED]` - [ ] `CAT-06`: Region with zero available node capacity denies cart reservation. `[NOT_STARTED]` ### C. Payments & Webhooks (Critical Financial Gates) - [ ] `PAY-01`: Webhook with forged HMAC signature is rejected with `400 Bad Request`. `[NOT_STARTED]` - [ ] `PAY-02`: Duplicate delivery of same PSP event ID returns `200 OK` without duplicate execution. `[NOT_STARTED]` - [ ] `PAY-03`: Two different event IDs for the same payment intent do not grant double server entitlements. `[NOT_STARTED]` - [ ] `PAY-04`: Webhook payload with mismatched amount (e.g. paid €10 instead of €12) transitions to `ANOMALY_HELD`. `[NOT_STARTED]` - [ ] `PAY-05`: 10 concurrent checkout submissions with identical idempotency key create exactly 1 PSP session. `[NOT_STARTED]` - [ ] `PAY-06`: Database outage during webhook ingestion returns non-2xx status, forcing PSP retry. `[NOT_STARTED]` - [ ] `PAY-07`: Refund request exceeding remaining refundable balance is rejected with `422 Unprocessable`. `[NOT_STARTED]` - [ ] `PAY-08`: Partial refund creates credit note for exact partial amount, preserving remaining balance. `[NOT_STARTED]` - [ ] `PAY-09`: Card details (PAN/CVV) never appear in logs, database columns, or API response bodies. `[NOT_STARTED]` ### D. Subscription Lifecycle & Renewals - [ ] `SUB-01`: End-of-month renewal (Jan 31 -> Feb 28 -> Mar 31) maintains correct anchor date. `[NOT_STARTED]` - [ ] `SUB-02`: Overlapping renewal worker jobs run simultaneously; exactly one renewal invoice generated. `[NOT_STARTED]` - [ ] `SUB-03`: Cancellation effective at period end allows service usage until period end date, then terminates. `[NOT_STARTED]` - [ ] `SUB-04`: Failed card payment initiates 5-day grace period; service remains `ACTIVE` with dunning alerts. `[NOT_STARTED]` - [ ] `SUB-05`: Unpaid invoice after grace period triggers automated Pterodactyl `suspend`. `[NOT_STARTED]` ### E. Infrastructure Provisioning & Failure Recovery - [ ] `PROV-01`: Paid order triggers outbox job; exactly one Pterodactyl server created with purchased RAM/Disk. `[NOT_STARTED]` - [ ] `PROV-02`: Unpaid or canceled order never invokes provider creation API under any circumstances. `[NOT_STARTED]` - [ ] `PROV-03`: Provider returns 500 error; outbox worker retries with exponential backoff + jitter. `[NOT_STARTED]` - [ ] `PROV-04`: Provider creates server but connection times out; lookup recovery links existing server without duplicate. `[NOT_STARTED]` - [ ] `PROV-05`: Outbox worker terminated via `SIGKILL` mid-execution; next worker picks up lease safely. `[NOT_STARTED]` - [ ] `PROV-06`: Customer cannot manipulate container startup variables to bypass egg environment constraints. `[NOT_STARTED]` - [ ] `PROV-07`: Service suspension stops container immediately; disk files remain intact. `[NOT_STARTED]` - [ ] `PROV-08`: Reconciler discovers orphaned Pterodactyl server and logs quarantine alert. `[NOT_STARTED]` ### F. Security & Vulnerability Defense - [ ] `SEC-01`: SSRF probe to `http://169.254.169.254` or `http://127.0.0.1` is blocked by egress IP validator. `[NOT_STARTED]` - [ ] `SEC-02`: Stored XSS payload `` in support ticket is sanitized on render. `[NOT_STARTED]` - [ ] `SEC-03`: File manager download endpoint rejects path traversal `../../../../etc/shadow`. `[NOT_STARTED]` - [ ] `SEC-04`: WebSocket console subscription without valid short-lived ticket is rejected with `401`. `[NOT_STARTED]` - [ ] `SEC-05`: CORS header rejects untrusted origin requesting credentials (`Access-Control-Allow-Origin: *` blocked). `[NOT_STARTED]` --- ## 3. Strict P0 Release Acceptance Gate Checklist Before public commercial traffic is routed to Fortless, all mandatory gates must be verified: - [ ] **Gate 1:** 100% of Critical Financial tests (Category C) pass in automated CI. - [ ] **Gate 2:** 100% of Auth & Tenant Isolation tests (Category A) pass with zero leaks. - [ ] **Gate 3:** Provider Timeout & Idempotency tests (Category E) pass with zero duplicate instances. - [ ] **Gate 4:** Stripe Testmode / Sandbox end-to-end checkout, 3DS challenge, and webhook verification verified. - [ ] **Gate 5:** Staging Pterodactyl 1.x panel verified with real server creation, suspension, and deletion. - [ ] **Gate 6:** Off-host database backup and point-in-time recovery (PITR) drill executed and verified. - [ ] **Gate 7:** Legal Terms of Service, Privacy Policy, and Acceptable Use Policy reviewed and posted. - [ ] **Gate 8:** No hardcoded secrets, test credentials, or debug bypass flags exist in the codebase.