{
  "id": "APR-001",
  "name": "Non-approver calling Approve should return 403",
  "description": "Non-approver attempting to Approve a submitted request should return 403 Forbidden. Bug: New - permission control not tested.",
  "object": "Quote",
  "method": "POST",
  "endpoint": "/services/data/v63.0/process/approvals",
  "setup": [
    {
      "type": "sql",
      "name": "Create Account for APR-001",
      "sql": "INSERT INTO Account (Id, Name, Type, BillingCountryCode, IsDeleted, CreatedDate, LastModifiedDate, SystemModstamp) VALUES (%s, %s, %s, %s, %s, %s, %s, %s)",
      "params": [
        "001APR001ACC00001",
        "APR-001 Test Account",
        "Customer - Direct",
        "US",
        0,
        "{db_timestamp}",
        "{db_timestamp}",
        "{db_timestamp}"
      ]
    },
    {
      "type": "sql",
      "name": "Create Opportunity for APR-001",
      "sql": "INSERT INTO Opportunity (Id, Name, AccountId, StageName, CloseDate, Amount, IsDeleted, CreatedDate, LastModifiedDate, SystemModstamp) VALUES (%s, %s, %s, %s, %s, %s, %s, %s, %s, %s)",
      "params": [
        "006APR001OPP00001",
        "APR-001 Test Opportunity",
        "001APR001ACC00001",
        "Prospecting",
        "{today}",
        1000,
        0,
        "{db_timestamp}",
        "{db_timestamp}",
        "{db_timestamp}"
      ]
    },
    {
      "method": "POST",
      "endpoint": "/services/data/v63.0/sobjects/Quote",
      "object": "Quote",
      "payload": {
        "Name": "APR-001 Test Quote",
        "OpportunityId": "006APR001OPP00001",
        "AccountId": "001APR001ACC00001",
        "Status": "Draft"
      },
      "id_var": "quote_id",
      "extract": {
        "quote_id": "id"
      }
    }
  ],
  "payload": {
    "actionType": "Submit",
    "contextId": "{quote_id}",
    "comments": "Please approve this quote"
  },
  "expects": {
    "status_code": 200
  },
  "approval_step": {
    "action": "approve_as_different_user",
    "name": "Approve as non-approver",
    "endpoint": "/services/data/v63.0/process/approvals",
    "auth": {
      "username": "sales@test.com",
      "password": "Sales123!"
    },
    "payload": {
      "actionType": "Approve",
      "contextId": "{quote_id}",
      "comments": "Approved by non-approver"
    },
    "expects": {
      "status_code": 403
    }
  },
  "teardown": [
    {
      "method": "DELETE",
      "endpoint": "/services/data/v63.0/sobjects/Quote/{quote_id}"
    },
    {
      "type": "sql",
      "sql": "DELETE FROM Opportunity WHERE Id = %s",
      "params": [
        "006APR001OPP00001"
      ]
    },
    {
      "type": "sql",
      "sql": "DELETE FROM Account WHERE Id = %s",
      "params": [
        "001APR001ACC00001"
      ]
    }
  ],
  "priority": "P2",
  "bug_ref": "New",
  "scene": "approval",
  "skip": true,
  "skip_reason": "Runner now supports chained approval requests and step-level auth, but current product behavior still returns 500 on the initial Submit call to /process/approvals before the non-approver 403 assertion can execute"
}