# Scenario: Approval Authorization (#56)

skip: true

**Source Issue:** #56 — P0 Security: processAction has no ActorId authorization
**Date:** 2026-03-27

---

## Pre-conditions

| ID | Check | How to verify |
|----|-------|---------------|
| PRE-01 | Two users exist: admin and a non-admin | DB: `SELECT Id, Username FROM User WHERE IsActive = 1 LIMIT 5` |
| PRE-02 | A pending WorkItem assigned to the non-admin user exists | DB: `SELECT piw.Id, piw.ActorId FROM ProcessInstanceWorkitem piw JOIN ProcessInstance pi ON piw.ProcessInstanceId = pi.Id WHERE pi.Status = 'Pending' AND piw.ActorId != '<admin_id>' LIMIT 1` |
| PRE-03 | Admin has a valid auth token | `POST /services/oauth2/token` with admin credentials |

---

## Test Cases

| ID | Step | Expected | Checkpoints |
|----|------|----------|-------------|
| SA-01 | Admin calls `POST /process/approvals` with `actionType: Approve` on a WorkItem assigned to another user | Request should be **rejected** with 403 | - HTTP status 403<br>- Error message indicates unauthorized<br>- WorkItem status unchanged in DB<br>- ProcessInstance status unchanged |
| SA-02 | Admin calls `POST /process/approvals` with `actionType: Reject` on a WorkItem assigned to another user | Request should be **rejected** with 403 | Same as SA-01 |
| SA-03 | Admin calls `POST /process/approvals` with `actionType: Approve` on a WorkItem assigned to themselves | Request should **succeed** | - HTTP status 200<br>- `success: true`<br>- ProcessInstance status updated |
| SA-04 | Verify frontend only shows Approve/Reject for WorkItems assigned to current user | Approval Queue should filter by ActorId | - SOQL query includes `WHERE ActorId = :currentUserId`<br>- Items assigned to other users not visible |
| SA-05 | Non-admin user tries to approve their own WorkItem | Should succeed | - Same as SA-03 but from non-admin token |
| SA-06 | Non-admin user tries to approve admin's WorkItem | Should be rejected | - Same as SA-01 |

### Reproduction Command (SA-01)

```bash
# Get admin token
TOKEN=$(curl -s -X POST http://localhost:8082/services/oauth2/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "grant_type=password" \
  --data-urlencode "username=admin@test.com" \
  --data-urlencode "password=${NEXUS_ADMIN_PASSWORD}" | python3 -c "import sys,json; print(json.load(sys.stdin)['access_token'])")

# Find a WorkItem assigned to someone else
WORKITEM_ID=<from PRE-02 query>

# Attempt unauthorized approval
curl -X POST http://localhost:8082/services/data/v63.0/process/approvals \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"requests":[{"actionType":"Approve","contextId":"'$WORKITEM_ID'","comments":"Unauthorized test"}]}'

# Expected: 403 Forbidden
# Actual (bug): 200 OK with success: true
```

---

## Execution Checklist

```
PRE-01: [ ] PRE-02: [ ] PRE-03: [ ]
SA-01: [ ] SA-02: [ ] SA-03: [ ] SA-04: [ ] SA-05: [ ] SA-06: [ ]
```