30 lines
1.9 KiB
Markdown
30 lines
1.9 KiB
Markdown
---
|
|
name: reconciliation-auditing
|
|
description: "Checks row-level security boundaries, audits logs immutability, and reconciles PMS sales totals. Use this when running security tests, validating database queries, or auditing log security."
|
|
---
|
|
|
|
# Reconciliation & Auditing
|
|
|
|
Defines guidelines for validating row-level security (RLS), verifying system audit log immutability, and running compliance tests on calculations.
|
|
|
|
## Core Rationale
|
|
Financial systems must maintain zero-trust boundaries. Unauthorized data access or alteration of audit logs ruins regulatory compliance and system trustworthiness.
|
|
|
|
## Execution Rules
|
|
|
|
### 1. Row-Level Security (RLS) Boundary Verification
|
|
- **User-Context Checks**: Test database access filters by emulating collaborator queries. Validate that users can only fetch records belonging to their assigned hotel site (e.g., leaders in Cartagena cannot view Bogota records).
|
|
- **Test Assertion**: Execute automated queries using the collaborator's database role or session context and assert that 0 records are returned for other sites.
|
|
|
|
### 2. Audit Log Immutability
|
|
- **Append-Only Logs**: Ensure that all logs written to the system are strictly append-only.
|
|
- **Verification Rule**: Attempt to update or delete a log entry in a testing context. Assert that the operation is rejected (either by database triggers, Prisma hooks, or PostgreSQL permissions).
|
|
|
|
### 3. Bilingual JSON formatting Checks
|
|
- **Validation**: Inspect the `aiAuditNotes` and `flaggedReason` fields in calculation outputs.
|
|
- **Assertion**:
|
|
- The content MUST be a valid JSON object.
|
|
- The object MUST contain both `en` and `es` keys.
|
|
- The keys must have non-empty string values.
|
|
- **Example Assertion**: `expect(settlement.aiAuditNotes).toHaveProperty('en'); expect(settlement.aiAuditNotes).toHaveProperty('es');`
|
|
- **UI Rendering**: Verify that the Next.js UI component renders the correct translation matching the active context locale.
|