Hospital Private Document Foundation QA

ScopeCopy Anchor Link

This guide tests the U3 API foundation, not a completed Lab or TPA screen. Use synthetic records and PDFs only. Do not enable real staging/production uploads before D2 passes. Do not deploy this candidate to staging or production before the D2 storage/scanning gate is accepted. The developer guide defines configuration, routes, states, and permission requirements. The main QA guide continues to cover shell access, cases, scheduling, and both presets.

Record The CandidateCopy Anchor Link

• Record backend/frontend commits, migration versions, environment, facility, preset, and QA actor permissions.
• Confirm all four U3 migrations and the scope indexes, composite FKs, history/metadata triggers, and FORCE RLS exist in the target database.
• Confirm the tested actor has the relevant category authority and a second actor lacks it.
• Record D2 storage, scanner, limits, retention/deletion, and actor approvals. Missing evidence blocks real uploads and pilot acceptance.
• Keep the tracking issue open. Record implementation, deployment, QA, and approvals separately.

Disabled DeploymentCopy Anchor Link

• With uploads disabled, submit a synthetic PDF using an authorized test actor. Expect DOCUMENT_UPLOADS_UNAVAILABLE and no new document.
• Repeat with no scanner, invalid/missing size limit, missing approval reference, and missing staging bucket. No case produces a clean scan or disk fallback.
• Confirm the rest of Hospital still boots and its implemented case/OT operations work.
• Confirm Lab/TPA screens do not claim to be connected because U3 APIs exist.

Approved Isolated Document TestCopy Anchor Link

Run this section only where a reviewed scanner and private storage are configured. Never install a test-only clean scanner on staging or production to pass this checklist.

• Upload a valid synthetic PDF for a case using the documented multipart fields. Expect one metadata record with an opaque ID and no storage key, signed URL, or file path.
• Reject a renamed non-PDF, malformed PDF signature/end marker, empty file, and oversized file. Confirm no accessible object or clinical review appears.
• Inspect the private storage object and persisted case/patient scope through approved operator tools. Do not copy object keys or patient data into public evidence.
• Before scan completion, download must fail with DOCUMENT_QUARANTINED.
• A clean result enables authenticated attachment download. The response is PDF, nosniff, private/no-store, and has a PHI access audit before delivery.
• An unsafe result is rejected. Missing/malformed/failed scanner responses remain unavailable or failed, never clean.
• Stop storage access or alter the stored bytes in the isolated test setup. Download cannot return a different file or fabricate success.
• Verify scan completion alone does not change readiness, create a clinical review, or unblock OT.

Access And HistoryCopy Anchor Link

• General case view without the category grant cannot list, inspect, upload, retry scanning, or download that category's documents.
• General clinician and patient-facing document lists, details, timelines, and counts must not expose Hospital evidence, even after a clean scan. Ordinary documents with a missing document type must remain visible.
• Revoke membership, facility assignment, or category authority between requests. The next request must fail; no cached private download is served by the endpoint.
• Change the facility, case, document, or predecessor selector to a foreign resource. No metadata or bytes are exposed.
• Disable cases or the source module and retry direct API calls. They must fail despite an old browser route.
• Suspend the practice. Authorized history reads remain available under existing read-only policy; uploads/retries are denied.
• Upload a replacement with a new operation key and the current predecessor ID. Prior metadata/history remains and only one successor can exist.
• Try a second successor, foreign-purpose predecessor, self-reference, and stale replacement. Expect conflict or database rejection without a second active revision in that chain.
• With approved isolated operator access, try to change the linked canonical file name, size, content type, document type, or file path. The database must reject each edit. Unrelated document edits must still work.
• Verify multiple independent reports can exist for one case and purpose. History does not mark an older revision as current clinical evidence.

Failure And RetryCopy Anchor Link

• Repeat an upload with the same key and identical bytes/name/purpose/predecessor. Expect the same record, not a duplicate revision or event.
• Reuse the key with changed content or metadata. Expect IDEMPOTENCY_CONFLICT.
• Simulate storage failure after registration. Confirm a durable pending/failed quarantine reference remains. Restore storage and retry the same key/file to recover it.
• Simulate registration audit failure. No object is uploaded and no document records commit.
• Simulate finalization/audit failure after bytes reach storage. The quarantine reference remains; retry cannot bypass current authority or create duplicate history.
• Simulate scan enqueue failure. The stored object remains, the failure is visible, and authorized scan retry can recover after the queue returns.
• Retry/duplicate scan execution. Confirm immutable bytes/revision binding, preserved terminal outcomes, required audit, and restored tenant context after success or failure.
• Test scan-completion audit failure in a standalone job without an outer test transaction. It must persist scan_failed, raise the retryable document error, and restore tenant context. Restore audit and retry to reach the correct terminal state.
• Make download audit unavailable. No bytes may leave the endpoint.

AcceptanceCopy Anchor Link

• Record request/response outcomes, relevant source rows, audit references, and failure-recovery evidence without secrets or real patient content.
• Resolve code-review findings and run the backend/frontend checks for the exact candidate.
• Obtain document-security/operator acceptance before enabling real uploads.
• Keep selected-provider integration, retention/legal-hold deletion behavior, D2 verification, and U4/U5 operational workflow acceptance open until implemented and approved.