A public service website and protected staff workspace for enquiry intake, assignments, follow-ups, and invoice records. The engineering focus is the transition from untrusted input to a reliable business record.
A convenient form can guide input, but validation must also handle requests that never used that form.
03 / REVIEW SCENARIOS
Look at the unexpected path.
Illustrative explanations of selected test definitions. These controls do not call the application or execute its tests.
SCENARIO 01
Manipulated total
A request supplies a low total, a paid amount, and a paid status alongside invoice fields.
EXPECTED IN THE SELECTED TEST
Recompute from inputs
The selected parser test expects those authority-bearing fields to be excluded from parsed invoice input.
NEXT REVIEW QUESTION
Review the server save path to confirm that calculated values and payment history are the only authority.
SCENARIO 02
Invalid decimal
A unit price contains excess fractional digits, scientific notation, or a non-finite value.
EXPECTED IN THE SELECTED TEST
Input rejected
The invoice tests expect malformed or out-of-range monetary inputs to throw validation errors.
NEXT REVIEW QUESTION
Present a useful field error while preserving the user’s valid entries.
SCENARIO 03
Boundary amount
An invoice reaches the permitted total, then another line pushes it beyond that limit.
EXPECTED IN THE SELECTED TEST
Limit enforced
The selected test accepts the exact maximum and rejects values that exceed it, including through tax.
NEXT REVIEW QUESTION
Apply equivalent limits to imports, edits, and payments as well as initial creation.
04 / TRACEABLE EVIDENCE
From a claim to a test.
Selected source reviewed on November 6, 2026.
Source reviewed · tests not rerun
SELECTED TEST FILEsrc/lib/invoice-model.test.ts
Snapshot9b83e5f14339
Client-supplied totals and payment status are excluded
Decimal arithmetic, line count, amount, and tax limits
Date validation, leap dates, and identity for invoice edits
These statements summarize the test definitions at this repository snapshot. They do not report a passing run, complete coverage, or an independent security audit. Application source stays private.
WHAT I WOULD EXAMINE NEXT
Continue the review.
A fuller production review would verify staff permissions at server endpoints, exercise partial payments and corrections, and test notification failures after a request is saved.