# QA permission and representative matrix

This matrix is the maintained regression contract for role, unit, permission, scope,
and primary workflows. Representatives are deterministic records created by
`python manage.py bootstrap`; tests do not depend on mutable production data.

| Unit | Role | Representative | Scope | Expected access |
| --- | --- | --- | --- | --- |
| فروش | کارشناس فروش | کیمیا غفاری (`kimiya_ghaffari`) | `SELF` | Public unassigned sales tickets, tickets created by or assigned to self, reply in that scope |
| فروش | سرپرست فروش | مریم فتوت (`maryam_fotovat`) | `UNIT` | All sales-unit tickets and normal sales workflows |
| فروش | مدیر فروش | مرتضی سخائی فرد (`morteza_sokhaeifard`) | `UNIT` + manager role permissions | All sales-unit tickets and manager actions |
| بارگیری انبار | کارشناس بارگیری | خانم سبزعلی (`ms_sabzali`) | `UNIT` | Warehouse-loading-loading tickets only; create bulk/inquiry and view own operations |
| مالی / حسابداری | کارشناس مالی | خانم فرشته یاوری (`fereshteh_yavari`) | `UNIT` | Finance tickets, categories, and contact groups only |
| مدیریت ارشد | مدیرعامل | مصطفی سخائی فرد (`mostafa_sokhaeifard`) | Broad/global explicit permissions | All tickets, all bulk dispatches, all inquiries |

## Permission coverage contract

| Capability | Limited scope | Unit scope | Broad scope |
| --- | --- | --- | --- |
| Ticket view/reply | Public unassigned + created/assigned self | All permitted tickets in own unit | `view_all_tickets` |
| Staff ticket creation | Primary unit only | Primary unit only | Explicit `add_ticket`; unit/category validation still applies |
| Category / expert / queue | Selected/primary unit only | Selected/primary unit only | Still validated against selected unit |
| Contact group | Primary unit only | Primary unit only | Explicit permission plus unit validation |
| Bulk ticket | `create_bulk_dispatch`, own records | Same within permitted unit | `view_all_bulk_dispatches` |
| Inquiry | `create_inquiry`, own records | Same within permitted unit | `view_all_inquiries` |

The public “general queue” is a routing state, not a separate database model: it is
stored as the selected unit with `selected_expert = NULL`.

## Permanent commands

```powershell
# Backend/API/integration regression
.\.venv\Scripts\python.exe -m pytest tests -m "not e2e" -q

# Local real-browser regression (managed Chromium + isolated live_server)
.\.venv\Scripts\python.exe -m pytest tests\e2e -m "e2e and not external_e2e" -q

# Read-only deployed-environment smoke (requires environment variables in README)
.\.venv\Scripts\python.exe -m pytest tests\e2e\test_external_environment_smoke.py -m external_e2e -q
```