grceng.academy
YAML lab 40 bonus XP

Repair the billing request contract

Start labRead the room

Objectives

Halcyon Clinics is publishing a machine-readable contract for its billing reader. The draft owner proposes a write method because 'all encrypted calls are safe' and wants to retain live session cookies in the evidence bundle.

Complete the YAML from the fixture. Use booleans for flags, integers for codes, and the SameSite mode named by policy. Supply a short evidence description that refers to redacted traces or sanitized traces instead of collecting credentials.

Approved billing-reader requirements

Operation: read bill 42 without requesting any business-state change; use GET.
URL: https://portal.example.test/bills/42?view=summary#total
Contract path excludes query and fragment.
No valid session: 401. Valid session, no billing role: 403.
Session cookie: HTTPS only, unavailable to script cookie APIs.
Policy selects SameSite=Lax to allow ordinary cross-site top-level safe navigations.
Logout must invalidate the server session, not just remove the browser cookie.
Evidence: redacted traces or sanitized traces; never live credentials.

Checks the server runs (6)

  • Read method and resource path match the contract
  • Safe and idempotent classifications are distinct and correct
  • Credential and role failures use the documented codes
  • Cookie attributes meet transport, script, and navigation requirements
  • Logout revokes server-side session state
  • Evidence describes sanitized exchanges, not credentials

Check names are all you see here: the expectations that decide pass or fail, and the reference solution, stay on the server.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

  1. Step 1

    Identify the resource

    Find the operation and isolate the URL portion identifying the resource, excluding selection parameters and local navigation.

    Read method and resource path match the contract

  2. Step 2

    Classify effects

    Ask separately whether the operation requests a mutation and whether repeating it changes the intended result.

    Safe and idempotent classifications are distinct and correct

  3. Step 3

    Separate failure causes

    Map absent identity and inadequate permission to their respective documented responses.

    Credential and role failures use the documented codes

  4. Step 4

    Apply browser boundaries

    Match each cookie field to its transport, script-access, or cross-site navigation requirement in the policy.

    Cookie attributes meet transport, script, and navigation requirements

  5. Step 5

    Test the old credential

    Consider whether replay after logout would succeed if only the local browser copy were removed.

    Logout revokes server-side session state

  6. Step 6

    Keep evidence safe

    Describe a trace collection with sensitive values removed; an auditor needs behavior, not a usable credential.

    Evidence describes sanitized exchanges, not credentials

Rules summary

  • XP on pass

    40 bonus XP the first time every check goes green.

  • Paid hints

    2 available. Each costs 25% of the lab XP (about 10 XP).

  • Reveal solution

    Scores 0 XP and unlocks only after 3 check runs.

  • Attempt cap

    60 check runs per learner. The runner warns you in the last 10.

  • Drafts

    Your editor content is saved in this browser, so a reload will not lose work.

  • Walkthrough

    Always free and never penalised: use it before spending a hint.