---
id: TST-ACC-TRX-026
title: Payments table suite
kind: integration
product_area: accounting
module: transactions
revision: 1
status: draft
source_sha:
  services-accounting: f47cb263875bbc0c5640fba7dae6785ec32695f8
repository: services-accounting
files:
  - modules/transactions/tests/integration/db/payments.table.integration.spec.js
implements: []
implements_parts: []
environment: local
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 3
isolation: >-
  Suite-marked records in the prepared local test database; fixture teardown
  removes owned records.
provenance: test
source: >-
  services-accounting:modules/transactions/tests/integration/db/payments.table.integration.spec.js
evidence:
  - provenance: test
    source: >-
      services-accounting:modules/transactions/tests/integration/db/payments.table.integration.spec.js
    assertion_titles:
      - the payments core’s tables (integration)
      - 'row-level security: another tenant’s money is not seen'
      - >-
        shows the foreign payment to its own tenant (the premise of the cases
        below)
      - >-
        hides another tenant’s payments, intents, allocations, credits,
        applications and application lines
      - hides another tenant’s payment events
      - 'the same-unit, same-currency keys'
      - >-
        refuses an allocation naming a line of another unit
        (payment_allocations_invoice_line_fk)
      - >-
        refuses a payment in a merchant account of another unit
        (payments_merchant_account_fk)
      - >-
        refuses a credit naming a payment in another currency
        (credits_payment_fk)
      - 'the generated amounts and their CHECKs, which bind the owner too'
      - >-
        refuses an allocation of more than the payment holds
        (payments_unallocated_check)
      - >-
        refuses an application of more than the credit holds
        (credits_balance_check)
      - >-
        refuses a maintained amount going negative by hand
        (payments_maintained_check)
      - write-once identity
      - refuses a change to a payment’s total (RHF01)
      - refuses a change to a payment’s customer (RHF01)
      - refuses a change to a credit’s source (RHF01)
      - the statuses the database derives
      - does not let a voided payment come back (RHA04)
      - derives succeeded for a payment written refunded by nothing
      - derives open for a credit written used while it has a balance
      - the ledgers and the event logs
      - >-
        refuses the owner’s UPDATE of an allocation row (RHA01: the trigger,
        beneath the grant)
      - >-
        refuses the owner’s DELETE of an application line outside a purge
        (RHA01)
      - >-
        refuses the application role’s UPDATE and DELETE of the ledgers and
        UPDATE of the events (the grants)
      - refuses a DELETE of a payment event outside a purge (RHT02)
      - one payment per intent (FC-13)
      - refuses a second payment naming an intent (payments_intent_uidx)
      - refuses a card payment with no intent (payments_intent_check)
      - the invariant function
      - >-
        answers no violating row for either tenant after the commands wrote
        their money
    imports:
      - 'const { sql } = require(''drizzle-orm'');'
      - >-
        const { uuidV7 } =
        require('@rhythmsoftware/macroservice-records/uuid-v7');
      - >-
        const { expectConstraintViolation, expectDatabaseRefusal } =
        require('@rhythmsoftware/macroservice-testing/refusals');
      - 'const { stage } = require(''@rhythmsoftware/macroservice-testing/stage'');'
      - >-
        const { createCredit, applyCredit } =
        require('../../../services/credits/credit-commands');
      - >-
        const { receivePayment } =
        require('../../../services/payments/payment-receive');
      - '} = require(''../payments-fixtures'');'
      - "\t\t\tconst { foreign } = world.require();"
      - "\t\t\tconst { foreign } = world.require();"
      - "\t\t\tconst { foreign } = world.require();"
      - "\t\t\tconst { own } = world.require();"
      - "\t\t\tconst { own } = world.require();"
      - "\t\t\tconst { own } = world.require();"
      - "\t\t\tconst { own } = world.require();"
      - "\t\t\tconst { own } = world.require();"
      - "\t\t\tconst { own } = world.require();"
      - "\t\t\tconst { own } = world.require();"
      - "\t\t\tconst { own } = world.require();"
      - "\t\t\tconst { voidPayment } = require('../../../services/payments/payment-allocate');"
      - "\t\t\tconst { own } = world.require();"
      - "\t\t\tconst { own } = world.require();"
      - "\t\t\tconst { own } = world.require();"
      - "\t\t\tconst { own } = world.require();"
      - "\t\t\tconst { own } = world.require();"
      - "\t\t\tconst { own } = world.require();"
      - "\t\t\tconst { own } = world.require();"
    test_double_declarations: []
---

# Payments table suite

## Verification Boundary

The suite exercises transaction commands and database protections in the local prepared test environment. Registration records the existing executable file; it does not report a run or establish product approval.

## What This Suite Proves

The executable assertions exercise this module, but no capability or feature scenario binding is established for this file. Its individual assertion titles remain in the evidence register for subsequent mapping.

## What It Does Not Prove

Local commands and route invocations do not establish deployed routing, live processor guarantees or the complete staff browser experience. An unbound feature chain remains proposed, and this registration carries no execution result.

## Real Dependencies and Test Doubles

The suite uses the imported commands, route handlers or persistence code against the local test database. Fixture helpers supply accounting context; any stepped clock, dummy processor or substituted external client is retained in the evidence declarations.

## Must Not Be Doubled

The command or persistence behavior under assertion and its relevant database protections must remain real. Substituting the final financial result removes evidence of transactional effects.