---
id: TST-PFM-DJE-193
title: Upload permission
kind: unit
product_area: platform
module: data-job-engine
revision: 1
status: draft
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  macroservice-libraries: 54536a441935c6e09fdb7f96f0bec71c52ba4e03
  services-crm: a8d1364f1dd44b723bb5f9acba12f983e9ec8d69
  services-membership: 5994c270e8a37a30f848e99ba5b5ee6b87c08893
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
repository: services-platform
files:
  - modules/data-jobs/tests/unit/upload-permission.spec.ts
implements:
  - ATS-PFM-DJE-011-01
environment: local
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 1
isolation: In-memory fixtures and restored dependency doubles.
evidence:
  - 'services-platform:modules/data-jobs/tests/unit/upload-permission.spec.ts'
assertion_inventory:
  - 'the data-job upload key: what the catalog publishes'
  - publishes the key for putting a file into the store
  - 'publishes that one key alone, and none of the five standard actions of a resource with records'
  - describes it in the words an administrator reads when granting it
  - 'the data-job upload key: how it is declared'
  - >-
    declares it at the admin tier, because the file it loads is applied to the tenant\u2019s records
    in bulk
  - 'does not mark it staff-only: a customer\u2019s own administrator loads the customer\u2019s data'
  - 'the data-job upload key: which built-in policies carry it'
  - generates the three tier policies of Platform the key is measured against
  - puts it in Platform Administrator
  - keeps it out of Platform User
  - keeps it out of Platform Read Only
  - 'the data-job upload key: which routes require it'
  - 'declares the six operations of the protocol, and no seventh'
  - 'requires this one key on every one of them, opening and listing included'
  - 'serves every one of them on a console access context, so no token of another tier reaches one'
registration_note: Registration describes existing source; the suite is not executed by this documentation job.
---

# Upload permission

## Verification Boundary

The suite checks an isolated production calculation, declaration or adapter. The structured assertion inventory records the checks present at the pinned revision.

## What This Suite Proves

The existing checks exercise upload permission. The specification bindings identify the narrower outcomes supported by those assertions.

## What It Does Not Prove

An isolated check does not establish a deployed workflow, database enforcement or complete feature acceptance.

## Real Dependencies and Test Doubles

The production function or declaration is exercised with in-memory inputs and dependency doubles. This boundary does not require a live database.

## Must Not Be Doubled

The production function under examination and its returned decisions remain real; replacing their answers defeats the check.