---
id: TST-PFM-INT-525
title: broker
kind: integration
product_area: platform
module: integrations
revision: 1
status: draft
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  macroservice-libraries: 54536a441935c6e09fdb7f96f0bec71c52ba4e03
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
repository: services-platform
files:
  - modules/integrations/tests/integration/services/credentials/broker.integration.spec.js
implements:
  - ATS-PFM-INT-005-03
  - ATS-PFM-INT-005-04
  - ATS-PFM-INT-005-06
environment: local
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 5
isolation: >-
  Use the suite-owned database fixtures and its declared cleanup; prepare the test database before
  integration or lifecycle execution.
evidence:
  - >-
    services-platform:modules/integrations/tests/integration/services/credentials/broker.integration.spec.js
test_cases:
  - source: >-
      services-platform:modules/integrations/tests/integration/services/credentials/broker.integration.spec.js#carries
      an API key connection’s entered fields, under its method, as a crl_ lease
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/integration/services/credentials/broker.integration.spec.js#carries
      a basic connection’s username and password
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/integration/services/credentials/broker.integration.spec.js#carries
      Rhythm’s platform secret and the connection’s account for a platform account
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/integration/services/credentials/broker.integration.spec.js#carries
      a client-credentials token fetched once and kept for the next lease
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/integration/services/credentials/broker.integration.spec.js#lives
      five minutes unless the caller asks otherwise
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/integration/services/credentials/broker.integration.spec.js#is
      refused for a lifetime beyond sixty minutes
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/integration/services/credentials/broker.integration.spec.js#is
      refused as connection_unavailable for a suspended connection
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/integration/services/credentials/broker.integration.spec.js#is
      given a verifying connection only for its verification
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/integration/services/credentials/broker.integration.spec.js#writes
      an audit row naming the lease, the execution and the principal, and no value
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/integration/services/credentials/broker.integration.spec.js#records
      when the credential was last used
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/integration/services/credentials/broker.integration.spec.js#answers
      a fresh lease of the same connection while the execution runs, having asked the executions port
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/integration/services/credentials/broker.integration.spec.js#is
      refused when the execution is no longer running
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/integration/services/credentials/broker.integration.spec.js#is
      refused for a principal the lease was not issued to
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/integration/services/credentials/broker.integration.spec.js#is
      refused for a lease this container never issued
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/integration/services/credentials/broker.integration.spec.js#makes
      the new credential the active one and supersedes the previous
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/integration/services/credentials/broker.integration.spec.js#schedules
      the previous secret’s deletion with the seven-day window and keeps it until then
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/integration/services/credentials/broker.integration.spec.js#leases
      the new credential at once
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/integration/services/credentials/broker.integration.spec.js#writes
      a credential.rotated audit row naming both credentials
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/integration/services/credentials/broker.integration.spec.js#is
      refused when it lacks a field the method declares, naming the field
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/integration/services/credentials/broker.integration.spec.js#is
      refused when it states no field at all
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/integration/services/credentials/broker.integration.spec.js#is
      refused for another method than the connection’s
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/integration/services/credentials/broker.integration.spec.js#revokes
      every credential of the connection and schedules each live secret’s deletion
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/integration/services/credentials/broker.integration.spec.js#leaves
      nothing to lease
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/integration/services/credentials/broker.integration.spec.js#refuses
      a credential beyond the limit while every earlier secret still exists
    provenance: test
dependency_evidence:
  provenance: test
  source: >-
    services-platform:modules/integrations/tests/integration/services/credentials/broker.integration.spec.js
  reviewed:
    - Suite introduction
    - Fixture setup
    - Client substitutions
    - Assertions and cleanup
---
# broker

## Verification Boundary

This database and service suite exercises broker. Its registration records the executable definition; no run result is asserted.

## What This Suite Proves

The bindings identify the detailed outcomes asserted by this suite. Test-level evidence retains the individual checks, including cases where several suites contribute to one scenario.

## What It Does Not Prove

In-process execution does not establish deployed infrastructure or a real provider response. Several bindings can supply different parts of a detailed scenario; no single-file completeness is implied.

## Real Dependencies and Test Doubles

The suite definition identifies its database fixtures and replaced clients, hooks, clocks or executors. Integration runs use the prepared database; lifecycle runs exercise the in-process route or adapter path.

## Must Not Be Doubled

The database constraints, transactions and service behavior claimed by an integration binding must execute. Replaced external seams cannot establish live provider or infrastructure behavior.