---
id: TST-PFM-INT-580
title: gateway refusals
kind: unit
product_area: platform
module: integrations
revision: 1
status: draft
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  macroservice-libraries: 54536a441935c6e09fdb7f96f0bec71c52ba4e03
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
repository: services-platform
files:
  - modules/integrations/tests/unit/services/gateway-refusals.spec.ts
implements:
  - ATS-PFM-INT-009-01
  - ATS-PFM-INT-009-02
environment: mock
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 1
isolation: Pure test fixtures owned by the test process.
evidence:
  - 'services-platform:modules/integrations/tests/unit/services/gateway-refusals.spec.ts'
test_cases:
  - source: >-
      services-platform:modules/integrations/tests/unit/services/gateway-refusals.spec.ts#accepts a
      request its contract accepts, in the contract’s default mode
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/unit/services/gateway-refusals.spec.ts#refuses a
      request the contract refuses, invalid_request with the failing path
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/unit/services/gateway-refusals.spec.ts#refuses a
      capability the contracts do not define
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/unit/services/gateway-refusals.spec.ts#refuses a mode
      the contract does not allow
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/unit/services/gateway-refusals.spec.ts#refuses a
      missing key where the contract requires one
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/unit/services/gateway-refusals.spec.ts#refuses a key
      with surrounding whitespace as given, never trimming it into another key
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/unit/services/gateway-refusals.spec.ts#accepts a key
      with whitespace inside it
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/unit/services/gateway-refusals.spec.ts#refuses a
      timeout above the contract’s maximum
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/unit/services/gateway-refusals.spec.ts#refuses a
      request over 1 MB before anything else
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/unit/services/gateway-refusals.spec.ts#admits a
      service principal invoking for its own application
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/unit/services/gateway-refusals.spec.ts#refuses a
      service principal naming another application, access_denied
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/unit/services/gateway-refusals.spec.ts#admits
      Platform’s own principal for any application
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/unit/services/gateway-refusals.spec.ts#admits a
      console caller holding the capability’s permission
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/unit/services/gateway-refusals.spec.ts#refuses a
      console caller without it
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/unit/services/gateway-refusals.spec.ts#answers each
      refusal with the status chapter 13 §5 gives it, through the dispatcher’s error table
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/unit/services/gateway-refusals.spec.ts#states the same
      status as the table the module declares
    provenance: test
  - source: >-
      services-platform:modules/integrations/tests/unit/services/gateway-refusals.spec.ts#carries its
      reason as the code, and its facts in the details
    provenance: test
dependency_evidence:
  provenance: test
  source: 'services-platform:modules/integrations/tests/unit/services/gateway-refusals.spec.ts'
  reviewed:
    - Suite introduction
    - Fixture setup
    - Client substitutions
    - Assertions and cleanup
---
# gateway refusals

## Verification Boundary

This unit suite exercises gateway refusals. Its registration records the executable definition; no run result is asserted.

## What This Suite Proves

The bindings identify the detailed outcomes asserted by this suite. Test-level evidence retains the individual checks, including cases where several suites contribute to one scenario.

## What It Does Not Prove

Pure cases do not establish database constraints, deployed authorization or provider effects.

## Real Dependencies and Test Doubles

The suite evaluates its imported functions with controlled inputs. Its source records the fixture and substitution boundary.

## Must Not Be Doubled

The function under test and its result checks must execute. Replacing them with expected answers provides no proof.