---
id: TST-PFM-MTD-078
title: files
kind: api-lifecycle
product_area: platform
module: metadata
revision: 1
status: draft
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
repository: services-platform
files:
  - modules/files/tests/e2e/files.e2e.spec.js
implements:
  - ATS-PFM-MTD-007-01
  - ATS-PFM-MTD-007-02
  - ATS-PFM-MTD-007-06
environment: local
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 5
isolation: >-
  Prepared integration database and the suite fixture records; fixture teardown restores or removes its own
  rows.
evidence:
  - 'services-platform:modules/files/tests/e2e/files.e2e.spec.js'
  - >-
    services-platform:modules/files/tests/e2e/files.e2e.spec.js#answers a PUT upload with the headers and the
    staging reference of this workspace
  - >-
    services-platform:modules/files/tests/e2e/files.e2e.spec.js#signs the uploader named by the verified
    token, not by anything in the body
  - >-
    services-platform:modules/files/tests/e2e/files.e2e.spec.js#refuses a body that names a workspace of its
    own
  - 'services-platform:modules/files/tests/e2e/files.e2e.spec.js#is given the upload and the row records it'
  - >-
    services-platform:modules/files/tests/e2e/files.e2e.spec.js#is refused a picture over the limit, naming
    the size, and nothing is issued
  - >-
    services-platform:modules/files/tests/e2e/files.e2e.spec.js#is refused an SVG picture by its type, and
    nothing is issued
  - >-
    services-platform:modules/files/tests/e2e/files.e2e.spec.js#is refused 403 by the dispatcher, and nothing
    is issued
  - >-
    services-platform:modules/files/tests/e2e/files.e2e.spec.js#is refused 401 without a signed context, and
    nothing is issued
  - 'services-platform:modules/files/tests/e2e/files.e2e.spec.js#is refused the tenant, and nothing is issued'
fixture_imports:
  - chai
  - drizzle-orm
  - ../../../../aws/api/platform-api-handler
  - ../../../../db/config
  - '@rhythmsoftware/macroservice-testing/integration-database'
  - '@rhythmsoftware/macroservice-testing/signed-context'
  - '@rhythmsoftware/macroservice-testing/stage'
  - '@rhythmsoftware/macroservice-execution/tenant-time-zones'
  - '@rhythmsoftware/macroservice-assets/asset-configuration'
  - ../../../tenants/services/persistence/tenants
  - ../../../../db/seeds/integration/seed
  - ../../../../aws/platform.service
  - ../../../security/db/security-audit-events.table
  - ../../aws/api/files.routes
  - ../../db/file-uploads.table
  - ../integration/support
  - ../../services/uploads/upload-storage
test_doubles:
  - Upload storage and signing seam.
limitations: []
unmatched_specification: null
binding_assertions:
  - scenario: ATS-PFM-MTD-007-01
    provenance: test
    source:
      - >-
        services-platform:modules/files/tests/e2e/files.e2e.spec.js#is refused 403 by the dispatcher, and
        nothing is issued
      - >-
        services-platform:modules/files/tests/e2e/files.e2e.spec.js#is refused 401 without a signed context,
        and nothing is issued
    note: >-
      These references identify the assertions this suite contributes; bindings to additional suites remain
      part of the scenario’s proof.
  - scenario: ATS-PFM-MTD-007-02
    provenance: test
    source:
      - >-
        services-platform:modules/files/tests/e2e/files.e2e.spec.js#refuses a body that names a workspace of
        its own
      - >-
        services-platform:modules/files/tests/e2e/files.e2e.spec.js#is refused the tenant, and nothing is
        issued
    note: >-
      These references identify the assertions this suite contributes; bindings to additional suites remain
      part of the scenario’s proof.
  - scenario: ATS-PFM-MTD-007-06
    provenance: test
    source:
      - >-
        services-platform:modules/files/tests/e2e/files.e2e.spec.js#signs the uploader named by the verified
        token, not by anything in the body
    note: >-
      These references identify the assertions this suite contributes; bindings to additional suites remain
      part of the scenario’s proof.
---

# Files

## Verification Boundary

This API suite checks upload issuance within the local test harness. The registered file and pinned revision define its boundary.

## What This Suite Proves

The bindings identify the detailed or feature scenarios whose outcomes have assertions in this suite. Original case references remain attached to the detailed scenarios so a reviewer can inspect the exact assertion. Assertions are evidence of implemented checks; no execution result is claimed.

## What It Does Not Prove

The register does not establish a current passing run or full specification conformance. Behavior outside the suite’s fixtures and assertions remains unverified.

## Real Dependencies and Test Doubles

The fixture uses PostgreSQL and the imported persistence or API code. Upload storage and signing seam.

## Must Not Be Doubled

The operation under examination and its asserted stored outcomes must remain real within the declared harness. A fixture cannot replace the write, refusal or transactional effect that the bound scenario checks.