--- id: ATS-PFM-QRY-002 scope: CAP-PFM-QRY-002 product_area: platform module: queries revision: 2 status: proposed approved_by: null approved_at: null source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f rhythm-v2-docs: 99376625d3e7ac26936413cfc31a88fba6562464 scenarios: - id: ATS-PFM-QRY-002-01 title: Database confinement survives missing predicates level: api proves: - BR-CAP-PFM-QRY-002-01 - INV-DOM-PFM-QRY-001-02 preconditions: Separate workspaces contain records with matching identities. steps: Execute related-record queries in both and an unpredicated reader statement. expected: 'Each execution remains within its workspace, including the database-only confinement case.' negative: false data_needs: Use the existing binding’s controlled fixture data. bound_to: - >- services-platform:modules/queries/tests/integration/services/execute/run-query.integration.spec.js#answers no row, pick or joined value belonging to another tenant, though the ids are the same - >- services-platform:modules/queries/tests/integration/services/execute/run-query.integration.spec.js#answers the other tenant exactly its own rows, picks and joins - >- services-platform:modules/queries/tests/integration/services/execute/run-query.integration.spec.js#confines a statement carrying no tenant predicate at all, so row-level security holds beneath the compiler - TST-PFM-QRY-296 provenance: test source: >- services-platform:modules/queries/tests/integration/services/execute/run-query.integration.spec.js#answers no row, pick or joined value belonging to another tenant, though the ids are the same category: invariant - id: ATS-PFM-QRY-002-02 title: Reader execution refuses writes and bounds failure level: api proves: - BR-CAP-PFM-QRY-002-02 preconditions: A query reader session is available. steps: 'Attempt a write, exceed its time limit and provoke another database failure.' expected: Writes fail; timeouts are actionable; other failure output and logs omit statements and values. negative: true data_needs: Use the existing binding’s controlled fixture data. bound_to: - >- services-platform:modules/queries/tests/integration/services/execute/read-only-execution.integration.spec.js#refuses a write, whatever the statement carries, because the transaction is read-only - >- services-platform:modules/queries/tests/integration/services/execute/read-only-execution.integration.spec.js#stops a statement that outlasts the statement timeout, and lets a quick one through under the same timeout - >- services-platform:modules/queries/tests/integration/services/execute/read-only-execution.integration.spec.js#answers a timeout as a request limit the caller can act on, naming no SQL - >- services-platform:modules/queries/tests/integration/services/execute/read-only-execution.integration.spec.js#answers any other failure with a generic server error, never the statement, its tables or a criterion value, and logs neither - TST-PFM-QRY-289 provenance: test source: >- services-platform:modules/queries/tests/integration/services/execute/read-only-execution.integration.spec.js#refuses a write, whatever the statement carries, because the transaction is read-only category: failure - id: ATS-PFM-QRY-002-03 title: Invalid metadata does not disclose hidden fields level: api proves: - BR-CAP-PFM-QRY-002-03 preconditions: Contacts has both an unregistered and a nonexistent field name. steps: Query each field and an unsupported operator. expected: Field refusals have equivalent wording and operator errors identify the invalid use. negative: true data_needs: Use the existing binding’s controlled fixture data. bound_to: - >- services-platform:modules/queries/tests/integration/services/execute/run-query.integration.spec.js#refuses a column no owner registered exactly as it refuses one that does not exist at all - >- services-platform:modules/queries/tests/integration/services/execute/run-query.integration.spec.js#refuses an operator the field type does not support, naming both - TST-PFM-QRY-296 provenance: test source: >- services-platform:modules/queries/tests/integration/services/execute/run-query.integration.spec.js#refuses a column no owner registered exactly as it refuses one that does not exist at all category: validation - id: ATS-PFM-QRY-002-04 title: Malformed values fail before matching level: api proves: - BR-CAP-PFM-QRY-002-04 preconditions: The contact dataset is accessible. steps: 'Submit blank text, empty identity lists, fractional integers, unsafe numbers and malformed dates.' expected: Every invalid criterion is refused with 400. negative: true data_needs: Use the existing binding’s controlled fixture data. bound_to: - >- services-platform:modules/queries/tests/integration/services/execute/run-query.integration.spec.js#refuses a blank text value, which would match every contact rather than narrow anything - >- services-platform:modules/queries/tests/integration/services/execute/run-query.integration.spec.js#refuses an empty list of ids, which would exclude or admit every contact - >- services-platform:modules/queries/tests/integration/services/execute/run-query.integration.spec.js#refuses a fractional value where an integer field is compared - >- services-platform:modules/queries/tests/integration/services/execute/run-query.integration.spec.js#refuses a whole number JavaScript cannot hold exactly, rather than comparing a rounded one - >- services-platform:modules/queries/tests/integration/services/execute/run-query.integration.spec.js#refuses a date written in any form but YYYY-MM-DD - TST-PFM-QRY-296 provenance: test source: >- services-platform:modules/queries/tests/integration/services/execute/run-query.integration.spec.js#refuses a blank text value, which would match every contact rather than narrow anything category: validation - id: ATS-PFM-QRY-002-05 title: Cursors retain their original question level: api proves: - BR-CAP-PFM-QRY-002-05 preconditions: An ordered result spans multiple pages. steps: 'Page normally, then submit foreign, malformed and wrong-key-count cursors.' expected: Valid pages follow the ordered result; invalid cursors are rejected. negative: true data_needs: Use the existing binding’s controlled fixture data. bound_to: - >- services-platform:modules/queries/tests/integration/services/execute/run-query.integration.spec.js#pages a text sort ascending exactly as the unpaged query ordered it, ties included - >- services-platform:modules/queries/tests/integration/services/execute/run-query.integration.spec.js#refuses a cursor issued for a different query, rather than paging the wrong rows - >- services-platform:modules/queries/tests/integration/services/execute/run-query.integration.spec.js#refuses a cursor that is not a cursor at all, rather than reading it as a page of nothing - >- services-platform:modules/queries/tests/integration/services/execute/run-query.integration.spec.js#refuses a cursor of this query carrying the wrong number of keys, which could not place a row in the order - TST-PFM-QRY-296 provenance: test source: >- services-platform:modules/queries/tests/integration/services/execute/run-query.integration.spec.js#pages a text sort ascending exactly as the unpaged query ordered it, ties included category: validation - id: ATS-PFM-QRY-002-06 title: Totals ignore cursor narrowing and join multiplication level: api proves: - BR-CAP-PFM-QRY-002-06 preconditions: Fixtures span pages and include records with absent related records. steps: 'Request totals across pages, grouped and joined queries, then omit totals.' expected: Counts remain complete for the requested grain and disappear when unrequested. negative: false data_needs: Use the existing binding’s controlled fixture data. bound_to: - >- services-platform:modules/queries/tests/integration/services/execute/query-totals.integration.spec.js#answers the same total on a page read with a cursor as on the first, the cursor narrowing nothing - >- services-platform:modules/queries/tests/integration/services/execute/query-totals.integration.spec.js#counts the groups of a grouped query, not the records behind them - >- services-platform:modules/queries/tests/integration/services/execute/query-totals.integration.spec.js#counts the base records, not the rows the joins produced - >- services-platform:modules/queries/tests/integration/services/execute/query-totals.integration.spec.js#carries no total property, rather than a null one, when none was asked for - TST-PFM-QRY-287 provenance: test source: >- services-platform:modules/queries/tests/integration/services/execute/query-totals.integration.spec.js#answers the same total on a page read with a cursor as on the first, the cursor narrowing nothing category: rule - id: ATS-PFM-QRY-002-07 title: Recent views remain personal and local level: api proves: - BR-CAP-PFM-QRY-002-07 preconditions: Two people and two workspaces have different view histories. steps: Execute Recently Viewed under each identity and under a system context. expected: Each person receives their own deduplicated latest views; the system context is refused. negative: true data_needs: Use the existing binding’s controlled fixture data. bound_to: - >- services-platform:modules/queries/tests/integration/services/execute/recently-viewed-scope.integration.spec.js#answers each caller the records that caller viewed, and no other caller’s - >- services-platform:modules/queries/tests/integration/services/execute/recently-viewed-scope.integration.spec.js#answers one row per record however many times it was viewed, the latest view being the one it carries - >- services-platform:modules/queries/tests/integration/services/execute/recently-viewed-scope.integration.spec.js#answers, in another tenant, that tenant’s own record of the same id, never the one I viewed here - >- services-platform:modules/queries/tests/integration/services/execute/recently-viewed-scope.integration.spec.js#refuses an execution the macroservice itself makes, which is nobody in particular - TST-PFM-QRY-290 provenance: test source: >- services-platform:modules/queries/tests/integration/services/execute/recently-viewed-scope.integration.spec.js#answers each caller the records that caller viewed, and no other caller’s category: edge - id: ATS-PFM-QRY-002-08 title: Personal criteria require meaningful identities level: api proves: - BR-CAP-PFM-QRY-002-08 preconditions: Two users own different tasks and another field holds no user identity. steps: 'Evaluate the current-person value for each user and under invalid fields, operators or a system context.' expected: Users receive their own tasks; the invalid uses are refused. negative: true data_needs: Use the existing binding’s controlled fixture data. bound_to: - >- services-platform:modules/queries/tests/integration/services/execute/current-user-criterion.integration.spec.js#answers the caller their own tasks, with their own id in the row - >- services-platform:modules/queries/tests/integration/services/execute/current-user-criterion.integration.spec.js#answers a second caller their own tasks, from the very same criterion - >- services-platform:modules/queries/tests/integration/services/execute/current-user-criterion.integration.spec.js#refuses the token on a field whose owner does not say it holds a user, naming the field - >- services-platform:modules/queries/tests/integration/services/execute/current-user-criterion.integration.spec.js#refuses the token under an operator that compares no user, naming the operator - >- services-platform:modules/queries/tests/integration/services/execute/current-user-criterion.integration.spec.js#refuses an execution that is nobody in particular, rather than answering it nothing - TST-PFM-QRY-270 provenance: test source: >- services-platform:modules/queries/tests/integration/services/execute/current-user-criterion.integration.spec.js#answers the caller their own tasks, with their own id in the row category: permission - id: ATS-PFM-QRY-002-09 title: Validation reports run-time tokens without execution level: api proves: - BR-CAP-PFM-QRY-002-09 preconditions: An unsaved definition contains a requested-at-run value. steps: Submit the definition for validation. expected: 'The response is successful but invalid, locating the value problem without running the query.' negative: true data_needs: Use the existing binding’s controlled fixture data. bound_to: - >- services-platform:modules/queries/tests/e2e/saved-queries.e2e.spec.js#refuses a token sent to the validate route, which judges a request on its own - TST-PFM-QRY-234 provenance: test source: >- services-platform:modules/queries/tests/e2e/saved-queries.e2e.spec.js#refuses a token sent to the validate route, which judges a request on its own category: validation - id: ATS-PFM-QRY-002-10 title: Date matching uses the workspace calendar level: api proves: - BR-CAP-PFM-QRY-002-10 preconditions: The workspace time zone differs substantially from UTC. steps: 'Query a day, a preceding-day boundary and a relative range, then preview dates.' expected: Matching and previews follow the workspace zone rather than caller preferences. negative: false data_needs: Use the existing binding’s controlled fixture data. bound_to: - >- services-platform:modules/queries/tests/integration/services/execute/run-query.integration.spec.js#reads a day as that day in the tenant's zone, not in UTC - >- services-platform:modules/queries/tests/integration/services/execute/run-query.integration.spec.js#counts a relative range back from today in the tenant's zone - >- services-platform:modules/queries/tests/e2e/date-expressions.e2e.spec.js#answers the zone of the tenant in the path, not of the one the caller happens to prefer - TST-PFM-QRY-296 - TST-PFM-QRY-226 provenance: test source: >- services-platform:modules/queries/tests/integration/services/execute/run-query.integration.spec.js#reads a day as that day in the tenant's zone, not in UTC category: boundary binding_note: >- The cited suites contribute separate assertions. The complete combined example is not a single executable journey. - id: ATS-PFM-QRY-002-11 title: Validation supplies repair locations level: api proves: - BR-CAP-PFM-QRY-002-11 preconditions: A definition contains an unsupported field or criterion. steps: Request validation of the definition. expected: A successful validation response lists located problems and executes no question. negative: true data_needs: Use the existing binding’s controlled fixture data. bound_to: - >- services-platform:modules/queries/tests/e2e/saved-queries.e2e.spec.js#answers 200 and the problems for a query it will not run, rather than a refusal - >- services-platform:modules/queries/tests/e2e/saved-queries.e2e.spec.js#names the control the person used for a criterion the dataset will not accept - TST-PFM-QRY-234 provenance: test source: >- services-platform:modules/queries/tests/e2e/saved-queries.e2e.spec.js#answers 200 and the problems for a query it will not run, rather than a refusal category: validation - id: ATS-PFM-QRY-002-12 title: Result links refer to represented records level: api proves: - BR-CAP-PFM-QRY-002-12 preconditions: A contact question selects its number and name. steps: 'Execute it, then request an opening override for an absent record slot.' expected: The result supplies record identities; the invalid override returns 400. negative: true data_needs: Use the existing binding’s controlled fixture data. bound_to: - >- services-platform:modules/queries/tests/e2e/datasets.e2e.spec.js#names the record the number and the name open, and the id of each row’s, beside the rows - >- services-platform:modules/queries/tests/e2e/datasets.e2e.spec.js#refuses a link override naming a record the result does not have as 400 QueryLinkInvalid - TST-PFM-QRY-225 provenance: test source: >- services-platform:modules/queries/tests/e2e/datasets.e2e.spec.js#names the record the number and the name open, and the id of each row’s, beside the rows category: rule - id: ATS-PFM-QRY-002-13 title: Reference display and identity remain separate level: api proves: - BR-CAP-PFM-QRY-002-13 preconditions: 'Contacts include named, nameless and absent spouse references.' steps: Select spouse display values and an explicit spouse identity column. expected: 'Display uses names, identity fallback or null, with selected identities in their separate column.' negative: false data_needs: Use the existing binding’s controlled fixture data. bound_to: - >- services-platform:modules/queries/tests/integration/services/execute/reference-display-values.integration.spec.js#shows each spouse’s name, the id as text where the spouse has no name, and null where there is no spouse - >- services-platform:modules/queries/tests/integration/services/execute/reference-display-values.integration.spec.js#answers the spouse’s name and the spouse’s id as two columns - TST-PFM-QRY-293 provenance: test source: >- services-platform:modules/queries/tests/integration/services/execute/reference-display-values.integration.spec.js#shows each spouse’s name, the id as text where the spouse has no name, and null where there is no spouse category: edge - id: ATS-PFM-QRY-002-14 title: Reference traversal rejects another hop level: api proves: - BR-CAP-PFM-QRY-002-14 preconditions: Contacts refer to organizations with their own parent reference. steps: Read the employer name and then traverse through that employer’s reference. expected: The first read works and the second is refused. negative: true data_needs: Use the existing binding’s controlled fixture data. bound_to: - >- services-platform:modules/queries/tests/integration/services/execute/run-query.integration.spec.js#refuses a second hop through the referenced record's own reference - TST-PFM-QRY-296 provenance: test source: >- services-platform:modules/queries/tests/integration/services/execute/run-query.integration.spec.js#refuses a second hop through the referenced record's own reference category: boundary - id: ATS-PFM-QRY-002-15 title: Published bounds need explicit refusal proof level: api proves: - BR-CAP-PFM-QRY-002-15 preconditions: An accessible contact dataset is available. steps: 'Try 256 fields, six sorts, depth seven, three hops and a 1,001-row page, plus boundary-valid controls.' expected: >- The proposed proof requires located bound refusals and valid boundary execution; implementation alignment remains open. negative: true data_needs: Prepare isolated fixtures for the states described here. bound_to: [] provenance: proposed source: 'services-platform:docs/queries/semantic-query-layer.md#10.6 Complexity limits (first release)' category: boundary - id: ATS-PFM-QRY-002-16 title: Group calculations retain values and types level: api proves: - BR-CAP-PFM-QRY-002-16 preconditions: 'Three contacts share a group and have known number, date and custom-field values.' steps: 'Run a grouped query with sum, average, minimum and maximum columns, including an entirely absent field.' expected: The group returns the calculated values and column types; the absent field’s aggregate is null. negative: false data_needs: Use the grouped-calculation suite’s contact and metadata fixtures. bound_to: - >- services-platform:modules/queries/tests/integration/services/execute/query-aggregates.integration.spec.js#answers one group for the three contacts, every aggregate computed over exactly those rows - >- services-platform:modules/queries/tests/integration/services/execute/query-aggregates.integration.spec.js#answers null for an aggregate of a field no row in the group has a value for - >- services-platform:modules/queries/tests/integration/services/execute/query-aggregates.integration.spec.js#describes each aggregate column with the label the console shows by default and the type its result has - TST-PFM-QRY-286 provenance: test source: >- services-platform:modules/queries/tests/integration/services/execute/query-aggregates.integration.spec.js#answers one group for the three contacts, every aggregate computed over exactly those rows category: rule - id: ATS-PFM-QRY-002-17 title: A discovery suggestion does not hide inactive records category: interaction level: api exercises: - CAP-PFM-QRY-001 - CAP-PFM-QRY-002 proves: - BR-CAP-PFM-QRY-001-08 - BR-CAP-PFM-QRY-002-01 preconditions: Contacts includes active and inactive records; the description suggests active records. steps: 'Read the description, then run an unfiltered contact question and a question selecting inactive records.' expected: The first answer contains both statuses and the second contains only the inactive fixture. negative: false data_needs: >- Use an isolated workspace with the described source records, access grants and a surviving control workspace. bound_to: [] provenance: proposed source: - >- services-platform:modules/queries/tests/e2e/datasets.e2e.spec.js#refuses a dataset the caller holds no query permission for as 403 - >- services-platform:modules/queries/tests/integration/services/execute/current-user-criterion.integration.spec.js#answers a second caller their own tasks, from the very same criterion - id: ATS-PFM-QRY-002-18 title: Invalid questions never enter the reusable library category: interaction level: api exercises: - CAP-PFM-QRY-002 - CAP-PFM-QRY-006 proves: - BR-CAP-PFM-QRY-002-11 - BR-CAP-PFM-QRY-006-10 preconditions: A contact draft selects a field not offered by its description. steps: Validate the draft and attempt to save the same definition. expected: Validation locates the bad selection and the save creates no library entry. negative: false data_needs: >- Use an isolated workspace with the described source records, access grants and a surviving control workspace. bound_to: [] provenance: proposed source: - >- services-platform:modules/queries/tests/integration/services/execute/run-query.integration.spec.js#refuses a column no owner registered exactly as it refuses one that does not exist at all - >- services-platform:modules/queries/tests/e2e/saved-queries.e2e.spec.js#refuses a body whose definition cannot be run as written as 400 - id: ATS-PFM-QRY-002-19 title: A file contains the ordered answer beyond the first page category: interaction level: api exercises: - CAP-PFM-QRY-002 - CAP-PFM-QRY-014 proves: - BR-CAP-PFM-QRY-002-01 - BR-CAP-PFM-QRY-014-03 preconditions: 'A contact question spans more than one page, with duplicate sort values and a foreign workspace control.' steps: Run the first page and export the same on-screen definition. expected: >- The file matches the complete ordered local answer; later pages occur once and foreign records never appear. negative: false data_needs: >- Use an isolated workspace with the described source records, access grants and a surviving control workspace. bound_to: [] provenance: proposed source: - >- services-platform:modules/queries/tests/integration/services/execute/run-query.integration.spec.js#confines a statement carrying no tenant predicate at all, so row-level security holds beneath the compiler - >- services-platform:modules/queries/tests/integration/services/exports/run-query-export.integration.spec.js#writes every planted row exactly once, in the query’s sort, with no gap evidence: - 'Pinned reference: services-platform:docs/queries/semantic-query-layer.md' - 'Pinned reference: services-platform:modules/queries/tests/e2e/datasets.e2e.spec.js' - 'Pinned reference: services-platform:modules/queries/tests/e2e/date-expressions.e2e.spec.js' - 'Pinned reference: services-platform:modules/queries/tests/e2e/saved-queries.e2e.spec.js' - >- Pinned reference: services-platform:modules/queries/tests/integration/services/execute/current-user-criterion.integration.spec.js - >- Pinned reference: services-platform:modules/queries/tests/integration/services/execute/query-aggregates.integration.spec.js - >- Pinned reference: services-platform:modules/queries/tests/integration/services/execute/query-totals.integration.spec.js - >- Pinned reference: services-platform:modules/queries/tests/integration/services/execute/read-only-execution.integration.spec.js - >- Pinned reference: services-platform:modules/queries/tests/integration/services/execute/recently-viewed-scope.integration.spec.js - >- Pinned reference: services-platform:modules/queries/tests/integration/services/execute/reference-display-values.integration.spec.js - >- Pinned reference: services-platform:modules/queries/tests/integration/services/execute/run-query.integration.spec.js coverage_notes: transition: >- This capability has no formal lifecycle of its own. Audience and definition changes remain rule, permission and concurrency proofs; related lifecycles are exercised through interaction scenarios. coverage: rule: covered transition: not-applicable validation: covered permission: covered edge: covered failure: covered boundary: covered concurrency: 'gap: FND-PFM-QRY-052' invariant: covered interaction: covered coverage_findings: - FND-PFM-QRY-052 transition_obligations: [] unproved_rules: [] --- # Answer a question within the reader’s access: Capability Test Specification ## Coverage | Rule | Scenario or Finding | |---|---| | `BR-CAP-PFM-QRY-002-01` | `ATS-PFM-QRY-002-01`, `ATS-PFM-QRY-002-19` | | `BR-CAP-PFM-QRY-002-02` | `ATS-PFM-QRY-002-02` | | `BR-CAP-PFM-QRY-002-03` | `ATS-PFM-QRY-002-03`, `ATS-PFM-QRY-002-18` | | `BR-CAP-PFM-QRY-002-04` | `ATS-PFM-QRY-002-04` | | `BR-CAP-PFM-QRY-002-05` | `ATS-PFM-QRY-002-05` | | `BR-CAP-PFM-QRY-002-06` | `ATS-PFM-QRY-002-06` | | `BR-CAP-PFM-QRY-002-07` | `ATS-PFM-QRY-002-07` | | `BR-CAP-PFM-QRY-002-08` | `ATS-PFM-QRY-002-08`, `ATS-PFM-QRY-002-17` | | `BR-CAP-PFM-QRY-002-09` | `ATS-PFM-QRY-002-09` | | `BR-CAP-PFM-QRY-002-10` | `ATS-PFM-QRY-002-10` | | `BR-CAP-PFM-QRY-002-11` | `ATS-PFM-QRY-002-11` | | `BR-CAP-PFM-QRY-002-12` | `ATS-PFM-QRY-002-12` | | `BR-CAP-PFM-QRY-002-13` | `ATS-PFM-QRY-002-13` | | `BR-CAP-PFM-QRY-002-14` | `ATS-PFM-QRY-002-14` | | `BR-CAP-PFM-QRY-002-15` | `ATS-PFM-QRY-002-15` | | `BR-CAP-PFM-QRY-002-16` | `ATS-PFM-QRY-002-16` | ## Interactions With Related Capabilities The combined examples change a source, its audience or its retained state before checking the dependent outcome. Unbound examples remain proposed, and the coverage finding retains design obligations that these examples do not establish. | Related Capability | Scenario | |---|---| | `CAP-PFM-QRY-001` | `ATS-PFM-QRY-002-17` | | `CAP-PFM-QRY-006` | `ATS-PFM-QRY-002-18` | | `CAP-PFM-QRY-014` | `ATS-PFM-QRY-002-19` | ## Evidence and Binding Limits The source revisions pin the inspected assertions. A test binding identifies written assertions, and does not establish a successful run or approval of the expected behavior.