--- id: TST-PFM-QRY-417 title: Platform quick search access kind: api-lifecycle product_area: platform module: queries revision: 1 status: draft source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 rhythm-v2-docs: 99376625d3e7ac26936413cfc31a88fba6562464 repository: services-platform files: - modules/quick-search/tests/e2e/quick-search-access.e2e.spec.js implements: - ATS-PFM-QRY-016-01 - ATS-PFM-QRY-016-02 - ATS-PFM-QRY-016-03 - ATS-PFM-QRY-016-04 - ATS-PFM-QRY-016-05 - ATS-PFM-QRY-016-06 - ATS-PFM-QRY-016-07 environment: local implementation_state: implemented latest_result: not-run latest_run_at: null latest_run_ref: null conformance: not-verified estimated_minutes: 5 isolation: 'The suite’s database fixtures, controlled execution contexts and file-owned external dependency seams.' evidence: - 'services-platform:modules/quick-search/tests/e2e/quick-search-access.e2e.spec.js' assertion_bindings: - scenario: ATS-PFM-QRY-016-01 source: - >- services-platform:modules/quick-search/tests/e2e/quick-search-access.e2e.spec.js#refuses the whole request rather than granting what it can - >- services-platform:modules/quick-search/tests/e2e/quick-search-access.e2e.spec.js#names the first record type it was refused for - >- services-platform:modules/quick-search/tests/e2e/quick-search-access.e2e.spec.js#provisioned nothing: a refused request leaves the tenant exactly as it found it - >- services-platform:modules/quick-search/tests/e2e/quick-search-access.e2e.spec.js#refuses a caller without the lookup permission, at the dispatcher and before the handler scope: assertions cited by the scenario provenance: test - scenario: ATS-PFM-QRY-016-02 source: - >- services-platform:modules/quick-search/tests/e2e/quick-search-access.e2e.spec.js#grants organizations to a holder of contacts read, which is the registry’s deliberate mapping (plan §5.2) - >- services-platform:modules/quick-search/tests/e2e/quick-search-access.e2e.spec.js#refuses a caller holding organizations read, which is not what organizations are gated by scope: assertions cited by the scenario provenance: test - scenario: ATS-PFM-QRY-016-03 source: - >- services-platform:modules/quick-search/tests/e2e/quick-search-access.e2e.spec.js#is a key of its own, not one of the environment’s - >- services-platform:modules/quick-search/tests/e2e/quick-search-access.e2e.spec.js#is signed, which is what makes its restrictions unalterable by the browser - >- services-platform:modules/quick-search/tests/e2e/quick-search-access.e2e.spec.js#holds the tenant, the live state and the one record type asked for, as one filter the browser can only narrow - >- services-platform:modules/quick-search/tests/e2e/quick-search-access.e2e.spec.js#does not name the record type that was not asked for, so an unrequested type is unreachable with this key - >- services-platform:modules/quick-search/tests/e2e/quick-search-access.e2e.spec.js#expires fifteen minutes after it was issued, inside the key as well as in the response scope: assertions cited by the scenario provenance: test - scenario: ATS-PFM-QRY-016-04 source: - >- services-platform:modules/quick-search/tests/e2e/quick-search-access.e2e.spec.js#bakes in no discoverability at all, which is what leaves the browser able to widen status and nothing else scope: contributing assertions; the scenario combines multiple files provenance: test - scenario: ATS-PFM-QRY-016-05 source: - >- services-platform:modules/quick-search/tests/e2e/quick-search-access.e2e.spec.js#provisioned the record type the tenant had never searched - >- services-platform:modules/quick-search/tests/e2e/quick-search-access.e2e.spec.js#reports each granted type as populating, because nothing has indexed it yet - >- services-platform:modules/quick-search/tests/e2e/quick-search-access.e2e.spec.js#provisions nothing a second time: searching again spends no version scope: assertions cited by the scenario provenance: test - scenario: ATS-PFM-QRY-016-06 source: - >- services-platform:modules/quick-search/tests/e2e/quick-search-access.e2e.spec.js#refuses a record type the registry does not declare, naming the ones there are - >- services-platform:modules/quick-search/tests/e2e/quick-search-access.e2e.spec.js#refuses an empty list, which would be a key that reaches nothing - >- services-platform:modules/quick-search/tests/e2e/quick-search-access.e2e.spec.js#refuses the same record type twice - >- services-platform:modules/quick-search/tests/e2e/quick-search-access.e2e.spec.js#refuses more record types than the registry holds scope: assertions cited by the scenario provenance: test - scenario: ATS-PFM-QRY-016-07 source: - >- services-platform:modules/quick-search/tests/e2e/quick-search-access.e2e.spec.js#answers 409, so the console hides the search box rather than showing an error - >- services-platform:modules/quick-search/tests/e2e/quick-search-access.e2e.spec.js#names no secret, no variable and no key in the refusal the caller sees scope: assertions cited by the scenario provenance: test fixture_seams: [] --- # Platform quick search access ## Verification Boundary The file dispatches requests through the real route table and signed execution contexts against its local fixtures. ## What This Suite Proves Its assertions check quick search access. The assertion bindings identify the corresponding acceptance examples and retain their original test-title citations. ## What It Does Not Prove Local execution does not establish deployed queue scheduling, every external provider response or a passing result at the pinned revision. ## Real Dependencies and Test Doubles The integration fixture and any imported dependency seams define the environment. Database-oriented checks use PostgreSQL; file-owned transport, clock, provider or worker seams isolate the explicitly controlled boundary. ## Must Not Be Doubled Keep the dispatcher, route requirements and the handler behavior named by the assertions real. Review any new substitutions before treating the same acceptance bindings as unchanged.