--- id: TST-PFM-SEC-065 title: Security context request checks kind: api-lifecycle product_area: platform module: security revision: 2 status: draft source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 repository: services-platform files: - modules/security/tests/e2e/security-context.e2e.spec.js implements: - ATS-PFM-SEC-007-01 - ATS-PFM-SEC-007-02 - ATS-PFM-SEC-007-03 - ATS-PFM-SEC-007-06 - ATS-PFM-SEC-007-07 environment: local implementation_state: implemented latest_result: not-run latest_run_at: null latest_run_ref: null conformance: not-verified estimated_minutes: 5 isolation: Use the prepared test database and suite-owned fixture rows; retain shared seed records. assertion_evidence: - provenance: test source: >- services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#security context API (end to end) - provenance: test source: >- services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#GET /security/me/context - provenance: test source: >- services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#answers the caller, their organization and the tenants they reach, with the default tenant evaluated - provenance: test source: >- services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#answers every key the database says Read Only allows, not only the key the signed slice was resolved for - provenance: test source: >- services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#answers the application that follows from those keys - provenance: test source: >- services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#answers beside it an application no permission could be held of, which the tenant alone decides - provenance: test source: >- services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#answers an empty feature list, which no entitlement fills yet - provenance: test source: >- services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#tells every cache not to keep a document about who the caller is - provenance: test source: >- services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#exposes no linked contact for a console user: `cid` is a portal claim, and the document carries none - provenance: test source: >- services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#evaluates the tenant the query names, when the caller reaches it - provenance: test source: >- services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#ignores a preferred tenant out of the caller's reach rather than refusing it - provenance: test source: >- services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#refuses the same tenant named strictly by tenant_id, the console URL never falling back - provenance: test source: >- services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#evaluates a preferred tenant the caller reaches - provenance: test source: >- services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#refuses an anonymous caller, and says so with the header still on the refusal - provenance: test source: >- services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#answers a caller whose administrative grant the signed slice does not carry - provenance: test source: >- services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#a caller nobody has granted anything - provenance: test source: >- services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#is refused 403 under the code the console reads as no access - provenance: test source: >- services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#tells every cache not to keep that refusal either - provenance: test source: >- services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#refuses a suspended user, whose slice carries no grant of reading themselves at all - provenance: test source: >- services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#answers the user the signed context names and no other, so one person can never read another’s document - provenance: test source: >- services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#GET /security/{tenantId}/me/context - provenance: test source: >- services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#evaluates the tenant the path names, which is the tenant switch - provenance: test source: >- services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#refuses a tenant outside the caller's claim at the front door, as every tenant route does - provenance: test source: >- services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#refuses an anonymous caller - provenance: test source: >- services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#refuses the caller nobody has granted anything here too, under the same code as the default route - provenance: test source: >- services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#tells every cache not to keep the answer of the tenant switch either - provenance: test source: >- services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#GET /security/{tenantId}/me/applications - provenance: test source: >- services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#answers the applications the caller may use and the features they hold, and nothing else - provenance: test source: >- services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#answers among those applications the one the caller’s own keys reach - provenance: test source: >- services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#answers exactly what the context says, so a refreshing console is never told something new - provenance: test source: >- services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#tells every cache not to keep it, as the documents beside it do - provenance: test source: >- services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#refuses an anonymous caller - provenance: test source: >- services-platform:modules/security/tests/e2e/security-context.e2e.spec.js#refuses a tenant outside the caller's claim at the front door, as every tenant route does dependency_evidence: >- The local request harness exercises the route dispatcher and the prepared database. The file declares no substituted collaborators. evidence: - 'services-platform:modules/security/tests/e2e/security-context.e2e.spec.js' - >- Static review at the recorded source revision; executable results remain not-run and conformance remains not-verified. binding_note: >- Each binding names the scenario to which this file contributes assertions. A binding is not a recorded pass and does not extend the file’s dependency boundary. examiner: codex examined_at: '2026-10-23' final_text: OpenAI dependency_review: provenance: test source: 'services-platform:modules/security/tests/e2e/security-context.e2e.spec.js' explicit_no_doubles: true identified_double_boundaries: [] --- # Security context request checks ## Verification Boundary The file exercises public request handling through the local service harness. The assertion references identify the source checks for security context. ## What This Suite Proves The source assertions support the observations named in the bound scenarios. A scenario spanning multiple files must retain the other files’ contributions. ## What It Does Not Prove This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence. ## Real Dependencies and Test Doubles The local request harness exercises the route dispatcher and the prepared database. The file declares no substituted collaborators. ## Must Not Be Doubled Keep route dispatch, signed-context verification and the exercised service decisions real. A test key can supply signatures, but replacing the authorization decision cannot prove request enforcement.