--- id: TST-PFM-SEC-068 title: User names request checks kind: api-lifecycle product_area: platform module: security revision: 2 status: draft source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 repository: services-platform files: - modules/security/tests/e2e/user-names.e2e.spec.js implements: - ATS-PFM-SEC-007-11 environment: local implementation_state: implemented latest_result: not-run latest_run_at: null latest_run_ref: null conformance: not-verified estimated_minutes: 5 isolation: Use the prepared test database and suite-owned fixture rows; retain shared seed records. assertion_evidence: - provenance: test source: >- services-platform:modules/security/tests/e2e/user-names.e2e.spec.js#the tenant user-names route (end to end) - provenance: test source: >- services-platform:modules/security/tests/e2e/user-names.e2e.spec.js#a console administrator of the tenant's customer - provenance: test source: >- services-platform:modules/security/tests/e2e/user-names.e2e.spec.js#names its customer's own console users, its portal users of this tenant and of a sibling tenant, and Rhythm's staff - provenance: test source: >- services-platform:modules/security/tests/e2e/user-names.e2e.spec.js#leaves out another customer's user and an id that names nobody, rather than nulling or refusing them - provenance: test source: >- services-platform:modules/security/tests/e2e/user-names.e2e.spec.js#carries the id, the display name and the avatar of each person, and nothing else about anybody - provenance: test source: >- services-platform:modules/security/tests/e2e/user-names.e2e.spec.js#answers a name for every person it names, and the avatar as a string or null - provenance: test source: >- services-platform:modules/security/tests/e2e/user-names.e2e.spec.js#answers the body it answers and no other property beside the people - provenance: test source: >- services-platform:modules/security/tests/e2e/user-names.e2e.spec.js#a member of Rhythm’s staff acting in the tenant through a grant - provenance: test source: >- services-platform:modules/security/tests/e2e/user-names.e2e.spec.js#is admitted by the grant and named the tenant customer's console users, its portal users and Rhythm's staff - provenance: test source: >- services-platform:modules/security/tests/e2e/user-names.e2e.spec.js#is named nobody of another customer, which its own staff standing does not widen - provenance: test source: 'services-platform:modules/security/tests/e2e/user-names.e2e.spec.js#a portal caller' - provenance: test source: >- services-platform:modules/security/tests/e2e/user-names.e2e.spec.js#is refused by the access tier, because the route is console - provenance: test source: >- services-platform:modules/security/tests/e2e/user-names.e2e.spec.js#the ids the request may ask about - provenance: test source: >- services-platform:modules/security/tests/e2e/user-names.e2e.spec.js#refuses a request naming more than the hundred people it takes, rather than answering the first of them - provenance: test source: >- services-platform:modules/security/tests/e2e/user-names.e2e.spec.js#answers a request naming exactly the hundred it takes, which is the premise of the refusal above - provenance: test source: >- services-platform:modules/security/tests/e2e/user-names.e2e.spec.js#refuses a malformed id, as every other id parameter does - provenance: test source: >- services-platform:modules/security/tests/e2e/user-names.e2e.spec.js#refuses a request naming nobody at all - provenance: test source: >- services-platform:modules/security/tests/e2e/user-names.e2e.spec.js#collapses an id named twice into one answer - provenance: test source: >- services-platform:modules/security/tests/e2e/user-names.e2e.spec.js#a tenant the caller does not reach - provenance: test source: >- services-platform:modules/security/tests/e2e/user-names.e2e.spec.js#is refused at the front door, never answered about its people - provenance: test source: >- services-platform:modules/security/tests/e2e/user-names.e2e.spec.js#refuses an anonymous caller outright dependency_evidence: >- The local request harness exercises the route dispatcher and the prepared database. The suite controls the signing key at the declared seams; those collaborators remain outside its live proof. evidence: - 'services-platform:modules/security/tests/e2e/user-names.e2e.spec.js' - >- Static review at the recorded source revision; executable results remain not-run and conformance remains not-verified. binding_note: >- Each binding names the scenario to which this file contributes assertions. A binding is not a recorded pass and does not extend the file’s dependency boundary. examiner: codex examined_at: '2026-10-23' final_text: OpenAI dependency_review: provenance: test source: 'services-platform:modules/security/tests/e2e/user-names.e2e.spec.js' explicit_no_doubles: false identified_double_boundaries: - the signing key --- # User names request checks ## Verification Boundary The file exercises public request handling through the local service harness. The assertion references identify the source checks for user names. ## What This Suite Proves The source assertions support the observations named in the bound scenarios. A scenario spanning multiple files must retain the other files’ contributions. ## What It Does Not Prove This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence. ## Real Dependencies and Test Doubles The local request harness exercises the route dispatcher and the prepared database. The suite controls the signing key at the declared seams; those collaborators remain outside its live proof. ## Must Not Be Doubled Keep route dispatch, signed-context verification and the exercised service decisions real. A test key can supply signatures, but replacing the authorization decision cannot prove request enforcement.