--- id: TST-PFM-SEC-069 title: Users request checks kind: api-lifecycle product_area: platform module: security revision: 2 status: draft source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 repository: services-platform files: - modules/security/tests/e2e/users.e2e.spec.js implements: - ATS-PFM-SEC-006-08 - ATS-PFM-SEC-006-09 - ATS-PFM-SEC-006-10 - ATS-PFM-SEC-009-07 - ATS-PFM-SEC-009-09 - ATS-PFM-SEC-009-10 - ATS-PFM-SEC-011-06 - ATS-PFM-SEC-019-08 environment: local implementation_state: implemented latest_result: not-run latest_run_at: null latest_run_ref: null conformance: not-verified estimated_minutes: 5 isolation: Use the prepared test database and suite-owned fixture rows; retain shared seed records. assertion_evidence: - provenance: test source: 'services-platform:modules/security/tests/e2e/users.e2e.spec.js#security API (end to end)' - provenance: test source: 'services-platform:modules/security/tests/e2e/users.e2e.spec.js#health and anonymous calls' - provenance: test source: >- services-platform:modules/security/tests/e2e/users.e2e.spec.js#answers the public health route and refuses an anonymous call - provenance: test source: 'services-platform:modules/security/tests/e2e/users.e2e.spec.js#users within the caller''s scope' - provenance: test source: >- services-platform:modules/security/tests/e2e/users.e2e.spec.js#creates a console user of the caller's own customer, with the e-mail trimmed and its case kept, and refuses one of another customer - provenance: test source: >- services-platform:modules/security/tests/e2e/users.e2e.spec.js#refuses a duplicate e-mail in the same wall (400) and a wall the access type does not allow (400) - provenance: test source: >- services-platform:modules/security/tests/e2e/users.e2e.spec.js#creates a portal user of one of the customer’s tenants, and the same e-mail in another wall is a different user - provenance: test source: >- services-platform:modules/security/tests/e2e/users.e2e.spec.js#lists the caller's own customer's users (its console users and the portal users of its tenants) and nobody else's - provenance: test source: >- services-platform:modules/security/tests/e2e/users.e2e.spec.js#reads a user in scope, answers 404 for another customer's user (row-level security hides it) and an unknown one, and a portal user reads only itself - provenance: test source: >- services-platform:modules/security/tests/e2e/users.e2e.spec.js#replaces and patches a user in scope; the lifecycle is untouchable by the generic update and a move out of the customer is refused - provenance: test source: >- services-platform:modules/security/tests/e2e/users.e2e.spec.js#reads the replacement and the patch back from a later GET, at the version the write answered - provenance: test source: >- services-platform:modules/security/tests/e2e/users.e2e.spec.js#links the Cognito account from the pool of the user's own wall, records its federated identities, and refuses a mismatch - provenance: test source: 'services-platform:modules/security/tests/e2e/users.e2e.spec.js#changePassword' - provenance: test source: >- services-platform:modules/security/tests/e2e/users.e2e.spec.js#changes the caller's own password with the caller's own token, and audits it - provenance: test source: >- services-platform:modules/security/tests/e2e/users.e2e.spec.js#refuses a spoofed access token (another Cognito user) as 403, a token without the scope as 400, and an invalid body as 400 - provenance: test source: >- services-platform:modules/security/tests/e2e/users.e2e.spec.js#answers a social-only account with 409 and the identity-provider message; an unprovisioned account with 409 - provenance: test source: >- services-platform:modules/security/tests/e2e/users.e2e.spec.js#passes Cognito's refusal of the existing password through as 400 - provenance: test source: 'services-platform:modules/security/tests/e2e/users.e2e.spec.js#resetPassword' - provenance: test source: >- services-platform:modules/security/tests/e2e/users.e2e.spec.js#starts a recovery for the caller's own account (a code sent) and for a user in scope (recovery at next sign-in) - provenance: test source: >- services-platform:modules/security/tests/e2e/users.e2e.spec.js#requires the manage-passwords permission (Knox enforces it at the gateway) and refuses a user of another customer - provenance: test source: >- services-platform:modules/security/tests/e2e/users.e2e.spec.js#answers a social-only target with 409 and an unknown target with 404 - provenance: test source: 'services-platform:modules/security/tests/e2e/users.e2e.spec.js#deleteUser' - provenance: test source: >- services-platform:modules/security/tests/e2e/users.e2e.spec.js#deletes the created user within scope; another customer's administrator cannot - provenance: test source: >- services-platform:modules/security/tests/e2e/users.e2e.spec.js#keeps the name behind the id, so every record the person touched can still say who it was - provenance: test source: >- services-platform:modules/security/tests/e2e/users.e2e.spec.js#writes the deletion to the security trail, naming who deleted whom - provenance: test source: >- services-platform:modules/security/tests/e2e/users.e2e.spec.js#answers 409 and user_undeletable for somebody other records still point at - provenance: test source: >- services-platform:modules/security/tests/e2e/users.e2e.spec.js#refuses an administrator deleting their own account, and says so rather than hiding it - provenance: test source: >- services-platform:modules/security/tests/e2e/users.e2e.spec.js#answers an id that names nobody with 404 - provenance: test source: >- services-platform:modules/security/tests/e2e/users.e2e.spec.js#answers 409 for Rhythm’s last Rhythm Administrator, and deletes nobody - provenance: test source: >- services-platform:modules/security/tests/e2e/users.e2e.spec.js#refuses the next request made with a deleted user’s own still-valid token dependency_evidence: >- The local request harness exercises the route dispatcher and the prepared database. The suite’s own dependency setup determines which external collaborators are controlled; registration alone does not certify them as live. evidence: - 'services-platform:modules/security/tests/e2e/users.e2e.spec.js' - >- Static review at the recorded source revision; executable results remain not-run and conformance remains not-verified. binding_note: >- Each binding names the scenario to which this file contributes assertions. A binding is not a recorded pass and does not extend the file’s dependency boundary. examiner: codex examined_at: '2026-10-23' final_text: OpenAI dependency_review: provenance: test source: 'services-platform:modules/security/tests/e2e/users.e2e.spec.js' explicit_no_doubles: false identified_double_boundaries: [] --- # Users request checks ## Verification Boundary The file exercises public request handling through the local service harness. The assertion references identify the source checks for users. ## What This Suite Proves The source assertions support the observations named in the bound scenarios. A scenario spanning multiple files must retain the other files’ contributions. ## What It Does Not Prove This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence. ## Real Dependencies and Test Doubles The local request harness exercises the route dispatcher and the prepared database. The suite’s own dependency setup determines which external collaborators are controlled; registration alone does not certify them as live. ## Must Not Be Doubled Keep route dispatch, signed-context verification and the exercised service decisions real. A test key can supply signatures, but replacing the authorization decision cannot prove request enforcement.