--- id: TST-PFM-SEC-072 title: Former users.table database and service checks kind: integration product_area: platform module: security revision: 2 status: draft source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 repository: services-platform files: - modules/security/tests/integration/db/former-users.table.integration.spec.js implements: [] environment: local implementation_state: implemented latest_result: not-run latest_run_at: null latest_run_ref: null conformance: not-verified estimated_minutes: 3 isolation: Use the prepared test database and suite-owned fixture rows; retain shared seed records. assertion_evidence: - provenance: test source: >- services-platform:modules/security/tests/integration/db/former-users.table.integration.spec.js#platform.former_users (who a deleted user was) - provenance: test source: >- services-platform:modules/security/tests/integration/db/former-users.table.integration.spec.js#enables and forces row-level security, with the caller-scope policy platform.users carries - provenance: test source: >- services-platform:modules/security/tests/integration/db/former-users.table.integration.spec.js#grants the application role insert and select, and nothing that could rewrite a person’s history - provenance: test source: >- services-platform:modules/security/tests/integration/db/former-users.table.integration.spec.js#what the application role may do to a row it can read - provenance: test source: >- services-platform:modules/security/tests/integration/db/former-users.table.integration.spec.js#reads it, which is the premise of the two refusals below - provenance: test source: >- services-platform:modules/security/tests/integration/db/former-users.table.integration.spec.js#may not change the name a former user was deleted under - provenance: test source: >- services-platform:modules/security/tests/integration/db/former-users.table.integration.spec.js#may not delete a former user at all: the purge does that, through its definer function - provenance: test source: >- services-platform:modules/security/tests/integration/db/former-users.table.integration.spec.js#still has the row after both attempts, unchanged - provenance: test source: >- services-platform:modules/security/tests/integration/db/former-users.table.integration.spec.js#the rows the table itself refuses - provenance: test source: >- services-platform:modules/security/tests/integration/db/former-users.table.integration.spec.js#refuses an id that is not a user id, by former_users_id_check - provenance: test source: >- services-platform:modules/security/tests/integration/db/former-users.table.integration.spec.js#refuses an access type outside the closed list, by former_users_access_type_check - provenance: test source: >- services-platform:modules/security/tests/integration/db/former-users.table.integration.spec.js#refuses a console former user that names a tenant, by former_users_wall_check - provenance: test source: >- services-platform:modules/security/tests/integration/db/former-users.table.integration.spec.js#refuses a portal former user that names none, by the same check - provenance: test source: >- services-platform:modules/security/tests/integration/db/former-users.table.integration.spec.js#refuses an address that is not canonical, by the schema’s e-mail domain - provenance: test source: >- services-platform:modules/security/tests/integration/db/former-users.table.integration.spec.js#platform.current_and_former_users (everybody who has ever been a user) - provenance: test source: >- services-platform:modules/security/tests/integration/db/former-users.table.integration.spec.js#is a view the reader’s own row-level security binds, not the view owner’s - provenance: test source: >- services-platform:modules/security/tests/integration/db/former-users.table.integration.spec.js#answers a live user with the status they hold and no deletion instant - provenance: test source: >- services-platform:modules/security/tests/integration/db/former-users.table.integration.spec.js#answers a deleted user as deleted, with the name they had and the moment they went - provenance: test source: >- services-platform:modules/security/tests/integration/db/former-users.table.integration.spec.js#answers a customer’s live and former people as one list - provenance: test source: >- services-platform:modules/security/tests/integration/db/former-users.table.integration.spec.js#leaves another customer’s former user out of a console caller’s reach - provenance: test source: >- services-platform:modules/security/tests/integration/db/former-users.table.integration.spec.js#answers Rhythm staff both of them, which is what makes the absence above the policy rather than the view - provenance: test source: >- services-platform:modules/security/tests/integration/db/former-users.table.integration.spec.js#platform.current_and_former_users (the name it answers for somebody who chose none) - provenance: test source: >- services-platform:modules/security/tests/integration/db/former-users.table.integration.spec.js#stored no display name for the person who chose none, which is what the fallback is for (premise) - provenance: test source: >- services-platform:modules/security/tests/integration/db/former-users.table.integration.spec.js#answers a live person who chose no display name their first and last name - provenance: test source: >- services-platform:modules/security/tests/integration/db/former-users.table.integration.spec.js#stored no display name for the deleted person either, and their row is in the former users (premise) - provenance: test source: >- services-platform:modules/security/tests/integration/db/former-users.table.integration.spec.js#answers a deleted person who chose no display name their first and last name, from the other half of the union - provenance: test source: >- services-platform:modules/security/tests/integration/db/former-users.table.integration.spec.js#answers the name a person did choose, which the fallback never replaces - provenance: test source: >- services-platform:modules/security/tests/integration/db/former-users.table.integration.spec.js#stored no display name for the person who typed nothing but whitespace, so the case below is the rule and not the insert (premise) - provenance: test source: >- services-platform:modules/security/tests/integration/db/former-users.table.integration.spec.js#falls back for a person who typed nothing but whitespace, rather than answering the whitespace - provenance: test source: >- services-platform:modules/security/tests/integration/db/former-users.table.integration.spec.js#answers a name for everybody it answers at all, so no reader has to compose one dependency_evidence: >- The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The file declares no substituted collaborators. evidence: - 'services-platform:modules/security/tests/integration/db/former-users.table.integration.spec.js' - >- Static review at the recorded source revision; executable results remain not-run and conformance remains not-verified. binding_note: >- The file has no scenario binding established by this examination. Its executable checks remain registered without assigning them broader acceptance coverage. examiner: codex examined_at: '2026-10-23' final_text: OpenAI dependency_review: provenance: test source: 'services-platform:modules/security/tests/integration/db/former-users.table.integration.spec.js' explicit_no_doubles: true identified_double_boundaries: [] --- # Former users.table database and service checks ## Verification Boundary The file exercises database or service behavior through the local integration harness. The assertion references identify the source checks for former users.table. ## What This Suite Proves The file supplies executable engineering checks for the named subject. No complete acceptance scenario is inferred from the file’s existence. ## What It Does Not Prove This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence. ## Real Dependencies and Test Doubles The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The file declares no substituted collaborators. ## Must Not Be Doubled Keep the queried database, applicable constraints and transaction boundaries real. Provider substitutes cannot establish delivery, cloud execution or cross-service recovery.