--- id: TST-PFM-SEC-084 title: User provisioning database and service checks kind: integration product_area: platform module: security revision: 2 status: draft source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 repository: services-platform files: - >- modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js implements: - ATS-PFM-SEC-008-04 environment: local implementation_state: implemented latest_result: not-run latest_run_at: null latest_run_ref: null conformance: not-verified estimated_minutes: 3 isolation: Use the prepared test database and suite-owned fixture rows; retain shared seed records. assertion_evidence: - provenance: test source: >- services-platform:modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js#the user provisioning journey: an e-mail the pool already gives to somebody else - provenance: test source: >- services-platform:modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js#stage 1: what the administrator is told - provenance: test source: >- services-platform:modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js#answers the delivery as refused - provenance: test source: >- services-platform:modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js#says why, in words the administrator can act on - provenance: test source: >- services-platform:modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js#still answers the user and the invitation it committed - provenance: test source: >- services-platform:modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js#stage 2: what the refusal left behind - provenance: test source: >- services-platform:modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js#links no authentication identity, because no account was made - provenance: test source: >- services-platform:modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js#sends nothing - provenance: test source: >- services-platform:modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js#leaves the invitation unsent and without a token - provenance: test source: >- services-platform:modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js#leaves the person invited - provenance: test source: >- services-platform:modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js#records the provisioning as refused, with the reason, in the trail - provenance: test source: >- services-platform:modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js#the user provisioning journey: Cognito failing, then a resend once it answers - provenance: test source: >- services-platform:modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js#stage 1: the invite while Cognito failed - provenance: test source: >- services-platform:modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js#answers the delivery as failed, telling the administrator to resend - provenance: test source: >- services-platform:modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js#keeps the provider’s own words out of the answer - provenance: test source: >- services-platform:modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js#links no account and sends nothing - provenance: test source: >- services-platform:modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js#leaves the person invited, waiting for a resend - provenance: test source: >- services-platform:modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js#records the provisioning as failed in the trail - provenance: test source: >- services-platform:modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js#stage 2: the resend - provenance: test source: >- services-platform:modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js#answers the delivery as sent - provenance: test source: >- services-platform:modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js#creates the account the invite could not - provenance: test source: >- services-platform:modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js#supersedes the invitation that was never sent - provenance: test source: >- services-platform:modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js#stage 3: the person accepting with the link the resend sent - provenance: test source: >- services-platform:modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js#accepts and makes the account active - provenance: test source: >- services-platform:modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js#the user provisioning journey: the e-mail failing after the account was made, then a resend - provenance: test source: >- services-platform:modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js#stage 1: the invite whose e-mail failed - provenance: test source: >- services-platform:modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js#answers the delivery as failed - provenance: test source: >- services-platform:modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js#has already linked the account, which was made before the e-mail - provenance: test source: >- services-platform:modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js#leaves the invitation unsent - provenance: test source: >- services-platform:modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js#stage 2: the resend - provenance: test source: >- services-platform:modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js#answers the delivery as sent - provenance: test source: >- services-platform:modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js#finds the account the invite made rather than creating a second one - provenance: test source: >- services-platform:modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js#stage 3: the links - provenance: test source: >- services-platform:modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js#supersedes the first invitation, whose e-mail never left - provenance: test source: >- services-platform:modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js#counts the send against the invitation whose e-mail left, and nothing against the one that failed - provenance: test source: >- services-platform:modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js#accepts with the link the resend sent dependency_evidence: >- The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The suite controls Cognito, message delivery at the declared seams; those collaborators remain outside its live proof. evidence: - >- services-platform:modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js - >- Static review at the recorded source revision; executable results remain not-run and conformance remains not-verified. binding_note: >- Each binding names the scenario to which this file contributes assertions. A binding is not a recorded pass and does not extend the file’s dependency boundary. examiner: codex examined_at: '2026-10-23' final_text: OpenAI dependency_review: provenance: test source: >- services-platform:modules/security/tests/integration/lifecycle/user-provisioning/user-provisioning.integration.spec.js explicit_no_doubles: false identified_double_boundaries: - Cognito - message delivery --- # User provisioning database and service checks ## Verification Boundary The file exercises database or service behavior through the local integration harness. The assertion references identify the source checks for user provisioning. ## What This Suite Proves The source assertions support the observations named in the bound scenarios. A scenario spanning multiple files must retain the other files’ contributions. ## What It Does Not Prove This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence. ## Real Dependencies and Test Doubles The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The suite controls Cognito, message delivery at the declared seams; those collaborators remain outside its live proof. ## Must Not Be Doubled Keep the queried database, applicable constraints and transaction boundaries real. Provider substitutes cannot establish delivery, cloud execution or cross-service recovery.