--- id: TST-PFM-SEC-103 title: Reconcile database and service checks kind: integration product_area: platform module: security revision: 2 status: draft source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 repository: services-platform files: - modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js implements: - ATS-PFM-SEC-014-04 - ATS-PFM-SEC-014-07 environment: local implementation_state: implemented latest_result: not-run latest_run_at: null latest_run_ref: null conformance: not-verified estimated_minutes: 3 isolation: Use the prepared test database and suite-owned fixture rows; retain shared seed records. assertion_evidence: - provenance: test source: >- services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js#the derived-assignment reconciler - provenance: test source: >- services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js#for a subject the rule holds for, then does not - provenance: test source: >- services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js#creates one active, tenant-scoped, contact-keyed row of the role through the function, keyed by binding and contact - provenance: test source: >- services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js#asks the evaluator once, in one batch, at authorization consistency, for every rule-bound role - provenance: test source: >- services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js#re-confirms the same row when the subject is still eligible: its start kept, valid_until now + ttl, the note the new version - provenance: test source: >- services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js#revokes it through the function when the subject is no longer eligible, keeping the row as history - provenance: test source: >- services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js#leaves the function’s security trail for the grant, the re-confirmation and the revocation, all by the system - provenance: test source: >- services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js#a re-confirmation that changes nothing - provenance: test source: >- services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js#writes no row and no event the second time - provenance: test source: >- services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js#for a subject the engine cannot decide - provenance: test source: >- services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js#leaves the key exactly as it was and names the role it could not decide - provenance: test source: >- services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js#does not call the function for the key: the grant is the only event the row has - provenance: test source: >- services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js#grants nothing to a subject that holds nothing - provenance: test source: >- services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js#beside a manual assignment of the same role - provenance: test source: >- services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js#never touches the manual assignment: no derivation, no window, its first version - provenance: test source: >- services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js#derives and revokes the contact-keyed row beside it as if the manual one were not there - provenance: test source: >- services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js#a hand edit of a derived row - provenance: test source: >- services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js#refuses the amendment 409 derived_assignment, naming eligibility, the binding and the contact - provenance: test source: >- services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js#refuses the revocation 409 derived_assignment - provenance: test source: >- services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js#leaves the row exactly as the reconciler wrote it after both refusals - provenance: test source: >- services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js#through the authorizer’s own path - provenance: test source: >- services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js#holds no row keyed to the user, so what follows is the contact’s row alone - provenance: test source: >- services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js#allows the contact’s portal user while the row is within its window, which is the premise of the next case - provenance: test source: >- services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js#no longer allows once its valid_until has passed without re-confirmation - provenance: test source: >- services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js#explains the grant in the member’s access document as derived by eligibility from the binding - provenance: test source: >- services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js#reconcileRole - provenance: test source: >- services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js#re-evaluates the contacts that hold the role and revokes the one no longer eligible - provenance: test source: >- services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js#does not reach an eligible subject that holds nothing yet: that is sign-in’s until population runs exist - provenance: test source: >- services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js#two reconciles of one subject at once - provenance: test source: >- services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js#grants the role once: the second waits on the key’s lock and confirms what the first wrote - provenance: test source: >- services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js#when the evaluator fails - provenance: test source: >- services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js#throws the evaluator’s failure - provenance: test source: >- services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js#writes nothing - provenance: test source: >- services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js#for an organization subject - provenance: test source: >- services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js#evaluates nothing and creates nothing, because eligibility derives roles for contacts only dependency_evidence: >- The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The suite’s own dependency setup determines which external collaborators are controlled; registration alone does not certify them as live. evidence: - >- services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js - >- Static review at the recorded source revision; executable results remain not-run and conformance remains not-verified. binding_note: >- Each binding names the scenario to which this file contributes assertions. A binding is not a recorded pass and does not extend the file’s dependency boundary. examiner: codex examined_at: '2026-10-23' final_text: OpenAI dependency_review: provenance: test source: >- services-platform:modules/security/tests/integration/services/derived-assignments/reconcile.integration.spec.js explicit_no_doubles: false identified_double_boundaries: [] --- # Reconcile database and service checks ## Verification Boundary The file exercises database or service behavior through the local integration harness. The assertion references identify the source checks for reconcile. ## What This Suite Proves The source assertions support the observations named in the bound scenarios. A scenario spanning multiple files must retain the other files’ contributions. ## What It Does Not Prove This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence. ## Real Dependencies and Test Doubles The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The suite’s own dependency setup determines which external collaborators are controlled; registration alone does not certify them as live. ## Must Not Be Doubled Keep the queried database, applicable constraints and transaction boundaries real. Provider substitutes cannot establish delivery, cloud execution or cross-service recovery.