--- id: TST-PFM-SEC-135 title: Assignments.derived database and service checks kind: integration product_area: platform module: security revision: 2 status: draft source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 repository: services-platform files: - modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js implements: - ATS-PFM-SEC-014-02 - ATS-PFM-SEC-014-03 - ATS-PFM-SEC-014-04 environment: local implementation_state: implemented latest_result: not-run latest_run_at: null latest_run_ref: null conformance: not-verified estimated_minutes: 3 isolation: Use the prepared test database and suite-owned fixture rows; retain shared seed records. assertion_evidence: - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#security persistence: derived, contact-keyed assignments - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#platform.sync_derived_assignments, called as rhythm_committees_grantor - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#answers the one assignment it inserted, and nothing revoked - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#writes an active, contact-keyed row naming its derivation, granted by the session’s actor - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#writes one widening audit event for the insert, with the state it granted and no affected keys - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#changes nothing and writes nothing when called again with the same desired set - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#re-synchronising a key - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#extends the window in place, one version on, as a widening amendment - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#records an appointment ended early as an amendment that widens nothing - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#revokes by omission: a row of the key that is no longer desired is revoked, by the actor, and audited - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#revokes every row of the key when the desired set is empty, and answers each - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#grants the same role and scope again after a revoke as a new row, because a revoked grant is history - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#moves a grant to the surviving contact by revoking the merged one’s and deriving the survivor’s - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#what the function refuses, leaving the key as it was - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#refuses a source that is not on its allow-list - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#refuses a customer scope - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#refuses a platform scope - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#refuses a scope in another tenant - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#refuses a role that does not exist - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#refuses an archived role, which grants nothing - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#refuses a role of another customer - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#refuses one role at one resource named twice in a desired set - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#refuses a session in another tenant than the one synchronised - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#refuses a session that names no actor - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#refuses a whole desired set when one entry is refused, inserting none of the others - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#is not executable by a role it was not granted to - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#syncDerivedAssignments, Platform’s own entry point - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#synchronises through the function as Platform’s application role, entering the tenant itself - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#refuses a customer scope before calling the function, as ObjectInvalid - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#refuses an execution in no tenant, writing nothing - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#answers the function’s own refusal as the error its prefix names - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#a derived row refused to Security administration - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#refuses an amendment 409 derived_assignment, naming where to change it - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#refuses a revoke 409 derived_assignment - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#leaves the row exactly as it was after both refusals - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#the database’s rules for a contact-keyed row - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#accepts a tenant-scoped contact row written directly (the negative control) - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#refuses a contact-keyed row at customer scope by the wall trigger - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#refuses a contact-keyed row at platform scope by the wall trigger - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#refuses a contact-keyed row whose tenant is not of its customer by the wall trigger - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#refuses a contact-keyed row carrying another customer’s role by the role ownership check - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#refuses a row with neither a user nor a contact - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#refuses a row with both a user and a contact - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#refuses a derivation source without its key - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js#refuses a second live row of one derivation key, role and tenant scope dependency_evidence: >- The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The file declares no substituted collaborators. evidence: - >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js - >- Static review at the recorded source revision; executable results remain not-run and conformance remains not-verified. binding_note: >- Each binding names the scenario to which this file contributes assertions. A binding is not a recorded pass and does not extend the file’s dependency boundary. examiner: codex examined_at: '2026-10-23' final_text: OpenAI dependency_review: provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.derived.integration.spec.js explicit_no_doubles: true identified_double_boundaries: [] --- # Assignments.derived database and service checks ## Verification Boundary The file exercises database or service behavior through the local integration harness. The assertion references identify the source checks for assignments.derived. ## What This Suite Proves The source assertions support the observations named in the bound scenarios. A scenario spanning multiple files must retain the other files’ contributions. ## What It Does Not Prove This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence. ## Real Dependencies and Test Doubles The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The file declares no substituted collaborators. ## Must Not Be Doubled Keep the queried database, applicable constraints and transaction boundaries real. Provider substitutes cannot establish delivery, cloud execution or cross-service recovery.