--- id: TST-PFM-SEC-138 title: Assignments.grants.queries database and service checks kind: integration product_area: platform module: security revision: 2 status: draft source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 repository: services-platform files: - >- modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js implements: [] environment: local implementation_state: implemented latest_result: not-run latest_run_at: null latest_run_ref: null conformance: not-verified estimated_minutes: 3 isolation: Use the prepared test database and suite-owned fixture rows; retain shared seed records. assertion_evidence: - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#security persistence: the grant slice queries - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#resolveGrantSlice - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#is resolved against a registry whose only licence-free applications are platform and crm (premise) - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#answers the whole slice of a user whose rules come from an assignment, a role and the role's policy - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#keeps a wildcard pattern that matches the requested key and drops the exact rules that do not - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#answers the membership and no assignments at all for a user that was granted nothing - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#answers a pending grant with its status and its rules, and leaves a revoked one out entirely - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#the application access keys the slice is widened by - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#carries the rule that allows the application's own key beside the rule the route's key needs - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#carries the deny of the application's own key for a user whose role grants the route's key - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#asks for no access key on account of a platform key, so the same user's CRM rules stay out - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#answers the one key asked for and the access key together, in one slice, for a route that names both apps - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#answers the HQ user's access rule when the access key itself is what was asked for - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#asks for no access key on account of an HQ key, so that same rule stays out of the slice - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#resolveAllGrants - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#answers the same user the same grants with every rule, including those naming keys nobody asked about - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#agrees with the filtered slice about which grants exist, pending included and revoked excluded - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#answers the membership and no assignments at all for a user that was granted nothing - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#the reach of the caller the slice is resolved for - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#answers another customer's user to Rhythm staff, who reach every wall - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#refuses another customer's user to a console caller of its own customer, through both functions - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#security persistence: the licence record the grant slice carries - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#reads a registry in which platform and crm alone need no licence (premise) - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#names both tenants of the user’s customer and no other - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#answers north the application its grant licenses and the one that needs no licence, and nothing else - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#answers south, licensed differently under the same customer, only the applications that need no licence - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#leaves out an application a withhold refuses, though a grant of it is in force and it is enabled - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#leaves out an application Rhythm has suspended for the tenant, though its grant is in force - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#leaves out an application whose grant has ended, with nothing having run to expire it - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#answers that same expired grant as licensing the application at an instant inside its window - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#is uninfluenced by another customer’s tenant, which is licensed for the application north has - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#answers the unfiltered slice the same record, so the security context and the authorizer agree - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#the tenant the security context is asked for (`resolveAllGrants` in a tenant) - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#leaves out the tenant a customer-level grant reaches when no tenant is asked for, as before (premise) - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#names that tenant with its available applications when it is asked for, a withheld one left out - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#answers it the record the authorizer signs for a request in that tenant - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#changes nothing but the record: the assignments are the whole slice, unscoped - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#names no tenant of a customer the user holds no grant in, though it is asked for - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#security persistence: the licence record a contract fills in - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#reads a registry in which platform and crm alone need no licence (premise) - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#names all three tenants of the customer, linked or not - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#answers the production tenant the applications its contract licenses, with no override anywhere - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#answers the sandbox the same applications, because it reads the same company’s contract - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#answers a tenant linked to no HubSpot company only the applications that need no licence - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#leaves out an application a withhold refuses, though the contract licenses it - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#keeps a licence whose term ended inside the seven days of grace - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#keeps it on the last day of that grace, and drops it the day after - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#keeps the open-ended licence when the other has expired, since each window stands on its own - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#licenses nothing by contract the day before the term starts - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js#answers the unfiltered slice the same record, so the security context and the authorizer agree dependency_evidence: >- The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The file declares no substituted collaborators. evidence: - >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js - >- Static review at the recorded source revision; executable results remain not-run and conformance remains not-verified. binding_note: >- The file has no scenario binding established by this examination. Its executable checks remain registered without assigning them broader acceptance coverage. examiner: codex examined_at: '2026-10-23' final_text: OpenAI dependency_review: provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.grants.queries.integration.spec.js explicit_no_doubles: true identified_double_boundaries: [] --- # Assignments.grants.queries database and service checks ## Verification Boundary The file exercises database or service behavior through the local integration harness. The assertion references identify the source checks for assignments.grants.queries. ## What This Suite Proves The file supplies executable engineering checks for the named subject. No complete acceptance scenario is inferred from the file’s existence. ## What It Does Not Prove This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence. ## Real Dependencies and Test Doubles The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The file declares no substituted collaborators. ## Must Not Be Doubled Keep the queried database, applicable constraints and transaction boundaries real. Provider substitutes cannot establish delivery, cloud execution or cross-service recovery.