---
id: TST-PFM-SEC-139
title: Assignments database and service checks
kind: integration
product_area: platform
module: security
revision: 2
status: draft
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
repository: services-platform
files:
  - modules/security/tests/integration/services/persistence/assignments.integration.spec.js
implements: []
environment: local
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 3
isolation: Use the prepared test database and suite-owned fixture rows; retain shared seed records.
assertion_evidence:
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/persistence/assignments.integration.spec.js#security
      persistence: security_assignments
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/persistence/assignments.integration.spec.js#createAssignment
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/persistence/assignments.integration.spec.js#grants
      a role at the user's own customer, pending until something activates it
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/persistence/assignments.integration.spec.js#grants
      it active for a user who is already here, stamping when
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/persistence/assignments.integration.spec.js#takes
      the customer from the user's own wall when the scope names none, because there is only one it
      could be
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/persistence/assignments.integration.spec.js#grants
      a tenant and a resource scope inside the customer, and an assignment with no role at all
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/persistence/assignments.integration.spec.js#records
      a validity window and refuses one that ends before it begins, writing nothing
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/persistence/assignments.integration.spec.js#records
      conditions that parse as the condition language, the same language a rule carries
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/persistence/assignments.integration.spec.js#refuses
      a condition the evaluator could not read, writing nothing
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/persistence/assignments.integration.spec.js#refuses
      a user and a role that do not exist
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/persistence/assignments.integration.spec.js#the
      wall rule
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/persistence/assignments.integration.spec.js#refuses
      a console user a customer scope that is not its own, and a tenant of another customer's
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/persistence/assignments.integration.spec.js#allows
      platform scope only on a console user of Rhythm's own customer
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/persistence/assignments.integration.spec.js#refuses
      a portal member anything but its own tenant, or a resource within it
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/persistence/assignments.integration.spec.js#refuses
      a tenant that does not exist
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/persistence/assignments.integration.spec.js#states
      the rule as a pure function, so the administration layer can ask before it writes
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/persistence/assignments.integration.spec.js#the
      constraint trigger refuses the same scope to a writer that never came through the repository
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/persistence/assignments.integration.spec.js#the
      scope shape
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/persistence/assignments.integration.spec.js#refuses
      a scope that does not name exactly the columns its type requires
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/persistence/assignments.integration.spec.js#the
      reads
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/persistence/assignments.integration.spec.js#answers
      one assignment, a user's newest first, and everyone a role is assigned to
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/persistence/assignments.integration.spec.js#narrows
      by status, and leaves the revoked out unless they are asked for
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/persistence/assignments.integration.spec.js#amendAssignment
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/persistence/assignments.integration.spec.js#moves
      the scope, the window and the conditions of a live grant, and bumps its version once
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/persistence/assignments.integration.spec.js#leaves
      out what the amendment does not name, and clears a bound the amendment nulls
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/persistence/assignments.integration.spec.js#refuses
      a scope outside the user's wall, naming the rule, and moves nothing
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/persistence/assignments.integration.spec.js#refuses
      a window that would end before it begins, and moves nothing
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/persistence/assignments.integration.spec.js#answers
      nothing for an id that names no grant, as every write of one record does
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/persistence/assignments.integration.spec.js#the
      lifecycle
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/persistence/assignments.integration.spec.js#activates
      a user's pending assignments, which is the other half of acceptance
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/persistence/assignments.integration.spec.js#leaves
      an assignment revoked between the invitation and the acceptance revoked
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/persistence/assignments.integration.spec.js#revokes
      one assignment terminally, recording who did it and when
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/persistence/assignments.integration.spec.js#revokes
      every assignment of a user at once, which is what revoking a membership does to its authority
dependency_evidence: >-
  The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here.
  The suite’s own dependency setup determines which external collaborators are controlled;
  registration alone does not certify them as live.
evidence:
  - >-
    services-platform:modules/security/tests/integration/services/persistence/assignments.integration.spec.js
  - >-
    Static review at the recorded source revision; executable results remain not-run and conformance
    remains not-verified.
binding_note: >-
  The file has no scenario binding established by this examination. Its executable checks remain
  registered without assigning them broader acceptance coverage.
examiner: codex
examined_at: '2026-10-23'
final_text: OpenAI
dependency_review:
  provenance: test
  source: >-
    services-platform:modules/security/tests/integration/services/persistence/assignments.integration.spec.js
  explicit_no_doubles: false
  identified_double_boundaries: []
---
# Assignments database and service checks

## Verification Boundary

The file exercises database or service behavior through the local integration harness. The assertion references identify the source checks for assignments.

## What This Suite Proves

The file supplies executable engineering checks for the named subject. No complete acceptance scenario is inferred from the file’s existence.

## What It Does Not Prove

This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence.

## Real Dependencies and Test Doubles

The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The suite’s own dependency setup determines which external collaborators are controlled; registration alone does not certify them as live.

## Must Not Be Doubled

Keep the queried database, applicable constraints and transaction boundaries real. Provider substitutes cannot establish delivery, cloud execution or cross-service recovery.