--- id: TST-PFM-SEC-140 title: Assignments.queries database and service checks kind: integration product_area: platform module: security revision: 2 status: draft source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 repository: services-platform files: - modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js implements: [] environment: local implementation_state: implemented latest_result: not-run latest_run_at: null latest_run_ref: null conformance: not-verified estimated_minutes: 3 isolation: Use the prepared test database and suite-owned fixture rows; retain shared seed records. assertion_evidence: - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#security persistence: the security_assignments reads - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#getAssignment - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#answers a pending grant with every column it has mapped to its wire property - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#answers the validity window, the conditions and the activation instant of an active grant, and nothing else - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#answers a resource scope with all four of the columns that scope names, and nothing for an unknown id - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#answers who revoked a grant and when, which is the trail a removed role leaves - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#listAssignmentsForUser - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#answers a user's live grants newest first, the id breaking the tie between two written at one instant - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#answers the whole mapped record of each grant it lists, not an abbreviation of it - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#leaves the revoked grants out of the default statuses and answers them when they are asked for - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#narrows to one status, and to none at all, without reaching another user - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#answers an empty list for a user id that names nobody, which is not an error - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#listAssignmentsOfRole - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#answers every grant of a role, of every status and every user, in id order - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#answers another role only its own grant, whole, so the impact report of one role cannot show another's - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#activatePendingAssignments - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#answers every pending grant of the person whole, each activated at the moment of the write and its version bumped - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#leaves the already-active grant and the revoked one as they were, and answers nothing the second time - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#revokeAssignmentsOfUser - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#answers every live grant of the person whole, revoked at the moment of the write and by the caller - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#keeps the first revocation of a grant already revoked, and answers nothing the second time - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#listRoleHolders - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#answers one row per live grant, each with the person's own fields and the grant's scope, in assignment-id order within the person - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#leaves out a revoked grant, because nobody loses it when the role goes away - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#answers the members of one role alone, and nobody at all for a role nobody holds - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#names the cursor of the next page, and resumes after it without repeating or skipping a grant - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#names no next page when the last page is answered, which is how a screen knows to stop - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#answers no more members than the limit it is given, which is what bounds the refusal it feeds - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#answers each grant's own scope, including the tenant of a resource-scoped one - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#rolesHeldByUsers - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#answers one row per person and role, with the role's label and kind, in name order within the person - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#counts a role held at two scopes once, because a person holds it once however it was granted - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#leaves out a role somebody holds only through a revoked grant, and answers nothing for nobody - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#countCustomerAdministrators - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#counts an active person holding the Administrator role at customer scope - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#counts nobody for a customer that has no administrator of its own - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#stops counting the grant once it is revoked - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#stops counting a grant that has not begun or that ends - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#stops counting a grant that only applies under a condition - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#stops counting the person once their membership is suspended - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#activeTenantRoleIdsOf - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#answers the role of an active grant at the asked tenant's own scope - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#reaches the asked tenant through a grant at the customer's scope - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#does not answer a grant scoped to a sibling tenant of the same customer - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#stops answering a grant that is not yet accepted or is already revoked - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#answers a grant exactly inside its validity window, from its first instant - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#stops answering a grant that has not begun, and one at the instant it ends - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#stops answering a grant once its role is archived - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#answers a role held at two scopes that both reach the tenant exactly once - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js#answers nothing at all for a person holding no grant dependency_evidence: >- The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The file declares no substituted collaborators. evidence: - >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js - >- Static review at the recorded source revision; executable results remain not-run and conformance remains not-verified. binding_note: >- The file has no scenario binding established by this examination. Its executable checks remain registered without assigning them broader acceptance coverage. examiner: codex examined_at: '2026-10-23' final_text: OpenAI dependency_review: provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/assignments.queries.integration.spec.js explicit_no_doubles: true identified_double_boundaries: [] --- # Assignments.queries database and service checks ## Verification Boundary The file exercises database or service behavior through the local integration harness. The assertion references identify the source checks for assignments.queries. ## What This Suite Proves The file supplies executable engineering checks for the named subject. No complete acceptance scenario is inferred from the file’s existence. ## What It Does Not Prove This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence. ## Real Dependencies and Test Doubles The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The file declares no substituted collaborators. ## Must Not Be Doubled Keep the queried database, applicable constraints and transaction boundaries real. Provider substitutes cannot establish delivery, cloud execution or cross-service recovery.