--- id: TST-PFM-SEC-143 title: Authentication identities database and service checks kind: integration product_area: platform module: security revision: 2 status: draft source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 repository: services-platform files: - >- modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js implements: [] environment: local implementation_state: implemented latest_result: not-run latest_run_at: null latest_run_ref: null conformance: not-verified estimated_minutes: 3 isolation: Use the prepared test database and suite-owned fixture rows; retain shared seed records. assertion_evidence: - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#security persistence: authentication_identities - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#recordAuthenticationIdentity - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#records the account in the pool of the user's wall, active, with who linked it and why - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#offered the same account again answers the row it already made, so a retried provisioning run continues - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#refuses an account that is already another user’s login, and writes nothing - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#refuses a user that is not there and a pool nobody registered - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#the wall rule (the pool must be the pool of the user’s own wall) - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#refuses a console user an account in a portal pool and a portal member an account in the console pool - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#refuses a portal member an account in another tenant's pool, which is what keeps the walls apart - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#the constraint trigger refuses the same thing to a writer that never came through the repository - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#the reads - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#reads an identity by its id, by (issuer, subject), by user and by pool - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#answers nothing for a user with no login at all - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#findPoolForUser answers the user's own wall's pool, and refuses a user that is not there - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#records the moment a login was last used without making it an edit of the record - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#resolveIdentity (the authorizer’s port) - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#answers the identity and its user, read fresh, for a registered pair - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#answers a console user without a tenant, and nothing at all for a pair nobody linked - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#still answers a revoked login, with its status, so the authorizer refuses it in its own words - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#revokeAuthenticationIdentity - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#takes the login away, stamps when, and leaves the membership alone - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#revoking twice keeps the first moment, and an unknown id answers nothing - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#activateLinkedUser - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#activates a user that was never invited and already holds an active login - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#refuses a user with no login, and one with an invitation in flight, leaving both invited - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#security persistence: external_identities - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#linkExternalIdentity - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#records the provider, its issuer and subject, the evidence of the e-mail and why it was linked - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#defaults the evidence to `none`, which is an honest answer rather than an absent one - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#offered the same provider identity for the same account again answers the row it already made - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#refuses a provider identity another account of the same pool already holds, and writes nothing - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#allows the same provider subject in another pool, because the rule is per pool and a pool is a wall - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#refuses an account and a pool that do not exist - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#findExternalIdentity and listExternalIdentities - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#answers who a provider identity reaches in a pool, and nothing in a pool where it reaches nobody - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#lists the providers of one account in provider order, and nothing for an account with none - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#revokeExternalIdentity - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#stamps the link revoked and keeps the row, so the audit trail of a link survives its removal - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js#answers nothing for a link that is not there dependency_evidence: >- The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The suite’s own dependency setup determines which external collaborators are controlled; registration alone does not certify them as live. evidence: - >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js - >- Static review at the recorded source revision; executable results remain not-run and conformance remains not-verified. binding_note: >- The file has no scenario binding established by this examination. Its executable checks remain registered without assigning them broader acceptance coverage. examiner: codex examined_at: '2026-10-23' final_text: OpenAI dependency_review: provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.integration.spec.js explicit_no_doubles: false identified_double_boundaries: [] --- # Authentication identities database and service checks ## Verification Boundary The file exercises database or service behavior through the local integration harness. The assertion references identify the source checks for authentication identities. ## What This Suite Proves The file supplies executable engineering checks for the named subject. No complete acceptance scenario is inferred from the file’s existence. ## What It Does Not Prove This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence. ## Real Dependencies and Test Doubles The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The suite’s own dependency setup determines which external collaborators are controlled; registration alone does not certify them as live. ## Must Not Be Doubled Keep the queried database, applicable constraints and transaction boundaries real. Provider substitutes cannot establish delivery, cloud execution or cross-service recovery.