--- id: TST-PFM-SEC-144 title: Authentication identities.queries database and service checks kind: integration product_area: platform module: security revision: 2 status: draft source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 repository: services-platform files: - >- modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js implements: [] environment: local implementation_state: implemented latest_result: not-run latest_run_at: null latest_run_ref: null conformance: not-verified estimated_minutes: 3 isolation: Use the prepared test database and suite-owned fixture rows; retain shared seed records. assertion_evidence: - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#security persistence reads: authentication identities - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#assertPoolIsTheUsersWall (the two rows the write reads before it writes) - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#says nothing at all for a console user offered the console pool, which is its wall - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#says nothing for a portal member offered the pool of its own tenant - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#refuses a user that is not there, naming the id it could not read - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#refuses a pool that is not registered, because the row it reads second is not there either - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#refuses a console user offered a portal pool, because the wall is read from the user and not from the caller - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#refuses a portal member offered another tenant’s portal pool, naming the tenant whose member it is - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#the record recordAuthenticationIdentity answers - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#answers every column of the login it wrote, the e-mail canonicalised and the system properties stamped - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#leaves out the keys of the columns a login that states only what the table requires never set - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#getAuthenticationIdentity - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#reads back every column of the login, as the write answered it - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#reads back the login of the other wall, in the pool of the member’s own tenant - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#answers nothing for an id of the right grammar that names no login - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#findIdentityByIssuerSubject - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#answers the whole login the pair names, whatever its status - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#answers the revoked login too, because the caller decides what a revoked account means - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#answers nothing for a subject nobody linked and for the right subject under another issuer - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#listAuthenticationIdentities - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#answers the user’s logins newest first, breaking a shared instant by ascending id, each record whole - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#answers only the one user’s logins, never another user’s in the same pool - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#answers an empty list for a user with no login at all - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#findActiveIdentityForUser - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#answers the newest active login of the user, whole - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#answers nothing once the user’s only login has been revoked - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#answers nothing for a user with no login at all - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#findIdentityInPool - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#answers the user’s active account in the pool named, whole - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#answers the newest of the user’s several active accounts in the pool, never an older one - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#answers nothing in a pool the user holds no account in - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#answers nothing for a revoked account, because the read is of the account that can still sign in - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#hasActiveAuthenticationIdentity - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#answers true for a user holding an active login - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#answers false for a user whose only login was revoked and for one that never had any - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#resolveIdentity (the authorizer’s port) - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#answers the account and the portal member it joins, the tenant among the user’s own fields - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#answers a console user with no tenant key at all, rather than a null one - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#answers a revoked account with its status, so the authorizer refuses it in its own words - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#answers nothing for a pair nobody linked, which is the 401 the authorizer gives - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#the record revokeAuthenticationIdentity answers - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#answers the whole row it stamped: revoked, when, and the version the revocation moved it to - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#answers nothing for a login that is not there - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#the providers inside an account - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#answers every column of the link linkExternalIdentity wrote, the e-mail canonicalised - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#leaves out the keys a link that named no provider name and no e-mail never set, and keeps the default evidence - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#findExternalIdentity answers the whole link a provider identity reaches in the pool - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#findExternalIdentity answers nothing in a pool where that provider identity reaches nobody - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#listExternalIdentities answers the account’s links in provider then subject order, each record whole - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#listExternalIdentities answers an empty list for an account no provider reaches - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#revokeExternalIdentity answers the whole row it stamped, the link kept as the audit trail of itself - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#revokeExternalIdentity answers nothing for a link that is not there, and the revoked link is still found - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#activateLinkedUser - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#answers the whole user it activated: active at the moment of the write, its creation stamps kept - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#answers the record the user was before it, but for the lifecycle the activation moved - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js#answers nothing for a user that holds no login at all, so the condition is the login and not the status dependency_evidence: >- The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The file declares no substituted collaborators. evidence: - >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js - >- Static review at the recorded source revision; executable results remain not-run and conformance remains not-verified. binding_note: >- The file has no scenario binding established by this examination. Its executable checks remain registered without assigning them broader acceptance coverage. examiner: codex examined_at: '2026-10-23' final_text: OpenAI dependency_review: provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/authentication-identities.queries.integration.spec.js explicit_no_doubles: true identified_double_boundaries: [] --- # Authentication identities.queries database and service checks ## Verification Boundary The file exercises database or service behavior through the local integration harness. The assertion references identify the source checks for authentication identities.queries. ## What This Suite Proves The file supplies executable engineering checks for the named subject. No complete acceptance scenario is inferred from the file’s existence. ## What It Does Not Prove This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence. ## Real Dependencies and Test Doubles The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The file declares no substituted collaborators. ## Must Not Be Doubled Keep the queried database, applicable constraints and transaction boundaries real. Provider substitutes cannot establish delivery, cloud execution or cross-service recovery.