--- id: TST-PFM-SEC-150 title: Identity link sessions.queries database and service checks kind: integration product_area: platform module: security revision: 2 status: draft source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 repository: services-platform files: - >- modules/security/tests/integration/services/persistence/identity-link-sessions.queries.integration.spec.js implements: [] environment: local implementation_state: implemented latest_result: not-run latest_run_at: null latest_run_ref: null conformance: not-verified estimated_minutes: 3 isolation: Use the prepared test database and suite-owned fixture rows; retain shared seed records. assertion_evidence: - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-link-sessions.queries.integration.spec.js#security persistence reads: identity link sessions - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-link-sessions.queries.integration.spec.js#the record createLinkSession answers - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-link-sessions.queries.integration.spec.js#answers every column of the session it wrote, the candidate e-mail canonicalised and only the nonce’s hash - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-link-sessions.queries.integration.spec.js#leaves out the keys of the account and the candidate e-mail a session never named - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-link-sessions.queries.integration.spec.js#getLinkSession - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-link-sessions.queries.integration.spec.js#reads back every column of a live session, as the write answered it - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-link-sessions.queries.integration.spec.js#reads back a spent session too, with its outcome and its reason - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-link-sessions.queries.integration.spec.js#answers nothing for an id that names no session - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-link-sessions.queries.integration.spec.js#findLinkSessionByNonceHash - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-link-sessions.queries.integration.spec.js#answers the whole session the presented state names - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-link-sessions.queries.integration.spec.js#answers a session that is no longer live, because the caller decides what a stale one means - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-link-sessions.queries.integration.spec.js#answers nothing for a nonce nobody was ever issued - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-link-sessions.queries.integration.spec.js#listLiveLinkSessions - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-link-sessions.queries.integration.spec.js#answers the live sessions of the user in that pool, newest first, each record whole - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-link-sessions.queries.integration.spec.js#breaks a shared creation instant by descending id, so two sessions opened together always list the same way - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-link-sessions.queries.integration.spec.js#answers an empty list in a pool the user has no session in - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-link-sessions.queries.integration.spec.js#answers an empty list once every session of the user has expired by the execution’s clock - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-link-sessions.queries.integration.spec.js#leaves out a session that was spent, however long it had left to run - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-link-sessions.queries.integration.spec.js#findLiveLinkSessionForEmail (what the pre-sign-up trigger asks) - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-link-sessions.queries.integration.spec.js#answers the newest live session and the whole user it proves, within the trigger’s own pool - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-link-sessions.queries.integration.spec.js#matches the e-mail the user holds whatever case it is presented in - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-link-sessions.queries.integration.spec.js#breaks a shared creation instant by descending id, so it answers the same session every time - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-link-sessions.queries.integration.spec.js#is blind to a session of another pool, which is what keeps one wall out of another - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-link-sessions.queries.integration.spec.js#answers nothing for an expired session, a spent one, and an e-mail nobody in the pool holds - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-link-sessions.queries.integration.spec.js#the record consumeLinkSession answers - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-link-sessions.queries.integration.spec.js#answers the whole row it spent: the outcome, the reason, the moment and the version it moved to - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-link-sessions.queries.integration.spec.js#answers nothing for a replay of a session already spent, and nothing for one that is not there - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-link-sessions.queries.integration.spec.js#answers nothing for a session that expired before the attempt, leaving the row as it was dependency_evidence: >- The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The file declares no substituted collaborators. evidence: - >- services-platform:modules/security/tests/integration/services/persistence/identity-link-sessions.queries.integration.spec.js - >- Static review at the recorded source revision; executable results remain not-run and conformance remains not-verified. binding_note: >- The file has no scenario binding established by this examination. Its executable checks remain registered without assigning them broader acceptance coverage. examiner: codex examined_at: '2026-10-23' final_text: OpenAI dependency_review: provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-link-sessions.queries.integration.spec.js explicit_no_doubles: true identified_double_boundaries: [] --- # Identity link sessions.queries database and service checks ## Verification Boundary The file exercises database or service behavior through the local integration harness. The assertion references identify the source checks for identity link sessions.queries. ## What This Suite Proves The file supplies executable engineering checks for the named subject. No complete acceptance scenario is inferred from the file’s existence. ## What It Does Not Prove This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence. ## Real Dependencies and Test Doubles The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The file declares no substituted collaborators. ## Must Not Be Doubled Keep the queried database, applicable constraints and transaction boundaries real. Provider substitutes cannot establish delivery, cloud execution or cross-service recovery.