--- id: TST-PFM-SEC-152 title: Identity pools.queries database and service checks kind: integration product_area: platform module: security revision: 2 status: draft source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 repository: services-platform files: - >- modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js implements: [] environment: local implementation_state: implemented latest_result: not-run latest_run_at: null latest_run_ref: null conformance: not-verified estimated_minutes: 3 isolation: Use the prepared test database and suite-owned fixture rows; retain shared seed records. assertion_evidence: - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#security persistence reads: identity pools - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#the record registerIdentityPool answers - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#answers every column of the pool it registered, including the clients, the shard and the stack it names - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#leaves out the keys of the wall, the stack and the OAuth domain a console pool never names - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#the record setIdentityPoolStatus answers - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#answers the whole row it moved, with the clients, the domain and the stack the provisioning reported - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#answers the whole retired row, the outputs it was registered with untouched by the retirement - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#getIdentityPool - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#reads back every column of the pool, as the registration answered it - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#reads back a retired pool, which the registry keeps as the record of what existed - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#answers nothing for a pool nobody registered - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#listIdentityPools - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#answers every pool of the environment in ascending id order, each record whole - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#answers the pools of another environment and no others - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#answers every environment’s pools when none is named, still in ascending id order - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#answers an empty list for an environment nobody registered a pool in - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#findPoolByIssuer (the authorizer’s port) - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#answers the trusted pool of a portal issuer: its wall, its region, its clients and its status - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#answers a console issuer with no customer and no tenant key at all - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#answers a suspended pool with its status, so the authorizer refuses it in its own words - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#answers nothing for a retired pool, and nothing for an issuer nobody registered - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#findPoolForWall - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#answers the whole console pool of the environment named - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#answers the whole portal pool of the tenant named, whatever environment is asked for - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#answers a suspended portal pool, because the sign-in refusal belongs to the pool and not to this read - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#answers nothing for a pool that is only reserved, because there is no Cognito pool to target yet - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#answers nothing for a retired portal pool, a tenant with no pool and a console wall of an empty environment - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#listTenantPortalPools - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#answers the tenant’s portal pool whole - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#answers a reservation, which findPoolForWall does not, because deciding whether a portal is on its way reads it - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#answers a retired pool, because a purge removes whatever the registry still holds - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#answers nothing for a tenant no portal pool was registered for - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#findPoolForUser - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#answers the whole console pool of the environment for a console user - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#answers the whole pool of the member’s own tenant for a portal user - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#answers nothing for a member whose tenant’s pool has been retired - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#refuses a user that is not there, rather than answering no pool - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#poolQuotaUsage - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#counts the environment’s pools against the quota, leaving the retired one out - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#answers that another pool may not be created once the count has passed the refusal fraction - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#answers Cognito’s default quota when the caller names none - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#answers no pools at all for an environment nobody registered one in - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#the record reservePortalPool answers - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#answers the whole reservation: the provisional id, the placeholder issuer and no clients yet - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#is read back by the provisional id, so an operator can see a portal that never opened - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#the record completePortalPoolReservation answers - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#answers the renamed row whole: the real pool id, its issuer, its clients and the moment it was registered - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#leaves nothing behind under the provisional id, which is the one moment a registry row changes its key - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#answers the row already registered when there is nothing left to rename, so a replayed step is idempotent - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js#refuses a tenant with neither a reservation nor a registered pool dependency_evidence: >- The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The file declares no substituted collaborators. evidence: - >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js - >- Static review at the recorded source revision; executable results remain not-run and conformance remains not-verified. binding_note: >- The file has no scenario binding established by this examination. Its executable checks remain registered without assigning them broader acceptance coverage. examiner: codex examined_at: '2026-10-23' final_text: OpenAI dependency_review: provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/identity-pools.queries.integration.spec.js explicit_no_doubles: true identified_double_boundaries: [] --- # Identity pools.queries database and service checks ## Verification Boundary The file exercises database or service behavior through the local integration harness. The assertion references identify the source checks for identity pools.queries. ## What This Suite Proves The file supplies executable engineering checks for the named subject. No complete acceptance scenario is inferred from the file’s existence. ## What It Does Not Prove This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence. ## Real Dependencies and Test Doubles The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The file declares no substituted collaborators. ## Must Not Be Doubled Keep the queried database, applicable constraints and transaction boundaries real. Provider substitutes cannot establish delivery, cloud execution or cross-service recovery.