--- id: TST-PFM-SEC-164 title: Roles.queries database and service checks kind: integration product_area: platform module: security revision: 2 status: draft source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 repository: services-platform files: - modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js implements: [] environment: local implementation_state: implemented latest_result: not-run latest_run_at: null latest_run_ref: null conformance: not-verified estimated_minutes: 3 isolation: Use the prepared test database and suite-owned fixture rows; retain shared seed records. assertion_evidence: - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#security persistence: the security_roles reads - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#getRole and findRoleByProductKey - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#answers a customer's role with every column it has, including the scope it advertises - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#leaves out every column the row does not have, rather than answering null for it - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#answers what a copy was copied from, and nothing for an id that names no role - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#answers a built-in by the reconciler's stable key, archived or not, and nothing for a key nobody published - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#listRoles: the customer scope - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#answers the customer's own active roles and Rhythm's active built-ins, in name order, each whole - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#leaves out an archived product role, the row a raw disjunction leaks - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#leaves out the customer's own archived role and every other customer's - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#answers the customer's archived roles and Rhythm's when they are asked for, still in name order - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#answers another customer only its own role beside Rhythm's, which is how the scope isolates them - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#listRoles: the product and the unscoped list - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#answers Rhythm's active built-ins alone, and no customer's role - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#answers every role of every owner, archived ones included, when both are asked for - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#the attachment reads - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#answers a role's active policies in name order, whole, leaving out the one that has been archived - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#answers an empty list for a role that references nothing - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#answers the roles that reference a policy, in id order, and none for one nothing references - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#names the roles that reference a policy, which is what a refusal and a retirement warning have to say - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#answers a built-in's product key, which is how a reference to it is built - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#listRolesPage - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#answers the customer's own and Rhythm's in name order, whole, with the cursor of the next page - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#answers the rest of the list after that cursor, and names no next page at the end of it - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#narrows to Rhythm's built-ins, and to a search of the name whatever case it is typed in - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#leaves out the archived rows of both owners until they are asked for - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#answers another customer nothing of this one's, however it is paged - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#listRolesPage: the member count of a row - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#counts each person once however many live grants name the role, and leaves out a revoked grant - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#listRolesPage and roleGrantsNothing: the placeholder role - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#answers on the list which roles grant nothing: the empty, the deny-only and the archived-policy role - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#answers the same of each role when its record is read on its own - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#answers, of a batch of roles, exactly the ones that grant nothing - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#answers an empty batch with nothing, sending no statement - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#stops answering grants-nothing once the empty role is given an allow rule - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#copiedSourceOfRole - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#answers the source's reference, name, the version copied and the source's version today - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#answers the id with no name for a source that is no longer there, and nothing at all for a role that was not copied - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#resolveRoleReference - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#answers the built-in a key names, whole - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#answers the customer's own role an id names, whole - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#refuses a built-in key nobody published, and offers the near keys there are - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#refuses a built-in key the catalog has retired, saying so rather than saying it never existed - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#refuses another customer's role, and a built-in named as if it were the customer's own, as not found - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#security persistence: listGrantableTenantRoles, the roles a staff access grant may carry - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#answers the built-in console roles, then the customer's own active custom roles, each by name - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#orders the built-ins by name among themselves - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#answers each role as the role persistence maps it - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#never answers another customer's custom role - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#never answers the HQ staff roles - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#leaves out a staff role by its product key even when it is not marked for platform scope - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#leaves out any role meant for platform scope, built-in or custom - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#leaves out archived roles, built-in or custom - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#security persistence: listGrantableTenantRoles at its maximum - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#answers exactly 200 roles, the maximum - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#keeps the built-ins and cuts the last custom roles by name - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#security persistence: the staff-only built-in roles a customer never reads - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#names the seeded staff roles and the role granting only staff-only keys as staff-only, and no other - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#leaves every staff-only role out of a customer's roles page and keeps the customer's built-ins and the mixed role - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#answers Rhythm's own customer every staff-only role on its roles page - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#refuses a staff-only role named by its built-in key as not found, never as unknown or retired - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#still resolves the mixed role and a customer built-in by their keys for a customer - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#resolves a staff-only role by its key for Rhythm's own customer, where the staff are granted it - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#never offers a staff-only key among the near matches of a mistyped one - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js#leaves a role staff-only by its keys alone out of the roles a staff access grant may carry dependency_evidence: >- The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The file declares no substituted collaborators. evidence: - >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js - >- Static review at the recorded source revision; executable results remain not-run and conformance remains not-verified. binding_note: >- The file has no scenario binding established by this examination. Its executable checks remain registered without assigning them broader acceptance coverage. examiner: codex examined_at: '2026-10-23' final_text: OpenAI dependency_review: provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/roles.queries.integration.spec.js explicit_no_doubles: true identified_double_boundaries: [] --- # Roles.queries database and service checks ## Verification Boundary The file exercises database or service behavior through the local integration harness. The assertion references identify the source checks for roles.queries. ## What This Suite Proves The file supplies executable engineering checks for the named subject. No complete acceptance scenario is inferred from the file’s existence. ## What It Does Not Prove This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence. ## Real Dependencies and Test Doubles The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The file declares no substituted collaborators. ## Must Not Be Doubled Keep the queried database, applicable constraints and transaction boundaries real. Provider substitutes cannot establish delivery, cloud execution or cross-service recovery.