--- id: TST-PFM-SEC-165 title: Rules database and service checks kind: integration product_area: platform module: security revision: 2 status: draft source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 repository: services-platform files: - modules/security/tests/integration/services/persistence/rules.integration.spec.js implements: [] environment: local implementation_state: implemented latest_result: not-run latest_run_at: null latest_run_ref: null conformance: not-verified estimated_minutes: 3 isolation: Use the prepared test database and suite-owned fixture rows; retain shared seed records. assertion_evidence: - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.integration.spec.js#security persistence: security_rules - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.integration.spec.js#createRule - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.integration.spec.js#records a policy's rule: its effect, its keys, where it sits and nothing it does not have - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.integration.spec.js#records a role's inline rule and an assignment's own, each under its one owner - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.integration.spec.js#stores conditions that parse as the condition language, which is the only JSON in the model - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.integration.spec.js#refuses a condition that is not the condition language, writing nothing - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.integration.spec.js#refuses a zone no clock can be read in, which only the evaluator can tell, writing nothing - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.integration.spec.js#refuses no permissions, too many, a blank one and the same one twice - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.integration.spec.js#refuses an owner that does not exist - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.integration.spec.js#the ownership rule: exactly one owner - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.integration.spec.js#refuses a row with no owner at all, which is the CHECK speaking - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.integration.spec.js#refuses a row with two owners - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.integration.spec.js#leaves no rule in the database without an owner, which is what the CHECK is for - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.integration.spec.js#states the same rules as a pure function, so the administration layer can ask before it writes - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.integration.spec.js#the reads, updating and deleting - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.integration.spec.js#reads a rule by id and an owner’s rules in position order - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.integration.spec.js#changes an effect, a key list, a position and clears the conditions, bumping the version - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.integration.spec.js#refuses an update that would break the rules, leaving the rule as it was - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.integration.spec.js#deletes a rule and says whether there was one to delete - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.integration.spec.js#deletes an owner’s rules with the owner, because they are the owner’s - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.integration.spec.js#setRulesOf - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.integration.spec.js#replaces the whole set in one transaction and numbers the positions as given - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.integration.spec.js#clears the set when given none, and refuses the whole set when one rule is invalid dependency_evidence: >- The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The suite’s own dependency setup determines which external collaborators are controlled; registration alone does not certify them as live. evidence: - >- services-platform:modules/security/tests/integration/services/persistence/rules.integration.spec.js - >- Static review at the recorded source revision; executable results remain not-run and conformance remains not-verified. binding_note: >- The file has no scenario binding established by this examination. Its executable checks remain registered without assigning them broader acceptance coverage. examiner: codex examined_at: '2026-10-23' final_text: OpenAI dependency_review: provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.integration.spec.js explicit_no_doubles: false identified_double_boundaries: [] --- # Rules database and service checks ## Verification Boundary The file exercises database or service behavior through the local integration harness. The assertion references identify the source checks for rules. ## What This Suite Proves The file supplies executable engineering checks for the named subject. No complete acceptance scenario is inferred from the file’s existence. ## What It Does Not Prove This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence. ## Real Dependencies and Test Doubles The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The suite’s own dependency setup determines which external collaborators are controlled; registration alone does not certify them as live. ## Must Not Be Doubled Keep the queried database, applicable constraints and transaction boundaries real. Provider substitutes cannot establish delivery, cloud execution or cross-service recovery.