--- id: TST-PFM-SEC-166 title: Rules.queries database and service checks kind: integration product_area: platform module: security revision: 2 status: draft source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 repository: services-platform files: - modules/security/tests/integration/services/persistence/rules.queries.integration.spec.js implements: [] environment: local implementation_state: implemented latest_result: not-run latest_run_at: null latest_run_ref: null conformance: not-verified estimated_minutes: 3 isolation: Use the prepared test database and suite-owned fixture rows; retain shared seed records. assertion_evidence: - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.queries.integration.spec.js#security persistence: validating a set of rules against the catalog - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.queries.integration.spec.js#validateRules - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.queries.integration.spec.js#finds nothing wrong with an allow of exact active keys and a deny of a pattern - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.queries.integration.spec.js#names the key the catalog does not have, and the rule it is in - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.queries.integration.spec.js#refuses a key the catalog has retired, which only the live table can tell apart from one it never had - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.queries.integration.spec.js#refuses a pattern in an allow, naming the patterns rather than the whole rule - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.queries.integration.spec.js#allows a staff-only key to be named, because what a rule may grant is the widening rule's question - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.queries.integration.spec.js#answers every problem of every rule at once, so the editor shows them together - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.queries.integration.spec.js#reports a rule the shape itself refuses as one problem, and judges its keys no further - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.queries.integration.spec.js#assertRulesValid - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.queries.integration.spec.js#passes a valid set through without answering anything - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.queries.integration.spec.js#refuses an invalid set with the first problem as its code and every problem in its details - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.queries.integration.spec.js#permissionsGrantedByRole - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.queries.integration.spec.js#answers the role's own allows and those of the policies it references, sorted, with the denies apart - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.queries.integration.spec.js#answers two empty lists for a role that grants nothing, which is not the same as a role that does not exist - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.queries.integration.spec.js#the rule records - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.queries.integration.spec.js#createRule - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.queries.integration.spec.js#answers the rule it wrote whole: its one owner, its keys in the order given and its conditions - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.queries.integration.spec.js#answers a role's inline rule at the position the table defaults it to, with no policy or assignment on it - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.queries.integration.spec.js#answers an assignment's own rule under the assignment alone, the pattern kept exactly as written - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.queries.integration.spec.js#getRule - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.queries.integration.spec.js#reads a rule back exactly as the write answered it, conditions and all - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.queries.integration.spec.js#reads back a rule with no conditions without a `conditions` key at all, rather than a null one - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.queries.integration.spec.js#answers nothing for an id of the right grammar that names no rule - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.queries.integration.spec.js#listRulesOf - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.queries.integration.spec.js#answers a policy's rules in position order, each whole, whatever order they were written in - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.queries.integration.spec.js#answers a role's rules and an assignment's rules under their own owner, and neither the other's - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.queries.integration.spec.js#answers an empty list for an owner that has no rule, and for one that does not exist - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.queries.integration.spec.js#updateRule and deleteRule - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.queries.integration.spec.js#answers the changed rule whole, with the conditions cleared away and the version bumped - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.queries.integration.spec.js#answers nothing for a rule that is not there, and deletes the one that is exactly once - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.queries.integration.spec.js#countOrphanRules - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.queries.integration.spec.js#counts no ownerless rule while owned rules are in the table, and no writer can add one dependency_evidence: >- The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The file declares no substituted collaborators. evidence: - >- services-platform:modules/security/tests/integration/services/persistence/rules.queries.integration.spec.js - >- Static review at the recorded source revision; executable results remain not-run and conformance remains not-verified. binding_note: >- The file has no scenario binding established by this examination. Its executable checks remain registered without assigning them broader acceptance coverage. examiner: codex examined_at: '2026-10-23' final_text: OpenAI dependency_review: provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/rules.queries.integration.spec.js explicit_no_doubles: true identified_double_boundaries: [] --- # Rules.queries database and service checks ## Verification Boundary The file exercises database or service behavior through the local integration harness. The assertion references identify the source checks for rules.queries. ## What This Suite Proves The file supplies executable engineering checks for the named subject. No complete acceptance scenario is inferred from the file’s existence. ## What It Does Not Prove This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence. ## Real Dependencies and Test Doubles The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The file declares no substituted collaborators. ## Must Not Be Doubled Keep the queried database, applicable constraints and transaction boundaries real. Provider substitutes cannot establish delivery, cloud execution or cross-service recovery.