--- id: TST-PFM-SEC-183 title: Licensed applications database and service checks kind: integration product_area: platform module: security revision: 2 status: draft source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 repository: services-platform files: - >- modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js implements: [] environment: local implementation_state: implemented latest_result: not-run latest_run_at: null latest_run_ref: null conformance: not-verified estimated_minutes: 3 isolation: Use the prepared test database and suite-owned fixture rows; retain shared seed records. assertion_evidence: - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#security capability: the applications the licence mode offers - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#with the mode off, as an environment that has not been told anything runs it - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#offers the application in the tenant it is not licensed in, which is what today’s console shows - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#allows the application’s own key there too: nothing weighs the licence - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#with the mode in shadow, as every environment deploys it - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#answers exactly what `off` answered, in the tenant the application is not licensed in - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#allows the same keys as well, so nobody’s access changes when the mode is deployed - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#with the mode enforcing, which tests alone ask for - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#offers the application in the tenant the licence grant and the operational row make it available in - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#drops it from the tenant it is not licensed in, and keeps Platform, which the step exempts - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#allows no key of it there either, because the licence step refuses them - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#withholds a licensed application from a person who does not hold its access key - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#still allows that person the key they were granted in it: the licence is there, the application is not theirs - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#with the application access step enforcing too, as every environment deploys it - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#offers the application to the person who holds its access key, the premise of the two refusals below - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#does not offer it to the person an administrator has DENIED the access key - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#allows that person none of its keys either, because the step refuses every key of an application they may not open - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#still offers them Platform, which the step exempts, so they can read their own context and be told why - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#answers the refresh the console makes exactly as the document does, so neither can disagree with the other - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#leaves the person who was never granted the access key where the licence mode alone left them: offered nothing of it - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#allows that person none of its keys either, which is what enforcing the step adds to enforcing the licence - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#an application the catalog has no permission of - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#has no permission in the catalog the document is judged against, which is what the rule is about (premise) - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#offers it, by the registry’s name, in the tenant its grant and operational row make it available in - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#does not offer it in the tenant a withhold override takes it away in, which is the licence becoming visible - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#offers it in that withheld tenant all the same while the mode is shadow, which takes nothing away - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#offers it to a person nobody has granted anything of it, because there is no key of it to grant - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#answers the launcher refresh the same way, so a refreshing console is told what the boot call said - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#a member of Rhythm’s staff entering the tenant through a customer-level grant - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#evaluates the document in the tenant the grant reaches, which the console asked for (premise) - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#offers the keyless application the tenant is licensed for, as the tenant’s own administrator is offered it - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#does not offer it in the tenant a withhold takes it away in, so the licence still decides - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#answers the launcher refresh the same applications as the document - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#the features the document publishes - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#is empty, because no feature entitlement is published yet - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#getMyApplications, the refresh the console makes after a refusal - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#answers the two fields of the document and nothing else - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#drops the unlicensed application exactly as the document does, so a refreshing console is told the same thing - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#the modes the deployed functions are given - provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js#leaves the process environment as it found it, so no other suite inherits a mode dependency_evidence: >- The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The file declares no substituted collaborators. evidence: - >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js - >- Static review at the recorded source revision; executable results remain not-run and conformance remains not-verified. binding_note: >- The file has no scenario binding established by this examination. Its executable checks remain registered without assigning them broader acceptance coverage. examiner: codex examined_at: '2026-10-23' final_text: OpenAI dependency_review: provenance: test source: >- services-platform:modules/security/tests/integration/services/security-context/licensed-applications.integration.spec.js explicit_no_doubles: true identified_double_boundaries: [] --- # Licensed applications database and service checks ## Verification Boundary The file exercises database or service behavior through the local integration harness. The assertion references identify the source checks for licensed applications. ## What This Suite Proves The file supplies executable engineering checks for the named subject. No complete acceptance scenario is inferred from the file’s existence. ## What It Does Not Prove This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence. ## Real Dependencies and Test Doubles The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The file declares no substituted collaborators. ## Must Not Be Doubled Keep the queried database, applicable constraints and transaction boundaries real. Provider substitutes cannot establish delivery, cloud execution or cross-service recovery.