--- id: TST-PFM-SEC-184 title: HQ service principals routes database and service checks kind: integration product_area: platform module: security revision: 2 status: draft source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 repository: services-platform files: - >- modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js implements: - ATS-PFM-SEC-018-01 - ATS-PFM-SEC-018-02 - ATS-PFM-SEC-018-03 environment: local implementation_state: implemented latest_result: not-run latest_run_at: null latest_run_ref: null conformance: not-verified estimated_minutes: 3 isolation: Use the prepared test database and suite-owned fixture rows; retain shared seed records. assertion_evidence: - provenance: test source: >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#Rhythm HQ's service-principal routes (through the dispatcher) - provenance: test source: >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#GET /hq/service-principals - provenance: test source: >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#answers a staff reader 200 with every principal, this suite’s among them with its kind and status - provenance: test source: >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#refuses a customer's administrator 403, holding every key of their own customer - provenance: test source: >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#refuses an anonymous call 401 - provenance: test source: >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#POST /hq/service-principals/{id}/suspend, then /resume - provenance: test source: >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#answers the suspension 200 with the principal suspended, at version 2 - provenance: test source: >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#stores it suspended - provenance: test source: >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#records the suspension: the staff member, Rhythm’s customer, narrowing, from active to suspended - provenance: test source: >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#answers a second suspension 200 and records nothing more, the principal being suspended already - provenance: test source: >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#and the resumption - provenance: test source: >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#answers 200 with the principal active, at version 3 - provenance: test source: >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#stores it active - provenance: test source: >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#records the resumption as widening, from suspended to active - provenance: test source: >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#the refusals of the two writes - provenance: test source: >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#answers an id no principal holds 404 - provenance: test source: >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#records the refused suspension of that id, naming the staff member - provenance: test source: >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#writes no principal for that id - provenance: test source: >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#answers an id outside the registry’s grammar 400 - provenance: test source: >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#refuses a staff member who holds the read and not the manage 403 - provenance: test source: >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#refuses a customer's administrator 403 - provenance: test source: >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js#leaves the principal active after every refusal dependency_evidence: >- The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The suite controls the signing key at the declared seams; those collaborators remain outside its live proof. evidence: - >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js - >- Static review at the recorded source revision; executable results remain not-run and conformance remains not-verified. binding_note: >- Each binding names the scenario to which this file contributes assertions. A binding is not a recorded pass and does not extend the file’s dependency boundary. examiner: codex examined_at: '2026-10-23' final_text: OpenAI dependency_review: provenance: test source: >- services-platform:modules/security/tests/integration/services/service-principals/hq-service-principals-routes.integration.spec.js explicit_no_doubles: false identified_double_boundaries: - the signing key --- # HQ service principals routes database and service checks ## Verification Boundary The file exercises database or service behavior through the local integration harness. The assertion references identify the source checks for HQ service principals routes. ## What This Suite Proves The source assertions support the observations named in the bound scenarios. A scenario spanning multiple files must retain the other files’ contributions. ## What It Does Not Prove This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence. ## Real Dependencies and Test Doubles The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The suite controls the signing key at the declared seams; those collaborators remain outside its live proof. ## Must Not Be Doubled Keep the queried database, applicable constraints and transaction boundaries real. Provider substitutes cannot establish delivery, cloud execution or cross-service recovery.