---
id: TST-PFM-SEC-187
title: Customer named security routes database and service checks
kind: integration
product_area: platform
module: security
revision: 2
status: draft
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
repository: services-platform
files:
  - >-
    modules/security/tests/integration/services/staff-access/customer-named-security-routes.integration.spec.js
implements:
  - ATS-PFM-SEC-017-12
environment: local
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 3
isolation: Use the prepared test database and suite-owned fixture rows; retain shared seed records.
assertion_evidence:
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/customer-named-security-routes.integration.spec.js#the
      customer-named security routes, through the authorizer: staff in one customer, and that
      customer’s Read Only user
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/customer-named-security-routes.integration.spec.js#gives
      the staff member one customer-level standing grant, in Acme alone, the premise of every case
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/customer-named-security-routes.integration.spec.js#allows
      the permission catalog on the route naming Acme, listing the staff-only keys to a member of
      staff
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/customer-named-security-routes.integration.spec.js#still
      refuses the old catalog route naming no customer, which is the defect the customer route
      replaces
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/customer-named-security-routes.integration.spec.js#resends
      the invitation of an invited console user of Acme
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/customer-named-security-routes.integration.spec.js#suspends
      an active console user of Acme
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/customer-named-security-routes.integration.spec.js#reinstates
      the console user of Acme it suspended
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/customer-named-security-routes.integration.spec.js#revokes
      a console user of Acme
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/customer-named-security-routes.integration.spec.js#refuses
      the same route naming a customer the staff member holds no grant in
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/customer-named-security-routes.integration.spec.js#answers
      404 for Acme’s path naming another customer’s user, as for an id that names nobody
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/customer-named-security-routes.integration.spec.js#allows
      Acme’s Read Only user the catalog, a read-tier key, without the staff-only keys
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/customer-named-security-routes.integration.spec.js#refuses
      Acme’s Read Only user a suspension
  - provenance: test
    source: >-
      services-platform:modules/security/tests/integration/services/staff-access/customer-named-security-routes.integration.spec.js#refuses
      Acme’s Read Only user a role-scope change
dependency_evidence: >-
  The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here.
  The suite controls Cognito, message delivery, workflow execution, the signing key at the declared
  seams; those collaborators remain outside its live proof.
evidence:
  - >-
    services-platform:modules/security/tests/integration/services/staff-access/customer-named-security-routes.integration.spec.js
  - >-
    Static review at the recorded source revision; executable results remain not-run and conformance
    remains not-verified.
binding_note: >-
  Each binding names the scenario to which this file contributes assertions. A binding is not a
  recorded pass and does not extend the file’s dependency boundary.
examiner: codex
examined_at: '2026-10-23'
final_text: OpenAI
dependency_review:
  provenance: test
  source: >-
    services-platform:modules/security/tests/integration/services/staff-access/customer-named-security-routes.integration.spec.js
  explicit_no_doubles: false
  identified_double_boundaries:
    - Cognito
    - message delivery
    - workflow execution
    - the signing key
---
# Customer named security routes database and service checks

## Verification Boundary

The file exercises database or service behavior through the local integration harness. The assertion references identify the source checks for customer named security routes.

## What This Suite Proves

The source assertions support the observations named in the bound scenarios. A scenario spanning multiple files must retain the other files’ contributions.

## What It Does Not Prove

This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence.

## Real Dependencies and Test Doubles

The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The suite controls Cognito, message delivery, workflow execution, the signing key at the declared seams; those collaborators remain outside its live proof.

## Must Not Be Doubled

Keep the queried database, applicable constraints and transaction boundaries real. Provider substitutes cannot establish delivery, cloud execution or cross-service recovery.