---
id: TST-PFM-SEC-205
title: Accept invitation unit checks
kind: unit
product_area: platform
module: security
revision: 2
status: draft
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
repository: services-platform
files:
  - modules/security/tests/unit/services/invitations/accept-invitation.spec.js
implements:
  - ATS-PFM-SEC-005-03
  - ATS-PFM-SEC-005-04
  - ATS-PFM-SEC-005-05
  - ATS-PFM-SEC-005-11
environment: mock
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 1
isolation: The suite owns its input fixtures and installed doubles.
assertion_evidence:
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js#security
      capability: accept-invitation
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js#sets
      the chosen password in Cognito, then accepts, activates and makes the pending roles real in
      one transaction
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js#enables
      the pool account before setting the password, so a revoked person brought back can sign in
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js#reports
      no success when the pool account cannot be enabled, and leaves the invitation unspent for a
      retry
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js#acts
      and audits as the invited person, not as the anonymous caller that reached the route
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js#counts
      the presentation of the token whatever comes of it
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js#answers
      a malformed and an unknown token identically, without auditing a user nobody has identified
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js#answers
      an expired, a revoked and a superseded token with the same sentence, and records which it was
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js#answers
      a token spent by a concurrent acceptance with the same sentence, so only one acceptance wins
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js#answers
      a reused token as the success it already was, without touching Cognito again
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js#refuses
      a spent token whose user never became active, which is not an acceptance that happened
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js#completes
      on a retry after the database failed behind a successful Cognito call
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js#tells
      a disabled or already-active account about the account, once the token is known to be genuine
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js#refuses
      an account whose Cognito user does not exist yet, and an empty password
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js#passes
      Cognito's refusal of the password through, and leaves the invitation unspent
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js#the
      inviter’s authority, re-checked at acceptance
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js#judges
      the pending assignments again, as the inviter, against the grants they hold now
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js#activates
      nothing when the inviter may no longer grant what they offered, and spends no token
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js#records
      the real reason in the trail, which the person is deliberately not told
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js#refuses
      an invitation whose inviter is no longer a user at all
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js#asks
      nothing of an invitation that grants nothing
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js#refuses
      grants an invitation carries with neither an inviter to judge nor a named exemption
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js#lets
      through the invitation that records the exemption it was issued under, asking the rule nothing
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js#never
      writes the token or the password to a log line
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js#refuses
      a portal caller nothing special: the token, not the caller, is the authorization
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js#the
      code beside the sentence
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js#names
      a malformed token as not found
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js#names
      an unknown token as not found
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js#names
      an expired token as expired
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js#names
      a revoked token as revoked
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js#names
      a superseded token as superseded
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js#names
      a spent token whose user never became active as already accepted
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js#names
      a token spent by a concurrent acceptance as already accepted
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js#leaves
      a spent token of an active user a success, with no code at all
dependency_evidence: >-
  The production decision runs in-process. The suite substitutes Cognito, the clock where its
  dependency setup supplies them; those boundaries have no live-service proof here.
evidence:
  - 'services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js'
  - >-
    Static review at the recorded source revision; executable results remain not-run and conformance
    remains not-verified.
binding_note: >-
  Each binding names the scenario to which this file contributes assertions. A binding is not a
  recorded pass and does not extend the file’s dependency boundary.
examiner: codex
examined_at: '2026-10-23'
final_text: OpenAI
dependency_review:
  provenance: test
  source: 'services-platform:modules/security/tests/unit/services/invitations/accept-invitation.spec.js'
  explicit_no_doubles: false
  identified_double_boundaries:
    - Cognito
    - the clock
---
# Accept invitation unit checks

## Verification Boundary

The file evaluates production helpers with controlled inputs in-process. The assertion references identify the source checks for accept invitation.

## What This Suite Proves

The source assertions support the observations named in the bound scenarios. A scenario spanning multiple files must retain the other files’ contributions.

## What It Does Not Prove

This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence.

## Real Dependencies and Test Doubles

The production decision runs in-process. The suite substitutes Cognito, the clock where its dependency setup supplies them; those boundaries have no live-service proof here.

## Must Not Be Doubled

Keep the production helper, schema, matcher or declaration under examination real. Substituting the decision itself would remove the behavior the assertions exercise.