---
id: TST-PFM-SEC-208
title: Invitation email unit checks
kind: unit
product_area: platform
module: security
revision: 2
status: draft
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
repository: services-platform
files:
  - modules/security/tests/unit/services/invitations/invitation-email.spec.js
implements:
  - ATS-PFM-SEC-008-10
environment: mock
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 1
isolation: The suite owns its input fixtures and installed doubles.
assertion_evidence:
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-email.spec.js#security
      capability: invitation-email
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-email.spec.js#the
      acceptance link
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-email.spec.js#is
      the console’s accept-invite screen with the raw token as its only parameter
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-email.spec.js#tolerates
      a trailing slash on the base URL
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-email.spec.js#escapes
      a token that needs it
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-email.spec.js#the
      message an invitation goes out as
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-email.spec.js#comes
      from the configured address under the configured display name
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-email.spec.js#goes
      to the invited person and to nobody else
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-email.spec.js#carries
      the subject the deployed test finds the message by
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-email.spec.js#addresses
      the person by their first name
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-email.spec.js#is
      an HTML message as well as a text one
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-email.spec.js#carries
      the acceptance link in the text body
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-email.spec.js#carries
      the acceptance link as the href of the HTML body
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-email.spec.js#keeps
      the raw token out of the subject
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-email.spec.js#the
      expiry the message names
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-email.spec.js#names
      the expiry date in the text body when the invitation has one
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-email.spec.js#names
      it in the HTML body too
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-email.spec.js#says
      nothing about an expiry when the invitation has none
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-email.spec.js#what
      must not escape into the message
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-email.spec.js#greets
      a person with no first name plainly
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-email.spec.js#escapes
      the angle brackets of a display name into the HTML body
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-email.spec.js#lets
      no raw angle bracket of the display name reach the HTML body
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-email.spec.js#lets
      no newline out of the display name into the From header
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-email.spec.js#strips
      the quote and the newline of an injected display name, leaving one header line
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-email.spec.js#the
      settings the deployed worker reads from its environment
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-email.spec.js#reads
      the console URL and the from-address, trimming a trailing slash off the URL
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-email.spec.js#takes
      a configured display name over the default
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-email.spec.js#refuses
      to run without the from-address
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-email.spec.js#refuses
      to run without the console URL
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-email.spec.js#refuses
      to run with neither variable set
dependency_evidence: >-
  The production function, schema or declaration runs over literal inputs. The source declares no
  substituted collaborator; this is an in-process decision or mapping check.
evidence:
  - 'services-platform:modules/security/tests/unit/services/invitations/invitation-email.spec.js'
  - >-
    Static review at the recorded source revision; executable results remain not-run and conformance
    remains not-verified.
binding_note: >-
  Each binding names the scenario to which this file contributes assertions. A binding is not a
  recorded pass and does not extend the file’s dependency boundary.
examiner: codex
examined_at: '2026-10-23'
final_text: OpenAI
dependency_review:
  provenance: test
  source: 'services-platform:modules/security/tests/unit/services/invitations/invitation-email.spec.js'
  explicit_no_doubles: true
  identified_double_boundaries: []
---
# Invitation email unit checks

## Verification Boundary

The file evaluates production helpers with controlled inputs in-process. The assertion references identify the source checks for invitation email.

## What This Suite Proves

The source assertions support the observations named in the bound scenarios. A scenario spanning multiple files must retain the other files’ contributions.

## What It Does Not Prove

This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence.

## Real Dependencies and Test Doubles

The production function, schema or declaration runs over literal inputs. The source declares no substituted collaborator; this is an in-process decision or mapping check.

## Must Not Be Doubled

Keep the production helper, schema, matcher or declaration under examination real. Substituting the decision itself would remove the behavior the assertions exercise.