---
id: TST-PFM-SEC-209
title: Invitation summary unit checks
kind: unit
product_area: platform
module: security
revision: 2
status: draft
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
repository: services-platform
files:
  - modules/security/tests/unit/services/invitations/invitation-summary.spec.js
implements:
  - ATS-PFM-SEC-005-02
  - ATS-PFM-SEC-005-03
environment: mock
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 1
isolation: The suite owns its input fixtures and installed doubles.
assertion_evidence:
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-summary.spec.js#security
      capability: invitation-summary
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-summary.spec.js#the
      summary of a live invitation
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-summary.spec.js#answers
      the first name, a masked e-mail, the expiry, the organization and the kind of account, and
      nothing else
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-summary.spec.js#names
      the invited person's own customer, and nobody else's
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-summary.spec.js#a
      token that is not live
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-summary.spec.js#refuses
      a malformed token as not found
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-summary.spec.js#never
      looks a malformed token up, so the timing tells a prober nothing
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-summary.spec.js#refuses
      an unknown token as not found
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-summary.spec.js#refuses
      an expired token as expired
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-summary.spec.js#refuses
      a revoked token as revoked
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-summary.spec.js#refuses
      a superseded token as superseded
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-summary.spec.js#refuses
      a spent token as already accepted
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-summary.spec.js#refuses
      a live token whose account has been activated another way as already accepted
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-summary.spec.js#refuses
      a live token whose account has been suspended as revoked
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-summary.spec.js#refuses
      the same way when the token is live but its user has gone
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-summary.spec.js#reads
      no customer at all for a token it refuses, so a refusal discloses nothing
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-summary.spec.js#masking
      an address so its owner recognises it and nobody else can reconstruct it
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-summary.spec.js#keeps
      the first letter of each side and the top-level domain of an ordinary address
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-summary.spec.js#masks
      a one-letter local part and a multi-label domain down to its last label
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-summary.spec.js#masks
      a domain with no dot at all
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/invitations/invitation-summary.spec.js#masks
      an address with no @ entirely, rather than disclosing it
dependency_evidence: >-
  The production decision runs in-process. The suite substitutes the clock where its dependency
  setup supplies them; those boundaries have no live-service proof here.
evidence:
  - 'services-platform:modules/security/tests/unit/services/invitations/invitation-summary.spec.js'
  - >-
    Static review at the recorded source revision; executable results remain not-run and conformance
    remains not-verified.
binding_note: >-
  Each binding names the scenario to which this file contributes assertions. A binding is not a
  recorded pass and does not extend the file’s dependency boundary.
examiner: codex
examined_at: '2026-10-23'
final_text: OpenAI
dependency_review:
  provenance: test
  source: 'services-platform:modules/security/tests/unit/services/invitations/invitation-summary.spec.js'
  explicit_no_doubles: false
  identified_double_boundaries:
    - the clock
---
# Invitation summary unit checks

## Verification Boundary

The file evaluates production helpers with controlled inputs in-process. The assertion references identify the source checks for invitation summary.

## What This Suite Proves

The source assertions support the observations named in the bound scenarios. A scenario spanning multiple files must retain the other files’ contributions.

## What It Does Not Prove

This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence.

## Real Dependencies and Test Doubles

The production decision runs in-process. The suite substitutes the clock where its dependency setup supplies them; those boundaries have no live-service proof here.

## Must Not Be Doubled

Keep the production helper, schema, matcher or declaration under examination real. Substituting the decision itself would remove the behavior the assertions exercise.