--- id: TST-PFM-SEC-210 title: Invite user unit checks kind: unit product_area: platform module: security revision: 2 status: draft source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 repository: services-platform files: - modules/security/tests/unit/services/invitations/invite-user.spec.js implements: - ATS-PFM-SEC-005-01 - ATS-PFM-SEC-008-02 - ATS-PFM-SEC-008-06 environment: mock implementation_state: implemented latest_result: not-run latest_run_at: null latest_run_ref: null conformance: not-verified estimated_minutes: 1 isolation: The suite owns its input fixtures and installed doubles. assertion_evidence: - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/invite-user.spec.js#security capability: invite-user - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/invite-user.spec.js#creates the user and its invitation in one transaction, and answers the user with no token anywhere - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/invite-user.spec.js#creates the user in the wall the route named, which no part of the request can change - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/invite-user.spec.js#creates the invitation without a token: provisioning issues it when it sends the e-mail - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/invite-user.spec.js#provisions the user and its invitation only after the transaction commits, and answers how the e-mail went - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/invite-user.spec.js#expires the invitation 7 days after the execution's clock, on the invitation and on the user - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/invite-user.spec.js#audits the invitation - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/invite-user.spec.js#refuses an invalid e-mail address as ObjectInvalid naming email_address, creating nobody - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/invite-user.spec.js#invites the person under the canonical form of the address it was given - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/invite-user.spec.js#refuses an invitation with no e-mail address, because nothing could ever be delivered - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/invite-user.spec.js#refuses somebody already active in that wall as already_member, and makes nothing - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/invite-user.spec.js#refuses somebody already invited to that wall as already_invited, telling the administrator to resend - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/invite-user.spec.js#names the Rhythm HQ resend route in that refusal when the invitation is a staff one - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/invite-user.spec.js#invites a revoked member back on the row they already have, so their account and history are one - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/invite-user.spec.js#refuses a grant that reaches outside the wall the user is being created in, before a user exists - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/invite-user.spec.js#refuses a member's grant that is not tenant-scoped, or names another tenant - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/invite-user.spec.js#keeps the user and the invitation when the e-mail could not be sent, and says why so the administrator can resend dependency_evidence: >- The production decision runs in-process. The suite substitutes the clock, repository reads or writes where its dependency setup supplies them; those boundaries have no live-service proof here. evidence: - 'services-platform:modules/security/tests/unit/services/invitations/invite-user.spec.js' - >- Static review at the recorded source revision; executable results remain not-run and conformance remains not-verified. binding_note: >- Each binding names the scenario to which this file contributes assertions. A binding is not a recorded pass and does not extend the file’s dependency boundary. examiner: codex examined_at: '2026-10-23' final_text: OpenAI dependency_review: provenance: test source: 'services-platform:modules/security/tests/unit/services/invitations/invite-user.spec.js' explicit_no_doubles: false identified_double_boundaries: - the clock - repository reads or writes --- # Invite user unit checks ## Verification Boundary The file evaluates production helpers with controlled inputs in-process. The assertion references identify the source checks for invite user. ## What This Suite Proves The source assertions support the observations named in the bound scenarios. A scenario spanning multiple files must retain the other files’ contributions. ## What It Does Not Prove This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence. ## Real Dependencies and Test Doubles The production decision runs in-process. The suite substitutes the clock, repository reads or writes where its dependency setup supplies them; those boundaries have no live-service proof here. ## Must Not Be Doubled Keep the production helper, schema, matcher or declaration under examination real. Substituting the decision itself would remove the behavior the assertions exercise.