--- id: TST-PFM-SEC-213 title: Widening unit checks kind: unit product_area: platform module: security revision: 2 status: draft source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 repository: services-platform files: - modules/security/tests/unit/services/invitations/widening.spec.ts implements: - ATS-PFM-SEC-008-05 - ATS-PFM-SEC-010-02 environment: mock implementation_state: implemented latest_result: not-run latest_run_at: null latest_run_ref: null conformance: not-verified estimated_minutes: 1 isolation: The suite owns its input fixtures and installed doubles. assertion_evidence: - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#the widening rule - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#whether one pattern covers another - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#reads a short pattern as the wildcards it means, so a module-wide allow covers every key in it - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#refuses the comparison in the other direction: a single key never covers the module it is in - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#answers false for anything that is not a three-segment key, rather than guessing at it - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#how a scope is read and named - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#asks the evaluator about the scope being granted, at the level that scope lives at - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#names a scope in a refusal without naming anybody else, which is all a refusal may say - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#what it refuses before reading a role - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#passes an empty request through: an invitation with no assignments grants nothing to widen - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#refuses a caller granting to their own user, whatever they hold - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#refuses a scope the caller does not manage, and says which scope rather than which role - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#lists every bad scope at once, so an administrator fixes the invitation in one go - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#refuses a caller whose managing assignment is not active, because the evaluator decides, not the row - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#which keys a rule edit frees - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#reads an added allow as the keys it adds, and an unchanged one as nothing - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#reads a removed deny as the keys it was holding back, pattern and all - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#reads a removed allow and an added deny as nothing freed, because narrowing is not widening - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#reads a deny still denying the key under a wider pattern as nothing freed - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#which keys a weakened deny frees - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#frees nothing when the deny is stored again exactly as it was - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#frees nothing when a condition is removed, because an unconditional deny applies more often - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#frees the key when a condition is added, because the deny then applies in fewer places - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#frees the key when a condition's value changes, which is the relaxation the rule exists for - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#frees nothing when the same conditions are stored in another order, or their lists are - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#frees the key when a condition is one nothing can compare it to, rather than reading it as narrowing - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#frees the key when the deny's validity window is shortened at either end - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#frees nothing when the window is extended, or lifted altogether - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#frees nothing when one deny is split into two that each keep its conditions - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#frees only the key whose deny was weakened, when a split changes one half of it - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#reads a deny as strong enough when any one of the after-denies holds the key as tightly - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#whether an amended assignment still applies as widely - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#reads a scope that contains the stored one as applying at least as widely - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#reads a scope moved anywhere outside the stored one as narrowing it - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#reads a window or a condition tightened on an unmoved grant as narrowing it - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#a definition edit judged by the same rule - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#passes an edit that frees no key, whoever holds the definition: narrowing needs only the management key - provenance: test source: >- services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts#refuses an edit that reaches the editor's own grant, whatever they hold and whoever else holds it dependency_evidence: >- The file exercises its imported production code with controlled inputs. Source inspection identifies the test entry and assertions; it does not establish a live database, provider or deployed workflow. evidence: - 'services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts' - >- Static review at the recorded source revision; executable results remain not-run and conformance remains not-verified. binding_note: >- Each binding names the scenario to which this file contributes assertions. A binding is not a recorded pass and does not extend the file’s dependency boundary. examiner: codex examined_at: '2026-10-23' final_text: OpenAI dependency_review: provenance: test source: 'services-platform:modules/security/tests/unit/services/invitations/widening.spec.ts' explicit_no_doubles: false identified_double_boundaries: [] --- # Widening unit checks ## Verification Boundary The file evaluates production helpers with controlled inputs in-process. The assertion references identify the source checks for widening. ## What This Suite Proves The source assertions support the observations named in the bound scenarios. A scenario spanning multiple files must retain the other files’ contributions. ## What It Does Not Prove This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence. ## Real Dependencies and Test Doubles The file exercises its imported production code with controlled inputs. Source inspection identifies the test entry and assertions; it does not establish a live database, provider or deployed workflow. ## Must Not Be Doubled Keep the production helper, schema, matcher or declaration under examination real. Substituting the decision itself would remove the behavior the assertions exercise.