---
id: TST-PFM-SEC-218
title: Portal identity unit checks
kind: unit
product_area: platform
module: security
revision: 2
status: draft
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
repository: services-platform
files:
  - modules/security/tests/unit/services/portal/portal-identity.spec.ts
implements:
  - ATS-PFM-SEC-019-03
  - ATS-PFM-SEC-019-05
  - ATS-PFM-SEC-019-06
  - ATS-PFM-SEC-019-07
environment: mock
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 1
isolation: The suite owns its input fixtures and installed doubles.
assertion_evidence:
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#portal
      sign-in
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#answers
      an active member the tokens and the UTC instant the access token expires
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#refuses
      an address nobody holds as 401 incorrect_credentials
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#refuses
      a wrong password exactly as it refuses an address nobody holds
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#tells an
      unconfirmed account its address is unverified when the password is right
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#refuses
      an unconfirmed account with a wrong password as incorrect_credentials, never email_unverified
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#refuses
      a disabled pool account as 403 account_disabled
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#refuses
      a suspended member as 403 account_disabled
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#revokes
      the tokens Cognito issued to a revoked member before refusing them
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#refuses
      a member of another tenant as account_disabled
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#makes
      the member of a confirmed account whose confirmation trigger failed, from the id token
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#portal
      sign-up
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#registers
      an unconfirmed account named by a new user id and says the code was e-mailed
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#refuses
      an address a member of the tenant already holds as 409 email_address_taken, asking Cognito
      nothing
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#refuses
      a password the pool policy refuses as 400 password_policy
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#refuses
      an address Cognito already holds as an alias as 409 email_address_taken
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#portal
      password reset
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#answers
      an address nobody holds exactly as it answers a member, having asked Cognito for both
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#answers
      {} when Cognito refuses to start a reset for the address
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#refuses
      a wrong code as 400 verification_code_invalid
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#refuses
      an address nobody holds exactly as it refuses a wrong code
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#refuses
      a new password the pool policy refuses as 400 password_policy
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#portal
      e-mail verification
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#confirms
      the unconfirmed account the client names with the e-mailed code
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#refuses
      a wrong code as 400 verification_code_invalid
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#refuses
      an address no unconfirmed account holds exactly as it refuses a wrong code
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#never
      confirms a user id that does not hold the address
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#resending
      the portal verification code
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#answers
      an address nobody holds exactly as one an unconfirmed account holds, sending only to that
      account
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#a tenant
      without an active portal pool
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#refuses
      an unknown tenant with pool discovery’s 404 record_not_found
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#refuses
      a tenant whose portal pool is suspended exactly as an unknown tenant
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#portal
      sign-out
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#ends
      every session of the caller with their own access token
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts#refuses
      an access token issued to somebody other than the caller, ending no session
dependency_evidence: >-
  The production function, schema or declaration runs over literal inputs. The source declares no
  substituted collaborator; this is an in-process decision or mapping check.
evidence:
  - 'services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts'
  - >-
    Static review at the recorded source revision; executable results remain not-run and conformance
    remains not-verified.
binding_note: >-
  Each binding names the scenario to which this file contributes assertions. A binding is not a
  recorded pass and does not extend the file’s dependency boundary.
examiner: codex
examined_at: '2026-10-23'
final_text: OpenAI
dependency_review:
  provenance: test
  source: 'services-platform:modules/security/tests/unit/services/portal/portal-identity.spec.ts'
  explicit_no_doubles: true
  identified_double_boundaries: []
---
# Portal identity unit checks

## Verification Boundary

The file evaluates production helpers with controlled inputs in-process. The assertion references identify the source checks for portal identity.

## What This Suite Proves

The source assertions support the observations named in the bound scenarios. A scenario spanning multiple files must retain the other files’ contributions.

## What It Does Not Prove

This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence.

## Real Dependencies and Test Doubles

The production function, schema or declaration runs over literal inputs. The source declares no substituted collaborator; this is an in-process decision or mapping check.

## Must Not Be Doubled

Keep the production helper, schema, matcher or declaration under examination real. Substituting the decision itself would remove the behavior the assertions exercise.