OptionalCreatedID of the fixture Company created over the wire when the table was empty (deleted after the employee).
IDs of rows created over the wire by the write-path checks, deleted in teardown.
IDs of the minted MJ: API Keys rows, deleted (after their usage logs) in teardown.
IDs of the MJ: API Key Scopes rules granting the minted keys full_access (deleted before the keys).
OptionalDenierRow ID of the denier role's write-denied field rule, restored in teardown.
The FLS target entity name ('MJ: Employees').
OptionalFixtureID of the fixture Employee row created over the wire by the writer identity.
OptionalMultiSecondary GraphQL provider for the seeded MULTI-role user — entity-level create/update via the Writer role, plus a field-level write denial via the Denier role. The only identity that can reach field-level create suppression and update refusal over the wire; a read-only one is stopped by the entity gate first. Absent when the multi user is not seeded, which skips the write-path checks rather than failing them.
OptionalProvisionSet when the seed was present but wire provisioning FAILED — a product bug, not a skip.
OptionalReaderID of the reader role's Email permission row (tightened to Deny; restored in teardown).
OptionalReaderSecondary GraphQL provider authenticated as the seeded restricted reader (user API key).
OptionalReasonWhy the fixture is unusable (seed absent / entity pre-configured), when Usable is false.
True iff seeded users resolved over the wire, the entity was FLS-disabled, and provisioning succeeded.
OptionalWriterSecondary GraphQL provider authenticated as the seeded unrestricted writer (user API key).
Fixture for the
fls-enforcement-clientbundle (client transport, needs MJAPI): the over-the-wire Field-Level Security leg. The lifecycle provisions everything THROUGH the wire as the system-key identity — enables field security on the target entity (the snapshot runs inside MJAPI), tightens the reader role's Email rule, mints one user API key each for the seeded reader and writer users, and builds two secondary GraphQLDataProvider connections authenticated AS those users. That gives genuinely restricted/unrestricted WIRE identities — a passed contextUser cannot change what the server returns (see RLS7's notes), so per-user enforcement over the wire is only observable through per-user authentication.