@tellescope/schema 1.253.0 → 1.254.0

package/lib/cjs/schema.js

@@ -10,6 +10,15 @@ var __assign = (this && this.__assign) || function () {
     };
     return __assign.apply(this, arguments);
 };
+var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
+    if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
+        if (ar || !(i in from)) {
+            if (!ar) ar = Array.prototype.slice.call(from, 0, i);
+            ar[i] = from[i];
+        }
+    }
+    return to.concat(ar || Array.prototype.slice.call(from));
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.schema = exports.build_schema = exports.UNIQUE_LIST_FIELDS = exports.get_next_reminder_timestamp_for_ticket = void 0;
 var types_models_1 = require("@tellescope/types-models");
@@ -189,9 +198,10 @@ exports.schema = (0, exports.build_schema)({
             add_to_journey: {}, remove_from_journey: {}, begin_login_flow: {}, set_password: {},
             unsubscribe: {},
         },
-        fields: __assign(__assign({}, BuiltInFields), { recentViewers: { validator: validation_1.recentViewersValidator }, healthie_dietitian_id: { validator: validation_1.stringValidator100 }, mergedIds: { validator: validation_1.listOfMongoIdStringValidatorOptionalOrEmptyOk, readonly: true, redactions: ['enduser'] }, externalId: {
+        fields: __assign(__assign({}, BuiltInFields), { sharedWithOrganizations: __assign(__assign({}, BuiltInFields.sharedWithOrganizations), { enduserUpdatesDisabled: true }), recentViewers: { validator: validation_1.recentViewersValidator }, healthie_dietitian_id: { validator: validation_1.stringValidator100, enduserUpdatesDisabled: true }, mergedIds: { validator: validation_1.listOfMongoIdStringValidatorOptionalOrEmptyOk, readonly: true, redactions: ['enduser'] }, externalId: {
                 validator: validation_1.stringValidator250,
                 examples: ['addfed3e-ddea-415b-b52b-df820c944dbb'],
+                enduserUpdatesDisabled: true,
             }, email: {
                 validator: validation_1.emailValidatorEmptyOkay,
                 examples: ['test@tellescope.com'],
@@ -233,6 +243,7 @@ exports.schema = (0, exports.build_schema)({
             }, journeys: {
                 validator: validation_1.journeysValidator,
                 redactions: ['enduser'],
+                enduserUpdatesDisabled: true,
                 dependencies: [
                     {
                         dependsOn: ['journeys'],
@@ -249,14 +260,17 @@ exports.schema = (0, exports.build_schema)({
             }, scheduledJourneys: { validator: validation_1.scheduledJourneysValidator }, tags: {
                 redactions: ['enduser'],
                 validator: validation_1.listOfStringsValidatorUniqueOptionalOrEmptyOkay,
+                enduserUpdatesDisabled: true,
             }, accessTags: {
                 redactions: ['enduser'],
                 validator: validation_1.listOfStringsValidatorEmptyOk,
+                enduserUpdatesDisabled: true,
             }, unredactedTags: {
                 validator: validation_1.listOfStringsValidatorEmptyOk,
             }, fields: {
                 redactions: ['enduser'],
                 validator: validation_1.fieldsValidator,
+                enduserUpdatesDisabled: true, // intake forms write fields server-side; direct enduser PATCH is not a supported path
             }, unredactedFields: {
                 validator: validation_1.fieldsValidator,
             }, preference: {
@@ -265,12 +279,15 @@ exports.schema = (0, exports.build_schema)({
             }, assignedTo: {
                 redactions: ['enduser'],
                 validator: validation_1.listOfUniqueStringsValidatorEmptyOk,
+                enduserUpdatesDisabled: true,
             }, primaryAssignee: {
                 validator: validation_1.mongoIdStringRequired,
                 redactions: ['enduser'],
+                enduserUpdatesDisabled: true,
             }, unread: {
                 redactions: ['enduser'],
                 validator: validation_1.booleanValidator,
+                enduserUpdatesDisabled: true,
             }, lastActive: {
                 validator: validation_1.dateValidator,
             }, lastLogout: { validator: validation_1.dateValidator }, invalidateSessionsBefore: { validator: validation_1.dateValidator }, termsSigned: { validator: validation_1.dateValidator }, termsVersion: { validator: validation_1.stringValidator100 }, lastCommunication: {
@@ -293,12 +310,12 @@ exports.schema = (0, exports.build_schema)({
                 // ]
             }, 
             // should allow any gender via API but our UI can limit to Tellescope types by default
-            gender: { validator: validation_1.stringValidator, redactions: ['enduser'] }, genderIdentity: { validator: validation_1.stringValidator100, redactions: ['enduser'] }, pronouns: { validator: validation_1.stringValidator100, redactions: ['enduser'] }, height: { validator: validation_1.genericUnitWithQuantityValidator, redactions: ['enduser'] }, weight: { validator: validation_1.genericUnitWithQuantityValidator, redactions: ['enduser'] }, source: { validator: validation_1.stringValidator1000Optional }, addressLineOne: { validator: validation_1.stringValidator5000EmptyOkay, redactions: ['enduser'] }, addressLineTwo: { validator: validation_1.stringValidator5000EmptyOkay, redactions: ['enduser'] }, city: { validator: validation_1.stringValidator5000EmptyOkay, redactions: ['enduser'] }, state: { validator: validation_1.stateValidator, redactions: ['enduser'] }, zipCode: { validator: validation_1.stringValidator25000EmptyOkay, redactions: ['enduser'] }, zipPlusFour: { validator: validation_1.stringValidator100, redactions: ['enduser'] }, timezone: { validator: validation_1.timezoneValidator }, humanReadableId: { validator: validation_1.stringValidator100 }, displayName: { validator: validation_1.stringValidator250 }, unsubscribedFromPortalChatNotifications: { validator: validation_1.booleanValidator }, triggeredEvents: { validator: (0, validation_1.objectAnyFieldsValidator)(validation_1.numberValidator) }, customTypeId: { validator: validation_1.mongoIdStringRequired }, language: { validator: validation_1.languageValidator }, relationships: {
+            gender: { validator: validation_1.stringValidator, redactions: ['enduser'] }, genderIdentity: { validator: validation_1.stringValidator100, redactions: ['enduser'] }, pronouns: { validator: validation_1.stringValidator100, redactions: ['enduser'] }, height: { validator: validation_1.genericUnitWithQuantityValidator, redactions: ['enduser'] }, weight: { validator: validation_1.genericUnitWithQuantityValidator, redactions: ['enduser'] }, source: { validator: validation_1.stringValidator1000Optional, enduserUpdatesDisabled: true }, addressLineOne: { validator: validation_1.stringValidator5000EmptyOkay, redactions: ['enduser'] }, addressLineTwo: { validator: validation_1.stringValidator5000EmptyOkay, redactions: ['enduser'] }, city: { validator: validation_1.stringValidator5000EmptyOkay, redactions: ['enduser'] }, state: { validator: validation_1.stateValidator, redactions: ['enduser'] }, zipCode: { validator: validation_1.stringValidator25000EmptyOkay, redactions: ['enduser'] }, zipPlusFour: { validator: validation_1.stringValidator100, redactions: ['enduser'] }, timezone: { validator: validation_1.timezoneValidator }, humanReadableId: { validator: validation_1.stringValidator100 }, displayName: { validator: validation_1.stringValidator250 }, unsubscribedFromPortalChatNotifications: { validator: validation_1.booleanValidator }, triggeredEvents: { validator: (0, validation_1.objectAnyFieldsValidator)(validation_1.numberValidator) }, customTypeId: { validator: validation_1.mongoIdStringRequired, enduserUpdatesDisabled: true }, language: { validator: validation_1.languageValidator }, relationships: {
                 validator: (0, validation_1.listValidatorOptionalOrEmptyOk)((0, validation_1.objectValidator)({
                     id: validation_1.mongoIdStringRequired,
                     type: validation_1.stringValidator100,
                 }))
-            }, markedReadAt: { validator: validation_1.dateOptionalOrEmptyStringValidator }, markedUnreadAt: { validator: validation_1.dateOptionalOrEmptyStringValidator }, note: { validator: validation_1.stringValidator25000EmptyOkay, redactions: ['enduser'] }, noteIsFlagged: { validator: validation_1.booleanValidator }, insurance: { validator: validation_1.insuranceOptionalValidator, redactions: ['enduser'] }, insuranceSecondary: { validator: validation_1.insuranceOptionalValidator, redactions: ['enduser'] }, bookingNotes: {
+            }, markedReadAt: { validator: validation_1.dateOptionalOrEmptyStringValidator }, markedUnreadAt: { validator: validation_1.dateOptionalOrEmptyStringValidator }, note: { validator: validation_1.stringValidator25000EmptyOkay, redactions: ['enduser'], enduserUpdatesDisabled: true }, noteIsFlagged: { validator: validation_1.booleanValidator }, insurance: { validator: validation_1.insuranceOptionalValidator, redactions: ['enduser'], enduserUpdatesDisabled: true }, insuranceSecondary: { validator: validation_1.insuranceOptionalValidator, redactions: ['enduser'], enduserUpdatesDisabled: true }, bookingNotes: {
                 validator: (0, validation_1.listValidatorOptionalOrEmptyOk)((0, validation_1.objectValidator)({
                     bookingPageId: validation_1.mongoIdStringRequired,
                     note: validation_1.stringValidator5000EmptyOkay,
@@ -313,10 +330,11 @@ exports.schema = (0, exports.build_schema)({
                     archivedAt: validation_1.dateValidatorOptional,
                 })),
                 redactions: ['enduser'],
-            }, references: { validator: validation_1.listOfRelatedRecordsValidator, redactions: ['enduser'] }, athenaDepartmentId: { validator: validation_1.stringValidator100, redactions: ['enduser'] }, athenaPracticeId: { validator: validation_1.stringValidator100, redactions: ['enduser'] }, salesforceId: { validator: validation_1.stringValidator100, redactions: ['enduser'] }, vitalTriggersDisabled: { validator: validation_1.booleanValidator }, defaultFromPhone: { validator: validation_1.phoneValidator, redactions: ['enduser'] }, defaultFromEmail: { validator: validation_1.emailValidator, redactions: ['enduser'] }, useDefaultFromEmailInAutomations: { validator: validation_1.booleanValidator }, useDefaultFromPhoneInAutomations: { validator: validation_1.booleanValidator }, stripeCustomerId: { validator: validation_1.stringValidator100, redactions: ['enduser'] }, stripeKey: { validator: validation_1.stringValidator250, redactions: ['enduser'] }, diagnoses: {
+            }, references: { validator: validation_1.listOfRelatedRecordsValidator, redactions: ['enduser'], enduserUpdatesDisabled: true }, athenaDepartmentId: { validator: validation_1.stringValidator100, redactions: ['enduser'], enduserUpdatesDisabled: true }, athenaPracticeId: { validator: validation_1.stringValidator100, redactions: ['enduser'], enduserUpdatesDisabled: true }, salesforceId: { validator: validation_1.stringValidator100, redactions: ['enduser'], enduserUpdatesDisabled: true }, vitalTriggersDisabled: { validator: validation_1.booleanValidator }, defaultFromPhone: { validator: validation_1.phoneValidator, redactions: ['enduser'] }, defaultFromEmail: { validator: validation_1.emailValidator, redactions: ['enduser'] }, useDefaultFromEmailInAutomations: { validator: validation_1.booleanValidator }, useDefaultFromPhoneInAutomations: { validator: validation_1.booleanValidator }, stripeCustomerId: { validator: validation_1.stringValidator100, redactions: ['enduser'], enduserUpdatesDisabled: true }, stripeKey: { validator: validation_1.stringValidator250, redactions: ['enduser'], enduserUpdatesDisabled: true }, diagnoses: {
                 validator: (0, validation_1.listValidatorOptionalOrEmptyOk)(validation_1.enduserDiagnosisValidator),
-                redactions: ['enduser']
-            }, unsubscribedFromPhones: { validator: validation_1.listOfStringsValidatorUniqueOptionalOrEmptyOkay, redactions: ['enduser'] }, lockedFromPortal: { validator: validation_1.booleanValidator }, eligibleForAutoMerge: { validator: validation_1.booleanValidator }, preferredPharmacy: { validator: validation_1.pharmacyValidator, redactions: ['enduser'] } }),
+                redactions: ['enduser'],
+                enduserUpdatesDisabled: true,
+            }, unsubscribedFromPhones: { validator: validation_1.listOfStringsValidatorUniqueOptionalOrEmptyOkay, redactions: ['enduser'] }, lockedFromPortal: { validator: validation_1.booleanValidator, enduserUpdatesDisabled: true }, eligibleForAutoMerge: { validator: validation_1.booleanValidator, enduserUpdatesDisabled: true }, preferredPharmacy: { validator: validation_1.pharmacyValidator, redactions: ['enduser'] } }),
         customActions: {
             rename_stored_custom_fields: {
                 op: "custom", access: 'update', method: "patch",
@@ -1180,7 +1198,7 @@ exports.schema = (0, exports.build_schema)({
     },
     journeys: {
         info: {},
-        fields: __assign(__assign({}, BuiltInFields), { archivedAt: { validator: validation_1.dateOptionalOrEmptyStringValidator }, title: {
+        fields: __assign(__assign({}, BuiltInFields), { accessTags: { redactions: ['enduser'], validator: validation_1.listOfStringsValidatorEmptyOk }, archivedAt: { validator: validation_1.dateOptionalOrEmptyStringValidator }, title: {
                 validator: validation_1.stringValidator100,
                 required: true,
                 examples: ['Test']
@@ -1872,8 +1890,10 @@ exports.schema = (0, exports.build_schema)({
                         var _c;
                         var _id = _a._id;
                         var updates = _b.updates;
-                        if (session.type === 'user' && !session.eat)
-                            return; // accessTags is not enabled
+                        // editing a user's tags is a privilege-escalation vector whenever tags gate visibility:
+                        // enduser access tags (eat) OR resource access tags (erat). Skip only when neither is enabled.
+                        if (session.type === 'user' && !session.eat && !(session === null || session === void 0 ? void 0 : session.erat))
+                            return; // neither access-tags feature enabled
                         if ((_c = session === null || session === void 0 ? void 0 : session.roles) === null || _c === void 0 ? void 0 : _c.includes('Admin'))
                             return;
                         if (method === 'create')
@@ -2554,7 +2574,7 @@ exports.schema = (0, exports.build_schema)({
                 },
             },
         },
-        fields: __assign(__assign({}, BuiltInFields), { archivedAt: { validator: validation_1.dateOptionalOrEmptyStringValidator }, mmsAttachmentURLs: { validator: validation_1.listOfUniqueStringsValidatorEmptyOk }, title: {
+        fields: __assign(__assign({}, BuiltInFields), { accessTags: { redactions: ['enduser'], validator: validation_1.listOfStringsValidatorEmptyOk }, archivedAt: { validator: validation_1.dateOptionalOrEmptyStringValidator }, mmsAttachmentURLs: { validator: validation_1.listOfUniqueStringsValidatorEmptyOk }, title: {
                 validator: validation_1.stringValidator100,
                 required: true,
                 examples: ["Template Name"],
@@ -2584,7 +2604,7 @@ exports.schema = (0, exports.build_schema)({
         constraints: { unique: [], relationship: [] },
         defaultActions: { read: {}, readMany: {}, update: {}, delete: {} },
         enduserActions: { prepare_file_upload: {}, confirm_file_upload: {}, file_download_URL: {}, read: {}, readMany: {}, delete: {}, update: {} /* allow to hide from client side */ },
-        fields: __assign(__assign({}, BuiltInFields), { source: { validator: validation_1.stringValidator100 }, tags: { validator: validation_1.listOfStringsValidatorUniqueOptionalOrEmptyOkay }, name: {
+        fields: __assign(__assign({}, BuiltInFields), { accessTags: { redactions: ['enduser'], validator: validation_1.listOfStringsValidatorEmptyOk }, source: { validator: validation_1.stringValidator100 }, tags: { validator: validation_1.listOfStringsValidatorUniqueOptionalOrEmptyOkay }, name: {
                 validator: validation_1.stringValidator250,
                 required: true,
             }, size: {
@@ -2595,6 +2615,8 @@ exports.schema = (0, exports.build_schema)({
                 required: true
             }, enduserId: {
                 validator: validation_1.mongoIdStringRequired,
+            }, formResponseId: {
+                validator: validation_1.mongoIdStringRequired,
             }, secureName: {
                 validator: validation_1.stringValidator250,
                 readonly: true,
@@ -3075,7 +3097,7 @@ exports.schema = (0, exports.build_schema)({
                 },
             },
         },
-        fields: __assign(__assign({}, BuiltInFields), { showByUserTags: { validator: validation_1.listOfStringsValidatorOptionalOrEmptyOk }, belugaVisitType: { validator: validation_1.stringValidator }, belugaVerificationId: { validator: validation_1.stringValidator }, belugaPharmacyMappings: {
+        fields: __assign(__assign({}, BuiltInFields), { accessTags: { redactions: ['enduser'], validator: validation_1.listOfStringsValidatorEmptyOk }, showByUserTags: { validator: validation_1.listOfStringsValidatorOptionalOrEmptyOk }, belugaVisitType: { validator: validation_1.stringValidator }, belugaVerificationId: { validator: validation_1.stringValidator }, belugaPharmacyMappings: {
                 validator: (0, validation_1.listValidatorOptionalOrEmptyOk)((0, validation_1.objectValidator)({
                     title: validation_1.stringValidatorOptionalEmptyOkay,
                     pharmacyId: validation_1.stringValidator100,
@@ -3190,7 +3212,7 @@ exports.schema = (0, exports.build_schema)({
             unique: [],
             relationship: [],
         },
-        fields: __assign(__assign({}, BuiltInFields), { discussionRoomId: { validator: validation_1.mongoIdStringRequired }, hiddenFromTimeline: { validator: validation_1.booleanValidator }, lockedAt: { validator: validation_1.dateValidator }, formId: {
+        fields: __assign(__assign({}, BuiltInFields), { discussionRoomId: { validator: validation_1.mongoIdStringRequired }, hiddenFromTimeline: { validator: validation_1.booleanValidator, enduserUpdatesDisabled: true }, lockedAt: { validator: validation_1.dateValidator, enduserUpdatesDisabled: true }, formId: {
                 validator: validation_1.stringValidator100,
                 required: true,
                 dependencies: [
@@ -3215,12 +3237,13 @@ exports.schema = (0, exports.build_schema)({
                 updatesDisabled: true,
             }, openedAt: {
                 validator: validation_1.dateValidator,
-            }, copiedFrom: { validator: validation_1.mongoIdStringOptional }, copiedFromEnduserId: { validator: validation_1.mongoIdStringOptional }, publicSubmit: { validator: validation_1.booleanValidator }, submittedBy: { validator: validation_1.stringValidator250 }, submittedByIsPlaceholder: { validator: validation_1.booleanValidator }, markedAsSubmitted: { validator: validation_1.booleanValidator }, accessCode: { validator: validation_1.stringValidator250 }, userEmail: { validator: validation_1.emailValidator }, submittedAt: { validator: validation_1.dateValidator }, formTitle: { validator: validation_1.stringValidator250 }, responses: { validator: validation_1.formResponsesValidator }, draftSavedAt: { validator: validation_1.dateValidator }, draftSavedBy: { validator: validation_1.mongoIdStringRequired }, hideFromEnduserPortal: { validator: validation_1.booleanValidator }, sharedVia: { validator: validation_1.communicationsChannelValidator }, isInternalNote: { validator: validation_1.booleanValidator }, pinnedAt: { validator: validation_1.dateOptionalOrEmptyStringValidator }, publicIdentifier: { validator: validation_1.stringValidator250 }, source: { validator: validation_1.stringValidator250 }, externalId: { validator: validation_1.stringValidator250 }, rootResponseId: { validator: validation_1.mongoIdStringRequired }, parentResponseId: { validator: validation_1.mongoIdStringRequired }, tags: { validator: validation_1.listOfStringsValidatorOptionalOrEmptyOk }, carePlanId: { validator: validation_1.mongoIdStringRequired }, context: { validator: validation_1.stringValidator1000 }, logoURL: { validator: validation_1.stringValidator5000 }, logoHeight: { validator: validation_1.numberValidator }, calendarEventId: { validator: validation_1.mongoIdStringRequired }, references: { validator: validation_1.listOfRelatedRecordsValidator, readonly: true }, groupId: { validator: validation_1.mongoIdStringRequired }, groupInstance: { validator: validation_1.stringValidator100 }, groupPosition: { validator: validation_1.nonNegNumberValidator }, hideAfterUnsubmittedInMS: { validator: validation_1.numberValidator }, addenda: {
+            }, copiedFrom: { validator: validation_1.mongoIdStringOptional }, copiedFromEnduserId: { validator: validation_1.mongoIdStringOptional }, publicSubmit: { validator: validation_1.booleanValidator }, submittedBy: { validator: validation_1.stringValidator250, enduserUpdatesDisabled: true }, submittedByIsPlaceholder: { validator: validation_1.booleanValidator, enduserUpdatesDisabled: true }, markedAsSubmitted: { validator: validation_1.booleanValidator, enduserUpdatesDisabled: true }, accessCode: { validator: validation_1.stringValidator250 }, userEmail: { validator: validation_1.emailValidator, enduserUpdatesDisabled: true }, submittedAt: { validator: validation_1.dateValidator, enduserUpdatesDisabled: true }, formTitle: { validator: validation_1.stringValidator250, enduserUpdatesDisabled: true }, responses: { validator: validation_1.formResponsesValidator }, draftSavedAt: { validator: validation_1.dateValidator }, draftSavedBy: { validator: validation_1.mongoIdStringRequired }, hideFromEnduserPortal: { validator: validation_1.booleanValidator }, sharedVia: { validator: validation_1.communicationsChannelValidator }, isInternalNote: { validator: validation_1.booleanValidator, enduserUpdatesDisabled: true }, pinnedAt: { validator: validation_1.dateOptionalOrEmptyStringValidator, enduserUpdatesDisabled: true }, publicIdentifier: { validator: validation_1.stringValidator250 }, source: { validator: validation_1.stringValidator250 }, externalId: { validator: validation_1.stringValidator250 }, rootResponseId: { validator: validation_1.mongoIdStringRequired }, parentResponseId: { validator: validation_1.mongoIdStringRequired }, tags: { validator: validation_1.listOfStringsValidatorOptionalOrEmptyOk, enduserUpdatesDisabled: true }, carePlanId: { validator: validation_1.mongoIdStringRequired }, context: { validator: validation_1.stringValidator1000 }, logoURL: { validator: validation_1.stringValidator5000, enduserUpdatesDisabled: true }, logoHeight: { validator: validation_1.numberValidator, enduserUpdatesDisabled: true }, calendarEventId: { validator: validation_1.mongoIdStringRequired }, references: { validator: validation_1.listOfRelatedRecordsValidator, readonly: true }, groupId: { validator: validation_1.mongoIdStringRequired }, groupInstance: { validator: validation_1.stringValidator100 }, groupPosition: { validator: validation_1.nonNegNumberValidator }, hideAfterUnsubmittedInMS: { validator: validation_1.numberValidator }, addenda: {
                 validator: (0, validation_1.listValidatorOptionalOrEmptyOk)((0, validation_1.objectValidator)({
                     text: validation_1.stringValidator25000EmptyOkay,
                     timestamp: validation_1.dateValidator,
                     userId: validation_1.mongoIdStringRequired,
-                }))
+                })),
+                enduserUpdatesDisabled: true,
             }, followups: {
                 validator: (0, validation_1.listValidatorOptionalOrEmptyOk)((0, validation_1.objectValidator)({
                     formId: validation_1.mongoIdStringRequired,
@@ -3233,7 +3256,7 @@ exports.schema = (0, exports.build_schema)({
                     fieldTitle: validation_1.stringValidator250,
                     timestamp: validation_1.dateValidator,
                 }))
-            }, startedViaPinnedForm: { validator: validation_1.booleanValidator }, enduserAISummary: { validator: validation_1.stringValidator25000 }, procedureCodes: { validator: procedureCodesValidator }, diagnosisCodes: { validator: diagnosisCodesValidator } }),
+            }, startedViaPinnedForm: { validator: validation_1.booleanValidator }, enduserAISummary: { validator: validation_1.stringValidator25000, enduserUpdatesDisabled: true }, procedureCodes: { validator: procedureCodesValidator, enduserUpdatesDisabled: true }, diagnosisCodes: { validator: diagnosisCodesValidator, enduserUpdatesDisabled: true } }),
         defaultActions: constants_1.DEFAULT_OPERATIONS,
         enduserActions: {
             prepare_form_response: {}, info_for_access_code: {}, submit_form_response: {}, stripe_details: {}, chargebee_details: {},
@@ -3965,7 +3988,7 @@ exports.schema = (0, exports.build_schema)({
                 validator: validation_1.nonNegNumberValidator,
                 examples: [100],
                 required: true,
-            }, locationId: { validator: validation_1.mongoIdStringRequired }, locationIds: { validator: validation_1.listOfMongoIdStringValidatorOptionalOrEmptyOk }, type: { validator: validation_1.stringValidator100 }, description: { validator: validation_1.stringValidator5000 }, agreedToTerms: { validator: validation_1.appointmentTermsValidator }, meetingId: { validator: validation_1.mongoIdStringRequired, readonly: true }, bookingPageId: { validator: validation_1.mongoIdStringRequired }, meetingStatus: { validator: validation_1.meetingStatusValidator }, attachments: { validator: validation_1.listOfGenericAttachmentsValidator }, cancelledAt: { validator: validation_1.dateOptionalOrEmptyStringValidator }, rescheduledAt: { validator: validation_1.dateOptionalOrEmptyStringValidator }, noShowedAt: { validator: validation_1.dateOptionalOrEmptyStringValidator }, rescheduledTo: { validator: validation_1.mongoIdStringRequired }, chatRoomId: {
+            }, locationId: { validator: validation_1.mongoIdStringRequired }, locationIds: { validator: validation_1.listOfMongoIdStringValidatorOptionalOrEmptyOk }, type: { validator: validation_1.stringValidator100 }, description: { validator: validation_1.stringValidator5000 }, agreedToTerms: { validator: validation_1.appointmentTermsValidator }, meetingId: { validator: validation_1.mongoIdStringRequired, readonly: true }, bookingPageId: { validator: validation_1.mongoIdStringRequired }, meetingStatus: { validator: validation_1.meetingStatusValidator }, videoCallAttendance: { validator: validation_1.listOfVideoCallParticipantEventsValidator, readonly: true }, attachments: { validator: validation_1.listOfGenericAttachmentsValidator }, cancelledAt: { validator: validation_1.dateOptionalOrEmptyStringValidator }, rescheduledAt: { validator: validation_1.dateOptionalOrEmptyStringValidator }, noShowedAt: { validator: validation_1.dateOptionalOrEmptyStringValidator }, rescheduledTo: { validator: validation_1.mongoIdStringRequired }, chatRoomId: {
                 validator: validation_1.mongoIdStringRequired,
                 dependencies: [{
                         dependsOn: ['chat_rooms'],
@@ -4031,7 +4054,7 @@ exports.schema = (0, exports.build_schema)({
         defaultActions: constants_1.DEFAULT_OPERATIONS,
         customActions: {},
         enduserActions: { read: {}, readMany: {} },
-        fields: __assign(__assign({}, BuiltInFields), { dontSyncToElation: { validator: validation_1.booleanValidator }, sendIcsEmail: { validator: validation_1.booleanValidator }, createAndBookAthenaSlot: { validator: validation_1.booleanValidator }, athenaDepartmentId: { validator: validation_1.stringValidator1000 }, generateAthenaTelehealthLink: { validator: validation_1.booleanValidator }, athenaTypeId: { validator: validation_1.stringValidator1000 }, athenaBookingTypeId: { validator: validation_1.stringValidator1000 }, preventCancelMinutesInAdvance: { validator: validation_1.numberValidator }, preventRescheduleMinutesInAdvance: { validator: validation_1.numberValidator }, preventCancelInPortal: { validator: validation_1.booleanValidator }, preventRescheduleInPortal: { validator: validation_1.booleanValidator }, dontSyncToCanvas: { validator: validation_1.booleanValidator }, archivedAt: { validator: validation_1.dateOptionalOrEmptyStringValidator }, allowGroupReschedule: { validator: validation_1.booleanValidator }, dontAutoSyncPatientToHealthie: { validator: validation_1.booleanValidator }, title: {
+        fields: __assign(__assign({}, BuiltInFields), { accessTags: { redactions: ['enduser'], validator: validation_1.listOfStringsValidatorEmptyOk }, dontSyncToElation: { validator: validation_1.booleanValidator }, sendIcsEmail: { validator: validation_1.booleanValidator }, createAndBookAthenaSlot: { validator: validation_1.booleanValidator }, athenaDepartmentId: { validator: validation_1.stringValidator1000 }, generateAthenaTelehealthLink: { validator: validation_1.booleanValidator }, athenaTypeId: { validator: validation_1.stringValidator1000 }, athenaBookingTypeId: { validator: validation_1.stringValidator1000 }, preventCancelMinutesInAdvance: { validator: validation_1.numberValidator }, preventRescheduleMinutesInAdvance: { validator: validation_1.numberValidator }, preventCancelInPortal: { validator: validation_1.booleanValidator }, preventRescheduleInPortal: { validator: validation_1.booleanValidator }, dontSyncToCanvas: { validator: validation_1.booleanValidator }, archivedAt: { validator: validation_1.dateOptionalOrEmptyStringValidator }, allowGroupReschedule: { validator: validation_1.booleanValidator }, dontAutoSyncPatientToHealthie: { validator: validation_1.booleanValidator }, title: {
                 validator: validation_1.stringValidator250,
                 required: true,
                 examples: ["Text"],
@@ -4426,7 +4449,7 @@ exports.schema = (0, exports.build_schema)({
             create: {}, createMany: {}, read: {}, readMany: {},
             search: {},
         },
-        fields: __assign(__assign({}, BuiltInFields), { slug: { validator: validation_1.stringValidator250 }, title: {
+        fields: __assign(__assign({}, BuiltInFields), { accessTags: { redactions: ['enduser'], validator: validation_1.listOfStringsValidatorEmptyOk }, slug: { validator: validation_1.stringValidator250 }, title: {
                 validator: validation_1.stringValidator1000,
                 required: true,
                 examples: ["Template Name"],
@@ -4974,7 +4997,7 @@ exports.schema = (0, exports.build_schema)({
                 validator: (0, validation_1.objectValidator)({
                     type: validation_1.stringValidatorOptional,
                 }),
-            }, onboardingStatus: { validator: validation_1.stringValidator100 }, creditCount: { validator: validation_1.numberValidator, readonly: true }, stripeKeyDetails: {
+            }, onboardingStatus: { validator: validation_1.userPortalSettingsValidator }, creditCount: { validator: validation_1.numberValidator, readonly: true }, stripeKeyDetails: {
                 validator: (0, validation_1.listValidatorOptionalOrEmptyOk)((0, validation_1.objectValidator)({
                     key: validation_1.stringValidator5000EmptyOkay,
                     title: validation_1.stringValidator5000EmptyOkay,
@@ -5251,7 +5274,10 @@ exports.schema = (0, exports.build_schema)({
                         }
                     },
                 ]
-            }, uiRestrictions: { validator: validation_1.userUIRestrictionsValidator }, fieldRedactions: { validator: validation_1.userFieldRedactionsValidator } })
+            }, uiRestrictions: { validator: validation_1.userUIRestrictionsValidator }, fieldRedactions: { validator: validation_1.userFieldRedactionsValidator }, portalSchemaRestrictions: {
+                validator: validation_1.portalSchemaRestrictionsValidator,
+                initializer: function () { return ({ disableEditContent: true, disableEditTheming: true, disableEditSnippets: true }); },
+            }, color: { validator: validation_1.stringValidator1000 }, description: { validator: validation_1.stringValidator1000Optional } })
     },
     appointment_booking_pages: {
         info: {},
@@ -5293,7 +5319,7 @@ exports.schema = (0, exports.build_schema)({
         enduserActions: {
             read: {}, readMany: {}, validate_access_token: {},
         },
-        fields: __assign(__assign({}, BuiltInFields), { dontRestrictRescheduleToOriginalHost: { validator: validation_1.booleanValidator }, gtmTag: { validator: validation_1.stringValidator100EscapeHTML }, archivedAt: { validator: validation_1.dateOptionalOrEmptyStringValidator }, title: {
+        fields: __assign(__assign({}, BuiltInFields), { accessTags: { redactions: ['enduser'], validator: validation_1.listOfStringsValidatorEmptyOk }, dontRestrictRescheduleToOriginalHost: { validator: validation_1.booleanValidator }, gtmTag: { validator: validation_1.stringValidator100EscapeHTML }, archivedAt: { validator: validation_1.dateOptionalOrEmptyStringValidator }, title: {
                 validator: validation_1.stringValidator100,
                 required: true,
                 examples: ["Appointment Booking Title"]
@@ -5915,7 +5941,7 @@ exports.schema = (0, exports.build_schema)({
             },
         },
         enduserActions: {},
-        fields: __assign(__assign({}, BuiltInFields), { title: {
+        fields: __assign(__assign({}, BuiltInFields), { accessTags: { redactions: ['enduser'], validator: validation_1.listOfStringsValidatorEmptyOk }, title: {
                 validator: validation_1.stringValidator100,
                 required: true,
                 examples: ["Automation Trigger"]
@@ -6191,7 +6217,7 @@ exports.schema = (0, exports.build_schema)({
         defaultActions: constants_1.DEFAULT_OPERATIONS,
         customActions: {},
         enduserActions: {},
-        fields: __assign(__assign({}, BuiltInFields), { title: {
+        fields: __assign(__assign({}, BuiltInFields), { accessTags: { redactions: ['enduser'], validator: validation_1.listOfStringsValidatorEmptyOk }, title: {
                 validator: validation_1.stringValidator,
                 required: true,
                 examples: ["Title"]
@@ -6331,18 +6357,34 @@ exports.schema = (0, exports.build_schema)({
                     }
                 },
                 {
-                    explanation: "Locked time tracks only allow review field updates",
-                    evaluate: function (_v, _deps, _session, method, _a) {
+                    explanation: "Locked time tracks only allow review field updates, or owner resubmission of rejected entries",
+                    evaluate: function (_v, _deps, session, method, _a) {
                         var original = _a.original, updates = _a.updates;
                         if (method !== 'update')
                             return;
                         var orig = original;
                         if (!(orig === null || orig === void 0 ? void 0 : orig.lockedAt))
                             return;
+                        var u = updates;
                         var reviewFields = ['reviewedAt', 'reviewedByUserId', 'reviewApproved', 'reviewNote'];
                         var nonReviewFields = Object.keys(updates || {}).filter(function (k) { return !reviewFields.includes(k); });
-                        if (nonReviewFields.length > 0)
-                            return "Time track is locked. Only review fields (".concat(reviewFields.join(', '), ") can be updated.");
+                        if (nonReviewFields.length === 0)
+                            return; // pure review update — unchanged behavior
+                        var isRejected = !!orig.reviewedAt && orig.reviewApproved === false;
+                        var resubmitFields = __spreadArray(__spreadArray([], reviewFields, true), [
+                            'correctedAt', 'correctedByUserId', 'correctionNote',
+                            'originalTotalDurationInMS', 'totalDurationInMS',
+                            'lockedAt', 'lockedByUserId',
+                        ], false);
+                        var disallowed = Object.keys(updates || {}).filter(function (k) { return !resubmitFields.includes(k); });
+                        if (isRejected && session.id === orig.userId && disallowed.length === 0) {
+                            if ((u === null || u === void 0 ? void 0 : u.reviewedAt) !== '')
+                                return "Resubmitting a rejected time track requires clearing reviewedAt (set to '')";
+                            if ((u === null || u === void 0 ? void 0 : u.reviewApproved) === true)
+                                return "Cannot approve your own time track during resubmission";
+                            return; // valid resubmit — entry returns to Pending
+                        }
+                        return "Time track is locked. Only review fields (".concat(reviewFields.join(', '), ") can be updated.");
                     }
                 },
                 {
@@ -6417,7 +6459,20 @@ exports.schema = (0, exports.build_schema)({
                     type: validation_1.stringValidator,
                     id: validation_1.stringValidator,
                 }, { isOptional: true, emptyOk: true }),
-            }, isHistorical: { validator: validation_1.booleanValidatorOptional, updatesDisabled: true }, correctedAt: { validator: validation_1.dateValidatorOptional }, correctedByUserId: { validator: validation_1.mongoIdStringOptional }, correctionNote: { validator: validation_1.stringValidator1000Optional }, originalTotalDurationInMS: { validator: validation_1.numberValidatorOptional }, reviewedAt: { validator: validation_1.dateValidatorOptional }, reviewedByUserId: { validator: validation_1.mongoIdStringOptional }, reviewApproved: { validator: validation_1.booleanValidatorOptional }, reviewNote: { validator: validation_1.stringValidator1000Optional }, lockedAt: { validator: validation_1.dateValidatorOptional }, lockedByUserId: { validator: validation_1.mongoIdStringOptional } }),
+            }, isHistorical: { validator: validation_1.booleanValidatorOptional, updatesDisabled: true }, correctedAt: { validator: validation_1.dateValidatorOptional }, correctedByUserId: { validator: validation_1.mongoIdStringOptional }, correctionNote: { validator: validation_1.stringValidator1000Optional }, originalTotalDurationInMS: { validator: validation_1.numberValidatorOptional }, reviewedAt: { validator: validation_1.dateValidatorOptional }, reviewedByUserId: { validator: validation_1.mongoIdStringOptional }, reviewApproved: { validator: validation_1.booleanValidatorOptional }, reviewNote: { validator: validation_1.stringValidator1000Optional }, lockedAt: { validator: validation_1.dateValidatorOptional }, lockedByUserId: { validator: validation_1.mongoIdStringOptional }, 
+            // server-appended on resubmission of a rejected entry (see routing.ts update handler)
+            // note: reviewApproved remains false after resubmit (booleans can't be cleared to '') — status logic must key off reviewedAt
+            reviewHistory: {
+                validator: (0, validation_1.listValidatorOptionalOrEmptyOk)((0, validation_1.objectValidator)({
+                    reviewedAt: validation_1.dateValidator,
+                    reviewedByUserId: validation_1.mongoIdStringOptional,
+                    reviewApproved: validation_1.booleanValidatorOptional,
+                    reviewNote: validation_1.stringValidator1000Optional,
+                    resubmittedAt: validation_1.dateValidatorOptional,
+                    resubmittedByUserId: validation_1.mongoIdStringOptional,
+                })),
+                readonly: true, // server-appended only — clients can read, never write
+            } }),
     },
     ticket_queues: {
         info: {},
@@ -6845,7 +6900,7 @@ exports.schema = (0, exports.build_schema)({
         defaultActions: { read: {}, readMany: {} },
         customActions: {},
         enduserActions: {},
-        fields: __assign(__assign({}, BuiltInFields), { integration: { validator: validation_1.stringValidator, readonly: true, examples: ['Canvas'] }, status: { validator: (0, validation_1.exactMatchValidator)(['Success', 'Error']), readonly: true, examples: ['Error'] }, type: { validator: validation_1.stringValidator, readonly: true, examples: ['Patient Create'] }, payload: { validator: validation_1.stringValidator, readonly: true, examples: ['{}'] }, response: { validator: validation_1.stringValidator, readonly: true, examples: ['{}'] }, url: { validator: validation_1.stringValidator, readonly: true, examples: ['https://www.tellescope.com'] }, enduserId: { validator: validation_1.mongoIdStringRequired, readonly: true } })
+        fields: __assign(__assign({}, BuiltInFields), { integration: { validator: validation_1.stringValidator, readonly: true, examples: ['Canvas'] }, status: { validator: (0, validation_1.exactMatchValidator)(['Success', 'Error', 'Info']), readonly: true, examples: ['Error'] }, type: { validator: validation_1.stringValidator, readonly: true, examples: ['Patient Create'] }, payload: { validator: validation_1.stringValidator, readonly: true, examples: ['{}'] }, response: { validator: validation_1.stringValidator, readonly: true, examples: ['{}'] }, url: { validator: validation_1.stringValidator, readonly: true, examples: ['https://www.tellescope.com'] }, enduserId: { validator: validation_1.mongoIdStringRequired, readonly: true } })
     },
     organization_payments: {
         info: { description: 'Read Only - Organization Payment Transaction Logs' },