@tellescope/schema 1.253.1 → 1.254.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tellescope/schema",
-  "version": "1.253.1",
+  "version": "1.254.1",
   "description": "Schema definition for Tellescope models",
   "main": "./lib/cjs/schema.js",
   "module": "./lib/esm/schema.js",
@@ -23,13 +23,13 @@
   },
   "homepage": "https://github.com/tellescope-os/tellescope#readme",
   "dependencies": {
-    "@tellescope/constants": "1.253.1",
-    "@tellescope/types-client": "1.253.1",
-    "@tellescope/types-models": "1.253.1",
-    "@tellescope/types-server": "1.253.1",
-    "@tellescope/types-utilities": "1.253.1",
-    "@tellescope/utilities": "1.253.1",
-    "@tellescope/validation": "1.253.1",
+    "@tellescope/constants": "1.254.1",
+    "@tellescope/types-client": "1.254.1",
+    "@tellescope/types-models": "1.254.1",
+    "@tellescope/types-server": "1.254.1",
+    "@tellescope/types-utilities": "1.254.1",
+    "@tellescope/utilities": "1.254.1",
+    "@tellescope/validation": "1.254.1",
     "validator": "13.11.0"
   },
   "devDependencies": {
@@ -43,5 +43,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "5013042cc249a11312734f97835843f30b4249b2"
+  "gitHead": "28444816447e007bba693810c8ebad150b83a9a5"
 }

package/src/schema.ts

@@ -90,7 +90,9 @@ import {
   AIDecisionAutomationAction,
   AutomationAction,
   TimeTrackTimestamp,
+  TimeTrackReviewHistoryItem,
   BelugaPharmacyMapping,
+  CompoundFilter,
   BelugaAutomationMappingEntry,
   BelugaUpdateVisitPatientPreferenceItem,
   TimeTrack,
@@ -172,6 +174,7 @@ import {
   fileSizeValidator,
   meetingStatusValidator,
   listOfAttendeesValidator,
+  listOfVideoCallParticipantEventsValidator,
   meetingInfoValidator,
   listOfUserIndentitiesValidator,
   meetingsListValidator,
@@ -287,6 +290,7 @@ import {
   userCallRoutingBehaviorValidator,
   userUIRestrictionsValidator,
   userFieldRedactionsValidator,
+  portalSchemaRestrictionsValidator,
   externalChatGPTMessagesValidator,
   enduserProfileViewBlocksValidator,
   customDashboardBlocksValidator,
@@ -2644,6 +2648,7 @@ export const schema: SchemaV1 = build_schema({
     info: {},
     fields: {
       ...BuiltInFields,
+      accessTags: { redactions: ['enduser'], validator: listOfStringsValidatorEmptyOk },
       archivedAt: { validator: dateOptionalOrEmptyStringValidator },
       title: {
         validator: stringValidator100,
@@ -3185,9 +3190,21 @@ export const schema: SchemaV1 = build_schema({
   },
   chat_rooms: {
     info: {},
-    constraints: { 
+    constraints: {
       unique: [{ array: 'userIds' }, { array: 'enduserIds' }],
-      relationship: [],
+      relationship: [
+        {
+          // Patient-initiated rooms targeting specific care-team staff (userIds) are an intended
+          // portal feature and are left unrestricted. An enduser may only add THEMSELVES to a room
+          // they create — they cannot add other patients (cross-patient PHI broadcast).
+          explanation: 'Endusers can only add their own id to enduserIds on chat rooms they create',
+          evaluate: (doc, _, session) => {
+            if (session.type !== ENDUSER_SESSION_TYPE) return
+            if ((doc.enduserIds ?? []).some(id => id !== session.id))
+              return "enduserIds may only contain your own id for enduser session"
+          }
+        },
+      ],
       access: [
         { type: 'filter', field: 'userIds' },
         { type: 'filter', field: 'enduserIds' },
@@ -3486,7 +3503,9 @@ export const schema: SchemaV1 = build_schema({
         {
           explanation: "Only admin users can update tags when accessTags is enabled",
           evaluate: ({ _id }, _, session, method, { updates } ) => {
-            if (session.type === 'user' && !session.eat) return // accessTags is not enabled
+            // editing a user's tags is a privilege-escalation vector whenever tags gate visibility:
+            // enduser access tags (eat) OR resource access tags (erat). Skip only when neither is enabled.
+            if (session.type === 'user' && !session.eat && !(session as UserSession)?.erat) return // neither access-tags feature enabled
             if ((session as UserSession)?.roles?.includes('Admin')) return
             if (method === 'create') return
             if (!updates?.tags) return
@@ -4182,7 +4201,8 @@ export const schema: SchemaV1 = build_schema({
       },
     },
     fields: {
-      ...BuiltInFields, 
+      ...BuiltInFields,
+      accessTags: { redactions: ['enduser'], validator: listOfStringsValidatorEmptyOk },
       archivedAt: { validator: dateOptionalOrEmptyStringValidator },
       mmsAttachmentURLs: { validator: listOfUniqueStringsValidatorEmptyOk }, 
       title: {
@@ -4230,7 +4250,8 @@ export const schema: SchemaV1 = build_schema({
     defaultActions: { read: {}, readMany: {}, update: {}, delete: {} },
     enduserActions: { prepare_file_upload: {}, confirm_file_upload: {}, file_download_URL: {}, read: {}, readMany: {}, delete: {}, update: { } /* allow to hide from client side */ },
     fields: {
-      ...BuiltInFields, 
+      ...BuiltInFields,
+      accessTags: { redactions: ['enduser'], validator: listOfStringsValidatorEmptyOk },
       source: { validator: stringValidator100 },
       tags: { validator: listOfStringsValidatorUniqueOptionalOrEmptyOkay }, 
       name: {
@@ -4499,7 +4520,7 @@ export const schema: SchemaV1 = build_schema({
     },
     enduserActions: { create: {}, read: {}, readMany: {} },
     fields: {
-      ...BuiltInFields, 
+      ...BuiltInFields,
       title: {
         validator: stringValidator1000,
         required: true,
@@ -4824,6 +4845,7 @@ export const schema: SchemaV1 = build_schema({
     },
     fields: {
       ...BuiltInFields,
+      accessTags: { redactions: ['enduser'], validator: listOfStringsValidatorEmptyOk },
       showByUserTags: { validator: listOfStringsValidatorOptionalOrEmptyOk },
       belugaVisitType: { validator: stringValidator },
       belugaVerificationId: { validator: stringValidator },
@@ -4837,8 +4859,9 @@ export const schema: SchemaV1 = build_schema({
       },
       belugaCombineMatchingPharmacyMappings: { validator: booleanValidator },
       mdiCaseOfferings: {
-        validator: listValidatorOptionalOrEmptyOk(objectValidator<{ offering_id: string }>({
+        validator: listValidatorOptionalOrEmptyOk(objectValidator<{ offering_id: string, conditions?: CompoundFilter<string> }>({
           offering_id: stringValidator100,
+          conditions: compoundFilterValidator,
         }))
       },
       autoMergeOnSubmission: { validator: booleanValidator },
@@ -5945,6 +5968,7 @@ export const schema: SchemaV1 = build_schema({
       meetingId: { validator: mongoIdStringValidator, readonly: true },
       bookingPageId: { validator: mongoIdStringValidator }, // allows rescheduling via booking page
       meetingStatus: { validator: meetingStatusValidator },
+      videoCallAttendance: { validator: listOfVideoCallParticipantEventsValidator, readonly: true },
       attachments: { validator: listOfGenericAttachmentsValidator },
       cancelledAt: { validator: dateOptionalOrEmptyStringValidator },
       rescheduledAt: { validator: dateOptionalOrEmptyStringValidator },
@@ -6079,7 +6103,8 @@ export const schema: SchemaV1 = build_schema({
     customActions: {},
     enduserActions: { read: {}, readMany: {} },
     fields: {
-      ...BuiltInFields, 
+      ...BuiltInFields,
+      accessTags: { redactions: ['enduser'], validator: listOfStringsValidatorEmptyOk },
       dontSyncToElation: { validator: booleanValidator },
       sendIcsEmail: { validator: booleanValidator },
       createAndBookAthenaSlot: { validator: booleanValidator },
@@ -6446,8 +6471,16 @@ export const schema: SchemaV1 = build_schema({
   enduser_observations: {
     info: {},
     constraints: {
-      unique: [], 
-      relationship: [],
+      unique: [],
+      relationship: [
+        {
+          explanation: 'When created by an enduser, enduserId must match their id',
+          evaluate: ({ enduserId },_,session) => {
+          if (session.type === ENDUSER_SESSION_TYPE && session.id !== enduserId)
+            return "enduserId does not match creator id for enduser session"
+          }
+        },
+      ],
     },
     defaultActions: {
       ...DEFAULT_OPERATIONS,
@@ -6548,11 +6581,23 @@ export const schema: SchemaV1 = build_schema({
   managed_content_records: {
     info: {},
     constraints: {
-      unique: [], 
-      relationship: [],
+      unique: [],
+      relationship: [
+        {
+          explanation: 'Endusers cannot self-publish managed content or bind it to another enduser',
+          evaluate: (doc, _, session) => {
+            if (session.type !== ENDUSER_SESSION_TYPE) return
+            if (doc.publicRead) return "publicRead cannot be set by endusers"
+            if (doc.allowUnauthenticatedAccess) return "allowUnauthenticatedAccess cannot be set by endusers"
+            if (doc.forInternalUse) return "forInternalUse cannot be set by endusers"
+            if (doc.enduserId !== undefined && doc.enduserId !== session.id)
+              return "enduserId does not match creator id for enduser session"
+          }
+        },
+      ],
     },
     defaultActions: DEFAULT_OPERATIONS,
-    customActions: { 
+    customActions: {
       update_indexes: {
         op: "custom", access: 'update', method: "patch",
         name: 'Update Indexes',
@@ -6607,7 +6652,8 @@ export const schema: SchemaV1 = build_schema({
       search: {},
     },
     fields: {
-      ...BuiltInFields, 
+      ...BuiltInFields,
+      accessTags: { redactions: ['enduser'], validator: listOfStringsValidatorEmptyOk },
       slug: { validator: stringValidator250 },
       title: {
         validator: stringValidator1000,
@@ -7623,6 +7669,12 @@ export const schema: SchemaV1 = build_schema({
       },
       uiRestrictions: { validator: userUIRestrictionsValidator },
       fieldRedactions: { validator: userFieldRedactionsValidator },
+      portalSchemaRestrictions: {
+        validator: portalSchemaRestrictionsValidator,
+        initializer: () => ({ disableEditContent: true, disableEditTheming: true, disableEditSnippets: true }),
+      },
+      color: { validator: stringValidator1000 },
+      description: { validator: stringValidator1000Optional },
     }
   },
   appointment_booking_pages: {
@@ -7666,7 +7718,8 @@ export const schema: SchemaV1 = build_schema({
       read: {}, readMany: {}, validate_access_token: {},
     },
     fields: {
-      ...BuiltInFields, 
+      ...BuiltInFields,
+      accessTags: { redactions: ['enduser'], validator: listOfStringsValidatorEmptyOk },
       dontRestrictRescheduleToOriginalHost: { validator: booleanValidator },
       gtmTag: { validator: stringValidator100EscapeHTML },
       archivedAt: { validator: dateOptionalOrEmptyStringValidator },
@@ -8503,7 +8556,8 @@ If a voicemail is left, it is indicated by recordingURI, transcription, or recor
     },
     enduserActions: {},
     fields: {
-      ...BuiltInFields, 
+      ...BuiltInFields,
+      accessTags: { redactions: ['enduser'], validator: listOfStringsValidatorEmptyOk },
       title: {
         validator: stringValidator100,
         required: true,
@@ -8858,7 +8912,8 @@ If a voicemail is left, it is indicated by recordingURI, transcription, or recor
     customActions: {},
     enduserActions: {},
     fields: {
-      ...BuiltInFields, 
+      ...BuiltInFields,
+      accessTags: { redactions: ['enduser'], validator: listOfStringsValidatorEmptyOk },
       title: {
         validator: stringValidator,
         required: true,
@@ -9040,14 +9095,33 @@ If a voicemail is left, it is indicated by recordingURI, transcription, or recor
           }
         },
         {
-          explanation: "Locked time tracks only allow review field updates",
-          evaluate: (_v, _deps, _session, method, { original, updates }) => {
+          explanation: "Locked time tracks only allow review field updates, or owner resubmission of rejected entries",
+          evaluate: (_v, _deps, session, method, { original, updates }) => {
             if (method !== 'update') return
             const orig = original as any as TimeTrack | undefined
             if (!orig?.lockedAt) return
+
+            const u = updates as any as Partial<TimeTrack> | undefined
             const reviewFields = ['reviewedAt', 'reviewedByUserId', 'reviewApproved', 'reviewNote']
             const nonReviewFields = Object.keys(updates || {}).filter(k => !reviewFields.includes(k))
-            if (nonReviewFields.length > 0) return `Time track is locked. Only review fields (${reviewFields.join(', ')}) can be updated.`
+            if (nonReviewFields.length === 0) return // pure review update — unchanged behavior
+
+            const isRejected = !!orig.reviewedAt && orig.reviewApproved === false
+            const resubmitFields = [
+              ...reviewFields,
+              'correctedAt', 'correctedByUserId', 'correctionNote',
+              'originalTotalDurationInMS', 'totalDurationInMS',
+              'lockedAt', 'lockedByUserId',
+            ]
+            const disallowed = Object.keys(updates || {}).filter(k => !resubmitFields.includes(k))
+
+            if (isRejected && session.id === orig.userId && disallowed.length === 0) {
+              if (u?.reviewedAt !== '') return "Resubmitting a rejected time track requires clearing reviewedAt (set to '')"
+              if (u?.reviewApproved === true) return "Cannot approve your own time track during resubmission"
+              return // valid resubmit — entry returns to Pending
+            }
+
+            return `Time track is locked. Only review fields (${reviewFields.join(', ')}) can be updated.`
           }
         },
         {
@@ -9132,6 +9206,19 @@ If a voicemail is left, it is indicated by recordingURI, transcription, or recor
       reviewNote: { validator: stringValidator1000Optional },
       lockedAt: { validator: dateValidatorOptional },
       lockedByUserId: { validator: mongoIdStringOptional },
+      // server-appended on resubmission of a rejected entry (see routing.ts update handler)
+      // note: reviewApproved remains false after resubmit (booleans can't be cleared to '') — status logic must key off reviewedAt
+      reviewHistory: {
+        validator: listValidatorOptionalOrEmptyOk(objectValidator<TimeTrackReviewHistoryItem>({
+          reviewedAt: dateValidator,
+          reviewedByUserId: mongoIdStringOptional,
+          reviewApproved: booleanValidatorOptional,
+          reviewNote: stringValidator1000Optional,
+          resubmittedAt: dateValidatorOptional,
+          resubmittedByUserId: mongoIdStringOptional,
+        })),
+        readonly: true, // server-appended only — clients can read, never write
+      },
     },
   },
   ticket_queues: {
@@ -9315,8 +9402,17 @@ If a voicemail is left, it is indicated by recordingURI, transcription, or recor
     info: {
       description: 'Lab, medication, and device orders'
     },
-    constraints: { 
-      unique: [], relationship: [], 
+    constraints: {
+      unique: [],
+      relationship: [
+        {
+          explanation: 'When created by an enduser, enduserId must match their id',
+          evaluate: ({ enduserId },_,session) => {
+          if (session.type === ENDUSER_SESSION_TYPE && session.id !== enduserId)
+            return "enduserId does not match creator id for enduser session"
+          }
+        },
+      ],
       access: [{ type: 'filter', field: 'userId' }]
     },
     defaultActions: DEFAULT_OPERATIONS,
@@ -9744,7 +9840,7 @@ If a voicemail is left, it is indicated by recordingURI, transcription, or recor
     fields: {
       ...BuiltInFields,
       integration: { validator: stringValidator, readonly: true, examples: ['Canvas'] },
-      status: { validator: exactMatchValidator(['Success', 'Error']), readonly: true, examples: ['Error'] },
+      status: { validator: exactMatchValidator(['Success', 'Error', 'Info']), readonly: true, examples: ['Error'] },
       type: { validator: stringValidator, readonly: true, examples: ['Patient Create'] },
       payload: { validator: stringValidator, readonly: true, examples: ['{}'] },
       response: { validator: stringValidator, readonly: true, examples: ['{}'] },