@tellescope/sdk 1.246.2 → 1.248.0

package/src/tests/api_tests/form_submitted_trigger.test.ts

@@ -0,0 +1,281 @@
+require('source-map-support').install();
+
+import { Session } from "../../sdk"
+import { log_header, wait, async_test } from "@tellescope/testing"
+import { Enduser } from "@tellescope/types-client"
+import { setup_tests } from "../setup"
+
+const host = process.env.API_URL || "http://localhost:8080"
+
+export const form_submitted_trigger_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("Form Submitted Trigger Tests (Multi-Form & Per-Form Conditions)")
+
+  // Setup: two forms with one string field each
+  const formA = await sdk.api.forms.createOne({ title: 'Form Submitted Trigger Test A' })
+  const fieldA = await sdk.api.form_fields.createOne({
+    formId: formA.id,
+    type: 'string',
+    title: 'FieldA',
+    previousFields: [{ type: 'root', info: {} }],
+  })
+
+  const formB = await sdk.api.forms.createOne({ title: 'Form Submitted Trigger Test B' })
+  const fieldB = await sdk.api.form_fields.createOne({
+    formId: formB.id,
+    type: 'string',
+    title: 'FieldB',
+    previousFields: [{ type: 'root', info: {} }],
+  })
+
+  // Helper to prepare and submit a form response
+  const submitForm = async (formId: string, enduserId: string, responses: { fieldId: string, fieldTitle: string, answer: { type: 'string', value: string } }[]) => {
+    const { accessCode } = await sdk.api.form_responses.prepare_form_response({ enduserId, formId })
+    await sdk.api.form_responses.submit_form_response({ accessCode, responses })
+  }
+
+  // Pre-create endusers for each scenario to avoid throttle
+  const enduserA1 = await sdk.api.endusers.createOne({ fname: 'fst-a1' })
+  const enduserB1 = await sdk.api.endusers.createOne({ fname: 'fst-b1' })
+  const enduserA2 = await sdk.api.endusers.createOne({ fname: 'fst-a2' })
+  const enduserB2 = await sdk.api.endusers.createOne({ fname: 'fst-b2' })
+  const enduserB3 = await sdk.api.endusers.createOne({ fname: 'fst-b3' })
+  const enduserA3 = await sdk.api.endusers.createOne({ fname: 'fst-a3' })
+  const enduserA4 = await sdk.api.endusers.createOne({ fname: 'fst-a4' })
+
+  const allEndusers = [enduserA1, enduserB1, enduserA2, enduserB2, enduserB3, enduserA3, enduserA4]
+  const allTriggers: { id: string }[] = []
+
+  try {
+    // ── Scenario 1: Backwards compatibility — global conditions on primary form ──
+    const trigger1 = await sdk.api.automation_triggers.createOne({
+      event: {
+        type: 'Form Submitted',
+        info: { formId: formA.id },
+        conditions: {
+          "$and": [{ "condition": { [fieldA.id]: "match-value" } }]
+        },
+      },
+      action: { type: 'Add Tags', info: { tags: ['global-cond-primary'] } },
+      status: 'Active',
+      title: "Scenario 1: Global conditions backwards compat",
+    })
+    allTriggers.push(trigger1)
+
+    await submitForm(formA.id, enduserA1.id, [{
+      fieldId: fieldA.id, fieldTitle: 'FieldA',
+      answer: { type: 'string', value: 'match-value' },
+    }])
+    await wait(undefined, 1000)
+
+    await async_test(
+      "Scenario 1: Global conditions on primary form still work (backwards compat)",
+      () => sdk.api.endusers.getOne(enduserA1.id),
+      { onResult: (e: Enduser) => !!e.tags?.includes('global-cond-primary') }
+    )
+
+    await sdk.api.automation_triggers.deleteOne(trigger1.id)
+
+    // ── Scenario 2: Multi-form trigger fires on secondary form submission ──
+    const trigger2 = await sdk.api.automation_triggers.createOne({
+      event: {
+        type: 'Form Submitted',
+        info: { formId: formA.id, otherFormIds: [formB.id] },
+      },
+      action: { type: 'Add Tags', info: { tags: ['multi-form-secondary'] } },
+      status: 'Active',
+      title: "Scenario 2: Multi-form fires on secondary",
+    })
+    allTriggers.push(trigger2)
+
+    await submitForm(formB.id, enduserB1.id, [{
+      fieldId: fieldB.id, fieldTitle: 'FieldB',
+      answer: { type: 'string', value: 'anything' },
+    }])
+    await wait(undefined, 1000)
+
+    await async_test(
+      "Scenario 2: Trigger fires when secondary form (otherFormIds) is submitted",
+      () => sdk.api.endusers.getOne(enduserB1.id),
+      { onResult: (e: Enduser) => !!e.tags?.includes('multi-form-secondary') }
+    )
+
+    await sdk.api.automation_triggers.deleteOne(trigger2.id)
+
+    // ── Scenario 3: Per-form conditions match on primary form ──
+    const trigger3 = await sdk.api.automation_triggers.createOne({
+      event: {
+        type: 'Form Submitted',
+        info: {
+          formId: formA.id,
+          otherFormIds: [formB.id],
+          conditionsByFormId: {
+            [formA.id]: { "$and": [{ "condition": { [fieldA.id]: "primary-match" } }] },
+          },
+        },
+      },
+      action: { type: 'Add Tags', info: { tags: ['per-form-primary'] } },
+      status: 'Active',
+      title: "Scenario 3: Per-form conditions on primary",
+    })
+    allTriggers.push(trigger3)
+
+    await submitForm(formA.id, enduserA2.id, [{
+      fieldId: fieldA.id, fieldTitle: 'FieldA',
+      answer: { type: 'string', value: 'primary-match' },
+    }])
+    await wait(undefined, 1000)
+
+    await async_test(
+      "Scenario 3: Per-form conditions match on primary form",
+      () => sdk.api.endusers.getOne(enduserA2.id),
+      { onResult: (e: Enduser) => !!e.tags?.includes('per-form-primary') }
+    )
+
+    await sdk.api.automation_triggers.deleteOne(trigger3.id)
+
+    // ── Scenario 4: Per-form conditions match on secondary form ──
+    const trigger4 = await sdk.api.automation_triggers.createOne({
+      event: {
+        type: 'Form Submitted',
+        info: {
+          formId: formA.id,
+          otherFormIds: [formB.id],
+          conditionsByFormId: {
+            [formB.id]: { "$and": [{ "condition": { [fieldB.id]: "secondary-match" } }] },
+          },
+        },
+      },
+      action: { type: 'Add Tags', info: { tags: ['per-form-secondary'] } },
+      status: 'Active',
+      title: "Scenario 4: Per-form conditions on secondary",
+    })
+    allTriggers.push(trigger4)
+
+    await submitForm(formB.id, enduserB2.id, [{
+      fieldId: fieldB.id, fieldTitle: 'FieldB',
+      answer: { type: 'string', value: 'secondary-match' },
+    }])
+    await wait(undefined, 1000)
+
+    await async_test(
+      "Scenario 4: Per-form conditions match on secondary form",
+      () => sdk.api.endusers.getOne(enduserB2.id),
+      { onResult: (e: Enduser) => !!e.tags?.includes('per-form-secondary') }
+    )
+
+    await sdk.api.automation_triggers.deleteOne(trigger4.id)
+
+    // ── Scenario 5: Per-form conditions on one form don't block a different form ──
+    const trigger5 = await sdk.api.automation_triggers.createOne({
+      event: {
+        type: 'Form Submitted',
+        info: {
+          formId: formA.id,
+          otherFormIds: [formB.id],
+          conditionsByFormId: {
+            [formA.id]: { "$and": [{ "condition": { [fieldA.id]: "strict-value" } }] },
+          },
+        },
+      },
+      action: { type: 'Add Tags', info: { tags: ['no-cross-block'] } },
+      status: 'Active',
+      title: "Scenario 5: No cross-form condition blocking",
+    })
+    allTriggers.push(trigger5)
+
+    await submitForm(formB.id, enduserB3.id, [{
+      fieldId: fieldB.id, fieldTitle: 'FieldB',
+      answer: { type: 'string', value: 'anything' },
+    }])
+    await wait(undefined, 1000)
+
+    await async_test(
+      "Scenario 5: Conditions on FormA do not block FormB (no cross-form blocking)",
+      () => sdk.api.endusers.getOne(enduserB3.id),
+      { onResult: (e: Enduser) => !!e.tags?.includes('no-cross-block') }
+    )
+
+    await sdk.api.automation_triggers.deleteOne(trigger5.id)
+
+    // ── Scenario 6: conditionsByFormId overrides global conditions ──
+    const trigger6 = await sdk.api.automation_triggers.createOne({
+      event: {
+        type: 'Form Submitted',
+        info: {
+          formId: formA.id,
+          conditionsByFormId: {
+            [formA.id]: { "$and": [{ "condition": { [fieldA.id]: "per-form-value" } }] },
+          },
+        },
+        conditions: {
+          "$and": [{ "condition": { [fieldA.id]: "global-value" } }]
+        },
+      },
+      action: { type: 'Add Tags', info: { tags: ['override-test'] } },
+      status: 'Active',
+      title: "Scenario 6: conditionsByFormId overrides global",
+    })
+    allTriggers.push(trigger6)
+
+    // 6a: Submit with per-form matching value — should fire
+    await submitForm(formA.id, enduserA3.id, [{
+      fieldId: fieldA.id, fieldTitle: 'FieldA',
+      answer: { type: 'string', value: 'per-form-value' },
+    }])
+    await wait(undefined, 1000)
+
+    await async_test(
+      "Scenario 6a: conditionsByFormId match fires trigger (overrides global)",
+      () => sdk.api.endusers.getOne(enduserA3.id),
+      { onResult: (e: Enduser) => !!e.tags?.includes('override-test') }
+    )
+
+    // 6b: Submit with global matching value — should NOT fire (per-form takes precedence)
+    await submitForm(formA.id, enduserA4.id, [{
+      fieldId: fieldA.id, fieldTitle: 'FieldA',
+      answer: { type: 'string', value: 'global-value' },
+    }])
+    await wait(undefined, 1000)
+
+    await async_test(
+      "Scenario 6b: Global conditions ignored when conditionsByFormId exists",
+      () => sdk.api.endusers.getOne(enduserA4.id),
+      { onResult: (e: Enduser) => !e.tags?.includes('override-test') }
+    )
+
+    await sdk.api.automation_triggers.deleteOne(trigger6.id)
+
+  } finally {
+    // Cleanup
+    for (const e of allEndusers) {
+      try { await sdk.api.endusers.deleteOne(e.id) } catch (err) { /* may already be deleted */ }
+    }
+    for (const t of allTriggers) {
+      try { await sdk.api.automation_triggers.deleteOne(t.id) } catch (err) { /* may already be deleted */ }
+    }
+    try { await sdk.api.forms.deleteOne(formA.id) } catch (err) { /* ignore */ }
+    try { await sdk.api.forms.deleteOne(formB.id) } catch (err) { /* ignore */ }
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await form_submitted_trigger_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ Form Submitted trigger tests completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Form Submitted trigger tests failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/integrations_redacted.test.ts

@@ -0,0 +1,245 @@
+require('source-map-support').install();
+
+import { Session } from "../../sdk"
+import {
+  async_test,
+  log_header,
+} from "@tellescope/testing"
+import { setup_tests } from "../setup"
+import { INTEGRATION_SENSITIVE_FIELDS } from "@tellescope/constants"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const hasNoSensitiveFields = (integration: any) => {
+  for (const field of INTEGRATION_SENSITIVE_FIELDS) {
+    if (field in integration) return false
+  }
+  return true
+}
+
+export const integrations_redacted_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("Integrations Redacted Endpoints Tests")
+
+  let integrationId = ''
+  let sensitiveIntegrationId = ''
+
+  try {
+    // Create an integration with real auth data
+    const created = await sdk.api.integrations.createOne({
+      title: 'Test Redacted Integration',
+      authentication: { type: 'oauth2', info: { access_token: 'test-access-token', refresh_token: 'test-refresh-token', scope: '', token_type: 'Bearer', expiry_date: new Date().getTime() } },
+      webhooksSecret: 'super-secret-webhook',
+      emailDisabled: false,
+    })
+    integrationId = created.id
+
+    // load_redacted as creator — verify integration is returned, no sensitive fields present
+    await async_test(
+      "load_redacted as creator returns redacted integrations",
+      () => sdk.api.integrations.load_redacted({}),
+      { onResult: r => {
+        const found = r.integrations.find((i: any) => i.id === integrationId)
+        return !!found && hasNoSensitiveFields(found) && found.title === 'Test Redacted Integration'
+      }}
+    )
+
+    // load_redacted as non-creator — verify same integration visible and redacted
+    await async_test(
+      "load_redacted as non-creator returns redacted integrations (bypasses CREATOR_ONLY)",
+      () => sdkNonAdmin.api.integrations.load_redacted({}),
+      { onResult: r => {
+        const found = r.integrations.find((i: any) => i.id === integrationId)
+        return !!found && hasNoSensitiveFields(found) && found.title === 'Test Redacted Integration'
+      }}
+    )
+
+    // Standard load endpoints enforce CREATOR_ONLY — creator gets full object, non-creator gets nothing
+    await async_test(
+      "getOne as creator returns full integration including sensitive fields",
+      () => sdk.api.integrations.getOne(integrationId),
+      { onResult: i => !!i && 'authentication' in i && 'webhooksSecret' in i }
+    )
+
+    await async_test(
+      "getOne as non-creator returns 404 (CREATOR_ONLY access control)",
+      () => sdkNonAdmin.api.integrations.getOne(integrationId),
+      { shouldError: true, onError: () => true }
+    )
+
+    await async_test(
+      "getSome as non-creator returns empty list (CREATOR_ONLY access control)",
+      () => sdkNonAdmin.api.integrations.getSome(),
+      { onResult: r => Array.isArray(r) && r.find((i: any) => i.id === integrationId) === undefined }
+    )
+
+    // update_settings as creator — update a non-sensitive field
+    await async_test(
+      "update_settings as creator updates non-sensitive field",
+      () => sdk.api.integrations.update_settings({ id: integrationId, updates: { emailDisabled: true } }),
+      { onResult: r => {
+        return !!r.integration && r.integration.emailDisabled === true && hasNoSensitiveFields(r.integration)
+      }}
+    )
+
+    // update_settings as non-creator — update another field
+    await async_test(
+      "update_settings as non-creator updates non-sensitive field",
+      () => sdkNonAdmin.api.integrations.update_settings({ id: integrationId, updates: { disableEnduserAutoSync: true } }),
+      { onResult: r => {
+        return !!r.integration && r.integration.disableEnduserAutoSync === true && hasNoSensitiveFields(r.integration)
+      }}
+    )
+
+    // update_settings rejects sensitive fields
+    await async_test(
+      "update_settings rejects authentication update",
+      () => sdkNonAdmin.api.integrations.update_settings({ id: integrationId, updates: { authentication: { type: 'apiKey', info: { api_key: 'hacked' } } } as any }),
+      { shouldError: true, onError: () => true }
+    )
+
+    await async_test(
+      "update_settings rejects webhooksSecret update",
+      () => sdkNonAdmin.api.integrations.update_settings({ id: integrationId, updates: { webhooksSecret: 'hacked' } as any }),
+      { shouldError: true, onError: () => true }
+    )
+
+    await async_test(
+      "update_settings rejects fhirClientSecret update",
+      () => sdkNonAdmin.api.integrations.update_settings({ id: integrationId, updates: { fhirClientSecret: 'hacked' } as any }),
+      { shouldError: true, onError: () => true }
+    )
+
+    // Group 1: Dot-notation bypass tests (validates the allowlist fix)
+    await async_test(
+      "update_settings rejects dot-notation authentication.info.api_key update",
+      () => sdk.api.integrations.update_settings({ id: integrationId, updates: { "authentication.info.api_key": "hacked" } as any }),
+      { shouldError: true, onError: () => true }
+    )
+
+    await async_test(
+      "update_settings rejects dot-notation authentication.type update",
+      () => sdk.api.integrations.update_settings({ id: integrationId, updates: { "authentication.type": "hacked" } as any }),
+      { shouldError: true, onError: () => true }
+    )
+
+    // Group 2: Remaining sensitive field rejections
+    await async_test(
+      "update_settings rejects fhirClientId update",
+      () => sdk.api.integrations.update_settings({ id: integrationId, updates: { fhirClientId: 'hacked' } as any }),
+      { shouldError: true, onError: () => true }
+    )
+
+    await async_test(
+      "update_settings rejects fhirAccessToken update",
+      () => sdk.api.integrations.update_settings({ id: integrationId, updates: { fhirAccessToken: 'hacked' } as any }),
+      { shouldError: true, onError: () => true }
+    )
+
+    // Group 3: Non-allowlisted field rejections
+    await async_test(
+      "update_settings rejects title update (not in allowlist)",
+      () => sdk.api.integrations.update_settings({ id: integrationId, updates: { title: 'hacked' } as any }),
+      { shouldError: true, onError: () => true }
+    )
+
+    await async_test(
+      "update_settings rejects environment update (not in allowlist)",
+      () => sdk.api.integrations.update_settings({ id: integrationId, updates: { environment: 'hacked' } as any }),
+      { shouldError: true, onError: () => true }
+    )
+
+    await async_test(
+      "update_settings rejects unknown field update",
+      () => sdk.api.integrations.update_settings({ id: integrationId, updates: { unknownField: 'hacked' } as any }),
+      { shouldError: true, onError: () => true }
+    )
+
+    // Group 4: Verify additional allowlisted fields can be updated
+    await async_test(
+      "update_settings allows syncUnrecognizedSenders update",
+      () => sdk.api.integrations.update_settings({ id: integrationId, updates: { syncUnrecognizedSenders: true } }),
+      { onResult: r => !!r.integration && r.integration.syncUnrecognizedSenders === true && hasNoSensitiveFields(r.integration) }
+    )
+
+    await async_test(
+      "update_settings allows pushCalendarDetails update",
+      () => sdk.api.integrations.update_settings({ id: integrationId, updates: { pushCalendarDetails: true } }),
+      { onResult: r => !!r.integration && r.integration.pushCalendarDetails === true && hasNoSensitiveFields(r.integration) }
+    )
+
+    // Group 5: Explicit per-field redaction verification
+    // Note: fhirClientId/fhirClientSecret/fhirAccessToken are set server-side via OAuth flows only,
+    // so we test redaction of the fields that can be set via createOne (authentication, webhooksSecret)
+    const sensitiveIntegration = await sdk.api.integrations.createOne({
+      title: 'Test All Sensitive Fields',
+      authentication: { type: 'oauth2', info: { access_token: 'secret-access-token', refresh_token: 'secret-refresh-token', scope: '', token_type: 'Bearer', expiry_date: new Date().getTime() } },
+      webhooksSecret: 'super-secret-webhook-456',
+      emailDisabled: true,
+    })
+    sensitiveIntegrationId = sensitiveIntegration.id
+
+    await async_test(
+      "load_redacted omits authentication field individually",
+      () => sdk.api.integrations.load_redacted({}),
+      { onResult: r => {
+        const found = r.integrations.find((i: any) => i.id === sensitiveIntegrationId)
+        return !!found && !('authentication' in found)
+      }}
+    )
+
+    await async_test(
+      "load_redacted omits webhooksSecret field individually",
+      () => sdk.api.integrations.load_redacted({}),
+      { onResult: r => {
+        const found = r.integrations.find((i: any) => i.id === sensitiveIntegrationId)
+        return !!found && !('webhooksSecret' in found)
+      }}
+    )
+
+    await async_test(
+      "load_redacted still returns non-sensitive fields",
+      () => sdk.api.integrations.load_redacted({}),
+      { onResult: r => {
+        const found = r.integrations.find((i: any) => i.id === sensitiveIntegrationId)
+        return !!found && found.emailDisabled === true && found.title === 'Test All Sensitive Fields'
+      }}
+    )
+
+  } finally {
+    if (integrationId) {
+      try {
+        await sdk.api.integrations.deleteOne(integrationId)
+      } catch (error) {
+        console.error('Cleanup error:', error)
+      }
+    }
+    if (sensitiveIntegrationId) {
+      try {
+        await sdk.api.integrations.deleteOne(sensitiveIntegrationId)
+      } catch (error) {
+        console.error('Cleanup error (sensitive integration):', error)
+      }
+    }
+  }
+}
+
+if (require.main === module) {
+  console.log(`Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await integrations_redacted_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("Integrations redacted test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("Integrations redacted test suite failed:", error)
+      process.exit(1)
+    })
+}