@tellescope/sdk 1.247.0 → 1.248.0

package/lib/cjs/tests/api_tests/integrations_redacted.test.js

@@ -0,0 +1,273 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.integrations_redacted_tests = void 0;
+require('source-map-support').install();
+var sdk_1 = require("../../sdk");
+var testing_1 = require("@tellescope/testing");
+var setup_1 = require("../setup");
+var constants_1 = require("@tellescope/constants");
+var host = process.env.API_URL || 'http://localhost:8080';
+var hasNoSensitiveFields = function (integration) {
+    for (var _i = 0, INTEGRATION_SENSITIVE_FIELDS_1 = constants_1.INTEGRATION_SENSITIVE_FIELDS; _i < INTEGRATION_SENSITIVE_FIELDS_1.length; _i++) {
+        var field = INTEGRATION_SENSITIVE_FIELDS_1[_i];
+        if (field in integration)
+            return false;
+    }
+    return true;
+};
+var integrations_redacted_tests = function (_a) {
+    var sdk = _a.sdk, sdkNonAdmin = _a.sdkNonAdmin;
+    return __awaiter(void 0, void 0, void 0, function () {
+        var integrationId, sensitiveIntegrationId, created, sensitiveIntegration, error_1, error_2;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    (0, testing_1.log_header)("Integrations Redacted Endpoints Tests");
+                    integrationId = '';
+                    sensitiveIntegrationId = '';
+                    _b.label = 1;
+                case 1:
+                    _b.trys.push([1, , 26, 35]);
+                    return [4 /*yield*/, sdk.api.integrations.createOne({
+                            title: 'Test Redacted Integration',
+                            authentication: { type: 'oauth2', info: { access_token: 'test-access-token', refresh_token: 'test-refresh-token', scope: '', token_type: 'Bearer', expiry_date: new Date().getTime() } },
+                            webhooksSecret: 'super-secret-webhook',
+                            emailDisabled: false,
+                        })];
+                case 2:
+                    created = _b.sent();
+                    integrationId = created.id;
+                    // load_redacted as creator — verify integration is returned, no sensitive fields present
+                    return [4 /*yield*/, (0, testing_1.async_test)("load_redacted as creator returns redacted integrations", function () { return sdk.api.integrations.load_redacted({}); }, { onResult: function (r) {
+                                var found = r.integrations.find(function (i) { return i.id === integrationId; });
+                                return !!found && hasNoSensitiveFields(found) && found.title === 'Test Redacted Integration';
+                            } })
+                        // load_redacted as non-creator — verify same integration visible and redacted
+                    ];
+                case 3:
+                    // load_redacted as creator — verify integration is returned, no sensitive fields present
+                    _b.sent();
+                    // load_redacted as non-creator — verify same integration visible and redacted
+                    return [4 /*yield*/, (0, testing_1.async_test)("load_redacted as non-creator returns redacted integrations (bypasses CREATOR_ONLY)", function () { return sdkNonAdmin.api.integrations.load_redacted({}); }, { onResult: function (r) {
+                                var found = r.integrations.find(function (i) { return i.id === integrationId; });
+                                return !!found && hasNoSensitiveFields(found) && found.title === 'Test Redacted Integration';
+                            } })
+                        // Standard load endpoints enforce CREATOR_ONLY — creator gets full object, non-creator gets nothing
+                    ];
+                case 4:
+                    // load_redacted as non-creator — verify same integration visible and redacted
+                    _b.sent();
+                    // Standard load endpoints enforce CREATOR_ONLY — creator gets full object, non-creator gets nothing
+                    return [4 /*yield*/, (0, testing_1.async_test)("getOne as creator returns full integration including sensitive fields", function () { return sdk.api.integrations.getOne(integrationId); }, { onResult: function (i) { return !!i && 'authentication' in i && 'webhooksSecret' in i; } })];
+                case 5:
+                    // Standard load endpoints enforce CREATOR_ONLY — creator gets full object, non-creator gets nothing
+                    _b.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)("getOne as non-creator returns 404 (CREATOR_ONLY access control)", function () { return sdkNonAdmin.api.integrations.getOne(integrationId); }, { shouldError: true, onError: function () { return true; } })];
+                case 6:
+                    _b.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)("getSome as non-creator returns empty list (CREATOR_ONLY access control)", function () { return sdkNonAdmin.api.integrations.getSome(); }, { onResult: function (r) { return Array.isArray(r) && r.find(function (i) { return i.id === integrationId; }) === undefined; } })
+                        // update_settings as creator — update a non-sensitive field
+                    ];
+                case 7:
+                    _b.sent();
+                    // update_settings as creator — update a non-sensitive field
+                    return [4 /*yield*/, (0, testing_1.async_test)("update_settings as creator updates non-sensitive field", function () { return sdk.api.integrations.update_settings({ id: integrationId, updates: { emailDisabled: true } }); }, { onResult: function (r) {
+                                return !!r.integration && r.integration.emailDisabled === true && hasNoSensitiveFields(r.integration);
+                            } })
+                        // update_settings as non-creator — update another field
+                    ];
+                case 8:
+                    // update_settings as creator — update a non-sensitive field
+                    _b.sent();
+                    // update_settings as non-creator — update another field
+                    return [4 /*yield*/, (0, testing_1.async_test)("update_settings as non-creator updates non-sensitive field", function () { return sdkNonAdmin.api.integrations.update_settings({ id: integrationId, updates: { disableEnduserAutoSync: true } }); }, { onResult: function (r) {
+                                return !!r.integration && r.integration.disableEnduserAutoSync === true && hasNoSensitiveFields(r.integration);
+                            } })
+                        // update_settings rejects sensitive fields
+                    ];
+                case 9:
+                    // update_settings as non-creator — update another field
+                    _b.sent();
+                    // update_settings rejects sensitive fields
+                    return [4 /*yield*/, (0, testing_1.async_test)("update_settings rejects authentication update", function () { return sdkNonAdmin.api.integrations.update_settings({ id: integrationId, updates: { authentication: { type: 'apiKey', info: { api_key: 'hacked' } } } }); }, { shouldError: true, onError: function () { return true; } })];
+                case 10:
+                    // update_settings rejects sensitive fields
+                    _b.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)("update_settings rejects webhooksSecret update", function () { return sdkNonAdmin.api.integrations.update_settings({ id: integrationId, updates: { webhooksSecret: 'hacked' } }); }, { shouldError: true, onError: function () { return true; } })];
+                case 11:
+                    _b.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)("update_settings rejects fhirClientSecret update", function () { return sdkNonAdmin.api.integrations.update_settings({ id: integrationId, updates: { fhirClientSecret: 'hacked' } }); }, { shouldError: true, onError: function () { return true; } })
+                        // Group 1: Dot-notation bypass tests (validates the allowlist fix)
+                    ];
+                case 12:
+                    _b.sent();
+                    // Group 1: Dot-notation bypass tests (validates the allowlist fix)
+                    return [4 /*yield*/, (0, testing_1.async_test)("update_settings rejects dot-notation authentication.info.api_key update", function () { return sdk.api.integrations.update_settings({ id: integrationId, updates: { "authentication.info.api_key": "hacked" } }); }, { shouldError: true, onError: function () { return true; } })];
+                case 13:
+                    // Group 1: Dot-notation bypass tests (validates the allowlist fix)
+                    _b.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)("update_settings rejects dot-notation authentication.type update", function () { return sdk.api.integrations.update_settings({ id: integrationId, updates: { "authentication.type": "hacked" } }); }, { shouldError: true, onError: function () { return true; } })
+                        // Group 2: Remaining sensitive field rejections
+                    ];
+                case 14:
+                    _b.sent();
+                    // Group 2: Remaining sensitive field rejections
+                    return [4 /*yield*/, (0, testing_1.async_test)("update_settings rejects fhirClientId update", function () { return sdk.api.integrations.update_settings({ id: integrationId, updates: { fhirClientId: 'hacked' } }); }, { shouldError: true, onError: function () { return true; } })];
+                case 15:
+                    // Group 2: Remaining sensitive field rejections
+                    _b.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)("update_settings rejects fhirAccessToken update", function () { return sdk.api.integrations.update_settings({ id: integrationId, updates: { fhirAccessToken: 'hacked' } }); }, { shouldError: true, onError: function () { return true; } })
+                        // Group 3: Non-allowlisted field rejections
+                    ];
+                case 16:
+                    _b.sent();
+                    // Group 3: Non-allowlisted field rejections
+                    return [4 /*yield*/, (0, testing_1.async_test)("update_settings rejects title update (not in allowlist)", function () { return sdk.api.integrations.update_settings({ id: integrationId, updates: { title: 'hacked' } }); }, { shouldError: true, onError: function () { return true; } })];
+                case 17:
+                    // Group 3: Non-allowlisted field rejections
+                    _b.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)("update_settings rejects environment update (not in allowlist)", function () { return sdk.api.integrations.update_settings({ id: integrationId, updates: { environment: 'hacked' } }); }, { shouldError: true, onError: function () { return true; } })];
+                case 18:
+                    _b.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)("update_settings rejects unknown field update", function () { return sdk.api.integrations.update_settings({ id: integrationId, updates: { unknownField: 'hacked' } }); }, { shouldError: true, onError: function () { return true; } })
+                        // Group 4: Verify additional allowlisted fields can be updated
+                    ];
+                case 19:
+                    _b.sent();
+                    // Group 4: Verify additional allowlisted fields can be updated
+                    return [4 /*yield*/, (0, testing_1.async_test)("update_settings allows syncUnrecognizedSenders update", function () { return sdk.api.integrations.update_settings({ id: integrationId, updates: { syncUnrecognizedSenders: true } }); }, { onResult: function (r) { return !!r.integration && r.integration.syncUnrecognizedSenders === true && hasNoSensitiveFields(r.integration); } })];
+                case 20:
+                    // Group 4: Verify additional allowlisted fields can be updated
+                    _b.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)("update_settings allows pushCalendarDetails update", function () { return sdk.api.integrations.update_settings({ id: integrationId, updates: { pushCalendarDetails: true } }); }, { onResult: function (r) { return !!r.integration && r.integration.pushCalendarDetails === true && hasNoSensitiveFields(r.integration); } })
+                        // Group 5: Explicit per-field redaction verification
+                        // Note: fhirClientId/fhirClientSecret/fhirAccessToken are set server-side via OAuth flows only,
+                        // so we test redaction of the fields that can be set via createOne (authentication, webhooksSecret)
+                    ];
+                case 21:
+                    _b.sent();
+                    return [4 /*yield*/, sdk.api.integrations.createOne({
+                            title: 'Test All Sensitive Fields',
+                            authentication: { type: 'oauth2', info: { access_token: 'secret-access-token', refresh_token: 'secret-refresh-token', scope: '', token_type: 'Bearer', expiry_date: new Date().getTime() } },
+                            webhooksSecret: 'super-secret-webhook-456',
+                            emailDisabled: true,
+                        })];
+                case 22:
+                    sensitiveIntegration = _b.sent();
+                    sensitiveIntegrationId = sensitiveIntegration.id;
+                    return [4 /*yield*/, (0, testing_1.async_test)("load_redacted omits authentication field individually", function () { return sdk.api.integrations.load_redacted({}); }, { onResult: function (r) {
+                                var found = r.integrations.find(function (i) { return i.id === sensitiveIntegrationId; });
+                                return !!found && !('authentication' in found);
+                            } })];
+                case 23:
+                    _b.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)("load_redacted omits webhooksSecret field individually", function () { return sdk.api.integrations.load_redacted({}); }, { onResult: function (r) {
+                                var found = r.integrations.find(function (i) { return i.id === sensitiveIntegrationId; });
+                                return !!found && !('webhooksSecret' in found);
+                            } })];
+                case 24:
+                    _b.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)("load_redacted still returns non-sensitive fields", function () { return sdk.api.integrations.load_redacted({}); }, { onResult: function (r) {
+                                var found = r.integrations.find(function (i) { return i.id === sensitiveIntegrationId; });
+                                return !!found && found.emailDisabled === true && found.title === 'Test All Sensitive Fields';
+                            } })];
+                case 25:
+                    _b.sent();
+                    return [3 /*break*/, 35];
+                case 26:
+                    if (!integrationId) return [3 /*break*/, 30];
+                    _b.label = 27;
+                case 27:
+                    _b.trys.push([27, 29, , 30]);
+                    return [4 /*yield*/, sdk.api.integrations.deleteOne(integrationId)];
+                case 28:
+                    _b.sent();
+                    return [3 /*break*/, 30];
+                case 29:
+                    error_1 = _b.sent();
+                    console.error('Cleanup error:', error_1);
+                    return [3 /*break*/, 30];
+                case 30:
+                    if (!sensitiveIntegrationId) return [3 /*break*/, 34];
+                    _b.label = 31;
+                case 31:
+                    _b.trys.push([31, 33, , 34]);
+                    return [4 /*yield*/, sdk.api.integrations.deleteOne(sensitiveIntegrationId)];
+                case 32:
+                    _b.sent();
+                    return [3 /*break*/, 34];
+                case 33:
+                    error_2 = _b.sent();
+                    console.error('Cleanup error (sensitive integration):', error_2);
+                    return [3 /*break*/, 34];
+                case 34: return [7 /*endfinally*/];
+                case 35: return [2 /*return*/];
+            }
+        });
+    });
+};
+exports.integrations_redacted_tests = integrations_redacted_tests;
+if (require.main === module) {
+    console.log("Using API URL: ".concat(host));
+    var sdk_2 = new sdk_1.Session({ host: host });
+    var sdkNonAdmin_1 = new sdk_1.Session({ host: host });
+    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, (0, setup_1.setup_tests)(sdk_2, sdkNonAdmin_1)];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, (0, exports.integrations_redacted_tests)({ sdk: sdk_2, sdkNonAdmin: sdkNonAdmin_1 })];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); };
+    runTests()
+        .then(function () {
+        console.log("Integrations redacted test suite completed successfully");
+        process.exit(0);
+    })
+        .catch(function (error) {
+        console.error("Integrations redacted test suite failed:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=integrations_redacted.test.js.map

package/lib/cjs/tests/api_tests/integrations_redacted.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrations_redacted.test.js","sourceRoot":"","sources":["../../../../src/tests/api_tests/integrations_redacted.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,iCAAmC;AACnC,+CAG4B;AAC5B,kCAAsC;AACtC,mDAAoE;AAEpE,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE,IAAM,oBAAoB,GAAG,UAAC,WAAgB;IAC5C,KAAoB,UAA4B,EAA5B,iCAAA,wCAA4B,EAA5B,0CAA4B,EAA5B,IAA4B,EAAE;QAA7C,IAAM,KAAK,qCAAA;QACd,IAAI,KAAK,IAAI,WAAW;YAAE,OAAO,KAAK,CAAA;KACvC;IACD,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAEM,IAAM,2BAA2B,GAAG,UAAO,EAA6D;QAA3D,GAAG,SAAA,EAAE,WAAW,iBAAA;;;;;;oBAClE,IAAA,oBAAU,EAAC,uCAAuC,CAAC,CAAA;oBAE/C,aAAa,GAAG,EAAE,CAAA;oBAClB,sBAAsB,GAAG,EAAE,CAAA;;;;oBAIb,qBAAM,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC;4BACnD,KAAK,EAAE,2BAA2B;4BAClC,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,oBAAoB,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,EAAE;4BACxL,cAAc,EAAE,sBAAsB;4BACtC,aAAa,EAAE,KAAK;yBACrB,CAAC,EAAA;;oBALI,OAAO,GAAG,SAKd;oBACF,aAAa,GAAG,OAAO,CAAC,EAAE,CAAA;oBAE1B,yFAAyF;oBACzF,qBAAM,IAAA,oBAAU,EACd,wDAAwD,EACxD,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC,EAAE,CAAC,EAAtC,CAAsC,EAC5C,EAAE,QAAQ,EAAE,UAAA,CAAC;gCACX,IAAM,KAAK,GAAG,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,UAAC,CAAM,IAAK,OAAA,CAAC,CAAC,EAAE,KAAK,aAAa,EAAtB,CAAsB,CAAC,CAAA;gCACrE,OAAO,CAAC,CAAC,KAAK,IAAI,oBAAoB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,KAAK,2BAA2B,CAAA;4BAC9F,CAAC,EAAC,CACH;wBAED,8EAA8E;sBAF7E;;oBARD,yFAAyF;oBACzF,SAOC,CAAA;oBAED,8EAA8E;oBAC9E,qBAAM,IAAA,oBAAU,EACd,oFAAoF,EACpF,cAAM,OAAA,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC,EAAE,CAAC,EAA9C,CAA8C,EACpD,EAAE,QAAQ,EAAE,UAAA,CAAC;gCACX,IAAM,KAAK,GAAG,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,UAAC,CAAM,IAAK,OAAA,CAAC,CAAC,EAAE,KAAK,aAAa,EAAtB,CAAsB,CAAC,CAAA;gCACrE,OAAO,CAAC,CAAC,KAAK,IAAI,oBAAoB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,KAAK,2BAA2B,CAAA;4BAC9F,CAAC,EAAC,CACH;wBAED,oGAAoG;sBAFnG;;oBARD,8EAA8E;oBAC9E,SAOC,CAAA;oBAED,oGAAoG;oBACpG,qBAAM,IAAA,oBAAU,EACd,uEAAuE,EACvE,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,EAA1C,CAA0C,EAChD,EAAE,QAAQ,EAAE,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,CAAC,IAAI,gBAAgB,IAAI,CAAC,IAAI,gBAAgB,IAAI,CAAC,EAArD,CAAqD,EAAE,CACzE,EAAA;;oBALD,oGAAoG;oBACpG,SAIC,CAAA;oBAED,qBAAM,IAAA,oBAAU,EACd,iEAAiE,EACjE,cAAM,OAAA,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,EAAlD,CAAkD,EACxD,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,cAAM,OAAA,IAAI,EAAJ,CAAI,EAAE,CAC3C,EAAA;;oBAJD,SAIC,CAAA;oBAED,qBAAM,IAAA,oBAAU,EACd,yEAAyE,EACzE,cAAM,OAAA,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE,EAAtC,CAAsC,EAC5C,EAAE,QAAQ,EAAE,UAAA,CAAC,IAAI,OAAA,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAC,CAAM,IAAK,OAAA,CAAC,CAAC,EAAE,KAAK,aAAa,EAAtB,CAAsB,CAAC,KAAK,SAAS,EAA5E,CAA4E,EAAE,CAChG;wBAED,4DAA4D;sBAF3D;;oBAJD,SAIC,CAAA;oBAED,4DAA4D;oBAC5D,qBAAM,IAAA,oBAAU,EACd,wDAAwD,EACxD,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,CAAC,EAA7F,CAA6F,EACnG,EAAE,QAAQ,EAAE,UAAA,CAAC;gCACX,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,CAAC,aAAa,KAAK,IAAI,IAAI,oBAAoB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;4BACvG,CAAC,EAAC,CACH;wBAED,wDAAwD;sBAFvD;;oBAPD,4DAA4D;oBAC5D,SAMC,CAAA;oBAED,wDAAwD;oBACxD,qBAAM,IAAA,oBAAU,EACd,4DAA4D,EAC5D,cAAM,OAAA,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,EAAE,CAAC,EAA9G,CAA8G,EACpH,EAAE,QAAQ,EAAE,UAAA,CAAC;gCACX,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,CAAC,sBAAsB,KAAK,IAAI,IAAI,oBAAoB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;4BAChH,CAAC,EAAC,CACH;wBAED,2CAA2C;sBAF1C;;oBAPD,wDAAwD;oBACxD,SAMC,CAAA;oBAED,2CAA2C;oBAC3C,qBAAM,IAAA,oBAAU,EACd,+CAA+C,EAC/C,cAAM,OAAA,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAS,EAAE,CAAC,EAAxJ,CAAwJ,EAC9J,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,cAAM,OAAA,IAAI,EAAJ,CAAI,EAAE,CAC3C,EAAA;;oBALD,2CAA2C;oBAC3C,SAIC,CAAA;oBAED,qBAAM,IAAA,oBAAU,EACd,+CAA+C,EAC/C,cAAM,OAAA,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAS,EAAE,CAAC,EAAjH,CAAiH,EACvH,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,cAAM,OAAA,IAAI,EAAJ,CAAI,EAAE,CAC3C,EAAA;;oBAJD,SAIC,CAAA;oBAED,qBAAM,IAAA,oBAAU,EACd,iDAAiD,EACjD,cAAM,OAAA,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,gBAAgB,EAAE,QAAQ,EAAS,EAAE,CAAC,EAAnH,CAAmH,EACzH,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,cAAM,OAAA,IAAI,EAAJ,CAAI,EAAE,CAC3C;wBAED,mEAAmE;sBAFlE;;oBAJD,SAIC,CAAA;oBAED,mEAAmE;oBACnE,qBAAM,IAAA,oBAAU,EACd,yEAAyE,EACzE,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,6BAA6B,EAAE,QAAQ,EAAS,EAAE,CAAC,EAAxH,CAAwH,EAC9H,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,cAAM,OAAA,IAAI,EAAJ,CAAI,EAAE,CAC3C,EAAA;;oBALD,mEAAmE;oBACnE,SAIC,CAAA;oBAED,qBAAM,IAAA,oBAAU,EACd,iEAAiE,EACjE,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,qBAAqB,EAAE,QAAQ,EAAS,EAAE,CAAC,EAAhH,CAAgH,EACtH,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,cAAM,OAAA,IAAI,EAAJ,CAAI,EAAE,CAC3C;wBAED,gDAAgD;sBAF/C;;oBAJD,SAIC,CAAA;oBAED,gDAAgD;oBAChD,qBAAM,IAAA,oBAAU,EACd,6CAA6C,EAC7C,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAS,EAAE,CAAC,EAAvG,CAAuG,EAC7G,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,cAAM,OAAA,IAAI,EAAJ,CAAI,EAAE,CAC3C,EAAA;;oBALD,gDAAgD;oBAChD,SAIC,CAAA;oBAED,qBAAM,IAAA,oBAAU,EACd,gDAAgD,EAChD,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAS,EAAE,CAAC,EAA1G,CAA0G,EAChH,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,cAAM,OAAA,IAAI,EAAJ,CAAI,EAAE,CAC3C;wBAED,4CAA4C;sBAF3C;;oBAJD,SAIC,CAAA;oBAED,4CAA4C;oBAC5C,qBAAM,IAAA,oBAAU,EACd,yDAAyD,EACzD,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAS,EAAE,CAAC,EAAhG,CAAgG,EACtG,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,cAAM,OAAA,IAAI,EAAJ,CAAI,EAAE,CAC3C,EAAA;;oBALD,4CAA4C;oBAC5C,SAIC,CAAA;oBAED,qBAAM,IAAA,oBAAU,EACd,+DAA+D,EAC/D,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAS,EAAE,CAAC,EAAtG,CAAsG,EAC5G,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,cAAM,OAAA,IAAI,EAAJ,CAAI,EAAE,CAC3C,EAAA;;oBAJD,SAIC,CAAA;oBAED,qBAAM,IAAA,oBAAU,EACd,8CAA8C,EAC9C,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAS,EAAE,CAAC,EAAvG,CAAuG,EAC7G,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,cAAM,OAAA,IAAI,EAAJ,CAAI,EAAE,CAC3C;wBAED,+DAA+D;sBAF9D;;oBAJD,SAIC,CAAA;oBAED,+DAA+D;oBAC/D,qBAAM,IAAA,oBAAU,EACd,uDAAuD,EACvD,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,IAAI,EAAE,EAAE,CAAC,EAAvG,CAAuG,EAC7G,EAAE,QAAQ,EAAE,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,CAAC,uBAAuB,KAAK,IAAI,IAAI,oBAAoB,CAAC,CAAC,CAAC,WAAW,CAAC,EAAxG,CAAwG,EAAE,CAC5H,EAAA;;oBALD,+DAA+D;oBAC/D,SAIC,CAAA;oBAED,qBAAM,IAAA,oBAAU,EACd,mDAAmD,EACnD,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,EAAE,CAAC,EAAnG,CAAmG,EACzG,EAAE,QAAQ,EAAE,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,CAAC,mBAAmB,KAAK,IAAI,IAAI,oBAAoB,CAAC,CAAC,CAAC,WAAW,CAAC,EAApG,CAAoG,EAAE,CACxH;wBAED,qDAAqD;wBACrD,gGAAgG;wBAChG,oGAAoG;sBAJnG;;oBAJD,SAIC,CAAA;oBAK4B,qBAAM,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC;4BAChE,KAAK,EAAE,2BAA2B;4BAClC,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,YAAY,EAAE,qBAAqB,EAAE,aAAa,EAAE,sBAAsB,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,EAAE;4BAC5L,cAAc,EAAE,0BAA0B;4BAC1C,aAAa,EAAE,IAAI;yBACpB,CAAC,EAAA;;oBALI,oBAAoB,GAAG,SAK3B;oBACF,sBAAsB,GAAG,oBAAoB,CAAC,EAAE,CAAA;oBAEhD,qBAAM,IAAA,oBAAU,EACd,uDAAuD,EACvD,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC,EAAE,CAAC,EAAtC,CAAsC,EAC5C,EAAE,QAAQ,EAAE,UAAA,CAAC;gCACX,IAAM,KAAK,GAAG,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,UAAC,CAAM,IAAK,OAAA,CAAC,CAAC,EAAE,KAAK,sBAAsB,EAA/B,CAA+B,CAAC,CAAA;gCAC9E,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,gBAAgB,IAAI,KAAK,CAAC,CAAA;4BAChD,CAAC,EAAC,CACH,EAAA;;oBAPD,SAOC,CAAA;oBAED,qBAAM,IAAA,oBAAU,EACd,uDAAuD,EACvD,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC,EAAE,CAAC,EAAtC,CAAsC,EAC5C,EAAE,QAAQ,EAAE,UAAA,CAAC;gCACX,IAAM,KAAK,GAAG,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,UAAC,CAAM,IAAK,OAAA,CAAC,CAAC,EAAE,KAAK,sBAAsB,EAA/B,CAA+B,CAAC,CAAA;gCAC9E,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,gBAAgB,IAAI,KAAK,CAAC,CAAA;4BAChD,CAAC,EAAC,CACH,EAAA;;oBAPD,SAOC,CAAA;oBAED,qBAAM,IAAA,oBAAU,EACd,kDAAkD,EAClD,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC,EAAE,CAAC,EAAtC,CAAsC,EAC5C,EAAE,QAAQ,EAAE,UAAA,CAAC;gCACX,IAAM,KAAK,GAAG,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,UAAC,CAAM,IAAK,OAAA,CAAC,CAAC,EAAE,KAAK,sBAAsB,EAA/B,CAA+B,CAAC,CAAA;gCAC9E,OAAO,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,IAAI,KAAK,CAAC,KAAK,KAAK,2BAA2B,CAAA;4BAC/F,CAAC,EAAC,CACH,EAAA;;oBAPD,SAOC,CAAA;;;yBAGG,aAAa,EAAb,yBAAa;;;;oBAEb,qBAAM,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC,aAAa,CAAC,EAAA;;oBAAnD,SAAmD,CAAA;;;;oBAEnD,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,OAAK,CAAC,CAAA;;;yBAGtC,sBAAsB,EAAtB,yBAAsB;;;;oBAEtB,qBAAM,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC,sBAAsB,CAAC,EAAA;;oBAA5D,SAA4D,CAAA;;;;oBAE5D,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,OAAK,CAAC,CAAA;;;;;;;CAIrE,CAAA;AA5MY,QAAA,2BAA2B,+BA4MvC;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,yBAAkB,IAAI,CAAE,CAAC,CAAA;IACrC,IAAM,KAAG,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACjC,IAAM,aAAW,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IAEzC,IAAM,QAAQ,GAAG;;;wBACf,qBAAM,IAAA,mBAAW,EAAC,KAAG,EAAE,aAAW,CAAC,EAAA;;oBAAnC,SAAmC,CAAA;oBACnC,qBAAM,IAAA,mCAA2B,EAAC,EAAE,GAAG,OAAA,EAAE,WAAW,eAAA,EAAE,CAAC,EAAA;;oBAAvD,SAAuD,CAAA;;;;SACxD,CAAA;IAED,QAAQ,EAAE;SACP,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAA;QACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAA;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}

package/lib/cjs/tests/api_tests/openloop_webhooks.test.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openloop_webhooks.test.d.ts","sourceRoot":"","sources":["../../../../src/tests/api_tests/openloop_webhooks.test.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AA2EnC,eAAO,MAAM,uBAAuB;SAAuC,OAAO;iBAAe,OAAO;mBAkjBvG,CAAA"}
+{"version":3,"file":"openloop_webhooks.test.d.ts","sourceRoot":"","sources":["../../../../src/tests/api_tests/openloop_webhooks.test.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AA2EnC,eAAO,MAAM,uBAAuB;SAAuC,OAAO;iBAAe,OAAO;mBAknBvG,CAAA"}

package/lib/cjs/tests/api_tests/openloop_webhooks.test.js

@@ -116,7 +116,7 @@ var openloop_webhooks_tests = function (_a) {
                     enduser2 = _b.sent();
                     _b.label = 3;
                 case 3:
-                    _b.trys.push([3, , 25, 28]);
+                    _b.trys.push([3, , 28, 31]);
                     // ===== SECTION A: V1 Validation =====
                     (0, testing_1.log_header)("V1 Validation");
                     return [4 /*yield*/, (0, testing_1.async_test)('V1: missing patientID returns 400', function () { return __awaiter(void 0, void 0, void 0, function () {
@@ -188,6 +188,33 @@ var openloop_webhooks_tests = function (_a) {
                             });
                         }); }, { onResult: function (r) { return r === true; } })];
                 case 6:
+                    _b.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)('V1: order_confirmation maps program_code to protocol field', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var orderNum, res, orders;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        orderNum = "ol-conf-protocol-".concat(uid());
+                                        return [4 /*yield*/, postV1(makeV1Confirmation({
+                                                patientID: healthieId1,
+                                                orderNumber: orderNum,
+                                                program_code: 'Weight-Loss',
+                                            }))];
+                                    case 1:
+                                        res = _a.sent();
+                                        (0, testing_1.assert)(res.status === 200, "Expected 200, got ".concat(res.status));
+                                        return [4 /*yield*/, sdk.api.enduser_orders.getSome({
+                                                filter: { source: 'OpenLoop', externalId: orderNum }
+                                            })];
+                                    case 2:
+                                        orders = _a.sent();
+                                        (0, testing_1.assert)(orders.length === 1, "Expected 1 order, got ".concat(orders.length));
+                                        (0, testing_1.assert)(orders[0].protocol === 'Weight-Loss', "protocol mismatch: ".concat(orders[0].protocol));
+                                        return [2 /*return*/, true];
+                                }
+                            });
+                        }); }, { onResult: function (r) { return r === true; } })];
+                case 7:
                     _b.sent();
                     return [4 /*yield*/, (0, testing_1.async_test)('V1: order_confirmation idempotency - same order not duplicated', function () { return __awaiter(void 0, void 0, void 0, function () {
                             var res, orders;
@@ -215,7 +242,7 @@ var openloop_webhooks_tests = function (_a) {
                                 }
                             });
                         }); }, { onResult: function (r) { return r === true; } })];
-                case 7:
+                case 8:
                     _b.sent();
                     return [4 /*yield*/, (0, testing_1.async_test)('V1: order_confirmation without sku_med falls back to pharmacy name', function () { return __awaiter(void 0, void 0, void 0, function () {
                             var orderNum, res, orders;
@@ -245,7 +272,7 @@ var openloop_webhooks_tests = function (_a) {
                         }); }, { onResult: function (r) { return r === true; } })
                         // ===== SECTION C: V1 order_shipped =====
                     ];
-                case 8:
+                case 9:
                     _b.sent();
                     // ===== SECTION C: V1 order_shipped =====
                     (0, testing_1.log_header)("V1 order_shipped");
@@ -288,7 +315,7 @@ var openloop_webhooks_tests = function (_a) {
                                 }
                             });
                         }); }, { onResult: function (r) { return r === true; } })];
-                case 9:
+                case 10:
                     _b.sent();
                     return [4 /*yield*/, (0, testing_1.async_test)('V1: order_shipped updates title and sku when provided', function () { return __awaiter(void 0, void 0, void 0, function () {
                             var res, orders, order;
@@ -318,7 +345,7 @@ var openloop_webhooks_tests = function (_a) {
                                 }
                             });
                         }); }, { onResult: function (r) { return r === true; } })];
-                case 10:
+                case 11:
                     _b.sent();
                     return [4 /*yield*/, (0, testing_1.async_test)('V1: order_shipped creates new order if none exists', function () { return __awaiter(void 0, void 0, void 0, function () {
                             var newOrderNum, res, orders, order;
@@ -354,7 +381,7 @@ var openloop_webhooks_tests = function (_a) {
                                 }
                             });
                         }); }, { onResult: function (r) { return r === true; } })];
-                case 11:
+                case 12:
                     _b.sent();
                     return [4 /*yield*/, (0, testing_1.async_test)('V1: order_shipped can re-ship with updated tracking', function () { return __awaiter(void 0, void 0, void 0, function () {
                             var reshipOrderNum, res, orders;
@@ -397,10 +424,40 @@ var openloop_webhooks_tests = function (_a) {
                                         return [2 /*return*/, true];
                                 }
                             });
+                        }); }, { onResult: function (r) { return r === true; } })];
+                case 13:
+                    _b.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)('V1: order_shipped maps program_code to protocol field', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var orderNum, res, orders;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        orderNum = "ol-ship-protocol-".concat(uid());
+                                        return [4 /*yield*/, postV1(makeV1Confirmation({ patientID: healthieId1, orderNumber: orderNum }))];
+                                    case 1:
+                                        _a.sent();
+                                        return [4 /*yield*/, postV1(makeV1Shipped({
+                                                patientID: healthieId1,
+                                                orderNumber: orderNum,
+                                                program_code: 'Diabetes',
+                                            }))];
+                                    case 2:
+                                        res = _a.sent();
+                                        (0, testing_1.assert)(res.status === 200, "Expected 200, got ".concat(res.status));
+                                        return [4 /*yield*/, sdk.api.enduser_orders.getSome({
+                                                filter: { source: 'OpenLoop', externalId: orderNum }
+                                            })];
+                                    case 3:
+                                        orders = _a.sent();
+                                        (0, testing_1.assert)(orders.length === 1, "Expected 1 order, got ".concat(orders.length));
+                                        (0, testing_1.assert)(orders[0].protocol === 'Diabetes', "protocol mismatch: ".concat(orders[0].protocol));
+                                        return [2 /*return*/, true];
+                                }
+                            });
                         }); }, { onResult: function (r) { return r === true; } })
                         // ===== SECTION D: V1 enduserId Isolation =====
                     ];
-                case 12:
+                case 14:
                     _b.sent();
                     // ===== SECTION D: V1 enduserId Isolation =====
                     (0, testing_1.log_header)("V1 enduserId Isolation");
@@ -439,7 +496,7 @@ var openloop_webhooks_tests = function (_a) {
                         }); }, { onResult: function (r) { return r === true; } })
                         // ===== SECTION E: V2 Validation =====
                     ];
-                case 13:
+                case 15:
                     _b.sent();
                     // ===== SECTION E: V2 Validation =====
                     (0, testing_1.log_header)("V2 Validation");
@@ -457,7 +514,7 @@ var openloop_webhooks_tests = function (_a) {
                                 }
                             });
                         }); }, { onResult: function (s) { return s === 400; } })];
-                case 14:
+                case 16:
                     _b.sent();
                     return [4 /*yield*/, (0, testing_1.async_test)('V2: invalid eventType returns 400', function () { return __awaiter(void 0, void 0, void 0, function () {
                             var res;
@@ -470,7 +527,7 @@ var openloop_webhooks_tests = function (_a) {
                                 }
                             });
                         }); }, { onResult: function (s) { return s === 400; } })];
-                case 15:
+                case 17:
                     _b.sent();
                     return [4 /*yield*/, (0, testing_1.async_test)('V2: unknown patient returns 404', function () { return __awaiter(void 0, void 0, void 0, function () {
                             var res;
@@ -485,7 +542,7 @@ var openloop_webhooks_tests = function (_a) {
                         }); }, { onResult: function (s) { return s === 404; } })
                         // ===== SECTION F: V2 Order Lifecycle =====
                     ];
-                case 16:
+                case 18:
                     _b.sent();
                     // ===== SECTION F: V2 Order Lifecycle =====
                     (0, testing_1.log_header)("V2 Order Lifecycle");
@@ -520,7 +577,34 @@ var openloop_webhooks_tests = function (_a) {
                                 }
                             });
                         }); }, { onResult: function (r) { return r === true; } })];
-                case 17:
+                case 19:
+                    _b.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)('V2: prescription-created maps program_code to protocol field', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var orderNum, res, orders;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        orderNum = "v2-protocol-".concat(uid());
+                                        return [4 /*yield*/, postV2(makeV2Payload('prescription-created', {
+                                                id: orderNum,
+                                                patientId: healthieId1,
+                                                program_code: 'GLP-1',
+                                            }))];
+                                    case 1:
+                                        res = _a.sent();
+                                        (0, testing_1.assert)(res.status === 200, "Expected 200, got ".concat(res.status));
+                                        return [4 /*yield*/, sdk.api.enduser_orders.getSome({
+                                                filter: { source: 'OpenLoop', externalId: orderNum }
+                                            })];
+                                    case 2:
+                                        orders = _a.sent();
+                                        (0, testing_1.assert)(orders.length === 1, "Expected 1 order, got ".concat(orders.length));
+                                        (0, testing_1.assert)(orders[0].protocol === 'GLP-1', "protocol mismatch: ".concat(orders[0].protocol));
+                                        return [2 /*return*/, true];
+                                }
+                            });
+                        }); }, { onResult: function (r) { return r === true; } })];
+                case 20:
                     _b.sent();
                     return [4 /*yield*/, (0, testing_1.async_test)('V2: prescription-shipped updates with carrier and tracking', function () { return __awaiter(void 0, void 0, void 0, function () {
                             var res, orders, order;
@@ -553,7 +637,7 @@ var openloop_webhooks_tests = function (_a) {
                                 }
                             });
                         }); }, { onResult: function (r) { return r === true; } })];
-                case 18:
+                case 21:
                     _b.sent();
                     v2CancelId_1 = "v2-cancel-".concat(uid());
                     return [4 /*yield*/, (0, testing_1.async_test)('V2: prescription-cancelled sets cancelledDate and reason', function () { return __awaiter(void 0, void 0, void 0, function () {
@@ -594,7 +678,7 @@ var openloop_webhooks_tests = function (_a) {
                                 }
                             });
                         }); }, { onResult: function (r) { return r === true; } })];
-                case 19:
+                case 22:
                     _b.sent();
                     v2RefundId_1 = "v2-refund-".concat(uid());
                     return [4 /*yield*/, (0, testing_1.async_test)('V2: prescription-refunded sets status', function () { return __awaiter(void 0, void 0, void 0, function () {
@@ -628,7 +712,7 @@ var openloop_webhooks_tests = function (_a) {
                         }); }, { onResult: function (r) { return r === true; } })
                         // ===== SECTION G: V2 Idempotency & Isolation =====
                     ];
-                case 20:
+                case 23:
                     _b.sent();
                     // ===== SECTION G: V2 Idempotency & Isolation =====
                     (0, testing_1.log_header)("V2 Idempotency & Isolation");
@@ -660,7 +744,7 @@ var openloop_webhooks_tests = function (_a) {
                                 }
                             });
                         }); }, { onResult: function (r) { return r === true; } })];
-                case 21:
+                case 24:
                     _b.sent();
                     return [4 /*yield*/, (0, testing_1.async_test)('V2: same id for different patients creates separate orders', function () { return __awaiter(void 0, void 0, void 0, function () {
                             var sharedV2Id, res1, res2, orders, enduserIds, expected;
@@ -697,7 +781,7 @@ var openloop_webhooks_tests = function (_a) {
                         }); }, { onResult: function (r) { return r === true; } })
                         // ===== SECTION H: V2 Full Lifecycle =====
                     ];
-                case 22:
+                case 25:
                     _b.sent();
                     // ===== SECTION H: V2 Full Lifecycle =====
                     (0, testing_1.log_header)("V2 Full Lifecycle");
@@ -741,7 +825,7 @@ var openloop_webhooks_tests = function (_a) {
                         }); }, { onResult: function (r) { return r === true; } })
                         // ===== SECTION I: V2 Undefined Field Handling =====
                     ];
-                case 23:
+                case 26:
                     _b.sent();
                     // ===== SECTION I: V2 Undefined Field Handling =====
                     (0, testing_1.log_header)("V2 Undefined Field Handling");
@@ -785,18 +869,18 @@ var openloop_webhooks_tests = function (_a) {
                                 }
                             });
                         }); }, { onResult: function (r) { return r === true; } })];
-                case 24:
+                case 27:
                     _b.sent();
                     console.log("All OpenLoop webhook tests passed!");
-                    return [3 /*break*/, 28];
-                case 25: return [4 /*yield*/, sdk.api.endusers.deleteOne(enduser1.id).catch(console.error)];
-                case 26:
+                    return [3 /*break*/, 31];
+                case 28: return [4 /*yield*/, sdk.api.endusers.deleteOne(enduser1.id).catch(console.error)];
+                case 29:
                     _b.sent();
                     return [4 /*yield*/, sdk.api.endusers.deleteOne(enduser2.id).catch(console.error)];
-                case 27:
+                case 30:
                     _b.sent();
                     return [7 /*endfinally*/];
-                case 28: return [2 /*return*/];
+                case 31: return [2 /*return*/];
             }
         });
     });