@tellescope/sdk 1.247.0 → 1.249.0

package/src/tests/api_tests/date_string_validation.test.ts

@@ -0,0 +1,107 @@
+require('source-map-support').install();
+
+import { Session } from "../../sdk"
+import {
+  assert,
+  log_header,
+} from "@tellescope/testing"
+import { setup_tests } from "../setup"
+import { is_valid_mm_dd_yyyy } from "@tellescope/validation"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+export const date_string_validation_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("Date String Validation Tests (is_valid_mm_dd_yyyy)")
+
+  // --- Valid standard dates ---
+  assert(is_valid_mm_dd_yyyy('01-15-1990') === true, 'Expected 01-15-1990 to be valid', 'valid: 01-15-1990')
+  assert(is_valid_mm_dd_yyyy('12-31-2024') === true, 'Expected 12-31-2024 to be valid', 'valid: 12-31-2024')
+  assert(is_valid_mm_dd_yyyy('06-15-2000') === true, 'Expected 06-15-2000 to be valid', 'valid: 06-15-2000')
+  assert(is_valid_mm_dd_yyyy('01-01-2000') === true, 'Expected 01-01-2000 to be valid', 'valid: 01-01-2000')
+
+  // --- Leap year: Feb 29 accepted ---
+  assert(is_valid_mm_dd_yyyy('02-29-2024') === true, 'Expected 02-29-2024 to be valid (2024 is leap year, div by 4)', 'valid: 02-29-2024 (leap year)')
+  assert(is_valid_mm_dd_yyyy('02-29-2000') === true, 'Expected 02-29-2000 to be valid (2000 is leap year, div by 400)', 'valid: 02-29-2000 (leap year)')
+  assert(is_valid_mm_dd_yyyy('02-29-2400') === true, 'Expected 02-29-2400 to be valid (2400 is leap year, div by 400)', 'valid: 02-29-2400 (leap year)')
+
+  // --- Non-leap year: Feb 29 rejected ---
+  assert(is_valid_mm_dd_yyyy('02-29-2023') === false, 'Expected 02-29-2023 to be invalid (2023 is not a leap year)', 'invalid: 02-29-2023 (not leap year)')
+  assert(is_valid_mm_dd_yyyy('02-29-1900') === false, 'Expected 02-29-1900 to be invalid (1900 div by 100 but not 400)', 'invalid: 02-29-1900 (not leap year)')
+  assert(is_valid_mm_dd_yyyy('02-29-2100') === false, 'Expected 02-29-2100 to be invalid (2100 div by 100 but not 400)', 'invalid: 02-29-2100 (not leap year)')
+  assert(is_valid_mm_dd_yyyy('02-29-2025') === false, 'Expected 02-29-2025 to be invalid (2025 is not a leap year)', 'invalid: 02-29-2025 (not leap year)')
+
+  // --- Feb 30 and Feb 31 always rejected (the original bug) ---
+  assert(is_valid_mm_dd_yyyy('02-30-2024') === false, 'Expected 02-30-2024 to be invalid (Feb never has 30 days)', 'invalid: 02-30-2024 (Feb 30 leap year)')
+  assert(is_valid_mm_dd_yyyy('02-31-2024') === false, 'Expected 02-31-2024 to be invalid (Feb never has 31 days)', 'invalid: 02-31-2024 (Feb 31 leap year)')
+  assert(is_valid_mm_dd_yyyy('02-30-2023') === false, 'Expected 02-30-2023 to be invalid (Feb never has 30 days)', 'invalid: 02-30-2023 (Feb 30 non-leap)')
+  assert(is_valid_mm_dd_yyyy('02-31-2023') === false, 'Expected 02-31-2023 to be invalid (Feb never has 31 days)', 'invalid: 02-31-2023 (Feb 31 non-leap)')
+
+  // --- Feb 28 always valid ---
+  assert(is_valid_mm_dd_yyyy('02-28-2024') === true, 'Expected 02-28-2024 to be valid', 'valid: 02-28-2024')
+  assert(is_valid_mm_dd_yyyy('02-28-2023') === true, 'Expected 02-28-2023 to be valid', 'valid: 02-28-2023')
+
+  // --- 30-day months: day 31 rejected ---
+  assert(is_valid_mm_dd_yyyy('04-31-2024') === false, 'Expected 04-31-2024 to be invalid (April has 30 days)', 'invalid: 04-31 (April)')
+  assert(is_valid_mm_dd_yyyy('06-31-2024') === false, 'Expected 06-31-2024 to be invalid (June has 30 days)', 'invalid: 06-31 (June)')
+  assert(is_valid_mm_dd_yyyy('09-31-2024') === false, 'Expected 09-31-2024 to be invalid (September has 30 days)', 'invalid: 09-31 (September)')
+  assert(is_valid_mm_dd_yyyy('11-31-2024') === false, 'Expected 11-31-2024 to be invalid (November has 30 days)', 'invalid: 11-31 (November)')
+
+  // --- 30-day months: day 30 accepted ---
+  assert(is_valid_mm_dd_yyyy('04-30-2024') === true, 'Expected 04-30-2024 to be valid', 'valid: 04-30 (April)')
+  assert(is_valid_mm_dd_yyyy('06-30-2024') === true, 'Expected 06-30-2024 to be valid', 'valid: 06-30 (June)')
+  assert(is_valid_mm_dd_yyyy('09-30-2024') === true, 'Expected 09-30-2024 to be valid', 'valid: 09-30 (September)')
+  assert(is_valid_mm_dd_yyyy('11-30-2024') === true, 'Expected 11-30-2024 to be valid', 'valid: 11-30 (November)')
+
+  // --- 31-day months: day 31 accepted ---
+  assert(is_valid_mm_dd_yyyy('01-31-2024') === true, 'Expected 01-31-2024 to be valid', 'valid: 01-31 (January)')
+  assert(is_valid_mm_dd_yyyy('03-31-2024') === true, 'Expected 03-31-2024 to be valid', 'valid: 03-31 (March)')
+  assert(is_valid_mm_dd_yyyy('05-31-2024') === true, 'Expected 05-31-2024 to be valid', 'valid: 05-31 (May)')
+  assert(is_valid_mm_dd_yyyy('07-31-2024') === true, 'Expected 07-31-2024 to be valid', 'valid: 07-31 (July)')
+  assert(is_valid_mm_dd_yyyy('08-31-2024') === true, 'Expected 08-31-2024 to be valid', 'valid: 08-31 (August)')
+  assert(is_valid_mm_dd_yyyy('10-31-2024') === true, 'Expected 10-31-2024 to be valid', 'valid: 10-31 (October)')
+  assert(is_valid_mm_dd_yyyy('12-31-2024') === true, 'Expected 12-31-2024 to be valid', 'valid: 12-31 (December)')
+
+  // --- Invalid month values ---
+  assert(is_valid_mm_dd_yyyy('00-15-2024') === false, 'Expected month 00 to be invalid', 'invalid: month 00')
+  assert(is_valid_mm_dd_yyyy('13-15-2024') === false, 'Expected month 13 to be invalid', 'invalid: month 13')
+
+  // --- Invalid day values ---
+  assert(is_valid_mm_dd_yyyy('01-00-2024') === false, 'Expected day 00 to be invalid', 'invalid: day 00')
+  assert(is_valid_mm_dd_yyyy('01-32-2024') === false, 'Expected day 32 to be invalid', 'invalid: day 32')
+
+  // --- Malformed strings ---
+  assert(is_valid_mm_dd_yyyy('') === false, 'Expected empty string to be invalid', 'invalid: empty string')
+  assert(is_valid_mm_dd_yyyy('not-a-date') === false, 'Expected text to be invalid', 'invalid: text')
+  assert(is_valid_mm_dd_yyyy('2024-01-15') === false, 'Expected YYYY-MM-DD to be invalid', 'invalid: YYYY-MM-DD format')
+  assert(is_valid_mm_dd_yyyy('1-15-2024') === false, 'Expected single-digit month to be invalid', 'invalid: single-digit month')
+  assert(is_valid_mm_dd_yyyy('01/15/2024') === false, 'Expected slashes to be invalid', 'invalid: slashes')
+  assert(is_valid_mm_dd_yyyy('01-15-24') === false, 'Expected 2-digit year to be invalid', 'invalid: 2-digit year')
+  assert(is_valid_mm_dd_yyyy('01-5-2024') === false, 'Expected single-digit day to be invalid', 'invalid: single-digit day')
+  assert(is_valid_mm_dd_yyyy('01-15-20240') === false, 'Expected 5-digit year to be invalid', 'invalid: 5-digit year')
+
+  // --- Whitespace trimming ---
+  assert(is_valid_mm_dd_yyyy(' 01-15-1990 ') === true, 'Expected trimmed whitespace to be valid', 'valid: whitespace trimmed')
+  assert(is_valid_mm_dd_yyyy('  02-28-2024  ') === true, 'Expected trimmed whitespace to be valid', 'valid: whitespace trimmed (2)')
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await date_string_validation_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("Date string validation test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("Date string validation test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/enduser_session_invalidation.test.ts

@@ -0,0 +1,361 @@
+require('source-map-support').install();
+
+import { Session, EnduserSession } from "../../sdk"
+import {
+  async_test,
+  handleAnyError,
+  log_header,
+  wait,
+} from "@tellescope/testing"
+import { setup_tests } from "../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+const businessId = '60398b1131a295e64f084ff6'
+
+// Main test function that can be called independently
+export const enduser_session_invalidation_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("Enduser Session Invalidation Tests")
+
+  // Create test enduser
+  const testEnduser = await sdk.api.endusers.createOne({ email: `session-invalidation-test-${Date.now()}@tellescope.com` })
+
+  try {
+    // Generate auth token for the enduser
+    const { authToken } = await sdk.api.endusers.generate_auth_token({ id: testEnduser.id })
+    const enduserSDK = new EnduserSession({ host, authToken, businessId: sdk.userInfo.businessId })
+
+    // Test 1: Enduser authenticated before invalidation
+    await async_test(
+      'enduser authenticated before invalidation',
+      () => enduserSDK.test_authenticated(),
+      { expectedResult: 'Authenticated!' }
+    )
+
+    // Wait to ensure time separation between token creation and invalidation
+    await wait(undefined, 2000)
+
+    // Test 2: Setting invalidateSessionsBefore rejects old token (401)
+    await async_test(
+      'setting invalidateSessionsBefore rejects old token',
+      async () => {
+        await sdk.api.endusers.updateOne(testEnduser.id, { invalidateSessionsBefore: new Date() })
+
+        // Old token should now be rejected
+        try {
+          await enduserSDK.test_authenticated()
+          return 'should have thrown'
+        } catch (e) {
+          return 'rejected'
+        }
+      },
+      { expectedResult: 'rejected' }
+    )
+
+    // Test 3: New token after invalidation works
+    await async_test(
+      'new token after invalidation works',
+      async () => {
+        // Wait to ensure new token iat is after invalidateSessionsBefore
+        await wait(undefined, 2000)
+
+        const { authToken: newAuthToken } = await sdk.api.endusers.generate_auth_token({ id: testEnduser.id })
+        const newEnduserSDK = new EnduserSession({ host, authToken: newAuthToken, businessId: sdk.userInfo.businessId })
+
+        return await newEnduserSDK.test_authenticated()
+      },
+      { expectedResult: 'Authenticated!' }
+    )
+
+    // Test 4: Cannot set invalidateSessionsBefore backwards (constraint error)
+    await async_test(
+      'cannot set invalidateSessionsBefore backwards',
+      async () => {
+        // Try to set invalidateSessionsBefore to a date in the past (before current value)
+        const pastDate = new Date(Date.now() - 24 * 60 * 60 * 1000) // 1 day ago
+        await sdk.api.endusers.updateOne(testEnduser.id, { invalidateSessionsBefore: pastDate })
+      },
+      handleAnyError
+    )
+
+    // Test 5: Deleted enduser token rejected (401)
+    await async_test(
+      'deleted enduser token rejected',
+      async () => {
+        // Create a separate enduser, get token, then delete enduser
+        const tempEnduser = await sdk.api.endusers.createOne({ email: `temp-session-test-${Date.now()}@tellescope.com` })
+        const { authToken: tempAuthToken } = await sdk.api.endusers.generate_auth_token({ id: tempEnduser.id })
+        const tempEnduserSDK = new EnduserSession({ host, authToken: tempAuthToken, businessId: sdk.userInfo.businessId })
+
+        // Verify token works before deletion
+        await tempEnduserSDK.test_authenticated()
+
+        // Delete the enduser
+        await sdk.api.endusers.deleteOne(tempEnduser.id)
+
+        // Token should now be rejected
+        try {
+          await tempEnduserSDK.test_authenticated()
+          return 'should have thrown'
+        } catch (e) {
+          return 'rejected'
+        }
+      },
+      { expectedResult: 'rejected' }
+    )
+
+    console.log("✅ All Enduser Session Invalidation tests passed!")
+
+  } finally {
+    // Cleanup: Delete test enduser
+    try {
+      await sdk.api.endusers.deleteOne(testEnduser.id)
+    } catch (error) {
+      console.error('Cleanup error:', error)
+    }
+  }
+
+  // --- OTP enablement invalidation tests ---
+
+  log_header("OTP Enablement Session Invalidation Tests")
+
+  // Helper to reset OTP settings
+  const resetOTPSettings = async (s: Session) => {
+    await s.api.organizations.updateOne(s.userInfo.businessId, {
+      portalSettings: { authentication: { requireOTP: false, requireOTPAfterPassword: false } },
+    }, { replaceObjectFields: true })
+  }
+
+  // Ensure OTP is off and db is clean before starting
+  await sdk.reset_db()
+  await wait(undefined, 500)
+  await resetOTPSettings(sdk)
+
+  try {
+
+  // Test 6: Enabling requireOTP invalidates multiple enduser sessions at once
+  await async_test(
+    'enabling requireOTP invalidates multiple enduser sessions',
+    async () => {
+      const endusers = await Promise.all([
+        sdk.api.endusers.createOne({ email: `otp-bulk-1-${Date.now()}@tellescope.com` }),
+        sdk.api.endusers.createOne({ email: `otp-bulk-2-${Date.now()}@tellescope.com` }),
+        sdk.api.endusers.createOne({ email: `otp-bulk-3-${Date.now()}@tellescope.com` }),
+      ])
+      try {
+        const tokens = await Promise.all(
+          endusers.map(e => sdk.api.endusers.generate_auth_token({ id: e.id, overrideOTP: true }))
+        )
+        const sessions = tokens.map(t => new EnduserSession({ host, authToken: t.authToken, businessId: sdk.userInfo.businessId }))
+
+        // Verify all tokens work
+        for (const s of sessions) {
+          await s.test_authenticated()
+        }
+
+        await wait(undefined, 2000)
+
+        // Enable OTP
+        await sdk.api.organizations.updateOne(sdk.userInfo.businessId, {
+          portalSettings: { authentication: { requireOTP: true } },
+        })
+
+        // Wait for side effect to process
+        await wait(undefined, 1000)
+
+        // All old tokens should be rejected
+        for (const s of sessions) {
+          try {
+            await s.test_authenticated()
+            return 'should have thrown'
+          } catch (e) { /* expected */ }
+        }
+
+        // New tokens should work
+        await wait(undefined, 2000)
+        for (const e of endusers) {
+          const { authToken: newToken } = await sdk.api.endusers.generate_auth_token({ id: e.id, overrideOTP: true })
+          const newSession = new EnduserSession({ host, authToken: newToken, businessId: sdk.userInfo.businessId })
+          await newSession.test_authenticated()
+        }
+
+        return 'passed'
+      } finally {
+        await resetOTPSettings(sdk)
+        for (const e of endusers) {
+          await sdk.api.endusers.deleteOne(e.id).catch(console.error)
+        }
+      }
+    },
+    { expectedResult: 'passed' }
+  )
+
+  // Test 7: Enabling requireOTPAfterPassword invalidates multiple enduser sessions
+  await async_test(
+    'enabling requireOTPAfterPassword invalidates multiple enduser sessions',
+    async () => {
+      const endusers = await Promise.all([
+        sdk.api.endusers.createOne({ email: `otp-mfa-1-${Date.now()}@tellescope.com` }),
+        sdk.api.endusers.createOne({ email: `otp-mfa-2-${Date.now()}@tellescope.com` }),
+      ])
+      try {
+        const tokens = await Promise.all(
+          endusers.map(e => sdk.api.endusers.generate_auth_token({ id: e.id, overrideOTP: true }))
+        )
+        const sessions = tokens.map(t => new EnduserSession({ host, authToken: t.authToken, businessId: sdk.userInfo.businessId }))
+
+        for (const s of sessions) {
+          await s.test_authenticated()
+        }
+
+        await wait(undefined, 2000)
+
+        await sdk.api.organizations.updateOne(sdk.userInfo.businessId, {
+          portalSettings: { authentication: { requireOTPAfterPassword: true } },
+        })
+
+        await wait(undefined, 1000)
+
+        for (const s of sessions) {
+          try {
+            await s.test_authenticated()
+            return 'should have thrown'
+          } catch (e) { /* expected */ }
+        }
+
+        // New tokens work
+        await wait(undefined, 2000)
+        for (const e of endusers) {
+          const { authToken: newToken } = await sdk.api.endusers.generate_auth_token({ id: e.id, overrideOTP: true })
+          const newSession = new EnduserSession({ host, authToken: newToken, businessId: sdk.userInfo.businessId })
+          await newSession.test_authenticated()
+        }
+
+        return 'passed'
+      } finally {
+        await resetOTPSettings(sdk)
+        for (const e of endusers) {
+          await sdk.api.endusers.deleteOne(e.id).catch(console.error)
+        }
+      }
+    },
+    { expectedResult: 'passed' }
+  )
+
+  // Reset rate limiting state before continuing
+  await sdk.reset_db()
+  await wait(undefined, 500)
+
+  // Test 8: Disabling OTP does NOT invalidate sessions
+  await async_test(
+    'disabling OTP does not invalidate sessions',
+    async () => {
+      // Enable OTP first
+      await sdk.api.organizations.updateOne(sdk.userInfo.businessId, {
+        portalSettings: { authentication: { requireOTP: true } },
+      })
+
+      await wait(undefined, 2000)
+
+      // Create enduser and token AFTER OTP is enabled (so token is valid)
+      const enduser = await sdk.api.endusers.createOne({ email: `otp-disable-${Date.now()}@tellescope.com` })
+      try {
+        const { authToken } = await sdk.api.endusers.generate_auth_token({ id: enduser.id, overrideOTP: true })
+        const enduserSession = new EnduserSession({ host, authToken, businessId: sdk.userInfo.businessId })
+        await enduserSession.test_authenticated()
+
+        await wait(undefined, 2000)
+
+        // Disable OTP
+        await sdk.api.organizations.updateOne(sdk.userInfo.businessId, {
+          portalSettings: { authentication: { requireOTP: false } },
+        }, { replaceObjectFields: true })
+
+        await wait(undefined, 1000)
+
+        // Old token should still work (disabling OTP should not invalidate)
+        return await enduserSession.test_authenticated()
+      } finally {
+        await resetOTPSettings(sdk)
+        await sdk.api.endusers.deleteOne(enduser.id).catch(console.error)
+      }
+    },
+    { expectedResult: 'Authenticated!' }
+  )
+
+  // Test 9: OTP invalidation is scoped to the updated organization only (multi-tenant)
+  await async_test(
+    'OTP invalidation is scoped to the updated organization only',
+    async () => {
+      const sdkOther = new Session({ host, apiKey: "ba745e25162bb95a795c5fa1af70df188d93c4d3aac9c48b34a5c8c9dd7b80f7" })
+
+      const otherEnduser = await sdkOther.api.endusers.createOne({ email: `otp-other-tenant-${Date.now()}@tellescope.com` })
+      const mainEnduser = await sdk.api.endusers.createOne({ email: `otp-main-tenant-${Date.now()}@tellescope.com` })
+
+      try {
+        const { authToken: otherToken } = await sdkOther.api.endusers.generate_auth_token({ id: otherEnduser.id, overrideOTP: true })
+        const otherEnduserSession = new EnduserSession({ host, authToken: otherToken, businessId: sdkOther.userInfo.businessId })
+
+        const { authToken: mainToken } = await sdk.api.endusers.generate_auth_token({ id: mainEnduser.id, overrideOTP: true })
+        const mainEnduserSession = new EnduserSession({ host, authToken: mainToken, businessId: sdk.userInfo.businessId })
+
+        // Both tokens work
+        await otherEnduserSession.test_authenticated()
+        await mainEnduserSession.test_authenticated()
+
+        await wait(undefined, 2000)
+
+        // Enable OTP on main tenant only
+        await sdk.api.organizations.updateOne(sdk.userInfo.businessId, {
+          portalSettings: { authentication: { requireOTP: true } },
+        })
+
+        await wait(undefined, 1000)
+
+        // Main tenant enduser's old token should be rejected
+        try {
+          await mainEnduserSession.test_authenticated()
+          return 'should have thrown'
+        } catch (e) { /* expected */ }
+
+        // Other tenant enduser's token should still work
+        await otherEnduserSession.test_authenticated()
+
+        return 'passed'
+      } finally {
+        await resetOTPSettings(sdk)
+        await sdk.api.endusers.deleteOne(mainEnduser.id).catch(console.error)
+        await sdkOther.api.endusers.deleteOne(otherEnduser.id).catch(console.error)
+      }
+    },
+    { expectedResult: 'passed' }
+  )
+
+  console.log("✅ All OTP Enablement Session Invalidation tests passed!")
+
+  } finally {
+    // Always reset OTP settings to prevent impacting other tests
+    await resetOTPSettings(sdk).catch(console.error)
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await enduser_session_invalidation_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ Enduser session invalidation test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Enduser session invalidation test suite failed:", error)
+      process.exit(1)
+    })
+}