@tellescope/sdk 1.250.2 → 1.252.0

package/lib/esm/tests/api_tests/push_forms_to_portal_group_completion.test.js

@@ -0,0 +1,402 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+require('source-map-support').install();
+import { Session, EnduserSession } from "../../sdk";
+import { log_header, wait, async_test } from "@tellescope/testing";
+import { setup_tests } from "../setup";
+var host = process.env.API_URL || "http://localhost:8080";
+var pollFor = function (fetchFn, evaluateFn, description, intervalMs, maxIterations) {
+    if (intervalMs === void 0) { intervalMs = 500; }
+    if (maxIterations === void 0) { maxIterations = 30; }
+    return __awaiter(void 0, void 0, void 0, function () {
+        var lastResult, i;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    i = 0;
+                    _a.label = 1;
+                case 1:
+                    if (!(i < maxIterations)) return [3 /*break*/, 5];
+                    return [4 /*yield*/, wait(undefined, intervalMs)];
+                case 2:
+                    _a.sent();
+                    return [4 /*yield*/, fetchFn()];
+                case 3:
+                    lastResult = _a.sent();
+                    if (evaluateFn(lastResult))
+                        return [2 /*return*/, lastResult];
+                    _a.label = 4;
+                case 4:
+                    i++;
+                    return [3 /*break*/, 1];
+                case 5: throw new Error("Polling timeout: ".concat(description, " - waited ").concat(maxIterations * intervalMs, "ms"));
+            }
+        });
+    });
+};
+export var push_forms_to_portal_group_completion_tests = function (_a) {
+    var sdk = _a.sdk, sdkNonAdmin = _a.sdkNonAdmin;
+    return __awaiter(void 0, void 0, void 0, function () {
+        var createdEnduserIds, createdJourneyIds, createdFormIds, createdFormGroupIds, createdTriggerIds, formA_1, fieldA_1, formB, fieldB_1, formGroup_1, runFlow, _i, createdTriggerIds_1, id, e_1, _b, createdEnduserIds_1, id, e_2, _c, createdJourneyIds_1, id, e_3, _d, createdFormGroupIds_1, id, e_4, _e, createdFormIds_1, id, e_5;
+        return __generator(this, function (_f) {
+            switch (_f.label) {
+                case 0:
+                    log_header("Push Forms To Portal - Form Group Completed Trigger Tests");
+                    createdEnduserIds = [];
+                    createdJourneyIds = [];
+                    createdFormIds = [];
+                    createdFormGroupIds = [];
+                    createdTriggerIds = [];
+                    _f.label = 1;
+                case 1:
+                    _f.trys.push([1, , 9, 40]);
+                    return [4 /*yield*/, sdk.api.forms.createOne({ title: 'Push To Portal Form A' })];
+                case 2:
+                    formA_1 = _f.sent();
+                    createdFormIds.push(formA_1.id);
+                    return [4 /*yield*/, sdk.api.form_fields.createOne({
+                            formId: formA_1.id,
+                            type: 'string',
+                            title: 'FieldA',
+                            previousFields: [{ type: 'root', info: {} }],
+                        })];
+                case 3:
+                    fieldA_1 = _f.sent();
+                    return [4 /*yield*/, sdk.api.forms.createOne({ title: 'Push To Portal Form B' })];
+                case 4:
+                    formB = _f.sent();
+                    createdFormIds.push(formB.id);
+                    return [4 /*yield*/, sdk.api.form_fields.createOne({
+                            formId: formB.id,
+                            type: 'string',
+                            title: 'FieldB',
+                            previousFields: [{ type: 'root', info: {} }],
+                        })
+                        // 2. Create a form group containing both forms (shared across both submission flows)
+                    ];
+                case 5:
+                    fieldB_1 = _f.sent();
+                    return [4 /*yield*/, sdk.api.form_groups.createOne({
+                            title: 'Push To Portal Test Group',
+                            formIds: [formA_1.id, formB.id],
+                        })];
+                case 6:
+                    formGroup_1 = _f.sent();
+                    createdFormGroupIds.push(formGroup_1.id);
+                    runFlow = function (_a) {
+                        var label = _a.label, tag = _a.tag, submitAsEnduser = _a.submitAsEnduser;
+                        return __awaiter(void 0, void 0, void 0, function () {
+                            var trigger, journey, pushStep, enduser, pushedResponses, _i, pushedResponses_1, fr, submitterApi, authToken, enduserSDK, _b, pushedResponses_2, fr, isFormA, targetFieldId, targetFieldTitle;
+                            return __generator(this, function (_c) {
+                                switch (_c.label) {
+                                    case 0: return [4 /*yield*/, sdk.api.automation_triggers.createOne({
+                                            event: { type: 'Form Group Completed', info: { groupId: formGroup_1.id } },
+                                            action: { type: 'Add Tags', info: { tags: [tag] } },
+                                            status: 'Active',
+                                            title: "Form Group Completed - Push to Portal (".concat(label, ")"),
+                                        })];
+                                    case 1:
+                                        trigger = _c.sent();
+                                        createdTriggerIds.push(trigger.id);
+                                        return [4 /*yield*/, sdk.api.journeys.createOne({
+                                                title: "Push To Portal Trigger Journey (".concat(label, ")"),
+                                            })];
+                                    case 2:
+                                        journey = _c.sent();
+                                        createdJourneyIds.push(journey.id);
+                                        return [4 /*yield*/, sdk.api.automation_steps.createOne({
+                                                journeyId: journey.id,
+                                                action: { type: 'pushFormsToPortal', info: { formGroupIds: [formGroup_1.id] } },
+                                                events: [{ type: 'onJourneyStart', info: {} }],
+                                            })];
+                                    case 3:
+                                        pushStep = _c.sent();
+                                        return [4 /*yield*/, sdk.api.endusers.createOne({ fname: 'PushPortal', lname: label })];
+                                    case 4:
+                                        enduser = _c.sent();
+                                        createdEnduserIds.push(enduser.id);
+                                        return [4 /*yield*/, sdk.api.endusers.add_to_journey({
+                                                enduserIds: [enduser.id],
+                                                journeyId: journey.id,
+                                            })];
+                                    case 5:
+                                        _c.sent();
+                                        return [4 /*yield*/, pollFor(function () { return __awaiter(void 0, void 0, void 0, function () {
+                                                var responses, pushed;
+                                                return __generator(this, function (_a) {
+                                                    switch (_a.label) {
+                                                        case 0: return [4 /*yield*/, sdk.api.form_responses.getSome({
+                                                                filter: { enduserId: enduser.id },
+                                                            })];
+                                                        case 1:
+                                                            responses = _a.sent();
+                                                            pushed = responses.filter(function (r) { return !!r.pushedToPortalAt; });
+                                                            return [2 /*return*/, pushed.length >= 2 ? pushed : undefined];
+                                                    }
+                                                });
+                                            }); }, function (result) { return Array.isArray(result) && result.length >= 2; }, "pushed-to-portal form_responses to be created by worker (".concat(label, ")"), 500, 40)];
+                                    case 6:
+                                        pushedResponses = _c.sent();
+                                        for (_i = 0, pushedResponses_1 = pushedResponses; _i < pushedResponses_1.length; _i++) {
+                                            fr = pushedResponses_1[_i];
+                                            if (!fr.pushedToPortalAt) {
+                                                throw new Error("Expected pushedToPortalAt to be set on form_response ".concat(fr.id, " (").concat(label, ")"));
+                                            }
+                                            if (fr.groupId !== pushStep.id) {
+                                                throw new Error("Expected form_response.groupId (".concat(fr.groupId, ") to equal automation step id (").concat(pushStep.id, ") (").concat(label, ")"));
+                                            }
+                                            if (fr.automationStepId !== pushStep.id) {
+                                                throw new Error("Expected form_response.automationStepId (".concat(fr.automationStepId, ") to equal automation step id (").concat(pushStep.id, ") (").concat(label, ")"));
+                                            }
+                                        }
+                                        return [4 /*yield*/, async_test("Worker writes groupId === automationStepId and pushedToPortalAt set (".concat(label, ")"), function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                                                return [2 /*return*/, true];
+                                            }); }); }, { onResult: function (r) { return r === true; } })
+                                            // Build the submitter session
+                                        ];
+                                    case 7:
+                                        _c.sent();
+                                        if (!submitAsEnduser) return [3 /*break*/, 9];
+                                        return [4 /*yield*/, sdk.api.endusers.generate_auth_token({ id: enduser.id })];
+                                    case 8:
+                                        authToken = (_c.sent()).authToken;
+                                        enduserSDK = new EnduserSession({ host: host, authToken: authToken, businessId: sdk.userInfo.businessId });
+                                        submitterApi = enduserSDK.api;
+                                        return [3 /*break*/, 10];
+                                    case 9:
+                                        submitterApi = sdk.api;
+                                        _c.label = 10;
+                                    case 10:
+                                        _b = 0, pushedResponses_2 = pushedResponses;
+                                        _c.label = 11;
+                                    case 11:
+                                        if (!(_b < pushedResponses_2.length)) return [3 /*break*/, 14];
+                                        fr = pushedResponses_2[_b];
+                                        isFormA = fr.formId === formA_1.id;
+                                        targetFieldId = isFormA ? fieldA_1.id : fieldB_1.id;
+                                        targetFieldTitle = isFormA ? 'FieldA' : 'FieldB';
+                                        return [4 /*yield*/, submitterApi.form_responses.submit_form_response({
+                                                accessCode: fr.accessCode,
+                                                responses: [{
+                                                        fieldId: targetFieldId,
+                                                        fieldTitle: targetFieldTitle,
+                                                        answer: { type: 'string', value: 'pushed-portal-answer' },
+                                                    }],
+                                            })];
+                                    case 12:
+                                        _c.sent();
+                                        _c.label = 13;
+                                    case 13:
+                                        _b++;
+                                        return [3 /*break*/, 11];
+                                    case 14: return [4 /*yield*/, pollFor(function () { return __awaiter(void 0, void 0, void 0, function () {
+                                            var e;
+                                            var _a;
+                                            return __generator(this, function (_b) {
+                                                switch (_b.label) {
+                                                    case 0: return [4 /*yield*/, sdk.api.endusers.getOne(enduser.id)];
+                                                    case 1:
+                                                        e = _b.sent();
+                                                        return [2 /*return*/, ((_a = e.tags) === null || _a === void 0 ? void 0 : _a.includes(tag)) ? e : undefined];
+                                                }
+                                            });
+                                        }); }, function (result) { return !!result; }, "Form Group Completed trigger to apply tag after push-to-portal submissions (".concat(label, ")"), 500, 30)];
+                                    case 15:
+                                        _c.sent();
+                                        return [4 /*yield*/, async_test("Form Group Completed trigger fires for push-to-portal completion (".concat(label, ")"), function () { return sdk.api.endusers.getOne(enduser.id); }, { onResult: function (e) { var _a; return !!((_a = e.tags) === null || _a === void 0 ? void 0 : _a.includes(tag)); } })];
+                                    case 16:
+                                        _c.sent();
+                                        return [2 /*return*/];
+                                }
+                            });
+                        });
+                    };
+                    // Admin submitter: simulates a staff user filling in the form on behalf of the patient
+                    // (uses a user-scoped DB in submit_form_response).
+                    return [4 /*yield*/, runFlow({
+                            label: 'admin-submit',
+                            tag: 'form-group-completed-push-admin',
+                            submitAsEnduser: false,
+                        })
+                        // Enduser submitter: simulates the patient submitting via the portal
+                        // (uses an enduser-scoped DB in submit_form_response — exercises the path QA caught).
+                    ];
+                case 7:
+                    // Admin submitter: simulates a staff user filling in the form on behalf of the patient
+                    // (uses a user-scoped DB in submit_form_response).
+                    _f.sent();
+                    // Enduser submitter: simulates the patient submitting via the portal
+                    // (uses an enduser-scoped DB in submit_form_response — exercises the path QA caught).
+                    return [4 /*yield*/, runFlow({
+                            label: 'enduser-submit',
+                            tag: 'form-group-completed-push-enduser',
+                            submitAsEnduser: true,
+                        })];
+                case 8:
+                    // Enduser submitter: simulates the patient submitting via the portal
+                    // (uses an enduser-scoped DB in submit_form_response — exercises the path QA caught).
+                    _f.sent();
+                    return [3 /*break*/, 40];
+                case 9:
+                    _i = 0, createdTriggerIds_1 = createdTriggerIds;
+                    _f.label = 10;
+                case 10:
+                    if (!(_i < createdTriggerIds_1.length)) return [3 /*break*/, 15];
+                    id = createdTriggerIds_1[_i];
+                    _f.label = 11;
+                case 11:
+                    _f.trys.push([11, 13, , 14]);
+                    return [4 /*yield*/, sdk.api.automation_triggers.deleteOne(id)];
+                case 12:
+                    _f.sent();
+                    return [3 /*break*/, 14];
+                case 13:
+                    e_1 = _f.sent();
+                    return [3 /*break*/, 14];
+                case 14:
+                    _i++;
+                    return [3 /*break*/, 10];
+                case 15:
+                    _b = 0, createdEnduserIds_1 = createdEnduserIds;
+                    _f.label = 16;
+                case 16:
+                    if (!(_b < createdEnduserIds_1.length)) return [3 /*break*/, 21];
+                    id = createdEnduserIds_1[_b];
+                    _f.label = 17;
+                case 17:
+                    _f.trys.push([17, 19, , 20]);
+                    return [4 /*yield*/, sdk.api.endusers.deleteOne(id)];
+                case 18:
+                    _f.sent();
+                    return [3 /*break*/, 20];
+                case 19:
+                    e_2 = _f.sent();
+                    return [3 /*break*/, 20];
+                case 20:
+                    _b++;
+                    return [3 /*break*/, 16];
+                case 21:
+                    _c = 0, createdJourneyIds_1 = createdJourneyIds;
+                    _f.label = 22;
+                case 22:
+                    if (!(_c < createdJourneyIds_1.length)) return [3 /*break*/, 27];
+                    id = createdJourneyIds_1[_c];
+                    _f.label = 23;
+                case 23:
+                    _f.trys.push([23, 25, , 26]);
+                    return [4 /*yield*/, sdk.api.journeys.deleteOne(id)];
+                case 24:
+                    _f.sent();
+                    return [3 /*break*/, 26];
+                case 25:
+                    e_3 = _f.sent();
+                    return [3 /*break*/, 26];
+                case 26:
+                    _c++;
+                    return [3 /*break*/, 22];
+                case 27:
+                    _d = 0, createdFormGroupIds_1 = createdFormGroupIds;
+                    _f.label = 28;
+                case 28:
+                    if (!(_d < createdFormGroupIds_1.length)) return [3 /*break*/, 33];
+                    id = createdFormGroupIds_1[_d];
+                    _f.label = 29;
+                case 29:
+                    _f.trys.push([29, 31, , 32]);
+                    return [4 /*yield*/, sdk.api.form_groups.deleteOne(id)];
+                case 30:
+                    _f.sent();
+                    return [3 /*break*/, 32];
+                case 31:
+                    e_4 = _f.sent();
+                    return [3 /*break*/, 32];
+                case 32:
+                    _d++;
+                    return [3 /*break*/, 28];
+                case 33:
+                    _e = 0, createdFormIds_1 = createdFormIds;
+                    _f.label = 34;
+                case 34:
+                    if (!(_e < createdFormIds_1.length)) return [3 /*break*/, 39];
+                    id = createdFormIds_1[_e];
+                    _f.label = 35;
+                case 35:
+                    _f.trys.push([35, 37, , 38]);
+                    return [4 /*yield*/, sdk.api.forms.deleteOne(id)];
+                case 36:
+                    _f.sent();
+                    return [3 /*break*/, 38];
+                case 37:
+                    e_5 = _f.sent();
+                    return [3 /*break*/, 38];
+                case 38:
+                    _e++;
+                    return [3 /*break*/, 34];
+                case 39: return [7 /*endfinally*/];
+                case 40: return [2 /*return*/];
+            }
+        });
+    });
+};
+if (require.main === module) {
+    console.log("\uD83C\uDF10 Using API URL: ".concat(host));
+    var sdk_1 = new Session({ host: host });
+    var sdkNonAdmin_1 = new Session({ host: host });
+    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, setup_tests(sdk_1, sdkNonAdmin_1)];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, push_forms_to_portal_group_completion_tests({ sdk: sdk_1, sdkNonAdmin: sdkNonAdmin_1 })];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); };
+    runTests()
+        .then(function () {
+        console.log("✅ Push forms to portal group completion test suite completed successfully");
+        process.exit(0);
+    })
+        .catch(function (error) {
+        console.error("❌ Push forms to portal group completion test suite failed:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=push_forms_to_portal_group_completion.test.js.map

package/lib/esm/tests/api_tests/push_forms_to_portal_group_completion.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"push_forms_to_portal_group_completion.test.js","sourceRoot":"","sources":["../../../../src/tests/api_tests/push_forms_to_portal_group_completion.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AACnD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAElE,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAEtC,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAuB,CAAA;AAE3D,IAAM,OAAO,GAAG,UACd,OAAqC,EACrC,UAAkD,EAClD,WAAmB,EACnB,UAAgB,EAChB,aAAkB;IADlB,2BAAA,EAAA,gBAAgB;IAChB,8BAAA,EAAA,kBAAkB;;;;;;oBAGT,CAAC,GAAG,CAAC;;;yBAAE,CAAA,CAAC,GAAG,aAAa,CAAA;oBAC/B,qBAAM,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,EAAA;;oBAAjC,SAAiC,CAAA;oBACpB,qBAAM,OAAO,EAAE,EAAA;;oBAA5B,UAAU,GAAG,SAAe,CAAA;oBAC5B,IAAI,UAAU,CAAC,UAAU,CAAC;wBAAE,sBAAO,UAAU,EAAA;;;oBAHZ,CAAC,EAAE,CAAA;;wBAKtC,MAAM,IAAI,KAAK,CAAC,2BAAoB,WAAW,uBAAa,aAAa,GAAG,UAAU,OAAI,CAAC,CAAA;;;;CAC5F,CAAA;AAED,MAAM,CAAC,IAAM,2CAA2C,GAAG,UAAO,EAA6D;QAA3D,GAAG,SAAA,EAAE,WAAW,iBAAA;;;;;;oBAClF,UAAU,CAAC,2DAA2D,CAAC,CAAA;oBAEjE,iBAAiB,GAAa,EAAE,CAAA;oBAChC,iBAAiB,GAAa,EAAE,CAAA;oBAChC,cAAc,GAAa,EAAE,CAAA;oBAC7B,mBAAmB,GAAa,EAAE,CAAA;oBAClC,iBAAiB,GAAa,EAAE,CAAA;;;;oBAItB,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,EAAA;;oBAAzE,UAAQ,SAAiE;oBAC/E,cAAc,CAAC,IAAI,CAAC,OAAK,CAAC,EAAE,CAAC,CAAA;oBACd,qBAAM,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC;4BACjD,MAAM,EAAE,OAAK,CAAC,EAAE;4BAChB,IAAI,EAAE,QAAQ;4BACd,KAAK,EAAE,QAAQ;4BACf,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;yBAC7C,CAAC,EAAA;;oBALI,WAAS,SAKb;oBAEY,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,EAAA;;oBAAzE,KAAK,GAAG,SAAiE;oBAC/E,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;oBACd,qBAAM,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC;4BACjD,MAAM,EAAE,KAAK,CAAC,EAAE;4BAChB,IAAI,EAAE,QAAQ;4BACd,KAAK,EAAE,QAAQ;4BACf,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;yBAC7C,CAAC;wBAEF,qFAAqF;sBAFnF;;oBALI,WAAS,SAKb;oBAGgB,qBAAM,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC;4BACpD,KAAK,EAAE,2BAA2B;4BAClC,OAAO,EAAE,CAAC,OAAK,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC;yBAC9B,CAAC,EAAA;;oBAHI,cAAY,SAGhB;oBACF,mBAAmB,CAAC,IAAI,CAAC,WAAS,CAAC,EAAE,CAAC,CAAA;oBAOhC,OAAO,GAAG,UAAO,EAA0F;4BAAxF,KAAK,WAAA,EAAE,GAAG,SAAA,EAAE,eAAe,qBAAA;;;;;4CAClC,qBAAM,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,SAAS,CAAC;4CAC1D,KAAK,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,WAAS,CAAC,EAAE,EAAE,EAAE;4CACxE,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE;4CACnD,MAAM,EAAE,QAAQ;4CAChB,KAAK,EAAE,iDAA0C,KAAK,MAAG;yCAC1D,CAAC,EAAA;;wCALI,OAAO,GAAG,SAKd;wCACF,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;wCAElB,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;gDAC/C,KAAK,EAAE,0CAAmC,KAAK,MAAG;6CACnD,CAAC,EAAA;;wCAFI,OAAO,GAAG,SAEd;wCACF,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;wCAEjB,qBAAM,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,SAAS,CAAC;gDACxD,SAAS,EAAE,OAAO,CAAC,EAAE;gDACrB,MAAM,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,EAAE,YAAY,EAAE,CAAC,WAAS,CAAC,EAAE,CAAC,EAAE,EAAE;gDAC7E,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;6CAC/C,CAAC,EAAA;;wCAJI,QAAQ,GAAG,SAIf;wCAEc,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAA;;wCAAjF,OAAO,GAAG,SAAuE;wCACvF,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;wCAElC,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC;gDACpC,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;gDACxB,SAAS,EAAE,OAAO,CAAC,EAAE;6CACtB,CAAC,EAAA;;wCAHF,SAGE,CAAA;wCAEsB,qBAAM,OAAO,CACnC;;;;gEACoB,qBAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC;gEACrD,MAAM,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE;6DAClC,CAAC,EAAA;;4DAFI,SAAS,GAAG,SAEhB;4DACI,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAApB,CAAoB,CAAC,CAAA;4DAC1D,sBAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAA;;;iDAC/C,EACD,UAAC,MAAM,IAAsB,OAAA,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,EAA3C,CAA2C,EACxE,mEAA4D,KAAK,MAAG,EACpE,GAAG,EACH,EAAE,CACH,EAAA;;wCAZK,eAAe,GAAG,SAYvB;wCAED,WAAgC,EAAf,mCAAe,EAAf,6BAAe,EAAf,IAAe,EAAE;4CAAvB,EAAE;4CACX,IAAI,CAAC,EAAE,CAAC,gBAAgB,EAAE;gDACxB,MAAM,IAAI,KAAK,CAAC,+DAAwD,EAAE,CAAC,EAAE,eAAK,KAAK,MAAG,CAAC,CAAA;6CAC5F;4CACD,IAAI,EAAE,CAAC,OAAO,KAAK,QAAQ,CAAC,EAAE,EAAE;gDAC9B,MAAM,IAAI,KAAK,CAAC,0CAAmC,EAAE,CAAC,OAAO,4CAAkC,QAAQ,CAAC,EAAE,gBAAM,KAAK,MAAG,CAAC,CAAA;6CAC1H;4CACD,IAAI,EAAE,CAAC,gBAAgB,KAAK,QAAQ,CAAC,EAAE,EAAE;gDACvC,MAAM,IAAI,KAAK,CAAC,mDAA4C,EAAE,CAAC,gBAAgB,4CAAkC,QAAQ,CAAC,EAAE,gBAAM,KAAK,MAAG,CAAC,CAAA;6CAC5I;yCACF;wCAED,qBAAM,UAAU,CACd,+EAAwE,KAAK,MAAG,EAChF;gDAAY,sBAAA,IAAI,EAAA;qDAAA,EAChB,EAAE,QAAQ,EAAE,UAAA,CAAC,IAAI,OAAA,CAAC,KAAK,IAAI,EAAV,CAAU,EAAE,CAC9B;4CAED,8BAA8B;0CAF7B;;wCAJD,SAIC,CAAA;6CAIG,eAAe,EAAf,wBAAe;wCACK,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,EAAA;;wCAA5E,SAAS,GAAK,CAAA,SAA8D,CAAA,UAAnE;wCACX,UAAU,GAAG,IAAI,cAAc,CAAC,EAAE,IAAI,MAAA,EAAE,SAAS,WAAA,EAAE,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAA;wCAC/F,YAAY,GAAG,UAAU,CAAC,GAAG,CAAA;;;wCAE7B,YAAY,GAAG,GAAG,CAAC,GAAG,CAAA;;;8CAGQ,EAAf,mCAAe;;;6CAAf,CAAA,6BAAe,CAAA;wCAArB,EAAE;wCACL,OAAO,GAAG,EAAE,CAAC,MAAM,KAAK,OAAK,CAAC,EAAE,CAAA;wCAChC,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,QAAM,CAAC,EAAE,CAAC,CAAC,CAAC,QAAM,CAAC,EAAE,CAAA;wCAC/C,gBAAgB,GAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAA;wCACtD,qBAAM,YAAY,CAAC,cAAc,CAAC,oBAAoB,CAAC;gDACrD,UAAU,EAAE,EAAE,CAAC,UAAoB;gDACnC,SAAS,EAAE,CAAC;wDACV,OAAO,EAAE,aAAa;wDACtB,UAAU,EAAE,gBAAgB;wDAC5B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,sBAAsB,EAAE;qDAC1D,CAAC;6CACH,CAAC,EAAA;;wCAPF,SAOE,CAAA;;;wCAXa,IAAe,CAAA;;6CAchC,qBAAM,OAAO,CACX;;;;;4DACY,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAA;;wDAA7C,CAAC,GAAG,SAAyC;wDACnD,sBAAO,CAAA,MAAA,CAAC,CAAC,IAAI,0CAAE,QAAQ,CAAC,GAAG,CAAC,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAAA;;;6CAC7C,EACD,UAAC,MAAM,IAAwB,OAAA,CAAC,CAAC,MAAM,EAAR,CAAQ,EACvC,sFAA+E,KAAK,MAAG,EACvF,GAAG,EACH,EAAE,CACH,EAAA;;wCATD,SASC,CAAA;wCAED,qBAAM,UAAU,CACd,4EAAqE,KAAK,MAAG,EAC7E,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAnC,CAAmC,EACzC,EAAE,QAAQ,EAAE,UAAC,CAAU,YAAK,OAAA,CAAC,CAAC,CAAA,MAAA,CAAC,CAAC,IAAI,0CAAE,QAAQ,CAAC,GAAG,CAAC,CAAA,CAAA,EAAA,EAAE,CACtD,EAAA;;wCAJD,SAIC,CAAA;;;;;qBACF,CAAA;oBAED,uFAAuF;oBACvF,mDAAmD;oBACnD,qBAAM,OAAO,CAAC;4BACZ,KAAK,EAAE,cAAc;4BACrB,GAAG,EAAE,iCAAiC;4BACtC,eAAe,EAAE,KAAK;yBACvB,CAAC;wBAEF,qEAAqE;wBACrE,sFAAsF;sBAHpF;;oBANF,uFAAuF;oBACvF,mDAAmD;oBACnD,SAIE,CAAA;oBAEF,qEAAqE;oBACrE,sFAAsF;oBACtF,qBAAM,OAAO,CAAC;4BACZ,KAAK,EAAE,gBAAgB;4BACvB,GAAG,EAAE,mCAAmC;4BACxC,eAAe,EAAE,IAAI;yBACtB,CAAC,EAAA;;oBANF,qEAAqE;oBACrE,sFAAsF;oBACtF,SAIE,CAAA;;;0BAGgC,EAAjB,uCAAiB;;;yBAAjB,CAAA,+BAAiB,CAAA;oBAAvB,EAAE;;;;oBACL,qBAAM,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC,EAAA;;oBAA/C,SAA+C,CAAA;;;;;;oBADtC,IAAiB,CAAA;;;0BAGA,EAAjB,uCAAiB;;;yBAAjB,CAAA,+BAAiB,CAAA;oBAAvB,EAAE;;;;oBACL,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,EAAA;;oBAApC,SAAoC,CAAA;;;;;;oBAD3B,IAAiB,CAAA;;;0BAGA,EAAjB,uCAAiB;;;yBAAjB,CAAA,+BAAiB,CAAA;oBAAvB,EAAE;;;;oBACL,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,EAAA;;oBAApC,SAAoC,CAAA;;;;;;oBAD3B,IAAiB,CAAA;;;0BAGE,EAAnB,2CAAmB;;;yBAAnB,CAAA,iCAAmB,CAAA;oBAAzB,EAAE;;;;oBACL,qBAAM,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,EAAA;;oBAAvC,SAAuC,CAAA;;;;;;oBAD9B,IAAmB,CAAA;;;0BAGL,EAAd,iCAAc;;;yBAAd,CAAA,4BAAc,CAAA;oBAApB,EAAE;;;;oBACL,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,EAAA;;oBAAjC,SAAiC,CAAA;;;;;;oBADxB,IAAc,CAAA;;;;;;;CAIlC,CAAA;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAM,KAAG,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACjC,IAAM,aAAW,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IAEzC,IAAM,QAAQ,GAAG;;;wBACf,qBAAM,WAAW,CAAC,KAAG,EAAE,aAAW,CAAC,EAAA;;oBAAnC,SAAmC,CAAA;oBACnC,qBAAM,2CAA2C,CAAC,EAAE,GAAG,OAAA,EAAE,WAAW,eAAA,EAAE,CAAC,EAAA;;oBAAvE,SAAuE,CAAA;;;;SACxE,CAAA;IAED,QAAQ,EAAE;SACP,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAA;QACxF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,4DAA4D,EAAE,KAAK,CAAC,CAAA;QAClF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}

package/lib/esm/tests/api_tests/security/F-0001-data-sync-redaction-bypass.test.d.ts

@@ -0,0 +1,28 @@
+import { Session } from "../../../sdk";
+/**
+ * Regression test for F-0001 (security-audit/findings/F-0001-data-sync-bypasses-applyRedactions.md).
+ *
+ * The /v1/data-sync handler must apply the central applyRedactions() pipeline to
+ * every non-deleted record. The original bug: redactions were gated behind
+ *   `if (session.fieldRedactions && session.fieldRedactions[record.modelName])`
+ * which meant any session without role-based field redactions (including all
+ * admins) received raw records — leaking schema-level `redactions: ['all']`
+ * fields (hashedPass, hashedPassword, hashedInviteCode).
+ *
+ * This test:
+ *   1. Configures a non-admin user with broad read access on users + endusers
+ *      and NO fieldRedactions — the realistic "regular user with read access"
+ *      condition that triggers the bypass.
+ *   2. Creates an enduser with a password to populate the sync stream.
+ *   3. Calls /v1/data-sync as the non-admin.
+ *   4. Asserts no returned record contains hashedPass / hashedPassword /
+ *      hashedInviteCode.
+ *
+ * Pre-fix: assertion fails with leaked records.
+ * Post-fix: assertion passes.
+ */
+export declare const data_sync_redaction_bypass_tests: ({ sdk, sdkNonAdmin }: {
+    sdk: Session;
+    sdkNonAdmin: Session;
+}) => Promise<void>;
+//# sourceMappingURL=F-0001-data-sync-redaction-bypass.test.d.ts.map

package/lib/esm/tests/api_tests/security/F-0001-data-sync-redaction-bypass.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"F-0001-data-sync-redaction-bypass.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/F-0001-data-sync-redaction-bypass.test.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAwCtC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,gCAAgC;SAAwC,OAAO;iBAAe,OAAO;mBAqJjH,CAAA"}