@tellescope/sdk 1.250.2 → 1.252.0

package/lib/esm/tests/api_tests/security/F-0007-invite-user-enumeration.test.d.ts

@@ -0,0 +1,29 @@
+import { Session } from "../../../sdk";
+/**
+ * Regression test for F-0007 (security-audit/findings/F-0007-invite-user-cross-tenant-email-enumeration.md).
+ *
+ * `users.invite_user` previously used `buildAllQueries({ unrestricted: true, organizationIds: [] }).users.findOne({ email })`
+ * to enforce platform-wide email uniqueness and threw the distinctive `"A user with this email already exists"`
+ * error on duplicate — regardless of which tenant the existing user was in. Any authenticated user could
+ * therefore probe whether email X is registered to any tenant on the platform.
+ *
+ * **Tests only the negative case** — never drives a successful invite (which would create a real user
+ * record and send a real transactional email). All assertions use either:
+ *   - An email that already exists in the test tenant (the admin's own email), so each call short-circuits
+ *     at the same-tenant duplicate check or rate-limit check before any invite work happens, OR
+ *   - The cross-org infrastructure (CROSS_ORG_API_KEY env var) targeting an email that exists in a different
+ *     tenant — verifies the post-fix response does NOT distinguish "exists elsewhere" from a generic outcome.
+ *
+ * Assertions:
+ *   1. Rate-limit defense-in-depth: rapid same-tenant duplicate requests trip 429 within ~12 attempts.
+ *   2. Same-tenant duplicate: returns the same `"already exists"` error pre/post-fix (this branch is
+ *      unchanged by the fix; asserted for regression-safety).
+ *   3. Cross-tenant duplicate (env-gated): post-fix response shape does NOT contain the `"already exists"`
+ *      string and matches the silent-no-op shape `{ created: { id: ... } }`. Skipped when CROSS_ORG_*
+ *      env vars are not set, mirroring cross_org_api_key.test.ts convention.
+ */
+export declare const invite_user_enumeration_tests: ({ sdk, sdkNonAdmin }: {
+    sdk: Session;
+    sdkNonAdmin: Session;
+}) => Promise<void>;
+//# sourceMappingURL=F-0007-invite-user-enumeration.test.d.ts.map

package/lib/esm/tests/api_tests/security/F-0007-invite-user-enumeration.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"F-0007-invite-user-enumeration.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/F-0007-invite-user-enumeration.test.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAyBtC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,6BAA6B;SAAwC,OAAO;iBAAe,OAAO;mBA6H9G,CAAA"}

package/lib/esm/tests/api_tests/security/F-0007-invite-user-enumeration.test.js

@@ -0,0 +1,271 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+require('source-map-support').install();
+import axios from "axios";
+import { Session } from "../../../sdk";
+import { async_test, log_header, wait, } from "@tellescope/testing";
+import { setup_tests } from "../../setup";
+var host = process.env.API_URL || 'http://localhost:8080';
+var CROSS_ORG_API_KEY = process.env.CROSS_ORG_API_KEY;
+var CROSS_ORG_TARGET_BUSINESS_ID = process.env.CROSS_ORG_TARGET_BUSINESS_ID;
+var post = function (path, body, headers) {
+    if (headers === void 0) { headers = {}; }
+    return __awaiter(void 0, void 0, void 0, function () {
+        var res, err_1;
+        var _a, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0:
+                    _c.trys.push([0, 2, , 3]);
+                    return [4 /*yield*/, axios.post("".concat(host).concat(path), body, {
+                            validateStatus: function () { return true; },
+                            headers: headers,
+                        })];
+                case 1:
+                    res = _c.sent();
+                    return [2 /*return*/, { status: res.status, data: res.data }];
+                case 2:
+                    err_1 = _c.sent();
+                    return [2 /*return*/, { status: (_a = err_1 === null || err_1 === void 0 ? void 0 : err_1.response) === null || _a === void 0 ? void 0 : _a.status, data: (_b = err_1 === null || err_1 === void 0 ? void 0 : err_1.response) === null || _b === void 0 ? void 0 : _b.data }];
+                case 3: return [2 /*return*/];
+            }
+        });
+    });
+};
+/**
+ * Regression test for F-0007 (security-audit/findings/F-0007-invite-user-cross-tenant-email-enumeration.md).
+ *
+ * `users.invite_user` previously used `buildAllQueries({ unrestricted: true, organizationIds: [] }).users.findOne({ email })`
+ * to enforce platform-wide email uniqueness and threw the distinctive `"A user with this email already exists"`
+ * error on duplicate — regardless of which tenant the existing user was in. Any authenticated user could
+ * therefore probe whether email X is registered to any tenant on the platform.
+ *
+ * **Tests only the negative case** — never drives a successful invite (which would create a real user
+ * record and send a real transactional email). All assertions use either:
+ *   - An email that already exists in the test tenant (the admin's own email), so each call short-circuits
+ *     at the same-tenant duplicate check or rate-limit check before any invite work happens, OR
+ *   - The cross-org infrastructure (CROSS_ORG_API_KEY env var) targeting an email that exists in a different
+ *     tenant — verifies the post-fix response does NOT distinguish "exists elsewhere" from a generic outcome.
+ *
+ * Assertions:
+ *   1. Rate-limit defense-in-depth: rapid same-tenant duplicate requests trip 429 within ~12 attempts.
+ *   2. Same-tenant duplicate: returns the same `"already exists"` error pre/post-fix (this branch is
+ *      unchanged by the fix; asserted for regression-safety).
+ *   3. Cross-tenant duplicate (env-gated): post-fix response shape does NOT contain the `"already exists"`
+ *      string and matches the silent-no-op shape `{ created: { id: ... } }`. Skipped when CROSS_ORG_*
+ *      env vars are not set, mirroring cross_org_api_key.test.ts convention.
+ */
+export var invite_user_enumeration_tests = function (_a) {
+    var sdk = _a.sdk, sdkNonAdmin = _a.sdkNonAdmin;
+    return __awaiter(void 0, void 0, void 0, function () {
+        var organizationId, sameTenantExistingEmail, rateLimitedAt, i, r, sameTenantRes, sdkCrossOrg, targetOrgId, orgs, _b, crossRes;
+        var _c, _d, _e;
+        return __generator(this, function (_f) {
+            switch (_f.label) {
+                case 0:
+                    log_header("F-0007: users.invite_user cross-tenant enumeration regression");
+                    // Reset state so prior tests' rate-limit accounting doesn't leak in.
+                    return [4 /*yield*/, sdk.reset_db()];
+                case 1:
+                    // Reset state so prior tests' rate-limit accounting doesn't leak in.
+                    _f.sent();
+                    organizationId = (_d = (_c = sdk.userInfo.organizationIds) === null || _c === void 0 ? void 0 : _c[0]) !== null && _d !== void 0 ? _d : sdk.userInfo.businessId;
+                    sameTenantExistingEmail = process.env.TEST_EMAIL;
+                    rateLimitedAt = -1;
+                    i = 0;
+                    _f.label = 2;
+                case 2:
+                    if (!(i < 15)) return [3 /*break*/, 5];
+                    return [4 /*yield*/, post('/v1/invite-user-to-organization', {
+                            email: sameTenantExistingEmail,
+                            fname: 'F0007', lname: 'RateLimit',
+                            organizationId: organizationId,
+                        }, { Authorization: "Bearer ".concat(sdk.authToken) })];
+                case 3:
+                    r = _f.sent();
+                    if (r.status === 429) {
+                        rateLimitedAt = i;
+                        return [3 /*break*/, 5];
+                    }
+                    _f.label = 4;
+                case 4:
+                    i++;
+                    return [3 /*break*/, 2];
+                case 5: return [4 /*yield*/, async_test("F-0007: invite_user rate-limits within ~12 rapid requests (defense-in-depth; no invites sent)", function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                        return [2 /*return*/, ({ rateLimitedAt: rateLimitedAt })];
+                    }); }); }, { onResult: function (r) { return r.rateLimitedAt >= 0 && r.rateLimitedAt <= 12; } })
+                    // ====================================================================
+                    // Assertion 2: same-tenant duplicate returns the descriptive error
+                    // (unchanged by the fix; regression guard so a future change to the
+                    // duplicate-detection path doesn't accidentally suppress same-tenant
+                    // errors that operators rely on).
+                    // ====================================================================
+                    // Let rate limit decay so this single call isn't blocked.
+                ];
+                case 6:
+                    _f.sent();
+                    // ====================================================================
+                    // Assertion 2: same-tenant duplicate returns the descriptive error
+                    // (unchanged by the fix; regression guard so a future change to the
+                    // duplicate-detection path doesn't accidentally suppress same-tenant
+                    // errors that operators rely on).
+                    // ====================================================================
+                    // Let rate limit decay so this single call isn't blocked.
+                    return [4 /*yield*/, wait(undefined, 5000)];
+                case 7:
+                    // ====================================================================
+                    // Assertion 2: same-tenant duplicate returns the descriptive error
+                    // (unchanged by the fix; regression guard so a future change to the
+                    // duplicate-detection path doesn't accidentally suppress same-tenant
+                    // errors that operators rely on).
+                    // ====================================================================
+                    // Let rate limit decay so this single call isn't blocked.
+                    _f.sent();
+                    return [4 /*yield*/, sdk.reset_db()];
+                case 8:
+                    _f.sent();
+                    return [4 /*yield*/, post('/v1/invite-user-to-organization', {
+                            email: sameTenantExistingEmail,
+                            fname: 'F0007', lname: 'SameTenant',
+                            organizationId: organizationId,
+                        }, { Authorization: "Bearer ".concat(sdk.authToken) })];
+                case 9:
+                    sameTenantRes = _f.sent();
+                    return [4 /*yield*/, async_test("F-0007: invite_user same-tenant duplicate returns 400 'already exists' (unchanged)", function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var _a, _b;
+                            return __generator(this, function (_c) {
+                                return [2 /*return*/, ({
+                                        status: sameTenantRes.status,
+                                        message: (_b = (_a = sameTenantRes.data) === null || _a === void 0 ? void 0 : _a.message) !== null && _b !== void 0 ? _b : '',
+                                    })];
+                            });
+                        }); }, { onResult: function (r) { return r.status === 400 && r.message.toLowerCase().includes('already exists'); } })
+                        // ====================================================================
+                        // Assertion 3: cross-tenant duplicate must NOT reveal existence
+                        // Env-gated; skipped when cross-org infra not configured.
+                        // ====================================================================
+                    ];
+                case 10:
+                    _f.sent();
+                    // ====================================================================
+                    // Assertion 3: cross-tenant duplicate must NOT reveal existence
+                    // Env-gated; skipped when cross-org infra not configured.
+                    // ====================================================================
+                    if (!(CROSS_ORG_API_KEY && CROSS_ORG_TARGET_BUSINESS_ID)) {
+                        console.log("  [F-0007] Skipping cross-tenant silent no-op assertion — CROSS_ORG_* env vars not set");
+                        return [2 /*return*/];
+                    }
+                    sdkCrossOrg = new Session({
+                        host: host,
+                        apiKey: CROSS_ORG_API_KEY,
+                        headers: { 'x-tellescope-organization': CROSS_ORG_TARGET_BUSINESS_ID },
+                    });
+                    targetOrgId = CROSS_ORG_TARGET_BUSINESS_ID;
+                    _f.label = 11;
+                case 11:
+                    _f.trys.push([11, 13, , 14]);
+                    return [4 /*yield*/, sdkCrossOrg.api.organizations.getSome({ limit: 1 })];
+                case 12:
+                    orgs = _f.sent();
+                    if ((_e = orgs === null || orgs === void 0 ? void 0 : orgs[0]) === null || _e === void 0 ? void 0 : _e.id)
+                        targetOrgId = orgs[0].id;
+                    return [3 /*break*/, 14];
+                case 13:
+                    _b = _f.sent();
+                    return [3 /*break*/, 14];
+                case 14: return [4 /*yield*/, post('/v1/invite-user-to-organization', {
+                        email: sameTenantExistingEmail,
+                        fname: 'F0007', lname: 'CrossTenantProbe',
+                        organizationId: targetOrgId,
+                    }, {
+                        Authorization: "API_KEY ".concat(CROSS_ORG_API_KEY),
+                        'x-tellescope-organization': CROSS_ORG_TARGET_BUSINESS_ID,
+                    })];
+                case 15:
+                    crossRes = _f.sent();
+                    return [4 /*yield*/, async_test("F-0007: cross-tenant invite of existing email must NOT return 'already exists' (no enumeration)", function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var _a, _b, _c, _d;
+                            return __generator(this, function (_e) {
+                                return [2 /*return*/, ({
+                                        status: crossRes.status,
+                                        message: (_b = (_a = crossRes.data) === null || _a === void 0 ? void 0 : _a.message) !== null && _b !== void 0 ? _b : '',
+                                        hasCreatedShape: !!((_d = (_c = crossRes.data) === null || _c === void 0 ? void 0 : _c.created) === null || _d === void 0 ? void 0 : _d.id),
+                                    })];
+                            });
+                        }); }, {
+                            onResult: function (r) {
+                                // The response MUST NOT contain the "already exists" string regardless of status.
+                                // Acceptable post-fix shapes: 200 with `{ created: { id: ... } }` (silent no-op), or
+                                // 200 with a generic ack. Rate-limit 429 also OK if it slipped through to here.
+                                return !r.message.toLowerCase().includes('already exists');
+                            },
+                        })];
+                case 16:
+                    _f.sent();
+                    return [2 /*return*/];
+            }
+        });
+    });
+};
+if (require.main === module) {
+    console.log("\uD83C\uDF10 Using API URL: ".concat(host));
+    var sdk_1 = new Session({ host: host });
+    var sdkNonAdmin_1 = new Session({ host: host });
+    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, setup_tests(sdk_1, sdkNonAdmin_1)];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, invite_user_enumeration_tests({ sdk: sdk_1, sdkNonAdmin: sdkNonAdmin_1 })];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); };
+    runTests()
+        .then(function () {
+        console.log("✅ F-0007 invite_user enumeration test suite completed successfully");
+        process.exit(0);
+    })
+        .catch(function (error) {
+        console.error("❌ F-0007 invite_user enumeration test suite failed:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=F-0007-invite-user-enumeration.test.js.map

package/lib/esm/tests/api_tests/security/F-0007-invite-user-enumeration.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"F-0007-invite-user-enumeration.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/F-0007-invite-user-enumeration.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,OAAO,KAAK,MAAM,OAAO,CAAA;AACzB,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EACL,UAAU,EACV,UAAU,EACV,IAAI,GACL,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEzC,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE,IAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAA;AACvD,IAAM,4BAA4B,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAA;AAE7E,IAAM,IAAI,GAAG,UAAO,IAAY,EAAE,IAAS,EAAE,OAAoC;IAApC,wBAAA,EAAA,YAAoC;;;;;;;;oBAEjE,qBAAM,KAAK,CAAC,IAAI,CAAC,UAAG,IAAI,SAAG,IAAI,CAAE,EAAE,IAAI,EAAE;4BACnD,cAAc,EAAE,cAAM,OAAA,IAAI,EAAJ,CAAI;4BAC1B,OAAO,SAAA;yBACR,CAAC,EAAA;;oBAHI,GAAG,GAAG,SAGV;oBACF,sBAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAA;;;oBAE7C,sBAAO,EAAE,MAAM,EAAE,MAAA,KAAG,aAAH,KAAG,uBAAH,KAAG,CAAE,QAAQ,0CAAE,MAAM,EAAE,IAAI,EAAE,MAAA,KAAG,aAAH,KAAG,uBAAH,KAAG,CAAE,QAAQ,0CAAE,IAAI,EAAE,EAAA;;;;;CAEtE,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,IAAM,6BAA6B,GAAG,UAAO,EAA6D;QAA3D,GAAG,SAAA,EAAE,WAAW,iBAAA;;;;;;;oBACpE,UAAU,CAAC,+DAA+D,CAAC,CAAA;oBAE3E,qEAAqE;oBACrE,qBAAM,GAAG,CAAC,QAAQ,EAAE,EAAA;;oBADpB,qEAAqE;oBACrE,SAAoB,CAAA;oBAEd,cAAc,GAAG,MAAA,MAAA,GAAG,CAAC,QAAQ,CAAC,eAAe,0CAAG,CAAC,CAAC,mCAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAA;oBAI7E,uBAAuB,GAAG,OAAO,CAAC,GAAG,CAAC,UAAW,CAAA;oBAQnD,aAAa,GAAG,CAAC,CAAC,CAAA;oBACb,CAAC,GAAG,CAAC;;;yBAAE,CAAA,CAAC,GAAG,EAAE,CAAA;oBACV,qBAAM,IAAI,CAClB,iCAAiC,EACjC;4BACE,KAAK,EAAE,uBAAuB;4BAC9B,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW;4BAClC,cAAc,gBAAA;yBACf,EACD,EAAE,aAAa,EAAE,iBAAU,GAAG,CAAC,SAAS,CAAE,EAAE,CAC7C,EAAA;;oBARK,CAAC,GAAG,SAQT;oBACD,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE;wBACpB,aAAa,GAAG,CAAC,CAAA;wBACjB,wBAAK;qBACN;;;oBAbqB,CAAC,EAAE,CAAA;;wBAgB3B,qBAAM,UAAU,CACd,+FAA+F,EAC/F;wBAAY,sBAAA,CAAC,EAAE,aAAa,eAAA,EAAE,CAAC,EAAA;6BAAA,EAC/B,EAAE,QAAQ,EAAE,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,IAAI,EAAE,EAA7C,CAA6C,EAAE,CACjE;oBAED,uEAAuE;oBACvE,mEAAmE;oBACnE,oEAAoE;oBACpE,qEAAqE;oBACrE,kCAAkC;oBAClC,uEAAuE;oBACvE,0DAA0D;kBARzD;;oBAJD,SAIC,CAAA;oBAED,uEAAuE;oBACvE,mEAAmE;oBACnE,oEAAoE;oBACpE,qEAAqE;oBACrE,kCAAkC;oBAClC,uEAAuE;oBACvE,0DAA0D;oBAC1D,qBAAM,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAA;;oBAP3B,uEAAuE;oBACvE,mEAAmE;oBACnE,oEAAoE;oBACpE,qEAAqE;oBACrE,kCAAkC;oBAClC,uEAAuE;oBACvE,0DAA0D;oBAC1D,SAA2B,CAAA;oBAC3B,qBAAM,GAAG,CAAC,QAAQ,EAAE,EAAA;;oBAApB,SAAoB,CAAA;oBAEE,qBAAM,IAAI,CAC9B,iCAAiC,EACjC;4BACE,KAAK,EAAE,uBAAuB;4BAC9B,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY;4BACnC,cAAc,gBAAA;yBACf,EACD,EAAE,aAAa,EAAE,iBAAU,GAAG,CAAC,SAAS,CAAE,EAAE,CAC7C,EAAA;;oBARK,aAAa,GAAG,SAQrB;oBAED,qBAAM,UAAU,CACd,oFAAoF,EACpF;;;gCAAY,sBAAA,CAAC;wCACX,MAAM,EAAE,aAAa,CAAC,MAAM;wCAC5B,OAAO,EAAE,MAAA,MAAA,aAAa,CAAC,IAAI,0CAAE,OAAO,mCAAI,EAAE;qCAC3C,CAAC,EAAA;;6BAAA,EACF,EAAE,QAAQ,EAAE,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAtE,CAAsE,EAAE,CAC1F;wBAED,uEAAuE;wBACvE,gEAAgE;wBAChE,0DAA0D;wBAC1D,uEAAuE;sBALtE;;oBAPD,SAOC,CAAA;oBAED,uEAAuE;oBACvE,gEAAgE;oBAChE,0DAA0D;oBAC1D,uEAAuE;oBACvE,IAAI,CAAC,CAAC,iBAAiB,IAAI,4BAA4B,CAAC,EAAE;wBACxD,OAAO,CAAC,GAAG,CAAC,wFAAwF,CAAC,CAAA;wBACrG,sBAAM;qBACP;oBAOK,WAAW,GAAG,IAAI,OAAO,CAAC;wBAC9B,IAAI,MAAA;wBACJ,MAAM,EAAE,iBAAiB;wBACzB,OAAO,EAAE,EAAE,2BAA2B,EAAE,4BAA4B,EAAE;qBACvE,CAAC,CAAA;oBAGE,WAAW,GAAG,4BAA4B,CAAA;;;;oBAE/B,qBAAM,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAA;;oBAAhE,IAAI,GAAG,SAAyD;oBACtE,IAAI,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAG,CAAC,CAAC,0CAAE,EAAE;wBAAE,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;;;;;yBAG5B,qBAAM,IAAI,CACzB,iCAAiC,EACjC;wBACE,KAAK,EAAE,uBAAuB;wBAC9B,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,kBAAkB;wBACzC,cAAc,EAAE,WAAW;qBAC5B,EACD;wBACE,aAAa,EAAE,kBAAW,iBAAiB,CAAE;wBAC7C,2BAA2B,EAAE,4BAA4B;qBAC1D,CACF,EAAA;;oBAXK,QAAQ,GAAG,SAWhB;oBAED,qBAAM,UAAU,CACd,iGAAiG,EACjG;;;gCAAY,sBAAA,CAAC;wCACX,MAAM,EAAE,QAAQ,CAAC,MAAM;wCACvB,OAAO,EAAE,MAAA,MAAA,QAAQ,CAAC,IAAI,0CAAE,OAAO,mCAAI,EAAE;wCACrC,eAAe,EAAE,CAAC,CAAC,CAAA,MAAA,MAAA,QAAQ,CAAC,IAAI,0CAAE,OAAO,0CAAE,EAAE,CAAA;qCAC9C,CAAC,EAAA;;6BAAA,EACF;4BACE,QAAQ,EAAE,UAAA,CAAC;gCACT,kFAAkF;gCAClF,qFAAqF;gCACrF,gFAAgF;gCAChF,OAAA,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC;4BAAnD,CAAmD;yBACtD,CACF,EAAA;;oBAdD,SAcC,CAAA;;;;;CACF,CAAA;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAM,KAAG,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACjC,IAAM,aAAW,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IAEzC,IAAM,QAAQ,GAAG;;;wBACf,qBAAM,WAAW,CAAC,KAAG,EAAE,aAAW,CAAC,EAAA;;oBAAnC,SAAmC,CAAA;oBACnC,qBAAM,6BAA6B,CAAC,EAAE,GAAG,OAAA,EAAE,WAAW,eAAA,EAAE,CAAC,EAAA;;oBAAzD,SAAyD,CAAA;;;;SAC1D,CAAA;IAED,QAAQ,EAAE;SACP,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAA;QACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,qDAAqD,EAAE,KAAK,CAAC,CAAA;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}

package/lib/esm/tests/api_tests/security/F-0008-handle-incoming-communication-cross-tenant.test.d.ts

@@ -0,0 +1,24 @@
+import { Session } from "../../../sdk";
+/**
+ * Regression test for F-0008 (security-audit/findings/F-0008-handle-incoming-communication-cross-tenant-enduser-lookup.md).
+ *
+ * `journeys.handle_incoming_communication` previously used `buildAllQueries({ unrestricted: true, organizationIds: [] }).endusers.findById(enduserId)`,
+ * permitting cross-tenant lookup of any enduser by id. The handler then called `handleIncomingCommunication(...)`
+ * against the matched enduser, triggering journey progression and automated actions on someone else's tenant.
+ *
+ * The fix switches to the standard tenant-scoped `DB.endusers.findById(enduserId)` wrapper, which automatically
+ * filters by `req.session.businessId`. Cross-tenant lookups now return null → handler returns 404 → no side effect.
+ *
+ * Note: the same-tenant happy path is already covered by the existing test at
+ * `packages/public/sdk/src/tests/tests.ts:7588` ("handle_incoming_communication test for other enduser") — that
+ * test creates endusers in the test tenant, sets up journeys, calls handle_incoming_communication, and asserts
+ * journey-step cancellation. This file covers the negative cases only.
+ *
+ * **Negative-only by design**: the test never drives `handleIncomingCommunication` against a cross-tenant
+ * enduser — the post-fix code returns 404 before any side effects fire, and the assertion confirms that.
+ */
+export declare const handle_incoming_communication_cross_tenant_tests: ({ sdk, sdkNonAdmin }: {
+    sdk: Session;
+    sdkNonAdmin: Session;
+}) => Promise<void>;
+//# sourceMappingURL=F-0008-handle-incoming-communication-cross-tenant.test.d.ts.map

package/lib/esm/tests/api_tests/security/F-0008-handle-incoming-communication-cross-tenant.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"F-0008-handle-incoming-communication-cross-tenant.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/F-0008-handle-incoming-communication-cross-tenant.test.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAwBtC;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,gDAAgD;SAAwC,OAAO;iBAAe,OAAO;mBA8DjI,CAAA"}

package/lib/esm/tests/api_tests/security/F-0008-handle-incoming-communication-cross-tenant.test.js

@@ -0,0 +1,194 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+require('source-map-support').install();
+import axios from "axios";
+import { ObjectId } from 'bson';
+import { Session } from "../../../sdk";
+import { async_test, log_header, } from "@tellescope/testing";
+import { setup_tests } from "../../setup";
+var host = process.env.API_URL || 'http://localhost:8080';
+var CROSS_ORG_API_KEY = process.env.CROSS_ORG_API_KEY;
+var CROSS_ORG_TARGET_BUSINESS_ID = process.env.CROSS_ORG_TARGET_BUSINESS_ID;
+var post = function (path, body, headers) {
+    if (headers === void 0) { headers = {}; }
+    return __awaiter(void 0, void 0, void 0, function () {
+        var res, err_1;
+        var _a, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0:
+                    _c.trys.push([0, 2, , 3]);
+                    return [4 /*yield*/, axios.post("".concat(host).concat(path), body, {
+                            validateStatus: function () { return true; },
+                            headers: headers,
+                        })];
+                case 1:
+                    res = _c.sent();
+                    return [2 /*return*/, { status: res.status, data: res.data }];
+                case 2:
+                    err_1 = _c.sent();
+                    return [2 /*return*/, { status: (_a = err_1 === null || err_1 === void 0 ? void 0 : err_1.response) === null || _a === void 0 ? void 0 : _a.status, data: (_b = err_1 === null || err_1 === void 0 ? void 0 : err_1.response) === null || _b === void 0 ? void 0 : _b.data }];
+                case 3: return [2 /*return*/];
+            }
+        });
+    });
+};
+/**
+ * Regression test for F-0008 (security-audit/findings/F-0008-handle-incoming-communication-cross-tenant-enduser-lookup.md).
+ *
+ * `journeys.handle_incoming_communication` previously used `buildAllQueries({ unrestricted: true, organizationIds: [] }).endusers.findById(enduserId)`,
+ * permitting cross-tenant lookup of any enduser by id. The handler then called `handleIncomingCommunication(...)`
+ * against the matched enduser, triggering journey progression and automated actions on someone else's tenant.
+ *
+ * The fix switches to the standard tenant-scoped `DB.endusers.findById(enduserId)` wrapper, which automatically
+ * filters by `req.session.businessId`. Cross-tenant lookups now return null → handler returns 404 → no side effect.
+ *
+ * Note: the same-tenant happy path is already covered by the existing test at
+ * `packages/public/sdk/src/tests/tests.ts:7588` ("handle_incoming_communication test for other enduser") — that
+ * test creates endusers in the test tenant, sets up journeys, calls handle_incoming_communication, and asserts
+ * journey-step cancellation. This file covers the negative cases only.
+ *
+ * **Negative-only by design**: the test never drives `handleIncomingCommunication` against a cross-tenant
+ * enduser — the post-fix code returns 404 before any side effects fire, and the assertion confirms that.
+ */
+export var handle_incoming_communication_cross_tenant_tests = function (_a) {
+    var sdk = _a.sdk, sdkNonAdmin = _a.sdkNonAdmin;
+    return __awaiter(void 0, void 0, void 0, function () {
+        var nonexistentId, nonexistentRes, sdkCrossOrg, ts, crossEnduser, crossRes_1, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0:
+                    log_header("F-0008: handle_incoming_communication cross-tenant rejection");
+                    nonexistentId = new ObjectId().toHexString();
+                    return [4 /*yield*/, post('/v1/journeys/handle-incoming-communication', { enduserId: nonexistentId }, { Authorization: "Bearer ".concat(sdk.authToken) })];
+                case 1:
+                    nonexistentRes = _c.sent();
+                    return [4 /*yield*/, async_test("F-0008: handle_incoming_communication with nonexistent enduserId returns 404", function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                            return [2 /*return*/, ({ status: nonexistentRes.status })];
+                        }); }); }, { onResult: function (r) { return r.status === 404; } })
+                        // ====================================================================
+                        // Assertion 2: cross-tenant enduserId returns 404 (the actual F-0008 fix).
+                        // Env-gated; skipped when cross-org infra isn't configured.
+                        // Safe to run post-fix because the tenant-scoped DB returns null for
+                        // cross-tenant lookups — no handleIncomingCommunication side effect fires.
+                        // ====================================================================
+                    ];
+                case 2:
+                    _c.sent();
+                    // ====================================================================
+                    // Assertion 2: cross-tenant enduserId returns 404 (the actual F-0008 fix).
+                    // Env-gated; skipped when cross-org infra isn't configured.
+                    // Safe to run post-fix because the tenant-scoped DB returns null for
+                    // cross-tenant lookups — no handleIncomingCommunication side effect fires.
+                    // ====================================================================
+                    if (!(CROSS_ORG_API_KEY && CROSS_ORG_TARGET_BUSINESS_ID)) {
+                        console.log("  [F-0008] Skipping cross-tenant rejection assertion — CROSS_ORG_* env vars not set");
+                        return [2 /*return*/];
+                    }
+                    sdkCrossOrg = new Session({
+                        host: host,
+                        apiKey: CROSS_ORG_API_KEY,
+                        headers: { 'x-tellescope-organization': CROSS_ORG_TARGET_BUSINESS_ID },
+                    });
+                    ts = Date.now();
+                    return [4 /*yield*/, sdkCrossOrg.api.endusers.createOne({
+                            fname: 'F0008CrossTenant', lname: 'Sentinel',
+                            email: "f0008-cross-".concat(ts, "@tellescope.com"),
+                        })];
+                case 3:
+                    crossEnduser = _c.sent();
+                    _c.label = 4;
+                case 4:
+                    _c.trys.push([4, , 7, 11]);
+                    return [4 /*yield*/, post('/v1/journeys/handle-incoming-communication', { enduserId: crossEnduser.id }, { Authorization: "Bearer ".concat(sdk.authToken) })];
+                case 5:
+                    crossRes_1 = _c.sent();
+                    return [4 /*yield*/, async_test("F-0008: handle_incoming_communication with cross-tenant enduserId returns 404 (no side effect)", function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var _a, _b;
+                            return __generator(this, function (_c) {
+                                return [2 /*return*/, ({
+                                        status: crossRes_1.status,
+                                        message: (_b = (_a = crossRes_1.data) === null || _a === void 0 ? void 0 : _a.message) !== null && _b !== void 0 ? _b : null,
+                                    })];
+                            });
+                        }); }, { onResult: function (r) { return r.status === 404; } })];
+                case 6:
+                    _c.sent();
+                    return [3 /*break*/, 11];
+                case 7:
+                    _c.trys.push([7, 9, , 10]);
+                    return [4 /*yield*/, sdkCrossOrg.api.endusers.deleteOne(crossEnduser.id)];
+                case 8:
+                    _c.sent();
+                    return [3 /*break*/, 10];
+                case 9:
+                    _b = _c.sent();
+                    return [3 /*break*/, 10];
+                case 10: return [7 /*endfinally*/];
+                case 11: return [2 /*return*/];
+            }
+        });
+    });
+};
+if (require.main === module) {
+    console.log("\uD83C\uDF10 Using API URL: ".concat(host));
+    var sdk_1 = new Session({ host: host });
+    var sdkNonAdmin_1 = new Session({ host: host });
+    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, setup_tests(sdk_1, sdkNonAdmin_1)];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, handle_incoming_communication_cross_tenant_tests({ sdk: sdk_1, sdkNonAdmin: sdkNonAdmin_1 })];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); };
+    runTests()
+        .then(function () {
+        console.log("✅ F-0008 handle_incoming_communication cross-tenant test suite completed successfully");
+        process.exit(0);
+    })
+        .catch(function (error) {
+        console.error("❌ F-0008 handle_incoming_communication cross-tenant test suite failed:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=F-0008-handle-incoming-communication-cross-tenant.test.js.map

package/lib/esm/tests/api_tests/security/F-0008-handle-incoming-communication-cross-tenant.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"F-0008-handle-incoming-communication-cross-tenant.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/F-0008-handle-incoming-communication-cross-tenant.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,OAAO,KAAK,MAAM,OAAO,CAAA;AACzB,OAAO,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAA;AAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EACL,UAAU,EACV,UAAU,GACX,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEzC,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE,IAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAA;AACvD,IAAM,4BAA4B,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAA;AAE7E,IAAM,IAAI,GAAG,UAAO,IAAY,EAAE,IAAS,EAAE,OAAoC;IAApC,wBAAA,EAAA,YAAoC;;;;;;;;oBAEjE,qBAAM,KAAK,CAAC,IAAI,CAAC,UAAG,IAAI,SAAG,IAAI,CAAE,EAAE,IAAI,EAAE;4BACnD,cAAc,EAAE,cAAM,OAAA,IAAI,EAAJ,CAAI;4BAC1B,OAAO,SAAA;yBACR,CAAC,EAAA;;oBAHI,GAAG,GAAG,SAGV;oBACF,sBAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAA;;;oBAE7C,sBAAO,EAAE,MAAM,EAAE,MAAA,KAAG,aAAH,KAAG,uBAAH,KAAG,CAAE,QAAQ,0CAAE,MAAM,EAAE,IAAI,EAAE,MAAA,KAAG,aAAH,KAAG,uBAAH,KAAG,CAAE,QAAQ,0CAAE,IAAI,EAAE,EAAA;;;;;CAEtE,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,IAAM,gDAAgD,GAAG,UAAO,EAA6D;QAA3D,GAAG,SAAA,EAAE,WAAW,iBAAA;;;;;;oBACvF,UAAU,CAAC,8DAA8D,CAAC,CAAA;oBAMpE,aAAa,GAAG,IAAI,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAA;oBAC3B,qBAAM,IAAI,CAC/B,4CAA4C,EAC5C,EAAE,SAAS,EAAE,aAAa,EAAE,EAC5B,EAAE,aAAa,EAAE,iBAAU,GAAG,CAAC,SAAS,CAAE,EAAE,CAC7C,EAAA;;oBAJK,cAAc,GAAG,SAItB;oBACD,qBAAM,UAAU,CACd,8EAA8E,EAC9E;4BAAY,sBAAA,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,CAAC,EAAA;iCAAA,EAC/C,EAAE,QAAQ,EAAE,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,MAAM,KAAK,GAAG,EAAhB,CAAgB,EAAE,CACpC;wBAED,uEAAuE;wBACvE,2EAA2E;wBAC3E,4DAA4D;wBAC5D,qEAAqE;wBACrE,2EAA2E;wBAC3E,uEAAuE;sBAPtE;;oBAJD,SAIC,CAAA;oBAED,uEAAuE;oBACvE,2EAA2E;oBAC3E,4DAA4D;oBAC5D,qEAAqE;oBACrE,2EAA2E;oBAC3E,uEAAuE;oBACvE,IAAI,CAAC,CAAC,iBAAiB,IAAI,4BAA4B,CAAC,EAAE;wBACxD,OAAO,CAAC,GAAG,CAAC,qFAAqF,CAAC,CAAA;wBAClG,sBAAM;qBACP;oBAEK,WAAW,GAAG,IAAI,OAAO,CAAC;wBAC9B,IAAI,MAAA;wBACJ,MAAM,EAAE,iBAAiB;wBACzB,OAAO,EAAE,EAAE,2BAA2B,EAAE,4BAA4B,EAAE;qBACvE,CAAC,CAAA;oBAII,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;oBACA,qBAAM,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;4BAC5D,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,UAAU;4BAC5C,KAAK,EAAE,sBAAe,EAAE,oBAAiB;yBACnC,CAAC,EAAA;;oBAHH,YAAY,GAAG,SAGZ;;;;oBAGU,qBAAM,IAAI,CACzB,4CAA4C,EAC5C,EAAE,SAAS,EAAE,YAAY,CAAC,EAAE,EAAE,EAC9B,EAAE,aAAa,EAAE,iBAAU,GAAG,CAAC,SAAS,CAAE,EAAE,CAC7C,EAAA;;oBAJK,aAAW,SAIhB;oBAED,qBAAM,UAAU,CACd,gGAAgG,EAChG;;;gCAAY,sBAAA,CAAC;wCACX,MAAM,EAAE,UAAQ,CAAC,MAAM;wCACvB,OAAO,EAAE,MAAA,MAAA,UAAQ,CAAC,IAAI,0CAAE,OAAO,mCAAI,IAAI;qCACxC,CAAC,EAAA;;6BAAA,EACF,EAAE,QAAQ,EAAE,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,MAAM,KAAK,GAAG,EAAhB,CAAgB,EAAE,CACpC,EAAA;;oBAPD,SAOC,CAAA;;;;oBAEK,qBAAM,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC,EAAA;;oBAAzD,SAAyD,CAAA;;;;;;;;;;CAElE,CAAA;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAM,KAAG,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACjC,IAAM,aAAW,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IAEzC,IAAM,QAAQ,GAAG;;;wBACf,qBAAM,WAAW,CAAC,KAAG,EAAE,aAAW,CAAC,EAAA;;oBAAnC,SAAmC,CAAA;oBACnC,qBAAM,gDAAgD,CAAC,EAAE,GAAG,OAAA,EAAE,WAAW,eAAA,EAAE,CAAC,EAAA;;oBAA5E,SAA4E,CAAA;;;;SAC7E,CAAA;IAED,QAAQ,EAAE;SACP,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,uFAAuF,CAAC,CAAA;QACpG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,wEAAwE,EAAE,KAAK,CAAC,CAAA;QAC9F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}

package/lib/esm/tests/api_tests/security/F-0013-sanitize-user-html.test.d.ts

@@ -0,0 +1,2 @@
+export declare const sanitize_user_html_xss_tests: () => Promise<void>;
+//# sourceMappingURL=F-0013-sanitize-user-html.test.d.ts.map

package/lib/esm/tests/api_tests/security/F-0013-sanitize-user-html.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"F-0013-sanitize-user-html.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/F-0013-sanitize-user-html.test.ts"],"names":[],"mappings":"AAgCA,eAAO,MAAM,4BAA4B,qBAsExC,CAAA"}