@tellescope/sdk 1.250.2 → 1.252.0

package/lib/cjs/tests/api_tests/enduser_login.test.js

@@ -0,0 +1,315 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.enduser_login_tests = void 0;
+require('source-map-support').install();
+var axios_1 = __importDefault(require("axios"));
+var sdk_1 = require("../../sdk");
+var testing_1 = require("@tellescope/testing");
+var setup_1 = require("../setup");
+var host = process.env.API_URL || 'http://localhost:8080';
+// Coverage for the /v1/login-enduser response surface:
+// - When an enduser has no password set, the error response must not include
+//   enduser fields (PHI, hashedPassword, etc.).
+// - The "enduser not found" and "wrong password" cases must be indistinguishable
+//   (same status code, same message) to prevent account enumeration.
+// - verify_otp invalid-code error must not include enduser fields.
+var post_login = function (body) { return __awaiter(void 0, void 0, void 0, function () {
+    var res, err_1;
+    var _a, _b;
+    return __generator(this, function (_c) {
+        switch (_c.label) {
+            case 0:
+                _c.trys.push([0, 2, , 3]);
+                return [4 /*yield*/, axios_1.default.post("".concat(host, "/v1/login-enduser"), body, { validateStatus: function () { return true; } })];
+            case 1:
+                res = _c.sent();
+                return [2 /*return*/, { status: res.status, data: res.data }];
+            case 2:
+                err_1 = _c.sent();
+                return [2 /*return*/, { status: (_a = err_1 === null || err_1 === void 0 ? void 0 : err_1.response) === null || _a === void 0 ? void 0 : _a.status, data: (_b = err_1 === null || err_1 === void 0 ? void 0 : err_1.response) === null || _b === void 0 ? void 0 : _b.data }];
+            case 3: return [2 /*return*/];
+        }
+    });
+}); };
+var enduser_login_tests = function (_a) {
+    var sdk = _a.sdk, sdkNonAdmin = _a.sdkNonAdmin;
+    return __awaiter(void 0, void 0, void 0, function () {
+        var ts, MARKER_FNAME, MARKER_ADDRESS, MARKER_DOB, noPasswordEnduser, withPasswordEnduser, noPasswordResp_1, noPasswordBody_1, _loop_1, _i, _b, sensitiveKey, wrongPasswordResp_1, unknownEmailResp_1, verifyOtpInvalidResp, verifyOtpBody_1, duplicateError_1, err_2;
+        var _c, _d;
+        return __generator(this, function (_e) {
+            switch (_e.label) {
+                case 0:
+                    (0, testing_1.log_header)("Enduser Login Tests");
+                    ts = Date.now();
+                    MARKER_FNAME = "LoginTestFname".concat(ts);
+                    MARKER_ADDRESS = "".concat(ts, " Test Way");
+                    MARKER_DOB = '01-01-1990';
+                    return [4 /*yield*/, sdk.api.endusers.createOne({
+                            fname: MARKER_FNAME,
+                            lname: 'LoginTest',
+                            email: "login-test-no-password-".concat(ts, "@tellescope.com"),
+                            dateOfBirth: MARKER_DOB,
+                            addressLineOne: MARKER_ADDRESS,
+                            addressLineTwo: 'Apt 4B',
+                            city: 'Springfield',
+                            state: 'IL',
+                            zipCode: '62701',
+                            gender: 'Female',
+                            assignedTo: [sdk.userInfo.id],
+                            fields: { secretField: "should-not-leak-".concat(ts) },
+                            tags: ['vip', 'sensitive'],
+                        })];
+                case 1:
+                    noPasswordEnduser = _e.sent();
+                    return [4 /*yield*/, sdk.api.endusers.createOne({
+                            fname: 'PasswordedEnduser',
+                            lname: 'LoginTest',
+                            email: "login-test-with-password-".concat(ts, "@tellescope.com"),
+                        })];
+                case 2:
+                    withPasswordEnduser = _e.sent();
+                    return [4 /*yield*/, sdk.api.endusers.set_password({ id: withPasswordEnduser.id, password: 'CorrectPassword123!' })];
+                case 3:
+                    _e.sent();
+                    _e.label = 4;
+                case 4:
+                    _e.trys.push([4, , 27, 29]);
+                    return [4 /*yield*/, post_login({
+                            email: noPasswordEnduser.email,
+                            password: 'arbitrary-password',
+                            businessId: sdk.userInfo.businessId,
+                        })];
+                case 5:
+                    noPasswordResp_1 = _e.sent();
+                    noPasswordBody_1 = JSON.stringify((_c = noPasswordResp_1.data) !== null && _c !== void 0 ? _c : {});
+                    return [4 /*yield*/, (0, testing_1.async_test)('No-password login response does not include fname marker', function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                            return [2 /*return*/, noPasswordBody_1.includes(MARKER_FNAME) ? 'leaked' : 'safe'];
+                        }); }); }, { expectedResult: 'safe' })];
+                case 6:
+                    _e.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)('No-password login response does not include dateOfBirth', function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                            return [2 /*return*/, noPasswordBody_1.includes(MARKER_DOB) ? 'leaked' : 'safe'];
+                        }); }); }, { expectedResult: 'safe' })];
+                case 7:
+                    _e.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)('No-password login response does not include addressLineOne marker', function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                            return [2 /*return*/, noPasswordBody_1.includes(MARKER_ADDRESS) ? 'leaked' : 'safe'];
+                        }); }); }, { expectedResult: 'safe' })];
+                case 8:
+                    _e.sent();
+                    _loop_1 = function (sensitiveKey) {
+                        return __generator(this, function (_f) {
+                            switch (_f.label) {
+                                case 0: return [4 /*yield*/, (0, testing_1.async_test)("No-password login response does not include \"".concat(sensitiveKey, "\" key"), function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                                        return [2 /*return*/, noPasswordBody_1.includes("\"".concat(sensitiveKey, "\"")) ? 'leaked' : 'safe'];
+                                    }); }); }, { expectedResult: 'safe' })];
+                                case 1:
+                                    _f.sent();
+                                    return [2 /*return*/];
+                            }
+                        });
+                    };
+                    _i = 0, _b = ['hashedPassword', 'assignedTo', 'fields', 'tags', 'insurance', 'customFields'];
+                    _e.label = 9;
+                case 9:
+                    if (!(_i < _b.length)) return [3 /*break*/, 12];
+                    sensitiveKey = _b[_i];
+                    return [5 /*yield**/, _loop_1(sensitiveKey)];
+                case 10:
+                    _e.sent();
+                    _e.label = 11;
+                case 11:
+                    _i++;
+                    return [3 /*break*/, 9];
+                case 12: return [4 /*yield*/, (0, testing_1.async_test)('No-password login response info field is absent or empty', function () { return __awaiter(void 0, void 0, void 0, function () {
+                        var info;
+                        var _a;
+                        return __generator(this, function (_b) {
+                            info = ((_a = noPasswordResp_1.data) !== null && _a !== void 0 ? _a : {}).info;
+                            if (info === undefined)
+                                return [2 /*return*/, 'safe'];
+                            if (typeof info === 'object' && info !== null && Object.keys(info).length === 0)
+                                return [2 /*return*/, 'safe'];
+                            return [2 /*return*/, 'leaked'];
+                        });
+                    }); }, { expectedResult: 'safe' })
+                    // All three failure modes (no-password-set, wrong-password, unknown-email)
+                    // must return an identical 401 + identical message — no enumeration of
+                    // which case actually applies.
+                ];
+                case 13:
+                    _e.sent();
+                    return [4 /*yield*/, post_login({
+                            email: withPasswordEnduser.email,
+                            password: 'WrongPassword!2025',
+                            businessId: sdk.userInfo.businessId,
+                        })];
+                case 14:
+                    wrongPasswordResp_1 = _e.sent();
+                    return [4 /*yield*/, post_login({
+                            email: "does-not-exist-".concat(ts, "@tellescope.com"),
+                            password: 'AnyPassword!2025',
+                            businessId: sdk.userInfo.businessId,
+                        })];
+                case 15:
+                    unknownEmailResp_1 = _e.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)('Login returns 401 for no-password account (indistinguishable from wrong password)', function () { return __awaiter(void 0, void 0, void 0, function () { var _a, _b; return __generator(this, function (_c) {
+                            return [2 /*return*/, "".concat(noPasswordResp_1.status, ":").concat((_b = (_a = noPasswordResp_1.data) === null || _a === void 0 ? void 0 : _a.message) !== null && _b !== void 0 ? _b : '')];
+                        }); }); }, { expectedResult: '401:Login details are invalid' })];
+                case 16:
+                    _e.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)('Login returns same status for no-password vs wrong-password vs unknown-email', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var statuses, allSame;
+                            return __generator(this, function (_a) {
+                                statuses = [noPasswordResp_1.status, wrongPasswordResp_1.status, unknownEmailResp_1.status];
+                                allSame = statuses.every(function (s) { return s === statuses[0]; });
+                                return [2 /*return*/, allSame ? "same:".concat(statuses[0]) : "diff:".concat(statuses.join(','))];
+                            });
+                        }); }, { expectedResult: 'same:401' })];
+                case 17:
+                    _e.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)('Login returns same message for no-password vs wrong-password vs unknown-email', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var messages, allSame;
+                            var _a, _b, _c;
+                            return __generator(this, function (_d) {
+                                messages = [(_a = noPasswordResp_1.data) === null || _a === void 0 ? void 0 : _a.message, (_b = wrongPasswordResp_1.data) === null || _b === void 0 ? void 0 : _b.message, (_c = unknownEmailResp_1.data) === null || _c === void 0 ? void 0 : _c.message];
+                                allSame = messages.every(function (m) { return m === messages[0]; });
+                                return [2 /*return*/, allSame ? 'same' : "diff:".concat(JSON.stringify(messages))];
+                            });
+                        }); }, { expectedResult: 'same' })
+                        // verify_otp invalid-code response must not include enduser fields.
+                    ];
+                case 18:
+                    _e.sent();
+                    return [4 /*yield*/, axios_1.default.post("".concat(host, "/v1/verify-otp-code"), { token: 'not-a-real-token', code: '000000', businessId: sdk.userInfo.businessId }, { validateStatus: function () { return true; } })];
+                case 19:
+                    verifyOtpInvalidResp = _e.sent();
+                    verifyOtpBody_1 = JSON.stringify((_d = verifyOtpInvalidResp.data) !== null && _d !== void 0 ? _d : {});
+                    return [4 /*yield*/, (0, testing_1.async_test)('verify_otp invalid-code response does not include any enduser fields', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            return __generator(this, function (_a) {
+                                return [2 /*return*/, (verifyOtpBody_1.includes('"hashedPassword"')
+                                        || verifyOtpBody_1.includes('"assignedTo"')
+                                        || verifyOtpBody_1.includes(MARKER_FNAME)
+                                        ? 'leaked' : 'safe')];
+                            });
+                        }); }, { expectedResult: 'safe' })
+                        // Regression: admin creating a duplicate enduser (same email) must still
+                        // receive the existing record's id in the error info — this is an
+                        // authenticated, intentional API-aid pattern via uniquenessError and must
+                        // not be regressed by the public-endpoint sanitizer.
+                    ];
+                case 20:
+                    _e.sent();
+                    duplicateError_1 = null;
+                    _e.label = 21;
+                case 21:
+                    _e.trys.push([21, 23, , 24]);
+                    return [4 /*yield*/, sdk.api.endusers.createOne({ email: noPasswordEnduser.email })];
+                case 22:
+                    _e.sent();
+                    return [3 /*break*/, 24];
+                case 23:
+                    err_2 = _e.sent();
+                    duplicateError_1 = err_2;
+                    return [3 /*break*/, 24];
+                case 24: return [4 /*yield*/, (0, testing_1.async_test)('Admin duplicate enduser create rejects with 409 Uniqueness Violation', function () { return __awaiter(void 0, void 0, void 0, function () { var _a; return __generator(this, function (_b) {
+                        return [2 /*return*/, (_a = duplicateError_1 === null || duplicateError_1 === void 0 ? void 0 : duplicateError_1.message) !== null && _a !== void 0 ? _a : 'no-error'];
+                    }); }); }, { expectedResult: 'Uniqueness Violation' })];
+                case 25:
+                    _e.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)('Admin duplicate enduser create returns the existing record id in info', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var info, existing, existingId;
+                            var _a, _b;
+                            return __generator(this, function (_c) {
+                                info = duplicateError_1 === null || duplicateError_1 === void 0 ? void 0 : duplicateError_1.info;
+                                if (!Array.isArray(info) || info.length === 0)
+                                    return [2 /*return*/, "no-info:".concat(JSON.stringify(info))];
+                                existing = (_a = info[0]) === null || _a === void 0 ? void 0 : _a.existingRecord;
+                                existingId = (_b = existing === null || existing === void 0 ? void 0 : existing._id) !== null && _b !== void 0 ? _b : existing === null || existing === void 0 ? void 0 : existing.id;
+                                return [2 /*return*/, existingId === noPasswordEnduser.id ? 'matched' : "mismatched:".concat(existingId)];
+                            });
+                        }); }, { expectedResult: 'matched' })];
+                case 26:
+                    _e.sent();
+                    return [3 /*break*/, 29];
+                case 27: return [4 /*yield*/, Promise.all([
+                        sdk.api.endusers.deleteOne(noPasswordEnduser.id).catch(function () { return null; }),
+                        sdk.api.endusers.deleteOne(withPasswordEnduser.id).catch(function () { return null; }),
+                    ])];
+                case 28:
+                    _e.sent();
+                    return [7 /*endfinally*/];
+                case 29: return [2 /*return*/];
+            }
+        });
+    });
+};
+exports.enduser_login_tests = enduser_login_tests;
+// Allow running this test file independently
+if (require.main === module) {
+    console.log("\uD83C\uDF10 Using API URL: ".concat(host));
+    var sdk_2 = new sdk_1.Session({ host: host });
+    var sdkNonAdmin_1 = new sdk_1.Session({ host: host });
+    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, (0, setup_1.setup_tests)(sdk_2, sdkNonAdmin_1)];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, (0, exports.enduser_login_tests)({ sdk: sdk_2, sdkNonAdmin: sdkNonAdmin_1 })];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); };
+    runTests()
+        .then(function () {
+        console.log("✅ Enduser login test suite completed successfully");
+        process.exit(0);
+    })
+        .catch(function (error) {
+        console.error("❌ Enduser login test suite failed:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=enduser_login.test.js.map

package/lib/cjs/tests/api_tests/enduser_login.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enduser_login.test.js","sourceRoot":"","sources":["../../../../src/tests/api_tests/enduser_login.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,gDAAyB;AACzB,iCAAmC;AACnC,+CAG4B;AAC5B,kCAAsC;AAEtC,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE,uDAAuD;AACvD,6EAA6E;AAC7E,gDAAgD;AAChD,iFAAiF;AACjF,qEAAqE;AACrE,mEAAmE;AAEnE,IAAM,UAAU,GAAG,UAAO,IAAS;;;;;;;gBAEnB,qBAAM,eAAK,CAAC,IAAI,CAAC,UAAG,IAAI,sBAAmB,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,cAAM,OAAA,IAAI,EAAJ,CAAI,EAAE,CAAC,EAAA;;gBAAxF,GAAG,GAAG,SAAkF;gBAC9F,sBAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAA;;;gBAE7C,sBAAO,EAAE,MAAM,EAAE,MAAA,KAAG,aAAH,KAAG,uBAAH,KAAG,CAAE,QAAQ,0CAAE,MAAM,EAAE,IAAI,EAAE,MAAA,KAAG,aAAH,KAAG,uBAAH,KAAG,CAAE,QAAQ,0CAAE,IAAI,EAAE,EAAA;;;;KAEtE,CAAA;AAEM,IAAM,mBAAmB,GAAG,UAAO,EAA6D;QAA3D,GAAG,SAAA,EAAE,WAAW,iBAAA;;;;;;;oBAC1D,IAAA,oBAAU,EAAC,qBAAqB,CAAC,CAAA;oBAE3B,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;oBAEf,YAAY,GAAG,wBAAiB,EAAE,CAAE,CAAA;oBACpC,cAAc,GAAG,UAAG,EAAE,cAAW,CAAA;oBACjC,UAAU,GAAG,YAAY,CAAA;oBAEL,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;4BACzD,KAAK,EAAE,YAAY;4BACnB,KAAK,EAAE,WAAW;4BAClB,KAAK,EAAE,iCAA0B,EAAE,oBAAiB;4BACpD,WAAW,EAAE,UAAU;4BACvB,cAAc,EAAE,cAAc;4BAC9B,cAAc,EAAE,QAAQ;4BACxB,IAAI,EAAE,aAAa;4BACnB,KAAK,EAAE,IAAI;4BACX,OAAO,EAAE,OAAO;4BAChB,MAAM,EAAE,QAAQ;4BAChB,UAAU,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;4BAC7B,MAAM,EAAE,EAAE,WAAW,EAAE,0BAAmB,EAAE,CAAE,EAAE;4BAChD,IAAI,EAAE,CAAC,KAAK,EAAE,WAAW,CAAC;yBAC3B,CAAC,EAAA;;oBAdI,iBAAiB,GAAG,SAcxB;oBAE0B,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;4BAC3D,KAAK,EAAE,mBAAmB;4BAC1B,KAAK,EAAE,WAAW;4BAClB,KAAK,EAAE,mCAA4B,EAAE,oBAAiB;yBACvD,CAAC,EAAA;;oBAJI,mBAAmB,GAAG,SAI1B;oBACF,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,qBAAqB,EAAE,CAAC,EAAA;;oBAApG,SAAoG,CAAA;;;;oBAK3E,qBAAM,UAAU,CAAC;4BACtC,KAAK,EAAE,iBAAiB,CAAC,KAAK;4BAC9B,QAAQ,EAAE,oBAAoB;4BAC9B,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,UAAU;yBACpC,CAAC,EAAA;;oBAJI,mBAAiB,SAIrB;oBAEI,mBAAiB,IAAI,CAAC,SAAS,CAAC,MAAA,gBAAc,CAAC,IAAI,mCAAI,EAAE,CAAC,CAAA;oBAEhE,qBAAM,IAAA,oBAAU,EACd,0DAA0D,EAC1D;4BAAY,sBAAA,gBAAc,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAA;iCAAA,EACrE,EAAE,cAAc,EAAE,MAAM,EAAE,CAC3B,EAAA;;oBAJD,SAIC,CAAA;oBACD,qBAAM,IAAA,oBAAU,EACd,yDAAyD,EACzD;4BAAY,sBAAA,gBAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAA;iCAAA,EACnE,EAAE,cAAc,EAAE,MAAM,EAAE,CAC3B,EAAA;;oBAJD,SAIC,CAAA;oBACD,qBAAM,IAAA,oBAAU,EACd,mEAAmE,EACnE;4BAAY,sBAAA,gBAAc,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAA;iCAAA,EACvE,EAAE,cAAc,EAAE,MAAM,EAAE,CAC3B,EAAA;;oBAJD,SAIC,CAAA;wCACU,YAAY;;;wCACrB,qBAAM,IAAA,oBAAU,EACd,wDAAgD,YAAY,WAAO,EACnE;wCAAY,sBAAA,gBAAc,CAAC,QAAQ,CAAC,YAAI,YAAY,OAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAA;6CAAA,EAC5E,EAAE,cAAc,EAAE,MAAM,EAAE,CAC3B,EAAA;;oCAJD,SAIC,CAAA;;;;;0BALuG,EAA/E,MAAC,gBAAgB,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,CAAC;;;yBAA/E,CAAA,cAA+E,CAAA;oBAA/F,YAAY;kDAAZ,YAAY;;;;;oBAAI,IAA+E,CAAA;;yBAO1G,qBAAM,IAAA,oBAAU,EACd,0DAA0D,EAC1D;;;;4BACQ,IAAI,GAAG,CAAC,MAAA,gBAAc,CAAC,IAAI,mCAAI,EAAE,CAAC,CAAC,IAAI,CAAA;4BAC7C,IAAI,IAAI,KAAK,SAAS;gCAAE,sBAAO,MAAM,EAAA;4BACrC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;gCAAE,sBAAO,MAAM,EAAA;4BAC9F,sBAAO,QAAQ,EAAA;;yBAChB,EACD,EAAE,cAAc,EAAE,MAAM,EAAE,CAC3B;oBAED,2EAA2E;oBAC3E,uEAAuE;oBACvE,+BAA+B;kBAJ9B;;oBATD,SASC,CAAA;oBAKyB,qBAAM,UAAU,CAAC;4BACzC,KAAK,EAAE,mBAAmB,CAAC,KAAK;4BAChC,QAAQ,EAAE,oBAAoB;4BAC9B,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,UAAU;yBACpC,CAAC,EAAA;;oBAJI,sBAAoB,SAIxB;oBACuB,qBAAM,UAAU,CAAC;4BACxC,KAAK,EAAE,yBAAkB,EAAE,oBAAiB;4BAC5C,QAAQ,EAAE,kBAAkB;4BAC5B,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,UAAU;yBACpC,CAAC,EAAA;;oBAJI,qBAAmB,SAIvB;oBAEF,qBAAM,IAAA,oBAAU,EACd,mFAAmF,EACnF;4BAAY,sBAAA,UAAG,gBAAc,CAAC,MAAM,cAAI,MAAA,MAAA,gBAAc,CAAC,IAAI,0CAAE,OAAO,mCAAI,EAAE,CAAE,EAAA;iCAAA,EAC5E,EAAE,cAAc,EAAE,+BAA+B,EAAE,CACpD,EAAA;;oBAJD,SAIC,CAAA;oBACD,qBAAM,IAAA,oBAAU,EACd,8EAA8E,EAC9E;;;gCACQ,QAAQ,GAAG,CAAC,gBAAc,CAAC,MAAM,EAAE,mBAAiB,CAAC,MAAM,EAAE,kBAAgB,CAAC,MAAM,CAAC,CAAA;gCACrF,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAA,CAAC,IAAI,OAAA,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAjB,CAAiB,CAAC,CAAA;gCACtD,sBAAO,OAAO,CAAC,CAAC,CAAC,eAAQ,QAAQ,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,eAAQ,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAE,EAAA;;6BACtE,EACD,EAAE,cAAc,EAAE,UAAU,EAAE,CAC/B,EAAA;;oBARD,SAQC,CAAA;oBACD,qBAAM,IAAA,oBAAU,EACd,+EAA+E,EAC/E;;;;gCACQ,QAAQ,GAAG,CAAC,MAAA,gBAAc,CAAC,IAAI,0CAAE,OAAO,EAAE,MAAA,mBAAiB,CAAC,IAAI,0CAAE,OAAO,EAAE,MAAA,kBAAgB,CAAC,IAAI,0CAAE,OAAO,CAAC,CAAA;gCAC1G,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAA,CAAC,IAAI,OAAA,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAjB,CAAiB,CAAC,CAAA;gCACtD,sBAAO,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,eAAQ,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAE,EAAA;;6BAC7D,EACD,EAAE,cAAc,EAAE,MAAM,EAAE,CAC3B;wBAED,oEAAoE;sBAFnE;;oBARD,SAQC,CAAA;oBAG4B,qBAAM,eAAK,CAAC,IAAI,CAC3C,UAAG,IAAI,wBAAqB,EAC5B,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,EAClF,EAAE,cAAc,EAAE,cAAM,OAAA,IAAI,EAAJ,CAAI,EAAE,CAC/B,EAAA;;oBAJK,oBAAoB,GAAG,SAI5B;oBACK,kBAAgB,IAAI,CAAC,SAAS,CAAC,MAAA,oBAAoB,CAAC,IAAI,mCAAI,EAAE,CAAC,CAAA;oBACrE,qBAAM,IAAA,oBAAU,EACd,sEAAsE,EACtE;;gCAAY,sBAAA,CACV,eAAa,CAAC,QAAQ,CAAC,kBAAkB,CAAC;2CACvC,eAAa,CAAC,QAAQ,CAAC,cAAc,CAAC;2CACtC,eAAa,CAAC,QAAQ,CAAC,YAAY,CAAC;wCACrC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CACtB,EAAA;;6BAAA,EACD,EAAE,cAAc,EAAE,MAAM,EAAE,CAC3B;wBAED,yEAAyE;wBACzE,kEAAkE;wBAClE,0EAA0E;wBAC1E,qDAAqD;sBALpD;;oBATD,SASC,CAAA;oBAMG,mBAAsB,IAAI,CAAA;;;;oBAE5B,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,CAAC,KAAK,EAAE,CAAC,EAAA;;oBAApE,SAAoE,CAAA;;;;oBAEpE,gBAAc,GAAG,KAAG,CAAA;;yBAEtB,qBAAM,IAAA,oBAAU,EACd,sEAAsE,EACtE;wBAAY,sBAAA,MAAA,gBAAc,aAAd,gBAAc,uBAAd,gBAAc,CAAE,OAAO,mCAAI,UAAU,EAAA;6BAAA,EACjD,EAAE,cAAc,EAAE,sBAAsB,EAAE,CAC3C,EAAA;;oBAJD,SAIC,CAAA;oBACD,qBAAM,IAAA,oBAAU,EACd,uEAAuE,EACvE;;;;gCACQ,IAAI,GAAG,gBAAc,aAAd,gBAAc,uBAAd,gBAAc,CAAE,IAAI,CAAA;gCACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;oCAAE,sBAAO,kBAAW,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAE,EAAA;gCACjF,QAAQ,GAAG,MAAA,IAAI,CAAC,CAAC,CAAC,0CAAE,cAAc,CAAA;gCAClC,UAAU,GAAG,MAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,GAAG,mCAAI,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,EAAE,CAAA;gCAChD,sBAAO,UAAU,KAAK,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAc,UAAU,CAAE,EAAA;;6BACpF,EACD,EAAE,cAAc,EAAE,SAAS,EAAE,CAC9B,EAAA;;oBAVD,SAUC,CAAA;;yBAED,qBAAM,OAAO,CAAC,GAAG,CAAC;wBAChB,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,cAAM,OAAA,IAAI,EAAJ,CAAI,CAAC;wBAClE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,cAAM,OAAA,IAAI,EAAJ,CAAI,CAAC;qBACrE,CAAC,EAAA;;oBAHF,SAGE,CAAA;;;;;;CAEL,CAAA;AApKY,QAAA,mBAAmB,uBAoK/B;AAED,6CAA6C;AAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAM,KAAG,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACjC,IAAM,aAAW,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IAEzC,IAAM,QAAQ,GAAG;;;wBACf,qBAAM,IAAA,mBAAW,EAAC,KAAG,EAAE,aAAW,CAAC,EAAA;;oBAAnC,SAAmC,CAAA;oBACnC,qBAAM,IAAA,2BAAmB,EAAC,EAAE,GAAG,OAAA,EAAE,WAAW,eAAA,EAAE,CAAC,EAAA;;oBAA/C,SAA+C,CAAA;;;;SAChD,CAAA;IAED,QAAQ,EAAE;SACP,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAA;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAA;QAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}

package/lib/cjs/tests/api_tests/enduser_login_rate_limits.test.d.ts

@@ -0,0 +1,6 @@
+import { Session } from "../../sdk";
+export declare const enduser_login_rate_limits_tests: ({ sdk, sdkNonAdmin }: {
+    sdk: Session;
+    sdkNonAdmin: Session;
+}) => Promise<void>;
+//# sourceMappingURL=enduser_login_rate_limits.test.d.ts.map

package/lib/cjs/tests/api_tests/enduser_login_rate_limits.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enduser_login_rate_limits.test.d.ts","sourceRoot":"","sources":["../../../../src/tests/api_tests/enduser_login_rate_limits.test.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAoCnC,eAAO,MAAM,+BAA+B;SAAwC,OAAO;iBAAe,OAAO;mBAoHhH,CAAA"}

package/lib/cjs/tests/api_tests/enduser_login_rate_limits.test.js

@@ -0,0 +1,287 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.enduser_login_rate_limits_tests = void 0;
+require('source-map-support').install();
+var axios_1 = __importDefault(require("axios"));
+var sdk_1 = require("../../sdk");
+var testing_1 = require("@tellescope/testing");
+var setup_1 = require("../setup");
+var host = process.env.API_URL || 'http://localhost:8080';
+// Per-IP rate limits applied to enduser public endpoints:
+//   POST /v1/login-enduser              20 / min, 100 / hour
+//   POST /v1/begin-enduser-login-flow   10 / min,  50 / hour
+//   POST /v1/endusers/send-otp-code      5 / min,  30 / hour
+// Plus a per-identifier limit on begin_login_flow: 5 / 10 min per email|phone.
+var post = function (path, body) { return __awaiter(void 0, void 0, void 0, function () {
+    var res, err_1;
+    var _a, _b;
+    return __generator(this, function (_c) {
+        switch (_c.label) {
+            case 0:
+                _c.trys.push([0, 2, , 3]);
+                return [4 /*yield*/, axios_1.default.post("".concat(host).concat(path), body, { validateStatus: function () { return true; } })];
+            case 1:
+                res = _c.sent();
+                return [2 /*return*/, { status: res.status, data: res.data }];
+            case 2:
+                err_1 = _c.sent();
+                return [2 /*return*/, { status: (_a = err_1 === null || err_1 === void 0 ? void 0 : err_1.response) === null || _a === void 0 ? void 0 : _a.status, data: (_b = err_1 === null || err_1 === void 0 ? void 0 : err_1.response) === null || _b === void 0 ? void 0 : _b.data }];
+            case 3: return [2 /*return*/];
+        }
+    });
+}); };
+var fire_until_429 = function (cap, send) { return __awaiter(void 0, void 0, void 0, function () {
+    var triggeredAt, i, status_1;
+    return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0:
+                triggeredAt = -1;
+                i = 0;
+                _a.label = 1;
+            case 1:
+                if (!(i < cap + 5)) return [3 /*break*/, 4];
+                return [4 /*yield*/, send(i)];
+            case 2:
+                status_1 = (_a.sent()).status;
+                if (status_1 === 429) {
+                    triggeredAt = i;
+                    return [3 /*break*/, 4];
+                }
+                _a.label = 3;
+            case 3:
+                i++;
+                return [3 /*break*/, 1];
+            case 4: return [2 /*return*/, triggeredAt];
+        }
+    });
+}); };
+var enduser_login_rate_limits_tests = function (_a) {
+    var sdk = _a.sdk, sdkNonAdmin = _a.sdkNonAdmin;
+    return __awaiter(void 0, void 0, void 0, function () {
+        var businessId, loginTrip, beginIpTrip, fixedEmail, beginIdTrip, fakeToken, sendOtpTrip, tripped, ts, enduser, goodLogin_1, goodLoginRetry_1;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    (0, testing_1.log_header)("Enduser Login Rate Limit Tests");
+                    businessId = sdk.userInfo.businessId;
+                    // Ensure throttled_events from prior tests don't bleed in.
+                    return [4 /*yield*/, sdk.reset_db()
+                        // ---- /v1/login-enduser per-IP cap (20/min) ----
+                        // Bogus emails ensure we never reach the actual DB lookup / login work.
+                    ];
+                case 1:
+                    // Ensure throttled_events from prior tests don't bleed in.
+                    _b.sent();
+                    return [4 /*yield*/, fire_until_429(20, function (i) { return post('/v1/login-enduser', {
+                            email: "rl-login-".concat(Date.now(), "-").concat(i, "@tellescope.com"),
+                            password: 'NotARealPassword!2025',
+                            businessId: businessId,
+                        }); })];
+                case 2:
+                    loginTrip = _b.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)('login per-IP throttle trips within first 21 requests', function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                            return [2 /*return*/, (loginTrip >= 0 && loginTrip <= 20) ? 'tripped' : "not-tripped:".concat(loginTrip)];
+                        }); }); }, { expectedResult: 'tripped' })];
+                case 3:
+                    _b.sent();
+                    return [4 /*yield*/, sdk.reset_db()
+                        // ---- /v1/begin-enduser-login-flow per-IP cap (10/min) ----
+                        // Use distinct emails so the per-identifier limit (5/10min) does NOT trip first;
+                        // we want the IP cap to be the first thing to fire.
+                    ];
+                case 4:
+                    _b.sent();
+                    return [4 /*yield*/, fire_until_429(10, function (i) { return post('/v1/begin-enduser-login-flow', {
+                            email: "rl-begin-ip-".concat(Date.now(), "-").concat(i, "@tellescope.com"),
+                            businessId: businessId,
+                        }); })];
+                case 5:
+                    beginIpTrip = _b.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)('begin_login_flow per-IP throttle trips within first 11 requests', function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                            return [2 /*return*/, (beginIpTrip >= 0 && beginIpTrip <= 10) ? 'tripped' : "not-tripped:".concat(beginIpTrip)];
+                        }); }); }, { expectedResult: 'tripped' })];
+                case 6:
+                    _b.sent();
+                    return [4 /*yield*/, sdk.reset_db()
+                        // ---- /v1/begin-enduser-login-flow per-identifier cap (5 / 10 min per email) ----
+                        // Hit a single email below the per-IP cap.
+                    ];
+                case 7:
+                    _b.sent();
+                    fixedEmail = "rl-begin-id-".concat(Date.now(), "@tellescope.com");
+                    return [4 /*yield*/, fire_until_429(5, function () { return post('/v1/begin-enduser-login-flow', {
+                            email: fixedEmail,
+                            businessId: businessId,
+                        }); })];
+                case 8:
+                    beginIdTrip = _b.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)('begin_login_flow per-identifier throttle trips within first 6 requests', function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                            return [2 /*return*/, (beginIdTrip >= 0 && beginIdTrip <= 5) ? 'tripped' : "not-tripped:".concat(beginIdTrip)];
+                        }); }); }, { expectedResult: 'tripped' })];
+                case 9:
+                    _b.sent();
+                    return [4 /*yield*/, sdk.reset_db()
+                        // ---- /v1/endusers/send-otp-code per-IP cap (5/min) ----
+                        // Use a bogus JWT-shaped token so we trip the IP guard first (it runs before any DB work).
+                    ];
+                case 10:
+                    _b.sent();
+                    fakeToken = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMCJ9.sig';
+                    return [4 /*yield*/, fire_until_429(5, function () { return post('/v1/endusers/send-otp-code', {
+                            token: fakeToken,
+                            method: 'email',
+                        }); })];
+                case 11:
+                    sendOtpTrip = _b.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)('send_otp per-IP throttle trips within first 6 requests', function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                            return [2 /*return*/, (sendOtpTrip >= 0 && sendOtpTrip <= 5) ? 'tripped' : "not-tripped:".concat(sendOtpTrip)];
+                        }); }); }, { expectedResult: 'tripped' })
+                        // Confirm 429 response does not leak the keying strategy (no mention of "ip" or "address").
+                    ];
+                case 12:
+                    _b.sent();
+                    return [4 /*yield*/, post('/v1/endusers/send-otp-code', { token: fakeToken, method: 'email' })];
+                case 13:
+                    tripped = _b.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)('429 response does not mention "ip" or "address"', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var msg;
+                            var _a, _b;
+                            return __generator(this, function (_c) {
+                                msg = ((_b = (_a = tripped.data) === null || _a === void 0 ? void 0 : _a.message) !== null && _b !== void 0 ? _b : '').toLowerCase();
+                                return [2 /*return*/, (msg.includes('ip') || msg.includes('address')) ? 'leaked' : 'safe'];
+                            });
+                        }); }, { expectedResult: 'safe' })
+                        // ---- Legitimate-login regression: a single successful login should still go through ----
+                        // Reset state, then create a real enduser with a password and confirm one login succeeds.
+                    ];
+                case 14:
+                    _b.sent();
+                    // ---- Legitimate-login regression: a single successful login should still go through ----
+                    // Reset state, then create a real enduser with a password and confirm one login succeeds.
+                    return [4 /*yield*/, sdk.reset_db()];
+                case 15:
+                    // ---- Legitimate-login regression: a single successful login should still go through ----
+                    // Reset state, then create a real enduser with a password and confirm one login succeeds.
+                    _b.sent();
+                    ts = Date.now();
+                    return [4 /*yield*/, sdk.api.endusers.createOne({
+                            fname: 'RateLimitOk', lname: 'Enduser',
+                            email: "rl-legit-".concat(ts, "@tellescope.com"),
+                        })];
+                case 16:
+                    enduser = _b.sent();
+                    _b.label = 17;
+                case 17:
+                    _b.trys.push([17, , 23, 26]);
+                    return [4 /*yield*/, sdk.api.endusers.set_password({ id: enduser.id, password: 'CorrectPassword123!' })];
+                case 18:
+                    _b.sent();
+                    return [4 /*yield*/, post('/v1/login-enduser', {
+                            email: enduser.email,
+                            password: 'CorrectPassword123!',
+                            businessId: businessId,
+                        })];
+                case 19:
+                    goodLogin_1 = _b.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)('legitimate login still succeeds (returns authToken, not 429)', function () { return __awaiter(void 0, void 0, void 0, function () { var _a; return __generator(this, function (_b) {
+                            return [2 /*return*/, goodLogin_1.status === 200 && !!((_a = goodLogin_1.data) === null || _a === void 0 ? void 0 : _a.authToken) ? 'ok' : "failed:".concat(goodLogin_1.status)];
+                        }); }); }, { expectedResult: 'ok' })
+                        // A subsequent successful login by the same user/IP should also succeed —
+                        // a single legitimate user retrying must not trip the per-IP cap.
+                    ];
+                case 20:
+                    _b.sent();
+                    return [4 /*yield*/, post('/v1/login-enduser', {
+                            email: enduser.email,
+                            password: 'CorrectPassword123!',
+                            businessId: businessId,
+                        })];
+                case 21:
+                    goodLoginRetry_1 = _b.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)('legitimate login retry still succeeds', function () { return __awaiter(void 0, void 0, void 0, function () { var _a; return __generator(this, function (_b) {
+                            return [2 /*return*/, goodLoginRetry_1.status === 200 && !!((_a = goodLoginRetry_1.data) === null || _a === void 0 ? void 0 : _a.authToken) ? 'ok' : "failed:".concat(goodLoginRetry_1.status)];
+                        }); }); }, { expectedResult: 'ok' })];
+                case 22:
+                    _b.sent();
+                    return [3 /*break*/, 26];
+                case 23: return [4 /*yield*/, sdk.api.endusers.deleteOne(enduser.id).catch(function () { return null; })];
+                case 24:
+                    _b.sent();
+                    return [4 /*yield*/, sdk.reset_db().catch(function () { return null; })];
+                case 25:
+                    _b.sent();
+                    return [7 /*endfinally*/];
+                case 26: return [2 /*return*/];
+            }
+        });
+    });
+};
+exports.enduser_login_rate_limits_tests = enduser_login_rate_limits_tests;
+// Allow running this test file independently
+if (require.main === module) {
+    console.log("\uD83C\uDF10 Using API URL: ".concat(host));
+    var sdk_2 = new sdk_1.Session({ host: host });
+    var sdkNonAdmin_1 = new sdk_1.Session({ host: host });
+    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, (0, setup_1.setup_tests)(sdk_2, sdkNonAdmin_1)];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, (0, exports.enduser_login_rate_limits_tests)({ sdk: sdk_2, sdkNonAdmin: sdkNonAdmin_1 })];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); };
+    runTests()
+        .then(function () {
+        console.log("✅ Enduser login rate limit test suite completed successfully");
+        process.exit(0);
+    })
+        .catch(function (error) {
+        console.error("❌ Enduser login rate limit test suite failed:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=enduser_login_rate_limits.test.js.map