@tellescope/sdk 1.252.3 → 1.253.1

package/lib/cjs/tests/api_tests/beluga_manual_sync.test.d.ts

@@ -0,0 +1,6 @@
+import { Session } from "../../sdk";
+export declare const beluga_manual_sync_tests: ({ sdk, sdkNonAdmin }: {
+    sdk: Session;
+    sdkNonAdmin: Session;
+}) => Promise<void>;
+//# sourceMappingURL=beluga_manual_sync.test.d.ts.map

package/lib/cjs/tests/api_tests/beluga_manual_sync.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"beluga_manual_sync.test.d.ts","sourceRoot":"","sources":["../../../../src/tests/api_tests/beluga_manual_sync.test.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAkBnC,eAAO,MAAM,wBAAwB;SAAuC,OAAO;iBAAe,OAAO;mBAqHxG,CAAA"}

package/lib/cjs/tests/api_tests/beluga_manual_sync.test.js

@@ -0,0 +1,256 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.beluga_manual_sync_tests = void 0;
+require('source-map-support').install();
+var sdk_1 = require("../../sdk");
+var testing_1 = require("@tellescope/testing");
+var setup_1 = require("../setup");
+var constants_1 = require("@tellescope/constants");
+var host = process.env.API_URL || 'http://localhost:8080';
+// Manual Beluga re-sync guard tests (CU-86e1uxz1n).
+//   - form_responses.push_to_EHR with target === BELUGA_TITLE
+//   - files.push with destination === BELUGA_TITLE
+//
+// Fast / no-upload: this only verifies the bad-input / guard branches that reject before any
+// Beluga call. It performs NO S3 file uploads and triggers NO actual sync (both slow and require
+// live Beluga sandbox credentials). File records are created via prepare_file_upload alone — that
+// inserts the DB record, which is all the guards need.
+var beluga_manual_sync_tests = function (_a) {
+    var sdk = _a.sdk, sdkNonAdmin = _a.sdkNonAdmin;
+    return __awaiter(void 0, void 0, void 0, function () {
+        var errorMessage, enduserId, belugaFormId, plainFormId, fileIds, createdBelugaIntegrationId, enduser_1, belugaForm, plainForm, plainField_1, submitForm, createFileRecord, draft_1, plainResponseId_1, belugaIntegrationAvailable, existing, _b, created, e_1, unlinkedFile_1, _i, fileIds_1, id;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0:
+                    (0, testing_1.log_header)("Beluga Manual Sync Guard Tests (FormResponses & Files)");
+                    errorMessage = function (e) { var _a; return ((e === null || e === void 0 ? void 0 : e.message) || ((_a = e === null || e === void 0 ? void 0 : e.toString) === null || _a === void 0 ? void 0 : _a.call(e)) || JSON.stringify(e)); };
+                    fileIds = [];
+                    _c.label = 1;
+                case 1:
+                    _c.trys.push([1, , 22, 35]);
+                    return [4 /*yield*/, sdk.api.endusers.createOne({
+                            fname: 'beluga-sync',
+                            email: "beluga_manual_sync_".concat(Date.now(), "@test.tellescope.com"),
+                        })];
+                case 2:
+                    enduser_1 = _c.sent();
+                    enduserId = enduser_1.id;
+                    return [4 /*yield*/, sdk.api.forms.createOne({ title: 'Beluga Manual Sync Form', belugaVisitType: 'sync' })];
+                case 3:
+                    belugaForm = _c.sent();
+                    belugaFormId = belugaForm.id;
+                    return [4 /*yield*/, sdk.api.forms.createOne({ title: 'Non-Beluga Manual Sync Form' })];
+                case 4:
+                    plainForm = _c.sent();
+                    plainFormId = plainForm.id;
+                    return [4 /*yield*/, sdk.api.form_fields.createOne({
+                            formId: plainForm.id, type: 'string', title: 'Field', previousFields: [{ type: 'root', info: {} }],
+                        })];
+                case 5:
+                    plainField_1 = _c.sent();
+                    submitForm = function (formId) { return __awaiter(void 0, void 0, void 0, function () {
+                        var _a, accessCode, response;
+                        return __generator(this, function (_b) {
+                            switch (_b.label) {
+                                case 0: return [4 /*yield*/, sdk.api.form_responses.prepare_form_response({ enduserId: enduser_1.id, formId: formId })];
+                                case 1:
+                                    _a = _b.sent(), accessCode = _a.accessCode, response = _a.response;
+                                    return [4 /*yield*/, sdk.api.form_responses.submit_form_response({
+                                            accessCode: accessCode,
+                                            responses: [{ fieldId: plainField_1.id, fieldTitle: 'Field', answer: { type: 'string', value: 'x' } }],
+                                        })];
+                                case 2:
+                                    _b.sent();
+                                    return [2 /*return*/, response.id];
+                            }
+                        });
+                    }); };
+                    createFileRecord = function (name) { return __awaiter(void 0, void 0, void 0, function () {
+                        var file;
+                        return __generator(this, function (_a) {
+                            switch (_a.label) {
+                                case 0: return [4 /*yield*/, sdk.api.files.prepare_file_upload({
+                                        name: name,
+                                        type: 'text/plain', size: 1, enduserId: enduser_1.id,
+                                    })];
+                                case 1:
+                                    file = (_a.sent()).file;
+                                    fileIds.push(file.id);
+                                    return [2 /*return*/, file];
+                            }
+                        });
+                    }); };
+                    return [4 /*yield*/, sdk.api.form_responses.prepare_form_response({ enduserId: enduser_1.id, formId: belugaForm.id })];
+                case 6:
+                    draft_1 = (_c.sent()).response;
+                    return [4 /*yield*/, (0, testing_1.async_test)("push_to_EHR(target=BELUGA) rejects an unsubmitted form response", function () { return sdk.api.form_responses.push_to_EHR({ id: draft_1.id, target: constants_1.BELUGA_TITLE }); }, { shouldError: true, onError: function (e) { return /has not been submitted/i.test(errorMessage(e)); } })
+                        // Submitted, but the form has no belugaVisitType → rejected as not configured
+                    ];
+                case 7:
+                    _c.sent();
+                    return [4 /*yield*/, submitForm(plainForm.id)];
+                case 8:
+                    plainResponseId_1 = _c.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)("push_to_EHR(target=BELUGA) rejects a form not configured for Beluga", function () { return sdk.api.form_responses.push_to_EHR({ id: plainResponseId_1, target: constants_1.BELUGA_TITLE }); }, { shouldError: true, onError: function (e) { return /not configured for Beluga/i.test(errorMessage(e)); } })
+                        // ──────────────────────────────────────────────────────────────────────────
+                        // 2. files.push(destination=BELUGA) guard — the endpoint resolves the destination
+                        //    integration first, so a Beluga integration must exist for the branch to be reached.
+                        //    Create a placeholder if the org has none; skip gracefully if that's not permitted.
+                        // ──────────────────────────────────────────────────────────────────────────
+                    ];
+                case 9:
+                    _c.sent();
+                    belugaIntegrationAvailable = false;
+                    _c.label = 10;
+                case 10:
+                    _c.trys.push([10, 12, , 13]);
+                    return [4 /*yield*/, sdk.api.integrations.load_redacted({})];
+                case 11:
+                    existing = _c.sent();
+                    belugaIntegrationAvailable = !!existing.integrations.find(function (i) { return i.title === constants_1.BELUGA_TITLE; });
+                    return [3 /*break*/, 13];
+                case 12:
+                    _b = _c.sent();
+                    return [3 /*break*/, 13];
+                case 13:
+                    if (!!belugaIntegrationAvailable) return [3 /*break*/, 17];
+                    _c.label = 14;
+                case 14:
+                    _c.trys.push([14, 16, , 17]);
+                    return [4 /*yield*/, sdk.api.integrations.createOne({
+                            title: constants_1.BELUGA_TITLE,
+                            authentication: {
+                                type: 'oauth2',
+                                info: { access_token: 'test-access-token', refresh_token: 'test-refresh-token', scope: '', token_type: 'Bearer', expiry_date: new Date().getTime() },
+                            },
+                        })];
+                case 15:
+                    created = _c.sent();
+                    createdBelugaIntegrationId = created.id;
+                    belugaIntegrationAvailable = true;
+                    return [3 /*break*/, 17];
+                case 16:
+                    e_1 = _c.sent();
+                    console.log("Could not create a Beluga integration for testing; skipping files.push guard:", errorMessage(e_1));
+                    return [3 /*break*/, 17];
+                case 17:
+                    if (!belugaIntegrationAvailable) return [3 /*break*/, 20];
+                    return [4 /*yield*/, createFileRecord('beluga-unlinked.txt')];
+                case 18:
+                    unlinkedFile_1 = _c.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)("files.push(destination=BELUGA) rejects a file with no associated form response", function () { return sdk.api.files.push({ id: unlinkedFile_1.id, destination: constants_1.BELUGA_TITLE }); }, { shouldError: true, onError: function (e) { return /not associated with a form response/i.test(errorMessage(e)); } })];
+                case 19:
+                    _c.sent();
+                    return [3 /*break*/, 21];
+                case 20:
+                    console.log("⏭️  Skipping files.push(destination=BELUGA) guard (no Beluga integration available)");
+                    _c.label = 21;
+                case 21: return [3 /*break*/, 35];
+                case 22:
+                    _i = 0, fileIds_1 = fileIds;
+                    _c.label = 23;
+                case 23:
+                    if (!(_i < fileIds_1.length)) return [3 /*break*/, 26];
+                    id = fileIds_1[_i];
+                    return [4 /*yield*/, sdk.api.files.deleteOne(id).catch(console.error)];
+                case 24:
+                    _c.sent();
+                    _c.label = 25;
+                case 25:
+                    _i++;
+                    return [3 /*break*/, 23];
+                case 26:
+                    if (!belugaFormId) return [3 /*break*/, 28];
+                    return [4 /*yield*/, sdk.api.forms.deleteOne(belugaFormId).catch(console.error)];
+                case 27:
+                    _c.sent();
+                    _c.label = 28;
+                case 28:
+                    if (!plainFormId) return [3 /*break*/, 30];
+                    return [4 /*yield*/, sdk.api.forms.deleteOne(plainFormId).catch(console.error)];
+                case 29:
+                    _c.sent();
+                    _c.label = 30;
+                case 30:
+                    if (!enduserId) return [3 /*break*/, 32];
+                    return [4 /*yield*/, sdk.api.endusers.deleteOne(enduserId).catch(console.error)];
+                case 31:
+                    _c.sent();
+                    _c.label = 32;
+                case 32:
+                    if (!createdBelugaIntegrationId) return [3 /*break*/, 34];
+                    return [4 /*yield*/, sdk.api.integrations.deleteOne(createdBelugaIntegrationId).catch(console.error)];
+                case 33:
+                    _c.sent();
+                    _c.label = 34;
+                case 34: return [7 /*endfinally*/];
+                case 35: return [2 /*return*/];
+            }
+        });
+    });
+};
+exports.beluga_manual_sync_tests = beluga_manual_sync_tests;
+if (require.main === module) {
+    console.log("Using API URL: ".concat(host));
+    var sdk_2 = new sdk_1.Session({ host: host });
+    var sdkNonAdmin_1 = new sdk_1.Session({ host: host });
+    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, (0, setup_1.setup_tests)(sdk_2, sdkNonAdmin_1)];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, (0, exports.beluga_manual_sync_tests)({ sdk: sdk_2, sdkNonAdmin: sdkNonAdmin_1 })];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); };
+    runTests()
+        .then(function () {
+        console.log("✅ Beluga manual sync test suite completed successfully");
+        process.exit(0);
+    })
+        .catch(function (error) {
+        console.error("❌ Beluga manual sync test suite failed:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=beluga_manual_sync.test.js.map

package/lib/cjs/tests/api_tests/beluga_manual_sync.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"beluga_manual_sync.test.js","sourceRoot":"","sources":["../../../../src/tests/api_tests/beluga_manual_sync.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,iCAAmC;AACnC,+CAG4B;AAC5B,kCAAsC;AACtC,mDAAoD;AAEpD,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE,oDAAoD;AACpD,8DAA8D;AAC9D,mDAAmD;AACnD,EAAE;AACF,6FAA6F;AAC7F,iGAAiG;AACjG,kGAAkG;AAClG,uDAAuD;AAChD,IAAM,wBAAwB,GAAG,UAAO,EAA4D;QAA1D,GAAG,SAAA,EAAE,WAAW,iBAAA;;;;;;oBAC/D,IAAA,oBAAU,EAAC,wDAAwD,CAAC,CAAA;oBAE9D,YAAY,GAAG,UAAC,CAAM,YAAK,OAAA,CAAC,CAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,MAAI,MAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,QAAQ,iDAAI,CAAA,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAW,CAAA,EAAA,CAAA;oBAKzF,OAAO,GAAa,EAAE,CAAA;;;;oBAIV,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;4BAC/C,KAAK,EAAE,aAAa;4BACpB,KAAK,EAAE,6BAAsB,IAAI,CAAC,GAAG,EAAE,yBAAsB;yBAC9D,CAAC,EAAA;;oBAHI,YAAU,SAGd;oBACF,SAAS,GAAG,SAAO,CAAC,EAAE,CAAA;oBAGH,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC,EAAA;;oBAAzG,UAAU,GAAG,SAA4F;oBAC/G,YAAY,GAAG,UAAU,CAAC,EAAE,CAAA;oBAEV,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,EAAA;;oBAAnF,SAAS,GAAG,SAAuE;oBACzF,WAAW,GAAG,SAAS,CAAC,EAAE,CAAA;oBAEP,qBAAM,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC;4BACrD,MAAM,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;yBACnG,CAAC,EAAA;;oBAFI,eAAa,SAEjB;oBAEI,UAAU,GAAG,UAAO,MAAc;;;;wCACL,qBAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,SAAO,CAAC,EAAE,EAAE,MAAM,QAAA,EAAE,CAAC,EAAA;;oCAAhH,KAA2B,SAAqF,EAA9G,UAAU,gBAAA,EAAE,QAAQ,cAAA;oCAC5B,qBAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,oBAAoB,CAAC;4CAChD,UAAU,YAAA;4CACV,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,YAAU,CAAC,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;yCACrG,CAAC,EAAA;;oCAHF,SAGE,CAAA;oCACF,sBAAO,QAAQ,CAAC,EAAE,EAAA;;;yBACnB,CAAA;oBAKK,gBAAgB,GAAG,UAAO,IAAY;;;;wCACzB,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC;wCACvD,IAAI,MAAA;wCAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,SAAO,CAAC,EAAE;qCACzD,CAAC,EAAA;;oCAFM,IAAI,GAAK,CAAA,SAEf,CAAA,KAFU;oCAGZ,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;oCACrB,sBAAO,IAAI,EAAA;;;yBACZ,CAAA;oBAO2B,qBAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,SAAO,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,EAAA;;oBAAxH,UAAoB,CAAA,SAAoG,CAAA,SAAzG;oBACvB,qBAAM,IAAA,oBAAU,EACd,iEAAiE,EACjE,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,OAAK,CAAC,EAAE,EAAE,MAAM,EAAE,wBAAY,EAAE,CAAC,EAA1E,CAA0E,EAChF,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,UAAC,CAAM,IAAK,OAAA,yBAAyB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAA/C,CAA+C,EAAE,CAC5F;wBAED,8EAA8E;sBAF7E;;oBAJD,SAIC,CAAA;oBAGuB,qBAAM,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,EAAA;;oBAAhD,oBAAkB,SAA8B;oBACtD,qBAAM,IAAA,oBAAU,EACd,qEAAqE,EACrE,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,iBAAe,EAAE,MAAM,EAAE,wBAAY,EAAE,CAAC,EAAjF,CAAiF,EACvF,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,UAAC,CAAM,IAAK,OAAA,4BAA4B,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAlD,CAAkD,EAAE,CAC/F;wBAED,6EAA6E;wBAC7E,kFAAkF;wBAClF,yFAAyF;wBACzF,wFAAwF;wBACxF,6EAA6E;sBAN5E;;oBAJD,SAIC,CAAA;oBAQG,0BAA0B,GAAG,KAAK,CAAA;;;;oBAEnB,qBAAM,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC,EAAE,CAAC,EAAA;;oBAAvD,QAAQ,GAAG,SAA4C;oBAC7D,0BAA0B,GAAG,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,UAAC,CAAM,IAAK,OAAA,CAAC,CAAC,KAAK,KAAK,wBAAY,EAAxB,CAAwB,CAAC,CAAA;;;;;;yBAG7F,CAAC,0BAA0B,EAA3B,yBAA2B;;;;oBAEX,qBAAM,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC;4BACnD,KAAK,EAAE,wBAAY;4BACnB,cAAc,EAAE;gCACd,IAAI,EAAE,QAAQ;gCACd,IAAI,EAAE,EAAE,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,oBAAoB,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE;6BACrJ;yBACF,CAAC,EAAA;;oBANI,OAAO,GAAG,SAMd;oBACF,0BAA0B,GAAG,OAAO,CAAC,EAAE,CAAA;oBACvC,0BAA0B,GAAG,IAAI,CAAA;;;;oBAEjC,OAAO,CAAC,GAAG,CAAC,+EAA+E,EAAE,YAAY,CAAC,GAAC,CAAC,CAAC,CAAA;;;yBAI7G,0BAA0B,EAA1B,yBAA0B;oBAEP,qBAAM,gBAAgB,CAAC,qBAAqB,CAAC,EAAA;;oBAA5D,iBAAe,SAA6C;oBAClE,qBAAM,IAAA,oBAAU,EACd,gFAAgF,EAChF,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,cAAY,CAAC,EAAE,EAAE,WAAW,EAAE,wBAAY,EAAE,CAAC,EAAtE,CAAsE,EAC5E,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,UAAC,CAAM,IAAK,OAAA,sCAAsC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAA5D,CAA4D,EAAE,CACzG,EAAA;;oBAJD,SAIC,CAAA;;;oBAED,OAAO,CAAC,GAAG,CAAC,qFAAqF,CAAC,CAAA;;;;0BAG5E,EAAP,mBAAO;;;yBAAP,CAAA,qBAAO,CAAA;oBAAb,EAAE;oBACX,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAA;;oBAAtD,SAAsD,CAAA;;;oBADvC,IAAO,CAAA;;;yBAGpB,YAAY,EAAZ,yBAAY;oBAAE,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAA;;oBAAhE,SAAgE,CAAA;;;yBAC9E,WAAW,EAAX,yBAAW;oBAAE,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAA;;oBAA/D,SAA+D,CAAA;;;yBAC5E,SAAS,EAAT,yBAAS;oBAAE,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAA;;oBAAhE,SAAgE,CAAA;;;yBAC3E,0BAA0B,EAA1B,yBAA0B;oBAAE,qBAAM,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAA;;oBAArF,SAAqF,CAAA;;;;;;;CAExH,CAAA;AArHY,QAAA,wBAAwB,4BAqHpC;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,yBAAkB,IAAI,CAAE,CAAC,CAAA;IACrC,IAAM,KAAG,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACjC,IAAM,aAAW,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IAEzC,IAAM,QAAQ,GAAG;;;wBACf,qBAAM,IAAA,mBAAW,EAAC,KAAG,EAAE,aAAW,CAAC,EAAA;;oBAAnC,SAAmC,CAAA;oBACnC,qBAAM,IAAA,gCAAwB,EAAC,EAAE,GAAG,OAAA,EAAE,WAAW,eAAA,EAAE,CAAC,EAAA;;oBAApD,SAAoD,CAAA;;;;SACrD,CAAA;IAED,QAAQ,EAAE;SACP,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAA;QACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAA;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}

package/lib/cjs/tests/api_tests/gcal_sync_retry.test.d.ts

@@ -0,0 +1,43 @@
+import { Session } from "../../sdk";
+/**
+ * Google Calendar sync retry — integration coverage.
+ *
+ * ┌─ ARCHITECTURE NOTE (why the full mock-Google scenarios are gated) ──────────┐
+ * │ SDK api_tests run in a SEPARATE process from the API server (they talk to    │
+ * │ host = API_URL / http://localhost:8080). The retry scheduler, the Google     │
+ * │ retryable-error predicates, and the google.calendar() client all live in the │
+ * │ API SERVER process. A stub installed here (in the SDK test process) cannot   │
+ * │ replace the server's in-process google client, so we cannot deterministically│
+ * │ inject 429 / 500 / ECONNRESET responses from this test alone.                │
+ * │                                                                              │
+ * │ Two ways to run the full fail-429-then-succeed / exhaustion / cap scenarios: │
+ * │  1. Run the API server with NODE_ENV=test and RETRY_SCHEDULER_DELAYS_MS=10,20 │
+ * │     (already honored by the singleton constructor) plus a server-side        │
+ * │     fault-injection hook on sdk.events.* that reads e.g.                      │
+ * │     process.env.GCAL_TEST_FORCE_ERROR — that hook does not exist yet.         │
+ * │  2. Drive the scheduler directly with the in-process unit tests, which DO     │
+ * │     cover all retry mechanics deterministically:                             │
+ * │       packages/private/api/api/modules/retry_scheduler.test.ts               │
+ * │       packages/private/api/api/integrations/google.test.ts                   │
+ * │                                                                              │
+ * │ The scenario matrix below is recorded for when a server-side hook is added.  │
+ * └──────────────────────────────────────────────────────────────────────────────┘
+ *
+ * Scenario matrix (requires server-side Google fault injection — see note):
+ *   1. create retry:   fail 429 once then succeed -> gcal reference written, NO background_errors
+ *   2. exhaustion:     fail 429 on every call -> exactly one "Google Calendar Push Error" background_errors row
+ *   3. non-retryable:  fail 403 -> background_errors written immediately, no retries
+ *   4. create idempotency: fail ECONNRESET (network) -> NON-retryable for create (duplicate risk),
+ *                          background_errors written, no retry, no duplicate insert
+ *   5. update + delete: same as (1) for events.patch and events.delete
+ *   6. cap exceeded:   maxOpenRetries=2, 3 events all fail retryably -> 3rd -> background_errors immediately
+ *
+ * The runnable assertions below cover what IS observable end-to-end without a
+ * connected Google account: the refactored call sites must not regress the common
+ * "user has no Google integration" path (no sync attempt, no background_errors, no retry).
+ */
+export declare const gcal_sync_retry_tests: ({ sdk }: {
+    sdk: Session;
+    sdkNonAdmin: Session;
+}) => Promise<void>;
+//# sourceMappingURL=gcal_sync_retry.test.d.ts.map

package/lib/cjs/tests/api_tests/gcal_sync_retry.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcal_sync_retry.test.d.ts","sourceRoot":"","sources":["../../../../src/tests/api_tests/gcal_sync_retry.test.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAUnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,eAAO,MAAM,qBAAqB;SAA2B,OAAO;iBAAe,OAAO;mBAwCzF,CAAA"}

package/lib/cjs/tests/api_tests/gcal_sync_retry.test.js

@@ -0,0 +1,168 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.gcal_sync_retry_tests = void 0;
+require('source-map-support').install();
+var sdk_1 = require("../../sdk");
+var testing_1 = require("@tellescope/testing");
+var setup_1 = require("../setup");
+var host = process.env.API_URL || 'http://localhost:8080';
+/**
+ * Google Calendar sync retry — integration coverage.
+ *
+ * ┌─ ARCHITECTURE NOTE (why the full mock-Google scenarios are gated) ──────────┐
+ * │ SDK api_tests run in a SEPARATE process from the API server (they talk to    │
+ * │ host = API_URL / http://localhost:8080). The retry scheduler, the Google     │
+ * │ retryable-error predicates, and the google.calendar() client all live in the │
+ * │ API SERVER process. A stub installed here (in the SDK test process) cannot   │
+ * │ replace the server's in-process google client, so we cannot deterministically│
+ * │ inject 429 / 500 / ECONNRESET responses from this test alone.                │
+ * │                                                                              │
+ * │ Two ways to run the full fail-429-then-succeed / exhaustion / cap scenarios: │
+ * │  1. Run the API server with NODE_ENV=test and RETRY_SCHEDULER_DELAYS_MS=10,20 │
+ * │     (already honored by the singleton constructor) plus a server-side        │
+ * │     fault-injection hook on sdk.events.* that reads e.g.                      │
+ * │     process.env.GCAL_TEST_FORCE_ERROR — that hook does not exist yet.         │
+ * │  2. Drive the scheduler directly with the in-process unit tests, which DO     │
+ * │     cover all retry mechanics deterministically:                             │
+ * │       packages/private/api/api/modules/retry_scheduler.test.ts               │
+ * │       packages/private/api/api/integrations/google.test.ts                   │
+ * │                                                                              │
+ * │ The scenario matrix below is recorded for when a server-side hook is added.  │
+ * └──────────────────────────────────────────────────────────────────────────────┘
+ *
+ * Scenario matrix (requires server-side Google fault injection — see note):
+ *   1. create retry:   fail 429 once then succeed -> gcal reference written, NO background_errors
+ *   2. exhaustion:     fail 429 on every call -> exactly one "Google Calendar Push Error" background_errors row
+ *   3. non-retryable:  fail 403 -> background_errors written immediately, no retries
+ *   4. create idempotency: fail ECONNRESET (network) -> NON-retryable for create (duplicate risk),
+ *                          background_errors written, no retry, no duplicate insert
+ *   5. update + delete: same as (1) for events.patch and events.delete
+ *   6. cap exceeded:   maxOpenRetries=2, 3 events all fail retryably -> 3rd -> background_errors immediately
+ *
+ * The runnable assertions below cover what IS observable end-to-end without a
+ * connected Google account: the refactored call sites must not regress the common
+ * "user has no Google integration" path (no sync attempt, no background_errors, no retry).
+ */
+var gcal_sync_retry_tests = function (_a) {
+    var sdk = _a.sdk;
+    return __awaiter(void 0, void 0, void 0, function () {
+        var enduser;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    (0, testing_1.log_header)("Google Calendar Sync Retry");
+                    if (process.env.GCAL_RETRY_INTEGRATION !== '1') {
+                        console.log("ℹ️  Skipping mock-Google scenarios (set GCAL_RETRY_INTEGRATION=1 with a server-side "
+                            + "fault-injection hook to run scenarios 1-6). Running no-integration regression checks only.");
+                    }
+                    return [4 /*yield*/, sdk.api.endusers.createOne({ fname: 'GcalRetry', lname: 'Test' })];
+                case 1:
+                    enduser = _b.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)('create event for user without Google integration does not produce a background error', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var event, errors;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0: return [4 /*yield*/, sdk.api.calendar_events.createOne({
+                                            title: 'Gcal Retry Regression',
+                                            startTimeInMS: Date.now() + 1000 * 60 * 60,
+                                            durationInMinutes: 30,
+                                            attendees: [{ type: 'user', id: sdk.userInfo.id }, { type: 'enduser', id: enduser.id }],
+                                        })
+                                        // give side-effect handlers a moment to run
+                                    ];
+                                    case 1:
+                                        event = _a.sent();
+                                        // give side-effect handlers a moment to run
+                                        return [4 /*yield*/, (0, testing_1.wait)(undefined, 750)];
+                                    case 2:
+                                        // give side-effect handlers a moment to run
+                                        _a.sent();
+                                        return [4 /*yield*/, sdk.api.background_errors.getSome({}).catch(function () { return []; })
+                                            // clean up
+                                        ];
+                                    case 3:
+                                        errors = _a.sent();
+                                        // clean up
+                                        return [4 /*yield*/, sdk.api.calendar_events.deleteOne(event.id).catch(function () { })
+                                            // No Google integration on the test user => no push attempt => no error row.
+                                        ];
+                                    case 4:
+                                        // clean up
+                                        _a.sent();
+                                        // No Google integration on the test user => no push attempt => no error row.
+                                        return [2 /*return*/, errors.filter(function (e) { return (e.userId === sdk.userInfo.id && e.title === "Google Calendar Push Error"); }).length];
+                                }
+                            });
+                        }); }, { onResult: function (count) { return count === 0; } })
+                        // cleanup
+                    ];
+                case 2:
+                    _b.sent();
+                    // cleanup
+                    return [4 /*yield*/, sdk.api.endusers.deleteOne(enduser.id).catch(function () { })];
+                case 3:
+                    // cleanup
+                    _b.sent();
+                    return [2 /*return*/];
+            }
+        });
+    });
+};
+exports.gcal_sync_retry_tests = gcal_sync_retry_tests;
+if (require.main === module) {
+    var sdk_2 = new sdk_1.Session({ host: host });
+    var sdkNonAdmin_1 = new sdk_1.Session({ host: host });
+    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, (0, setup_1.setup_tests)(sdk_2, sdkNonAdmin_1)];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, (0, exports.gcal_sync_retry_tests)({ sdk: sdk_2, sdkNonAdmin: sdkNonAdmin_1 })];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); };
+    runTests()
+        .then(function () { console.log("✅ gcal sync retry test suite completed successfully"); process.exit(0); })
+        .catch(function (error) { console.error("❌ gcal sync retry test suite failed:", error); process.exit(1); });
+}
+//# sourceMappingURL=gcal_sync_retry.test.js.map

package/lib/cjs/tests/api_tests/gcal_sync_retry.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcal_sync_retry.test.js","sourceRoot":"","sources":["../../../../src/tests/api_tests/gcal_sync_retry.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,iCAAmC;AACnC,+CAI4B;AAC5B,kCAAsC;AAEtC,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACI,IAAM,qBAAqB,GAAG,UAAO,EAAgD;QAA9C,GAAG,SAAA;;;;;;oBAC/C,IAAA,oBAAU,EAAC,4BAA4B,CAAC,CAAA;oBAExC,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,GAAG,EAAE;wBAC9C,OAAO,CAAC,GAAG,CAAC,sFAAsF;8BAC9F,4FAA4F,CAAC,CAAA;qBAClG;oBAIe,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAA;;oBAAjF,OAAO,GAAG,SAAuE;oBAEvF,qBAAM,IAAA,oBAAU,EACd,sFAAsF,EACtF;;;;4CACgB,qBAAM,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC;4CACpD,KAAK,EAAE,uBAAuB;4CAC9B,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE;4CAC1C,iBAAiB,EAAE,EAAE;4CACrB,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;yCACxF,CAAC;wCAEF,4CAA4C;sCAF1C;;wCALI,KAAK,GAAG,SAKZ;wCAEF,4CAA4C;wCAC5C,qBAAM,IAAA,cAAI,EAAC,SAAS,EAAE,GAAG,CAAC,EAAA;;wCAD1B,4CAA4C;wCAC5C,SAA0B,CAAA;wCAEX,qBAAM,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,cAAM,OAAA,EAAE,EAAF,CAAE,CAAC;4CAE1E,WAAW;0CAF+D;;wCAApE,MAAM,GAAG,SAA2D;wCAE1E,WAAW;wCACX,qBAAM,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,cAAO,CAAC,CAAC;4CAEjE,6EAA6E;0CAFZ;;wCADjE,WAAW;wCACX,SAAiE,CAAA;wCAEjE,6EAA6E;wCAC7E,sBAAO,MAAM,CAAC,MAAM,CAAC,UAAC,CAAM,IAAK,OAAA,CAC/B,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,4BAA4B,CACzE,EAFgC,CAEhC,CAAC,CAAC,MAAM,EAAA;;;6BACV,EACD,EAAE,QAAQ,EAAE,UAAC,KAAK,IAAK,OAAA,KAAK,KAAK,CAAC,EAAX,CAAW,EAAE,CACrC;wBAED,UAAU;sBAFT;;oBAxBD,SAwBC,CAAA;oBAED,UAAU;oBACV,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,cAAO,CAAC,CAAC,EAAA;;oBAD5D,UAAU;oBACV,SAA4D,CAAA;;;;;CAC7D,CAAA;AAxCY,QAAA,qBAAqB,yBAwCjC;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,IAAM,KAAG,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACjC,IAAM,aAAW,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IAEzC,IAAM,QAAQ,GAAG;;;wBACf,qBAAM,IAAA,mBAAW,EAAC,KAAG,EAAE,aAAW,CAAC,EAAA;;oBAAnC,SAAmC,CAAA;oBACnC,qBAAM,IAAA,6BAAqB,EAAC,EAAE,GAAG,OAAA,EAAE,WAAW,eAAA,EAAE,CAAC,EAAA;;oBAAjD,SAAiD,CAAA;;;;SAClD,CAAA;IAED,QAAQ,EAAE;SACP,IAAI,CAAC,cAAQ,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC;SACnG,KAAK,CAAC,UAAC,KAAK,IAAO,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;CACvG"}

package/lib/cjs/tests/api_tests/security/F-0106-F-0110-enduser-write-restrictions.test.d.ts

@@ -0,0 +1,23 @@
+import { Session } from "../../../sdk";
+/**
+ * Regression test for F-0106 and F-0110
+ * (security-audit/findings/F-0106-enduser-self-update-admin-only-fields.md,
+ *  security-audit/findings/F-0110-form-responses-enduser-update-admin-only-fields.md).
+ *
+ * Endusers could PATCH admin-only / access-bearing / attribution-bearing fields on
+ * their own endusers record (assignedTo, tags, references, ...) and their own
+ * form_responses (procedureCodes, submittedBy, markedAsSubmitted, ...). The fix adds
+ * the `enduserUpdatesDisabled` field option (schema.ts ModelFieldInfo), enforced for
+ * enduser sessions in the generic update handler (routing.ts createDefaultEndpoints).
+ *
+ * This test asserts, for every flagged field on both models:
+ *   - an enduser session updating its OWN record gets a 400 "<field> cannot be updated by endusers"
+ *   - nothing persists (spot-checked on assignedTo, the highest-impact field)
+ *   - enduser self-updates of allowed fields still work (fname, hideFromEnduserPortal)
+ *   - staff sessions can still update the restricted fields
+ */
+export declare const enduser_write_restrictions_tests: ({ sdk }: {
+    sdk: Session;
+    sdkNonAdmin: Session;
+}) => Promise<void>;
+//# sourceMappingURL=F-0106-F-0110-enduser-write-restrictions.test.d.ts.map

package/lib/cjs/tests/api_tests/security/F-0106-F-0110-enduser-write-restrictions.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"F-0106-F-0110-enduser-write-restrictions.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/F-0106-F-0110-enduser-write-restrictions.test.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAkB,MAAM,cAAc,CAAA;AA+DtD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,gCAAgC;SAA2B,OAAO;iBAAe,OAAO;mBA6GpG,CAAA"}