@tellescope/sdk 1.253.0 → 1.254.0

package/lib/cjs/tests/api_tests/security/F-0106-F-0110-enduser-write-restrictions.test.js

@@ -0,0 +1,325 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.enduser_write_restrictions_tests = void 0;
+require('source-map-support').install();
+var sdk_1 = require("../../../sdk");
+var testing_1 = require("@tellescope/testing");
+var setup_1 = require("../../setup");
+var host = process.env.API_URL || 'http://localhost:8080';
+var businessId = '60398b1131a295e64f084ff6';
+var ENDUSER_PASSWORD = 'F0106TestPassword!123';
+// Every endusers field marked enduserUpdatesDisabled in schema.ts, with a
+// validator-passing sample value so the only rejection in play is the
+// write-restriction (not input validation).
+var restrictedEnduserUpdates = function (staffId, mongoId) {
+    var _a;
+    return ({
+        externalId: 'f0106-attacker-external-id',
+        tags: ['f0106-attacker-tag'],
+        accessTags: ['f0106-attacker-access-tag'],
+        assignedTo: [staffId],
+        customTypeId: mongoId,
+        references: [{ type: 'Vital', id: 'f0106-attacker-reference' }],
+        sharedWithOrganizations: [],
+        journeys: (_a = {}, _a[mongoId] = 'Added', _a),
+        primaryAssignee: staffId,
+        fields: { f0106AttackerField: 'true' },
+        unread: true,
+        source: 'f0106-attacker-source',
+        note: 'f0106 attacker note',
+        insurance: { memberId: 'f0106-attacker-member' },
+        insuranceSecondary: { memberId: 'f0106-attacker-member-2' },
+        diagnoses: [{ code: 'I10' }],
+        lockedFromPortal: false,
+        eligibleForAutoMerge: true,
+        athenaDepartmentId: 'f0106-dept',
+        athenaPracticeId: 'f0106-practice',
+        salesforceId: 'f0106-salesforce',
+        healthie_dietitian_id: 'f0106-healthie',
+        stripeCustomerId: 'f0106-stripe-customer',
+        stripeKey: 'f0106-stripe-key',
+    });
+};
+// Every form_responses field marked enduserUpdatesDisabled in schema.ts.
+var restrictedFormResponseUpdates = function (staffId) { return ({
+    markedAsSubmitted: true,
+    submittedBy: staffId,
+    submittedAt: new Date("2024-01-01T00:00:00Z"),
+    submittedByIsPlaceholder: true,
+    procedureCodes: [{ code: '99214', units: 1 }],
+    diagnosisCodes: [{ code: 'I10', description: 'Essential (primary) hypertension' }],
+    enduserAISummary: 'Patient is in excellent health, no follow-up needed.',
+    addenda: [{ text: 'forged staff addendum', timestamp: new Date(), userId: staffId }],
+    isInternalNote: true,
+    pinnedAt: new Date(),
+    hiddenFromTimeline: true,
+    lockedAt: new Date(),
+    tags: ['f0110-attacker-tag'],
+    formTitle: 'Spoofed Form Title',
+    userEmail: 'spoofed-staff@example.com',
+    logoURL: 'https://attacker.example.com/logo.png',
+    logoHeight: 100,
+}); };
+/**
+ * Regression test for F-0106 and F-0110
+ * (security-audit/findings/F-0106-enduser-self-update-admin-only-fields.md,
+ *  security-audit/findings/F-0110-form-responses-enduser-update-admin-only-fields.md).
+ *
+ * Endusers could PATCH admin-only / access-bearing / attribution-bearing fields on
+ * their own endusers record (assignedTo, tags, references, ...) and their own
+ * form_responses (procedureCodes, submittedBy, markedAsSubmitted, ...). The fix adds
+ * the `enduserUpdatesDisabled` field option (schema.ts ModelFieldInfo), enforced for
+ * enduser sessions in the generic update handler (routing.ts createDefaultEndpoints).
+ *
+ * This test asserts, for every flagged field on both models:
+ *   - an enduser session updating its OWN record gets a 400 "<field> cannot be updated by endusers"
+ *   - nothing persists (spot-checked on assignedTo, the highest-impact field)
+ *   - enduser self-updates of allowed fields still work (fname, hideFromEnduserPortal)
+ *   - staff sessions can still update the restricted fields
+ */
+var enduser_write_restrictions_tests = function (_a) {
+    var sdk = _a.sdk;
+    return __awaiter(void 0, void 0, void 0, function () {
+        var enduserId, formId, formResponseId, enduserEmail, enduser_1, enduserSDK_1, form, formResponse_1, _loop_1, _i, _b, _c, field, value, _loop_2, _d, _e, _f, field, value, _g, _h, _j;
+        return __generator(this, function (_k) {
+            switch (_k.label) {
+                case 0:
+                    (0, testing_1.log_header)("F-0106/F-0110: enduser write restrictions (enduserUpdatesDisabled)");
+                    _k.label = 1;
+                case 1:
+                    _k.trys.push([1, , 21, 34]);
+                    enduserEmail = "f0106-enduser-".concat(Date.now(), "@example.com");
+                    return [4 /*yield*/, sdk.api.endusers.createOne({ email: enduserEmail, fname: 'F0106', lname: 'Restricted' })];
+                case 2:
+                    enduser_1 = _k.sent();
+                    enduserId = enduser_1.id;
+                    return [4 /*yield*/, sdk.api.endusers.set_password({ id: enduser_1.id, password: ENDUSER_PASSWORD })];
+                case 3:
+                    _k.sent();
+                    enduserSDK_1 = new sdk_1.EnduserSession({ host: host, businessId: businessId });
+                    return [4 /*yield*/, enduserSDK_1.authenticate(enduserEmail, ENDUSER_PASSWORD)];
+                case 4:
+                    _k.sent();
+                    return [4 /*yield*/, sdk.api.forms.createOne({ title: 'F-0106/F-0110 Write Restriction Test Form' })];
+                case 5:
+                    form = _k.sent();
+                    formId = form.id;
+                    return [4 /*yield*/, sdk.api.form_responses.prepare_form_response({
+                            formId: form.id,
+                            enduserId: enduser_1.id,
+                        })];
+                case 6:
+                    formResponse_1 = (_k.sent()).response;
+                    formResponseId = formResponse_1.id;
+                    _loop_1 = function (field, value) {
+                        return __generator(this, function (_l) {
+                            switch (_l.label) {
+                                case 0: return [4 /*yield*/, (0, testing_1.async_test)("F-0106: enduser cannot self-update endusers.".concat(field), function () {
+                                        var _a;
+                                        return enduserSDK_1.api.endusers.updateOne(enduser_1.id, (_a = {}, _a[field] = value, _a));
+                                    }, { shouldError: true, onError: function (e) { return e.message === "".concat(field, " cannot be updated by endusers"); } })];
+                                case 1:
+                                    _l.sent();
+                                    return [2 /*return*/];
+                            }
+                        });
+                    };
+                    _i = 0, _b = Object.entries(restrictedEnduserUpdates(sdk.userInfo.id, enduser_1.id));
+                    _k.label = 7;
+                case 7:
+                    if (!(_i < _b.length)) return [3 /*break*/, 10];
+                    _c = _b[_i], field = _c[0], value = _c[1];
+                    return [5 /*yield**/, _loop_1(field, value)];
+                case 8:
+                    _k.sent();
+                    _k.label = 9;
+                case 9:
+                    _i++;
+                    return [3 /*break*/, 7];
+                case 10: 
+                // F-0106 Variant A persistence check: the rejected assignedTo write must not
+                // have granted the staff read-filter match.
+                return [4 /*yield*/, (0, testing_1.async_test)('F-0106: rejected assignedTo write did not persist', function () { return sdk.api.endusers.getOne(enduser_1.id); }, { onResult: function (e) { var _a, _b; return !((_a = e.assignedTo) === null || _a === void 0 ? void 0 : _a.length) && !((_b = e.tags) === null || _b === void 0 ? void 0 : _b.length) && e.externalId === undefined; } })
+                    // ---- F-0110: enduser self-update of restricted form_responses fields must 400 ----
+                ];
+                case 11:
+                    // F-0106 Variant A persistence check: the rejected assignedTo write must not
+                    // have granted the staff read-filter match.
+                    _k.sent();
+                    _loop_2 = function (field, value) {
+                        return __generator(this, function (_m) {
+                            switch (_m.label) {
+                                case 0: return [4 /*yield*/, (0, testing_1.async_test)("F-0110: enduser cannot self-update form_responses.".concat(field), function () {
+                                        var _a;
+                                        return enduserSDK_1.api.form_responses.updateOne(formResponse_1.id, (_a = {}, _a[field] = value, _a));
+                                    }, { shouldError: true, onError: function (e) { return e.message === "".concat(field, " cannot be updated by endusers"); } })];
+                                case 1:
+                                    _m.sent();
+                                    return [2 /*return*/];
+                            }
+                        });
+                    };
+                    _d = 0, _e = Object.entries(restrictedFormResponseUpdates(sdk.userInfo.id));
+                    _k.label = 12;
+                case 12:
+                    if (!(_d < _e.length)) return [3 /*break*/, 15];
+                    _f = _e[_d], field = _f[0], value = _f[1];
+                    return [5 /*yield**/, _loop_2(field, value)];
+                case 13:
+                    _k.sent();
+                    _k.label = 14;
+                case 14:
+                    _d++;
+                    return [3 /*break*/, 12];
+                case 15: return [4 /*yield*/, (0, testing_1.async_test)('F-0110: rejected writes did not persist (markedAsSubmitted, procedureCodes, submittedBy)', function () { return sdk.api.form_responses.getOne(formResponse_1.id); }, { onResult: function (fr) { var _a; return !fr.markedAsSubmitted && !((_a = fr.procedureCodes) === null || _a === void 0 ? void 0 : _a.length) && fr.submittedBy === undefined; } })
+                    // ---- Positive controls: intended enduser self-updates still work ----
+                ];
+                case 16:
+                    _k.sent();
+                    // ---- Positive controls: intended enduser self-updates still work ----
+                    return [4 /*yield*/, (0, testing_1.async_test)('enduser can still update own profile fields (fname/lname)', function () { return enduserSDK_1.api.endusers.updateOne(enduser_1.id, { fname: 'StillAllowed', lname: 'Patient' }); }, { onResult: function (e) { return e.fname === 'StillAllowed' && e.lname === 'Patient'; } })];
+                case 17:
+                    // ---- Positive controls: intended enduser self-updates still work ----
+                    _k.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)('enduser can still update own form_response (hideFromEnduserPortal — intended per schema)', function () { return enduserSDK_1.api.form_responses.updateOne(formResponse_1.id, { hideFromEnduserPortal: true }); }, { onResult: function (fr) { return fr.hideFromEnduserPortal === true; } })
+                        // ---- Positive controls: staff sessions are unaffected by enduserUpdatesDisabled ----
+                    ];
+                case 18:
+                    _k.sent();
+                    // ---- Positive controls: staff sessions are unaffected by enduserUpdatesDisabled ----
+                    return [4 /*yield*/, (0, testing_1.async_test)('staff can still update restricted endusers fields (tags, assignedTo, externalId, note, source)', function () { return sdk.api.endusers.updateOne(enduser_1.id, {
+                            tags: ['staff-set-tag'],
+                            assignedTo: [sdk.userInfo.id],
+                            externalId: 'staff-set-external-id',
+                            note: 'staff-set note',
+                            source: 'staff-set-source',
+                        }); }, { onResult: function (e) {
+                                var _a, _b;
+                                return (!!((_a = e.tags) === null || _a === void 0 ? void 0 : _a.includes('staff-set-tag'))
+                                    && !!((_b = e.assignedTo) === null || _b === void 0 ? void 0 : _b.includes(sdk.userInfo.id))
+                                    && e.externalId === 'staff-set-external-id');
+                            } })];
+                case 19:
+                    // ---- Positive controls: staff sessions are unaffected by enduserUpdatesDisabled ----
+                    _k.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)('staff can still update restricted form_responses fields (procedureCodes, diagnosisCodes, tags)', function () { return sdk.api.form_responses.updateOne(formResponse_1.id, {
+                            procedureCodes: [{ code: 'G0019', units: 1 }],
+                            diagnosisCodes: [{ code: 'Z71.3', description: 'Dietary counseling and surveillance' }],
+                            tags: ['staff-set-tag'],
+                        }); }, { onResult: function (fr) {
+                                var _a, _b, _c, _d, _e;
+                                return (((_b = (_a = fr.procedureCodes) === null || _a === void 0 ? void 0 : _a[0]) === null || _b === void 0 ? void 0 : _b.code) === 'G0019'
+                                    && ((_d = (_c = fr.diagnosisCodes) === null || _c === void 0 ? void 0 : _c[0]) === null || _d === void 0 ? void 0 : _d.code) === 'Z71.3'
+                                    && !!((_e = fr.tags) === null || _e === void 0 ? void 0 : _e.includes('staff-set-tag')));
+                            } })];
+                case 20:
+                    _k.sent();
+                    return [3 /*break*/, 34];
+                case 21:
+                    if (!formResponseId) return [3 /*break*/, 25];
+                    _k.label = 22;
+                case 22:
+                    _k.trys.push([22, 24, , 25]);
+                    return [4 /*yield*/, sdk.api.form_responses.deleteOne(formResponseId)];
+                case 23:
+                    _k.sent();
+                    return [3 /*break*/, 25];
+                case 24:
+                    _g = _k.sent();
+                    return [3 /*break*/, 25];
+                case 25:
+                    if (!formId) return [3 /*break*/, 29];
+                    _k.label = 26;
+                case 26:
+                    _k.trys.push([26, 28, , 29]);
+                    return [4 /*yield*/, sdk.api.forms.deleteOne(formId)];
+                case 27:
+                    _k.sent();
+                    return [3 /*break*/, 29];
+                case 28:
+                    _h = _k.sent();
+                    return [3 /*break*/, 29];
+                case 29:
+                    if (!enduserId) return [3 /*break*/, 33];
+                    _k.label = 30;
+                case 30:
+                    _k.trys.push([30, 32, , 33]);
+                    return [4 /*yield*/, sdk.api.endusers.deleteOne(enduserId)];
+                case 31:
+                    _k.sent();
+                    return [3 /*break*/, 33];
+                case 32:
+                    _j = _k.sent();
+                    return [3 /*break*/, 33];
+                case 33: return [7 /*endfinally*/];
+                case 34: return [2 /*return*/];
+            }
+        });
+    });
+};
+exports.enduser_write_restrictions_tests = enduser_write_restrictions_tests;
+// Allow running this test file independently
+if (require.main === module) {
+    console.log("\uD83C\uDF10 Using API URL: ".concat(host));
+    var sdk_2 = new sdk_1.Session({ host: host });
+    var sdkNonAdmin_1 = new sdk_1.Session({ host: host });
+    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, (0, setup_1.setup_tests)(sdk_2, sdkNonAdmin_1)];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, (0, exports.enduser_write_restrictions_tests)({ sdk: sdk_2, sdkNonAdmin: sdkNonAdmin_1 })];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); };
+    runTests()
+        .then(function () {
+        console.log("✅ F-0106/F-0110 enduser write-restriction test suite completed successfully");
+        process.exit(0);
+    })
+        .catch(function (error) {
+        console.error("❌ F-0106/F-0110 enduser write-restriction test suite failed:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=F-0106-F-0110-enduser-write-restrictions.test.js.map

package/lib/cjs/tests/api_tests/security/F-0106-F-0110-enduser-write-restrictions.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"F-0106-F-0110-enduser-write-restrictions.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/F-0106-F-0110-enduser-write-restrictions.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,oCAAsD;AACtD,+CAG4B;AAC5B,qCAAyC;AAEzC,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AACpE,IAAM,UAAU,GAAG,0BAA0B,CAAA;AAE7C,IAAM,gBAAgB,GAAG,uBAAuB,CAAA;AAEhD,0EAA0E;AAC1E,sEAAsE;AACtE,4CAA4C;AAC5C,IAAM,wBAAwB,GAAG,UAAC,OAAe,EAAE,OAAe;;IAA0B,OAAA,CAAC;QAC3F,UAAU,EAAE,4BAA4B;QACxC,IAAI,EAAE,CAAC,oBAAoB,CAAC;QAC5B,UAAU,EAAE,CAAC,2BAA2B,CAAC;QACzC,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,YAAY,EAAE,OAAO;QACrB,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,0BAA0B,EAAE,CAAC;QAC/D,uBAAuB,EAAE,EAAE;QAC3B,QAAQ,YAAI,GAAC,OAAO,IAAG,OAAO,KAAE;QAChC,eAAe,EAAE,OAAO;QACxB,MAAM,EAAE,EAAE,kBAAkB,EAAE,MAAM,EAAE;QACtC,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,uBAAuB;QAC/B,IAAI,EAAE,qBAAqB;QAC3B,SAAS,EAAE,EAAE,QAAQ,EAAE,uBAAuB,EAAE;QAChD,kBAAkB,EAAE,EAAE,QAAQ,EAAE,yBAAyB,EAAE;QAC3D,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC5B,gBAAgB,EAAE,KAAK;QACvB,oBAAoB,EAAE,IAAI;QAC1B,kBAAkB,EAAE,YAAY;QAChC,gBAAgB,EAAE,gBAAgB;QAClC,YAAY,EAAE,kBAAkB;QAChC,qBAAqB,EAAE,gBAAgB;QACvC,gBAAgB,EAAE,uBAAuB;QACzC,SAAS,EAAE,kBAAkB;KAC9B,CAAC;AAzB0F,CAyB1F,CAAA;AAEF,yEAAyE;AACzE,IAAM,6BAA6B,GAAG,UAAC,OAAe,IAA0B,OAAA,CAAC;IAC/E,iBAAiB,EAAE,IAAI;IACvB,WAAW,EAAE,OAAO;IACpB,WAAW,EAAE,IAAI,IAAI,CAAC,sBAAsB,CAAC;IAC7C,wBAAwB,EAAE,IAAI;IAC9B,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAC7C,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;IAClF,gBAAgB,EAAE,sDAAsD;IACxE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACpF,cAAc,EAAE,IAAI;IACpB,QAAQ,EAAE,IAAI,IAAI,EAAE;IACpB,kBAAkB,EAAE,IAAI;IACxB,QAAQ,EAAE,IAAI,IAAI,EAAE;IACpB,IAAI,EAAE,CAAC,oBAAoB,CAAC;IAC5B,SAAS,EAAE,oBAAoB;IAC/B,SAAS,EAAE,2BAA2B;IACtC,OAAO,EAAE,uCAAuC;IAChD,UAAU,EAAE,GAAG;CAChB,CAAC,EAlB8E,CAkB9E,CAAA;AAEF;;;;;;;;;;;;;;;;GAgBG;AACI,IAAM,gCAAgC,GAAG,UAAO,EAAgD;QAA9C,GAAG,SAAA;;;;;;oBAC1D,IAAA,oBAAU,EAAC,oEAAoE,CAAC,CAAA;;;;oBAQxE,YAAY,GAAG,wBAAiB,IAAI,CAAC,GAAG,EAAE,iBAAc,CAAA;oBAC9C,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAA;;oBAAxG,YAAU,SAA8F;oBAC9G,SAAS,GAAG,SAAO,CAAC,EAAE,CAAA;oBACtB,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,SAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,EAAA;;oBAAnF,SAAmF,CAAA;oBAE7E,eAAa,IAAI,oBAAc,CAAC,EAAE,IAAI,MAAA,EAAE,UAAU,YAAA,EAAE,CAAC,CAAA;oBAC3D,qBAAM,YAAU,CAAC,YAAY,CAAC,YAAY,EAAE,gBAAgB,CAAC,EAAA;;oBAA7D,SAA6D,CAAA;oBAEhD,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC,EAAA;;oBAA5F,IAAI,GAAG,SAAqF;oBAClG,MAAM,GAAG,IAAI,CAAC,EAAE,CAAA;oBACmB,qBAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,qBAAqB,CAAC;4BACpF,MAAM,EAAE,IAAI,CAAC,EAAE;4BACf,SAAS,EAAE,SAAO,CAAC,EAAE;yBACtB,CAAC,EAAA;;oBAHM,iBAA2B,CAAA,SAGjC,CAAA,SAH4B;oBAI9B,cAAc,GAAG,cAAY,CAAC,EAAE,CAAA;wCAGpB,KAAK,EAAE,KAAK;;;wCACtB,qBAAM,IAAA,oBAAU,EACd,sDAA+C,KAAK,CAAE,EACtD;;wCAAM,OAAA,YAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAO,CAAC,EAAE,EAAE,CAAA,SAAE,GAAC,KAAK,IAAG,KAAK,IAAS,CAAA,CAAC;oCAAxE,CAAwE,EAC9E,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,OAAO,KAAK,UAAG,KAAK,mCAAgC,EAAtD,CAAsD,EAAE,CAC5F,EAAA;;oCAJD,SAIC,CAAA;;;;;0BAL+F,EAArE,KAAA,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAO,CAAC,EAAE,CAAC,CAAC;;;yBAArE,CAAA,cAAqE,CAAA;oBAAvF,WAAc,EAAb,KAAK,QAAA,EAAE,KAAK,QAAA;kDAAZ,KAAK,EAAE,KAAK;;;;;oBAAK,IAAqE,CAAA;;;gBAQlG,6EAA6E;gBAC7E,4CAA4C;gBAC5C,qBAAM,IAAA,oBAAU,EACd,mDAAmD,EACnD,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAO,CAAC,EAAE,CAAC,EAAnC,CAAmC,EACzC,EAAE,QAAQ,EAAE,UAAA,CAAC,gBAAI,OAAA,CAAC,CAAA,MAAA,CAAC,CAAC,UAAU,0CAAE,MAAM,CAAA,IAAI,CAAC,CAAA,MAAA,CAAC,CAAC,IAAI,0CAAE,MAAM,CAAA,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,CAAA,EAAA,EAAE,CAC1F;oBAED,qFAAqF;kBAFpF;;oBAND,6EAA6E;oBAC7E,4CAA4C;oBAC5C,SAIC,CAAA;wCAGW,KAAK,EAAE,KAAK;;;wCACtB,qBAAM,IAAA,oBAAU,EACd,4DAAqD,KAAK,CAAE,EAC5D;;wCAAM,OAAA,YAAU,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,cAAY,CAAC,EAAE,EAAE,CAAA,SAAE,GAAC,KAAK,IAAG,KAAK,IAAS,CAAA,CAAC;oCAAnF,CAAmF,EACzF,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,OAAO,KAAK,UAAG,KAAK,mCAAgC,EAAtD,CAAsD,EAAE,CAC5F,EAAA;;oCAJD,SAIC,CAAA;;;;;0BALwF,EAA9D,KAAA,MAAM,CAAC,OAAO,CAAC,6BAA6B,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;;;yBAA9D,CAAA,cAA8D,CAAA;oBAAhF,WAAc,EAAb,KAAK,QAAA,EAAE,KAAK,QAAA;kDAAZ,KAAK,EAAE,KAAK;;;;;oBAAK,IAA8D,CAAA;;yBAQ3F,qBAAM,IAAA,oBAAU,EACd,0FAA0F,EAC1F,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,cAAY,CAAC,EAAE,CAAC,EAA9C,CAA8C,EACpD,EAAE,QAAQ,EAAE,UAAA,EAAE,YAAI,OAAA,CAAC,EAAE,CAAC,iBAAiB,IAAI,CAAC,CAAA,MAAA,EAAE,CAAC,cAAc,0CAAE,MAAM,CAAA,IAAI,EAAE,CAAC,WAAW,KAAK,SAAS,CAAA,EAAA,EAAE,CACxG;oBAED,wEAAwE;kBAFvE;;oBAJD,SAIC,CAAA;oBAED,wEAAwE;oBACxE,qBAAM,IAAA,oBAAU,EACd,2DAA2D,EAC3D,cAAM,OAAA,YAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAA1F,CAA0F,EAChG,EAAE,QAAQ,EAAE,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,KAAK,KAAK,cAAc,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAnD,CAAmD,EAAE,CACvE,EAAA;;oBALD,wEAAwE;oBACxE,SAIC,CAAA;oBACD,qBAAM,IAAA,oBAAU,EACd,0FAA0F,EAC1F,cAAM,OAAA,YAAU,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,cAAY,CAAC,EAAE,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,EAAzF,CAAyF,EAC/F,EAAE,QAAQ,EAAE,UAAA,EAAE,IAAI,OAAA,EAAE,CAAC,qBAAqB,KAAK,IAAI,EAAjC,CAAiC,EAAE,CACtD;wBAED,uFAAuF;sBAFtF;;oBAJD,SAIC,CAAA;oBAED,uFAAuF;oBACvF,qBAAM,IAAA,oBAAU,EACd,gGAAgG,EAChG,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAO,CAAC,EAAE,EAAE;4BAC3C,IAAI,EAAE,CAAC,eAAe,CAAC;4BACvB,UAAU,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;4BAC7B,UAAU,EAAE,uBAAuB;4BACnC,IAAI,EAAE,gBAAgB;4BACtB,MAAM,EAAE,kBAAkB;yBAC3B,CAAC,EANI,CAMJ,EACF,EAAE,QAAQ,EAAE,UAAA,CAAC;;gCAAI,OAAA,CACf,CAAC,CAAC,CAAA,MAAA,CAAC,CAAC,IAAI,0CAAE,QAAQ,CAAC,eAAe,CAAC,CAAA;uCAChC,CAAC,CAAC,CAAA,MAAA,CAAC,CAAC,UAAU,0CAAE,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;uCACzC,CAAC,CAAC,UAAU,KAAK,uBAAuB,CAC5C,CAAA;6BAAA,EAAE,CACJ,EAAA;;oBAfD,uFAAuF;oBACvF,SAcC,CAAA;oBACD,qBAAM,IAAA,oBAAU,EACd,gGAAgG,EAChG,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,cAAY,CAAC,EAAE,EAAE;4BACtD,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;4BAC7C,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC;4BACvF,IAAI,EAAE,CAAC,eAAe,CAAC;yBACxB,CAAC,EAJI,CAIJ,EACF,EAAE,QAAQ,EAAE,UAAA,EAAE;;gCAAI,OAAA,CAChB,CAAA,MAAA,MAAA,EAAE,CAAC,cAAc,0CAAG,CAAC,CAAC,0CAAE,IAAI,MAAK,OAAO;uCACrC,CAAA,MAAA,MAAA,EAAE,CAAC,cAAc,0CAAG,CAAC,CAAC,0CAAE,IAAI,MAAK,OAAO;uCACxC,CAAC,CAAC,CAAA,MAAA,EAAE,CAAC,IAAI,0CAAE,QAAQ,CAAC,eAAe,CAAC,CAAA,CACxC,CAAA;6BAAA,EAAE,CACJ,EAAA;;oBAZD,SAYC,CAAA;;;yBAEG,cAAc,EAAd,yBAAc;;;;oBACV,qBAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,cAAc,CAAC,EAAA;;oBAAtD,SAAsD,CAAA;;;;;;yBAE1D,MAAM,EAAN,yBAAM;;;;oBACF,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAA;;oBAArC,SAAqC,CAAA;;;;;;yBAEzC,SAAS,EAAT,yBAAS;;;;oBACL,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,EAAA;;oBAA3C,SAA2C,CAAA;;;;;;;;;;CAGtD,CAAA;AA7GY,QAAA,gCAAgC,oCA6G5C;AAED,6CAA6C;AAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAM,KAAG,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACjC,IAAM,aAAW,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IAEzC,IAAM,QAAQ,GAAG;;;wBACf,qBAAM,IAAA,mBAAW,EAAC,KAAG,EAAE,aAAW,CAAC,EAAA;;oBAAnC,SAAmC,CAAA;oBACnC,qBAAM,IAAA,wCAAgC,EAAC,EAAE,GAAG,OAAA,EAAE,WAAW,eAAA,EAAE,CAAC,EAAA;;oBAA5D,SAA4D,CAAA;;;;SAC7D,CAAA;IAED,QAAQ,EAAE;SACP,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAA;QAC1F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,8DAA8D,EAAE,KAAK,CAAC,CAAA;QACpF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}

package/lib/cjs/tests/api_tests/time_tracks.test.d.ts

@@ -23,4 +23,12 @@ export declare const time_tracks_edge_case_tests: ({ sdk, sdkNonAdmin }: {
     sdk: Session;
     sdkNonAdmin: Session;
 }) => Promise<void>;
+export declare const time_tracks_resubmit_tests: ({ sdk, sdkNonAdmin }: {
+    sdk: Session;
+    sdkNonAdmin: Session;
+}) => Promise<void>;
+export declare const time_tracks_appointment_duration_tests: ({ sdk, sdkNonAdmin }: {
+    sdk: Session;
+    sdkNonAdmin: Session;
+}) => Promise<void>;
 //# sourceMappingURL=time_tracks.test.d.ts.map

package/lib/cjs/tests/api_tests/time_tracks.test.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"time_tracks.test.d.ts","sourceRoot":"","sources":["../../../../src/tests/api_tests/time_tracks.test.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAkFnC,eAAO,MAAM,iBAAiB;SAAuC,OAAO;iBAAe,OAAO;mBA0JjG,CAAA;AAKD,eAAO,MAAM,4BAA4B;SAAuC,OAAO;iBAAe,OAAO;mBAoF5G,CAAA;AAKD,eAAO,MAAM,4BAA4B;SAAuC,OAAO;iBAAe,OAAO;mBAsH5G,CAAA;AAKD,eAAO,MAAM,wBAAwB;SAAuC,OAAO;iBAAe,OAAO;mBA+GxG,CAAA;AAKD,eAAO,MAAM,sBAAsB;SAAuC,OAAO;iBAAe,OAAO;mBAqGtG,CAAA;AAKD,eAAO,MAAM,2BAA2B;SAAuC,OAAO;iBAAe,OAAO;mBAsE3G,CAAA"}
+{"version":3,"file":"time_tracks.test.d.ts","sourceRoot":"","sources":["../../../../src/tests/api_tests/time_tracks.test.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAkFnC,eAAO,MAAM,iBAAiB;SAAuC,OAAO;iBAAe,OAAO;mBA0JjG,CAAA;AAKD,eAAO,MAAM,4BAA4B;SAAuC,OAAO;iBAAe,OAAO;mBAoF5G,CAAA;AAKD,eAAO,MAAM,4BAA4B;SAAuC,OAAO;iBAAe,OAAO;mBAsH5G,CAAA;AAKD,eAAO,MAAM,wBAAwB;SAAuC,OAAO;iBAAe,OAAO;mBA+GxG,CAAA;AAKD,eAAO,MAAM,sBAAsB;SAAuC,OAAO;iBAAe,OAAO;mBAqGtG,CAAA;AAKD,eAAO,MAAM,2BAA2B;SAAuC,OAAO;iBAAe,OAAO;mBAsE3G,CAAA;AAKD,eAAO,MAAM,0BAA0B;SAAuC,OAAO;iBAAe,OAAO;mBA6M1G,CAAA;AAKD,eAAO,MAAM,sCAAsC;SAAuC,OAAO;iBAAe,OAAO;mBA2MtH,CAAA"}