@tellescope/sdk 1.253.1 → 1.254.1

package/src/tests/api_tests/resource_access_tags.test.ts

@@ -0,0 +1,303 @@
+require('source-map-support').install();
+
+import { Session } from "../../sdk"
+import {
+  async_test,
+  handleAnyError,
+  log_header,
+  wait,
+  assert,
+} from "@tellescope/testing"
+import { PROVIDER_PERMISSIONS } from "@tellescope/constants"
+import { setup_tests } from "../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
+const TAG_A = 'resource-access-tag-A'
+const TAG_B = 'resource-access-tag-B'
+
+/**
+ * Tests for settings.users.enableResourceAccessTags (the `erat` session flag).
+ *
+ * When the org setting is enabled, org-level configuration resources carrying `accessTags`
+ * become visible only to non-admin (Default/Assigned) users whose own tags intersect the
+ * record's accessTags. This mirrors the existing enduser accessTags behavior, generalized
+ * to the 9 RESOURCE_ACCESS_TAG_MODELS.
+ *
+ * The model is ADDITIVE: a record only becomes tag-gated once an admin sets accessTags on it.
+ * Records without accessTags keep their existing rules (Default == creator-only). Admins and
+ * All-access users are unaffected.
+ *
+ * Per the throwaway-user testing guidance, this test creates throwaway users rather than
+ * mutating existing user roles. Tokens are minted via generate_auth_token AFTER the org
+ * setting is enabled, so the `erat` flag lands in their sessions.
+ */
+export const resource_access_tags_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("Resource Access Tags Tests")
+
+  const DEFAULT_RW = { create: 'Default', read: 'Default', update: 'Default', delete: 'Default' } as const
+  const ALL_RW = { create: 'All', read: 'All', update: 'All', delete: 'All' } as const
+
+  const RESOURCE_MODELS = [
+    'templates', 'forms', 'journeys', 'automation_triggers', 'calendar_event_templates',
+    'appointment_booking_pages', 'table_views', 'files', 'managed_content_records',
+  ] as const
+
+  // track everything we create for cleanup
+  const createdUserIds: string[] = []
+  const createdRoleIds: string[] = []
+  const createdByModel: Record<string, string[]> = {}
+  for (const m of RESOURCE_MODELS) createdByModel[m] = []
+  let helperTemplateId: string | undefined // calendar_event_template used as a booking-page dependency
+
+  const orgId = sdk.userInfo.businessId
+
+  try {
+    // ── 1. Enable the org setting ───────────────────────────────────────────────
+    // Explicitly disable enduser access tags (eat) so that the tag-edit-restriction
+    // assertions below prove the `erat` flag alone enforces the protection (otherwise
+    // a residual `eat` could mask the gap). Settings deep-merge, so this is targeted.
+    await sdk.api.organizations.updateOne(orgId, {
+      settings: { users: { enableResourceAccessTags: true }, endusers: { enableAccessTags: false } },
+    })
+
+    // ── 2. Roles: Default read for a tag-gated user, All read for a control user ──
+    const defaultPermissions: any = { ...PROVIDER_PERMISSIONS }
+    const allPermissions: any = { ...PROVIDER_PERMISSIONS }
+    for (const m of RESOURCE_MODELS) {
+      defaultPermissions[m] = { ...DEFAULT_RW }
+      allPermissions[m] = { ...ALL_RW }
+    }
+
+    const defaultRole = `resource-access-tags-default-${RAND()}`
+    const allRole = `resource-access-tags-all-${RAND()}`
+    const rbapDefault = await sdk.api.role_based_access_permissions.createOne({ role: defaultRole, permissions: defaultPermissions })
+    const rbapAll = await sdk.api.role_based_access_permissions.createOne({ role: allRole, permissions: allPermissions })
+    createdRoleIds.push(rbapDefault.id, rbapAll.id)
+
+    // ── 3. Throwaway users + tokens (minted AFTER enabling the setting → erat set) ─
+    const mkUser = async (tags: string[], roles: string[]) => {
+      const user = await sdk.api.users.createOne({
+        email: `resource-access-tags-${RAND()}@tellescope.example`,
+        fname: 'Resource', lname: 'AccessTags',
+        notificationEmailsDisabled: true, verifiedEmail: true,
+        tags, roles,
+      } as any)
+      createdUserIds.push(user.id)
+      // mint AFTER the setting is enabled so the erat flag lands in the session/JWT
+      const { authToken, user: sessionUser } = await sdk.api.users.generate_auth_token({ id: user.id })
+      const session = new Session({ host })
+      session.setAuthToken(authToken)
+      session.setUserInfo(sessionUser as any)
+      return { session, sessionUser: sessionUser as any }
+    }
+
+    const { session: sdkWithTag, sessionUser: withTagUser } = await mkUser([TAG_A], [defaultRole]) // Default access, carries the gating tag
+    const { session: sdkWithoutTag } = await mkUser([TAG_B], [defaultRole]) // Default access, lacks the gating tag
+    const { session: sdkAllAccess } = await mkUser([TAG_B], [allRole])      // All access, lacks the tag (should still see everything)
+
+    // sanity check: erat made it into the gated sessions
+    assert(!!withTagUser.erat, 'erat flag missing on tagged user session', 'erat flag present on tagged user session')
+
+    // ── 4. Per-model record creation (tagged with TAG_A + untagged control) ──────
+    // calendar_event_template dependency for booking pages
+    const helperTemplate = await sdk.api.calendar_event_templates.createOne({ title: `RAT helper ${RAND()}`, durationInMinutes: 30 })
+    helperTemplateId = helperTemplate.id
+    createdByModel['calendar_event_templates'].push(helperTemplate.id)
+
+    const createRecord = async (model: typeof RESOURCE_MODELS[number], accessTags?: string[]): Promise<string> => {
+      const tags = accessTags ? { accessTags } : {}
+      let id: string
+      switch (model) {
+        case 'templates': {
+          const r = await sdk.api.templates.createOne({ title: `RAT tmpl ${RAND()}`, subject: 's', html: '<p>x</p>', message: 'm', ...tags } as any)
+          id = r.id; break
+        }
+        case 'forms': {
+          const r = await sdk.api.forms.createOne({ title: `RAT form ${RAND()}`, ...tags } as any)
+          id = r.id; break
+        }
+        case 'journeys': {
+          const r = await sdk.api.journeys.createOne({ title: `RAT jrn ${RAND()}`, ...tags } as any)
+          id = r.id; break
+        }
+        case 'automation_triggers': {
+          const r = await sdk.api.automation_triggers.createOne({
+            title: `RAT trg ${RAND()}`, status: 'Active',
+            event: { type: 'Appointment Completed', info: {} },
+            action: { type: 'Add Tags', info: { tags: ['x'] } },
+            ...tags,
+          } as any)
+          id = r.id; break
+        }
+        case 'calendar_event_templates': {
+          const r = await sdk.api.calendar_event_templates.createOne({ title: `RAT cet ${RAND()}`, durationInMinutes: 30, ...tags } as any)
+          id = r.id; break
+        }
+        case 'appointment_booking_pages': {
+          const r = await sdk.api.appointment_booking_pages.createOne({
+            title: `RAT bp ${RAND()}`, calendarEventTemplateIds: [helperTemplateId!], locationIds: [], ...tags,
+          } as any)
+          id = r.id; break
+        }
+        case 'table_views': {
+          const r = await sdk.api.table_views.createOne({ title: `RAT view ${RAND()}`, page: 'Ticket', columns: [], ...tags } as any)
+          id = r.id; break
+        }
+        case 'files': {
+          const { file } = await sdk.api.files.prepare_file_upload({ name: `RAT file ${RAND()}`, type: 'text/plain', size: 1 })
+          if (accessTags) await sdk.api.files.updateOne(file.id, { accessTags } as any)
+          id = file.id; break
+        }
+        case 'managed_content_records': {
+          const r = await sdk.api.managed_content_records.createOne({ title: `RAT content ${RAND()}`, textContent: 't', ...tags } as any)
+          id = r.id; break
+        }
+        default: throw new Error(`unhandled model ${model}`)
+      }
+      createdByModel[model].push(id)
+      return id
+    }
+
+    const recordsByModel: Record<string, { taggedId: string, untaggedId: string }> = {}
+    for (const model of RESOURCE_MODELS) {
+      const taggedId = await createRecord(model, [TAG_A])
+      const untaggedId = await createRecord(model)
+      recordsByModel[model] = { taggedId, untaggedId }
+    }
+
+    // ── 5. Assertions per model ──────────────────────────────────────────────────
+    const visibleIds = async (session: Session, model: string, ids: string[]): Promise<Set<string>> => {
+      const records = await (session.api as any)[model].getSome({ ids, limit: 100 })
+      return new Set(records.map((r: any) => r.id))
+    }
+
+    for (const model of RESOURCE_MODELS) {
+      const { taggedId, untaggedId } = recordsByModel[model]
+      const ids = [taggedId, untaggedId]
+
+      const withTag = await visibleIds(sdkWithTag, model, ids)
+      const withoutTag = await visibleIds(sdkWithoutTag, model, ids)
+      const admin = await visibleIds(sdk, model, ids)
+      const allAccess = await visibleIds(sdkAllAccess, model, ids)
+
+      await async_test(
+        `${model}: user WITH matching tag CAN read the tagged record`,
+        async () => withTag.has(taggedId),
+        { onResult: r => r === true },
+      )
+      await async_test(
+        `${model}: user WITHOUT matching tag CANNOT read the tagged record`,
+        async () => withoutTag.has(taggedId),
+        { onResult: r => r === false },
+      )
+      await async_test(
+        `${model}: untagged admin record NOT visible to tagged user (additive model)`,
+        async () => withTag.has(untaggedId),
+        { onResult: r => r === false },
+      )
+      await async_test(
+        `${model}: untagged admin record NOT visible to untagged user (additive model)`,
+        async () => withoutTag.has(untaggedId),
+        { onResult: r => r === false },
+      )
+      await async_test(
+        `${model}: admin sees both records (gating does not apply)`,
+        async () => admin.has(taggedId) && admin.has(untaggedId),
+        { onResult: r => r === true },
+      )
+      await async_test(
+        `${model}: All-access user sees both records (gating does not apply)`,
+        async () => allAccess.has(taggedId) && allAccess.has(untaggedId),
+        { onResult: r => r === true },
+      )
+    }
+
+    // ── 5b. Tag-edit restriction: a non-admin cannot edit tags to self-escalate ──
+    // With erat ON and eat OFF, the users.tags edit guard must still fire — proving
+    // resource access tags (not just enduser access tags) trigger the protection.
+    log_header("Resource Access Tags: tag-edit blocked")
+    const withTagUserId = createdUserIds[0]
+    await async_test(
+      `non-admin can't update own tags (erat enabled)`,
+      () => sdkWithTag.api.users.updateOne(withTagUserId, { tags: ['escalate'] }),
+      handleAnyError,
+    )
+    await async_test(
+      `non-admin can't update own tags alongside other fields (erat enabled)`,
+      () => sdkWithTag.api.users.updateOne(withTagUserId, { tags: ['escalate'], bio: '' }),
+      handleAnyError,
+    )
+    await async_test(
+      `non-admin can still update non-tag fields (control)`,
+      () => sdkWithTag.api.users.updateOne(withTagUserId, { bio: '' }),
+      { shouldError: false, onResult: () => true },
+    )
+
+    // ── 6. Org-setting-OFF control: disabling the flag gates the whole feature ────
+    log_header("Resource Access Tags: org-setting-OFF control")
+    await sdk.api.organizations.updateOne(orgId, {
+      settings: { users: { enableResourceAccessTags: false } },
+    })
+    // re-mint the tagged user's token so the (now-disabled) setting is reflected in the session
+    const { authToken: reAuthToken, user: reAuthUser } = await sdk.api.users.generate_auth_token({ id: createdUserIds[0] })
+    const sdkWithTagOff = new Session({ host })
+    sdkWithTagOff.setAuthToken(reAuthToken)
+    sdkWithTagOff.setUserInfo(reAuthUser as any)
+    assert(!(reAuthUser as any).erat, 'erat flag should be absent after disabling setting', 'erat flag absent after disabling setting')
+
+    const { taggedId: templatesTaggedId } = recordsByModel['templates']
+    const offVisible = await visibleIds(sdkWithTagOff, 'templates', [templatesTaggedId])
+    await async_test(
+      `templates: tagged record NOT visible to tagged user once setting is OFF`,
+      async () => offVisible.has(templatesTaggedId),
+      { onResult: r => r === false },
+    )
+
+    console.log("\n" + "=".repeat(60))
+    console.log("Resource Access Tags Tests Complete")
+    console.log("=".repeat(60))
+  } finally {
+    // ── Cleanup ────────────────────────────────────────────────────────────────
+    for (const model of RESOURCE_MODELS) {
+      for (const id of createdByModel[model]) {
+        await (sdk.api as any)[model].deleteOne(id).catch(() => {})
+      }
+    }
+    for (const id of createdRoleIds) {
+      await sdk.api.role_based_access_permissions.deleteOne(id).catch(() => {})
+    }
+    for (const id of createdUserIds) {
+      await sdk.api.users.deleteOne(id).catch(() => {})
+    }
+    // reset the org setting
+    await sdk.api.organizations.updateOne(orgId, {
+      settings: { users: { enableResourceAccessTags: false } },
+    }).catch(() => {})
+    await wait(undefined, 250)
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await resource_access_tags_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ Resource access tags test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Resource access tags test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/security/F-0116-F-0119-enduser-cross-create.test.ts

@@ -0,0 +1,221 @@
+require('source-map-support').install();
+
+import { Session, EnduserSession } from "../../../sdk"
+import {
+  async_test,
+  log_header,
+} from "@tellescope/testing"
+import { setup_tests } from "../../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+const businessId = '60398b1131a295e64f084ff6'
+
+const ENDUSER_PASSWORD = 'F0116TestPassword!123'
+
+const CROSS_ENDUSER_MESSAGE = "enduserId does not match creator id for enduser session"
+
+/**
+ * Regression test for the enduser cross-enduser CREATE gating gaps:
+ *   F-0116 enduser_observations  (security-audit/findings/F-0116-*.md)
+ *   F-0117 enduser_orders        (security-audit/findings/F-0117-*.md)
+ *   F-0119 managed_content_records (security-audit/findings/F-0119-*.md)
+ *   F-0118 chat_rooms (enduserIds-only gate; staff userIds targeting is by-design)
+ *
+ * Each model exposed enduserActions.create with an `enduserId`/`enduserIds` field that
+ * lacked a write-side gate, letting an authenticated enduser create records bound to a
+ * DIFFERENT enduser in the same tenant. The fix adds a `constraints.relationship`
+ * evaluator mirroring the canonical `tickets` pattern (schema.ts).
+ *
+ * Methodology: each section asserts BOTH the exploit-is-blocked case AND that the
+ * legitimate path (self-create + staff-create) still works.
+ */
+export const enduser_cross_create_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("F-0116/F-0117/F-0118/F-0119: enduser cross-enduser create gates")
+
+  let attackerId: string | undefined
+  let victimId: string | undefined
+  const createdObservationIds: string[] = []
+  const createdOrderIds: string[] = []
+  const createdContentIds: string[] = []
+  const createdRoomIds: string[] = []
+
+  try {
+    // ---- Setup: attacker enduser (with portal session) + victim enduser ----
+    const attackerEmail = `f0116-attacker-${Date.now()}@example.com`
+    const victimEmail = `f0116-victim-${Date.now()}@example.com`
+    const attacker = await sdk.api.endusers.createOne({ email: attackerEmail, fname: 'F0116', lname: 'Attacker' })
+    attackerId = attacker.id
+    const victim = await sdk.api.endusers.createOne({ email: victimEmail, fname: 'F0116', lname: 'Victim' })
+    victimId = victim.id
+    await sdk.api.endusers.set_password({ id: attacker.id, password: ENDUSER_PASSWORD })
+
+    const attackerSDK = new EnduserSession({ host, businessId })
+    await attackerSDK.authenticate(attackerEmail, ENDUSER_PASSWORD)
+
+    // ============================================================
+    // F-0116 — enduser_observations
+    // ============================================================
+    await async_test(
+      `F-0116: enduser cannot create observation on another enduser (createOne)`,
+      () => attackerSDK.api.enduser_observations.createOne({
+        enduserId: victimId!, category: 'vital-signs', status: 'final',
+        measurement: { unit: 'mmHg', value: 220 },
+      } as any),
+      { shouldError: true, onError: e => e.message === CROSS_ENDUSER_MESSAGE },
+    )
+    await async_test(
+      `F-0116: enduser cannot create observation on another enduser (createMany)`,
+      () => attackerSDK.api.enduser_observations.createSome([{
+        enduserId: victimId!, category: 'vital-signs', status: 'final',
+        measurement: { unit: 'mmHg', value: 220 },
+      }] as any),
+      { shouldError: true, onError: e => e.message === CROSS_ENDUSER_MESSAGE },
+    )
+
+    // Positive control: enduser CAN create an observation on their OWN record
+    await async_test(
+      `F-0116: enduser can still create observation on own record`,
+      () => attackerSDK.api.enduser_observations.createOne({
+        enduserId: attackerId!, category: 'vital-signs', status: 'final',
+        measurement: { unit: 'mmHg', value: 120 },
+      } as any),
+      { onResult: (o: any) => { if (o?.id) createdObservationIds.push(o.id); return o?.enduserId === attackerId } },
+    )
+    // Positive control: staff CAN create an observation on any tenant enduser
+    await async_test(
+      `F-0116: staff can still create observation on any enduser`,
+      () => sdk.api.enduser_observations.createOne({
+        enduserId: victimId!, category: 'vital-signs', status: 'final',
+        measurement: { unit: 'mmHg', value: 118 },
+      } as any),
+      { onResult: (o: any) => { if (o?.id) createdObservationIds.push(o.id); return o?.enduserId === victimId } },
+    )
+
+    // ============================================================
+    // F-0117 — enduser_orders
+    // ============================================================
+    const orderPayload = (enduserId: string) => ({
+      enduserId, externalId: `f0117-${Date.now()}`, source: 'f0117-source',
+      title: 'f0117 order', status: 'pending',
+    })
+    await async_test(
+      `F-0117: enduser cannot create order on another enduser`,
+      () => attackerSDK.api.enduser_orders.createOne(orderPayload(victimId!) as any),
+      { shouldError: true, onError: e => e.message === CROSS_ENDUSER_MESSAGE },
+    )
+    await async_test(
+      `F-0117: enduser can still create order on own record`,
+      () => attackerSDK.api.enduser_orders.createOne(orderPayload(attackerId!) as any),
+      { onResult: (o: any) => { if (o?.id) createdOrderIds.push(o.id); return o?.enduserId === attackerId } },
+    )
+    await async_test(
+      `F-0117: staff can still create order on any enduser`,
+      () => sdk.api.enduser_orders.createOne(orderPayload(victimId!) as any),
+      { onResult: (o: any) => { if (o?.id) createdOrderIds.push(o.id); return o?.enduserId === victimId } },
+    )
+
+    // ============================================================
+    // F-0119 — managed_content_records
+    // ============================================================
+    await async_test(
+      `F-0119: enduser cannot create content with allowUnauthenticatedAccess`,
+      () => attackerSDK.api.managed_content_records.createOne({
+        title: 'f0119 phishing', textContent: 'x', allowUnauthenticatedAccess: true,
+      } as any),
+      { shouldError: true, onError: e => e.message === "allowUnauthenticatedAccess cannot be set by endusers" },
+    )
+    await async_test(
+      `F-0119: enduser cannot create content with publicRead`,
+      () => attackerSDK.api.managed_content_records.createOne({
+        title: 'f0119 broadcast', textContent: 'x', publicRead: true,
+      } as any),
+      { shouldError: true, onError: e => e.message === "publicRead cannot be set by endusers" },
+    )
+    await async_test(
+      `F-0119: enduser cannot create content bound to another enduser`,
+      () => attackerSDK.api.managed_content_records.createOne({
+        title: 'f0119 cross', textContent: 'x', enduserId: victimId!,
+      } as any),
+      { shouldError: true, onError: e => e.message === CROSS_ENDUSER_MESSAGE },
+    )
+    await async_test(
+      `F-0119: enduser can still create ordinary content`,
+      () => attackerSDK.api.managed_content_records.createOne({
+        title: 'f0119 ok', textContent: 'hello',
+      } as any),
+      { onResult: (o: any) => { if (o?.id) createdContentIds.push(o.id); return !o?.publicRead && !o?.allowUnauthenticatedAccess } },
+    )
+    await async_test(
+      `F-0119: staff can still create public content`,
+      () => sdk.api.managed_content_records.createOne({
+        title: 'f0119 staff public', textContent: 'x', publicRead: true,
+      } as any),
+      { onResult: (o: any) => { if (o?.id) createdContentIds.push(o.id); return o?.publicRead === true } },
+    )
+
+    // ============================================================
+    // F-0118 — chat_rooms (enduserIds-only gate; staff userIds targeting is by-design)
+    // ============================================================
+    const staffId = sdk.userInfo.id
+    await async_test(
+      `F-0118: enduser cannot add another patient to a chat room (enduserIds)`,
+      () => attackerSDK.api.chat_rooms.createOne({
+        type: 'internal', enduserIds: [attackerId!, victimId!], userIds: [staffId],
+      } as any),
+      { shouldError: true, onError: e => e.message === "enduserIds may only contain your own id for enduser session" },
+    )
+    // Positive control: patient CAN create a room with care-team staff + self (intended feature)
+    await async_test(
+      `F-0118: enduser can still create a room with staff + self`,
+      () => attackerSDK.api.chat_rooms.createOne({
+        type: 'internal', enduserIds: [attackerId!], userIds: [staffId],
+      } as any),
+      { onResult: (o: any) => { if (o?.id) createdRoomIds.push(o.id); return o?.enduserIds?.length === 1 && o?.userIds?.includes(staffId) } },
+    )
+    // Positive control: staff can still create multi-patient rooms
+    await async_test(
+      `F-0118: staff can still create a room with multiple endusers`,
+      () => sdk.api.chat_rooms.createOne({
+        type: 'internal', enduserIds: [attackerId!, victimId!], userIds: [staffId],
+      } as any),
+      { onResult: (o: any) => { if (o?.id) createdRoomIds.push(o.id); return o?.enduserIds?.length === 2 } },
+    )
+  } finally {
+    for (const id of createdRoomIds) {
+      try { await sdk.api.chat_rooms.deleteOne(id) } catch {}
+    }
+    for (const id of createdContentIds) {
+      try { await sdk.api.managed_content_records.deleteOne(id) } catch {}
+    }
+    for (const id of createdObservationIds) {
+      try { await sdk.api.enduser_observations.deleteOne(id) } catch {}
+    }
+    for (const id of createdOrderIds) {
+      try { await sdk.api.enduser_orders.deleteOne(id) } catch {}
+    }
+    if (attackerId) { try { await sdk.api.endusers.deleteOne(attackerId) } catch {} }
+    if (victimId) { try { await sdk.api.endusers.deleteOne(victimId) } catch {} }
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await enduser_cross_create_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ F-0116/F-0117/F-0118/F-0119 enduser cross-create test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ enduser cross-create test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/security/F-0145-globalunique-leak.test.ts

@@ -0,0 +1,78 @@
+require('source-map-support').install();
+
+import { Session } from "../../../sdk"
+import {
+  async_test,
+  log_header,
+} from "@tellescope/testing"
+import { setup_tests } from "../../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+/**
+ * Regression test for F-0145
+ * (security-audit/findings/F-0145-globalunique-conflict-leaks-cross-tenant-record.md).
+ *
+ * The create endpoint generator's unconditional globalUnique-enforcement block
+ * (routing.ts, "globalUnique should be enforced even if _overrideUnique is true")
+ * threw uniquenessError([{ existingRecord: matches[0] }]) with the RAW matched record.
+ * `findSomeByMatchAny_Global` deletes businessId, so the match is global; for `users`
+ * (globalUnique: ['email','phone']) the 409 body leaked the full record incl. hashedPass.
+ *
+ * Fix: redact existingRecord to { _id, businessId } like the safe validateUniquenessConstraints
+ * path. This reproduces the leak with a same-tenant collision (same code path) and asserts the
+ * 409 body's existingRecord exposes nothing beyond _id + businessId.
+ */
+export const globalunique_leak_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("F-0145: globalUnique conflict response redaction")
+
+  let userId: string | undefined
+  try {
+    const email = `f0145-victim-${Date.now()}@example.com`
+    const user = await sdk.api.users.createOne({ email } as any)
+    userId = user.id
+
+    await async_test(
+      'F-0145: globalUnique 409 existingRecord exposes only _id + businessId (no email/hashedPass)',
+      () => sdk.api.users.createOne({ email, _overrideUnique: true } as any),
+      {
+        shouldError: true,
+        onError: (e: any) => {
+          const rec = e?.info?.[0]?.existingRecord
+          if (!rec || typeof rec !== 'object') return false
+          const keys = Object.keys(rec)
+          return (
+            keys.length > 0
+            && keys.every(k => k === '_id' || k === 'businessId' || k === 'id')
+            && !('email' in rec)
+            && !('hashedPass' in rec)
+            && !('hashedInviteCode' in rec)
+          )
+        },
+      },
+    )
+  } finally {
+    if (userId) { try { await sdk.api.users.deleteOne(userId) } catch {} }
+  }
+}
+
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await globalunique_leak_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ F-0145 globalUnique leak test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ F-0145 globalUnique leak test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/security/F-0151-load-inbox-redaction.test.ts

@@ -0,0 +1,81 @@
+require('source-map-support').install();
+
+import { Session } from "../../../sdk"
+import {
+  async_test,
+  log_header,
+} from "@tellescope/testing"
+import { setup_tests } from "../../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const ENDUSER_PASSWORD = 'F0151TestPassword!123'
+
+/**
+ * Regression test for F-0151
+ * (security-audit/findings/F-0151-load-inbox-data-endusers-unredacted.md).
+ *
+ * load_inbox_data serialized $lookup'ed endusers via convert_id_name only (NOT applyRedactions),
+ * so endusers.hashedPassword (redactions:['all']) leaked to staff sessions — while the sibling
+ * phone_calls in the same response correctly went through applyRedactions.
+ *
+ * Repro: create an enduser, set their portal password (→ hashedPassword), seed an inbound
+ * (logOnly) email so the enduser appears in the inbox join, then load_inbox_data as staff and
+ * assert the returned enduser entry has NO hashedPassword.
+ */
+export const load_inbox_redaction_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("F-0151: load_inbox_data enduser redaction")
+
+  let enduserId: string | undefined
+  let emailId: string | undefined
+  try {
+    const email = `f0151-enduser-${Date.now()}@example.com`
+    const enduser = await sdk.api.endusers.createOne({ email, fname: 'F0151', lname: 'Inbox' })
+    enduserId = enduser.id
+    await sdk.api.endusers.set_password({ id: enduser.id, password: ENDUSER_PASSWORD })
+
+    // Seed an inbound logOnly email so the enduser is joined into the inbox payload
+    const seeded = await sdk.api.emails.createOne({
+      enduserId: enduser.id, subject: 'F0151 seed', textContent: 'seed',
+      logOnly: true, inbound: true,
+    } as any)
+    emailId = seeded.id
+
+    await async_test(
+      'F-0151: load_inbox_data does not leak enduser.hashedPassword to staff',
+      () => sdk.api.endusers.load_inbox_data({ enduserIds: [enduser.id] } as any),
+      {
+        onResult: (r: any) => {
+          const returned = (r?.endusers ?? []).find((e: any) => (e.id || e._id)?.toString() === enduserId)
+          // require that the enduser actually came back (so the assertion is meaningful),
+          // and that hashedPassword is absent
+          return !!returned && !('hashedPassword' in returned)
+        },
+      },
+    )
+  } finally {
+    if (emailId) { try { await sdk.api.emails.deleteOne(emailId) } catch {} }
+    if (enduserId) { try { await sdk.api.endusers.deleteOne(enduserId) } catch {} }
+  }
+}
+
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await load_inbox_redaction_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ F-0151 load_inbox_data redaction test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ F-0151 load_inbox_data redaction test suite failed:", error)
+      process.exit(1)
+    })
+}