@tellescope/sdk 1.254.0 → 1.254.1

package/src/tests/api_tests/security/F-0145-globalunique-leak.test.ts

@@ -0,0 +1,78 @@
+require('source-map-support').install();
+
+import { Session } from "../../../sdk"
+import {
+  async_test,
+  log_header,
+} from "@tellescope/testing"
+import { setup_tests } from "../../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+/**
+ * Regression test for F-0145
+ * (security-audit/findings/F-0145-globalunique-conflict-leaks-cross-tenant-record.md).
+ *
+ * The create endpoint generator's unconditional globalUnique-enforcement block
+ * (routing.ts, "globalUnique should be enforced even if _overrideUnique is true")
+ * threw uniquenessError([{ existingRecord: matches[0] }]) with the RAW matched record.
+ * `findSomeByMatchAny_Global` deletes businessId, so the match is global; for `users`
+ * (globalUnique: ['email','phone']) the 409 body leaked the full record incl. hashedPass.
+ *
+ * Fix: redact existingRecord to { _id, businessId } like the safe validateUniquenessConstraints
+ * path. This reproduces the leak with a same-tenant collision (same code path) and asserts the
+ * 409 body's existingRecord exposes nothing beyond _id + businessId.
+ */
+export const globalunique_leak_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("F-0145: globalUnique conflict response redaction")
+
+  let userId: string | undefined
+  try {
+    const email = `f0145-victim-${Date.now()}@example.com`
+    const user = await sdk.api.users.createOne({ email } as any)
+    userId = user.id
+
+    await async_test(
+      'F-0145: globalUnique 409 existingRecord exposes only _id + businessId (no email/hashedPass)',
+      () => sdk.api.users.createOne({ email, _overrideUnique: true } as any),
+      {
+        shouldError: true,
+        onError: (e: any) => {
+          const rec = e?.info?.[0]?.existingRecord
+          if (!rec || typeof rec !== 'object') return false
+          const keys = Object.keys(rec)
+          return (
+            keys.length > 0
+            && keys.every(k => k === '_id' || k === 'businessId' || k === 'id')
+            && !('email' in rec)
+            && !('hashedPass' in rec)
+            && !('hashedInviteCode' in rec)
+          )
+        },
+      },
+    )
+  } finally {
+    if (userId) { try { await sdk.api.users.deleteOne(userId) } catch {} }
+  }
+}
+
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await globalunique_leak_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ F-0145 globalUnique leak test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ F-0145 globalUnique leak test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/security/F-0151-load-inbox-redaction.test.ts

@@ -0,0 +1,81 @@
+require('source-map-support').install();
+
+import { Session } from "../../../sdk"
+import {
+  async_test,
+  log_header,
+} from "@tellescope/testing"
+import { setup_tests } from "../../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const ENDUSER_PASSWORD = 'F0151TestPassword!123'
+
+/**
+ * Regression test for F-0151
+ * (security-audit/findings/F-0151-load-inbox-data-endusers-unredacted.md).
+ *
+ * load_inbox_data serialized $lookup'ed endusers via convert_id_name only (NOT applyRedactions),
+ * so endusers.hashedPassword (redactions:['all']) leaked to staff sessions — while the sibling
+ * phone_calls in the same response correctly went through applyRedactions.
+ *
+ * Repro: create an enduser, set their portal password (→ hashedPassword), seed an inbound
+ * (logOnly) email so the enduser appears in the inbox join, then load_inbox_data as staff and
+ * assert the returned enduser entry has NO hashedPassword.
+ */
+export const load_inbox_redaction_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("F-0151: load_inbox_data enduser redaction")
+
+  let enduserId: string | undefined
+  let emailId: string | undefined
+  try {
+    const email = `f0151-enduser-${Date.now()}@example.com`
+    const enduser = await sdk.api.endusers.createOne({ email, fname: 'F0151', lname: 'Inbox' })
+    enduserId = enduser.id
+    await sdk.api.endusers.set_password({ id: enduser.id, password: ENDUSER_PASSWORD })
+
+    // Seed an inbound logOnly email so the enduser is joined into the inbox payload
+    const seeded = await sdk.api.emails.createOne({
+      enduserId: enduser.id, subject: 'F0151 seed', textContent: 'seed',
+      logOnly: true, inbound: true,
+    } as any)
+    emailId = seeded.id
+
+    await async_test(
+      'F-0151: load_inbox_data does not leak enduser.hashedPassword to staff',
+      () => sdk.api.endusers.load_inbox_data({ enduserIds: [enduser.id] } as any),
+      {
+        onResult: (r: any) => {
+          const returned = (r?.endusers ?? []).find((e: any) => (e.id || e._id)?.toString() === enduserId)
+          // require that the enduser actually came back (so the assertion is meaningful),
+          // and that hashedPassword is absent
+          return !!returned && !('hashedPassword' in returned)
+        },
+      },
+    )
+  } finally {
+    if (emailId) { try { await sdk.api.emails.deleteOne(emailId) } catch {} }
+    if (enduserId) { try { await sdk.api.endusers.deleteOne(enduserId) } catch {} }
+  }
+}
+
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await load_inbox_redaction_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ F-0151 load_inbox_data redaction test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ F-0151 load_inbox_data redaction test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/security/F-0155-webhook-timeout.test.ts

@@ -0,0 +1,85 @@
+require('source-map-support').install();
+
+import http from "http"
+import { Session } from "../../../sdk"
+import {
+  async_test,
+  log_header,
+} from "@tellescope/testing"
+import { setup_tests } from "../../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+// The server-side axios timeout is 15s (F-0155 fix). We bound our own wait above that.
+const CLIENT_WAIT_MS = 20_000
+
+/**
+ * Regression test for F-0155
+ * (security-audit/findings/F-0155-outbound-webhook-no-timeout-slow-loris.md).
+ *
+ * Outbound webhook delivery used axios.post(url, ...) with no `timeout` (axios default = infinite).
+ * A tenant-controlled receiver that accepts the connection and never responds hangs the awaited
+ * request indefinitely (slow-loris → worker exhaustion). Fix: timeout: 15_000 on the axios calls.
+ *
+ * Repro: stand up a local HTTP server that accepts the connection but NEVER responds, point
+ * send_automation_webhook (which awaits the axios call) at it, and race the call against a 20s
+ * client timer.
+ *   - green (fixed):  server times out at ~15s → handler returns 400 → SDK call rejects < 20s
+ *   - red  (unfixed): the call is still pending at 20s → client timer wins
+ */
+export const webhook_timeout_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("F-0155: outbound webhook timeout")
+
+  let enduserId: string | undefined
+  const slowServer = http.createServer(() => { /* accept connection, never respond */ })
+
+  try {
+    await new Promise<void>(resolve => slowServer.listen(0, '127.0.0.1', () => resolve()))
+    const port = (slowServer.address() as any).port
+    const blackholeUrl = `http://127.0.0.1:${port}/hook`
+
+    const enduser = await sdk.api.endusers.createOne({ email: `f0155-${Date.now()}@example.com`, fname: 'F0155', lname: 'Webhook' })
+    enduserId = enduser.id
+
+    await async_test(
+      'F-0155: outbound webhook to a non-responding receiver times out server-side (does not hang)',
+      async () => {
+        const start = Date.now()
+        const outcome = await Promise.race([
+          sdk.api.webhooks.send_automation_webhook({
+            enduserId: enduser.id,
+            action: { info: { url: blackholeUrl } },
+          } as any).then(() => 'completed').catch(() => 'errored'),
+          new Promise<string>(r => setTimeout(() => r('client-timeout'), CLIENT_WAIT_MS)),
+        ])
+        return { outcome, elapsed: Date.now() - start }
+      },
+      // green: the server-side axios timeout fired (call settled) before our 20s client wait
+      { onResult: (r: any) => r.outcome !== 'client-timeout' && r.elapsed < CLIENT_WAIT_MS },
+    )
+  } finally {
+    slowServer.close()
+    if (enduserId) { try { await sdk.api.endusers.deleteOne(enduserId) } catch {} }
+  }
+}
+
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await webhook_timeout_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ F-0155 webhook timeout test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ F-0155 webhook timeout test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/setup.ts

@@ -150,4 +150,13 @@ export const setup_tests = async (sdk: Session, sdkNonAdmin: Session) => {
   // may do some stuff in background after returning
   await async_test('reset_db', () => sdk.reset_db(), passOnVoid)
   await wait(undefined, 250)
+
+  // Prevent test-triggered notifications (e.g. timeTrackRejected, inbound-message
+  // notifications) from enqueuing real notification emails to SQS for the primary
+  // test accounts. On-the-fly test users already set this flag individually.
+  // Set after the final reset_db so it isn't wiped by the reset.
+  await Promise.all([
+    sdk.api.users.updateOne(sdk.userInfo.id, { notificationEmailsDisabled: true }),
+    sdk.api.users.updateOne(sdkNonAdmin.userInfo.id, { notificationEmailsDisabled: true }),
+  ]).catch(console.error)
 }

package/src/tests/tests.ts

@@ -100,6 +100,10 @@ import { invite_user_enumeration_tests } from "./api_tests/security/F-0007-invit
 import { handle_incoming_communication_cross_tenant_tests } from "./api_tests/security/F-0008-handle-incoming-communication-cross-tenant.test";
 import { sanitize_user_html_xss_tests } from "./api_tests/security/F-0013-sanitize-user-html.test";
 import { prototype_pollution_tests } from "./api_tests/security/F-0016-prototype-pollution.test";
+import { enduser_cross_create_tests } from "./api_tests/security/F-0116-F-0119-enduser-cross-create.test";
+import { globalunique_leak_tests } from "./api_tests/security/F-0145-globalunique-leak.test";
+import { load_inbox_redaction_tests } from "./api_tests/security/F-0151-load-inbox-redaction.test";
+import { webhook_timeout_tests } from "./api_tests/security/F-0155-webhook-timeout.test";
 import { bulk_assignment_tests } from "./api_tests/bulk_assignment.test";
 import { managed_content_enduser_access_tests } from "./api_tests/managed_content_enduser_access.test";
 import { managed_content_file_access_tests } from "./api_tests/managed_content_file_access.test";
@@ -116,6 +120,7 @@ import { organization_settings_duplicates_tests } from "./api_tests/organization
 import { calendar_events_bulk_update_tests } from "./api_tests/calendar_events_bulk_update.test";
 import { openloop_webhooks_tests } from "./api_tests/openloop_webhooks.test";
 import { beluga_pharmacy_mappings_tests } from "./api_tests/beluga_pharmacy_mappings.test";
+import { mdi_case_offerings_tests } from "./api_tests/mdi_case_offerings.test";
 import { beluga_manual_sync_tests } from "./api_tests/beluga_manual_sync.test";
 import { mdi_webhooks_tests } from "./api_tests/mdi_webhooks.test";
 import { account_switcher_tests } from "./api_tests/account_switcher.test";
@@ -14840,7 +14845,12 @@ const ip_address_form_tests = async () => {
     await resource_access_tags_tests({ sdk, sdkNonAdmin })
     await beluga_manual_sync_tests({ sdk, sdkNonAdmin })
     await beluga_pharmacy_mappings_tests({ sdk, sdkNonAdmin })
+    await mdi_case_offerings_tests({ sdk, sdkNonAdmin })
     await enduser_write_restrictions_tests({ sdk, sdkNonAdmin })
+    await enduser_cross_create_tests({ sdk, sdkNonAdmin })
+    await globalunique_leak_tests({ sdk, sdkNonAdmin })
+    await load_inbox_redaction_tests({ sdk, sdkNonAdmin })
+    await webhook_timeout_tests({ sdk, sdkNonAdmin })
     await user_portal_settings_tests({ sdk, sdkNonAdmin })
     await automation_trigger_tests()
     await invite_user_enumeration_tests({ sdk, sdkNonAdmin })