@tellescope/sdk 1.254.0 → 1.255.0

package/src/tests/api_tests/security/F-0116-F-0119-enduser-cross-create.test.ts

@@ -0,0 +1,221 @@
+require('source-map-support').install();
+
+import { Session, EnduserSession } from "../../../sdk"
+import {
+  async_test,
+  log_header,
+} from "@tellescope/testing"
+import { setup_tests } from "../../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+const businessId = '60398b1131a295e64f084ff6'
+
+const ENDUSER_PASSWORD = 'F0116TestPassword!123'
+
+const CROSS_ENDUSER_MESSAGE = "enduserId does not match creator id for enduser session"
+
+/**
+ * Regression test for the enduser cross-enduser CREATE gating gaps:
+ *   F-0116 enduser_observations  (security-audit/findings/F-0116-*.md)
+ *   F-0117 enduser_orders        (security-audit/findings/F-0117-*.md)
+ *   F-0119 managed_content_records (security-audit/findings/F-0119-*.md)
+ *   F-0118 chat_rooms (enduserIds-only gate; staff userIds targeting is by-design)
+ *
+ * Each model exposed enduserActions.create with an `enduserId`/`enduserIds` field that
+ * lacked a write-side gate, letting an authenticated enduser create records bound to a
+ * DIFFERENT enduser in the same tenant. The fix adds a `constraints.relationship`
+ * evaluator mirroring the canonical `tickets` pattern (schema.ts).
+ *
+ * Methodology: each section asserts BOTH the exploit-is-blocked case AND that the
+ * legitimate path (self-create + staff-create) still works.
+ */
+export const enduser_cross_create_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("F-0116/F-0117/F-0118/F-0119: enduser cross-enduser create gates")
+
+  let attackerId: string | undefined
+  let victimId: string | undefined
+  const createdObservationIds: string[] = []
+  const createdOrderIds: string[] = []
+  const createdContentIds: string[] = []
+  const createdRoomIds: string[] = []
+
+  try {
+    // ---- Setup: attacker enduser (with portal session) + victim enduser ----
+    const attackerEmail = `f0116-attacker-${Date.now()}@example.com`
+    const victimEmail = `f0116-victim-${Date.now()}@example.com`
+    const attacker = await sdk.api.endusers.createOne({ email: attackerEmail, fname: 'F0116', lname: 'Attacker' })
+    attackerId = attacker.id
+    const victim = await sdk.api.endusers.createOne({ email: victimEmail, fname: 'F0116', lname: 'Victim' })
+    victimId = victim.id
+    await sdk.api.endusers.set_password({ id: attacker.id, password: ENDUSER_PASSWORD })
+
+    const attackerSDK = new EnduserSession({ host, businessId })
+    await attackerSDK.authenticate(attackerEmail, ENDUSER_PASSWORD)
+
+    // ============================================================
+    // F-0116 — enduser_observations
+    // ============================================================
+    await async_test(
+      `F-0116: enduser cannot create observation on another enduser (createOne)`,
+      () => attackerSDK.api.enduser_observations.createOne({
+        enduserId: victimId!, category: 'vital-signs', status: 'final',
+        measurement: { unit: 'mmHg', value: 220 },
+      } as any),
+      { shouldError: true, onError: e => e.message === CROSS_ENDUSER_MESSAGE },
+    )
+    await async_test(
+      `F-0116: enduser cannot create observation on another enduser (createMany)`,
+      () => attackerSDK.api.enduser_observations.createSome([{
+        enduserId: victimId!, category: 'vital-signs', status: 'final',
+        measurement: { unit: 'mmHg', value: 220 },
+      }] as any),
+      { shouldError: true, onError: e => e.message === CROSS_ENDUSER_MESSAGE },
+    )
+
+    // Positive control: enduser CAN create an observation on their OWN record
+    await async_test(
+      `F-0116: enduser can still create observation on own record`,
+      () => attackerSDK.api.enduser_observations.createOne({
+        enduserId: attackerId!, category: 'vital-signs', status: 'final',
+        measurement: { unit: 'mmHg', value: 120 },
+      } as any),
+      { onResult: (o: any) => { if (o?.id) createdObservationIds.push(o.id); return o?.enduserId === attackerId } },
+    )
+    // Positive control: staff CAN create an observation on any tenant enduser
+    await async_test(
+      `F-0116: staff can still create observation on any enduser`,
+      () => sdk.api.enduser_observations.createOne({
+        enduserId: victimId!, category: 'vital-signs', status: 'final',
+        measurement: { unit: 'mmHg', value: 118 },
+      } as any),
+      { onResult: (o: any) => { if (o?.id) createdObservationIds.push(o.id); return o?.enduserId === victimId } },
+    )
+
+    // ============================================================
+    // F-0117 — enduser_orders
+    // ============================================================
+    const orderPayload = (enduserId: string) => ({
+      enduserId, externalId: `f0117-${Date.now()}`, source: 'f0117-source',
+      title: 'f0117 order', status: 'pending',
+    })
+    await async_test(
+      `F-0117: enduser cannot create order on another enduser`,
+      () => attackerSDK.api.enduser_orders.createOne(orderPayload(victimId!) as any),
+      { shouldError: true, onError: e => e.message === CROSS_ENDUSER_MESSAGE },
+    )
+    await async_test(
+      `F-0117: enduser can still create order on own record`,
+      () => attackerSDK.api.enduser_orders.createOne(orderPayload(attackerId!) as any),
+      { onResult: (o: any) => { if (o?.id) createdOrderIds.push(o.id); return o?.enduserId === attackerId } },
+    )
+    await async_test(
+      `F-0117: staff can still create order on any enduser`,
+      () => sdk.api.enduser_orders.createOne(orderPayload(victimId!) as any),
+      { onResult: (o: any) => { if (o?.id) createdOrderIds.push(o.id); return o?.enduserId === victimId } },
+    )
+
+    // ============================================================
+    // F-0119 — managed_content_records
+    // ============================================================
+    await async_test(
+      `F-0119: enduser cannot create content with allowUnauthenticatedAccess`,
+      () => attackerSDK.api.managed_content_records.createOne({
+        title: 'f0119 phishing', textContent: 'x', allowUnauthenticatedAccess: true,
+      } as any),
+      { shouldError: true, onError: e => e.message === "allowUnauthenticatedAccess cannot be set by endusers" },
+    )
+    await async_test(
+      `F-0119: enduser cannot create content with publicRead`,
+      () => attackerSDK.api.managed_content_records.createOne({
+        title: 'f0119 broadcast', textContent: 'x', publicRead: true,
+      } as any),
+      { shouldError: true, onError: e => e.message === "publicRead cannot be set by endusers" },
+    )
+    await async_test(
+      `F-0119: enduser cannot create content bound to another enduser`,
+      () => attackerSDK.api.managed_content_records.createOne({
+        title: 'f0119 cross', textContent: 'x', enduserId: victimId!,
+      } as any),
+      { shouldError: true, onError: e => e.message === CROSS_ENDUSER_MESSAGE },
+    )
+    await async_test(
+      `F-0119: enduser can still create ordinary content`,
+      () => attackerSDK.api.managed_content_records.createOne({
+        title: 'f0119 ok', textContent: 'hello',
+      } as any),
+      { onResult: (o: any) => { if (o?.id) createdContentIds.push(o.id); return !o?.publicRead && !o?.allowUnauthenticatedAccess } },
+    )
+    await async_test(
+      `F-0119: staff can still create public content`,
+      () => sdk.api.managed_content_records.createOne({
+        title: 'f0119 staff public', textContent: 'x', publicRead: true,
+      } as any),
+      { onResult: (o: any) => { if (o?.id) createdContentIds.push(o.id); return o?.publicRead === true } },
+    )
+
+    // ============================================================
+    // F-0118 — chat_rooms (enduserIds-only gate; staff userIds targeting is by-design)
+    // ============================================================
+    const staffId = sdk.userInfo.id
+    await async_test(
+      `F-0118: enduser cannot add another patient to a chat room (enduserIds)`,
+      () => attackerSDK.api.chat_rooms.createOne({
+        type: 'internal', enduserIds: [attackerId!, victimId!], userIds: [staffId],
+      } as any),
+      { shouldError: true, onError: e => e.message === "enduserIds may only contain your own id for enduser session" },
+    )
+    // Positive control: patient CAN create a room with care-team staff + self (intended feature)
+    await async_test(
+      `F-0118: enduser can still create a room with staff + self`,
+      () => attackerSDK.api.chat_rooms.createOne({
+        type: 'internal', enduserIds: [attackerId!], userIds: [staffId],
+      } as any),
+      { onResult: (o: any) => { if (o?.id) createdRoomIds.push(o.id); return o?.enduserIds?.length === 1 && o?.userIds?.includes(staffId) } },
+    )
+    // Positive control: staff can still create multi-patient rooms
+    await async_test(
+      `F-0118: staff can still create a room with multiple endusers`,
+      () => sdk.api.chat_rooms.createOne({
+        type: 'internal', enduserIds: [attackerId!, victimId!], userIds: [staffId],
+      } as any),
+      { onResult: (o: any) => { if (o?.id) createdRoomIds.push(o.id); return o?.enduserIds?.length === 2 } },
+    )
+  } finally {
+    for (const id of createdRoomIds) {
+      try { await sdk.api.chat_rooms.deleteOne(id) } catch {}
+    }
+    for (const id of createdContentIds) {
+      try { await sdk.api.managed_content_records.deleteOne(id) } catch {}
+    }
+    for (const id of createdObservationIds) {
+      try { await sdk.api.enduser_observations.deleteOne(id) } catch {}
+    }
+    for (const id of createdOrderIds) {
+      try { await sdk.api.enduser_orders.deleteOne(id) } catch {}
+    }
+    if (attackerId) { try { await sdk.api.endusers.deleteOne(attackerId) } catch {} }
+    if (victimId) { try { await sdk.api.endusers.deleteOne(victimId) } catch {} }
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await enduser_cross_create_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ F-0116/F-0117/F-0118/F-0119 enduser cross-create test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ enduser cross-create test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/security/F-0145-globalunique-leak.test.ts

@@ -0,0 +1,78 @@
+require('source-map-support').install();
+
+import { Session } from "../../../sdk"
+import {
+  async_test,
+  log_header,
+} from "@tellescope/testing"
+import { setup_tests } from "../../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+/**
+ * Regression test for F-0145
+ * (security-audit/findings/F-0145-globalunique-conflict-leaks-cross-tenant-record.md).
+ *
+ * The create endpoint generator's unconditional globalUnique-enforcement block
+ * (routing.ts, "globalUnique should be enforced even if _overrideUnique is true")
+ * threw uniquenessError([{ existingRecord: matches[0] }]) with the RAW matched record.
+ * `findSomeByMatchAny_Global` deletes businessId, so the match is global; for `users`
+ * (globalUnique: ['email','phone']) the 409 body leaked the full record incl. hashedPass.
+ *
+ * Fix: redact existingRecord to { _id, businessId } like the safe validateUniquenessConstraints
+ * path. This reproduces the leak with a same-tenant collision (same code path) and asserts the
+ * 409 body's existingRecord exposes nothing beyond _id + businessId.
+ */
+export const globalunique_leak_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("F-0145: globalUnique conflict response redaction")
+
+  let userId: string | undefined
+  try {
+    const email = `f0145-victim-${Date.now()}@example.com`
+    const user = await sdk.api.users.createOne({ email } as any)
+    userId = user.id
+
+    await async_test(
+      'F-0145: globalUnique 409 existingRecord exposes only _id + businessId (no email/hashedPass)',
+      () => sdk.api.users.createOne({ email, _overrideUnique: true } as any),
+      {
+        shouldError: true,
+        onError: (e: any) => {
+          const rec = e?.info?.[0]?.existingRecord
+          if (!rec || typeof rec !== 'object') return false
+          const keys = Object.keys(rec)
+          return (
+            keys.length > 0
+            && keys.every(k => k === '_id' || k === 'businessId' || k === 'id')
+            && !('email' in rec)
+            && !('hashedPass' in rec)
+            && !('hashedInviteCode' in rec)
+          )
+        },
+      },
+    )
+  } finally {
+    if (userId) { try { await sdk.api.users.deleteOne(userId) } catch {} }
+  }
+}
+
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await globalunique_leak_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ F-0145 globalUnique leak test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ F-0145 globalUnique leak test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/security/F-0151-load-inbox-redaction.test.ts

@@ -0,0 +1,81 @@
+require('source-map-support').install();
+
+import { Session } from "../../../sdk"
+import {
+  async_test,
+  log_header,
+} from "@tellescope/testing"
+import { setup_tests } from "../../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const ENDUSER_PASSWORD = 'F0151TestPassword!123'
+
+/**
+ * Regression test for F-0151
+ * (security-audit/findings/F-0151-load-inbox-data-endusers-unredacted.md).
+ *
+ * load_inbox_data serialized $lookup'ed endusers via convert_id_name only (NOT applyRedactions),
+ * so endusers.hashedPassword (redactions:['all']) leaked to staff sessions — while the sibling
+ * phone_calls in the same response correctly went through applyRedactions.
+ *
+ * Repro: create an enduser, set their portal password (→ hashedPassword), seed an inbound
+ * (logOnly) email so the enduser appears in the inbox join, then load_inbox_data as staff and
+ * assert the returned enduser entry has NO hashedPassword.
+ */
+export const load_inbox_redaction_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("F-0151: load_inbox_data enduser redaction")
+
+  let enduserId: string | undefined
+  let emailId: string | undefined
+  try {
+    const email = `f0151-enduser-${Date.now()}@example.com`
+    const enduser = await sdk.api.endusers.createOne({ email, fname: 'F0151', lname: 'Inbox' })
+    enduserId = enduser.id
+    await sdk.api.endusers.set_password({ id: enduser.id, password: ENDUSER_PASSWORD })
+
+    // Seed an inbound logOnly email so the enduser is joined into the inbox payload
+    const seeded = await sdk.api.emails.createOne({
+      enduserId: enduser.id, subject: 'F0151 seed', textContent: 'seed',
+      logOnly: true, inbound: true,
+    } as any)
+    emailId = seeded.id
+
+    await async_test(
+      'F-0151: load_inbox_data does not leak enduser.hashedPassword to staff',
+      () => sdk.api.endusers.load_inbox_data({ enduserIds: [enduser.id] } as any),
+      {
+        onResult: (r: any) => {
+          const returned = (r?.endusers ?? []).find((e: any) => (e.id || e._id)?.toString() === enduserId)
+          // require that the enduser actually came back (so the assertion is meaningful),
+          // and that hashedPassword is absent
+          return !!returned && !('hashedPassword' in returned)
+        },
+      },
+    )
+  } finally {
+    if (emailId) { try { await sdk.api.emails.deleteOne(emailId) } catch {} }
+    if (enduserId) { try { await sdk.api.endusers.deleteOne(enduserId) } catch {} }
+  }
+}
+
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await load_inbox_redaction_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ F-0151 load_inbox_data redaction test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ F-0151 load_inbox_data redaction test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/security/F-0155-webhook-timeout.test.ts

@@ -0,0 +1,85 @@
+require('source-map-support').install();
+
+import http from "http"
+import { Session } from "../../../sdk"
+import {
+  async_test,
+  log_header,
+} from "@tellescope/testing"
+import { setup_tests } from "../../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+// The server-side axios timeout is 15s (F-0155 fix). We bound our own wait above that.
+const CLIENT_WAIT_MS = 20_000
+
+/**
+ * Regression test for F-0155
+ * (security-audit/findings/F-0155-outbound-webhook-no-timeout-slow-loris.md).
+ *
+ * Outbound webhook delivery used axios.post(url, ...) with no `timeout` (axios default = infinite).
+ * A tenant-controlled receiver that accepts the connection and never responds hangs the awaited
+ * request indefinitely (slow-loris → worker exhaustion). Fix: timeout: 15_000 on the axios calls.
+ *
+ * Repro: stand up a local HTTP server that accepts the connection but NEVER responds, point
+ * send_automation_webhook (which awaits the axios call) at it, and race the call against a 20s
+ * client timer.
+ *   - green (fixed):  server times out at ~15s → handler returns 400 → SDK call rejects < 20s
+ *   - red  (unfixed): the call is still pending at 20s → client timer wins
+ */
+export const webhook_timeout_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("F-0155: outbound webhook timeout")
+
+  let enduserId: string | undefined
+  const slowServer = http.createServer(() => { /* accept connection, never respond */ })
+
+  try {
+    await new Promise<void>(resolve => slowServer.listen(0, '127.0.0.1', () => resolve()))
+    const port = (slowServer.address() as any).port
+    const blackholeUrl = `http://127.0.0.1:${port}/hook`
+
+    const enduser = await sdk.api.endusers.createOne({ email: `f0155-${Date.now()}@example.com`, fname: 'F0155', lname: 'Webhook' })
+    enduserId = enduser.id
+
+    await async_test(
+      'F-0155: outbound webhook to a non-responding receiver times out server-side (does not hang)',
+      async () => {
+        const start = Date.now()
+        const outcome = await Promise.race([
+          sdk.api.webhooks.send_automation_webhook({
+            enduserId: enduser.id,
+            action: { info: { url: blackholeUrl } },
+          } as any).then(() => 'completed').catch(() => 'errored'),
+          new Promise<string>(r => setTimeout(() => r('client-timeout'), CLIENT_WAIT_MS)),
+        ])
+        return { outcome, elapsed: Date.now() - start }
+      },
+      // green: the server-side axios timeout fired (call settled) before our 20s client wait
+      { onResult: (r: any) => r.outcome !== 'client-timeout' && r.elapsed < CLIENT_WAIT_MS },
+    )
+  } finally {
+    slowServer.close()
+    if (enduserId) { try { await sdk.api.endusers.deleteOne(enduserId) } catch {} }
+  }
+}
+
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await webhook_timeout_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ F-0155 webhook timeout test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ F-0155 webhook timeout test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/setup.ts

@@ -150,4 +150,13 @@ export const setup_tests = async (sdk: Session, sdkNonAdmin: Session) => {
   // may do some stuff in background after returning
   await async_test('reset_db', () => sdk.reset_db(), passOnVoid)
   await wait(undefined, 250)
+
+  // Prevent test-triggered notifications (e.g. timeTrackRejected, inbound-message
+  // notifications) from enqueuing real notification emails to SQS for the primary
+  // test accounts. On-the-fly test users already set this flag individually.
+  // Set after the final reset_db so it isn't wiped by the reset.
+  await Promise.all([
+    sdk.api.users.updateOne(sdk.userInfo.id, { notificationEmailsDisabled: true }),
+    sdk.api.users.updateOne(sdkNonAdmin.userInfo.id, { notificationEmailsDisabled: true }),
+  ]).catch(console.error)
 }