@tellescope/sdk 1.254.0 → 1.255.0

package/lib/cjs/tests/api_tests/security/F-0116-F-0119-enduser-cross-create.test.js

@@ -0,0 +1,362 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.enduser_cross_create_tests = void 0;
+require('source-map-support').install();
+var sdk_1 = require("../../../sdk");
+var testing_1 = require("@tellescope/testing");
+var setup_1 = require("../../setup");
+var host = process.env.API_URL || 'http://localhost:8080';
+var businessId = '60398b1131a295e64f084ff6';
+var ENDUSER_PASSWORD = 'F0116TestPassword!123';
+var CROSS_ENDUSER_MESSAGE = "enduserId does not match creator id for enduser session";
+/**
+ * Regression test for the enduser cross-enduser CREATE gating gaps:
+ *   F-0116 enduser_observations  (security-audit/findings/F-0116-*.md)
+ *   F-0117 enduser_orders        (security-audit/findings/F-0117-*.md)
+ *   F-0119 managed_content_records (security-audit/findings/F-0119-*.md)
+ *   F-0118 chat_rooms (enduserIds-only gate; staff userIds targeting is by-design)
+ *
+ * Each model exposed enduserActions.create with an `enduserId`/`enduserIds` field that
+ * lacked a write-side gate, letting an authenticated enduser create records bound to a
+ * DIFFERENT enduser in the same tenant. The fix adds a `constraints.relationship`
+ * evaluator mirroring the canonical `tickets` pattern (schema.ts).
+ *
+ * Methodology: each section asserts BOTH the exploit-is-blocked case AND that the
+ * legitimate path (self-create + staff-create) still works.
+ */
+var enduser_cross_create_tests = function (_a) {
+    var sdk = _a.sdk;
+    return __awaiter(void 0, void 0, void 0, function () {
+        var attackerId, victimId, createdObservationIds, createdOrderIds, createdContentIds, createdRoomIds, attackerEmail, victimEmail, attacker, victim, attackerSDK_1, orderPayload_1, staffId_1, _i, createdRoomIds_1, id, _b, _c, createdContentIds_1, id, _d, _e, createdObservationIds_1, id, _f, _g, createdOrderIds_1, id, _h, _j, _k;
+        return __generator(this, function (_l) {
+            switch (_l.label) {
+                case 0:
+                    (0, testing_1.log_header)("F-0116/F-0117/F-0118/F-0119: enduser cross-enduser create gates");
+                    createdObservationIds = [];
+                    createdOrderIds = [];
+                    createdContentIds = [];
+                    createdRoomIds = [];
+                    _l.label = 1;
+                case 1:
+                    _l.trys.push([1, , 21, 54]);
+                    attackerEmail = "f0116-attacker-".concat(Date.now(), "@example.com");
+                    victimEmail = "f0116-victim-".concat(Date.now(), "@example.com");
+                    return [4 /*yield*/, sdk.api.endusers.createOne({ email: attackerEmail, fname: 'F0116', lname: 'Attacker' })];
+                case 2:
+                    attacker = _l.sent();
+                    attackerId = attacker.id;
+                    return [4 /*yield*/, sdk.api.endusers.createOne({ email: victimEmail, fname: 'F0116', lname: 'Victim' })];
+                case 3:
+                    victim = _l.sent();
+                    victimId = victim.id;
+                    return [4 /*yield*/, sdk.api.endusers.set_password({ id: attacker.id, password: ENDUSER_PASSWORD })];
+                case 4:
+                    _l.sent();
+                    attackerSDK_1 = new sdk_1.EnduserSession({ host: host, businessId: businessId });
+                    return [4 /*yield*/, attackerSDK_1.authenticate(attackerEmail, ENDUSER_PASSWORD)
+                        // ============================================================
+                        // F-0116 — enduser_observations
+                        // ============================================================
+                    ];
+                case 5:
+                    _l.sent();
+                    // ============================================================
+                    // F-0116 — enduser_observations
+                    // ============================================================
+                    return [4 /*yield*/, (0, testing_1.async_test)("F-0116: enduser cannot create observation on another enduser (createOne)", function () { return attackerSDK_1.api.enduser_observations.createOne({
+                            enduserId: victimId, category: 'vital-signs', status: 'final',
+                            measurement: { unit: 'mmHg', value: 220 },
+                        }); }, { shouldError: true, onError: function (e) { return e.message === CROSS_ENDUSER_MESSAGE; } })];
+                case 6:
+                    // ============================================================
+                    // F-0116 — enduser_observations
+                    // ============================================================
+                    _l.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)("F-0116: enduser cannot create observation on another enduser (createMany)", function () { return attackerSDK_1.api.enduser_observations.createSome([{
+                                enduserId: victimId, category: 'vital-signs', status: 'final',
+                                measurement: { unit: 'mmHg', value: 220 },
+                            }]); }, { shouldError: true, onError: function (e) { return e.message === CROSS_ENDUSER_MESSAGE; } })
+                        // Positive control: enduser CAN create an observation on their OWN record
+                    ];
+                case 7:
+                    _l.sent();
+                    // Positive control: enduser CAN create an observation on their OWN record
+                    return [4 /*yield*/, (0, testing_1.async_test)("F-0116: enduser can still create observation on own record", function () { return attackerSDK_1.api.enduser_observations.createOne({
+                            enduserId: attackerId, category: 'vital-signs', status: 'final',
+                            measurement: { unit: 'mmHg', value: 120 },
+                        }); }, { onResult: function (o) { if (o === null || o === void 0 ? void 0 : o.id)
+                                createdObservationIds.push(o.id); return (o === null || o === void 0 ? void 0 : o.enduserId) === attackerId; } })
+                        // Positive control: staff CAN create an observation on any tenant enduser
+                    ];
+                case 8:
+                    // Positive control: enduser CAN create an observation on their OWN record
+                    _l.sent();
+                    // Positive control: staff CAN create an observation on any tenant enduser
+                    return [4 /*yield*/, (0, testing_1.async_test)("F-0116: staff can still create observation on any enduser", function () { return sdk.api.enduser_observations.createOne({
+                            enduserId: victimId, category: 'vital-signs', status: 'final',
+                            measurement: { unit: 'mmHg', value: 118 },
+                        }); }, { onResult: function (o) { if (o === null || o === void 0 ? void 0 : o.id)
+                                createdObservationIds.push(o.id); return (o === null || o === void 0 ? void 0 : o.enduserId) === victimId; } })
+                        // ============================================================
+                        // F-0117 — enduser_orders
+                        // ============================================================
+                    ];
+                case 9:
+                    // Positive control: staff CAN create an observation on any tenant enduser
+                    _l.sent();
+                    orderPayload_1 = function (enduserId) { return ({
+                        enduserId: enduserId,
+                        externalId: "f0117-".concat(Date.now()), source: 'f0117-source',
+                        title: 'f0117 order', status: 'pending',
+                    }); };
+                    return [4 /*yield*/, (0, testing_1.async_test)("F-0117: enduser cannot create order on another enduser", function () { return attackerSDK_1.api.enduser_orders.createOne(orderPayload_1(victimId)); }, { shouldError: true, onError: function (e) { return e.message === CROSS_ENDUSER_MESSAGE; } })];
+                case 10:
+                    _l.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)("F-0117: enduser can still create order on own record", function () { return attackerSDK_1.api.enduser_orders.createOne(orderPayload_1(attackerId)); }, { onResult: function (o) { if (o === null || o === void 0 ? void 0 : o.id)
+                                createdOrderIds.push(o.id); return (o === null || o === void 0 ? void 0 : o.enduserId) === attackerId; } })];
+                case 11:
+                    _l.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)("F-0117: staff can still create order on any enduser", function () { return sdk.api.enduser_orders.createOne(orderPayload_1(victimId)); }, { onResult: function (o) { if (o === null || o === void 0 ? void 0 : o.id)
+                                createdOrderIds.push(o.id); return (o === null || o === void 0 ? void 0 : o.enduserId) === victimId; } })
+                        // ============================================================
+                        // F-0119 — managed_content_records
+                        // ============================================================
+                    ];
+                case 12:
+                    _l.sent();
+                    // ============================================================
+                    // F-0119 — managed_content_records
+                    // ============================================================
+                    return [4 /*yield*/, (0, testing_1.async_test)("F-0119: enduser cannot create content with allowUnauthenticatedAccess", function () { return attackerSDK_1.api.managed_content_records.createOne({
+                            title: 'f0119 phishing', textContent: 'x', allowUnauthenticatedAccess: true,
+                        }); }, { shouldError: true, onError: function (e) { return e.message === "allowUnauthenticatedAccess cannot be set by endusers"; } })];
+                case 13:
+                    // ============================================================
+                    // F-0119 — managed_content_records
+                    // ============================================================
+                    _l.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)("F-0119: enduser cannot create content with publicRead", function () { return attackerSDK_1.api.managed_content_records.createOne({
+                            title: 'f0119 broadcast', textContent: 'x', publicRead: true,
+                        }); }, { shouldError: true, onError: function (e) { return e.message === "publicRead cannot be set by endusers"; } })];
+                case 14:
+                    _l.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)("F-0119: enduser cannot create content bound to another enduser", function () { return attackerSDK_1.api.managed_content_records.createOne({
+                            title: 'f0119 cross', textContent: 'x', enduserId: victimId,
+                        }); }, { shouldError: true, onError: function (e) { return e.message === CROSS_ENDUSER_MESSAGE; } })];
+                case 15:
+                    _l.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)("F-0119: enduser can still create ordinary content", function () { return attackerSDK_1.api.managed_content_records.createOne({
+                            title: 'f0119 ok', textContent: 'hello',
+                        }); }, { onResult: function (o) { if (o === null || o === void 0 ? void 0 : o.id)
+                                createdContentIds.push(o.id); return !(o === null || o === void 0 ? void 0 : o.publicRead) && !(o === null || o === void 0 ? void 0 : o.allowUnauthenticatedAccess); } })];
+                case 16:
+                    _l.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)("F-0119: staff can still create public content", function () { return sdk.api.managed_content_records.createOne({
+                            title: 'f0119 staff public', textContent: 'x', publicRead: true,
+                        }); }, { onResult: function (o) { if (o === null || o === void 0 ? void 0 : o.id)
+                                createdContentIds.push(o.id); return (o === null || o === void 0 ? void 0 : o.publicRead) === true; } })
+                        // ============================================================
+                        // F-0118 — chat_rooms (enduserIds-only gate; staff userIds targeting is by-design)
+                        // ============================================================
+                    ];
+                case 17:
+                    _l.sent();
+                    staffId_1 = sdk.userInfo.id;
+                    return [4 /*yield*/, (0, testing_1.async_test)("F-0118: enduser cannot add another patient to a chat room (enduserIds)", function () { return attackerSDK_1.api.chat_rooms.createOne({
+                            type: 'internal', enduserIds: [attackerId, victimId], userIds: [staffId_1],
+                        }); }, { shouldError: true, onError: function (e) { return e.message === "enduserIds may only contain your own id for enduser session"; } })
+                        // Positive control: patient CAN create a room with care-team staff + self (intended feature)
+                    ];
+                case 18:
+                    _l.sent();
+                    // Positive control: patient CAN create a room with care-team staff + self (intended feature)
+                    return [4 /*yield*/, (0, testing_1.async_test)("F-0118: enduser can still create a room with staff + self", function () { return attackerSDK_1.api.chat_rooms.createOne({
+                            type: 'internal', enduserIds: [attackerId], userIds: [staffId_1],
+                        }); }, { onResult: function (o) { var _a, _b; if (o === null || o === void 0 ? void 0 : o.id)
+                                createdRoomIds.push(o.id); return ((_a = o === null || o === void 0 ? void 0 : o.enduserIds) === null || _a === void 0 ? void 0 : _a.length) === 1 && ((_b = o === null || o === void 0 ? void 0 : o.userIds) === null || _b === void 0 ? void 0 : _b.includes(staffId_1)); } })
+                        // Positive control: staff can still create multi-patient rooms
+                    ];
+                case 19:
+                    // Positive control: patient CAN create a room with care-team staff + self (intended feature)
+                    _l.sent();
+                    // Positive control: staff can still create multi-patient rooms
+                    return [4 /*yield*/, (0, testing_1.async_test)("F-0118: staff can still create a room with multiple endusers", function () { return sdk.api.chat_rooms.createOne({
+                            type: 'internal', enduserIds: [attackerId, victimId], userIds: [staffId_1],
+                        }); }, { onResult: function (o) { var _a; if (o === null || o === void 0 ? void 0 : o.id)
+                                createdRoomIds.push(o.id); return ((_a = o === null || o === void 0 ? void 0 : o.enduserIds) === null || _a === void 0 ? void 0 : _a.length) === 2; } })];
+                case 20:
+                    // Positive control: staff can still create multi-patient rooms
+                    _l.sent();
+                    return [3 /*break*/, 54];
+                case 21:
+                    _i = 0, createdRoomIds_1 = createdRoomIds;
+                    _l.label = 22;
+                case 22:
+                    if (!(_i < createdRoomIds_1.length)) return [3 /*break*/, 27];
+                    id = createdRoomIds_1[_i];
+                    _l.label = 23;
+                case 23:
+                    _l.trys.push([23, 25, , 26]);
+                    return [4 /*yield*/, sdk.api.chat_rooms.deleteOne(id)];
+                case 24:
+                    _l.sent();
+                    return [3 /*break*/, 26];
+                case 25:
+                    _b = _l.sent();
+                    return [3 /*break*/, 26];
+                case 26:
+                    _i++;
+                    return [3 /*break*/, 22];
+                case 27:
+                    _c = 0, createdContentIds_1 = createdContentIds;
+                    _l.label = 28;
+                case 28:
+                    if (!(_c < createdContentIds_1.length)) return [3 /*break*/, 33];
+                    id = createdContentIds_1[_c];
+                    _l.label = 29;
+                case 29:
+                    _l.trys.push([29, 31, , 32]);
+                    return [4 /*yield*/, sdk.api.managed_content_records.deleteOne(id)];
+                case 30:
+                    _l.sent();
+                    return [3 /*break*/, 32];
+                case 31:
+                    _d = _l.sent();
+                    return [3 /*break*/, 32];
+                case 32:
+                    _c++;
+                    return [3 /*break*/, 28];
+                case 33:
+                    _e = 0, createdObservationIds_1 = createdObservationIds;
+                    _l.label = 34;
+                case 34:
+                    if (!(_e < createdObservationIds_1.length)) return [3 /*break*/, 39];
+                    id = createdObservationIds_1[_e];
+                    _l.label = 35;
+                case 35:
+                    _l.trys.push([35, 37, , 38]);
+                    return [4 /*yield*/, sdk.api.enduser_observations.deleteOne(id)];
+                case 36:
+                    _l.sent();
+                    return [3 /*break*/, 38];
+                case 37:
+                    _f = _l.sent();
+                    return [3 /*break*/, 38];
+                case 38:
+                    _e++;
+                    return [3 /*break*/, 34];
+                case 39:
+                    _g = 0, createdOrderIds_1 = createdOrderIds;
+                    _l.label = 40;
+                case 40:
+                    if (!(_g < createdOrderIds_1.length)) return [3 /*break*/, 45];
+                    id = createdOrderIds_1[_g];
+                    _l.label = 41;
+                case 41:
+                    _l.trys.push([41, 43, , 44]);
+                    return [4 /*yield*/, sdk.api.enduser_orders.deleteOne(id)];
+                case 42:
+                    _l.sent();
+                    return [3 /*break*/, 44];
+                case 43:
+                    _h = _l.sent();
+                    return [3 /*break*/, 44];
+                case 44:
+                    _g++;
+                    return [3 /*break*/, 40];
+                case 45:
+                    if (!attackerId) return [3 /*break*/, 49];
+                    _l.label = 46;
+                case 46:
+                    _l.trys.push([46, 48, , 49]);
+                    return [4 /*yield*/, sdk.api.endusers.deleteOne(attackerId)];
+                case 47:
+                    _l.sent();
+                    return [3 /*break*/, 49];
+                case 48:
+                    _j = _l.sent();
+                    return [3 /*break*/, 49];
+                case 49:
+                    if (!victimId) return [3 /*break*/, 53];
+                    _l.label = 50;
+                case 50:
+                    _l.trys.push([50, 52, , 53]);
+                    return [4 /*yield*/, sdk.api.endusers.deleteOne(victimId)];
+                case 51:
+                    _l.sent();
+                    return [3 /*break*/, 53];
+                case 52:
+                    _k = _l.sent();
+                    return [3 /*break*/, 53];
+                case 53: return [7 /*endfinally*/];
+                case 54: return [2 /*return*/];
+            }
+        });
+    });
+};
+exports.enduser_cross_create_tests = enduser_cross_create_tests;
+// Allow running this test file independently
+if (require.main === module) {
+    console.log("\uD83C\uDF10 Using API URL: ".concat(host));
+    var sdk_2 = new sdk_1.Session({ host: host });
+    var sdkNonAdmin_1 = new sdk_1.Session({ host: host });
+    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, (0, setup_1.setup_tests)(sdk_2, sdkNonAdmin_1)];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, (0, exports.enduser_cross_create_tests)({ sdk: sdk_2, sdkNonAdmin: sdkNonAdmin_1 })];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); };
+    runTests()
+        .then(function () {
+        console.log("✅ F-0116/F-0117/F-0118/F-0119 enduser cross-create test suite completed successfully");
+        process.exit(0);
+    })
+        .catch(function (error) {
+        console.error("❌ enduser cross-create test suite failed:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=F-0116-F-0119-enduser-cross-create.test.js.map

package/lib/cjs/tests/api_tests/security/F-0116-F-0119-enduser-cross-create.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"F-0116-F-0119-enduser-cross-create.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/F-0116-F-0119-enduser-cross-create.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,oCAAsD;AACtD,+CAG4B;AAC5B,qCAAyC;AAEzC,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AACpE,IAAM,UAAU,GAAG,0BAA0B,CAAA;AAE7C,IAAM,gBAAgB,GAAG,uBAAuB,CAAA;AAEhD,IAAM,qBAAqB,GAAG,yDAAyD,CAAA;AAEvF;;;;;;;;;;;;;;GAcG;AACI,IAAM,0BAA0B,GAAG,UAAO,EAAgD;QAA9C,GAAG,SAAA;;;;;;oBACpD,IAAA,oBAAU,EAAC,iEAAiE,CAAC,CAAA;oBAIvE,qBAAqB,GAAa,EAAE,CAAA;oBACpC,eAAe,GAAa,EAAE,CAAA;oBAC9B,iBAAiB,GAAa,EAAE,CAAA;oBAChC,cAAc,GAAa,EAAE,CAAA;;;;oBAI3B,aAAa,GAAG,yBAAkB,IAAI,CAAC,GAAG,EAAE,iBAAc,CAAA;oBAC1D,WAAW,GAAG,uBAAgB,IAAI,CAAC,GAAG,EAAE,iBAAc,CAAA;oBAC3C,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAA;;oBAAxG,QAAQ,GAAG,SAA6F;oBAC9G,UAAU,GAAG,QAAQ,CAAC,EAAE,CAAA;oBACT,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAA;;oBAAlG,MAAM,GAAG,SAAyF;oBACxG,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAA;oBACpB,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,EAAA;;oBAApF,SAAoF,CAAA;oBAE9E,gBAAc,IAAI,oBAAc,CAAC,EAAE,IAAI,MAAA,EAAE,UAAU,YAAA,EAAE,CAAC,CAAA;oBAC5D,qBAAM,aAAW,CAAC,YAAY,CAAC,aAAa,EAAE,gBAAgB,CAAC;wBAE/D,+DAA+D;wBAC/D,gCAAgC;wBAChC,+DAA+D;sBAJA;;oBAA/D,SAA+D,CAAA;oBAE/D,+DAA+D;oBAC/D,gCAAgC;oBAChC,+DAA+D;oBAC/D,qBAAM,IAAA,oBAAU,EACd,0EAA0E,EAC1E,cAAM,OAAA,aAAW,CAAC,GAAG,CAAC,oBAAoB,CAAC,SAAS,CAAC;4BACnD,SAAS,EAAE,QAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO;4BAC9D,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE;yBACnC,CAAC,EAHH,CAGG,EACT,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,OAAO,KAAK,qBAAqB,EAAnC,CAAmC,EAAE,CACzE,EAAA;;oBAVD,+DAA+D;oBAC/D,gCAAgC;oBAChC,+DAA+D;oBAC/D,SAOC,CAAA;oBACD,qBAAM,IAAA,oBAAU,EACd,2EAA2E,EAC3E,cAAM,OAAA,aAAW,CAAC,GAAG,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC;gCACrD,SAAS,EAAE,QAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO;gCAC9D,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE;6BAC1C,CAAQ,CAAC,EAHJ,CAGI,EACV,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,OAAO,KAAK,qBAAqB,EAAnC,CAAmC,EAAE,CACzE;wBAED,0EAA0E;sBAFzE;;oBAPD,SAOC,CAAA;oBAED,0EAA0E;oBAC1E,qBAAM,IAAA,oBAAU,EACd,4DAA4D,EAC5D,cAAM,OAAA,aAAW,CAAC,GAAG,CAAC,oBAAoB,CAAC,SAAS,CAAC;4BACnD,SAAS,EAAE,UAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO;4BAChE,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE;yBACnC,CAAC,EAHH,CAGG,EACT,EAAE,QAAQ,EAAE,UAAC,CAAM,IAAO,IAAI,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,EAAE;gCAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,SAAS,MAAK,UAAU,CAAA,CAAC,CAAC,EAAE,CAC9G;wBACD,0EAA0E;sBADzE;;oBARD,0EAA0E;oBAC1E,SAOC,CAAA;oBACD,0EAA0E;oBAC1E,qBAAM,IAAA,oBAAU,EACd,2DAA2D,EAC3D,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,SAAS,CAAC;4BAC3C,SAAS,EAAE,QAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO;4BAC9D,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE;yBACnC,CAAC,EAHH,CAGG,EACT,EAAE,QAAQ,EAAE,UAAC,CAAM,IAAO,IAAI,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,EAAE;gCAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,SAAS,MAAK,QAAQ,CAAA,CAAC,CAAC,EAAE,CAC5G;wBAED,+DAA+D;wBAC/D,0BAA0B;wBAC1B,+DAA+D;sBAJ9D;;oBARD,0EAA0E;oBAC1E,SAOC,CAAA;oBAKK,iBAAe,UAAC,SAAiB,IAAK,OAAA,CAAC;wBAC3C,SAAS,WAAA;wBAAE,UAAU,EAAE,gBAAS,IAAI,CAAC,GAAG,EAAE,CAAE,EAAE,MAAM,EAAE,cAAc;wBACpE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS;qBACxC,CAAC,EAH0C,CAG1C,CAAA;oBACF,qBAAM,IAAA,oBAAU,EACd,wDAAwD,EACxD,cAAM,OAAA,aAAW,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,cAAY,CAAC,QAAS,CAAQ,CAAC,EAAxE,CAAwE,EAC9E,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,OAAO,KAAK,qBAAqB,EAAnC,CAAmC,EAAE,CACzE,EAAA;;oBAJD,SAIC,CAAA;oBACD,qBAAM,IAAA,oBAAU,EACd,sDAAsD,EACtD,cAAM,OAAA,aAAW,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,cAAY,CAAC,UAAW,CAAQ,CAAC,EAA1E,CAA0E,EAChF,EAAE,QAAQ,EAAE,UAAC,CAAM,IAAO,IAAI,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,EAAE;gCAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,SAAS,MAAK,UAAU,CAAA,CAAC,CAAC,EAAE,CACxG,EAAA;;oBAJD,SAIC,CAAA;oBACD,qBAAM,IAAA,oBAAU,EACd,qDAAqD,EACrD,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,cAAY,CAAC,QAAS,CAAQ,CAAC,EAAhE,CAAgE,EACtE,EAAE,QAAQ,EAAE,UAAC,CAAM,IAAO,IAAI,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,EAAE;gCAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,SAAS,MAAK,QAAQ,CAAA,CAAC,CAAC,EAAE,CACtG;wBAED,+DAA+D;wBAC/D,mCAAmC;wBACnC,+DAA+D;sBAJ9D;;oBAJD,SAIC,CAAA;oBAED,+DAA+D;oBAC/D,mCAAmC;oBACnC,+DAA+D;oBAC/D,qBAAM,IAAA,oBAAU,EACd,uEAAuE,EACvE,cAAM,OAAA,aAAW,CAAC,GAAG,CAAC,uBAAuB,CAAC,SAAS,CAAC;4BACtD,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,EAAE,0BAA0B,EAAE,IAAI;yBACrE,CAAC,EAFH,CAEG,EACT,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,OAAO,KAAK,sDAAsD,EAApE,CAAoE,EAAE,CAC1G,EAAA;;oBATD,+DAA+D;oBAC/D,mCAAmC;oBACnC,+DAA+D;oBAC/D,SAMC,CAAA;oBACD,qBAAM,IAAA,oBAAU,EACd,uDAAuD,EACvD,cAAM,OAAA,aAAW,CAAC,GAAG,CAAC,uBAAuB,CAAC,SAAS,CAAC;4BACtD,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI;yBACtD,CAAC,EAFH,CAEG,EACT,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,OAAO,KAAK,sCAAsC,EAApD,CAAoD,EAAE,CAC1F,EAAA;;oBAND,SAMC,CAAA;oBACD,qBAAM,IAAA,oBAAU,EACd,gEAAgE,EAChE,cAAM,OAAA,aAAW,CAAC,GAAG,CAAC,uBAAuB,CAAC,SAAS,CAAC;4BACtD,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,EAAE,QAAS;yBACtD,CAAC,EAFH,CAEG,EACT,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,OAAO,KAAK,qBAAqB,EAAnC,CAAmC,EAAE,CACzE,EAAA;;oBAND,SAMC,CAAA;oBACD,qBAAM,IAAA,oBAAU,EACd,mDAAmD,EACnD,cAAM,OAAA,aAAW,CAAC,GAAG,CAAC,uBAAuB,CAAC,SAAS,CAAC;4BACtD,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO;yBACjC,CAAC,EAFH,CAEG,EACT,EAAE,QAAQ,EAAE,UAAC,CAAM,IAAO,IAAI,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,EAAE;gCAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,UAAU,CAAA,IAAI,CAAC,CAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,0BAA0B,CAAA,CAAA,CAAC,CAAC,EAAE,CAC/H,EAAA;;oBAND,SAMC,CAAA;oBACD,qBAAM,IAAA,oBAAU,EACd,+CAA+C,EAC/C,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,SAAS,CAAC;4BAC9C,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI;yBACzD,CAAC,EAFH,CAEG,EACT,EAAE,QAAQ,EAAE,UAAC,CAAM,IAAO,IAAI,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,EAAE;gCAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,UAAU,MAAK,IAAI,CAAA,CAAC,CAAC,EAAE,CACrG;wBAED,+DAA+D;wBAC/D,mFAAmF;wBACnF,+DAA+D;sBAJ9D;;oBAND,SAMC,CAAA;oBAKK,YAAU,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAA;oBAC/B,qBAAM,IAAA,oBAAU,EACd,wEAAwE,EACxE,cAAM,OAAA,aAAW,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;4BACzC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,UAAW,EAAE,QAAS,CAAC,EAAE,OAAO,EAAE,CAAC,SAAO,CAAC;yBACpE,CAAC,EAFH,CAEG,EACT,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,OAAO,KAAK,6DAA6D,EAA3E,CAA2E,EAAE,CACjH;wBACD,6FAA6F;sBAD5F;;oBAND,SAMC,CAAA;oBACD,6FAA6F;oBAC7F,qBAAM,IAAA,oBAAU,EACd,2DAA2D,EAC3D,cAAM,OAAA,aAAW,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;4BACzC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,UAAW,CAAC,EAAE,OAAO,EAAE,CAAC,SAAO,CAAC;yBACzD,CAAC,EAFH,CAEG,EACT,EAAE,QAAQ,EAAE,UAAC,CAAM,gBAAO,IAAI,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,EAAE;gCAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA,MAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,UAAU,0CAAE,MAAM,MAAK,CAAC,KAAI,MAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,0CAAE,QAAQ,CAAC,SAAO,CAAC,CAAA,CAAA,CAAC,CAAC,EAAE,CACxI;wBACD,+DAA+D;sBAD9D;;oBAPD,6FAA6F;oBAC7F,SAMC,CAAA;oBACD,+DAA+D;oBAC/D,qBAAM,IAAA,oBAAU,EACd,8DAA8D,EAC9D,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;4BACjC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,UAAW,EAAE,QAAS,CAAC,EAAE,OAAO,EAAE,CAAC,SAAO,CAAC;yBACpE,CAAC,EAFH,CAEG,EACT,EAAE,QAAQ,EAAE,UAAC,CAAM,YAAO,IAAI,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,EAAE;gCAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA,MAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,UAAU,0CAAE,MAAM,MAAK,CAAC,CAAA,CAAC,CAAC,EAAE,CACvG,EAAA;;oBAPD,+DAA+D;oBAC/D,SAMC,CAAA;;;0BAE8B,EAAd,iCAAc;;;yBAAd,CAAA,4BAAc,CAAA;oBAApB,EAAE;;;;oBACL,qBAAM,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,EAAA;;oBAAtC,SAAsC,CAAA;;;;;;oBAD7B,IAAc,CAAA;;;0BAGG,EAAjB,uCAAiB;;;yBAAjB,CAAA,+BAAiB,CAAA;oBAAvB,EAAE;;;;oBACL,qBAAM,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,SAAS,CAAC,EAAE,CAAC,EAAA;;oBAAnD,SAAmD,CAAA;;;;;;oBAD1C,IAAiB,CAAA;;;0BAGI,EAArB,+CAAqB;;;yBAArB,CAAA,mCAAqB,CAAA;oBAA3B,EAAE;;;;oBACL,qBAAM,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAAE,CAAC,EAAA;;oBAAhD,SAAgD,CAAA;;;;;;oBADvC,IAAqB,CAAA;;;0BAGN,EAAf,mCAAe;;;yBAAf,CAAA,6BAAe,CAAA;oBAArB,EAAE;;;;oBACL,qBAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC,EAAA;;oBAA1C,SAA0C,CAAA;;;;;;oBADjC,IAAe,CAAA;;;yBAG5B,UAAU,EAAV,yBAAU;;;;oBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC,EAAA;;oBAA5C,SAA4C,CAAA;;;;;;yBAChE,QAAQ,EAAR,yBAAQ;;;;oBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAA;;oBAA1C,SAA0C,CAAA;;;;;;;;;;CAEnE,CAAA;AAvKY,QAAA,0BAA0B,8BAuKtC;AAED,6CAA6C;AAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAM,KAAG,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACjC,IAAM,aAAW,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IAEzC,IAAM,QAAQ,GAAG;;;wBACf,qBAAM,IAAA,mBAAW,EAAC,KAAG,EAAE,aAAW,CAAC,EAAA;;oBAAnC,SAAmC,CAAA;oBACnC,qBAAM,IAAA,kCAA0B,EAAC,EAAE,GAAG,OAAA,EAAE,WAAW,eAAA,EAAE,CAAC,EAAA;;oBAAtD,SAAsD,CAAA;;;;SACvD,CAAA;IAED,QAAQ,EAAE;SACP,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,sFAAsF,CAAC,CAAA;QACnG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAAA;QACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}

package/lib/cjs/tests/api_tests/security/F-0145-globalunique-leak.test.d.ts

@@ -0,0 +1,20 @@
+import { Session } from "../../../sdk";
+/**
+ * Regression test for F-0145
+ * (security-audit/findings/F-0145-globalunique-conflict-leaks-cross-tenant-record.md).
+ *
+ * The create endpoint generator's unconditional globalUnique-enforcement block
+ * (routing.ts, "globalUnique should be enforced even if _overrideUnique is true")
+ * threw uniquenessError([{ existingRecord: matches[0] }]) with the RAW matched record.
+ * `findSomeByMatchAny_Global` deletes businessId, so the match is global; for `users`
+ * (globalUnique: ['email','phone']) the 409 body leaked the full record incl. hashedPass.
+ *
+ * Fix: redact existingRecord to { _id, businessId } like the safe validateUniquenessConstraints
+ * path. This reproduces the leak with a same-tenant collision (same code path) and asserts the
+ * 409 body's existingRecord exposes nothing beyond _id + businessId.
+ */
+export declare const globalunique_leak_tests: ({ sdk }: {
+    sdk: Session;
+    sdkNonAdmin: Session;
+}) => Promise<void>;
+//# sourceMappingURL=F-0145-globalunique-leak.test.d.ts.map

package/lib/cjs/tests/api_tests/security/F-0145-globalunique-leak.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"F-0145-globalunique-leak.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/F-0145-globalunique-leak.test.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAStC;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,uBAAuB;SAA2B,OAAO;iBAAe,OAAO;mBA+B3F,CAAA"}

package/lib/cjs/tests/api_tests/security/F-0145-globalunique-leak.test.js

@@ -0,0 +1,139 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.globalunique_leak_tests = void 0;
+require('source-map-support').install();
+var sdk_1 = require("../../../sdk");
+var testing_1 = require("@tellescope/testing");
+var setup_1 = require("../../setup");
+var host = process.env.API_URL || 'http://localhost:8080';
+/**
+ * Regression test for F-0145
+ * (security-audit/findings/F-0145-globalunique-conflict-leaks-cross-tenant-record.md).
+ *
+ * The create endpoint generator's unconditional globalUnique-enforcement block
+ * (routing.ts, "globalUnique should be enforced even if _overrideUnique is true")
+ * threw uniquenessError([{ existingRecord: matches[0] }]) with the RAW matched record.
+ * `findSomeByMatchAny_Global` deletes businessId, so the match is global; for `users`
+ * (globalUnique: ['email','phone']) the 409 body leaked the full record incl. hashedPass.
+ *
+ * Fix: redact existingRecord to { _id, businessId } like the safe validateUniquenessConstraints
+ * path. This reproduces the leak with a same-tenant collision (same code path) and asserts the
+ * 409 body's existingRecord exposes nothing beyond _id + businessId.
+ */
+var globalunique_leak_tests = function (_a) {
+    var sdk = _a.sdk;
+    return __awaiter(void 0, void 0, void 0, function () {
+        var userId, email_1, user, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0:
+                    (0, testing_1.log_header)("F-0145: globalUnique conflict response redaction");
+                    _c.label = 1;
+                case 1:
+                    _c.trys.push([1, , 4, 9]);
+                    email_1 = "f0145-victim-".concat(Date.now(), "@example.com");
+                    return [4 /*yield*/, sdk.api.users.createOne({ email: email_1 })];
+                case 2:
+                    user = _c.sent();
+                    userId = user.id;
+                    return [4 /*yield*/, (0, testing_1.async_test)('F-0145: globalUnique 409 existingRecord exposes only _id + businessId (no email/hashedPass)', function () { return sdk.api.users.createOne({ email: email_1, _overrideUnique: true }); }, {
+                            shouldError: true,
+                            onError: function (e) {
+                                var _a, _b;
+                                var rec = (_b = (_a = e === null || e === void 0 ? void 0 : e.info) === null || _a === void 0 ? void 0 : _a[0]) === null || _b === void 0 ? void 0 : _b.existingRecord;
+                                if (!rec || typeof rec !== 'object')
+                                    return false;
+                                var keys = Object.keys(rec);
+                                return (keys.length > 0
+                                    && keys.every(function (k) { return k === '_id' || k === 'businessId' || k === 'id'; })
+                                    && !('email' in rec)
+                                    && !('hashedPass' in rec)
+                                    && !('hashedInviteCode' in rec));
+                            },
+                        })];
+                case 3:
+                    _c.sent();
+                    return [3 /*break*/, 9];
+                case 4:
+                    if (!userId) return [3 /*break*/, 8];
+                    _c.label = 5;
+                case 5:
+                    _c.trys.push([5, 7, , 8]);
+                    return [4 /*yield*/, sdk.api.users.deleteOne(userId)];
+                case 6:
+                    _c.sent();
+                    return [3 /*break*/, 8];
+                case 7:
+                    _b = _c.sent();
+                    return [3 /*break*/, 8];
+                case 8: return [7 /*endfinally*/];
+                case 9: return [2 /*return*/];
+            }
+        });
+    });
+};
+exports.globalunique_leak_tests = globalunique_leak_tests;
+if (require.main === module) {
+    console.log("\uD83C\uDF10 Using API URL: ".concat(host));
+    var sdk_2 = new sdk_1.Session({ host: host });
+    var sdkNonAdmin_1 = new sdk_1.Session({ host: host });
+    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, (0, setup_1.setup_tests)(sdk_2, sdkNonAdmin_1)];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, (0, exports.globalunique_leak_tests)({ sdk: sdk_2, sdkNonAdmin: sdkNonAdmin_1 })];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); };
+    runTests()
+        .then(function () {
+        console.log("✅ F-0145 globalUnique leak test suite completed successfully");
+        process.exit(0);
+    })
+        .catch(function (error) {
+        console.error("❌ F-0145 globalUnique leak test suite failed:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=F-0145-globalunique-leak.test.js.map

package/lib/cjs/tests/api_tests/security/F-0145-globalunique-leak.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"F-0145-globalunique-leak.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/F-0145-globalunique-leak.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,oCAAsC;AACtC,+CAG4B;AAC5B,qCAAyC;AAEzC,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE;;;;;;;;;;;;;GAaG;AACI,IAAM,uBAAuB,GAAG,UAAO,EAAgD;QAA9C,GAAG,SAAA;;;;;;oBACjD,IAAA,oBAAU,EAAC,kDAAkD,CAAC,CAAA;;;;oBAItD,UAAQ,uBAAgB,IAAI,CAAC,GAAG,EAAE,iBAAc,CAAA;oBACzC,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,SAAA,EAAS,CAAC,EAAA;;oBAAtD,IAAI,GAAG,SAA+C;oBAC5D,MAAM,GAAG,IAAI,CAAC,EAAE,CAAA;oBAEhB,qBAAM,IAAA,oBAAU,EACd,6FAA6F,EAC7F,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,SAAA,EAAE,eAAe,EAAE,IAAI,EAAS,CAAC,EAAhE,CAAgE,EACtE;4BACE,WAAW,EAAE,IAAI;4BACjB,OAAO,EAAE,UAAC,CAAM;;gCACd,IAAM,GAAG,GAAG,MAAA,MAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,IAAI,0CAAG,CAAC,CAAC,0CAAE,cAAc,CAAA;gCACxC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;oCAAE,OAAO,KAAK,CAAA;gCACjD,IAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gCAC7B,OAAO,CACL,IAAI,CAAC,MAAM,GAAG,CAAC;uCACZ,IAAI,CAAC,KAAK,CAAC,UAAA,CAAC,IAAI,OAAA,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,YAAY,IAAI,CAAC,KAAK,IAAI,EAA/C,CAA+C,CAAC;uCAChE,CAAC,CAAC,OAAO,IAAI,GAAG,CAAC;uCACjB,CAAC,CAAC,YAAY,IAAI,GAAG,CAAC;uCACtB,CAAC,CAAC,kBAAkB,IAAI,GAAG,CAAC,CAChC,CAAA;4BACH,CAAC;yBACF,CACF,EAAA;;oBAlBD,SAkBC,CAAA;;;yBAEG,MAAM,EAAN,wBAAM;;;;oBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAA;;oBAArC,SAAqC,CAAA;;;;;;;;;;CAE5D,CAAA;AA/BY,QAAA,uBAAuB,2BA+BnC;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAM,KAAG,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACjC,IAAM,aAAW,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IAEzC,IAAM,QAAQ,GAAG;;;wBACf,qBAAM,IAAA,mBAAW,EAAC,KAAG,EAAE,aAAW,CAAC,EAAA;;oBAAnC,SAAmC,CAAA;oBACnC,qBAAM,IAAA,+BAAuB,EAAC,EAAE,GAAG,OAAA,EAAE,WAAW,eAAA,EAAE,CAAC,EAAA;;oBAAnD,SAAmD,CAAA;;;;SACpD,CAAA;IAED,QAAQ,EAAE;SACP,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAA;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,+CAA+C,EAAE,KAAK,CAAC,CAAA;QACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}

package/lib/cjs/tests/api_tests/security/F-0151-load-inbox-redaction.test.d.ts

@@ -0,0 +1,18 @@
+import { Session } from "../../../sdk";
+/**
+ * Regression test for F-0151
+ * (security-audit/findings/F-0151-load-inbox-data-endusers-unredacted.md).
+ *
+ * load_inbox_data serialized $lookup'ed endusers via convert_id_name only (NOT applyRedactions),
+ * so endusers.hashedPassword (redactions:['all']) leaked to staff sessions — while the sibling
+ * phone_calls in the same response correctly went through applyRedactions.
+ *
+ * Repro: create an enduser, set their portal password (→ hashedPassword), seed an inbound
+ * (logOnly) email so the enduser appears in the inbox join, then load_inbox_data as staff and
+ * assert the returned enduser entry has NO hashedPassword.
+ */
+export declare const load_inbox_redaction_tests: ({ sdk }: {
+    sdk: Session;
+    sdkNonAdmin: Session;
+}) => Promise<void>;
+//# sourceMappingURL=F-0151-load-inbox-redaction.test.d.ts.map

package/lib/cjs/tests/api_tests/security/F-0151-load-inbox-redaction.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"F-0151-load-inbox-redaction.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/F-0151-load-inbox-redaction.test.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAWtC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B;SAA2B,OAAO;iBAAe,OAAO;mBAkC9F,CAAA"}