@tellescope/sdk 1.255.12 → 1.255.14

package/src/sdk.ts

@@ -435,6 +435,12 @@ type Queries = { [K in keyof ClientModelForName]: APIQuery<K> } & {
     configure_MFA: (args: extractFields<CustomActions['users']['configure_MFA']['parameters']>) => (
       Promise<extractFields<CustomActions['users']['configure_MFA']['returns']>>
     ),
+    begin_TOTP_configuration: (args: extractFields<CustomActions['users']['begin_TOTP_configuration']['parameters']>) => (
+      Promise<extractFields<CustomActions['users']['begin_TOTP_configuration']['returns']>>
+    ),
+    confirm_TOTP_configuration: (args: extractFields<CustomActions['users']['confirm_TOTP_configuration']['parameters']>) => (
+      Promise<extractFields<CustomActions['users']['confirm_TOTP_configuration']['returns']>>
+    ),
     generate_MFA_challenge: (args: extractFields<CustomActions['users']['generate_MFA_challenge']['parameters']>) => (
       Promise<extractFields<CustomActions['users']['generate_MFA_challenge']['returns']>>
     ),
@@ -698,6 +704,9 @@ type Queries = { [K in keyof ClientModelForName]: APIQuery<K> } & {
     upgrade_to_conference: (args: extractFields<CustomActions['phone_calls']['upgrade_to_conference']['parameters']>) => (
       Promise<extractFields<CustomActions['phone_calls']['upgrade_to_conference']['returns']>>
     ),
+    cold_transfer: (args: extractFields<CustomActions['phone_calls']['cold_transfer']['parameters']>) => (
+      Promise<extractFields<CustomActions['phone_calls']['cold_transfer']['returns']>>
+    ),
     add_conference_attendees: (args: extractFields<CustomActions['phone_calls']['add_conference_attendees']['parameters']>) => (
       Promise<extractFields<CustomActions['phone_calls']['add_conference_attendees']['returns']>>
     ),
@@ -1025,6 +1034,8 @@ export class Session extends SessionManager {
     queries.users.request_linked_account_access = a => this._POST(`/v1/${schema.users.customActions.request_linked_account_access.path}`, a)
 
     queries.users.configure_MFA = a => this._POST(`/v1/${schema.users.customActions.configure_MFA.path}`, a)
+    queries.users.begin_TOTP_configuration = a => this._POST(`/v1/${schema.users.customActions.begin_TOTP_configuration.path}`, a)
+    queries.users.confirm_TOTP_configuration = a => this._POST(`/v1/${schema.users.customActions.confirm_TOTP_configuration.path}`, a)
     queries.users.generate_MFA_challenge = a => this._POST(`/v1/${schema.users.customActions.generate_MFA_challenge.path}`, a)
     queries.users.submit_MFA_challenge = a => this._POST(`/v1/${schema.users.customActions.submit_MFA_challenge.path}`, a)
 
@@ -1146,6 +1157,7 @@ export class Session extends SessionManager {
     queries.phone_calls.get_report = a => this._GET(`/v1/${schema.phone_calls.customActions.get_report.path}`, a)
     queries.phone_calls.authenticate_calling = a => this._POST(`/v1${schema.phone_calls.customActions.authenticate_calling.path}`, a)
     queries.phone_calls.upgrade_to_conference = a => this._POST(`/v1${schema.phone_calls.customActions.upgrade_to_conference.path}`, a)
+    queries.phone_calls.cold_transfer = a => this._POST(`/v1${schema.phone_calls.customActions.cold_transfer.path}`, a)
     queries.phone_calls.add_conference_attendees = a => this._POST(`/v1${schema.phone_calls.customActions.add_conference_attendees.path}`, a)
     queries.phone_calls.remove_conference_attendees = a => this._POST(`/v1${schema.phone_calls.customActions.remove_conference_attendees.path}`, a)
     queries.phone_calls.end_conference = a => this._POST(`/v1${schema.phone_calls.customActions.end_conference.path}`, a)

package/src/tests/api_tests/calendar_event_references_update.test.ts

@@ -0,0 +1,108 @@
+require('source-map-support').install();
+
+import { Session, EnduserSession } from "../../sdk"
+import {
+  async_test,
+  log_header,
+} from "@tellescope/testing"
+import { setup_tests, authenticate_enduser_via_token } from "../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+const businessId = '60398b1131a295e64f084ff6'
+
+/**
+ * CU-86e2dvrn9: calendar_events.references switched from updatesDisabled to
+ * enduserUpdatesDisabled (schema.ts), mirroring the Enduser references behavior:
+ *   - staff / API-key sessions may update references (e.g. to set or clear
+ *     external appointment IDs like stale Elation references)
+ *   - enduser (patient) sessions remain blocked — required because endusers DO
+ *     have update access on calendar_events they attend (for cancelling)
+ */
+export const calendar_event_references_update_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("Calendar Event References Update (enduserUpdatesDisabled)")
+
+  let enduserId: string | undefined
+  let eventId: string | undefined
+
+  try {
+    // Setup: enduser attending a calendar event, so the enduser session has update access to it
+    const enduser = await sdk.api.endusers.createOne({
+      email: `references-update-${Date.now()}@example.com`,
+      fname: 'References',
+      lname: 'UpdateTest',
+    })
+    enduserId = enduser.id
+
+    const event = await sdk.api.calendar_events.createOne({
+      title: "References Update Test Event",
+      durationInMinutes: 30,
+      startTimeInMS: Date.now(),
+      attendees: [{ id: enduser.id, type: 'enduser' }],
+    })
+    eventId = event.id
+
+    const enduserSDK = new EnduserSession({ host, businessId })
+    await authenticate_enduser_via_token(sdk, enduserSDK, { id: enduser.id })
+
+    // ---- Staff/API session can update references ----
+    const staffReferences = [{ type: 'Elation', id: 'elation-appointment-123' }]
+    await async_test(
+      'staff can update calendar_events.references',
+      () => sdk.api.calendar_events.updateOne(event.id, { references: staffReferences }),
+      { onResult: e => e.references?.length === 1 && e.references[0].type === 'Elation' && e.references[0].id === 'elation-appointment-123' },
+    )
+    await async_test(
+      'staff references update persisted',
+      () => sdk.api.calendar_events.getOne(event.id),
+      { onResult: e => e.references?.length === 1 && e.references[0].type === 'Elation' && e.references[0].id === 'elation-appointment-123' },
+    )
+
+    // ---- Enduser session (attendee with update access) is still blocked on references ----
+    await async_test(
+      'enduser cannot update calendar_events.references',
+      () => enduserSDK.api.calendar_events.updateOne(event.id, { references: [{ type: 'Attacker', id: 'attacker-reference' }] } as any),
+      { shouldError: true, onError: e => e.message === "references cannot be updated by endusers" },
+    )
+    await async_test(
+      'rejected enduser references update did not persist',
+      () => sdk.api.calendar_events.getOne(event.id),
+      { onResult: e => e.references?.length === 1 && e.references[0].type === 'Elation' && e.references[0].id === 'elation-appointment-123' },
+    )
+
+    // ---- Positive control: the guard is field-scoped — enduser can still cancel the event ----
+    await async_test(
+      'enduser can still perform allowed update (cancelledAt)',
+      () => enduserSDK.api.calendar_events.updateOne(event.id, { cancelledAt: new Date() }),
+      { onResult: e => !!e.cancelledAt },
+    )
+  } finally {
+    if (eventId) {
+      try { await sdk.api.calendar_events.deleteOne(eventId) } catch {}
+    }
+    if (enduserId) {
+      try { await sdk.api.endusers.deleteOne(enduserId) } catch {}
+    }
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await calendar_event_references_update_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ Calendar event references update test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Calendar event references update test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/phone_calls_cold_transfer.test.ts

@@ -0,0 +1,113 @@
+require('source-map-support').install();
+
+import { Session } from "../../sdk"
+import {
+  async_test,
+  handleAnyError,
+  log_header,
+} from "@tellescope/testing"
+import { setup_tests } from "../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const NONEXISTENT_MONGO_ID = '60398b1131a295e64f084fff'
+
+// Validation-path tests for the cold transfer endpoint. All assertions below hit
+// validations that run before any Twilio access, so no Twilio config is needed.
+export const phone_calls_cold_transfer_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("Phone Calls Cold Transfer Tests")
+
+  const enduser = await sdk.api.endusers.createOne({ fname: 'Cold', lname: 'Transfer' })
+  const targetUsers: { id: string }[] = []
+
+  try {
+    const inboundCall = await sdk.api.phone_calls.createOne({
+      enduserId: enduser.id,
+      inbound: true,
+      externalId: 'CAcoldtransfertestinbound000000001',
+      from: '+15550001111',
+      to: '+15550002222',
+      userId: sdk.userInfo.id,
+    })
+    const outboundCall = await sdk.api.phone_calls.createOne({
+      enduserId: enduser.id,
+      inbound: false,
+      externalId: 'CAcoldtransfertestoutbound00000001',
+      from: '+15550002222',
+      to: '+15550001111',
+      userId: sdk.userInfo.id,
+    })
+
+    // throwaway target users (never modify existing users' roles)
+    const disabledTargetUser = await sdk.api.users.createOne({
+      email: 'cold.transfer.disabled@tellescope.com',
+      verifiedEmail: true,
+      notificationEmailsDisabled: true,
+      disableIncomingPhoneCalls: true,
+    })
+    targetUsers.push(disabledTargetUser)
+
+    await async_test(
+      "cold_transfer: cannot transfer to yourself",
+      () => sdk.api.phone_calls.cold_transfer({ callSid: inboundCall.externalId, targetUserId: sdk.userInfo.id }),
+      { shouldError: true, onError: (e: any) => e.message === "Cannot transfer a call to yourself" }
+    )
+    await async_test(
+      "cold_transfer: bogus callSid rejected",
+      () => sdk.api.phone_calls.cold_transfer({ callSid: 'CAdoesnotexist0000000000000000000', targetUserId: disabledTargetUser.id }),
+      { shouldError: true, onError: (e: any) => e.message === "Call not found" }
+    )
+    await async_test(
+      "cold_transfer: outbound calls rejected",
+      () => sdk.api.phone_calls.cold_transfer({ callSid: outboundCall.externalId, targetUserId: disabledTargetUser.id }),
+      { shouldError: true, onError: (e: any) => e.message === "Only inbound calls can be transferred" }
+    )
+    // conferenceId is not settable via the public API (only set internally by conference webhooks),
+    // so the "Conference calls cannot be transferred" branch is covered by manual E2E testing only
+    await async_test(
+      "cold_transfer: nonexistent target user rejected",
+      () => sdk.api.phone_calls.cold_transfer({ callSid: inboundCall.externalId, targetUserId: NONEXISTENT_MONGO_ID }),
+      { shouldError: true, onError: (e: any) => e.message === "Target user not found" }
+    )
+    await async_test(
+      "cold_transfer: target user with incoming calls disabled rejected",
+      () => sdk.api.phone_calls.cold_transfer({ callSid: inboundCall.externalId, targetUserId: disabledTargetUser.id }),
+      { shouldError: true, onError: (e: any) => e.message === "Target user has incoming calls disabled" }
+    )
+    // non-admin either can't see the call (Call not found) or is stopped by a later
+    // validation (target has incoming calls disabled) — errors on every path
+    await async_test(
+      "cold_transfer: non-admin cannot transfer an inaccessible call",
+      () => sdkNonAdmin.api.phone_calls.cold_transfer({ callSid: inboundCall.externalId, targetUserId: disabledTargetUser.id }),
+      handleAnyError
+    )
+  } finally {
+    // deleting the enduser cascades deletion of its phone_calls records
+    await Promise.all([
+      sdk.api.endusers.deleteOne(enduser.id),
+      ...targetUsers.map(u => sdk.api.users.deleteOne(u.id)),
+    ]).catch(console.error)
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await phone_calls_cold_transfer_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ Phone calls cold transfer test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Phone calls cold transfer test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/phone_tree_enduser_condition.test.ts

@@ -0,0 +1,174 @@
+require('source-map-support').install();
+
+import { Session } from "../../sdk"
+import {
+  assert,
+  async_test,
+  handleAnyError,
+  log_header,
+} from "@tellescope/testing"
+import { PhoneTreeNode } from "@tellescope/types-models"
+import { setup_tests } from "../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const SPLIT_NODE_ID = 'enduser-condition-split-node'
+const VIP_NODE_ID = 'vip-play-message-node'
+const ELSE_NODE_ID = 'else-play-message-node'
+
+const valid_condition_split_nodes: PhoneTreeNode[] = [
+  {
+    id: SPLIT_NODE_ID,
+    action: {
+      type: 'Enduser Condition Split',
+      info: {
+        branches: [
+          { name: 'VIP', enduserCondition: { $and: [{ condition: { tags: 'VIP' } }] } },
+          { name: 'Everyone Else' }, // no condition — catch-all
+        ],
+      },
+    },
+    events: [{ type: 'Start', parentId: SPLIT_NODE_ID, info: {} }],
+    flowchartUI: { x: 0, y: 0 },
+  },
+  {
+    id: VIP_NODE_ID,
+    action: {
+      type: 'Play Message',
+      info: { playback: { type: 'Say', info: { script: 'Welcome, VIP caller' } } },
+    },
+    events: [{ type: 'On Condition Branch', parentId: SPLIT_NODE_ID, info: { branch: 'VIP' } }],
+    flowchartUI: { x: -100, y: 100 },
+  },
+  {
+    id: ELSE_NODE_ID,
+    action: {
+      type: 'Play Message',
+      info: { playback: { type: 'Say', info: { script: 'Welcome' } } },
+    },
+    events: [{ type: 'On Condition Branch', parentId: SPLIT_NODE_ID, info: { branch: 'Everyone Else' } }],
+    flowchartUI: { x: 100, y: 100 },
+  },
+]
+
+export const phone_tree_enduser_condition_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("Phone Tree Enduser Condition Split Tests")
+
+  const treeIds: string[] = []
+  try {
+    // valid Enduser Condition Split node with On Condition Branch children saves
+    const tree = await sdk.api.phone_trees.createOne({
+      number: '+15005550006',
+      isActive: false,
+      nodes: valid_condition_split_nodes,
+    })
+    treeIds.push(tree.id)
+    assert(!!tree.id, 'failed to create tree with Enduser Condition Split', 'create tree with Enduser Condition Split')
+
+    const loaded = await sdk.api.phone_trees.getOne(tree.id)
+    const loadedSplit = loaded.nodes.find(n => n.action.type === 'Enduser Condition Split')
+    assert(
+      loadedSplit?.action.type === 'Enduser Condition Split'
+      && loadedSplit.action.info.branches.length === 2
+      && loadedSplit.action.info.branches[0].name === 'VIP'
+      && !!loadedSplit.action.info.branches[0].enduserCondition
+      && loadedSplit.action.info.branches[1].enduserCondition === undefined,
+      'branches did not round-trip',
+      'branches (conditions + catch-all) round-trip on read',
+    )
+
+    // regression: existing Conditional Split shape is unaffected
+    const conditionalSplitTree = await sdk.api.phone_trees.createOne({
+      number: '+15005550006',
+      isActive: false,
+      nodes: [{
+        id: 'conditional-split-node',
+        // timezone + weeklyAvailabilities included to match the webapp's default Conditional Split shape
+        action: { type: 'Conditional Split', info: { timezone: 'US/Eastern', weeklyAvailabilities: [], hasCareTeam: true } },
+        events: [{ type: 'Start', parentId: 'conditional-split-node', info: {} }],
+        flowchartUI: { x: 0, y: 0 },
+      }],
+    })
+    treeIds.push(conditionalSplitTree.id)
+    assert(!!conditionalSplitTree.id, 'failed to create Conditional Split tree', 'existing Conditional Split still saves (regression)')
+
+    // invalid: enduserCondition must be an object
+    await async_test(
+      "non-object enduserCondition is rejected",
+      () => sdk.api.phone_trees.createOne({
+        number: '+15005550006',
+        isActive: false,
+        nodes: [{
+          id: SPLIT_NODE_ID,
+          action: {
+            type: 'Enduser Condition Split',
+            info: { branches: [{ name: 'Bad', enduserCondition: "not-an-object" as any }] },
+          },
+          events: [{ type: 'Start', parentId: SPLIT_NODE_ID, info: {} }],
+          flowchartUI: { x: 0, y: 0 },
+        }],
+      }).then(t => { treeIds.push(t.id); return t }), // cleanup if it unexpectedly passes
+      handleAnyError,
+    )
+
+    // invalid: branches must include a name
+    await async_test(
+      "branch without a name is rejected",
+      () => sdk.api.phone_trees.createOne({
+        number: '+15005550006',
+        isActive: false,
+        nodes: [{
+          id: SPLIT_NODE_ID,
+          action: {
+            type: 'Enduser Condition Split',
+            info: { branches: [{ enduserCondition: {} } as any] },
+          },
+          events: [{ type: 'Start', parentId: SPLIT_NODE_ID, info: {} }],
+          flowchartUI: { x: 0, y: 0 },
+        }],
+      }).then(t => { treeIds.push(t.id); return t }),
+      handleAnyError,
+    )
+
+    // invalid: On Condition Branch events must include a branch value
+    await async_test(
+      "On Condition Branch event without branch is rejected",
+      () => sdk.api.phone_trees.createOne({
+        number: '+15005550006',
+        isActive: false,
+        nodes: valid_condition_split_nodes.map(n => (
+          n.id !== VIP_NODE_ID
+            ? n
+            : { ...n, events: [{ type: 'On Condition Branch', parentId: SPLIT_NODE_ID, info: {} as any }] }
+        )),
+      }).then(t => { treeIds.push(t.id); return t }),
+      handleAnyError,
+    )
+  } finally {
+    for (const id of treeIds) {
+      await sdk.api.phone_trees.deleteOne(id).catch(console.error)
+    }
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await phone_tree_enduser_condition_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ Phone tree enduser condition test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Phone tree enduser condition test suite failed:", error)
+      process.exit(1)
+    })
+}