@tellescope/sdk 1.255.13 → 1.255.14

package/src/tests/api_tests/calendar_event_references_update.test.ts

@@ -0,0 +1,108 @@
+require('source-map-support').install();
+
+import { Session, EnduserSession } from "../../sdk"
+import {
+  async_test,
+  log_header,
+} from "@tellescope/testing"
+import { setup_tests, authenticate_enduser_via_token } from "../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+const businessId = '60398b1131a295e64f084ff6'
+
+/**
+ * CU-86e2dvrn9: calendar_events.references switched from updatesDisabled to
+ * enduserUpdatesDisabled (schema.ts), mirroring the Enduser references behavior:
+ *   - staff / API-key sessions may update references (e.g. to set or clear
+ *     external appointment IDs like stale Elation references)
+ *   - enduser (patient) sessions remain blocked — required because endusers DO
+ *     have update access on calendar_events they attend (for cancelling)
+ */
+export const calendar_event_references_update_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("Calendar Event References Update (enduserUpdatesDisabled)")
+
+  let enduserId: string | undefined
+  let eventId: string | undefined
+
+  try {
+    // Setup: enduser attending a calendar event, so the enduser session has update access to it
+    const enduser = await sdk.api.endusers.createOne({
+      email: `references-update-${Date.now()}@example.com`,
+      fname: 'References',
+      lname: 'UpdateTest',
+    })
+    enduserId = enduser.id
+
+    const event = await sdk.api.calendar_events.createOne({
+      title: "References Update Test Event",
+      durationInMinutes: 30,
+      startTimeInMS: Date.now(),
+      attendees: [{ id: enduser.id, type: 'enduser' }],
+    })
+    eventId = event.id
+
+    const enduserSDK = new EnduserSession({ host, businessId })
+    await authenticate_enduser_via_token(sdk, enduserSDK, { id: enduser.id })
+
+    // ---- Staff/API session can update references ----
+    const staffReferences = [{ type: 'Elation', id: 'elation-appointment-123' }]
+    await async_test(
+      'staff can update calendar_events.references',
+      () => sdk.api.calendar_events.updateOne(event.id, { references: staffReferences }),
+      { onResult: e => e.references?.length === 1 && e.references[0].type === 'Elation' && e.references[0].id === 'elation-appointment-123' },
+    )
+    await async_test(
+      'staff references update persisted',
+      () => sdk.api.calendar_events.getOne(event.id),
+      { onResult: e => e.references?.length === 1 && e.references[0].type === 'Elation' && e.references[0].id === 'elation-appointment-123' },
+    )
+
+    // ---- Enduser session (attendee with update access) is still blocked on references ----
+    await async_test(
+      'enduser cannot update calendar_events.references',
+      () => enduserSDK.api.calendar_events.updateOne(event.id, { references: [{ type: 'Attacker', id: 'attacker-reference' }] } as any),
+      { shouldError: true, onError: e => e.message === "references cannot be updated by endusers" },
+    )
+    await async_test(
+      'rejected enduser references update did not persist',
+      () => sdk.api.calendar_events.getOne(event.id),
+      { onResult: e => e.references?.length === 1 && e.references[0].type === 'Elation' && e.references[0].id === 'elation-appointment-123' },
+    )
+
+    // ---- Positive control: the guard is field-scoped — enduser can still cancel the event ----
+    await async_test(
+      'enduser can still perform allowed update (cancelledAt)',
+      () => enduserSDK.api.calendar_events.updateOne(event.id, { cancelledAt: new Date() }),
+      { onResult: e => !!e.cancelledAt },
+    )
+  } finally {
+    if (eventId) {
+      try { await sdk.api.calendar_events.deleteOne(eventId) } catch {}
+    }
+    if (enduserId) {
+      try { await sdk.api.endusers.deleteOne(enduserId) } catch {}
+    }
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await calendar_event_references_update_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ Calendar event references update test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Calendar event references update test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/phone_calls_cold_transfer.test.ts

@@ -0,0 +1,113 @@
+require('source-map-support').install();
+
+import { Session } from "../../sdk"
+import {
+  async_test,
+  handleAnyError,
+  log_header,
+} from "@tellescope/testing"
+import { setup_tests } from "../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const NONEXISTENT_MONGO_ID = '60398b1131a295e64f084fff'
+
+// Validation-path tests for the cold transfer endpoint. All assertions below hit
+// validations that run before any Twilio access, so no Twilio config is needed.
+export const phone_calls_cold_transfer_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("Phone Calls Cold Transfer Tests")
+
+  const enduser = await sdk.api.endusers.createOne({ fname: 'Cold', lname: 'Transfer' })
+  const targetUsers: { id: string }[] = []
+
+  try {
+    const inboundCall = await sdk.api.phone_calls.createOne({
+      enduserId: enduser.id,
+      inbound: true,
+      externalId: 'CAcoldtransfertestinbound000000001',
+      from: '+15550001111',
+      to: '+15550002222',
+      userId: sdk.userInfo.id,
+    })
+    const outboundCall = await sdk.api.phone_calls.createOne({
+      enduserId: enduser.id,
+      inbound: false,
+      externalId: 'CAcoldtransfertestoutbound00000001',
+      from: '+15550002222',
+      to: '+15550001111',
+      userId: sdk.userInfo.id,
+    })
+
+    // throwaway target users (never modify existing users' roles)
+    const disabledTargetUser = await sdk.api.users.createOne({
+      email: 'cold.transfer.disabled@tellescope.com',
+      verifiedEmail: true,
+      notificationEmailsDisabled: true,
+      disableIncomingPhoneCalls: true,
+    })
+    targetUsers.push(disabledTargetUser)
+
+    await async_test(
+      "cold_transfer: cannot transfer to yourself",
+      () => sdk.api.phone_calls.cold_transfer({ callSid: inboundCall.externalId, targetUserId: sdk.userInfo.id }),
+      { shouldError: true, onError: (e: any) => e.message === "Cannot transfer a call to yourself" }
+    )
+    await async_test(
+      "cold_transfer: bogus callSid rejected",
+      () => sdk.api.phone_calls.cold_transfer({ callSid: 'CAdoesnotexist0000000000000000000', targetUserId: disabledTargetUser.id }),
+      { shouldError: true, onError: (e: any) => e.message === "Call not found" }
+    )
+    await async_test(
+      "cold_transfer: outbound calls rejected",
+      () => sdk.api.phone_calls.cold_transfer({ callSid: outboundCall.externalId, targetUserId: disabledTargetUser.id }),
+      { shouldError: true, onError: (e: any) => e.message === "Only inbound calls can be transferred" }
+    )
+    // conferenceId is not settable via the public API (only set internally by conference webhooks),
+    // so the "Conference calls cannot be transferred" branch is covered by manual E2E testing only
+    await async_test(
+      "cold_transfer: nonexistent target user rejected",
+      () => sdk.api.phone_calls.cold_transfer({ callSid: inboundCall.externalId, targetUserId: NONEXISTENT_MONGO_ID }),
+      { shouldError: true, onError: (e: any) => e.message === "Target user not found" }
+    )
+    await async_test(
+      "cold_transfer: target user with incoming calls disabled rejected",
+      () => sdk.api.phone_calls.cold_transfer({ callSid: inboundCall.externalId, targetUserId: disabledTargetUser.id }),
+      { shouldError: true, onError: (e: any) => e.message === "Target user has incoming calls disabled" }
+    )
+    // non-admin either can't see the call (Call not found) or is stopped by a later
+    // validation (target has incoming calls disabled) — errors on every path
+    await async_test(
+      "cold_transfer: non-admin cannot transfer an inaccessible call",
+      () => sdkNonAdmin.api.phone_calls.cold_transfer({ callSid: inboundCall.externalId, targetUserId: disabledTargetUser.id }),
+      handleAnyError
+    )
+  } finally {
+    // deleting the enduser cascades deletion of its phone_calls records
+    await Promise.all([
+      sdk.api.endusers.deleteOne(enduser.id),
+      ...targetUsers.map(u => sdk.api.users.deleteOne(u.id)),
+    ]).catch(console.error)
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await phone_calls_cold_transfer_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ Phone calls cold transfer test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Phone calls cold transfer test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/phone_tree_enduser_condition.test.ts

@@ -0,0 +1,174 @@
+require('source-map-support').install();
+
+import { Session } from "../../sdk"
+import {
+  assert,
+  async_test,
+  handleAnyError,
+  log_header,
+} from "@tellescope/testing"
+import { PhoneTreeNode } from "@tellescope/types-models"
+import { setup_tests } from "../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const SPLIT_NODE_ID = 'enduser-condition-split-node'
+const VIP_NODE_ID = 'vip-play-message-node'
+const ELSE_NODE_ID = 'else-play-message-node'
+
+const valid_condition_split_nodes: PhoneTreeNode[] = [
+  {
+    id: SPLIT_NODE_ID,
+    action: {
+      type: 'Enduser Condition Split',
+      info: {
+        branches: [
+          { name: 'VIP', enduserCondition: { $and: [{ condition: { tags: 'VIP' } }] } },
+          { name: 'Everyone Else' }, // no condition — catch-all
+        ],
+      },
+    },
+    events: [{ type: 'Start', parentId: SPLIT_NODE_ID, info: {} }],
+    flowchartUI: { x: 0, y: 0 },
+  },
+  {
+    id: VIP_NODE_ID,
+    action: {
+      type: 'Play Message',
+      info: { playback: { type: 'Say', info: { script: 'Welcome, VIP caller' } } },
+    },
+    events: [{ type: 'On Condition Branch', parentId: SPLIT_NODE_ID, info: { branch: 'VIP' } }],
+    flowchartUI: { x: -100, y: 100 },
+  },
+  {
+    id: ELSE_NODE_ID,
+    action: {
+      type: 'Play Message',
+      info: { playback: { type: 'Say', info: { script: 'Welcome' } } },
+    },
+    events: [{ type: 'On Condition Branch', parentId: SPLIT_NODE_ID, info: { branch: 'Everyone Else' } }],
+    flowchartUI: { x: 100, y: 100 },
+  },
+]
+
+export const phone_tree_enduser_condition_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("Phone Tree Enduser Condition Split Tests")
+
+  const treeIds: string[] = []
+  try {
+    // valid Enduser Condition Split node with On Condition Branch children saves
+    const tree = await sdk.api.phone_trees.createOne({
+      number: '+15005550006',
+      isActive: false,
+      nodes: valid_condition_split_nodes,
+    })
+    treeIds.push(tree.id)
+    assert(!!tree.id, 'failed to create tree with Enduser Condition Split', 'create tree with Enduser Condition Split')
+
+    const loaded = await sdk.api.phone_trees.getOne(tree.id)
+    const loadedSplit = loaded.nodes.find(n => n.action.type === 'Enduser Condition Split')
+    assert(
+      loadedSplit?.action.type === 'Enduser Condition Split'
+      && loadedSplit.action.info.branches.length === 2
+      && loadedSplit.action.info.branches[0].name === 'VIP'
+      && !!loadedSplit.action.info.branches[0].enduserCondition
+      && loadedSplit.action.info.branches[1].enduserCondition === undefined,
+      'branches did not round-trip',
+      'branches (conditions + catch-all) round-trip on read',
+    )
+
+    // regression: existing Conditional Split shape is unaffected
+    const conditionalSplitTree = await sdk.api.phone_trees.createOne({
+      number: '+15005550006',
+      isActive: false,
+      nodes: [{
+        id: 'conditional-split-node',
+        // timezone + weeklyAvailabilities included to match the webapp's default Conditional Split shape
+        action: { type: 'Conditional Split', info: { timezone: 'US/Eastern', weeklyAvailabilities: [], hasCareTeam: true } },
+        events: [{ type: 'Start', parentId: 'conditional-split-node', info: {} }],
+        flowchartUI: { x: 0, y: 0 },
+      }],
+    })
+    treeIds.push(conditionalSplitTree.id)
+    assert(!!conditionalSplitTree.id, 'failed to create Conditional Split tree', 'existing Conditional Split still saves (regression)')
+
+    // invalid: enduserCondition must be an object
+    await async_test(
+      "non-object enduserCondition is rejected",
+      () => sdk.api.phone_trees.createOne({
+        number: '+15005550006',
+        isActive: false,
+        nodes: [{
+          id: SPLIT_NODE_ID,
+          action: {
+            type: 'Enduser Condition Split',
+            info: { branches: [{ name: 'Bad', enduserCondition: "not-an-object" as any }] },
+          },
+          events: [{ type: 'Start', parentId: SPLIT_NODE_ID, info: {} }],
+          flowchartUI: { x: 0, y: 0 },
+        }],
+      }).then(t => { treeIds.push(t.id); return t }), // cleanup if it unexpectedly passes
+      handleAnyError,
+    )
+
+    // invalid: branches must include a name
+    await async_test(
+      "branch without a name is rejected",
+      () => sdk.api.phone_trees.createOne({
+        number: '+15005550006',
+        isActive: false,
+        nodes: [{
+          id: SPLIT_NODE_ID,
+          action: {
+            type: 'Enduser Condition Split',
+            info: { branches: [{ enduserCondition: {} } as any] },
+          },
+          events: [{ type: 'Start', parentId: SPLIT_NODE_ID, info: {} }],
+          flowchartUI: { x: 0, y: 0 },
+        }],
+      }).then(t => { treeIds.push(t.id); return t }),
+      handleAnyError,
+    )
+
+    // invalid: On Condition Branch events must include a branch value
+    await async_test(
+      "On Condition Branch event without branch is rejected",
+      () => sdk.api.phone_trees.createOne({
+        number: '+15005550006',
+        isActive: false,
+        nodes: valid_condition_split_nodes.map(n => (
+          n.id !== VIP_NODE_ID
+            ? n
+            : { ...n, events: [{ type: 'On Condition Branch', parentId: SPLIT_NODE_ID, info: {} as any }] }
+        )),
+      }).then(t => { treeIds.push(t.id); return t }),
+      handleAnyError,
+    )
+  } finally {
+    for (const id of treeIds) {
+      await sdk.api.phone_trees.deleteOne(id).catch(console.error)
+    }
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await phone_tree_enduser_condition_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ Phone tree enduser condition test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Phone tree enduser condition test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/tests.ts

@@ -81,6 +81,7 @@ import {
 
 import fs from "fs"
 import { load_inbox_data_tests } from "./api_tests/load_inbox_data.test";
+import { phone_calls_cold_transfer_tests } from "./api_tests/phone_calls_cold_transfer.test";
 import { enduser_login_tests } from "./api_tests/enduser_login.test";
 import { enduser_login_rate_limits_tests } from "./api_tests/enduser_login_rate_limits.test";
 import { eom_procedure_codes_tests } from "./api_tests/eom_procedure_codes.test";
@@ -127,6 +128,7 @@ import { conditional_logic_medication_unit_tests } from "./unit_tests/conditiona
 import { elation_user_id_tests } from "./api_tests/elation_user_id.test";
 import { organization_settings_duplicates_tests } from "./api_tests/organization_settings_duplicates.test";
 import { calendar_events_bulk_update_tests } from "./api_tests/calendar_events_bulk_update.test";
+import { calendar_event_references_update_tests } from "./api_tests/calendar_event_references_update.test";
 import { openloop_webhooks_tests } from "./api_tests/openloop_webhooks.test";
 import { beluga_pharmacy_mappings_tests } from "./api_tests/beluga_pharmacy_mappings.test";
 import { mdi_case_offerings_tests } from "./api_tests/mdi_case_offerings.test";
@@ -140,6 +142,7 @@ import { enduser_session_invalidation_tests } from "./api_tests/enduser_session_
 import { enduser_cross_access_isolation_tests } from "./api_tests/enduser_cross_access_isolation.test";
 import { calendar_event_webhook_template_tests } from "./api_tests/calendar_event_webhook_template.test";
 import { webhook_error_handling_tests } from "./api_tests/webhook_error_handling.test";
+import { phone_tree_enduser_condition_tests } from "./api_tests/phone_tree_enduser_condition.test";
 
 const UniquenessViolationMessage = 'Uniqueness Violation'
 
@@ -15087,6 +15090,7 @@ const ip_address_form_tests = async () => {
     await form_submitted_trigger_tests({ sdk, sdkNonAdmin })
     await dont_sync_to_elation_form_submission_tests({ sdk, sdkNonAdmin })
     await date_string_validation_tests({ sdk, sdkNonAdmin })
+    await phone_tree_enduser_condition_tests({ sdk, sdkNonAdmin })
     await openloop_webhooks_tests({ sdk, sdkNonAdmin })
     await mdi_webhooks_tests({ sdk, sdkNonAdmin })
     await integrations_redacted_tests({ sdk, sdkNonAdmin })
@@ -15131,6 +15135,7 @@ const ip_address_form_tests = async () => {
     await inbox_threads_building_tests()
     await inbox_threads_loading_tests()
     await load_inbox_data_tests({ sdk, sdkNonAdmin })
+    await phone_calls_cold_transfer_tests({ sdk, sdkNonAdmin })
     await enduser_observations_acknowledge_tests({ sdk, sdkNonAdmin })
     await nutrition_tracking_tests({ sdk, sdkNonAdmin })
     await translations_tests({ sdk, sdkNonAdmin })
@@ -15142,6 +15147,7 @@ const ip_address_form_tests = async () => {
     await ip_address_form_tests()
     await bulk_update_tests()
     await calendar_events_bulk_update_tests({ sdk })
+    await calendar_event_references_update_tests({ sdk, sdkNonAdmin })
     await cancel_upcoming_appointments_journey_action_test()
     await multi_tenant_tests() // should come right after setup tests
     await sync_tests_with_access_tags() // should come directly after setup to avoid extra sync values