@tellescope/sdk 1.255.17 → 1.255.19

package/src/sdk.ts

@@ -716,6 +716,9 @@ type Queries = { [K in keyof ClientModelForName]: APIQuery<K> } & {
     remove_conference_attendees: (args: extractFields<CustomActions['phone_calls']['remove_conference_attendees']['parameters']>) => (
       Promise<extractFields<CustomActions['phone_calls']['remove_conference_attendees']['returns']>>
     ),
+    modify_conference_attendee_status: (args: extractFields<CustomActions['phone_calls']['modify_conference_attendee_status']['parameters']>) => (
+      Promise<extractFields<CustomActions['phone_calls']['modify_conference_attendee_status']['returns']>>
+    ),
     end_conference: (args: extractFields<CustomActions['phone_calls']['end_conference']['parameters']>) => (
       Promise<extractFields<CustomActions['phone_calls']['end_conference']['returns']>>
     ),
@@ -1163,6 +1166,7 @@ export class Session extends SessionManager {
     queries.phone_calls.cold_transfer = a => this._POST(`/v1${schema.phone_calls.customActions.cold_transfer.path}`, a)
     queries.phone_calls.add_conference_attendees = a => this._POST(`/v1${schema.phone_calls.customActions.add_conference_attendees.path}`, a)
     queries.phone_calls.remove_conference_attendees = a => this._POST(`/v1${schema.phone_calls.customActions.remove_conference_attendees.path}`, a)
+    queries.phone_calls.modify_conference_attendee_status = a => this._POST(`/v1${schema.phone_calls.customActions.modify_conference_attendee_status.path}`, a)
     queries.phone_calls.end_conference = a => this._POST(`/v1${schema.phone_calls.customActions.end_conference.path}`, a)
     queries.phone_calls.cancel_recording = a => this._POST(`/v1${schema.phone_calls.customActions.cancel_recording.path}`, a)
     queries.phone_calls.delete_recordings = a => this._POST(`/v1${schema.phone_calls.customActions.delete_recordings.path}`, a)

package/src/tests/api_tests/auto_merge_form_submission.test.ts

@@ -547,9 +547,9 @@ export const auto_merge_form_submission_tests = async ({ sdk, sdkNonAdmin }: { s
     { expectedResult: true }
   )
 
-  // Test 12: Intake fields update destination enduser directly
+  // Test 12: Intake fields update destination enduser directly — except the authentication channels
   await async_test(
-    "Auto-merge: Intake fields update destination enduser directly",
+    "Auto-merge: Intake fields update destination enduser directly (email/phone locked)",
     async () => {
       const testEmail = `automerge.intake.${Date.now()}@test.com`
       const destination = await sdk.api.endusers.createOne({
@@ -579,10 +579,19 @@ export const auto_merge_form_submission_tests = async ({ sdk, sdkNonAdmin }: { s
       await sdk.api.forms.deleteOne(form.id)
       await sdk.api.endusers.deleteOne(destination.id)
 
-      // Intake fields should have been applied to the destination enduser
+      // Non-auth intake fields are still applied to the destination — dateOfBirth landing here is
+      // also what proves the intake write ran at all, so the negative assertions below aren't vacuous.
       return sourceDeleted
-        && updatedDestination.phone === newPhone
         && updatedDestination.dateOfBirth === newDOB
+        // ...but email and phone are NOT applied. The merge attaches this response to a contact that
+        // existed before the submission, which sets FormResponse.authFieldIntakeDisabled, and these two
+        // are authentication channels (password reset resolves by email; OTPs are delivered to phone).
+        // Filling a BLANK phone is deliberately blocked too — contact-less patients are the primary
+        // takeover target, so "fill only if empty" would not close the hole. Staff update these fields.
+        // Previously this test asserted `phone === newPhone`; that behaviour was the vulnerability.
+        // See api_tests/security/public_endpoint_auth_field_lock.test.ts (G26).
+        && !updatedDestination.phone
+        && updatedDestination.email === testEmail
     },
     { expectedResult: true }
   )

package/src/tests/api_tests/healthie_multi_integration.test.ts

@@ -8,9 +8,9 @@ import {
   log_header,
   wait,
 } from "@tellescope/testing"
-import { evaluate_conditional_logic_for_enduser_fields } from "@tellescope/utilities"
+import { evaluate_conditional_logic_for_enduser_fields, objects_equivalent } from "@tellescope/utilities"
 import { setup_tests } from "../setup"
-import { BUILT_INS_FOR_SET_FIELDS, HEALTHIE_TITLE } from "@tellescope/constants"
+import { BUILT_INS_FOR_SET_FIELDS, ENDUSER_FIELD_TYPES, EnduserField, HEALTHIE_TITLE } from "@tellescope/constants"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
@@ -27,6 +27,12 @@ export const healthie_multi_integration_tests = async ({ sdk, sdkNonAdmin } : {
   let enduserId = ''
   let formsortEnduserId = ''
   let formId = ''
+  let hiddenFormId = ''
+  let multipleChoiceFormId = ''
+  let hiddenIntakeEnduserId = ''
+  let multipleChoiceIntakeEnduserId = ''
+  let numberIntakeEnduserId = ''
+  const formResponseIds: string[] = []
 
   try {
     // ── Set Fields support ────────────────────────────────────────────────────────────────────
@@ -236,6 +242,90 @@ export const healthie_multi_integration_tests = async ({ sdk, sdkNonAdmin } : {
       { onResult: e => e.healthieIntegrationId === 'somewhere-else' },
     )
 
+    // ── Form intake field: "Update Patient Profile" writes the top-level enduser column ──
+    const submitIntakeResponse = async (enduserId: string, formId: string, response: any) => {
+      const { accessCode, response: prepared } = await sdk.api.form_responses.prepare_form_response({ enduserId, formId })
+      formResponseIds.push(prepared.id)
+      await sdk.api.form_responses.submit_form_response({ accessCode, responses: [response] })
+    }
+
+    const hiddenForm = await sdk.api.forms.createOne({ title: "Multi Healthie Intake (Hidden Value)" })
+    hiddenFormId = hiddenForm.id
+    const hiddenField = await sdk.api.form_fields.createOne({
+      formId: hiddenForm.id,
+      title: "Healthie Integration",
+      type: 'Hidden Value',
+      intakeField: 'healthieIntegrationId',
+      previousFields: [{ type: 'root', info: {} }],
+    })
+
+    const hiddenIntakeEnduser = await sdk.api.endusers.createOne({ email: 'multi-healthie-intake-hidden@tellescope.com' })
+    hiddenIntakeEnduserId = hiddenIntakeEnduser.id
+
+    await submitIntakeResponse(hiddenIntakeEnduserId, hiddenForm.id, {
+      fieldId: hiddenField.id, fieldTitle: hiddenField.title, answer: { type: 'Hidden Value', value: TAG },
+    })
+    await async_test(
+      "Hidden Value intake field sets healthieIntegrationId",
+      () => sdk.api.endusers.getOne(hiddenIntakeEnduserId),
+      { onResult: e => e.healthieIntegrationId === TAG },
+    )
+
+    // Multiple Choice answers arrive as arrays — the stored value must be the collapsed scalar,
+    // otherwise stringValidator100 rejects the update and takes the whole submission's intake down
+    const multipleChoiceForm = await sdk.api.forms.createOne({ title: "Multi Healthie Intake (Multiple Choice)" })
+    multipleChoiceFormId = multipleChoiceForm.id
+    const multipleChoiceField = await sdk.api.form_fields.createOne({
+      formId: multipleChoiceForm.id,
+      title: "Which clinic?",
+      type: 'multiple_choice',
+      intakeField: 'healthieIntegrationId',
+      options: { choices: [TAG, 'other-clinic'], radio: true },
+      previousFields: [{ type: 'root', info: {} }],
+    })
+
+    const multipleChoiceIntakeEnduser = await sdk.api.endusers.createOne({ email: 'multi-healthie-intake-mc@tellescope.com' })
+    multipleChoiceIntakeEnduserId = multipleChoiceIntakeEnduser.id
+
+    await submitIntakeResponse(multipleChoiceIntakeEnduserId, multipleChoiceForm.id, {
+      fieldId: multipleChoiceField.id, fieldTitle: multipleChoiceField.title, answer: { type: 'multiple_choice', value: [TAG] },
+    })
+    await async_test(
+      "Multiple Choice intake field stores healthieIntegrationId as a scalar",
+      () => sdk.api.endusers.getOne(multipleChoiceIntakeEnduserId),
+      { onResult: e => e.healthieIntegrationId === TAG },
+    )
+
+    // Allowed form field types. The form_fields model validates intakeField as a free string (isFormField,
+    // which checks ENDUSER_FIELD_TYPES, is not wired into its schema), so this is enforced in the form editor
+    // rather than by the API — same as every other intake field. Assert the shared constant the editor reads.
+    assert(
+      objects_equivalent(
+        ENDUSER_FIELD_TYPES['healthieIntegrationId' as EnduserField],
+        ['Hidden Value', 'Dropdown', 'multiple_choice', 'string'],
+      ),
+      'ENDUSER_FIELD_TYPES error', 'healthieIntegrationId is limited to Hidden Value, Dropdown, Multiple Choice, and Text',
+    )
+
+    // An incompatible type is accepted by the API but must never write a non-string to the enduser column
+    const numberField = await sdk.api.form_fields.createOne({
+      formId: multipleChoiceForm.id,
+      title: "Bad Type",
+      type: 'number',
+      intakeField: 'healthieIntegrationId',
+      previousFields: [{ type: 'after', info: { fieldId: multipleChoiceField.id } }],
+    })
+    const numberIntakeEnduser = await sdk.api.endusers.createOne({ email: 'multi-healthie-intake-number@tellescope.com' })
+    numberIntakeEnduserId = numberIntakeEnduser.id
+    await submitIntakeResponse(numberIntakeEnduserId, multipleChoiceForm.id, {
+      fieldId: numberField.id, fieldTitle: numberField.title, answer: { type: 'number', value: 5 },
+    })
+    await async_test(
+      "non-string answer for the healthieIntegrationId intake field is ignored",
+      () => sdk.api.endusers.getOne(numberIntakeEnduserId),
+      { onResult: e => !e.healthieIntegrationId },
+    )
+
     // ── Removing the primary must not affect the tagged integration; org list recomputes on delete ──
     await sdk.api.integrations.deleteOne(primaryIntegrationId)
     primaryIntegrationId = ''
@@ -258,9 +348,17 @@ export const healthie_multi_integration_tests = async ({ sdk, sdkNonAdmin } : {
       if (!id) continue
       await sdk.api.integrations.deleteOne(id).catch(console.error)
     }
-    if (enduserId) await sdk.api.endusers.deleteOne(enduserId).catch(console.error)
-    if (formsortEnduserId) await sdk.api.endusers.deleteOne(formsortEnduserId).catch(console.error)
-    if (formId) await sdk.api.forms.deleteOne(formId).catch(console.error)
+    for (const id of formResponseIds) {
+      await sdk.api.form_responses.deleteOne(id).catch(console.error)
+    }
+    for (const id of [enduserId, formsortEnduserId, hiddenIntakeEnduserId, multipleChoiceIntakeEnduserId, numberIntakeEnduserId]) {
+      if (!id) continue
+      await sdk.api.endusers.deleteOne(id).catch(console.error)
+    }
+    for (const id of [formId, hiddenFormId, multipleChoiceFormId]) {
+      if (!id) continue
+      await sdk.api.forms.deleteOne(id).catch(console.error)
+    }
   }
 }
 

package/src/tests/api_tests/phone_calls_conference_hold.test.ts

@@ -0,0 +1,62 @@
+require('source-map-support').install();
+
+import { Session } from "../../sdk"
+import {
+  async_test,
+  handleAnyError,
+  log_header,
+} from "@tellescope/testing"
+import { setup_tests } from "../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+// Validation-path tests for the modify-conference-attendee-status endpoint. All assertions
+// below hit validations that run before any Twilio access, so no Twilio config is needed.
+// conferenceId is not settable via the public API (only set internally by conference
+// webhooks), so the Twilio hold/unhold branches are covered by manual E2E testing only.
+export const phone_calls_conference_hold_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("Phone Calls Conference Hold Tests")
+
+  await async_test(
+    "modify_conference_attendee_status: no status fields rejected",
+    () => sdk.api.phone_calls.modify_conference_attendee_status({ conferenceId: 'CAconferenceholdtest0000000000001' }),
+    { shouldError: true, onError: (e: any) => e.message === "At least one status field (e.g. hold) must be provided" }
+  )
+  await async_test(
+    "modify_conference_attendee_status: bogus conferenceId rejected",
+    () => sdk.api.phone_calls.modify_conference_attendee_status({ conferenceId: 'CAdoesnotexist0000000000000000000', hold: true }),
+    { shouldError: true, onError: (e: any) => e.message === "Call not found" }
+  )
+  await async_test(
+    "modify_conference_attendee_status: hold false also validated against record access",
+    () => sdk.api.phone_calls.modify_conference_attendee_status({ conferenceId: 'CAdoesnotexist0000000000000000000', hold: false }),
+    { shouldError: true, onError: (e: any) => e.message === "Call not found" }
+  )
+  await async_test(
+    "modify_conference_attendee_status: non-admin cannot hold an inaccessible conference",
+    () => sdkNonAdmin.api.phone_calls.modify_conference_attendee_status({ conferenceId: 'CAdoesnotexist0000000000000000000', hold: true }),
+    handleAnyError
+  )
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await phone_calls_conference_hold_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ Phone calls conference hold test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Phone calls conference hold test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/scoped_api_keys.test.ts

@@ -35,6 +35,7 @@ export const scoped_api_keys_tests = async ({ sdk, sdkNonAdmin } : { sdk: Sessio
 
   const keyIds: string[] = []
   const formResponseIds: string[] = []
+  const fileIds: string[] = []
   let throwawayUserId: string | undefined
   let throwawayRoleId: string | undefined
 
@@ -77,6 +78,11 @@ export const scoped_api_keys_tests = async ({ sdk, sdkNonAdmin } : { sdk: Sessio
       }),
       { shouldError: true, onError: (e: any) => e.response?.status === 401 },
     )
+    await async_test(
+      "scoped key cannot create API keys (escalation guard)",
+      () => axios.post(`${host}/v1/api-key`, {}, { headers: { Authorization: `API_KEY ${scoped.key}` } }),
+      { shouldError: true, onError: (e: any) => e.response?.status === 401 },
+    )
 
     // =============================================
     // (c) Scoped key IS accepted by the form-ingestion webhook
@@ -101,6 +107,44 @@ export const scoped_api_keys_tests = async ({ sdk, sdkNonAdmin } : { sdk: Sessio
     )
     if (pathResult.data?.formResponseId) formResponseIds.push(pathResult.data.formResponseId)
 
+    // =============================================
+    // (c2) Scoped key CAN run the file-upload flow (prepare + confirm) — needed for intake forms with files
+    // =============================================
+    const scopedSession = new Session({ host, apiKey: scoped.key })
+    const { file: uploadedFile } = await scopedSession.api.files.prepare_file_upload({
+      name: 'scoped-intake-file.txt', size: 12, type: 'text/plain',
+    })
+    assert(
+      !!uploadedFile?.id,
+      "scoped key prepare_file_upload returned no file",
+      "scoped key can call POST /prepare-file-upload",
+    )
+    if (uploadedFile?.id) fileIds.push(uploadedFile.id)
+
+    await async_test(
+      "scoped key can call POST /files/confirm-upload",
+      () => scopedSession.api.files.confirm_file_upload({ id: uploadedFile.id }),
+      { onResult: () => true },
+    )
+
+    // ...but is blocked from EVERY other endpoint in the files domain — proving the two allowed paths are the
+    // ONLY files access, and that the '/files/confirm-upload' allow-prefix does not open the '/files/*' namespace.
+    const blockedFileEndpoints: [string, () => Promise<any>][] = [
+      ['GET /v1/files (readMany)', () => axios.get(`${host}/v1/files`, { headers: { Authorization: `API_KEY ${scoped.key}` } })],
+      ['GET /v1/file/:id (read one)', () => axios.get(`${host}/v1/file/000000000000000000000000`, { headers: { Authorization: `API_KEY ${scoped.key}` } })],
+      ['DELETE /v1/file/:id (destructive)', () => axios.delete(`${host}/v1/file/000000000000000000000000`, { headers: { Authorization: `API_KEY ${scoped.key}` } })],
+      ['POST /v1/files/send-fax (/files/* sibling)', () => axios.post(`${host}/v1/files/send-fax`, {}, { headers: { Authorization: `API_KEY ${scoped.key}` } })],
+      ['POST /v1/files/ocr (/files/* sibling)', () => axios.post(`${host}/v1/files/ocr`, {}, { headers: { Authorization: `API_KEY ${scoped.key}` } })],
+      ['POST /v1/files/push (/files/* sibling)', () => axios.post(`${host}/v1/files/push`, {}, { headers: { Authorization: `API_KEY ${scoped.key}` } })],
+    ]
+    for (const [label, call] of blockedFileEndpoints) {
+      await async_test(
+        `scoped key blocked on ${label}`,
+        call,
+        { shouldError: true, onError: (e: any) => e.response?.status === 401 || e.response?.status === 403 },
+      )
+    }
+
     // =============================================
     // (d) Non-admin cannot create a scoped key (throwaway user, never mutate existing roles)
     // =============================================
@@ -185,6 +229,46 @@ export const scoped_api_keys_tests = async ({ sdk, sdkNonAdmin } : { sdk: Sessio
       "get_organization_api_keys still never returns key/hashedKey",
     )
 
+    // =============================================
+    // (g) Legacy non-/v1 funnel (app.js requireLoginAndAccess → is_logged_in_API_key with NO requestPath).
+    // Proves scoped keys fail closed on every non-/v1 caller (also stands in for the Medplum webhook path),
+    // and that unscoped keys still authenticate the legacy funnel after this work.
+    // NOTE: the legacy middleware reads the key from ?apiKey= / body only (never the Authorization header).
+    // =============================================
+    await async_test(
+      "unscoped key authenticates a legacy non-/v1 route",
+      () => axios.get(`${host}/API-keys-for-user?apiKey=${encodeURIComponent(unscopedKeyValue)}`),
+      { onResult: (r: any) => r.status === 200 },
+    )
+    await async_test(
+      "scoped key rejected on a legacy non-/v1 route (fail closed, no requestPath)",
+      () => axios.get(`${host}/API-keys-for-user?apiKey=${encodeURIComponent(scoped.key)}`),
+      { shouldError: true, onError: (e: any) => e.response?.status === 401 },
+    )
+
+    // =============================================
+    // (h) Data-egress adjacency: the scope's allowed paths must NOT leak to the file DOWNLOAD endpoint.
+    // =============================================
+    await async_test(
+      "scoped key cannot call file_download_URL (no PHI egress)",
+      () => axios.get(`${host}/v1/file-download-URL?secureName=nonexistent`, { headers: { Authorization: `API_KEY ${scoped.key}` } }),
+      { shouldError: true, onError: (e: any) => e.response?.status === 401 || e.response?.status === 403 },
+    )
+
+    // =============================================
+    // (i) Transport independence: the scope gate applies whether the key is in the header or the ?apiKey= query.
+    // =============================================
+    await async_test(
+      "scoped key via ?apiKey= query param still rejected on a disallowed /v1 endpoint",
+      () => axios.get(`${host}/v1/endusers?apiKey=${encodeURIComponent(scoped.key)}`),
+      { shouldError: true, onError: (e: any) => e.response?.status === 401 || e.response?.status === 403 },
+    )
+    await async_test(
+      "unscoped key via ?apiKey= query param still authenticates /v1 (regression)",
+      () => axios.get(`${host}/v1/test-authenticated?apiKey=${encodeURIComponent(unscopedKeyValue)}`),
+      { onResult: (r: any) => r.status === 200 },
+    )
+
     // =============================================
     // Validation: unknown scope values are rejected
     // =============================================
@@ -200,6 +284,9 @@ export const scoped_api_keys_tests = async ({ sdk, sdkNonAdmin } : { sdk: Sessio
     for (const id of formResponseIds) {
       await sdk.api.form_responses.deleteOne(id).catch(() => {})
     }
+    for (const id of fileIds) {
+      await sdk.api.files.deleteOne(id).catch(() => {})
+    }
     try {
       const enduser = await sdk.api.endusers.getOne({ email: TEST_EMAIL })
       await sdk.api.endusers.deleteOne(enduser.id)

package/src/tests/api_tests/security/F-0106-F-0110-enduser-write-restrictions.test.ts

@@ -43,8 +43,15 @@ const restrictedEnduserUpdates = (staffId: string, mongoId: string): Record<stri
 })
 
 // Every form_responses field marked enduserUpdatesDisabled in schema.ts.
-const restrictedFormResponseUpdates = (staffId: string): Record<string, any> => ({
+// otherEnduserId must be a REAL enduser other than the one submitting the update: enduserId's
+// foreign key is existence-checked, so a nonexistent id would be rejected as a bad dependency
+// rather than by the write restriction under test.
+const restrictedFormResponseUpdates = (staffId: string, otherEnduserId: string): Record<string, any> => ({
   markedAsSubmitted: true,
+  // repointing a response at another patient redirects the intake write in
+  // save_enduser_updates_for_form_response, which is how email/phone (authentication channels)
+  // reach an enduser record — see api_tests/security/public_endpoint_auth_field_lock.test.ts
+  enduserId: otherEnduserId,
   submittedBy: staffId,
   submittedAt: new Date("2024-01-01T00:00:00Z"),
   submittedByIsPlaceholder: true,
@@ -84,6 +91,7 @@ export const enduser_write_restrictions_tests = async ({ sdk } : { sdk: Session,
   log_header("F-0106/F-0110: enduser write restrictions (enduserUpdatesDisabled)")
 
   let enduserId: string | undefined
+  let otherEnduserId: string | undefined
   let formId: string | undefined
   let formResponseId: string | undefined
 
@@ -92,6 +100,12 @@ export const enduser_write_restrictions_tests = async ({ sdk } : { sdk: Session,
     const enduserEmail = `f0106-enduser-${Date.now()}@example.com`
     const enduser = await sdk.api.endusers.createOne({ email: enduserEmail, fname: 'F0106', lname: 'Restricted' })
     enduserId = enduser.id
+
+    // The would-be victim of an enduserId repoint, and the destination for the staff positive control.
+    const otherEnduser = await sdk.api.endusers.createOne({
+      email: `f0106-other-${Date.now()}@example.com`, fname: 'F0106', lname: 'Other',
+    })
+    otherEnduserId = otherEnduser.id
     await sdk.api.endusers.set_password({ id: enduser.id, password: ENDUSER_PASSWORD })
 
     const enduserSDK = new EnduserSession({ host, businessId })
@@ -123,7 +137,7 @@ export const enduser_write_restrictions_tests = async ({ sdk } : { sdk: Session,
     )
 
     // ---- F-0110: enduser self-update of restricted form_responses fields must 400 ----
-    for (const [field, value] of Object.entries(restrictedFormResponseUpdates(sdk.userInfo.id))) {
+    for (const [field, value] of Object.entries(restrictedFormResponseUpdates(sdk.userInfo.id, otherEnduser.id))) {
       await async_test(
         `F-0110: enduser cannot self-update form_responses.${field}`,
         () => enduserSDK.api.form_responses.updateOne(formResponse.id, { [field]: value } as any),
@@ -132,9 +146,13 @@ export const enduser_write_restrictions_tests = async ({ sdk } : { sdk: Session,
     }
 
     await async_test(
-      'F-0110: rejected writes did not persist (markedAsSubmitted, procedureCodes, submittedBy)',
+      'F-0110: rejected writes did not persist (markedAsSubmitted, procedureCodes, submittedBy, enduserId)',
       () => sdk.api.form_responses.getOne(formResponse.id),
-      { onResult: fr => !fr.markedAsSubmitted && !fr.procedureCodes?.length && fr.submittedBy === undefined },
+      { onResult: fr => (
+        !fr.markedAsSubmitted && !fr.procedureCodes?.length && fr.submittedBy === undefined
+        // still points at its own patient: a successful repoint is what redirects the intake write
+        && fr.enduserId === enduser.id
+      ) },
     )
 
     // ---- Positive controls: intended enduser self-updates still work ----
@@ -178,6 +196,19 @@ export const enduser_write_restrictions_tests = async ({ sdk } : { sdk: Session,
         && !!fr.tags?.includes('staff-set-tag')
       ) },
     )
+
+    // enduserId is enduserUpdatesDisabled rather than updatesDisabled specifically so this keeps
+    // working: staff sometimes need to move a response to the correct profile to fix a mistake.
+    await async_test(
+      'staff can still repoint form_responses.enduserId to another patient',
+      () => sdk.api.form_responses.updateOne(formResponse.id, { enduserId: otherEnduser.id }),
+      { onResult: fr => fr.enduserId === otherEnduser.id },
+    )
+    await async_test(
+      'staff can repoint form_responses.enduserId back',
+      () => sdk.api.form_responses.updateOne(formResponse.id, { enduserId: enduser.id }),
+      { onResult: fr => fr.enduserId === enduser.id },
+    )
   } finally {
     if (formResponseId) {
       try { await sdk.api.form_responses.deleteOne(formResponseId) } catch {}
@@ -188,6 +219,9 @@ export const enduser_write_restrictions_tests = async ({ sdk } : { sdk: Session,
     if (enduserId) {
       try { await sdk.api.endusers.deleteOne(enduserId) } catch {}
     }
+    if (otherEnduserId) {
+      try { await sdk.api.endusers.deleteOne(otherEnduserId) } catch {}
+    }
   }
 }