@tellescope/sdk 1.255.18 → 1.255.19

package/lib/cjs/tests/api_tests/security/F-0166-allowed-paths-wildcard-bypass.test.js

@@ -0,0 +1,773 @@
+"use strict";
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.allowed_paths_confinement_tests = void 0;
+require('source-map-support').install();
+var axios_1 = __importDefault(require("axios"));
+var sdk_1 = require("../../../sdk");
+var testing_1 = require("@tellescope/testing");
+var setup_1 = require("../../setup");
+var host = process.env.API_URL || 'http://localhost:8080';
+/**
+ * Regression test for F-0166 — allowedPaths wildcard disables path confinement entirely.
+ *
+ * Several public, unauthenticated endpoints mint a JWT confined to a small set of API paths via an
+ * `allowedPaths` claim. The enforcement predicate (api/modules/authentication.ts checkAccess)
+ * contained:
+ *
+ *     || (p.endsWith('*') && req.path.split('/')[0] === p.split('/')[0])
+ *
+ * Every request path begins with '/', so req.path.split('/')[0] is ''. Every wildcard entry also
+ * begins with '/', so p.split('/')[0] is ''. The clause reduces to '' === '' — always true. Any
+ * allowedPaths array containing a single '*' entry therefore matched EVERY request path and the
+ * 403 never fired.
+ *
+ * Two mint sites contain `/meeting/*`, and both are public and unauthenticated:
+ *   - session_for_join_link  — enduser session, MFA bypassed
+ *   - session_for_start_link — full STAFF session with mfa: false
+ *
+ * So an unauthenticated caller holding a link token had an effectively unrestricted session.
+ *
+ * Fixing that exposed a second defect in the same primitive: entries matched by bare string prefix
+ * with no notion of HTTP method, so '/users' and '/endusers' were collection-NAMESPACE grants (22
+ * and 21 routes each). The worst consequence was a full escape — PATCH /users/consent called
+ * login_user on a freshly-read DB record with no options, minting a token with no allowedPaths at
+ * all, so two requests turned a start link into an unconfined staff session.
+ *
+ * Fix, in two parts:
+ *   - entries are now method-scoped and exact ('get:/endusers'), with ':param' for segments not
+ *     knowable at mint time ('get:/meeting/:id'). Un-prefixed and '*' entries remain honoured only
+ *     so tokens minted before this grammar keep working until they expire.
+ *   - consent / configure_inbox / switch_account forward req.session.allowedPaths into login_user.
+ *
+ * Scenarios:
+ *   S1 public-form session  — no wildcard; correctly confined throughout (regression anchor)
+ *   S2 join-link session    — RED before the wildcard fix
+ *   S3 start-link session   — RED before the wildcard fix (staff session; the severe case)
+ *   S4 side-effects of the /calendar-events entry
+ *   S6 namespace grants and the privilege-escalation chain — RED before method-scoped exact matching
+ *   S5 ordinary sessions with no allowedPaths claim, incl. headless API-key callers, are unaffected
+ */
+var RAND = function () { return Math.random().toString(36).slice(2, 10); };
+var OBJECT_ID = '68a1b2c3d4e5f60718293a4b';
+var allowed_paths_confinement_tests = function (_a) {
+    var sdk = _a.sdk;
+    return __awaiter(void 0, void 0, void 0, function () {
+        var probes, request, isPathDenial, expectDenied, expectAllowed, formId, productId, joinEnduserId, formEnduserEmail, hostUserId, eventIds, businessId, form, publicFormSession, product, joinEnduser, joinLinkToken, joinEvent, unrelatedEvent, joinSession, hostUser, startLinkToken, startEvent, startSession, baselineEnduserToken, baselineUserToken, S1, S2, refreshedJoin, refreshedJoinToken, S3, refreshedStart, refreshedStartToken, S4, prefixGranted, _i, prefixGranted_1, _b, method, path, r, S6, ABSENT_ID_A, ABSENT_ID_B, INVALID_EMAIL, consentAttempt, refreshedForScopes, rescopedToken, S5, _c, _d, path, _e, _f, path, adminAuthenticated, apiKeySDK, _g, _h, path, r, failures, scenarios, _loop_1, _j, scenarios_1, scenario, _k, probes_1, p, _l, eventIds_1, id, _m, _o, e, _p, _q, _r, _s;
+        var _t, _u, _v, _w;
+        return __generator(this, function (_x) {
+            switch (_x.label) {
+                case 0:
+                    (0, testing_1.log_header)("F-0166: allowedPaths wildcard bypasses session path confinement");
+                    probes = [];
+                    request = function (token, method, path, data) { return __awaiter(void 0, void 0, void 0, function () {
+                        var r;
+                        return __generator(this, function (_a) {
+                            switch (_a.label) {
+                                case 0: return [4 /*yield*/, axios_1.default.request(__assign(__assign({ method: method, url: "".concat(host, "/v1").concat(path) }, method === 'get' ? { params: data } : { data: data }), { headers: { Authorization: "Bearer ".concat(token) }, validateStatus: function () { return true; } }))];
+                                case 1:
+                                    r = _a.sent();
+                                    return [2 /*return*/, { status: r.status, body: r.data }];
+                            }
+                        });
+                    }); };
+                    isPathDenial = function (r) {
+                        var _a;
+                        return (r.status === 403 && ((_a = r.body) === null || _a === void 0 ? void 0 : _a.message) === 'Inaccessible');
+                    };
+                    expectDenied = function (scenario, label, confinedToken, baselineToken, method, path, data) { return __awaiter(void 0, void 0, void 0, function () {
+                        var baseline, confined;
+                        return __generator(this, function (_a) {
+                            switch (_a.label) {
+                                case 0: return [4 /*yield*/, request(baselineToken, method, path, data)];
+                                case 1:
+                                    baseline = _a.sent();
+                                    return [4 /*yield*/, request(confinedToken, method, path, data)];
+                                case 2:
+                                    confined = _a.sent();
+                                    probes.push({
+                                        scenario: scenario,
+                                        label: label,
+                                        path: path,
+                                        expected: 'denied',
+                                        status: confined.status,
+                                        baselineStatus: baseline.status,
+                                        pass: baseline.status !== 403 && isPathDenial(confined),
+                                        note: baseline.status === 403 ? 'BAD PROBE: baseline session also got 403' : undefined,
+                                    });
+                                    return [2 /*return*/];
+                            }
+                        });
+                    }); };
+                    expectAllowed = function (scenario, label, token, method, path, data, _a) {
+                        var _b = _a === void 0 ? {} : _a, _c = _b.allow401, allow401 = _c === void 0 ? false : _c;
+                        return __awaiter(void 0, void 0, void 0, function () {
+                            var r;
+                            return __generator(this, function (_d) {
+                                switch (_d.label) {
+                                    case 0: return [4 /*yield*/, request(token, method, path, data)];
+                                    case 1:
+                                        r = _d.sent();
+                                        probes.push({
+                                            scenario: scenario,
+                                            label: label,
+                                            path: path,
+                                            expected: 'allowed',
+                                            status: r.status,
+                                            pass: r.status !== 403 && (allow401 || r.status !== 401),
+                                            note: allow401 && r.status === 401 ? '401 expected: enduser cannot authenticate this model' : undefined,
+                                        });
+                                        return [2 /*return*/];
+                                }
+                            });
+                        });
+                    };
+                    eventIds = [];
+                    _x.label = 1;
+                case 1:
+                    _x.trys.push([1, , 101, 130]);
+                    businessId = sdk.userInfo.businessId;
+                    return [4 /*yield*/, sdk.api.forms.createOne({
+                            title: "F-0166 path confinement ".concat(RAND()),
+                            allowPublicURL: true,
+                        })];
+                case 2:
+                    form = _x.sent();
+                    formId = form.id;
+                    return [4 /*yield*/, sdk.api.form_fields.createOne({
+                            formId: form.id,
+                            title: 'q',
+                            type: 'string',
+                            previousFields: [{ type: 'root', info: {} }],
+                        })];
+                case 3:
+                    _x.sent();
+                    formEnduserEmail = "f0166-form-".concat(RAND(), "@tellescope.example");
+                    return [4 /*yield*/, new sdk_1.EnduserSession({ host: host, businessId: businessId })
+                            .api.form_responses.session_for_public_form({
+                            businessId: businessId,
+                            formId: form.id,
+                            email: formEnduserEmail,
+                            fname: 'Path',
+                            lname: 'Confinement',
+                            skipMatch: true, // also skips the intake-phone requirement
+                        })];
+                case 4:
+                    publicFormSession = _x.sent();
+                    return [4 /*yield*/, sdk.api.products.createOne({
+                            title: "F-0166 product ".concat(RAND()),
+                            cost: { amount: 500, currency: 'USD' },
+                            processor: 'Stripe',
+                        })];
+                case 5:
+                    product = _x.sent();
+                    productId = product.id;
+                    return [4 /*yield*/, sdk.api.endusers.createOne({
+                            email: "f0166-join-".concat(RAND(), "@tellescope.example"),
+                        })];
+                case 6:
+                    joinEnduser = _x.sent();
+                    joinEnduserId = joinEnduser.id;
+                    joinLinkToken = "f0166-join-".concat(RAND()).concat(RAND());
+                    return [4 /*yield*/, sdk.api.calendar_events.createOne({
+                            title: 'F-0166 join', durationInMinutes: 30, startTimeInMS: Date.now() + 3600000,
+                            attendees: [{ type: 'enduser', id: joinEnduser.id, joinLinkToken: joinLinkToken }],
+                        })];
+                case 7:
+                    joinEvent = _x.sent();
+                    eventIds.push(joinEvent.id);
+                    return [4 /*yield*/, sdk.api.calendar_events.createOne({
+                            title: 'F-0166 unrelated', durationInMinutes: 30, startTimeInMS: Date.now() + 3600000,
+                            attendees: [{ type: 'enduser', id: joinEnduser.id }],
+                        })];
+                case 8:
+                    unrelatedEvent = _x.sent();
+                    eventIds.push(unrelatedEvent.id);
+                    return [4 /*yield*/, new sdk_1.EnduserSession({ host: host, businessId: businessId })
+                            .api.calendar_events.session_for_join_link({ token: joinLinkToken })
+                        // -- start link (STAFF session, allowedPaths contains /meeting/*)
+                        // throwaway user; verifiedEmail must be set at create time (it is rejected on update)
+                    ];
+                case 9:
+                    joinSession = _x.sent();
+                    return [4 /*yield*/, sdk.api.users.createOne({
+                            email: "f0166-host-".concat(RAND(), "@tellescope.example"),
+                            fname: 'Path', lname: 'Host',
+                            verifiedEmail: true,
+                            notificationEmailsDisabled: true,
+                        })];
+                case 10:
+                    hostUser = _x.sent();
+                    hostUserId = hostUser.id;
+                    startLinkToken = "f0166-start-".concat(RAND()).concat(RAND());
+                    return [4 /*yield*/, sdk.api.calendar_events.createOne({
+                            title: 'F-0166 start', durationInMinutes: 30, startTimeInMS: Date.now() + 3600000,
+                            attendees: [{ type: 'user', id: hostUser.id }, { type: 'enduser', id: joinEnduser.id }],
+                            startLinkToken: startLinkToken,
+                        })];
+                case 11:
+                    startEvent = _x.sent();
+                    eventIds.push(startEvent.id);
+                    return [4 /*yield*/, sdk.api.calendar_events.session_for_start_link({ token: startLinkToken })
+                        // -- unconfined baselines of each session type (generate_auth_token, never .authenticate)
+                    ];
+                case 12:
+                    startSession = _x.sent();
+                    return [4 /*yield*/, sdk.api.endusers.generate_auth_token({ id: joinEnduser.id })];
+                case 13:
+                    baselineEnduserToken = (_x.sent()).authToken;
+                    return [4 /*yield*/, sdk.api.users.generate_auth_token({ id: hostUser.id })
+                        /* ============ S1: public-form session — no wildcard, correctly confined already ============ */
+                    ];
+                case 14:
+                    baselineUserToken = (_x.sent()).authToken;
+                    S1 = 'S1 public-form';
+                    return [4 /*yield*/, expectAllowed(S1, 'always-allowed path', publicFormSession.authToken, 'get', '/test-authenticated')];
+                case 15:
+                    _x.sent();
+                    return [4 /*yield*/, expectAllowed(S1, 'listed: form info for access code', publicFormSession.authToken, 'get', '/form-info-for-access-code', { accessCode: publicFormSession.accessCode })];
+                case 16:
+                    _x.sent();
+                    return [4 /*yield*/, expectAllowed(S1, 'listed: refresh enduser session', publicFormSession.authToken, 'post', '/refresh-enduser-session')];
+                case 17:
+                    _x.sent();
+                    return [4 /*yield*/, expectAllowed(S1, 'listed: product by id', publicFormSession.authToken, 'get', "/product/".concat(productId))];
+                case 18:
+                    _x.sent();
+                    return [4 /*yield*/, expectDenied(S1, 'unlisted: calendar events', publicFormSession.authToken, baselineEnduserToken, 'get', '/calendar-events')];
+                case 19:
+                    _x.sent();
+                    return [4 /*yield*/, expectDenied(S1, 'unlisted: form responses', publicFormSession.authToken, baselineEnduserToken, 'get', '/form-responses')];
+                case 20:
+                    _x.sent();
+                    return [4 /*yield*/, expectDenied(S1, 'unlisted: files', publicFormSession.authToken, baselineEnduserToken, 'get', '/files')
+                        // 'get:/product' names one route, so it no longer leaks the whole /products namespace the way a
+                        // bare '/product' prefix entry did — that used to reach /products/prepare-stripe-checkout too
+                    ];
+                case 21:
+                    _x.sent();
+                    // 'get:/product' names one route, so it no longer leaks the whole /products namespace the way a
+                    // bare '/product' prefix entry did — that used to reach /products/prepare-stripe-checkout too
+                    return [4 /*yield*/, expectDenied(S1, 'exact matching: /products not granted by get:/product', publicFormSession.authToken, baselineEnduserToken, 'get', '/products')
+                        /* ============ S2: join-link session — RED before the fix ============ */
+                    ];
+                case 22:
+                    // 'get:/product' names one route, so it no longer leaks the whole /products namespace the way a
+                    // bare '/product' prefix entry did — that used to reach /products/prepare-stripe-checkout too
+                    _x.sent();
+                    S2 = 'S2 join-link (enduser)';
+                    return [4 /*yield*/, expectDenied(S2, 'unlisted: form responses', joinSession.authToken, baselineEnduserToken, 'get', '/form-responses')];
+                case 23:
+                    _x.sent();
+                    return [4 /*yield*/, expectDenied(S2, 'unlisted: files', joinSession.authToken, baselineEnduserToken, 'get', '/files')];
+                case 24:
+                    _x.sent();
+                    return [4 /*yield*/, expectDenied(S2, 'unlisted: portal customizations', joinSession.authToken, baselineEnduserToken, 'get', '/portal-customizations')];
+                case 25:
+                    _x.sent();
+                    return [4 /*yield*/, expectDenied(S2, 'unlisted: UNRELATED calendar event', joinSession.authToken, baselineEnduserToken, 'get', "/calendar-event/".concat(unrelatedEvent.id))];
+                case 26:
+                    _x.sent();
+                    return [4 /*yield*/, expectAllowed(S2, 'always-allowed path', joinSession.authToken, 'get', '/test-authenticated')];
+                case 27:
+                    _x.sent();
+                    return [4 /*yield*/, expectAllowed(S2, 'listed: my meetings', joinSession.authToken, 'get', '/my-meetings')
+                        // enduserActions for organizations is {}, so an enduser 401s here regardless of confinement
+                    ];
+                case 28:
+                    _x.sent();
+                    // enduserActions for organizations is {}, so an enduser 401s here regardless of confinement
+                    return [4 /*yield*/, expectAllowed(S2, 'listed: organizations', joinSession.authToken, 'get', '/organizations', undefined, { allow401: true })];
+                case 29:
+                    // enduserActions for organizations is {}, so an enduser 401s here regardless of confinement
+                    _x.sent();
+                    return [4 /*yield*/, expectAllowed(S2, 'listed: users', joinSession.authToken, 'get', '/users')];
+                case 30:
+                    _x.sent();
+                    return [4 /*yield*/, expectAllowed(S2, 'listed: pinned calendar event', joinSession.authToken, 'get', "/calendar-event/".concat(joinEvent.id))];
+                case 31:
+                    _x.sent();
+                    return [4 /*yield*/, expectAllowed(S2, 'wildcard: meeting by id', joinSession.authToken, 'get', "/meeting/".concat(OBJECT_ID))
+                        // the two paths widened in this change so the portal video flow keeps working
+                    ];
+                case 32:
+                    _x.sent();
+                    // the two paths widened in this change so the portal video flow keeps working
+                    return [4 /*yield*/, expectAllowed(S2, 'widened: calendar events list', joinSession.authToken, 'get', '/calendar-events')];
+                case 33:
+                    // the two paths widened in this change so the portal video flow keeps working
+                    _x.sent();
+                    return [4 /*yield*/, expectAllowed(S2, 'widened: join meeting for event', joinSession.authToken, 'post', '/join-meeting-for-event', { calendarEventId: joinEvent.id })
+                        // confinement must survive a refresh rather than widening
+                    ];
+                case 34:
+                    _x.sent();
+                    return [4 /*yield*/, request(joinSession.authToken, 'post', '/refresh-enduser-session', {})];
+                case 35:
+                    refreshedJoin = _x.sent();
+                    refreshedJoinToken = (_t = refreshedJoin.body) === null || _t === void 0 ? void 0 : _t.authToken;
+                    probes.push({
+                        scenario: S2, label: 'refresh returned a new token', path: '/refresh-enduser-session',
+                        expected: 'allowed', status: refreshedJoin.status, pass: !!refreshedJoinToken,
+                    });
+                    if (!refreshedJoinToken) return [3 /*break*/, 38];
+                    return [4 /*yield*/, expectDenied(S2, 'after refresh: still denied form responses', refreshedJoinToken, baselineEnduserToken, 'get', '/form-responses')];
+                case 36:
+                    _x.sent();
+                    return [4 /*yield*/, expectAllowed(S2, 'after refresh: still allowed my meetings', refreshedJoinToken, 'get', '/my-meetings')];
+                case 37:
+                    _x.sent();
+                    _x.label = 38;
+                case 38:
+                    S3 = 'S3 start-link (STAFF)';
+                    return [4 /*yield*/, expectDenied(S3, 'unlisted: form responses', startSession.authToken, baselineUserToken, 'get', '/form-responses')];
+                case 39:
+                    _x.sent();
+                    return [4 /*yield*/, expectDenied(S3, 'unlisted: journeys', startSession.authToken, baselineUserToken, 'get', '/journeys')];
+                case 40:
+                    _x.sent();
+                    return [4 /*yield*/, expectDenied(S3, 'unlisted: tickets', startSession.authToken, baselineUserToken, 'get', '/tickets')];
+                case 41:
+                    _x.sent();
+                    return [4 /*yield*/, expectDenied(S3, 'unlisted: data sync (org-wide change firehose)', startSession.authToken, baselineUserToken, 'get', '/data-sync', { from: new Date(Date.now() - 60000).toISOString() })];
+                case 42:
+                    _x.sent();
+                    return [4 /*yield*/, expectDenied(S3, 'unlisted: file download URL', startSession.authToken, baselineUserToken, 'get', '/file-download-URL', { secureName: 'f0166-does-not-exist' })];
+                case 43:
+                    _x.sent();
+                    return [4 /*yield*/, expectDenied(S3, 'unlisted: UNRELATED calendar event', startSession.authToken, baselineUserToken, 'get', "/calendar-event/".concat(unrelatedEvent.id))];
+                case 44:
+                    _x.sent();
+                    return [4 /*yield*/, expectAllowed(S3, 'always-allowed path', startSession.authToken, 'get', '/test-authenticated')];
+                case 45:
+                    _x.sent();
+                    return [4 /*yield*/, expectAllowed(S3, 'listed: my meetings', startSession.authToken, 'get', '/my-meetings')];
+                case 46:
+                    _x.sent();
+                    return [4 /*yield*/, expectAllowed(S3, 'listed: calendar events', startSession.authToken, 'get', '/calendar-events')];
+                case 47:
+                    _x.sent();
+                    return [4 /*yield*/, expectAllowed(S3, 'listed: organizations', startSession.authToken, 'get', '/organizations')];
+                case 48:
+                    _x.sent();
+                    return [4 /*yield*/, expectAllowed(S3, 'listed: users', startSession.authToken, 'get', '/users')];
+                case 49:
+                    _x.sent();
+                    return [4 /*yield*/, expectAllowed(S3, 'listed: endusers', startSession.authToken, 'get', '/endusers')];
+                case 50:
+                    _x.sent();
+                    return [4 /*yield*/, expectAllowed(S3, 'listed: pinned calendar event', startSession.authToken, 'get', "/calendar-event/".concat(startEvent.id))];
+                case 51:
+                    _x.sent();
+                    return [4 /*yield*/, expectAllowed(S3, 'wildcard: meeting by id', startSession.authToken, 'get', "/meeting/".concat(OBJECT_ID))];
+                case 52:
+                    _x.sent();
+                    return [4 /*yield*/, expectAllowed(S3, 'prefix descendant: users bulk-read', startSession.authToken, 'post', '/users/bulk-read', { ids: [hostUser.id] })];
+                case 53:
+                    _x.sent();
+                    return [4 /*yield*/, expectAllowed(S3, 'prefix descendant: endusers bulk-read', startSession.authToken, 'post', '/endusers/bulk-read', { ids: [joinEnduser.id] })];
+                case 54:
+                    _x.sent();
+                    return [4 /*yield*/, expectAllowed(S3, 'widened: join meeting for event', startSession.authToken, 'post', '/join-meeting-for-event', { calendarEventId: startEvent.id })];
+                case 55:
+                    _x.sent();
+                    return [4 /*yield*/, expectAllowed(S3, 'widened: add attendees to meeting', startSession.authToken, 'post', '/add-attendees-to-meeting', { id: OBJECT_ID })
+                        // login_user propagates allowedPaths implicitly through its ...toSign rest spread — the
+                        // "(ASSUMPTION)" comments in the mint sites depend on this, so assert it explicitly
+                    ];
+                case 56:
+                    _x.sent();
+                    return [4 /*yield*/, request(startSession.authToken, 'post', '/refresh-session', {})];
+                case 57:
+                    refreshedStart = _x.sent();
+                    refreshedStartToken = (_u = refreshedStart.body) === null || _u === void 0 ? void 0 : _u.authToken;
+                    probes.push({
+                        scenario: S3, label: 'refresh returned a new token', path: '/refresh-session',
+                        expected: 'allowed', status: refreshedStart.status, pass: !!refreshedStartToken,
+                    });
+                    if (!refreshedStartToken) return [3 /*break*/, 60];
+                    return [4 /*yield*/, expectDenied(S3, 'after refresh: still denied journeys', refreshedStartToken, baselineUserToken, 'get', '/journeys')];
+                case 58:
+                    _x.sent();
+                    return [4 /*yield*/, expectAllowed(S3, 'after refresh: still allowed my meetings', refreshedStartToken, 'get', '/my-meetings')];
+                case 59:
+                    _x.sent();
+                    _x.label = 60;
+                case 60:
+                    S4 = 'S4 widening side-effects';
+                    prefixGranted = [
+                        ['patch', '/calendar-events/bulk-update'],
+                        ['post', '/calendar-events/report'],
+                    ];
+                    _i = 0, prefixGranted_1 = prefixGranted;
+                    _x.label = 61;
+                case 61:
+                    if (!(_i < prefixGranted_1.length)) return [3 /*break*/, 64];
+                    _b = prefixGranted_1[_i], method = _b[0], path = _b[1];
+                    return [4 /*yield*/, axios_1.default.request({
+                            method: method,
+                            url: "".concat(host, "/v1").concat(path),
+                            data: {},
+                            headers: { Authorization: "Bearer ".concat(joinSession.authToken) },
+                            validateStatus: function () { return true; },
+                        })];
+                case 62:
+                    r = _x.sent();
+                    probes.push({
+                        scenario: S4,
+                        label: "enduser action gating blocks ".concat(method.toUpperCase(), " ").concat(path),
+                        path: path,
+                        expected: 'denied',
+                        status: r.status,
+                        pass: r.status === 401 || r.status === 403,
+                        note: 'prefix-granted by /calendar-events; blocked by enduserActions instead',
+                    });
+                    _x.label = 63;
+                case 63:
+                    _i++;
+                    return [3 /*break*/, 61];
+                case 64:
+                    S6 = 'S6 namespace escapes';
+                    ABSENT_ID_A = '68a1b2c3d4e5f60718293a4b';
+                    ABSENT_ID_B = '68a1b2c3d4e5f60718293a4c';
+                    INVALID_EMAIL = 'f0166-not-an-email';
+                    return [4 /*yield*/, expectDenied(S6, 'ESCAPE: /users/consent (minted an unconfined token)', startSession.authToken, baselineUserToken, 'patch', '/users/consent', { termsVersion: '1' })];
+                case 65:
+                    _x.sent();
+                    return [4 /*yield*/, expectDenied(S6, 'ESCAPE: /users/switch-account', startSession.authToken, baselineUserToken, 'post', '/users/switch-account', { targetUserId: ABSENT_ID_A })];
+                case 66:
+                    _x.sent();
+                    return [4 /*yield*/, expectDenied(S6, 'ESCAPE: /users/configure-inbox', startSession.authToken, baselineUserToken, 'post', '/users/configure-inbox', {})];
+                case 67:
+                    _x.sent();
+                    return [4 /*yield*/, expectDenied(S6, 'PHI: /endusers/load-inbox-data', startSession.authToken, baselineUserToken, 'get', '/endusers/load-inbox-data')];
+                case 68:
+                    _x.sent();
+                    return [4 /*yield*/, expectDenied(S6, 'PHI: /endusers/report', startSession.authToken, baselineUserToken, 'get', '/endusers/report')];
+                case 69:
+                    _x.sent();
+                    return [4 /*yield*/, expectDenied(S6, 'PHI: /endusers/engagement', startSession.authToken, baselineUserToken, 'get', '/endusers/engagement')];
+                case 70:
+                    _x.sent();
+                    return [4 /*yield*/, expectDenied(S6, 'DESTRUCTIVE: /endusers/merge', startSession.authToken, baselineUserToken, 'post', '/endusers/merge', { sourceEnduserId: ABSENT_ID_A, destinationEnduserId: ABSENT_ID_B })];
+                case 71:
+                    _x.sent();
+                    return [4 /*yield*/, expectDenied(S6, 'DESTRUCTIVE: /endusers/bulk-update', startSession.authToken, baselineUserToken, 'patch', '/endusers/bulk-update', { ids: [ABSENT_ID_A], fields: {} })
+                        // method scoping, end to end: the same path is readable but not writable.
+                        // Baselines use the ADMIN token — the throwaway host user cannot create users or endusers, so it
+                        // would 403 on permissions and the probe could not distinguish that from a confinement denial.
+                    ];
+                case 72:
+                    _x.sent();
+                    // method scoping, end to end: the same path is readable but not writable.
+                    // Baselines use the ADMIN token — the throwaway host user cannot create users or endusers, so it
+                    // would 403 on permissions and the probe could not distinguish that from a confinement denial.
+                    return [4 /*yield*/, expectAllowed(S6, 'method scoping: GET /endusers allowed', startSession.authToken, 'get', '/endusers')];
+                case 73:
+                    // method scoping, end to end: the same path is readable but not writable.
+                    // Baselines use the ADMIN token — the throwaway host user cannot create users or endusers, so it
+                    // would 403 on permissions and the probe could not distinguish that from a confinement denial.
+                    _x.sent();
+                    return [4 /*yield*/, expectDenied(S6, 'method scoping: POST /endusers (create) denied', startSession.authToken, sdk.authToken, 'post', '/endusers', { email: INVALID_EMAIL })];
+                case 74:
+                    _x.sent();
+                    return [4 /*yield*/, expectAllowed(S6, 'method scoping: GET /users allowed', startSession.authToken, 'get', '/users')];
+                case 75:
+                    _x.sent();
+                    return [4 /*yield*/, expectDenied(S6, 'method scoping: POST /users (create) denied', startSession.authToken, sdk.authToken, 'post', '/users', { email: INVALID_EMAIL })
+                        // even if consent were reachable, the token it mints must stay confined (defense in depth)
+                    ];
+                case 76:
+                    _x.sent();
+                    return [4 /*yield*/, request(startSession.authToken, 'patch', '/users/consent', { termsVersion: '1' })];
+                case 77:
+                    consentAttempt = _x.sent();
+                    if (!(consentAttempt.status === 200 && ((_v = consentAttempt.body) === null || _v === void 0 ? void 0 : _v.authToken))) return [3 /*break*/, 79];
+                    return [4 /*yield*/, expectDenied(S6, 'consent-minted token is still confined', consentAttempt.body.authToken, baselineUserToken, 'get', '/journeys')];
+                case 78:
+                    _x.sent();
+                    _x.label = 79;
+                case 79: return [4 /*yield*/, request(startSession.authToken, 'post', '/refresh-session', {})];
+                case 80:
+                    refreshedForScopes = _x.sent();
+                    rescopedToken = (_w = refreshedForScopes.body) === null || _w === void 0 ? void 0 : _w.authToken;
+                    probes.push({
+                        scenario: S6, label: 'refresh returned a new token', path: '/refresh-session',
+                        expected: 'allowed', status: refreshedForScopes.status, pass: !!rescopedToken,
+                    });
+                    if (!rescopedToken) return [3 /*break*/, 86];
+                    return [4 /*yield*/, expectDenied(S6, 'after refresh: still cannot reach /users/consent', rescopedToken, baselineUserToken, 'patch', '/users/consent', { termsVersion: '1' })];
+                case 81:
+                    _x.sent();
+                    return [4 /*yield*/, expectDenied(S6, 'after refresh: still cannot reach /endusers/load-inbox-data', rescopedToken, baselineUserToken, 'get', '/endusers/load-inbox-data')];
+                case 82:
+                    _x.sent();
+                    return [4 /*yield*/, expectDenied(S6, 'after refresh: POST /endusers still denied', rescopedToken, baselineUserToken, 'post', '/endusers', { email: "f0166-should-not-exist-".concat(RAND(), "@tellescope.example") })];
+                case 83:
+                    _x.sent();
+                    return [4 /*yield*/, expectAllowed(S6, 'after refresh: GET /endusers still allowed', rescopedToken, 'get', '/endusers')];
+                case 84:
+                    _x.sent();
+                    return [4 /*yield*/, expectAllowed(S6, 'after refresh: my-meetings still allowed', rescopedToken, 'get', '/my-meetings')];
+                case 85:
+                    _x.sent();
+                    _x.label = 86;
+                case 86:
+                    S5 = 'S5 unconfined sessions';
+                    _c = 0, _d = ['/journeys', '/form-responses', '/endusers', '/calendar-events', '/tickets'];
+                    _x.label = 87;
+                case 87:
+                    if (!(_c < _d.length)) return [3 /*break*/, 90];
+                    path = _d[_c];
+                    return [4 /*yield*/, expectAllowed(S5, "staff session reaches ".concat(path), baselineUserToken, 'get', path)];
+                case 88:
+                    _x.sent();
+                    _x.label = 89;
+                case 89:
+                    _c++;
+                    return [3 /*break*/, 87];
+                case 90: return [4 /*yield*/, expectAllowed(S5, 'staff session reaches /data-sync', baselineUserToken, 'get', '/data-sync', { from: new Date(Date.now() - 60000).toISOString() })];
+                case 91:
+                    _x.sent();
+                    _e = 0, _f = ['/form-responses', '/calendar-events', '/files'];
+                    _x.label = 92;
+                case 92:
+                    if (!(_e < _f.length)) return [3 /*break*/, 95];
+                    path = _f[_e];
+                    return [4 /*yield*/, expectAllowed(S5, "enduser session reaches ".concat(path), baselineEnduserToken, 'get', path)];
+                case 93:
+                    _x.sent();
+                    _x.label = 94;
+                case 94:
+                    _e++;
+                    return [3 /*break*/, 92];
+                case 95: return [4 /*yield*/, sdk.test_authenticated()];
+                case 96:
+                    adminAuthenticated = _x.sent();
+                    probes.push({
+                        scenario: S5, label: 'admin sdk still authenticated', path: '/test-authenticated',
+                        expected: 'allowed', status: 200, pass: adminAuthenticated === 'Authenticated!',
+                    });
+                    apiKeySDK = new sdk_1.Session({ host: host, apiKey: '3n5q0SCBT_iUvZz-b9BJtX7o7HQUVJ9v132PgHJNJsg.' });
+                    _g = 0, _h = ['/journeys', '/form-responses', '/endusers', '/calendar-events', '/files'];
+                    _x.label = 97;
+                case 97:
+                    if (!(_g < _h.length)) return [3 /*break*/, 100];
+                    path = _h[_g];
+                    return [4 /*yield*/, axios_1.default.request({
+                            method: 'get',
+                            url: "".concat(host, "/v1").concat(path),
+                            headers: { Authorization: "API_KEY ".concat(apiKeySDK.apiKey) },
+                            validateStatus: function () { return true; },
+                        })];
+                case 98:
+                    r = _x.sent();
+                    probes.push({
+                        scenario: S5,
+                        label: "API key (headless) reaches ".concat(path),
+                        path: path,
+                        expected: 'allowed',
+                        status: r.status,
+                        pass: r.status !== 403,
+                    });
+                    _x.label = 99;
+                case 99:
+                    _g++;
+                    return [3 /*break*/, 97];
+                case 100:
+                    failures = probes.filter(function (p) { return !p.pass; });
+                    console.log('');
+                    console.log('  F-0166 — full probe table');
+                    console.log('  ' + '-'.repeat(112));
+                    scenarios = probes.map(function (p) { return p.scenario; }).filter(function (s, i, all) { return all.indexOf(s) === i; });
+                    _loop_1 = function (scenario) {
+                        var inScenario = probes.filter(function (p) { return p.scenario === scenario; });
+                        var failed = inScenario.filter(function (p) { return !p.pass; }).length;
+                        console.log("  ".concat(scenario, ": ").concat(inScenario.length - failed, "/").concat(inScenario.length, " passing").concat(failed ? "  <-- ".concat(failed, " FAILING") : ''));
+                        for (var _y = 0, inScenario_1 = inScenario; _y < inScenario_1.length; _y++) {
+                            var p = inScenario_1[_y];
+                            var baseline = p.baselineStatus !== undefined ? " baseline=".concat(p.baselineStatus) : '';
+                            console.log("    ".concat(p.pass ? ' ok ' : 'FAIL', "  want=").concat(p.expected.padEnd(7), " got=").concat(p.status).concat(baseline, "  ").concat(p.label).concat(p.note ? "  (".concat(p.note, ")") : ''));
+                        }
+                    };
+                    for (_j = 0, scenarios_1 = scenarios; _j < scenarios_1.length; _j++) {
+                        scenario = scenarios_1[_j];
+                        _loop_1(scenario);
+                    }
+                    console.log('  ' + '-'.repeat(112));
+                    console.log("  TOTAL: ".concat(probes.length - failures.length, "/").concat(probes.length, " passing, ").concat(failures.length, " failing"));
+                    console.log('');
+                    for (_k = 0, probes_1 = probes; _k < probes_1.length; _k++) {
+                        p = probes_1[_k];
+                        (0, testing_1.assert)(p.pass, "".concat(p.scenario, " \u2014 ").concat(p.label, " (").concat(p.path, "): wanted ").concat(p.expected, ", got status ").concat(p.status)
+                            + (p.baselineStatus !== undefined ? " (unconfined baseline got ".concat(p.baselineStatus, ")") : ''), "".concat(p.scenario, " \u2014 ").concat(p.label));
+                    }
+                    return [3 /*break*/, 130];
+                case 101:
+                    _l = 0, eventIds_1 = eventIds;
+                    _x.label = 102;
+                case 102:
+                    if (!(_l < eventIds_1.length)) return [3 /*break*/, 107];
+                    id = eventIds_1[_l];
+                    _x.label = 103;
+                case 103:
+                    _x.trys.push([103, 105, , 106]);
+                    return [4 /*yield*/, sdk.api.calendar_events.deleteOne(id)];
+                case 104:
+                    _x.sent();
+                    return [3 /*break*/, 106];
+                case 105:
+                    _m = _x.sent();
+                    return [3 /*break*/, 106];
+                case 106:
+                    _l++;
+                    return [3 /*break*/, 102];
+                case 107:
+                    if (!joinEnduserId) return [3 /*break*/, 111];
+                    _x.label = 108;
+                case 108:
+                    _x.trys.push([108, 110, , 111]);
+                    return [4 /*yield*/, sdk.api.endusers.deleteOne(joinEnduserId)];
+                case 109:
+                    _x.sent();
+                    return [3 /*break*/, 111];
+                case 110:
+                    _o = _x.sent();
+                    return [3 /*break*/, 111];
+                case 111:
+                    if (!formEnduserEmail) return [3 /*break*/, 117];
+                    _x.label = 112;
+                case 112:
+                    _x.trys.push([112, 116, , 117]);
+                    return [4 /*yield*/, sdk.api.endusers.getOne({ email: formEnduserEmail })];
+                case 113:
+                    e = _x.sent();
+                    if (!(e === null || e === void 0 ? void 0 : e.id)) return [3 /*break*/, 115];
+                    return [4 /*yield*/, sdk.api.endusers.deleteOne(e.id)];
+                case 114:
+                    _x.sent();
+                    _x.label = 115;
+                case 115: return [3 /*break*/, 117];
+                case 116:
+                    _p = _x.sent();
+                    return [3 /*break*/, 117];
+                case 117:
+                    if (!hostUserId) return [3 /*break*/, 121];
+                    _x.label = 118;
+                case 118:
+                    _x.trys.push([118, 120, , 121]);
+                    return [4 /*yield*/, sdk.api.users.deleteOne(hostUserId)];
+                case 119:
+                    _x.sent();
+                    return [3 /*break*/, 121];
+                case 120:
+                    _q = _x.sent();
+                    return [3 /*break*/, 121];
+                case 121:
+                    if (!productId) return [3 /*break*/, 125];
+                    _x.label = 122;
+                case 122:
+                    _x.trys.push([122, 124, , 125]);
+                    return [4 /*yield*/, sdk.api.products.deleteOne(productId)];
+                case 123:
+                    _x.sent();
+                    return [3 /*break*/, 125];
+                case 124:
+                    _r = _x.sent();
+                    return [3 /*break*/, 125];
+                case 125:
+                    if (!formId) return [3 /*break*/, 129];
+                    _x.label = 126;
+                case 126:
+                    _x.trys.push([126, 128, , 129]);
+                    return [4 /*yield*/, sdk.api.forms.deleteOne(formId)];
+                case 127:
+                    _x.sent();
+                    return [3 /*break*/, 129];
+                case 128:
+                    _s = _x.sent();
+                    return [3 /*break*/, 129];
+                case 129: return [7 /*endfinally*/];
+                case 130: return [2 /*return*/];
+            }
+        });
+    });
+};
+exports.allowed_paths_confinement_tests = allowed_paths_confinement_tests;
+if (require.main === module) {
+    console.log("\uD83C\uDF10 Using API URL: ".concat(host));
+    var sdk_2 = new sdk_1.Session({ host: host });
+    var sdkNonAdmin_1 = new sdk_1.Session({ host: host });
+    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, (0, setup_1.setup_tests)(sdk_2, sdkNonAdmin_1)];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, (0, exports.allowed_paths_confinement_tests)({ sdk: sdk_2, sdkNonAdmin: sdkNonAdmin_1 })];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); };
+    runTests()
+        .then(function () {
+        console.log("✅ F-0166 allowedPaths confinement test suite completed successfully");
+        process.exit(0);
+    })
+        .catch(function (error) {
+        console.error("❌ F-0166 allowedPaths confinement test suite failed:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=F-0166-allowed-paths-wildcard-bypass.test.js.map