@tellescope/sdk 1.255.18 → 1.256.0

package/lib/esm/tests/api_tests/security/F-0025-proxy-image-unauth-ssrf.test.js

@@ -0,0 +1,224 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+require('source-map-support').install();
+import http from "http";
+import axios from "axios";
+import { Session } from "../../../sdk";
+import { async_test, log_header, } from "@tellescope/testing";
+import { setup_tests } from "../../setup";
+var host = process.env.API_URL || 'http://localhost:8080';
+var LOCAL_HOSTNAMES = ['localhost', '127.0.0.1', '::1'];
+/**
+ * 127.0.0.1 only means "the machine running this test" when the API is also local. Against staging or
+ * prod it is the API server itself — the sentinel below would never be contacted, every assertion
+ * here would pass for the wrong reason, and we would be probing a live environment. Fail loudly.
+ */
+var assert_local_api = function () {
+    var hostname = new URL(host).hostname;
+    if (!LOCAL_HOSTNAMES.includes(hostname)) {
+        throw new Error("F-0025 SSRF tests must run against a local API (got ".concat(host, "). ")
+            + "127.0.0.1 would resolve to the API server rather than this machine, so the tests would be meaningless.");
+    }
+};
+/**
+ * Regression tests for F-0025
+ * (security-audit/findings/F-0025-proxy-image-unauth-ssrf.md).
+ *
+ * GET /v1/proxy-image accepted an arbitrary ?url= and streamed the upstream response body straight
+ * back with Access-Control-Allow-Origin: *, with no authentication, no destination validation and no
+ * content-type restriction. That reaches http://169.254.169.254/ (EC2 instance credentials under
+ * IMDSv1), 127.0.0.1, and anything else inside the VPC.
+ *
+ * The endpoint's only legitimate job is to re-serve an image that ALREADY renders in the staff
+ * browser, with permissive CORS headers, so html2canvas can rasterize a form-response PDF without
+ * tainting the canvas (canvas.toDataURL() throws on a tainted canvas, and the form-response view sets
+ * crossOrigin="anonymous"). Anything reachable only from inside our network was therefore never a
+ * legitimate input — which is why refusing non-public destinations cannot regress the feature.
+ *
+ * Repro: stand up a local HTTP server that serves a JSON secret, point proxy-image at it with no
+ * credentials, and assert the secret does not come back.
+ *   - red  (unfixed): the sentinel body is streamed back to an unauthenticated caller
+ *   - green (fixed):  the request is refused and the sentinel server is never contacted
+ *
+ * Assertions are deliberately written as "4xx and nothing leaked" rather than pinning an exact status,
+ * because the fix both authenticates the endpoint and moves it to POST (the url moves into the body so
+ * presigned S3 URLs for patient attachments stop landing in access logs). Either 401 or 404/405 on the
+ * old GET shape is an acceptable outcome; streaming the body is not.
+ *
+ * The authenticated happy-path test lives with the Phase 2 endpoint change — it cannot exist here
+ * because the POST route does not yet exist, and a test that fails for "not implemented" would muddy
+ * the vulnerability proof.
+ */
+export var proxy_image_ssrf_tests = function (_a) {
+    var sdk = _a.sdk;
+    return __awaiter(void 0, void 0, void 0, function () {
+        var SENTINEL, sentinelHits, sentinel, sentinelPort, sentinelURL_1, call_unauthenticated, call_authenticated_1;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    log_header("F-0025: proxy-image unauthenticated SSRF");
+                    assert_local_api();
+                    SENTINEL = "f0025-sentinel-".concat(Date.now(), "-").concat(Math.random().toString(36).slice(2));
+                    sentinelHits = 0;
+                    sentinel = http.createServer(function (_, res) {
+                        sentinelHits++;
+                        res.writeHead(200, { 'content-type': 'application/json' });
+                        res.end(JSON.stringify({ sentinel: SENTINEL, credentials: 'internal-only' }));
+                    });
+                    _b.label = 1;
+                case 1:
+                    _b.trys.push([1, , 9, 10]);
+                    return [4 /*yield*/, new Promise(function (resolve) { return sentinel.listen(0, '127.0.0.1', function () { return resolve(); }); })];
+                case 2:
+                    _b.sent();
+                    sentinelPort = sentinel.address().port;
+                    sentinelURL_1 = "http://127.0.0.1:".concat(sentinelPort, "/latest/meta-data/iam/security-credentials/");
+                    call_unauthenticated = function () { return __awaiter(void 0, void 0, void 0, function () {
+                        var res, body;
+                        var _a;
+                        return __generator(this, function (_b) {
+                            switch (_b.label) {
+                                case 0:
+                                    sentinelHits = 0;
+                                    return [4 /*yield*/, axios.get("".concat(host, "/v1/proxy-image"), {
+                                            params: { url: sentinelURL_1 },
+                                            validateStatus: function () { return true; },
+                                            responseType: 'text',
+                                            transformResponse: [function (d) { return d; }],
+                                            timeout: 10000,
+                                        })];
+                                case 1:
+                                    res = _b.sent();
+                                    body = typeof res.data === 'string' ? res.data : JSON.stringify((_a = res.data) !== null && _a !== void 0 ? _a : '');
+                                    return [2 /*return*/, { status: res.status, leaked: body.includes(SENTINEL), sentinelHits: sentinelHits }];
+                            }
+                        });
+                    }); };
+                    // T1 — the core SSRF: an unauthenticated caller must not be able to read an internal resource.
+                    return [4 /*yield*/, async_test('F-0025: proxy-image does not stream an internal non-image resource to an unauthenticated caller', call_unauthenticated, {
+                            // Positive control: a numeric status proves we actually reached our API rather than failing to
+                            // connect (a connection error would make "nothing leaked" true for the wrong reason).
+                            onResult: function (r) { return (typeof r.status === 'number'
+                                && r.leaked === false
+                                && r.sentinelHits === 0); },
+                        })
+                        // T2 — the unauthenticated surface itself: the request must be refused outright, and the
+                        // destination must never be contacted (no SSRF-as-a-side-effect even when the body is withheld).
+                    ];
+                case 3:
+                    // T1 — the core SSRF: an unauthenticated caller must not be able to read an internal resource.
+                    _b.sent();
+                    // T2 — the unauthenticated surface itself: the request must be refused outright, and the
+                    // destination must never be contacted (no SSRF-as-a-side-effect even when the body is withheld).
+                    return [4 /*yield*/, async_test('F-0025: proxy-image refuses an unauthenticated request without contacting the destination', call_unauthenticated, { onResult: function (r) { return r.status >= 400 && r.status < 500 && r.sentinelHits === 0; } })
+                        // Authenticating is not enough on its own — a staff session must not be able to reach an internal
+                        // address either. These use the real session, and are deterministic (no external network).
+                    ];
+                case 4:
+                    // T2 — the unauthenticated surface itself: the request must be refused outright, and the
+                    // destination must never be contacted (no SSRF-as-a-side-effect even when the body is withheld).
+                    _b.sent();
+                    call_authenticated_1 = function (url) { return __awaiter(void 0, void 0, void 0, function () {
+                        var res;
+                        return __generator(this, function (_a) {
+                            switch (_a.label) {
+                                case 0:
+                                    sentinelHits = 0;
+                                    return [4 /*yield*/, axios.post("".concat(host, "/v1/proxy-image"), { url: url }, {
+                                            headers: { Authorization: "Bearer ".concat(sdk.authToken) },
+                                            validateStatus: function () { return true; },
+                                            timeout: 10000,
+                                        })];
+                                case 1:
+                                    res = _a.sent();
+                                    return [2 /*return*/, { status: res.status, sentinelHits: sentinelHits }];
+                            }
+                        });
+                    }); };
+                    return [4 /*yield*/, async_test('F-0025: proxy-image refuses a private destination even for an authenticated staff session', function () { return call_authenticated_1(sentinelURL_1); }, { onResult: function (r) { return r.status === 400 && r.sentinelHits === 0; } })];
+                case 5:
+                    _b.sent();
+                    return [4 /*yield*/, async_test('F-0025: proxy-image refuses cloud metadata for an authenticated staff session', function () { return call_authenticated_1('https://169.254.169.254/latest/meta-data/'); }, { onResult: function (r) { return r.status === 400; } })
+                        // Scheme and port are pinned: only https on 443, which is all the PDF export ever needs.
+                    ];
+                case 6:
+                    _b.sent();
+                    // Scheme and port are pinned: only https on 443, which is all the PDF export ever needs.
+                    return [4 /*yield*/, async_test('F-0025: proxy-image refuses a plain http destination', function () { return call_authenticated_1('http://example.com/logo.png'); }, { onResult: function (r) { return r.status === 400; } })];
+                case 7:
+                    // Scheme and port are pinned: only https on 443, which is all the PDF export ever needs.
+                    _b.sent();
+                    return [4 /*yield*/, async_test('F-0025: proxy-image refuses a non-443 port', function () { return call_authenticated_1('https://example.com:8443/logo.png'); }, { onResult: function (r) { return r.status === 400; } })];
+                case 8:
+                    _b.sent();
+                    return [3 /*break*/, 10];
+                case 9:
+                    sentinel.close();
+                    return [7 /*endfinally*/];
+                case 10: return [2 /*return*/];
+            }
+        });
+    });
+};
+if (require.main === module) {
+    console.log("\uD83C\uDF10 Using API URL: ".concat(host));
+    var sdk_1 = new Session({ host: host });
+    var sdkNonAdmin_1 = new Session({ host: host });
+    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, setup_tests(sdk_1, sdkNonAdmin_1)];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, proxy_image_ssrf_tests({ sdk: sdk_1, sdkNonAdmin: sdkNonAdmin_1 })];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); };
+    runTests()
+        .then(function () {
+        console.log("✅ F-0025 proxy-image SSRF test suite completed successfully");
+        process.exit(0);
+    })
+        .catch(function (error) {
+        console.error("❌ F-0025 proxy-image SSRF test suite failed:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=F-0025-proxy-image-unauth-ssrf.test.js.map

package/lib/esm/tests/api_tests/security/F-0025-proxy-image-unauth-ssrf.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"F-0025-proxy-image-unauth-ssrf.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/F-0025-proxy-image-unauth-ssrf.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,OAAO,IAAI,MAAM,MAAM,CAAA;AACvB,OAAO,KAAK,MAAM,OAAO,CAAA;AACzB,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EACL,UAAU,EACV,UAAU,GACX,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEzC,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE,IAAM,eAAe,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAA;AAEzD;;;;GAIG;AACH,IAAM,gBAAgB,GAAG;IACvB,IAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAA;IACvC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;QACvC,MAAM,IAAI,KAAK,CACb,8DAAuD,IAAI,QAAK;cAC9D,wGAAwG,CAC3G,CAAA;KACF;AACH,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,IAAM,sBAAsB,GAAG,UAAO,EAAgD;QAA9C,GAAG,SAAA;;;;;;oBAChD,UAAU,CAAC,0CAA0C,CAAC,CAAA;oBACtD,gBAAgB,EAAE,CAAA;oBAEZ,QAAQ,GAAG,yBAAkB,IAAI,CAAC,GAAG,EAAE,cAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,CAAA;oBAClF,YAAY,GAAG,CAAC,CAAA;oBAId,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,UAAC,CAAC,EAAE,GAAG;wBACxC,YAAY,EAAE,CAAA;wBACd,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;wBAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC,CAAA;oBAC/E,CAAC,CAAC,CAAA;;;;oBAGA,qBAAM,IAAI,OAAO,CAAO,UAAA,OAAO,IAAI,OAAA,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,cAAM,OAAA,OAAO,EAAE,EAAT,CAAS,CAAC,EAAhD,CAAgD,CAAC,EAAA;;oBAApF,SAAoF,CAAA;oBAC9E,YAAY,GAAI,QAAQ,CAAC,OAAO,EAAU,CAAC,IAAI,CAAA;oBAC/C,gBAAc,2BAAoB,YAAY,gDAA6C,CAAA;oBAI3F,oBAAoB,GAAG;;;;;;oCAC3B,YAAY,GAAG,CAAC,CAAA;oCACJ,qBAAM,KAAK,CAAC,GAAG,CAAC,UAAG,IAAI,oBAAiB,EAAE;4CACpD,MAAM,EAAE,EAAE,GAAG,EAAE,aAAW,EAAE;4CAC5B,cAAc,EAAE,cAAM,OAAA,IAAI,EAAJ,CAAI;4CAC1B,YAAY,EAAE,MAAM;4CACpB,iBAAiB,EAAE,CAAC,UAAC,CAAM,IAAK,OAAA,CAAC,EAAD,CAAC,CAAC;4CAClC,OAAO,EAAE,KAAM;yCACT,CAAC,EAAA;;oCANH,GAAG,GAAG,SAMH;oCAEH,IAAI,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAA,GAAG,CAAC,IAAI,mCAAI,EAAE,CAAC,CAAA;oCACrF,sBAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,cAAA,EAAE,EAAA;;;yBAC7E,CAAA;oBAED,+FAA+F;oBAC/F,qBAAM,UAAU,CACd,iGAAiG,EACjG,oBAAoB,EACpB;4BACE,+FAA+F;4BAC/F,sFAAsF;4BACtF,QAAQ,EAAE,UAAC,CAAM,IAAK,OAAA,CACpB,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;mCACzB,CAAC,CAAC,MAAM,KAAK,KAAK;mCAClB,CAAC,CAAC,YAAY,KAAK,CAAC,CACxB,EAJqB,CAIrB;yBACF,CACF;wBAED,yFAAyF;wBACzF,iGAAiG;sBAHhG;;oBAbD,+FAA+F;oBAC/F,SAYC,CAAA;oBAED,yFAAyF;oBACzF,iGAAiG;oBACjG,qBAAM,UAAU,CACd,2FAA2F,EAC3F,oBAAoB,EACpB,EAAE,QAAQ,EAAE,UAAC,CAAM,IAAK,OAAA,CAAC,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,EAAzD,CAAyD,EAAE,CACpF;wBAED,kGAAkG;wBAClG,2FAA2F;sBAH1F;;oBAND,yFAAyF;oBACzF,iGAAiG;oBACjG,SAIC,CAAA;oBAIK,uBAAqB,UAAO,GAAW;;;;;oCAC3C,YAAY,GAAG,CAAC,CAAA;oCACJ,qBAAM,KAAK,CAAC,IAAI,CAAC,UAAG,IAAI,oBAAiB,EAAE,EAAE,GAAG,KAAA,EAAE,EAAE;4CAC9D,OAAO,EAAE,EAAE,aAAa,EAAE,iBAAU,GAAG,CAAC,SAAS,CAAE,EAAE;4CACrD,cAAc,EAAE,cAAM,OAAA,IAAI,EAAJ,CAAI;4CAC1B,OAAO,EAAE,KAAM;yCACT,CAAC,EAAA;;oCAJH,GAAG,GAAG,SAIH;oCACT,sBAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,cAAA,EAAE,EAAA;;;yBAC5C,CAAA;oBAED,qBAAM,UAAU,CACd,2FAA2F,EAC3F,cAAM,OAAA,oBAAkB,CAAC,aAAW,CAAC,EAA/B,CAA+B,EACrC,EAAE,QAAQ,EAAE,UAAC,CAAM,IAAK,OAAA,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,EAAxC,CAAwC,EAAE,CACnE,EAAA;;oBAJD,SAIC,CAAA;oBAED,qBAAM,UAAU,CACd,+EAA+E,EAC/E,cAAM,OAAA,oBAAkB,CAAC,2CAA2C,CAAC,EAA/D,CAA+D,EACrE,EAAE,QAAQ,EAAE,UAAC,CAAM,IAAK,OAAA,CAAC,CAAC,MAAM,KAAK,GAAG,EAAhB,CAAgB,EAAE,CAC3C;wBAED,yFAAyF;sBAFxF;;oBAJD,SAIC,CAAA;oBAED,yFAAyF;oBACzF,qBAAM,UAAU,CACd,sDAAsD,EACtD,cAAM,OAAA,oBAAkB,CAAC,6BAA6B,CAAC,EAAjD,CAAiD,EACvD,EAAE,QAAQ,EAAE,UAAC,CAAM,IAAK,OAAA,CAAC,CAAC,MAAM,KAAK,GAAG,EAAhB,CAAgB,EAAE,CAC3C,EAAA;;oBALD,yFAAyF;oBACzF,SAIC,CAAA;oBAED,qBAAM,UAAU,CACd,4CAA4C,EAC5C,cAAM,OAAA,oBAAkB,CAAC,mCAAmC,CAAC,EAAvD,CAAuD,EAC7D,EAAE,QAAQ,EAAE,UAAC,CAAM,IAAK,OAAA,CAAC,CAAC,MAAM,KAAK,GAAG,EAAhB,CAAgB,EAAE,CAC3C,EAAA;;oBAJD,SAIC,CAAA;;;oBAED,QAAQ,CAAC,KAAK,EAAE,CAAA;;;;;;CAEnB,CAAA;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAM,KAAG,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACjC,IAAM,aAAW,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IAEzC,IAAM,QAAQ,GAAG;;;wBACf,qBAAM,WAAW,CAAC,KAAG,EAAE,aAAW,CAAC,EAAA;;oBAAnC,SAAmC,CAAA;oBACnC,qBAAM,sBAAsB,CAAC,EAAE,GAAG,OAAA,EAAE,WAAW,eAAA,EAAE,CAAC,EAAA;;oBAAlD,SAAkD,CAAA;;;;SACnD,CAAA;IAED,QAAQ,EAAE;SACP,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAA;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAE,KAAK,CAAC,CAAA;QACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}

package/lib/esm/tests/api_tests/security/F-0106-F-0110-enduser-write-restrictions.test.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"F-0106-F-0110-enduser-write-restrictions.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/F-0106-F-0110-enduser-write-restrictions.test.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAkB,MAAM,cAAc,CAAA;AA+DtD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,gCAAgC;SAA2B,OAAO;iBAAe,OAAO;mBA6GpG,CAAA"}
+{"version":3,"file":"F-0106-F-0110-enduser-write-restrictions.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/F-0106-F-0110-enduser-write-restrictions.test.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAkB,MAAM,cAAc,CAAA;AAsEtD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,gCAAgC;SAA2B,OAAO;iBAAe,OAAO;mBAwIpG,CAAA"}

package/lib/esm/tests/api_tests/security/F-0106-F-0110-enduser-write-restrictions.test.js

@@ -74,8 +74,15 @@ var restrictedEnduserUpdates = function (staffId, mongoId) {
     });
 };
 // Every form_responses field marked enduserUpdatesDisabled in schema.ts.
-var restrictedFormResponseUpdates = function (staffId) { return ({
+// otherEnduserId must be a REAL enduser other than the one submitting the update: enduserId's
+// foreign key is existence-checked, so a nonexistent id would be rejected as a bad dependency
+// rather than by the write restriction under test.
+var restrictedFormResponseUpdates = function (staffId, otherEnduserId) { return ({
     markedAsSubmitted: true,
+    // repointing a response at another patient redirects the intake write in
+    // save_enduser_updates_for_form_response, which is how email/phone (authentication channels)
+    // reach an enduser record — see api_tests/security/public_endpoint_auth_field_lock.test.ts
+    enduserId: otherEnduserId,
     submittedBy: staffId,
     submittedAt: new Date("2024-01-01T00:00:00Z"),
     submittedByIsPlaceholder: true,
@@ -113,112 +120,123 @@ var restrictedFormResponseUpdates = function (staffId) { return ({
 export var enduser_write_restrictions_tests = function (_a) {
     var sdk = _a.sdk;
     return __awaiter(void 0, void 0, void 0, function () {
-        var enduserId, formId, formResponseId, enduserEmail, enduser_1, enduserSDK_1, form, formResponse_1, _loop_1, _i, _b, _c, field, value, _loop_2, _d, _e, _f, field, value, _g, _h, _j;
-        return __generator(this, function (_k) {
-            switch (_k.label) {
+        var enduserId, otherEnduserId, formId, formResponseId, enduserEmail, enduser_1, otherEnduser_1, enduserSDK_1, form, formResponse_1, _loop_1, _i, _b, _c, field, value, _loop_2, _d, _e, _f, field, value, _g, _h, _j, _k;
+        return __generator(this, function (_l) {
+            switch (_l.label) {
                 case 0:
                     log_header("F-0106/F-0110: enduser write restrictions (enduserUpdatesDisabled)");
-                    _k.label = 1;
+                    _l.label = 1;
                 case 1:
-                    _k.trys.push([1, , 21, 34]);
+                    _l.trys.push([1, , 24, 41]);
                     enduserEmail = "f0106-enduser-".concat(Date.now(), "@example.com");
                     return [4 /*yield*/, sdk.api.endusers.createOne({ email: enduserEmail, fname: 'F0106', lname: 'Restricted' })];
                 case 2:
-                    enduser_1 = _k.sent();
+                    enduser_1 = _l.sent();
                     enduserId = enduser_1.id;
-                    return [4 /*yield*/, sdk.api.endusers.set_password({ id: enduser_1.id, password: ENDUSER_PASSWORD })];
+                    return [4 /*yield*/, sdk.api.endusers.createOne({
+                            email: "f0106-other-".concat(Date.now(), "@example.com"), fname: 'F0106', lname: 'Other',
+                        })];
                 case 3:
-                    _k.sent();
+                    otherEnduser_1 = _l.sent();
+                    otherEnduserId = otherEnduser_1.id;
+                    return [4 /*yield*/, sdk.api.endusers.set_password({ id: enduser_1.id, password: ENDUSER_PASSWORD })];
+                case 4:
+                    _l.sent();
                     enduserSDK_1 = new EnduserSession({ host: host, businessId: businessId });
                     return [4 /*yield*/, enduserSDK_1.authenticate(enduserEmail, ENDUSER_PASSWORD)];
-                case 4:
-                    _k.sent();
-                    return [4 /*yield*/, sdk.api.forms.createOne({ title: 'F-0106/F-0110 Write Restriction Test Form' })];
                 case 5:
-                    form = _k.sent();
+                    _l.sent();
+                    return [4 /*yield*/, sdk.api.forms.createOne({ title: 'F-0106/F-0110 Write Restriction Test Form' })];
+                case 6:
+                    form = _l.sent();
                     formId = form.id;
                     return [4 /*yield*/, sdk.api.form_responses.prepare_form_response({
                             formId: form.id,
                             enduserId: enduser_1.id,
                         })];
-                case 6:
-                    formResponse_1 = (_k.sent()).response;
+                case 7:
+                    formResponse_1 = (_l.sent()).response;
                     formResponseId = formResponse_1.id;
                     _loop_1 = function (field, value) {
-                        return __generator(this, function (_l) {
-                            switch (_l.label) {
+                        return __generator(this, function (_m) {
+                            switch (_m.label) {
                                 case 0: return [4 /*yield*/, async_test("F-0106: enduser cannot self-update endusers.".concat(field), function () {
                                         var _a;
                                         return enduserSDK_1.api.endusers.updateOne(enduser_1.id, (_a = {}, _a[field] = value, _a));
                                     }, { shouldError: true, onError: function (e) { return e.message === "".concat(field, " cannot be updated by endusers"); } })];
                                 case 1:
-                                    _l.sent();
+                                    _m.sent();
                                     return [2 /*return*/];
                             }
                         });
                     };
                     _i = 0, _b = Object.entries(restrictedEnduserUpdates(sdk.userInfo.id, enduser_1.id));
-                    _k.label = 7;
-                case 7:
-                    if (!(_i < _b.length)) return [3 /*break*/, 10];
+                    _l.label = 8;
+                case 8:
+                    if (!(_i < _b.length)) return [3 /*break*/, 11];
                     _c = _b[_i], field = _c[0], value = _c[1];
                     return [5 /*yield**/, _loop_1(field, value)];
-                case 8:
-                    _k.sent();
-                    _k.label = 9;
                 case 9:
+                    _l.sent();
+                    _l.label = 10;
+                case 10:
                     _i++;
-                    return [3 /*break*/, 7];
-                case 10: 
+                    return [3 /*break*/, 8];
+                case 11: 
                 // F-0106 Variant A persistence check: the rejected assignedTo write must not
                 // have granted the staff read-filter match.
                 return [4 /*yield*/, async_test('F-0106: rejected assignedTo write did not persist', function () { return sdk.api.endusers.getOne(enduser_1.id); }, { onResult: function (e) { var _a, _b; return !((_a = e.assignedTo) === null || _a === void 0 ? void 0 : _a.length) && !((_b = e.tags) === null || _b === void 0 ? void 0 : _b.length) && e.externalId === undefined; } })
                     // ---- F-0110: enduser self-update of restricted form_responses fields must 400 ----
                 ];
-                case 11:
+                case 12:
                     // F-0106 Variant A persistence check: the rejected assignedTo write must not
                     // have granted the staff read-filter match.
-                    _k.sent();
+                    _l.sent();
                     _loop_2 = function (field, value) {
-                        return __generator(this, function (_m) {
-                            switch (_m.label) {
+                        return __generator(this, function (_o) {
+                            switch (_o.label) {
                                 case 0: return [4 /*yield*/, async_test("F-0110: enduser cannot self-update form_responses.".concat(field), function () {
                                         var _a;
                                         return enduserSDK_1.api.form_responses.updateOne(formResponse_1.id, (_a = {}, _a[field] = value, _a));
                                     }, { shouldError: true, onError: function (e) { return e.message === "".concat(field, " cannot be updated by endusers"); } })];
                                 case 1:
-                                    _m.sent();
+                                    _o.sent();
                                     return [2 /*return*/];
                             }
                         });
                     };
-                    _d = 0, _e = Object.entries(restrictedFormResponseUpdates(sdk.userInfo.id));
-                    _k.label = 12;
-                case 12:
-                    if (!(_d < _e.length)) return [3 /*break*/, 15];
+                    _d = 0, _e = Object.entries(restrictedFormResponseUpdates(sdk.userInfo.id, otherEnduser_1.id));
+                    _l.label = 13;
+                case 13:
+                    if (!(_d < _e.length)) return [3 /*break*/, 16];
                     _f = _e[_d], field = _f[0], value = _f[1];
                     return [5 /*yield**/, _loop_2(field, value)];
-                case 13:
-                    _k.sent();
-                    _k.label = 14;
                 case 14:
+                    _l.sent();
+                    _l.label = 15;
+                case 15:
                     _d++;
-                    return [3 /*break*/, 12];
-                case 15: return [4 /*yield*/, async_test('F-0110: rejected writes did not persist (markedAsSubmitted, procedureCodes, submittedBy)', function () { return sdk.api.form_responses.getOne(formResponse_1.id); }, { onResult: function (fr) { var _a; return !fr.markedAsSubmitted && !((_a = fr.procedureCodes) === null || _a === void 0 ? void 0 : _a.length) && fr.submittedBy === undefined; } })
+                    return [3 /*break*/, 13];
+                case 16: return [4 /*yield*/, async_test('F-0110: rejected writes did not persist (markedAsSubmitted, procedureCodes, submittedBy, enduserId)', function () { return sdk.api.form_responses.getOne(formResponse_1.id); }, { onResult: function (fr) {
+                            var _a;
+                            return (!fr.markedAsSubmitted && !((_a = fr.procedureCodes) === null || _a === void 0 ? void 0 : _a.length) && fr.submittedBy === undefined
+                                // still points at its own patient: a successful repoint is what redirects the intake write
+                                && fr.enduserId === enduser_1.id);
+                        } })
                     // ---- Positive controls: intended enduser self-updates still work ----
                 ];
-                case 16:
-                    _k.sent();
+                case 17:
+                    _l.sent();
                     // ---- Positive controls: intended enduser self-updates still work ----
                     return [4 /*yield*/, async_test('enduser can still update own profile fields (fname/lname)', function () { return enduserSDK_1.api.endusers.updateOne(enduser_1.id, { fname: 'StillAllowed', lname: 'Patient' }); }, { onResult: function (e) { return e.fname === 'StillAllowed' && e.lname === 'Patient'; } })];
-                case 17:
+                case 18:
                     // ---- Positive controls: intended enduser self-updates still work ----
-                    _k.sent();
+                    _l.sent();
                     return [4 /*yield*/, async_test('enduser can still update own form_response (hideFromEnduserPortal — intended per schema)', function () { return enduserSDK_1.api.form_responses.updateOne(formResponse_1.id, { hideFromEnduserPortal: true }); }, { onResult: function (fr) { return fr.hideFromEnduserPortal === true; } })
                         // ---- Positive controls: staff sessions are unaffected by enduserUpdatesDisabled ----
                     ];
-                case 18:
-                    _k.sent();
+                case 19:
+                    _l.sent();
                     // ---- Positive controls: staff sessions are unaffected by enduserUpdatesDisabled ----
                     return [4 /*yield*/, async_test('staff can still update restricted endusers fields (tags, assignedTo, externalId, note, source)', function () { return sdk.api.endusers.updateOne(enduser_1.id, {
                             tags: ['staff-set-tag'],
@@ -232,9 +250,9 @@ export var enduser_write_restrictions_tests = function (_a) {
                                     && !!((_b = e.assignedTo) === null || _b === void 0 ? void 0 : _b.includes(sdk.userInfo.id))
                                     && e.externalId === 'staff-set-external-id');
                             } })];
-                case 19:
+                case 20:
                     // ---- Positive controls: staff sessions are unaffected by enduserUpdatesDisabled ----
-                    _k.sent();
+                    _l.sent();
                     return [4 /*yield*/, async_test('staff can still update restricted form_responses fields (procedureCodes, diagnosisCodes, tags)', function () { return sdk.api.form_responses.updateOne(formResponse_1.id, {
                             procedureCodes: [{ code: 'G0019', units: 1 }],
                             diagnosisCodes: [{ code: 'Z71.3', description: 'Dietary counseling and surveillance' }],
@@ -244,48 +262,73 @@ export var enduser_write_restrictions_tests = function (_a) {
                                 return (((_b = (_a = fr.procedureCodes) === null || _a === void 0 ? void 0 : _a[0]) === null || _b === void 0 ? void 0 : _b.code) === 'G0019'
                                     && ((_d = (_c = fr.diagnosisCodes) === null || _c === void 0 ? void 0 : _c[0]) === null || _d === void 0 ? void 0 : _d.code) === 'Z71.3'
                                     && !!((_e = fr.tags) === null || _e === void 0 ? void 0 : _e.includes('staff-set-tag')));
-                            } })];
-                case 20:
-                    _k.sent();
-                    return [3 /*break*/, 34];
+                            } })
+                        // enduserId is enduserUpdatesDisabled rather than updatesDisabled specifically so this keeps
+                        // working: staff sometimes need to move a response to the correct profile to fix a mistake.
+                    ];
                 case 21:
-                    if (!formResponseId) return [3 /*break*/, 25];
-                    _k.label = 22;
+                    _l.sent();
+                    // enduserId is enduserUpdatesDisabled rather than updatesDisabled specifically so this keeps
+                    // working: staff sometimes need to move a response to the correct profile to fix a mistake.
+                    return [4 /*yield*/, async_test('staff can still repoint form_responses.enduserId to another patient', function () { return sdk.api.form_responses.updateOne(formResponse_1.id, { enduserId: otherEnduser_1.id }); }, { onResult: function (fr) { return fr.enduserId === otherEnduser_1.id; } })];
                 case 22:
-                    _k.trys.push([22, 24, , 25]);
-                    return [4 /*yield*/, sdk.api.form_responses.deleteOne(formResponseId)];
+                    // enduserId is enduserUpdatesDisabled rather than updatesDisabled specifically so this keeps
+                    // working: staff sometimes need to move a response to the correct profile to fix a mistake.
+                    _l.sent();
+                    return [4 /*yield*/, async_test('staff can repoint form_responses.enduserId back', function () { return sdk.api.form_responses.updateOne(formResponse_1.id, { enduserId: enduser_1.id }); }, { onResult: function (fr) { return fr.enduserId === enduser_1.id; } })];
                 case 23:
-                    _k.sent();
-                    return [3 /*break*/, 25];
+                    _l.sent();
+                    return [3 /*break*/, 41];
                 case 24:
-                    _g = _k.sent();
-                    return [3 /*break*/, 25];
+                    if (!formResponseId) return [3 /*break*/, 28];
+                    _l.label = 25;
                 case 25:
-                    if (!formId) return [3 /*break*/, 29];
-                    _k.label = 26;
+                    _l.trys.push([25, 27, , 28]);
+                    return [4 /*yield*/, sdk.api.form_responses.deleteOne(formResponseId)];
                 case 26:
-                    _k.trys.push([26, 28, , 29]);
-                    return [4 /*yield*/, sdk.api.forms.deleteOne(formId)];
+                    _l.sent();
+                    return [3 /*break*/, 28];
                 case 27:
-                    _k.sent();
-                    return [3 /*break*/, 29];
+                    _g = _l.sent();
+                    return [3 /*break*/, 28];
                 case 28:
-                    _h = _k.sent();
-                    return [3 /*break*/, 29];
+                    if (!formId) return [3 /*break*/, 32];
+                    _l.label = 29;
                 case 29:
-                    if (!enduserId) return [3 /*break*/, 33];
-                    _k.label = 30;
+                    _l.trys.push([29, 31, , 32]);
+                    return [4 /*yield*/, sdk.api.forms.deleteOne(formId)];
                 case 30:
-                    _k.trys.push([30, 32, , 33]);
-                    return [4 /*yield*/, sdk.api.endusers.deleteOne(enduserId)];
+                    _l.sent();
+                    return [3 /*break*/, 32];
                 case 31:
-                    _k.sent();
-                    return [3 /*break*/, 33];
+                    _h = _l.sent();
+                    return [3 /*break*/, 32];
                 case 32:
-                    _j = _k.sent();
-                    return [3 /*break*/, 33];
-                case 33: return [7 /*endfinally*/];
-                case 34: return [2 /*return*/];
+                    if (!enduserId) return [3 /*break*/, 36];
+                    _l.label = 33;
+                case 33:
+                    _l.trys.push([33, 35, , 36]);
+                    return [4 /*yield*/, sdk.api.endusers.deleteOne(enduserId)];
+                case 34:
+                    _l.sent();
+                    return [3 /*break*/, 36];
+                case 35:
+                    _j = _l.sent();
+                    return [3 /*break*/, 36];
+                case 36:
+                    if (!otherEnduserId) return [3 /*break*/, 40];
+                    _l.label = 37;
+                case 37:
+                    _l.trys.push([37, 39, , 40]);
+                    return [4 /*yield*/, sdk.api.endusers.deleteOne(otherEnduserId)];
+                case 38:
+                    _l.sent();
+                    return [3 /*break*/, 40];
+                case 39:
+                    _k = _l.sent();
+                    return [3 /*break*/, 40];
+                case 40: return [7 /*endfinally*/];
+                case 41: return [2 /*return*/];
             }
         });
     });

package/lib/esm/tests/api_tests/security/F-0106-F-0110-enduser-write-restrictions.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"F-0106-F-0110-enduser-write-restrictions.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/F-0106-F-0110-enduser-write-restrictions.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AACtD,OAAO,EACL,UAAU,EACV,UAAU,GACX,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEzC,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AACpE,IAAM,UAAU,GAAG,0BAA0B,CAAA;AAE7C,IAAM,gBAAgB,GAAG,uBAAuB,CAAA;AAEhD,0EAA0E;AAC1E,sEAAsE;AACtE,4CAA4C;AAC5C,IAAM,wBAAwB,GAAG,UAAC,OAAe,EAAE,OAAe;;IAA0B,OAAA,CAAC;QAC3F,UAAU,EAAE,4BAA4B;QACxC,IAAI,EAAE,CAAC,oBAAoB,CAAC;QAC5B,UAAU,EAAE,CAAC,2BAA2B,CAAC;QACzC,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,YAAY,EAAE,OAAO;QACrB,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,0BAA0B,EAAE,CAAC;QAC/D,uBAAuB,EAAE,EAAE;QAC3B,QAAQ,YAAI,GAAC,OAAO,IAAG,OAAO,KAAE;QAChC,eAAe,EAAE,OAAO;QACxB,MAAM,EAAE,EAAE,kBAAkB,EAAE,MAAM,EAAE;QACtC,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,uBAAuB;QAC/B,IAAI,EAAE,qBAAqB;QAC3B,SAAS,EAAE,EAAE,QAAQ,EAAE,uBAAuB,EAAE;QAChD,kBAAkB,EAAE,EAAE,QAAQ,EAAE,yBAAyB,EAAE;QAC3D,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC5B,gBAAgB,EAAE,KAAK;QACvB,oBAAoB,EAAE,IAAI;QAC1B,kBAAkB,EAAE,YAAY;QAChC,gBAAgB,EAAE,gBAAgB;QAClC,YAAY,EAAE,kBAAkB;QAChC,qBAAqB,EAAE,gBAAgB;QACvC,gBAAgB,EAAE,uBAAuB;QACzC,SAAS,EAAE,kBAAkB;KAC9B,CAAC;AAzB0F,CAyB1F,CAAA;AAEF,yEAAyE;AACzE,IAAM,6BAA6B,GAAG,UAAC,OAAe,IAA0B,OAAA,CAAC;IAC/E,iBAAiB,EAAE,IAAI;IACvB,WAAW,EAAE,OAAO;IACpB,WAAW,EAAE,IAAI,IAAI,CAAC,sBAAsB,CAAC;IAC7C,wBAAwB,EAAE,IAAI;IAC9B,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAC7C,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;IAClF,gBAAgB,EAAE,sDAAsD;IACxE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACpF,cAAc,EAAE,IAAI;IACpB,QAAQ,EAAE,IAAI,IAAI,EAAE;IACpB,kBAAkB,EAAE,IAAI;IACxB,QAAQ,EAAE,IAAI,IAAI,EAAE;IACpB,IAAI,EAAE,CAAC,oBAAoB,CAAC;IAC5B,SAAS,EAAE,oBAAoB;IAC/B,SAAS,EAAE,2BAA2B;IACtC,OAAO,EAAE,uCAAuC;IAChD,UAAU,EAAE,GAAG;CAChB,CAAC,EAlB8E,CAkB9E,CAAA;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,IAAM,gCAAgC,GAAG,UAAO,EAAgD;QAA9C,GAAG,SAAA;;;;;;oBAC1D,UAAU,CAAC,oEAAoE,CAAC,CAAA;;;;oBAQxE,YAAY,GAAG,wBAAiB,IAAI,CAAC,GAAG,EAAE,iBAAc,CAAA;oBAC9C,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAA;;oBAAxG,YAAU,SAA8F;oBAC9G,SAAS,GAAG,SAAO,CAAC,EAAE,CAAA;oBACtB,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,SAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,EAAA;;oBAAnF,SAAmF,CAAA;oBAE7E,eAAa,IAAI,cAAc,CAAC,EAAE,IAAI,MAAA,EAAE,UAAU,YAAA,EAAE,CAAC,CAAA;oBAC3D,qBAAM,YAAU,CAAC,YAAY,CAAC,YAAY,EAAE,gBAAgB,CAAC,EAAA;;oBAA7D,SAA6D,CAAA;oBAEhD,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC,EAAA;;oBAA5F,IAAI,GAAG,SAAqF;oBAClG,MAAM,GAAG,IAAI,CAAC,EAAE,CAAA;oBACmB,qBAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,qBAAqB,CAAC;4BACpF,MAAM,EAAE,IAAI,CAAC,EAAE;4BACf,SAAS,EAAE,SAAO,CAAC,EAAE;yBACtB,CAAC,EAAA;;oBAHM,iBAA2B,CAAA,SAGjC,CAAA,SAH4B;oBAI9B,cAAc,GAAG,cAAY,CAAC,EAAE,CAAA;wCAGpB,KAAK,EAAE,KAAK;;;wCACtB,qBAAM,UAAU,CACd,sDAA+C,KAAK,CAAE,EACtD;;wCAAM,OAAA,YAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAO,CAAC,EAAE,EAAE,CAAA,SAAE,GAAC,KAAK,IAAG,KAAK,IAAS,CAAA,CAAC;oCAAxE,CAAwE,EAC9E,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,OAAO,KAAK,UAAG,KAAK,mCAAgC,EAAtD,CAAsD,EAAE,CAC5F,EAAA;;oCAJD,SAIC,CAAA;;;;;0BAL+F,EAArE,KAAA,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAO,CAAC,EAAE,CAAC,CAAC;;;yBAArE,CAAA,cAAqE,CAAA;oBAAvF,WAAc,EAAb,KAAK,QAAA,EAAE,KAAK,QAAA;kDAAZ,KAAK,EAAE,KAAK;;;;;oBAAK,IAAqE,CAAA;;;gBAQlG,6EAA6E;gBAC7E,4CAA4C;gBAC5C,qBAAM,UAAU,CACd,mDAAmD,EACnD,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAO,CAAC,EAAE,CAAC,EAAnC,CAAmC,EACzC,EAAE,QAAQ,EAAE,UAAA,CAAC,gBAAI,OAAA,CAAC,CAAA,MAAA,CAAC,CAAC,UAAU,0CAAE,MAAM,CAAA,IAAI,CAAC,CAAA,MAAA,CAAC,CAAC,IAAI,0CAAE,MAAM,CAAA,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,CAAA,EAAA,EAAE,CAC1F;oBAED,qFAAqF;kBAFpF;;oBAND,6EAA6E;oBAC7E,4CAA4C;oBAC5C,SAIC,CAAA;wCAGW,KAAK,EAAE,KAAK;;;wCACtB,qBAAM,UAAU,CACd,4DAAqD,KAAK,CAAE,EAC5D;;wCAAM,OAAA,YAAU,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,cAAY,CAAC,EAAE,EAAE,CAAA,SAAE,GAAC,KAAK,IAAG,KAAK,IAAS,CAAA,CAAC;oCAAnF,CAAmF,EACzF,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,OAAO,KAAK,UAAG,KAAK,mCAAgC,EAAtD,CAAsD,EAAE,CAC5F,EAAA;;oCAJD,SAIC,CAAA;;;;;0BALwF,EAA9D,KAAA,MAAM,CAAC,OAAO,CAAC,6BAA6B,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;;;yBAA9D,CAAA,cAA8D,CAAA;oBAAhF,WAAc,EAAb,KAAK,QAAA,EAAE,KAAK,QAAA;kDAAZ,KAAK,EAAE,KAAK;;;;;oBAAK,IAA8D,CAAA;;yBAQ3F,qBAAM,UAAU,CACd,0FAA0F,EAC1F,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,cAAY,CAAC,EAAE,CAAC,EAA9C,CAA8C,EACpD,EAAE,QAAQ,EAAE,UAAA,EAAE,YAAI,OAAA,CAAC,EAAE,CAAC,iBAAiB,IAAI,CAAC,CAAA,MAAA,EAAE,CAAC,cAAc,0CAAE,MAAM,CAAA,IAAI,EAAE,CAAC,WAAW,KAAK,SAAS,CAAA,EAAA,EAAE,CACxG;oBAED,wEAAwE;kBAFvE;;oBAJD,SAIC,CAAA;oBAED,wEAAwE;oBACxE,qBAAM,UAAU,CACd,2DAA2D,EAC3D,cAAM,OAAA,YAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAA1F,CAA0F,EAChG,EAAE,QAAQ,EAAE,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,KAAK,KAAK,cAAc,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAnD,CAAmD,EAAE,CACvE,EAAA;;oBALD,wEAAwE;oBACxE,SAIC,CAAA;oBACD,qBAAM,UAAU,CACd,0FAA0F,EAC1F,cAAM,OAAA,YAAU,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,cAAY,CAAC,EAAE,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,EAAzF,CAAyF,EAC/F,EAAE,QAAQ,EAAE,UAAA,EAAE,IAAI,OAAA,EAAE,CAAC,qBAAqB,KAAK,IAAI,EAAjC,CAAiC,EAAE,CACtD;wBAED,uFAAuF;sBAFtF;;oBAJD,SAIC,CAAA;oBAED,uFAAuF;oBACvF,qBAAM,UAAU,CACd,gGAAgG,EAChG,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAO,CAAC,EAAE,EAAE;4BAC3C,IAAI,EAAE,CAAC,eAAe,CAAC;4BACvB,UAAU,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;4BAC7B,UAAU,EAAE,uBAAuB;4BACnC,IAAI,EAAE,gBAAgB;4BACtB,MAAM,EAAE,kBAAkB;yBAC3B,CAAC,EANI,CAMJ,EACF,EAAE,QAAQ,EAAE,UAAA,CAAC;;gCAAI,OAAA,CACf,CAAC,CAAC,CAAA,MAAA,CAAC,CAAC,IAAI,0CAAE,QAAQ,CAAC,eAAe,CAAC,CAAA;uCAChC,CAAC,CAAC,CAAA,MAAA,CAAC,CAAC,UAAU,0CAAE,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;uCACzC,CAAC,CAAC,UAAU,KAAK,uBAAuB,CAC5C,CAAA;6BAAA,EAAE,CACJ,EAAA;;oBAfD,uFAAuF;oBACvF,SAcC,CAAA;oBACD,qBAAM,UAAU,CACd,gGAAgG,EAChG,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,cAAY,CAAC,EAAE,EAAE;4BACtD,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;4BAC7C,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC;4BACvF,IAAI,EAAE,CAAC,eAAe,CAAC;yBACxB,CAAC,EAJI,CAIJ,EACF,EAAE,QAAQ,EAAE,UAAA,EAAE;;gCAAI,OAAA,CAChB,CAAA,MAAA,MAAA,EAAE,CAAC,cAAc,0CAAG,CAAC,CAAC,0CAAE,IAAI,MAAK,OAAO;uCACrC,CAAA,MAAA,MAAA,EAAE,CAAC,cAAc,0CAAG,CAAC,CAAC,0CAAE,IAAI,MAAK,OAAO;uCACxC,CAAC,CAAC,CAAA,MAAA,EAAE,CAAC,IAAI,0CAAE,QAAQ,CAAC,eAAe,CAAC,CAAA,CACxC,CAAA;6BAAA,EAAE,CACJ,EAAA;;oBAZD,SAYC,CAAA;;;yBAEG,cAAc,EAAd,yBAAc;;;;oBACV,qBAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,cAAc,CAAC,EAAA;;oBAAtD,SAAsD,CAAA;;;;;;yBAE1D,MAAM,EAAN,yBAAM;;;;oBACF,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAA;;oBAArC,SAAqC,CAAA;;;;;;yBAEzC,SAAS,EAAT,yBAAS;;;;oBACL,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,EAAA;;oBAA3C,SAA2C,CAAA;;;;;;;;;;CAGtD,CAAA;AAED,6CAA6C;AAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAM,KAAG,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACjC,IAAM,aAAW,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IAEzC,IAAM,QAAQ,GAAG;;;wBACf,qBAAM,WAAW,CAAC,KAAG,EAAE,aAAW,CAAC,EAAA;;oBAAnC,SAAmC,CAAA;oBACnC,qBAAM,gCAAgC,CAAC,EAAE,GAAG,OAAA,EAAE,WAAW,eAAA,EAAE,CAAC,EAAA;;oBAA5D,SAA4D,CAAA;;;;SAC7D,CAAA;IAED,QAAQ,EAAE;SACP,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAA;QAC1F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,8DAA8D,EAAE,KAAK,CAAC,CAAA;QACpF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}
+{"version":3,"file":"F-0106-F-0110-enduser-write-restrictions.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/F-0106-F-0110-enduser-write-restrictions.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AACtD,OAAO,EACL,UAAU,EACV,UAAU,GACX,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEzC,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AACpE,IAAM,UAAU,GAAG,0BAA0B,CAAA;AAE7C,IAAM,gBAAgB,GAAG,uBAAuB,CAAA;AAEhD,0EAA0E;AAC1E,sEAAsE;AACtE,4CAA4C;AAC5C,IAAM,wBAAwB,GAAG,UAAC,OAAe,EAAE,OAAe;;IAA0B,OAAA,CAAC;QAC3F,UAAU,EAAE,4BAA4B;QACxC,IAAI,EAAE,CAAC,oBAAoB,CAAC;QAC5B,UAAU,EAAE,CAAC,2BAA2B,CAAC;QACzC,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,YAAY,EAAE,OAAO;QACrB,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,0BAA0B,EAAE,CAAC;QAC/D,uBAAuB,EAAE,EAAE;QAC3B,QAAQ,YAAI,GAAC,OAAO,IAAG,OAAO,KAAE;QAChC,eAAe,EAAE,OAAO;QACxB,MAAM,EAAE,EAAE,kBAAkB,EAAE,MAAM,EAAE;QACtC,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,uBAAuB;QAC/B,IAAI,EAAE,qBAAqB;QAC3B,SAAS,EAAE,EAAE,QAAQ,EAAE,uBAAuB,EAAE;QAChD,kBAAkB,EAAE,EAAE,QAAQ,EAAE,yBAAyB,EAAE;QAC3D,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC5B,gBAAgB,EAAE,KAAK;QACvB,oBAAoB,EAAE,IAAI;QAC1B,kBAAkB,EAAE,YAAY;QAChC,gBAAgB,EAAE,gBAAgB;QAClC,YAAY,EAAE,kBAAkB;QAChC,qBAAqB,EAAE,gBAAgB;QACvC,gBAAgB,EAAE,uBAAuB;QACzC,SAAS,EAAE,kBAAkB;KAC9B,CAAC;AAzB0F,CAyB1F,CAAA;AAEF,yEAAyE;AACzE,8FAA8F;AAC9F,8FAA8F;AAC9F,mDAAmD;AACnD,IAAM,6BAA6B,GAAG,UAAC,OAAe,EAAE,cAAsB,IAA0B,OAAA,CAAC;IACvG,iBAAiB,EAAE,IAAI;IACvB,yEAAyE;IACzE,6FAA6F;IAC7F,2FAA2F;IAC3F,SAAS,EAAE,cAAc;IACzB,WAAW,EAAE,OAAO;IACpB,WAAW,EAAE,IAAI,IAAI,CAAC,sBAAsB,CAAC;IAC7C,wBAAwB,EAAE,IAAI;IAC9B,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAC7C,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;IAClF,gBAAgB,EAAE,sDAAsD;IACxE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACpF,cAAc,EAAE,IAAI;IACpB,QAAQ,EAAE,IAAI,IAAI,EAAE;IACpB,kBAAkB,EAAE,IAAI;IACxB,QAAQ,EAAE,IAAI,IAAI,EAAE;IACpB,IAAI,EAAE,CAAC,oBAAoB,CAAC;IAC5B,SAAS,EAAE,oBAAoB;IAC/B,SAAS,EAAE,2BAA2B;IACtC,OAAO,EAAE,uCAAuC;IAChD,UAAU,EAAE,GAAG;CAChB,CAAC,EAtBsG,CAsBtG,CAAA;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,IAAM,gCAAgC,GAAG,UAAO,EAAgD;QAA9C,GAAG,SAAA;;;;;;oBAC1D,UAAU,CAAC,oEAAoE,CAAC,CAAA;;;;oBASxE,YAAY,GAAG,wBAAiB,IAAI,CAAC,GAAG,EAAE,iBAAc,CAAA;oBAC9C,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAA;;oBAAxG,YAAU,SAA8F;oBAC9G,SAAS,GAAG,SAAO,CAAC,EAAE,CAAA;oBAGD,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;4BACpD,KAAK,EAAE,sBAAe,IAAI,CAAC,GAAG,EAAE,iBAAc,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO;yBAC/E,CAAC,EAAA;;oBAFI,iBAAe,SAEnB;oBACF,cAAc,GAAG,cAAY,CAAC,EAAE,CAAA;oBAChC,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,SAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,EAAA;;oBAAnF,SAAmF,CAAA;oBAE7E,eAAa,IAAI,cAAc,CAAC,EAAE,IAAI,MAAA,EAAE,UAAU,YAAA,EAAE,CAAC,CAAA;oBAC3D,qBAAM,YAAU,CAAC,YAAY,CAAC,YAAY,EAAE,gBAAgB,CAAC,EAAA;;oBAA7D,SAA6D,CAAA;oBAEhD,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC,EAAA;;oBAA5F,IAAI,GAAG,SAAqF;oBAClG,MAAM,GAAG,IAAI,CAAC,EAAE,CAAA;oBACmB,qBAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,qBAAqB,CAAC;4BACpF,MAAM,EAAE,IAAI,CAAC,EAAE;4BACf,SAAS,EAAE,SAAO,CAAC,EAAE;yBACtB,CAAC,EAAA;;oBAHM,iBAA2B,CAAA,SAGjC,CAAA,SAH4B;oBAI9B,cAAc,GAAG,cAAY,CAAC,EAAE,CAAA;wCAGpB,KAAK,EAAE,KAAK;;;wCACtB,qBAAM,UAAU,CACd,sDAA+C,KAAK,CAAE,EACtD;;wCAAM,OAAA,YAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAO,CAAC,EAAE,EAAE,CAAA,SAAE,GAAC,KAAK,IAAG,KAAK,IAAS,CAAA,CAAC;oCAAxE,CAAwE,EAC9E,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,OAAO,KAAK,UAAG,KAAK,mCAAgC,EAAtD,CAAsD,EAAE,CAC5F,EAAA;;oCAJD,SAIC,CAAA;;;;;0BAL+F,EAArE,KAAA,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAO,CAAC,EAAE,CAAC,CAAC;;;yBAArE,CAAA,cAAqE,CAAA;oBAAvF,WAAc,EAAb,KAAK,QAAA,EAAE,KAAK,QAAA;kDAAZ,KAAK,EAAE,KAAK;;;;;oBAAK,IAAqE,CAAA;;;gBAQlG,6EAA6E;gBAC7E,4CAA4C;gBAC5C,qBAAM,UAAU,CACd,mDAAmD,EACnD,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAO,CAAC,EAAE,CAAC,EAAnC,CAAmC,EACzC,EAAE,QAAQ,EAAE,UAAA,CAAC,gBAAI,OAAA,CAAC,CAAA,MAAA,CAAC,CAAC,UAAU,0CAAE,MAAM,CAAA,IAAI,CAAC,CAAA,MAAA,CAAC,CAAC,IAAI,0CAAE,MAAM,CAAA,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,CAAA,EAAA,EAAE,CAC1F;oBAED,qFAAqF;kBAFpF;;oBAND,6EAA6E;oBAC7E,4CAA4C;oBAC5C,SAIC,CAAA;wCAGW,KAAK,EAAE,KAAK;;;wCACtB,qBAAM,UAAU,CACd,4DAAqD,KAAK,CAAE,EAC5D;;wCAAM,OAAA,YAAU,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,cAAY,CAAC,EAAE,EAAE,CAAA,SAAE,GAAC,KAAK,IAAG,KAAK,IAAS,CAAA,CAAC;oCAAnF,CAAmF,EACzF,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,OAAO,KAAK,UAAG,KAAK,mCAAgC,EAAtD,CAAsD,EAAE,CAC5F,EAAA;;oCAJD,SAIC,CAAA;;;;;0BALyG,EAA/E,KAAA,MAAM,CAAC,OAAO,CAAC,6BAA6B,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,cAAY,CAAC,EAAE,CAAC,CAAC;;;yBAA/E,CAAA,cAA+E,CAAA;oBAAjG,WAAc,EAAb,KAAK,QAAA,EAAE,KAAK,QAAA;kDAAZ,KAAK,EAAE,KAAK;;;;;oBAAK,IAA+E,CAAA;;yBAQ5G,qBAAM,UAAU,CACd,qGAAqG,EACrG,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,cAAY,CAAC,EAAE,CAAC,EAA9C,CAA8C,EACpD,EAAE,QAAQ,EAAE,UAAA,EAAE;;4BAAI,OAAA,CAChB,CAAC,EAAE,CAAC,iBAAiB,IAAI,CAAC,CAAA,MAAA,EAAE,CAAC,cAAc,0CAAE,MAAM,CAAA,IAAI,EAAE,CAAC,WAAW,KAAK,SAAS;gCACnF,2FAA2F;mCACxF,EAAE,CAAC,SAAS,KAAK,SAAO,CAAC,EAAE,CAC/B,CAAA;yBAAA,EAAE,CACJ;oBAED,wEAAwE;kBAFvE;;oBARD,SAQC,CAAA;oBAED,wEAAwE;oBACxE,qBAAM,UAAU,CACd,2DAA2D,EAC3D,cAAM,OAAA,YAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAA1F,CAA0F,EAChG,EAAE,QAAQ,EAAE,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,KAAK,KAAK,cAAc,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAnD,CAAmD,EAAE,CACvE,EAAA;;oBALD,wEAAwE;oBACxE,SAIC,CAAA;oBACD,qBAAM,UAAU,CACd,0FAA0F,EAC1F,cAAM,OAAA,YAAU,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,cAAY,CAAC,EAAE,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,EAAzF,CAAyF,EAC/F,EAAE,QAAQ,EAAE,UAAA,EAAE,IAAI,OAAA,EAAE,CAAC,qBAAqB,KAAK,IAAI,EAAjC,CAAiC,EAAE,CACtD;wBAED,uFAAuF;sBAFtF;;oBAJD,SAIC,CAAA;oBAED,uFAAuF;oBACvF,qBAAM,UAAU,CACd,gGAAgG,EAChG,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAO,CAAC,EAAE,EAAE;4BAC3C,IAAI,EAAE,CAAC,eAAe,CAAC;4BACvB,UAAU,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;4BAC7B,UAAU,EAAE,uBAAuB;4BACnC,IAAI,EAAE,gBAAgB;4BACtB,MAAM,EAAE,kBAAkB;yBAC3B,CAAC,EANI,CAMJ,EACF,EAAE,QAAQ,EAAE,UAAA,CAAC;;gCAAI,OAAA,CACf,CAAC,CAAC,CAAA,MAAA,CAAC,CAAC,IAAI,0CAAE,QAAQ,CAAC,eAAe,CAAC,CAAA;uCAChC,CAAC,CAAC,CAAA,MAAA,CAAC,CAAC,UAAU,0CAAE,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;uCACzC,CAAC,CAAC,UAAU,KAAK,uBAAuB,CAC5C,CAAA;6BAAA,EAAE,CACJ,EAAA;;oBAfD,uFAAuF;oBACvF,SAcC,CAAA;oBACD,qBAAM,UAAU,CACd,gGAAgG,EAChG,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,cAAY,CAAC,EAAE,EAAE;4BACtD,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;4BAC7C,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC;4BACvF,IAAI,EAAE,CAAC,eAAe,CAAC;yBACxB,CAAC,EAJI,CAIJ,EACF,EAAE,QAAQ,EAAE,UAAA,EAAE;;gCAAI,OAAA,CAChB,CAAA,MAAA,MAAA,EAAE,CAAC,cAAc,0CAAG,CAAC,CAAC,0CAAE,IAAI,MAAK,OAAO;uCACrC,CAAA,MAAA,MAAA,EAAE,CAAC,cAAc,0CAAG,CAAC,CAAC,0CAAE,IAAI,MAAK,OAAO;uCACxC,CAAC,CAAC,CAAA,MAAA,EAAE,CAAC,IAAI,0CAAE,QAAQ,CAAC,eAAe,CAAC,CAAA,CACxC,CAAA;6BAAA,EAAE,CACJ;wBAED,6FAA6F;wBAC7F,4FAA4F;sBAH3F;;oBAZD,SAYC,CAAA;oBAED,6FAA6F;oBAC7F,4FAA4F;oBAC5F,qBAAM,UAAU,CACd,qEAAqE,EACrE,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,cAAY,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,cAAY,CAAC,EAAE,EAAE,CAAC,EAAjF,CAAiF,EACvF,EAAE,QAAQ,EAAE,UAAA,EAAE,IAAI,OAAA,EAAE,CAAC,SAAS,KAAK,cAAY,CAAC,EAAE,EAAhC,CAAgC,EAAE,CACrD,EAAA;;oBAND,6FAA6F;oBAC7F,4FAA4F;oBAC5F,SAIC,CAAA;oBACD,qBAAM,UAAU,CACd,iDAAiD,EACjD,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,cAAY,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,SAAO,CAAC,EAAE,EAAE,CAAC,EAA5E,CAA4E,EAClF,EAAE,QAAQ,EAAE,UAAA,EAAE,IAAI,OAAA,EAAE,CAAC,SAAS,KAAK,SAAO,CAAC,EAAE,EAA3B,CAA2B,EAAE,CAChD,EAAA;;oBAJD,SAIC,CAAA;;;yBAEG,cAAc,EAAd,yBAAc;;;;oBACV,qBAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,cAAc,CAAC,EAAA;;oBAAtD,SAAsD,CAAA;;;;;;yBAE1D,MAAM,EAAN,yBAAM;;;;oBACF,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAA;;oBAArC,SAAqC,CAAA;;;;;;yBAEzC,SAAS,EAAT,yBAAS;;;;oBACL,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,EAAA;;oBAA3C,SAA2C,CAAA;;;;;;yBAE/C,cAAc,EAAd,yBAAc;;;;oBACV,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,cAAc,CAAC,EAAA;;oBAAhD,SAAgD,CAAA;;;;;;;;;;CAG3D,CAAA;AAED,6CAA6C;AAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAM,KAAG,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACjC,IAAM,aAAW,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IAEzC,IAAM,QAAQ,GAAG;;;wBACf,qBAAM,WAAW,CAAC,KAAG,EAAE,aAAW,CAAC,EAAA;;oBAAnC,SAAmC,CAAA;oBACnC,qBAAM,gCAAgC,CAAC,EAAE,GAAG,OAAA,EAAE,WAAW,eAAA,EAAE,CAAC,EAAA;;oBAA5D,SAA4D,CAAA;;;;SAC7D,CAAA;IAED,QAAQ,EAAE;SACP,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAA;QAC1F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,8DAA8D,EAAE,KAAK,CAAC,CAAA;QACpF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}

package/lib/esm/tests/api_tests/security/F-0166-allowed-paths-wildcard-bypass.test.d.ts

@@ -0,0 +1,6 @@
+import { Session } from "../../../sdk";
+export declare const allowed_paths_confinement_tests: ({ sdk }: {
+    sdk: Session;
+    sdkNonAdmin: Session;
+}) => Promise<void>;
+//# sourceMappingURL=F-0166-allowed-paths-wildcard-bypass.test.d.ts.map

package/lib/esm/tests/api_tests/security/F-0166-allowed-paths-wildcard-bypass.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"F-0166-allowed-paths-wildcard-bypass.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/F-0166-allowed-paths-wildcard-bypass.test.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,OAAO,EAAkB,MAAM,cAAc,CAAA;AAkEtD,eAAO,MAAM,+BAA+B;SAA2B,OAAO;iBAAe,OAAO;mBAqnBnG,CAAA"}