@tellescope/sdk 1.255.18 → 1.256.0

package/lib/esm/tests/api_tests/security/F-0166-allowed-paths-wildcard-bypass.test.js

@@ -0,0 +1,996 @@
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+require('source-map-support').install();
+import axios from "axios";
+import { Session, EnduserSession } from "../../../sdk";
+import { assert, log_header, } from "@tellescope/testing";
+import { setup_tests } from "../../setup";
+var host = process.env.API_URL || 'http://localhost:8080';
+/**
+ * Regression test for F-0166 — allowedPaths wildcard disables path confinement entirely.
+ *
+ * Several public, unauthenticated endpoints mint a JWT confined to a small set of API paths via an
+ * `allowedPaths` claim. The enforcement predicate (api/modules/authentication.ts checkAccess)
+ * contained:
+ *
+ *     || (p.endsWith('*') && req.path.split('/')[0] === p.split('/')[0])
+ *
+ * Every request path begins with '/', so req.path.split('/')[0] is ''. Every wildcard entry also
+ * begins with '/', so p.split('/')[0] is ''. The clause reduces to '' === '' — always true. Any
+ * allowedPaths array containing a single '*' entry therefore matched EVERY request path and the
+ * 403 never fired.
+ *
+ * Two mint sites contain `/meeting/*`, and both are public and unauthenticated:
+ *   - session_for_join_link  — enduser session, MFA bypassed
+ *   - session_for_start_link — full STAFF session with mfa: false
+ *
+ * So an unauthenticated caller holding a link token had an effectively unrestricted session.
+ *
+ * Fixing that exposed a second defect in the same primitive: entries matched by bare string prefix
+ * with no notion of HTTP method, so '/users' and '/endusers' were collection-NAMESPACE grants (22
+ * and 21 routes each). The worst consequence was a full escape — PATCH /users/consent called
+ * login_user on a freshly-read DB record with no options, minting a token with no allowedPaths at
+ * all, so two requests turned a start link into an unconfined staff session.
+ *
+ * Fix, in two parts:
+ *   - entries are now method-scoped and exact ('get:/endusers'), with ':param' for segments not
+ *     knowable at mint time ('get:/meeting/:id'). Un-prefixed and '*' entries remain honoured only
+ *     so tokens minted before this grammar keep working until they expire.
+ *   - consent / configure_inbox / switch_account forward req.session.allowedPaths into login_user.
+ *
+ * Scenarios:
+ *   S1 public-form session  — no wildcard; correctly confined throughout (regression anchor)
+ *   S2 join-link session    — RED before the wildcard fix
+ *   S3 start-link session   — RED before the wildcard fix (staff session; the severe case)
+ *   S4 side-effects of the /calendar-events entry
+ *   S6 namespace grants and the privilege-escalation chain — RED before method-scoped exact matching
+ *   S5 ordinary sessions with no allowedPaths claim, incl. headless API-key callers, are unaffected
+ */
+var RAND = function () { return Math.random().toString(36).slice(2, 10); };
+var OBJECT_ID = '68a1b2c3d4e5f60718293a4b';
+export var allowed_paths_confinement_tests = function (_a) {
+    var sdk = _a.sdk;
+    return __awaiter(void 0, void 0, void 0, function () {
+        var probes, request, isPathDenial, expectDenied, expectAllowed, formId, productId, joinEnduserId, formEnduserEmail, hostUserId, templateId, bookingEnduserId, eventIds, businessId, form, publicFormSession, product, joinEnduser, joinLinkToken, joinEvent, unrelatedEvent, joinSession, hostUser, startLinkToken, startEvent, startSession, baselineEnduserToken, baselineUserToken, S1, formEnduserId, publicRefresh, refreshedEnduser_1, withheld, consentEcho, echoedKeys, leakedKeys, fieldsThatMustBeRefused, _i, fieldsThatMustBeRefused_1, _b, field, value, r, mixed, afterProbes, S2, attendanceWrite, echoedEvent, refreshedJoin, refreshedJoinToken, S3, refreshedStart, refreshedStartToken, S4, prefixGranted, _c, prefixGranted_1, _d, method, path, r, S6, ABSENT_ID_A, ABSENT_ID_B, INVALID_EMAIL, consentAttempt, refreshedForScopes, rescopedToken, S7, bookingTemplate, bookingEnduserEmail, bookingEnduser, bookingSession, bookingEcho, bookingLeaked, _e, _f, _g, field, value, r, S5, _h, _j, path, _k, _l, path, adminAuthenticated, apiKeySDK, _m, _o, path, r, failures, scenarios, _loop_1, _p, scenarios_1, scenario, _q, probes_1, p, _r, eventIds_1, id, _s, _t, e, _u, _v, _w, _x, _y, _z;
+        var _0, _1;
+        var _2, _3, _4, _5, _6, _7, _8, _9, _10;
+        return __generator(this, function (_11) {
+            switch (_11.label) {
+                case 0:
+                    log_header("F-0166: allowedPaths wildcard bypasses session path confinement");
+                    probes = [];
+                    request = function (token, method, path, data) { return __awaiter(void 0, void 0, void 0, function () {
+                        var r;
+                        return __generator(this, function (_a) {
+                            switch (_a.label) {
+                                case 0: return [4 /*yield*/, axios.request(__assign(__assign({ method: method, url: "".concat(host, "/v1").concat(path) }, method === 'get' ? { params: data } : { data: data }), { headers: { Authorization: "Bearer ".concat(token) }, validateStatus: function () { return true; } }))];
+                                case 1:
+                                    r = _a.sent();
+                                    return [2 /*return*/, { status: r.status, body: r.data }];
+                            }
+                        });
+                    }); };
+                    isPathDenial = function (r) {
+                        var _a;
+                        return (r.status === 403 && ((_a = r.body) === null || _a === void 0 ? void 0 : _a.message) === 'Inaccessible');
+                    };
+                    expectDenied = function (scenario, label, confinedToken, baselineToken, method, path, data) { return __awaiter(void 0, void 0, void 0, function () {
+                        var baseline, confined;
+                        return __generator(this, function (_a) {
+                            switch (_a.label) {
+                                case 0: return [4 /*yield*/, request(baselineToken, method, path, data)];
+                                case 1:
+                                    baseline = _a.sent();
+                                    return [4 /*yield*/, request(confinedToken, method, path, data)];
+                                case 2:
+                                    confined = _a.sent();
+                                    probes.push({
+                                        scenario: scenario,
+                                        label: label,
+                                        path: path,
+                                        expected: 'denied',
+                                        status: confined.status,
+                                        baselineStatus: baseline.status,
+                                        pass: baseline.status !== 403 && isPathDenial(confined),
+                                        note: baseline.status === 403 ? 'BAD PROBE: baseline session also got 403' : undefined,
+                                    });
+                                    return [2 /*return*/];
+                            }
+                        });
+                    }); };
+                    expectAllowed = function (scenario, label, token, method, path, data, _a) {
+                        var _b = _a === void 0 ? {} : _a, _c = _b.allow401, allow401 = _c === void 0 ? false : _c;
+                        return __awaiter(void 0, void 0, void 0, function () {
+                            var r;
+                            return __generator(this, function (_d) {
+                                switch (_d.label) {
+                                    case 0: return [4 /*yield*/, request(token, method, path, data)];
+                                    case 1:
+                                        r = _d.sent();
+                                        probes.push({
+                                            scenario: scenario,
+                                            label: label,
+                                            path: path,
+                                            expected: 'allowed',
+                                            status: r.status,
+                                            pass: r.status !== 403 && (allow401 || r.status !== 401),
+                                            note: allow401 && r.status === 401 ? '401 expected: enduser cannot authenticate this model' : undefined,
+                                        });
+                                        return [2 /*return*/];
+                                }
+                            });
+                        });
+                    };
+                    eventIds = [];
+                    _11.label = 1;
+                case 1:
+                    _11.trys.push([1, , 123, 160]);
+                    businessId = sdk.userInfo.businessId;
+                    return [4 /*yield*/, sdk.api.forms.createOne({
+                            title: "F-0166 path confinement ".concat(RAND()),
+                            allowPublicURL: true,
+                        })];
+                case 2:
+                    form = _11.sent();
+                    formId = form.id;
+                    return [4 /*yield*/, sdk.api.form_fields.createOne({
+                            formId: form.id,
+                            title: 'q',
+                            type: 'string',
+                            previousFields: [{ type: 'root', info: {} }],
+                        })];
+                case 3:
+                    _11.sent();
+                    formEnduserEmail = "f0166-form-".concat(RAND(), "@tellescope.example");
+                    return [4 /*yield*/, new EnduserSession({ host: host, businessId: businessId })
+                            .api.form_responses.session_for_public_form({
+                            businessId: businessId,
+                            formId: form.id,
+                            email: formEnduserEmail,
+                            fname: 'Path',
+                            lname: 'Confinement',
+                            skipMatch: true, // also skips the intake-phone requirement
+                        })];
+                case 4:
+                    publicFormSession = _11.sent();
+                    return [4 /*yield*/, sdk.api.products.createOne({
+                            title: "F-0166 product ".concat(RAND()),
+                            cost: { amount: 500, currency: 'USD' },
+                            processor: 'Stripe',
+                        })];
+                case 5:
+                    product = _11.sent();
+                    productId = product.id;
+                    return [4 /*yield*/, sdk.api.endusers.createOne({
+                            email: "f0166-join-".concat(RAND(), "@tellescope.example"),
+                        })];
+                case 6:
+                    joinEnduser = _11.sent();
+                    joinEnduserId = joinEnduser.id;
+                    joinLinkToken = "f0166-join-".concat(RAND()).concat(RAND());
+                    return [4 /*yield*/, sdk.api.calendar_events.createOne({
+                            title: 'F-0166 join', durationInMinutes: 30, startTimeInMS: Date.now() + 3600000,
+                            attendees: [{ type: 'enduser', id: joinEnduser.id, joinLinkToken: joinLinkToken }],
+                        })];
+                case 7:
+                    joinEvent = _11.sent();
+                    eventIds.push(joinEvent.id);
+                    return [4 /*yield*/, sdk.api.calendar_events.createOne({
+                            title: 'F-0166 unrelated', durationInMinutes: 30, startTimeInMS: Date.now() + 3600000,
+                            attendees: [{ type: 'enduser', id: joinEnduser.id }],
+                        })];
+                case 8:
+                    unrelatedEvent = _11.sent();
+                    eventIds.push(unrelatedEvent.id);
+                    return [4 /*yield*/, new EnduserSession({ host: host, businessId: businessId })
+                            .api.calendar_events.session_for_join_link({ token: joinLinkToken })
+                        // -- start link (STAFF session, allowedPaths contains /meeting/*)
+                        // throwaway user; verifiedEmail must be set at create time (it is rejected on update)
+                    ];
+                case 9:
+                    joinSession = _11.sent();
+                    return [4 /*yield*/, sdk.api.users.createOne({
+                            email: "f0166-host-".concat(RAND(), "@tellescope.example"),
+                            fname: 'Path', lname: 'Host',
+                            verifiedEmail: true,
+                            notificationEmailsDisabled: true,
+                        })];
+                case 10:
+                    hostUser = _11.sent();
+                    hostUserId = hostUser.id;
+                    startLinkToken = "f0166-start-".concat(RAND()).concat(RAND());
+                    return [4 /*yield*/, sdk.api.calendar_events.createOne({
+                            title: 'F-0166 start', durationInMinutes: 30, startTimeInMS: Date.now() + 3600000,
+                            attendees: [{ type: 'user', id: hostUser.id }, { type: 'enduser', id: joinEnduser.id }],
+                            startLinkToken: startLinkToken,
+                        })];
+                case 11:
+                    startEvent = _11.sent();
+                    eventIds.push(startEvent.id);
+                    return [4 /*yield*/, sdk.api.calendar_events.session_for_start_link({ token: startLinkToken })
+                        // -- unconfined baselines of each session type (generate_auth_token, never .authenticate)
+                    ];
+                case 12:
+                    startSession = _11.sent();
+                    return [4 /*yield*/, sdk.api.endusers.generate_auth_token({ id: joinEnduser.id })];
+                case 13:
+                    baselineEnduserToken = (_11.sent()).authToken;
+                    return [4 /*yield*/, sdk.api.users.generate_auth_token({ id: hostUser.id })
+                        /* ============ S1: public-form session — no wildcard, correctly confined already ============ */
+                    ];
+                case 14:
+                    baselineUserToken = (_11.sent()).authToken;
+                    S1 = 'S1 public-form';
+                    return [4 /*yield*/, expectAllowed(S1, 'always-allowed path', publicFormSession.authToken, 'get', '/test-authenticated')];
+                case 15:
+                    _11.sent();
+                    return [4 /*yield*/, expectAllowed(S1, 'listed: form info for access code', publicFormSession.authToken, 'get', '/form-info-for-access-code', { accessCode: publicFormSession.accessCode })];
+                case 16:
+                    _11.sent();
+                    return [4 /*yield*/, expectAllowed(S1, 'listed: refresh enduser session', publicFormSession.authToken, 'post', '/refresh-enduser-session')];
+                case 17:
+                    _11.sent();
+                    return [4 /*yield*/, expectAllowed(S1, 'listed: product by id', publicFormSession.authToken, 'get', "/product/".concat(productId))];
+                case 18:
+                    _11.sent();
+                    return [4 /*yield*/, expectDenied(S1, 'unlisted: calendar events', publicFormSession.authToken, baselineEnduserToken, 'get', '/calendar-events')];
+                case 19:
+                    _11.sent();
+                    return [4 /*yield*/, expectDenied(S1, 'unlisted: form responses', publicFormSession.authToken, baselineEnduserToken, 'get', '/form-responses')];
+                case 20:
+                    _11.sent();
+                    return [4 /*yield*/, expectDenied(S1, 'unlisted: files', publicFormSession.authToken, baselineEnduserToken, 'get', '/files')
+                        // 'get:/product' names one route, so it no longer leaks the whole /products namespace the way a
+                        // bare '/product' prefix entry did — that used to reach /products/prepare-stripe-checkout too
+                    ];
+                case 21:
+                    _11.sent();
+                    // 'get:/product' names one route, so it no longer leaks the whole /products namespace the way a
+                    // bare '/product' prefix entry did — that used to reach /products/prepare-stripe-checkout too
+                    return [4 /*yield*/, expectDenied(S1, 'exact matching: /products not granted by get:/product', publicFormSession.authToken, baselineEnduserToken, 'get', '/products')
+                        /* ---- field confinement on the granted generic update route ----
+                         * 'patch:/enduser/:id' is granted for Portal V2's terms gate, so the route check alone no longer
+                         * protects this session — SESSION_SCOPE_WRITABLE_FIELDS does. These probes are the live control:
+                         * the consent write lands, and every contactable/identity field is refused. Without them the
+                         * module test is the only thing standing between a scope-table edit and account takeover.
+                         */
+                    ];
+                case 22:
+                    // 'get:/product' names one route, so it no longer leaks the whole /products namespace the way a
+                    // bare '/product' prefix entry did — that used to reach /products/prepare-stripe-checkout too
+                    _11.sent();
+                    formEnduserId = publicFormSession.enduserId;
+                    return [4 /*yield*/, request(publicFormSession.authToken, 'post', '/refresh-enduser-session', {})];
+                case 23:
+                    publicRefresh = _11.sent();
+                    refreshedEnduser_1 = (_3 = (_2 = publicRefresh.body) === null || _2 === void 0 ? void 0 : _2.enduser) !== null && _3 !== void 0 ? _3 : {};
+                    probes.push({
+                        scenario: S1,
+                        label: 'public refresh exposes the session\'s own id',
+                        path: '/refresh-enduser-session',
+                        expected: 'allowed',
+                        status: refreshedEnduser_1.id === formEnduserId ? 200 : 500,
+                        pass: refreshedEnduser_1.id === formEnduserId,
+                        note: "id=".concat(refreshedEnduser_1.id),
+                    });
+                    withheld = ['email', 'phone', 'dateOfBirth', 'fname', 'lname', 'note', 'insurance', 'tags']
+                        .filter(function (f) { return refreshedEnduser_1[f] !== undefined; });
+                    probes.push({
+                        scenario: S1,
+                        label: 'public refresh still withholds the patient record',
+                        path: '/refresh-enduser-session',
+                        expected: 'denied',
+                        status: withheld.length ? 200 : 403,
+                        pass: withheld.length === 0,
+                        note: withheld.length ? "LEAKED [".concat(withheld, "]") : "keys=[".concat(Object.keys(refreshedEnduser_1), "]"),
+                    });
+                    return [4 /*yield*/, expectAllowed(S1, 'field-restricted: may record terms consent', publicFormSession.authToken, 'patch', "/enduser/".concat(formEnduserId), { updates: { termsSigned: new Date().toISOString(), termsVersion: '1' } })
+                        // The write being confined is not enough: the update RESPONSE is not redacted for enduser sessions
+                        // (applyRedactions runs only for user sessions on that path), so an unprojected echo would hand
+                        // this session the record it can't otherwise read — GET /enduser/:id is not even in this scope.
+                        // Assert the response carries ONLY what the session was allowed to write.
+                    ];
+                case 24:
+                    _11.sent();
+                    return [4 /*yield*/, request(publicFormSession.authToken, 'patch', "/enduser/".concat(formEnduserId), { updates: { termsVersion: '2' } })];
+                case 25:
+                    consentEcho = _11.sent();
+                    echoedKeys = Object.keys((_4 = consentEcho.body) !== null && _4 !== void 0 ? _4 : {});
+                    leakedKeys = echoedKeys.filter(function (k) { return !['id', 'termsSigned', 'termsVersion'].includes(k); });
+                    probes.push({
+                        scenario: S1,
+                        label: 'field-restricted: update response echoes only the writable fields',
+                        path: "/enduser/".concat(formEnduserId),
+                        expected: 'allowed',
+                        status: leakedKeys.length === 0 ? consentEcho.status : 500,
+                        pass: consentEcho.status === 200 && leakedKeys.length === 0,
+                        note: leakedKeys.length ? "LEAKED [".concat(leakedKeys, "]") : "echoed [".concat(echoedKeys, "]"),
+                    });
+                    fieldsThatMustBeRefused = [
+                        ['email', "f0166-takeover-".concat(RAND(), "@tellescope.example")],
+                        ['phone', '+15555550123'],
+                        ['landline', '+15555550124'],
+                        ['dateOfBirth', '1990-01-01'],
+                        ['fname', 'F0166Overwritten'],
+                    ];
+                    _i = 0, fieldsThatMustBeRefused_1 = fieldsThatMustBeRefused;
+                    _11.label = 26;
+                case 26:
+                    if (!(_i < fieldsThatMustBeRefused_1.length)) return [3 /*break*/, 29];
+                    _b = fieldsThatMustBeRefused_1[_i], field = _b[0], value = _b[1];
+                    return [4 /*yield*/, request(publicFormSession.authToken, 'patch', "/enduser/".concat(formEnduserId), { updates: (_0 = {}, _0[field] = value, _0) })];
+                case 27:
+                    r = _11.sent();
+                    probes.push({
+                        scenario: S1,
+                        label: "field-restricted: cannot write enduser '".concat(field, "'"),
+                        path: "/enduser/".concat(formEnduserId),
+                        expected: 'denied',
+                        status: r.status,
+                        pass: r.status === 403,
+                        note: 'route is granted; the field allowlist is what refuses this',
+                    });
+                    _11.label = 28;
+                case 28:
+                    _i++;
+                    return [3 /*break*/, 26];
+                case 29: return [4 /*yield*/, request(publicFormSession.authToken, 'patch', "/enduser/".concat(formEnduserId), { updates: { termsVersion: '2', email: "f0166-mixed-".concat(RAND(), "@tellescope.example") } })];
+                case 30:
+                    mixed = _11.sent();
+                    probes.push({
+                        scenario: S1,
+                        label: 'field-restricted: a mixed allowed+denied update is refused whole',
+                        path: "/enduser/".concat(formEnduserId),
+                        expected: 'denied',
+                        status: mixed.status,
+                        pass: mixed.status === 403,
+                        note: 'no partial application — email must not ride along with termsVersion',
+                    });
+                    return [4 /*yield*/, sdk.api.endusers.getOne(formEnduserId)];
+                case 31:
+                    afterProbes = _11.sent();
+                    probes.push({
+                        scenario: S1,
+                        label: 'field-restricted: stored email survived every attempt',
+                        path: "/enduser/".concat(formEnduserId),
+                        expected: 'denied',
+                        status: afterProbes.email === formEnduserEmail ? 403 : 200,
+                        pass: afterProbes.email === formEnduserEmail,
+                        note: "stored=".concat(afterProbes.email),
+                    });
+                    S2 = 'S2 join-link (enduser)';
+                    return [4 /*yield*/, expectDenied(S2, 'unlisted: form responses', joinSession.authToken, baselineEnduserToken, 'get', '/form-responses')];
+                case 32:
+                    _11.sent();
+                    return [4 /*yield*/, expectDenied(S2, 'unlisted: files', joinSession.authToken, baselineEnduserToken, 'get', '/files')];
+                case 33:
+                    _11.sent();
+                    return [4 /*yield*/, expectDenied(S2, 'unlisted: portal customizations', joinSession.authToken, baselineEnduserToken, 'get', '/portal-customizations')];
+                case 34:
+                    _11.sent();
+                    return [4 /*yield*/, expectDenied(S2, 'unlisted: UNRELATED calendar event', joinSession.authToken, baselineEnduserToken, 'get', "/calendar-event/".concat(unrelatedEvent.id))];
+                case 35:
+                    _11.sent();
+                    return [4 /*yield*/, expectAllowed(S2, 'always-allowed path', joinSession.authToken, 'get', '/test-authenticated')];
+                case 36:
+                    _11.sent();
+                    return [4 /*yield*/, expectAllowed(S2, 'listed: my meetings', joinSession.authToken, 'get', '/my-meetings')
+                        // enduserActions for organizations is {}, so an enduser 401s here regardless of confinement
+                    ];
+                case 37:
+                    _11.sent();
+                    // enduserActions for organizations is {}, so an enduser 401s here regardless of confinement
+                    return [4 /*yield*/, expectAllowed(S2, 'listed: organizations', joinSession.authToken, 'get', '/organizations', undefined, { allow401: true })];
+                case 38:
+                    // enduserActions for organizations is {}, so an enduser 401s here regardless of confinement
+                    _11.sent();
+                    return [4 /*yield*/, expectAllowed(S2, 'listed: users', joinSession.authToken, 'get', '/users')];
+                case 39:
+                    _11.sent();
+                    return [4 /*yield*/, expectAllowed(S2, 'listed: pinned calendar event', joinSession.authToken, 'get', "/calendar-event/".concat(joinEvent.id))];
+                case 40:
+                    _11.sent();
+                    return [4 /*yield*/, expectAllowed(S2, 'wildcard: meeting by id', joinSession.authToken, 'get', "/meeting/".concat(OBJECT_ID))
+                        // the two paths widened in this change so the portal video flow keeps working
+                    ];
+                case 41:
+                    _11.sent();
+                    // the two paths widened in this change so the portal video flow keeps working
+                    return [4 /*yield*/, expectAllowed(S2, 'widened: calendar events list', joinSession.authToken, 'get', '/calendar-events')];
+                case 42:
+                    // the two paths widened in this change so the portal video flow keeps working
+                    _11.sent();
+                    return [4 /*yield*/, expectAllowed(S2, 'widened: join meeting for event', joinSession.authToken, 'post', '/join-meeting-for-event', { calendarEventId: joinEvent.id })
+                        // The WaitingRoom marks attendance here. This write is deliberately NOT field-restricted: the
+                        // portal reads the event back through useCalendarEvents, whose updateElement REPLACES the local
+                        // record with the update response (react state.tsx), so a truncated response would drop event
+                        // fields out of local state mid-visit and break a live Twilio call. Assert both halves of that
+                        // contract — the write lands, AND the response is still a whole event.
+                    ];
+                case 43:
+                    _11.sent();
+                    return [4 /*yield*/, request(joinSession.authToken, 'patch', "/calendar-event/".concat(joinEvent.id), { updates: { joinedVideoCall: [{ id: joinEnduserId, at: new Date().toISOString() }] } })];
+                case 44:
+                    attendanceWrite = _11.sent();
+                    probes.push({
+                        scenario: S2,
+                        label: 'marks joinedVideoCall on its pinned event',
+                        path: "/calendar-event/".concat(joinEvent.id),
+                        expected: 'allowed',
+                        status: attendanceWrite.status,
+                        pass: attendanceWrite.status === 200,
+                    });
+                    echoedEvent = (_5 = attendanceWrite.body) !== null && _5 !== void 0 ? _5 : {};
+                    probes.push({
+                        scenario: S2,
+                        label: 'attendance write returns the WHOLE event (client replaces local state from it)',
+                        path: "/calendar-event/".concat(joinEvent.id),
+                        expected: 'allowed',
+                        status: (echoedEvent.title && echoedEvent.durationInMinutes) ? 200 : 500,
+                        pass: !!echoedEvent.title && !!echoedEvent.durationInMinutes && !!echoedEvent.joinedVideoCall,
+                        note: "echoed ".concat(Object.keys(echoedEvent).length, " keys"),
+                    });
+                    return [4 /*yield*/, request(joinSession.authToken, 'post', '/refresh-enduser-session', {})];
+                case 45:
+                    refreshedJoin = _11.sent();
+                    refreshedJoinToken = (_6 = refreshedJoin.body) === null || _6 === void 0 ? void 0 : _6.authToken;
+                    probes.push({
+                        scenario: S2, label: 'refresh returned a new token', path: '/refresh-enduser-session',
+                        expected: 'allowed', status: refreshedJoin.status, pass: !!refreshedJoinToken,
+                    });
+                    if (!refreshedJoinToken) return [3 /*break*/, 48];
+                    return [4 /*yield*/, expectDenied(S2, 'after refresh: still denied form responses', refreshedJoinToken, baselineEnduserToken, 'get', '/form-responses')];
+                case 46:
+                    _11.sent();
+                    return [4 /*yield*/, expectAllowed(S2, 'after refresh: still allowed my meetings', refreshedJoinToken, 'get', '/my-meetings')];
+                case 47:
+                    _11.sent();
+                    _11.label = 48;
+                case 48:
+                    S3 = 'S3 start-link (STAFF)';
+                    return [4 /*yield*/, expectDenied(S3, 'unlisted: form responses', startSession.authToken, baselineUserToken, 'get', '/form-responses')];
+                case 49:
+                    _11.sent();
+                    return [4 /*yield*/, expectDenied(S3, 'unlisted: journeys', startSession.authToken, baselineUserToken, 'get', '/journeys')];
+                case 50:
+                    _11.sent();
+                    return [4 /*yield*/, expectDenied(S3, 'unlisted: tickets', startSession.authToken, baselineUserToken, 'get', '/tickets')];
+                case 51:
+                    _11.sent();
+                    return [4 /*yield*/, expectDenied(S3, 'unlisted: data sync (org-wide change firehose)', startSession.authToken, baselineUserToken, 'get', '/data-sync', { from: new Date(Date.now() - 60000).toISOString() })];
+                case 52:
+                    _11.sent();
+                    return [4 /*yield*/, expectDenied(S3, 'unlisted: file download URL', startSession.authToken, baselineUserToken, 'get', '/file-download-URL', { secureName: 'f0166-does-not-exist' })];
+                case 53:
+                    _11.sent();
+                    return [4 /*yield*/, expectDenied(S3, 'unlisted: UNRELATED calendar event', startSession.authToken, baselineUserToken, 'get', "/calendar-event/".concat(unrelatedEvent.id))];
+                case 54:
+                    _11.sent();
+                    return [4 /*yield*/, expectAllowed(S3, 'always-allowed path', startSession.authToken, 'get', '/test-authenticated')];
+                case 55:
+                    _11.sent();
+                    return [4 /*yield*/, expectAllowed(S3, 'listed: my meetings', startSession.authToken, 'get', '/my-meetings')];
+                case 56:
+                    _11.sent();
+                    return [4 /*yield*/, expectAllowed(S3, 'listed: calendar events', startSession.authToken, 'get', '/calendar-events')];
+                case 57:
+                    _11.sent();
+                    return [4 /*yield*/, expectAllowed(S3, 'listed: organizations', startSession.authToken, 'get', '/organizations')];
+                case 58:
+                    _11.sent();
+                    return [4 /*yield*/, expectAllowed(S3, 'listed: users', startSession.authToken, 'get', '/users')];
+                case 59:
+                    _11.sent();
+                    return [4 /*yield*/, expectAllowed(S3, 'listed: endusers', startSession.authToken, 'get', '/endusers')];
+                case 60:
+                    _11.sent();
+                    return [4 /*yield*/, expectAllowed(S3, 'listed: pinned calendar event', startSession.authToken, 'get', "/calendar-event/".concat(startEvent.id))];
+                case 61:
+                    _11.sent();
+                    return [4 /*yield*/, expectAllowed(S3, 'wildcard: meeting by id', startSession.authToken, 'get', "/meeting/".concat(OBJECT_ID))];
+                case 62:
+                    _11.sent();
+                    return [4 /*yield*/, expectAllowed(S3, 'prefix descendant: users bulk-read', startSession.authToken, 'post', '/users/bulk-read', { ids: [hostUser.id] })];
+                case 63:
+                    _11.sent();
+                    return [4 /*yield*/, expectAllowed(S3, 'prefix descendant: endusers bulk-read', startSession.authToken, 'post', '/endusers/bulk-read', { ids: [joinEnduser.id] })];
+                case 64:
+                    _11.sent();
+                    return [4 /*yield*/, expectAllowed(S3, 'widened: join meeting for event', startSession.authToken, 'post', '/join-meeting-for-event', { calendarEventId: startEvent.id })];
+                case 65:
+                    _11.sent();
+                    return [4 /*yield*/, expectAllowed(S3, 'widened: add attendees to meeting', startSession.authToken, 'post', '/add-attendees-to-meeting', { id: OBJECT_ID })
+                        // login_user propagates allowedPaths implicitly through its ...toSign rest spread — the
+                        // "(ASSUMPTION)" comments in the mint sites depend on this, so assert it explicitly
+                    ];
+                case 66:
+                    _11.sent();
+                    return [4 /*yield*/, request(startSession.authToken, 'post', '/refresh-session', {})];
+                case 67:
+                    refreshedStart = _11.sent();
+                    refreshedStartToken = (_7 = refreshedStart.body) === null || _7 === void 0 ? void 0 : _7.authToken;
+                    probes.push({
+                        scenario: S3, label: 'refresh returned a new token', path: '/refresh-session',
+                        expected: 'allowed', status: refreshedStart.status, pass: !!refreshedStartToken,
+                    });
+                    if (!refreshedStartToken) return [3 /*break*/, 70];
+                    return [4 /*yield*/, expectDenied(S3, 'after refresh: still denied journeys', refreshedStartToken, baselineUserToken, 'get', '/journeys')];
+                case 68:
+                    _11.sent();
+                    return [4 /*yield*/, expectAllowed(S3, 'after refresh: still allowed my meetings', refreshedStartToken, 'get', '/my-meetings')];
+                case 69:
+                    _11.sent();
+                    _11.label = 70;
+                case 70:
+                    S4 = 'S4 widening side-effects';
+                    prefixGranted = [
+                        ['patch', '/calendar-events/bulk-update'],
+                        ['post', '/calendar-events/report'],
+                    ];
+                    _c = 0, prefixGranted_1 = prefixGranted;
+                    _11.label = 71;
+                case 71:
+                    if (!(_c < prefixGranted_1.length)) return [3 /*break*/, 74];
+                    _d = prefixGranted_1[_c], method = _d[0], path = _d[1];
+                    return [4 /*yield*/, axios.request({
+                            method: method,
+                            url: "".concat(host, "/v1").concat(path),
+                            data: {},
+                            headers: { Authorization: "Bearer ".concat(joinSession.authToken) },
+                            validateStatus: function () { return true; },
+                        })];
+                case 72:
+                    r = _11.sent();
+                    probes.push({
+                        scenario: S4,
+                        label: "enduser action gating blocks ".concat(method.toUpperCase(), " ").concat(path),
+                        path: path,
+                        expected: 'denied',
+                        status: r.status,
+                        pass: r.status === 401 || r.status === 403,
+                        note: 'prefix-granted by /calendar-events; blocked by enduserActions instead',
+                    });
+                    _11.label = 73;
+                case 73:
+                    _c++;
+                    return [3 /*break*/, 71];
+                case 74:
+                    S6 = 'S6 namespace escapes';
+                    ABSENT_ID_A = '68a1b2c3d4e5f60718293a4b';
+                    ABSENT_ID_B = '68a1b2c3d4e5f60718293a4c';
+                    INVALID_EMAIL = 'f0166-not-an-email';
+                    return [4 /*yield*/, expectDenied(S6, 'ESCAPE: /users/consent (minted an unconfined token)', startSession.authToken, baselineUserToken, 'patch', '/users/consent', { termsVersion: '1' })];
+                case 75:
+                    _11.sent();
+                    return [4 /*yield*/, expectDenied(S6, 'ESCAPE: /users/switch-account', startSession.authToken, baselineUserToken, 'post', '/users/switch-account', { targetUserId: ABSENT_ID_A })];
+                case 76:
+                    _11.sent();
+                    return [4 /*yield*/, expectDenied(S6, 'ESCAPE: /users/configure-inbox', startSession.authToken, baselineUserToken, 'post', '/users/configure-inbox', {})];
+                case 77:
+                    _11.sent();
+                    return [4 /*yield*/, expectDenied(S6, 'PHI: /endusers/load-inbox-data', startSession.authToken, baselineUserToken, 'get', '/endusers/load-inbox-data')];
+                case 78:
+                    _11.sent();
+                    return [4 /*yield*/, expectDenied(S6, 'PHI: /endusers/report', startSession.authToken, baselineUserToken, 'get', '/endusers/report')];
+                case 79:
+                    _11.sent();
+                    return [4 /*yield*/, expectDenied(S6, 'PHI: /endusers/engagement', startSession.authToken, baselineUserToken, 'get', '/endusers/engagement')];
+                case 80:
+                    _11.sent();
+                    return [4 /*yield*/, expectDenied(S6, 'DESTRUCTIVE: /endusers/merge', startSession.authToken, baselineUserToken, 'post', '/endusers/merge', { sourceEnduserId: ABSENT_ID_A, destinationEnduserId: ABSENT_ID_B })];
+                case 81:
+                    _11.sent();
+                    return [4 /*yield*/, expectDenied(S6, 'DESTRUCTIVE: /endusers/bulk-update', startSession.authToken, baselineUserToken, 'patch', '/endusers/bulk-update', { ids: [ABSENT_ID_A], fields: {} })
+                        // method scoping, end to end: the same path is readable but not writable.
+                        // Baselines use the ADMIN token — the throwaway host user cannot create users or endusers, so it
+                        // would 403 on permissions and the probe could not distinguish that from a confinement denial.
+                    ];
+                case 82:
+                    _11.sent();
+                    // method scoping, end to end: the same path is readable but not writable.
+                    // Baselines use the ADMIN token — the throwaway host user cannot create users or endusers, so it
+                    // would 403 on permissions and the probe could not distinguish that from a confinement denial.
+                    return [4 /*yield*/, expectAllowed(S6, 'method scoping: GET /endusers allowed', startSession.authToken, 'get', '/endusers')];
+                case 83:
+                    // method scoping, end to end: the same path is readable but not writable.
+                    // Baselines use the ADMIN token — the throwaway host user cannot create users or endusers, so it
+                    // would 403 on permissions and the probe could not distinguish that from a confinement denial.
+                    _11.sent();
+                    return [4 /*yield*/, expectDenied(S6, 'method scoping: POST /endusers (create) denied', startSession.authToken, sdk.authToken, 'post', '/endusers', { email: INVALID_EMAIL })];
+                case 84:
+                    _11.sent();
+                    return [4 /*yield*/, expectAllowed(S6, 'method scoping: GET /users allowed', startSession.authToken, 'get', '/users')];
+                case 85:
+                    _11.sent();
+                    return [4 /*yield*/, expectDenied(S6, 'method scoping: POST /users (create) denied', startSession.authToken, sdk.authToken, 'post', '/users', { email: INVALID_EMAIL })
+                        // even if consent were reachable, the token it mints must stay confined (defense in depth)
+                    ];
+                case 86:
+                    _11.sent();
+                    return [4 /*yield*/, request(startSession.authToken, 'patch', '/users/consent', { termsVersion: '1' })];
+                case 87:
+                    consentAttempt = _11.sent();
+                    if (!(consentAttempt.status === 200 && ((_8 = consentAttempt.body) === null || _8 === void 0 ? void 0 : _8.authToken))) return [3 /*break*/, 89];
+                    return [4 /*yield*/, expectDenied(S6, 'consent-minted token is still confined', consentAttempt.body.authToken, baselineUserToken, 'get', '/journeys')];
+                case 88:
+                    _11.sent();
+                    _11.label = 89;
+                case 89: return [4 /*yield*/, request(startSession.authToken, 'post', '/refresh-session', {})];
+                case 90:
+                    refreshedForScopes = _11.sent();
+                    rescopedToken = (_9 = refreshedForScopes.body) === null || _9 === void 0 ? void 0 : _9.authToken;
+                    probes.push({
+                        scenario: S6, label: 'refresh returned a new token', path: '/refresh-session',
+                        expected: 'allowed', status: refreshedForScopes.status, pass: !!rescopedToken,
+                    });
+                    if (!rescopedToken) return [3 /*break*/, 96];
+                    return [4 /*yield*/, expectDenied(S6, 'after refresh: still cannot reach /users/consent', rescopedToken, baselineUserToken, 'patch', '/users/consent', { termsVersion: '1' })];
+                case 91:
+                    _11.sent();
+                    return [4 /*yield*/, expectDenied(S6, 'after refresh: still cannot reach /endusers/load-inbox-data', rescopedToken, baselineUserToken, 'get', '/endusers/load-inbox-data')];
+                case 92:
+                    _11.sent();
+                    return [4 /*yield*/, expectDenied(S6, 'after refresh: POST /endusers still denied', rescopedToken, baselineUserToken, 'post', '/endusers', { email: "f0166-should-not-exist-".concat(RAND(), "@tellescope.example") })];
+                case 93:
+                    _11.sent();
+                    return [4 /*yield*/, expectAllowed(S6, 'after refresh: GET /endusers still allowed', rescopedToken, 'get', '/endusers')];
+                case 94:
+                    _11.sent();
+                    return [4 /*yield*/, expectAllowed(S6, 'after refresh: my-meetings still allowed', rescopedToken, 'get', '/my-meetings')];
+                case 95:
+                    _11.sent();
+                    _11.label = 96;
+                case 96:
+                    S7 = 'S7 appointment-booking';
+                    return [4 /*yield*/, sdk.api.calendar_event_templates.createOne({
+                            title: "F-0166 booking ".concat(RAND()), durationInMinutes: 30,
+                        })];
+                case 97:
+                    bookingTemplate = _11.sent();
+                    templateId = bookingTemplate.id;
+                    bookingEnduserEmail = "f0166-booking-".concat(RAND(), "@tellescope.example");
+                    return [4 /*yield*/, sdk.api.endusers.createOne({
+                            email: bookingEnduserEmail, fname: 'Booking', lname: 'Confinement',
+                        })];
+                case 98:
+                    bookingEnduser = _11.sent();
+                    bookingEnduserId = bookingEnduser.id;
+                    return [4 /*yield*/, new EnduserSession({ host: host, businessId: businessId })
+                            .api.calendar_events.session_for_public_appointment_booking({
+                            businessId: businessId,
+                            calendarEventTemplateId: bookingTemplate.id,
+                            email: bookingEnduserEmail,
+                            fname: 'Booking',
+                            lname: 'Confinement',
+                        })];
+                case 99:
+                    bookingSession = _11.sent();
+                    return [4 /*yield*/, expectAllowed(S7, 'field-restricted: may record terms consent', bookingSession.authToken, 'patch', "/enduser/".concat(bookingEnduser.id), { updates: { termsSigned: new Date().toISOString(), termsVersion: '1' } })];
+                case 100:
+                    _11.sent();
+                    return [4 /*yield*/, request(bookingSession.authToken, 'patch', "/enduser/".concat(bookingEnduser.id), { updates: { termsVersion: '2' } })];
+                case 101:
+                    bookingEcho = _11.sent();
+                    bookingLeaked = Object.keys((_10 = bookingEcho.body) !== null && _10 !== void 0 ? _10 : {})
+                        .filter(function (k) { return !['id', 'termsSigned', 'termsVersion'].includes(k); });
+                    probes.push({
+                        scenario: S7,
+                        label: 'field-restricted: update response echoes only the writable fields',
+                        path: "/enduser/".concat(bookingEnduser.id),
+                        expected: 'allowed',
+                        status: bookingLeaked.length === 0 ? bookingEcho.status : 500,
+                        pass: bookingEcho.status === 200 && bookingLeaked.length === 0,
+                        note: bookingLeaked.length ? "LEAKED [".concat(bookingLeaked, "]") : undefined,
+                    });
+                    _e = 0, _f = [['email', "f0166-bt-".concat(RAND(), "@tellescope.example")], ['phone', '+15555550188']];
+                    _11.label = 102;
+                case 102:
+                    if (!(_e < _f.length)) return [3 /*break*/, 105];
+                    _g = _f[_e], field = _g[0], value = _g[1];
+                    return [4 /*yield*/, request(bookingSession.authToken, 'patch', "/enduser/".concat(bookingEnduser.id), { updates: (_1 = {}, _1[field] = value, _1) })];
+                case 103:
+                    r = _11.sent();
+                    probes.push({
+                        scenario: S7,
+                        label: "field-restricted: cannot write enduser '".concat(field, "'"),
+                        path: "/enduser/".concat(bookingEnduser.id),
+                        expected: 'denied',
+                        status: r.status,
+                        pass: r.status === 403,
+                        note: 'route is granted; the field allowlist is what refuses this',
+                    });
+                    _11.label = 104;
+                case 104:
+                    _e++;
+                    return [3 /*break*/, 102];
+                case 105: 
+                // the booking scope must not have gained anything else along with the enduser write
+                return [4 /*yield*/, expectDenied(S7, 'unlisted: form responses', bookingSession.authToken, baselineEnduserToken, 'get', '/form-responses')];
+                case 106:
+                    // the booking scope must not have gained anything else along with the enduser write
+                    _11.sent();
+                    return [4 /*yield*/, expectDenied(S7, 'unlisted: calendar events', bookingSession.authToken, baselineEnduserToken, 'get', '/calendar-events')];
+                case 107:
+                    _11.sent();
+                    return [4 /*yield*/, expectAllowed(S7, 'listed: refresh enduser session', bookingSession.authToken, 'post', '/refresh-enduser-session')
+                        /* ============ S5: ordinary sessions with no allowedPaths claim ============ */
+                    ];
+                case 108:
+                    _11.sent();
+                    S5 = 'S5 unconfined sessions';
+                    _h = 0, _j = ['/journeys', '/form-responses', '/endusers', '/calendar-events', '/tickets'];
+                    _11.label = 109;
+                case 109:
+                    if (!(_h < _j.length)) return [3 /*break*/, 112];
+                    path = _j[_h];
+                    return [4 /*yield*/, expectAllowed(S5, "staff session reaches ".concat(path), baselineUserToken, 'get', path)];
+                case 110:
+                    _11.sent();
+                    _11.label = 111;
+                case 111:
+                    _h++;
+                    return [3 /*break*/, 109];
+                case 112: return [4 /*yield*/, expectAllowed(S5, 'staff session reaches /data-sync', baselineUserToken, 'get', '/data-sync', { from: new Date(Date.now() - 60000).toISOString() })];
+                case 113:
+                    _11.sent();
+                    _k = 0, _l = ['/form-responses', '/calendar-events', '/files'];
+                    _11.label = 114;
+                case 114:
+                    if (!(_k < _l.length)) return [3 /*break*/, 117];
+                    path = _l[_k];
+                    return [4 /*yield*/, expectAllowed(S5, "enduser session reaches ".concat(path), baselineEnduserToken, 'get', path)];
+                case 115:
+                    _11.sent();
+                    _11.label = 116;
+                case 116:
+                    _k++;
+                    return [3 /*break*/, 114];
+                case 117: return [4 /*yield*/, sdk.test_authenticated()];
+                case 118:
+                    adminAuthenticated = _11.sent();
+                    probes.push({
+                        scenario: S5, label: 'admin sdk still authenticated', path: '/test-authenticated',
+                        expected: 'allowed', status: 200, pass: adminAuthenticated === 'Authenticated!',
+                    });
+                    apiKeySDK = new Session({ host: host, apiKey: '3n5q0SCBT_iUvZz-b9BJtX7o7HQUVJ9v132PgHJNJsg.' });
+                    _m = 0, _o = ['/journeys', '/form-responses', '/endusers', '/calendar-events', '/files'];
+                    _11.label = 119;
+                case 119:
+                    if (!(_m < _o.length)) return [3 /*break*/, 122];
+                    path = _o[_m];
+                    return [4 /*yield*/, axios.request({
+                            method: 'get',
+                            url: "".concat(host, "/v1").concat(path),
+                            headers: { Authorization: "API_KEY ".concat(apiKeySDK.apiKey) },
+                            validateStatus: function () { return true; },
+                        })];
+                case 120:
+                    r = _11.sent();
+                    probes.push({
+                        scenario: S5,
+                        label: "API key (headless) reaches ".concat(path),
+                        path: path,
+                        expected: 'allowed',
+                        status: r.status,
+                        pass: r.status !== 403,
+                    });
+                    _11.label = 121;
+                case 121:
+                    _m++;
+                    return [3 /*break*/, 119];
+                case 122:
+                    failures = probes.filter(function (p) { return !p.pass; });
+                    console.log('');
+                    console.log('  F-0166 — full probe table');
+                    console.log('  ' + '-'.repeat(112));
+                    scenarios = probes.map(function (p) { return p.scenario; }).filter(function (s, i, all) { return all.indexOf(s) === i; });
+                    _loop_1 = function (scenario) {
+                        var inScenario = probes.filter(function (p) { return p.scenario === scenario; });
+                        var failed = inScenario.filter(function (p) { return !p.pass; }).length;
+                        console.log("  ".concat(scenario, ": ").concat(inScenario.length - failed, "/").concat(inScenario.length, " passing").concat(failed ? "  <-- ".concat(failed, " FAILING") : ''));
+                        for (var _12 = 0, inScenario_1 = inScenario; _12 < inScenario_1.length; _12++) {
+                            var p = inScenario_1[_12];
+                            var baseline = p.baselineStatus !== undefined ? " baseline=".concat(p.baselineStatus) : '';
+                            console.log("    ".concat(p.pass ? ' ok ' : 'FAIL', "  want=").concat(p.expected.padEnd(7), " got=").concat(p.status).concat(baseline, "  ").concat(p.label).concat(p.note ? "  (".concat(p.note, ")") : ''));
+                        }
+                    };
+                    for (_p = 0, scenarios_1 = scenarios; _p < scenarios_1.length; _p++) {
+                        scenario = scenarios_1[_p];
+                        _loop_1(scenario);
+                    }
+                    console.log('  ' + '-'.repeat(112));
+                    console.log("  TOTAL: ".concat(probes.length - failures.length, "/").concat(probes.length, " passing, ").concat(failures.length, " failing"));
+                    console.log('');
+                    for (_q = 0, probes_1 = probes; _q < probes_1.length; _q++) {
+                        p = probes_1[_q];
+                        assert(p.pass, "".concat(p.scenario, " \u2014 ").concat(p.label, " (").concat(p.path, "): wanted ").concat(p.expected, ", got status ").concat(p.status)
+                            + (p.baselineStatus !== undefined ? " (unconfined baseline got ".concat(p.baselineStatus, ")") : ''), "".concat(p.scenario, " \u2014 ").concat(p.label));
+                    }
+                    return [3 /*break*/, 160];
+                case 123:
+                    _r = 0, eventIds_1 = eventIds;
+                    _11.label = 124;
+                case 124:
+                    if (!(_r < eventIds_1.length)) return [3 /*break*/, 129];
+                    id = eventIds_1[_r];
+                    _11.label = 125;
+                case 125:
+                    _11.trys.push([125, 127, , 128]);
+                    return [4 /*yield*/, sdk.api.calendar_events.deleteOne(id)];
+                case 126:
+                    _11.sent();
+                    return [3 /*break*/, 128];
+                case 127:
+                    _s = _11.sent();
+                    return [3 /*break*/, 128];
+                case 128:
+                    _r++;
+                    return [3 /*break*/, 124];
+                case 129:
+                    if (!joinEnduserId) return [3 /*break*/, 133];
+                    _11.label = 130;
+                case 130:
+                    _11.trys.push([130, 132, , 133]);
+                    return [4 /*yield*/, sdk.api.endusers.deleteOne(joinEnduserId)];
+                case 131:
+                    _11.sent();
+                    return [3 /*break*/, 133];
+                case 132:
+                    _t = _11.sent();
+                    return [3 /*break*/, 133];
+                case 133:
+                    if (!formEnduserEmail) return [3 /*break*/, 139];
+                    _11.label = 134;
+                case 134:
+                    _11.trys.push([134, 138, , 139]);
+                    return [4 /*yield*/, sdk.api.endusers.getOne({ email: formEnduserEmail })];
+                case 135:
+                    e = _11.sent();
+                    if (!(e === null || e === void 0 ? void 0 : e.id)) return [3 /*break*/, 137];
+                    return [4 /*yield*/, sdk.api.endusers.deleteOne(e.id)];
+                case 136:
+                    _11.sent();
+                    _11.label = 137;
+                case 137: return [3 /*break*/, 139];
+                case 138:
+                    _u = _11.sent();
+                    return [3 /*break*/, 139];
+                case 139:
+                    if (!hostUserId) return [3 /*break*/, 143];
+                    _11.label = 140;
+                case 140:
+                    _11.trys.push([140, 142, , 143]);
+                    return [4 /*yield*/, sdk.api.users.deleteOne(hostUserId)];
+                case 141:
+                    _11.sent();
+                    return [3 /*break*/, 143];
+                case 142:
+                    _v = _11.sent();
+                    return [3 /*break*/, 143];
+                case 143:
+                    if (!bookingEnduserId) return [3 /*break*/, 147];
+                    _11.label = 144;
+                case 144:
+                    _11.trys.push([144, 146, , 147]);
+                    return [4 /*yield*/, sdk.api.endusers.deleteOne(bookingEnduserId)];
+                case 145:
+                    _11.sent();
+                    return [3 /*break*/, 147];
+                case 146:
+                    _w = _11.sent();
+                    return [3 /*break*/, 147];
+                case 147:
+                    if (!templateId) return [3 /*break*/, 151];
+                    _11.label = 148;
+                case 148:
+                    _11.trys.push([148, 150, , 151]);
+                    return [4 /*yield*/, sdk.api.calendar_event_templates.deleteOne(templateId)];
+                case 149:
+                    _11.sent();
+                    return [3 /*break*/, 151];
+                case 150:
+                    _x = _11.sent();
+                    return [3 /*break*/, 151];
+                case 151:
+                    if (!productId) return [3 /*break*/, 155];
+                    _11.label = 152;
+                case 152:
+                    _11.trys.push([152, 154, , 155]);
+                    return [4 /*yield*/, sdk.api.products.deleteOne(productId)];
+                case 153:
+                    _11.sent();
+                    return [3 /*break*/, 155];
+                case 154:
+                    _y = _11.sent();
+                    return [3 /*break*/, 155];
+                case 155:
+                    if (!formId) return [3 /*break*/, 159];
+                    _11.label = 156;
+                case 156:
+                    _11.trys.push([156, 158, , 159]);
+                    return [4 /*yield*/, sdk.api.forms.deleteOne(formId)];
+                case 157:
+                    _11.sent();
+                    return [3 /*break*/, 159];
+                case 158:
+                    _z = _11.sent();
+                    return [3 /*break*/, 159];
+                case 159: return [7 /*endfinally*/];
+                case 160: return [2 /*return*/];
+            }
+        });
+    });
+};
+if (require.main === module) {
+    console.log("\uD83C\uDF10 Using API URL: ".concat(host));
+    var sdk_1 = new Session({ host: host });
+    var sdkNonAdmin_1 = new Session({ host: host });
+    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, setup_tests(sdk_1, sdkNonAdmin_1)];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, allowed_paths_confinement_tests({ sdk: sdk_1, sdkNonAdmin: sdkNonAdmin_1 })];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); };
+    runTests()
+        .then(function () {
+        console.log("✅ F-0166 allowedPaths confinement test suite completed successfully");
+        process.exit(0);
+    })
+        .catch(function (error) {
+        console.error("❌ F-0166 allowedPaths confinement test suite failed:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=F-0166-allowed-paths-wildcard-bypass.test.js.map