@tellescope/sdk 1.255.18 → 1.256.0

package/lib/esm/tests/api_tests/security/formsort_webhook_auth_field_lock.test.js

@@ -0,0 +1,1193 @@
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+require('source-map-support').install();
+import axios from "axios";
+import { Session } from "../../../sdk";
+import { assert, log_header, } from "@tellescope/testing";
+import { setup_tests } from "../../setup";
+import { FORM_INGESTION_API_KEY_SCOPE } from "@tellescope/types-models";
+var host = process.env.API_URL || 'http://localhost:8080';
+/**
+ * Regression test for: email / phone are locked against writes from the Formsort webhook when it
+ * IMPLICITLY matched a patient that already existed before the submission started.
+ *
+ *   POST /v1/webhooks/formsort/*  (alias: /v1/webhooks/form-ingestion/*)
+ *
+ * The handler resolves an enduser four ways, in precedence order:
+ *   1. ?enduserId=            — an explicit assertion by the API-key-authenticated caller
+ *   2. existingResponse.enduserId — the patient attached to this responder_uuid's draft
+ *   3. findOne({ $or: [{ phone }, { email }] })  — a GUESS, optionally AND'ed with fname + lname
+ *   4. insert                 — brand-new patient
+ *
+ * On a finalized submission it then wrote a blanket `$set: enduserFields` onto whatever it landed
+ * on, and that object carries `email` and `phone`. Those are authentication channels:
+ * request-enduser-password-reset resolves purely by findOne({ email }), begin_login_flow accepts
+ * email OR phone, and send_otp delivers login codes to enduser.phone. So a submission that matched
+ * a patient on PHONE ALONE could repoint that patient's email (and vice versa), which chains to
+ * account takeover exactly as described in public_endpoint_auth_field_lock.test.ts.
+ *
+ * The rule under test: on path 3 — the guess — email and phone are dropped from the update. They
+ * remain writable on paths 1, 2 and 4.
+ *
+ *   - Path 1 stays open deliberately. This endpoint is API-key authenticated, so a caller that
+ *     names an enduserId knows which patient it means; keeping it writable preserves backwards
+ *     compatibility and lets a sophisticated consumer update these fields when it is safe.
+ *   - Path 2 stays open because Formsort fires a webhook per page: the patient who started the form
+ *     must still be able to fix a typo'd email on page 3. It is gated on the STICKY
+ *     FormResponse.authFieldIntakeDisabled flag, computed once when the response is first written,
+ *     so a response first formed by a guess can never be re-opened by a later webhook.
+ *
+ * A "fill only if blank" fix would NOT close this. Phone-only patients are the common case
+ * (sms_messages.leave_message creates them), and filling their blank email is the primary attack —
+ * hence the UNSET victim shapes in R5.
+ *
+ * Scenario groups (pre-fix expectation in parens):
+ *   R1  (RED)   matched on phone — submitted email must not land
+ *   R2  (RED)   matched on email — submitted phone must not land
+ *   R3  (RED)   stickiness: draft matched a pre-existing patient, finalize must not repoint them
+ *   R4  (RED)   unresolvable ?enduserId= falls through to the guess — must stay blocked
+ *   R5  (RED)   victim shapes: blank email / blank phone are filled by the guess (the takeover case)
+ *   G6  (GREEN) patient created by this responder's own draft may still correct their email
+ *   G7  (GREEN) explicit ?enduserId= still writes email + phone (backwards-compat escape hatch)
+ *   G8  (GREEN) ?createNewEnduser=true still writes email + phone
+ *   G9  (GREEN) brand-new patient still inserted WITH submitted email + phone
+ *   G10 (GREEN) fname/lname/dateOfBirth/gender/custom fields still update on a guessed match
+ *   G11 (GREEN) explicit ?enduserId= overrides for that request only — the stored flag stays set
+ *   G12 (GREEN) the Stripe grace: a BLANK phone on a contact the Stripe integration created within
+ *               the last hour is filled from intake (see stripe_provisional_enduser.ts)
+ *   R12         ...but a phone already stored on that contact is never overwritten
+ *   R13         ...and its email is never repointed
+ *   R14         both grace markers are load-bearing: neither source nor stripeCustomerId alone opens it
+ *   R15         the grace is per-request — it does not clear the stored flag
+ *
+ * The Stripe grace is deliberately confined to THIS endpoint, which is API-key authenticated. The
+ * anonymous public-form path gets no exemption; that boundary is pinned by G28 in
+ * public_endpoint_auth_field_lock.test.ts.
+ *
+ * STRUCTURE: record -> report -> cleanup -> assert.
+ * EXIT_ON_FIRST_ERROR is true in testing.ts, so assert() calls process.exit(1) synchronously on the
+ * first failure. Two consequences shape this file:
+ *   1. No async_test here. Every scenario records into `results`, a summary table prints, and a
+ *      single assert() loop runs LAST — so a pre-fix run prints the complete failure picture
+ *      instead of dying on the first probe.
+ *   2. process.exit() does not unwind pending finally blocks, so cleanup runs BEFORE the assert
+ *      loop; otherwise a by-design-failing run would leak every fixture into the next run.
+ */
+// The enduser update in this handler is fire-and-forget (.catch(console.error), not awaited).
+// Reading the victim immediately would frequently show the un-overwritten value on a VULNERABLE
+// server -> false pass. So poll for the attack LANDING: fails fast against vulnerable code, burns
+// the full window against fixed code.
+var OVERWRITE_WINDOW_MS = 3000;
+var POLL_INTERVAL_MS = 150;
+var sleep = function (ms) { return new Promise(function (resolve) { return setTimeout(resolve, ms); }); };
+export var formsort_webhook_auth_field_lock_tests = function (_a) {
+    var sdk = _a.sdk, sdkNonAdmin = _a.sdkNonAdmin;
+    return __awaiter(void 0, void 0, void 0, function () {
+        var RUN, results, record, skip, runScenario, phoneOffset, phoneSeed, nextPhone, emailFor, uuidFor, createdEnduserIds, createdFormIds, createdApiKeyIds, form, apiKey, postWebhook, makeVictim, pollEnduser, matched, stripeVictim, failures, skipped, _i, results_1, r, status_1, _b, createdFormIds_1, formId, responses, _c, responses_1, response, _d, createdFormIds_2, id, uniqueEnduserIds, _e, uniqueEnduserIds_1, id, _f, createdApiKeyIds_1, id, _g, results_2, r;
+        return __generator(this, function (_h) {
+            switch (_h.label) {
+                case 0:
+                    log_header("Formsort Webhook Auth Field Lock (email / phone)");
+                    RUN = Date.now().toString(36);
+                    results = [];
+                    record = function (group, name, ok, detail) {
+                        if (detail === void 0) { detail = ''; }
+                        results.push({ group: group, name: name, ok: ok, detail: detail });
+                        console.log("   ".concat(ok ? '✓' : '✗', " [").concat(group, "] ").concat(name).concat(detail ? " \u2014 ".concat(detail) : ''));
+                    };
+                    skip = function (group, name, detail) {
+                        results.push({ group: group, name: name, ok: true, skipped: true, detail: detail });
+                        console.log("   \u26A0 SKIP [".concat(group, "] ").concat(name, " \u2014 ").concat(detail));
+                    };
+                    runScenario = function (group, name, fn) { return __awaiter(void 0, void 0, void 0, function () {
+                        var err_1, message;
+                        var _a, _b;
+                        return __generator(this, function (_c) {
+                            switch (_c.label) {
+                                case 0:
+                                    _c.trys.push([0, 2, , 3]);
+                                    return [4 /*yield*/, fn()];
+                                case 1:
+                                    _c.sent();
+                                    return [3 /*break*/, 3];
+                                case 2:
+                                    err_1 = _c.sent();
+                                    message = (_b = (_a = err_1 === null || err_1 === void 0 ? void 0 : err_1.message) !== null && _a !== void 0 ? _a : err_1 === null || err_1 === void 0 ? void 0 : err_1.error) !== null && _b !== void 0 ? _b : JSON.stringify(err_1 !== null && err_1 !== void 0 ? err_1 : {}).slice(0, 300);
+                                    record(group, name, false, "threw: ".concat(message));
+                                    return [3 /*break*/, 3];
+                                case 3: return [2 /*return*/];
+                            }
+                        });
+                    }); };
+                    phoneOffset = 0;
+                    phoneSeed = Number(RUN.replace(/[^0-9]/g, '') || '0');
+                    nextPhone = function () { return "+1555555".concat(String((phoneSeed + (phoneOffset += 1)) % 10000).padStart(4, '0')); };
+                    emailFor = function (label) { return "fswh-".concat(label, "-").concat(RUN, "@tellescope.com").toLowerCase(); };
+                    uuidFor = function (label) { return "fswh-".concat(label, "-").concat(RUN); };
+                    createdEnduserIds = [];
+                    createdFormIds = [];
+                    createdApiKeyIds = [];
+                    return [4 /*yield*/, sdk.api.forms.createOne({ title: "formsort auth field lock ".concat(RUN) })];
+                case 1:
+                    form = _h.sent();
+                    createdFormIds.push(form.id);
+                    return [4 /*yield*/, sdk.api.api_keys.createOne({ scopes: [FORM_INGESTION_API_KEY_SCOPE] })];
+                case 2:
+                    apiKey = _h.sent();
+                    createdApiKeyIds.push(apiKey.id);
+                    postWebhook = function (o) { return __awaiter(void 0, void 0, void 0, function () {
+                        var url, res;
+                        return __generator(this, function (_a) {
+                            switch (_a.label) {
+                                case 0:
+                                    url = new URL("".concat(host, "/v1/webhooks/form-ingestion/").concat(apiKey.key));
+                                    url.searchParams.set('formId', form.id);
+                                    url.searchParams.set('returnJSON', 'true');
+                                    if (o.enduserId)
+                                        url.searchParams.set('enduserId', o.enduserId);
+                                    if (o.createNewEnduser)
+                                        url.searchParams.set('createNewEnduser', 'true');
+                                    return [4 /*yield*/, axios.post(url.toString(), { answers: o.answers, responder_uuid: uuidFor(o.label), finalized: o.finalized }, { validateStatus: function () { return true; } })
+                                        // In-progress webhooks always return a bare 200 (the handler returns before the returnJSON
+                                        // block), so `data` is only populated for finalized calls.
+                                    ];
+                                case 1:
+                                    res = _a.sent();
+                                    // In-progress webhooks always return a bare 200 (the handler returns before the returnJSON
+                                    // block), so `data` is only populated for finalized calls.
+                                    return [2 /*return*/, { status: res.status, data: (res.data || {}) }];
+                            }
+                        });
+                    }); };
+                    makeVictim = function (label, fields) { return __awaiter(void 0, void 0, void 0, function () {
+                        var victim;
+                        return __generator(this, function (_a) {
+                            switch (_a.label) {
+                                case 0: return [4 /*yield*/, sdk.api.endusers.createOne(__assign({}, fields))];
+                                case 1:
+                                    victim = _a.sent();
+                                    createdEnduserIds.push(victim.id);
+                                    return [2 /*return*/, victim];
+                            }
+                        });
+                    }); };
+                    pollEnduser = function (id, landed, windowMs) {
+                        if (windowMs === void 0) { windowMs = OVERWRITE_WINDOW_MS; }
+                        return __awaiter(void 0, void 0, void 0, function () {
+                            var deadline, enduser;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        deadline = Date.now() + windowMs;
+                                        enduser = null;
+                                        _a.label = 1;
+                                    case 1:
+                                        if (!(Date.now() < deadline)) return [3 /*break*/, 4];
+                                        return [4 /*yield*/, sdk.api.endusers.getOne(id).catch(function () { return null; })];
+                                    case 2:
+                                        enduser = (_a.sent());
+                                        if (enduser && landed(enduser))
+                                            return [2 /*return*/, enduser];
+                                        return [4 /*yield*/, sleep(POLL_INTERVAL_MS)];
+                                    case 3:
+                                        _a.sent();
+                                        return [3 /*break*/, 1];
+                                    case 4: return [2 /*return*/, enduser];
+                                }
+                            });
+                        });
+                    };
+                    matched = function (group, name, data, victimId) {
+                        if ((data === null || data === void 0 ? void 0 : data.enduserId) === victimId)
+                            return true;
+                        record(group, name, false, "probe invalid: webhook landed on enduserId=".concat((data === null || data === void 0 ? void 0 : data.enduserId) || '(none)', " expected victim=").concat(victimId));
+                        return false;
+                    };
+                    // ---------------------------------------------------------------------------------------------
+                    // R1 — matched on PHONE, submitted email must not land.
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, runScenario('R1', 'phone match does not repoint email', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var originalEmail, phone, victim, attackerEmail, data, enduser;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        originalEmail = emailFor('r1');
+                                        phone = nextPhone();
+                                        return [4 /*yield*/, makeVictim('r1', { email: originalEmail, phone: phone })];
+                                    case 1:
+                                        victim = _a.sent();
+                                        attackerEmail = emailFor('r1-attacker');
+                                        return [4 /*yield*/, postWebhook({
+                                                label: 'r1',
+                                                finalized: true,
+                                                answers: [{ key: 'phone', value: phone }, { key: 'email', value: attackerEmail }],
+                                            })];
+                                    case 2:
+                                        data = (_a.sent()).data;
+                                        if (!matched('R1', 'phone match does not repoint email', data, victim.id))
+                                            return [2 /*return*/];
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.email === attackerEmail; })];
+                                    case 3:
+                                        enduser = _a.sent();
+                                        record('R1', 'phone match does not repoint email', (enduser === null || enduser === void 0 ? void 0 : enduser.email) === originalEmail, "email=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.email) || '(unset)', " expected=").concat(originalEmail));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // R2 — matched on EMAIL, submitted phone must not land.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 3:
+                    // ---------------------------------------------------------------------------------------------
+                    // R1 — matched on PHONE, submitted email must not land.
+                    // ---------------------------------------------------------------------------------------------
+                    _h.sent();
+                    // ---------------------------------------------------------------------------------------------
+                    // R2 — matched on EMAIL, submitted phone must not land.
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, runScenario('R2', 'email match does not repoint phone', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var email, originalPhone, victim, attackerPhone, data, enduser;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        email = emailFor('r2');
+                                        originalPhone = nextPhone();
+                                        return [4 /*yield*/, makeVictim('r2', { email: email, phone: originalPhone })];
+                                    case 1:
+                                        victim = _a.sent();
+                                        attackerPhone = nextPhone();
+                                        return [4 /*yield*/, postWebhook({
+                                                label: 'r2',
+                                                finalized: true,
+                                                answers: [{ key: 'email', value: email }, { key: 'phone', value: attackerPhone }],
+                                            })];
+                                    case 2:
+                                        data = (_a.sent()).data;
+                                        if (!matched('R2', 'email match does not repoint phone', data, victim.id))
+                                            return [2 /*return*/];
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.phone === attackerPhone; })];
+                                    case 3:
+                                        enduser = _a.sent();
+                                        record('R2', 'email match does not repoint phone', (enduser === null || enduser === void 0 ? void 0 : enduser.phone) === originalPhone, "phone=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.phone) || '(unset)', " expected=").concat(originalPhone));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // R3 — stickiness. The draft matched a pre-existing patient by phone; the finalize resolves that
+                        // patient via existingResponse.enduserId (path 2), which is the OPEN path. It must stay blocked,
+                        // because the response was formed by a guess — that is what the sticky flag records.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 4:
+                    // ---------------------------------------------------------------------------------------------
+                    // R2 — matched on EMAIL, submitted phone must not land.
+                    // ---------------------------------------------------------------------------------------------
+                    _h.sent();
+                    // ---------------------------------------------------------------------------------------------
+                    // R3 — stickiness. The draft matched a pre-existing patient by phone; the finalize resolves that
+                    // patient via existingResponse.enduserId (path 2), which is the OPEN path. It must stay blocked,
+                    // because the response was formed by a guess — that is what the sticky flag records.
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, runScenario('R3', 'draft formed by a guess stays blocked on finalize', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var originalEmail, phone, victim, attackerEmail, data, enduser;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        originalEmail = emailFor('r3');
+                                        phone = nextPhone();
+                                        return [4 /*yield*/, makeVictim('r3', { email: originalEmail, phone: phone })];
+                                    case 1:
+                                        victim = _a.sent();
+                                        attackerEmail = emailFor('r3-attacker');
+                                        // in-progress webhook: enough to match (phone present), creates the draft response
+                                        return [4 /*yield*/, postWebhook({ label: 'r3', finalized: false, answers: [{ key: 'phone', value: phone }] })];
+                                    case 2:
+                                        // in-progress webhook: enough to match (phone present), creates the draft response
+                                        _a.sent();
+                                        return [4 /*yield*/, postWebhook({
+                                                label: 'r3',
+                                                finalized: true,
+                                                answers: [{ key: 'phone', value: phone }, { key: 'email', value: attackerEmail }],
+                                            })];
+                                    case 3:
+                                        data = (_a.sent()).data;
+                                        if (!matched('R3', 'draft formed by a guess stays blocked on finalize', data, victim.id))
+                                            return [2 /*return*/];
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.email === attackerEmail; })];
+                                    case 4:
+                                        enduser = _a.sent();
+                                        record('R3', 'draft formed by a guess stays blocked on finalize', (enduser === null || enduser === void 0 ? void 0 : enduser.email) === originalEmail, "email=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.email) || '(unset)', " expected=").concat(originalEmail));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // R4 — an unresolvable ?enduserId= must NOT count as an explicit assertion. findById returns null,
+                        // the chain falls through to the $or guess, and the write must stay blocked. This pins that the
+                        // override keys off the RESOLVED record, not the mere presence of the query param. A cross-tenant
+                        // id takes the same route: DB is businessId-scoped, so findById returns null for it too.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 5:
+                    // ---------------------------------------------------------------------------------------------
+                    // R3 — stickiness. The draft matched a pre-existing patient by phone; the finalize resolves that
+                    // patient via existingResponse.enduserId (path 2), which is the OPEN path. It must stay blocked,
+                    // because the response was formed by a guess — that is what the sticky flag records.
+                    // ---------------------------------------------------------------------------------------------
+                    _h.sent();
+                    // ---------------------------------------------------------------------------------------------
+                    // R4 — an unresolvable ?enduserId= must NOT count as an explicit assertion. findById returns null,
+                    // the chain falls through to the $or guess, and the write must stay blocked. This pins that the
+                    // override keys off the RESOLVED record, not the mere presence of the query param. A cross-tenant
+                    // id takes the same route: DB is businessId-scoped, so findById returns null for it too.
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, runScenario('R4', 'unresolvable enduserId falls through to the guess', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var originalEmail, phone, victim, attackerEmail, data, enduser;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        originalEmail = emailFor('r4');
+                                        phone = nextPhone();
+                                        return [4 /*yield*/, makeVictim('r4', { email: originalEmail, phone: phone })];
+                                    case 1:
+                                        victim = _a.sent();
+                                        attackerEmail = emailFor('r4-attacker');
+                                        return [4 /*yield*/, postWebhook({
+                                                label: 'r4',
+                                                finalized: true,
+                                                enduserId: '0000000000000000000000ff',
+                                                answers: [{ key: 'phone', value: phone }, { key: 'email', value: attackerEmail }],
+                                            })];
+                                    case 2:
+                                        data = (_a.sent()).data;
+                                        if (!matched('R4', 'unresolvable enduserId falls through to the guess', data, victim.id))
+                                            return [2 /*return*/];
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.email === attackerEmail; })];
+                                    case 3:
+                                        enduser = _a.sent();
+                                        record('R4', 'unresolvable enduserId falls through to the guess', (enduser === null || enduser === void 0 ? void 0 : enduser.email) === originalEmail, "email=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.email) || '(unset)', " expected=").concat(originalEmail));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // R5 — victim shapes. A blank field is the LOAD-BEARING case: phone-only patients are common and
+                        // cheap to create, and filling their blank email is the takeover primitive. "Only if blank" is
+                        // therefore the wrong fix, and these two rows are what prove it.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 6:
+                    // ---------------------------------------------------------------------------------------------
+                    // R4 — an unresolvable ?enduserId= must NOT count as an explicit assertion. findById returns null,
+                    // the chain falls through to the $or guess, and the write must stay blocked. This pins that the
+                    // override keys off the RESOLVED record, not the mere presence of the query param. A cross-tenant
+                    // id takes the same route: DB is businessId-scoped, so findById returns null for it too.
+                    // ---------------------------------------------------------------------------------------------
+                    _h.sent();
+                    // ---------------------------------------------------------------------------------------------
+                    // R5 — victim shapes. A blank field is the LOAD-BEARING case: phone-only patients are common and
+                    // cheap to create, and filling their blank email is the takeover primitive. "Only if blank" is
+                    // therefore the wrong fix, and these two rows are what prove it.
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, runScenario('R5', 'blank email on a phone-only patient is not filled by a guess', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var phone, victim, attackerEmail, data, enduser;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        phone = nextPhone();
+                                        return [4 /*yield*/, makeVictim('r5a', { phone: phone, fname: 'Blank', lname: "Email".concat(RUN) })];
+                                    case 1:
+                                        victim = _a.sent();
+                                        attackerEmail = emailFor('r5a-attacker');
+                                        return [4 /*yield*/, postWebhook({
+                                                label: 'r5a',
+                                                finalized: true,
+                                                answers: [{ key: 'phone', value: phone }, { key: 'email', value: attackerEmail }],
+                                            })];
+                                    case 2:
+                                        data = (_a.sent()).data;
+                                        if (!matched('R5', 'blank email on a phone-only patient is not filled by a guess', data, victim.id))
+                                            return [2 /*return*/];
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.email === attackerEmail; })];
+                                    case 3:
+                                        enduser = _a.sent();
+                                        record('R5', 'blank email on a phone-only patient is not filled by a guess', !(enduser === null || enduser === void 0 ? void 0 : enduser.email), "email=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.email) || '(unset)', " expected=(unset)"));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })];
+                case 7:
+                    // ---------------------------------------------------------------------------------------------
+                    // R5 — victim shapes. A blank field is the LOAD-BEARING case: phone-only patients are common and
+                    // cheap to create, and filling their blank email is the takeover primitive. "Only if blank" is
+                    // therefore the wrong fix, and these two rows are what prove it.
+                    // ---------------------------------------------------------------------------------------------
+                    _h.sent();
+                    return [4 /*yield*/, runScenario('R5', 'blank phone on an email-only patient is not filled by a guess', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var email, victim, attackerPhone, data, enduser;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        email = emailFor('r5b');
+                                        return [4 /*yield*/, makeVictim('r5b', { email: email })];
+                                    case 1:
+                                        victim = _a.sent();
+                                        attackerPhone = nextPhone();
+                                        return [4 /*yield*/, postWebhook({
+                                                label: 'r5b',
+                                                finalized: true,
+                                                answers: [{ key: 'email', value: email }, { key: 'phone', value: attackerPhone }],
+                                            })];
+                                    case 2:
+                                        data = (_a.sent()).data;
+                                        if (!matched('R5', 'blank phone on an email-only patient is not filled by a guess', data, victim.id))
+                                            return [2 /*return*/];
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.phone === attackerPhone; })];
+                                    case 3:
+                                        enduser = _a.sent();
+                                        record('R5', 'blank phone on an email-only patient is not filled by a guess', !(enduser === null || enduser === void 0 ? void 0 : enduser.phone), "phone=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.phone) || '(unset)', " expected=(unset)"));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // G6 — the carve-out. The draft CREATED this patient (no prior record matched), so the response is
+                        // not flagged and the same person may still correct their email on a later page of the form.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 8:
+                    _h.sent();
+                    // ---------------------------------------------------------------------------------------------
+                    // G6 — the carve-out. The draft CREATED this patient (no prior record matched), so the response is
+                    // not flagged and the same person may still correct their email on a later page of the form.
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, runScenario('G6', 'patient created by this draft may still correct their email', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var firstEmail, correctedEmail, phone, data, enduser;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        firstEmail = emailFor('g6-typo');
+                                        correctedEmail = emailFor('g6-correct');
+                                        phone = nextPhone();
+                                        // in-progress webhook with a never-before-seen email: inserts a new patient, response unflagged
+                                        return [4 /*yield*/, postWebhook({
+                                                label: 'g6',
+                                                finalized: false,
+                                                answers: [{ key: 'email', value: firstEmail }, { key: 'phone', value: phone }],
+                                            })];
+                                    case 1:
+                                        // in-progress webhook with a never-before-seen email: inserts a new patient, response unflagged
+                                        _a.sent();
+                                        return [4 /*yield*/, postWebhook({
+                                                label: 'g6',
+                                                finalized: true,
+                                                answers: [{ key: 'email', value: correctedEmail }, { key: 'phone', value: phone }],
+                                            })];
+                                    case 2:
+                                        data = (_a.sent()).data;
+                                        if (!(data === null || data === void 0 ? void 0 : data.enduserId)) {
+                                            record('G6', 'patient created by this draft may still correct their email', false, 'probe invalid: webhook returned no enduserId');
+                                            return [2 /*return*/];
+                                        }
+                                        createdEnduserIds.push(data.enduserId);
+                                        return [4 /*yield*/, pollEnduser(data.enduserId, function (e) { return e.email === correctedEmail; })];
+                                    case 3:
+                                        enduser = _a.sent();
+                                        record('G6', 'patient created by this draft may still correct their email', (enduser === null || enduser === void 0 ? void 0 : enduser.email) === correctedEmail, "email=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.email) || '(unset)', " expected=").concat(correctedEmail));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // G7 — the backwards-compat escape hatch. An API-key-authenticated caller that names the patient
+                        // explicitly still writes email and phone. Pinned so a later tightening can't silently remove it.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 9:
+                    // ---------------------------------------------------------------------------------------------
+                    // G6 — the carve-out. The draft CREATED this patient (no prior record matched), so the response is
+                    // not flagged and the same person may still correct their email on a later page of the form.
+                    // ---------------------------------------------------------------------------------------------
+                    _h.sent();
+                    // ---------------------------------------------------------------------------------------------
+                    // G7 — the backwards-compat escape hatch. An API-key-authenticated caller that names the patient
+                    // explicitly still writes email and phone. Pinned so a later tightening can't silently remove it.
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, runScenario('G7', 'explicit enduserId still writes email and phone', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var victim, newEmail, newPhone, data, enduser;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0: return [4 /*yield*/, makeVictim('g7', { email: emailFor('g7'), phone: nextPhone() })];
+                                    case 1:
+                                        victim = _a.sent();
+                                        newEmail = emailFor('g7-new');
+                                        newPhone = nextPhone();
+                                        return [4 /*yield*/, postWebhook({
+                                                label: 'g7',
+                                                finalized: true,
+                                                enduserId: victim.id,
+                                                answers: [{ key: 'email', value: newEmail }, { key: 'phone', value: newPhone }],
+                                            })];
+                                    case 2:
+                                        data = (_a.sent()).data;
+                                        if (!matched('G7', 'explicit enduserId still writes email and phone', data, victim.id))
+                                            return [2 /*return*/];
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.email === newEmail && e.phone === newPhone; })];
+                                    case 3:
+                                        enduser = _a.sent();
+                                        record('G7', 'explicit enduserId still writes email', (enduser === null || enduser === void 0 ? void 0 : enduser.email) === newEmail, "email=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.email) || '(unset)', " expected=").concat(newEmail));
+                                        record('G7', 'explicit enduserId still writes phone', (enduser === null || enduser === void 0 ? void 0 : enduser.phone) === newPhone, "phone=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.phone) || '(unset)', " expected=").concat(newPhone));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // G8 — ?createNewEnduser=true inserts a BLANK record up front and then fills it via the update
+                        // branch, so email/phone must still land there.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 10:
+                    // ---------------------------------------------------------------------------------------------
+                    // G7 — the backwards-compat escape hatch. An API-key-authenticated caller that names the patient
+                    // explicitly still writes email and phone. Pinned so a later tightening can't silently remove it.
+                    // ---------------------------------------------------------------------------------------------
+                    _h.sent();
+                    // ---------------------------------------------------------------------------------------------
+                    // G8 — ?createNewEnduser=true inserts a BLANK record up front and then fills it via the update
+                    // branch, so email/phone must still land there.
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, runScenario('G8', 'createNewEnduser still writes email and phone', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var newEmail, newPhone, data, enduser;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        newEmail = emailFor('g8');
+                                        newPhone = nextPhone();
+                                        return [4 /*yield*/, postWebhook({
+                                                label: 'g8',
+                                                finalized: true,
+                                                createNewEnduser: true,
+                                                answers: [{ key: 'email', value: newEmail }, { key: 'phone', value: newPhone }],
+                                            })];
+                                    case 1:
+                                        data = (_a.sent()).data;
+                                        if (!(data === null || data === void 0 ? void 0 : data.enduserId)) {
+                                            record('G8', 'createNewEnduser still writes email and phone', false, 'probe invalid: webhook returned no enduserId');
+                                            return [2 /*return*/];
+                                        }
+                                        createdEnduserIds.push(data.enduserId);
+                                        return [4 /*yield*/, pollEnduser(data.enduserId, function (e) { return e.email === newEmail && e.phone === newPhone; })];
+                                    case 2:
+                                        enduser = _a.sent();
+                                        record('G8', 'createNewEnduser still writes email', (enduser === null || enduser === void 0 ? void 0 : enduser.email) === newEmail, "email=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.email) || '(unset)', " expected=").concat(newEmail));
+                                        record('G8', 'createNewEnduser still writes phone', (enduser === null || enduser === void 0 ? void 0 : enduser.phone) === newPhone, "phone=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.phone) || '(unset)', " expected=").concat(newPhone));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // G9 — brand-new patient, no prior record to match: the INSERT path keeps both fields.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 11:
+                    // ---------------------------------------------------------------------------------------------
+                    // G8 — ?createNewEnduser=true inserts a BLANK record up front and then fills it via the update
+                    // branch, so email/phone must still land there.
+                    // ---------------------------------------------------------------------------------------------
+                    _h.sent();
+                    // ---------------------------------------------------------------------------------------------
+                    // G9 — brand-new patient, no prior record to match: the INSERT path keeps both fields.
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, runScenario('G9', 'brand-new patient is inserted with email and phone', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var newEmail, newPhone, data, enduser;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        newEmail = emailFor('g9');
+                                        newPhone = nextPhone();
+                                        return [4 /*yield*/, postWebhook({
+                                                label: 'g9',
+                                                finalized: true,
+                                                answers: [{ key: 'email', value: newEmail }, { key: 'phone', value: newPhone }],
+                                            })];
+                                    case 1:
+                                        data = (_a.sent()).data;
+                                        if (!(data === null || data === void 0 ? void 0 : data.enduserId)) {
+                                            record('G9', 'brand-new patient is inserted with email and phone', false, 'probe invalid: webhook returned no enduserId');
+                                            return [2 /*return*/];
+                                        }
+                                        createdEnduserIds.push(data.enduserId);
+                                        return [4 /*yield*/, pollEnduser(data.enduserId, function (e) { return !!e.email && !!e.phone; })];
+                                    case 2:
+                                        enduser = _a.sent();
+                                        record('G9', 'brand-new patient is inserted with email', (enduser === null || enduser === void 0 ? void 0 : enduser.email) === newEmail, "email=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.email) || '(unset)', " expected=").concat(newEmail));
+                                        record('G9', 'brand-new patient is inserted with phone', (enduser === null || enduser === void 0 ? void 0 : enduser.phone) === newPhone, "phone=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.phone) || '(unset)', " expected=").concat(newPhone));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // G10 — the narrowing is email/phone ONLY. Everything else the webhook parses must still update
+                        // on a guessed match, otherwise this fix has quietly broken Formsort intake.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 12:
+                    // ---------------------------------------------------------------------------------------------
+                    // G9 — brand-new patient, no prior record to match: the INSERT path keeps both fields.
+                    // ---------------------------------------------------------------------------------------------
+                    _h.sent();
+                    // ---------------------------------------------------------------------------------------------
+                    // G10 — the narrowing is email/phone ONLY. Everything else the webhook parses must still update
+                    // on a guessed match, otherwise this fix has quietly broken Formsort intake.
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, runScenario('G10', 'non-auth fields still update on a guessed match', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var originalEmail, phone, victim, data, enduser;
+                            var _a, _b;
+                            return __generator(this, function (_c) {
+                                switch (_c.label) {
+                                    case 0:
+                                        originalEmail = emailFor('g10');
+                                        phone = nextPhone();
+                                        return [4 /*yield*/, makeVictim('g10', {
+                                                email: originalEmail,
+                                                phone: phone,
+                                                fname: 'Before', lname: 'Before',
+                                            })];
+                                    case 1:
+                                        victim = _c.sent();
+                                        return [4 /*yield*/, postWebhook({
+                                                label: 'g10',
+                                                finalized: true,
+                                                answers: [
+                                                    { key: 'phone', value: phone },
+                                                    { key: 'email', value: emailFor('g10-attacker') },
+                                                    { key: 'fname', value: 'After' },
+                                                    { key: 'lname', value: 'After' },
+                                                    { key: 'gender', value: 'Male' },
+                                                    { key: 'dateOfBirth', value: '1990-01-02' },
+                                                    { key: 'ts_enduser_lockprobe', value: "probe-".concat(RUN) },
+                                                ],
+                                            })];
+                                    case 2:
+                                        data = (_c.sent()).data;
+                                        if (!matched('G10', 'non-auth fields still update on a guessed match', data, victim.id))
+                                            return [2 /*return*/];
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.fname === 'After'; })];
+                                    case 3:
+                                        enduser = _c.sent();
+                                        record('G10', 'fname still updates', (enduser === null || enduser === void 0 ? void 0 : enduser.fname) === 'After', "fname=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.fname) || '(unset)', " expected=After"));
+                                        record('G10', 'lname still updates', (enduser === null || enduser === void 0 ? void 0 : enduser.lname) === 'After', "lname=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.lname) || '(unset)', " expected=After"));
+                                        record('G10', 'gender still updates', (enduser === null || enduser === void 0 ? void 0 : enduser.gender) === 'Male', "gender=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.gender) || '(unset)', " expected=Male"));
+                                        record('G10', 'dateOfBirth still updates', (enduser === null || enduser === void 0 ? void 0 : enduser.dateOfBirth) === '01-02-1990', "dateOfBirth=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.dateOfBirth) || '(unset)', " expected=01-02-1990"));
+                                        record('G10', 'custom fields still update', ((_a = enduser === null || enduser === void 0 ? void 0 : enduser.fields) === null || _a === void 0 ? void 0 : _a.lockprobe) === "probe-".concat(RUN), "fields.lockprobe=".concat(((_b = enduser === null || enduser === void 0 ? void 0 : enduser.fields) === null || _b === void 0 ? void 0 : _b.lockprobe) || '(unset)', " expected=probe-").concat(RUN));
+                                        record('G10', 'email still blocked while other fields update', (enduser === null || enduser === void 0 ? void 0 : enduser.email) === originalEmail, "email=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.email) || '(unset)', " expected=").concat(originalEmail));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // G11 — the explicit override is per-REQUEST, not a flag reset. A response formed by a guess keeps
+                        // authFieldIntakeDisabled set, so the OTHER consumer of that flag
+                        // (save_enduser_updates_for_form_response, reached by later staff edits) stays protected.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 13:
+                    // ---------------------------------------------------------------------------------------------
+                    // G10 — the narrowing is email/phone ONLY. Everything else the webhook parses must still update
+                    // on a guessed match, otherwise this fix has quietly broken Formsort intake.
+                    // ---------------------------------------------------------------------------------------------
+                    _h.sent();
+                    // ---------------------------------------------------------------------------------------------
+                    // G11 — the explicit override is per-REQUEST, not a flag reset. A response formed by a guess keeps
+                    // authFieldIntakeDisabled set, so the OTHER consumer of that flag
+                    // (save_enduser_updates_for_form_response, reached by later staff edits) stays protected.
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, runScenario('G11', 'explicit override does not clear the stored flag', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var phone, victim, newEmail, data, enduser, response;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        phone = nextPhone();
+                                        return [4 /*yield*/, makeVictim('g11', { email: emailFor('g11'), phone: phone })];
+                                    case 1:
+                                        victim = _a.sent();
+                                        newEmail = emailFor('g11-new');
+                                        // draft formed by a guess -> flagged
+                                        return [4 /*yield*/, postWebhook({ label: 'g11', finalized: false, answers: [{ key: 'phone', value: phone }] })];
+                                    case 2:
+                                        // draft formed by a guess -> flagged
+                                        _a.sent();
+                                        return [4 /*yield*/, postWebhook({
+                                                label: 'g11',
+                                                finalized: true,
+                                                enduserId: victim.id,
+                                                answers: [{ key: 'phone', value: phone }, { key: 'email', value: newEmail }],
+                                            })];
+                                    case 3:
+                                        data = (_a.sent()).data;
+                                        if (!matched('G11', 'explicit override does not clear the stored flag', data, victim.id))
+                                            return [2 /*return*/];
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.email === newEmail; })];
+                                    case 4:
+                                        enduser = _a.sent();
+                                        record('G11', 'explicit override writes email even on a flagged response', (enduser === null || enduser === void 0 ? void 0 : enduser.email) === newEmail, "email=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.email) || '(unset)', " expected=").concat(newEmail));
+                                        if (!data.formResponseId) {
+                                            skip('G11', 'stored flag survives the override', 'webhook returned no formResponseId');
+                                            return [2 /*return*/];
+                                        }
+                                        return [4 /*yield*/, sdk.api.form_responses.getOne(data.formResponseId).catch(function () { return null; })];
+                                    case 5:
+                                        response = _a.sent();
+                                        if (!response) {
+                                            skip('G11', 'stored flag survives the override', 'form response not readable');
+                                        }
+                                        else if (response.authFieldIntakeDisabled === undefined) {
+                                            // The field is deliberately absent from schema.ts; if reads project it away there is nothing
+                                            // to assert here, and the enforcement is already covered by the scenarios above.
+                                            skip('G11', 'stored flag survives the override', 'authFieldIntakeDisabled not exposed on read');
+                                        }
+                                        else {
+                                            record('G11', 'stored flag survives the override', response.authFieldIntakeDisabled === true, "authFieldIntakeDisabled=".concat(response.authFieldIntakeDisabled, " expected=true"));
+                                        }
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // G12 — the Stripe grace. A contact the Stripe integration created minutes ago carries payment data
+                        // only (email + name + stripeCustomerId, never a phone), so intake is the first place a phone number
+                        // exists at all. enduser_is_provisional_stripe_record re-opens BLANK email/phone for one hour after
+                        // that insert; see api/integrations/payments/stripe_provisional_enduser.ts.
+                        //
+                        // The Stripe webhook cannot be driven locally (it needs a signature and an integration record), but
+                        // nothing about the grace depends on Stripe having done the insert: source and stripeCustomerId are
+                        // both enduserUpdatesDisabled, so an admin can create the same shape and drive the real webhook
+                        // against it. A fixture created here always has a fresh ObjectId, so this exercises the in-window
+                        // branch; the expired branch is pinned by the unit tests in
+                        // api/integrations/payments/stripe_provisional_enduser.test.ts.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 14:
+                    // ---------------------------------------------------------------------------------------------
+                    // G11 — the explicit override is per-REQUEST, not a flag reset. A response formed by a guess keeps
+                    // authFieldIntakeDisabled set, so the OTHER consumer of that flag
+                    // (save_enduser_updates_for_form_response, reached by later staff edits) stays protected.
+                    // ---------------------------------------------------------------------------------------------
+                    _h.sent();
+                    stripeVictim = function (label, fields) { return makeVictim(label, __assign({ source: 'Stripe', stripeCustomerId: "cus_".concat(RUN).concat(label) }, fields)); };
+                    return [4 /*yield*/, runScenario('G12', 'blank phone on a fresh Stripe contact is filled from intake', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var email, victim, intakePhone, data, enduser;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        email = emailFor('g12');
+                                        return [4 /*yield*/, stripeVictim('g12', { email: email, fname: 'Stripe', lname: "Payer".concat(RUN) })];
+                                    case 1:
+                                        victim = _a.sent();
+                                        intakePhone = nextPhone();
+                                        return [4 /*yield*/, postWebhook({
+                                                label: 'g12',
+                                                finalized: true,
+                                                answers: [
+                                                    { key: 'email', value: email },
+                                                    { key: 'phone', value: intakePhone },
+                                                    { key: 'dateOfBirth', value: '1990-01-02' },
+                                                    { key: 'ts_enduser_stripeprobe', value: "probe-".concat(RUN) },
+                                                ],
+                                            })];
+                                    case 2:
+                                        data = (_a.sent()).data;
+                                        if (!matched('G12', 'blank phone on a fresh Stripe contact is filled from intake', data, victim.id))
+                                            return [2 /*return*/];
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.phone === intakePhone; })];
+                                    case 3:
+                                        enduser = _a.sent();
+                                        record('G12', 'blank phone on a fresh Stripe contact is filled from intake', (enduser === null || enduser === void 0 ? void 0 : enduser.phone) === intakePhone, "phone=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.phone) || '(unset)', " expected=").concat(intakePhone));
+                                        // the grace must not disturb the ordinary update path around it
+                                        record('G12', 'non-auth fields still land alongside the graced phone', (enduser === null || enduser === void 0 ? void 0 : enduser.dateOfBirth) === '01-02-1990', "dateOfBirth=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.dateOfBirth) || '(unset)', " expected=01-02-1990"));
+                                        record('G12', 'email is unchanged by the grace', (enduser === null || enduser === void 0 ? void 0 : enduser.email) === email, "email=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.email) || '(unset)', " expected=").concat(email));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // R12 / R13 — the grace is strictly BLANK-FILL. Repointing a stored email or phone is the takeover
+                        // primitive this lock exists to stop, and being minutes old does not make it safe.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 15:
+                    _h.sent();
+                    // ---------------------------------------------------------------------------------------------
+                    // R12 / R13 — the grace is strictly BLANK-FILL. Repointing a stored email or phone is the takeover
+                    // primitive this lock exists to stop, and being minutes old does not make it safe.
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, runScenario('R12', 'grace does not overwrite a phone already on a Stripe contact', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var email, originalPhone, victim, attackerPhone, data, enduser;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        email = emailFor('r12');
+                                        originalPhone = nextPhone();
+                                        return [4 /*yield*/, stripeVictim('r12', { email: email, phone: originalPhone })];
+                                    case 1:
+                                        victim = _a.sent();
+                                        attackerPhone = nextPhone();
+                                        return [4 /*yield*/, postWebhook({
+                                                label: 'r12',
+                                                finalized: true,
+                                                answers: [{ key: 'email', value: email }, { key: 'phone', value: attackerPhone }],
+                                            })];
+                                    case 2:
+                                        data = (_a.sent()).data;
+                                        if (!matched('R12', 'grace does not overwrite a phone already on a Stripe contact', data, victim.id))
+                                            return [2 /*return*/];
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.phone === attackerPhone; })];
+                                    case 3:
+                                        enduser = _a.sent();
+                                        record('R12', 'grace does not overwrite a phone already on a Stripe contact', (enduser === null || enduser === void 0 ? void 0 : enduser.phone) === originalPhone, "phone=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.phone) || '(unset)', " expected=").concat(originalPhone));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })];
+                case 16:
+                    // ---------------------------------------------------------------------------------------------
+                    // R12 / R13 — the grace is strictly BLANK-FILL. Repointing a stored email or phone is the takeover
+                    // primitive this lock exists to stop, and being minutes old does not make it safe.
+                    // ---------------------------------------------------------------------------------------------
+                    _h.sent();
+                    return [4 /*yield*/, runScenario('R13', 'grace does not repoint the email of a Stripe contact', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var originalEmail, phone, victim, attackerEmail, data, enduser;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        originalEmail = emailFor('r13');
+                                        phone = nextPhone();
+                                        return [4 /*yield*/, stripeVictim('r13', { email: originalEmail, phone: phone })];
+                                    case 1:
+                                        victim = _a.sent();
+                                        attackerEmail = emailFor('r13-attacker');
+                                        return [4 /*yield*/, postWebhook({
+                                                label: 'r13',
+                                                finalized: true,
+                                                answers: [{ key: 'phone', value: phone }, { key: 'email', value: attackerEmail }],
+                                            })];
+                                    case 2:
+                                        data = (_a.sent()).data;
+                                        if (!matched('R13', 'grace does not repoint the email of a Stripe contact', data, victim.id))
+                                            return [2 /*return*/];
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.email === attackerEmail; })];
+                                    case 3:
+                                        enduser = _a.sent();
+                                        record('R13', 'grace does not repoint the email of a Stripe contact', (enduser === null || enduser === void 0 ? void 0 : enduser.email) === originalEmail, "email=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.email) || '(unset)', " expected=").concat(originalEmail));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // R14 — BOTH markers are load-bearing. `source` is set by every other integration and by staff, and
+                        // `stripeCustomerId` can be attached to a contact this integration never created, so neither alone
+                        // may open the grace.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 17:
+                    _h.sent();
+                    // ---------------------------------------------------------------------------------------------
+                    // R14 — BOTH markers are load-bearing. `source` is set by every other integration and by staff, and
+                    // `stripeCustomerId` can be attached to a contact this integration never created, so neither alone
+                    // may open the grace.
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, runScenario('R14', 'stripeCustomerId without a Stripe source does not open the grace', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var email, victim, attackerPhone, data, enduser;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        email = emailFor('r14a');
+                                        return [4 /*yield*/, makeVictim('r14a', { email: email, source: 'Elation', stripeCustomerId: "cus_".concat(RUN, "r14a") })];
+                                    case 1:
+                                        victim = _a.sent();
+                                        attackerPhone = nextPhone();
+                                        return [4 /*yield*/, postWebhook({
+                                                label: 'r14a',
+                                                finalized: true,
+                                                answers: [{ key: 'email', value: email }, { key: 'phone', value: attackerPhone }],
+                                            })];
+                                    case 2:
+                                        data = (_a.sent()).data;
+                                        if (!matched('R14', 'stripeCustomerId without a Stripe source does not open the grace', data, victim.id))
+                                            return [2 /*return*/];
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.phone === attackerPhone; })];
+                                    case 3:
+                                        enduser = _a.sent();
+                                        record('R14', 'stripeCustomerId without a Stripe source does not open the grace', !(enduser === null || enduser === void 0 ? void 0 : enduser.phone), "phone=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.phone) || '(unset)', " expected=(unset)"));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })];
+                case 18:
+                    // ---------------------------------------------------------------------------------------------
+                    // R14 — BOTH markers are load-bearing. `source` is set by every other integration and by staff, and
+                    // `stripeCustomerId` can be attached to a contact this integration never created, so neither alone
+                    // may open the grace.
+                    // ---------------------------------------------------------------------------------------------
+                    _h.sent();
+                    return [4 /*yield*/, runScenario('R14', 'Stripe source without a stripeCustomerId does not open the grace', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var email, victim, attackerPhone, data, enduser;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        email = emailFor('r14b');
+                                        return [4 /*yield*/, makeVictim('r14b', { email: email, source: 'Stripe' })];
+                                    case 1:
+                                        victim = _a.sent();
+                                        attackerPhone = nextPhone();
+                                        return [4 /*yield*/, postWebhook({
+                                                label: 'r14b',
+                                                finalized: true,
+                                                answers: [{ key: 'email', value: email }, { key: 'phone', value: attackerPhone }],
+                                            })];
+                                    case 2:
+                                        data = (_a.sent()).data;
+                                        if (!matched('R14', 'Stripe source without a stripeCustomerId does not open the grace', data, victim.id))
+                                            return [2 /*return*/];
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.phone === attackerPhone; })];
+                                    case 3:
+                                        enduser = _a.sent();
+                                        record('R14', 'Stripe source without a stripeCustomerId does not open the grace', !(enduser === null || enduser === void 0 ? void 0 : enduser.phone), "phone=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.phone) || '(unset)', " expected=(unset)"));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // R15 — the grace is a per-REQUEST override, exactly like the explicit ?enduserId= hatch in G11: the
+                        // response still records that it attached to a pre-existing contact, so the other consumer of that
+                        // flag (save_enduser_updates_for_form_response, reached by later staff edits and by submissions
+                        // after the window closes) stays protected.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 19:
+                    _h.sent();
+                    // ---------------------------------------------------------------------------------------------
+                    // R15 — the grace is a per-REQUEST override, exactly like the explicit ?enduserId= hatch in G11: the
+                    // response still records that it attached to a pre-existing contact, so the other consumer of that
+                    // flag (save_enduser_updates_for_form_response, reached by later staff edits and by submissions
+                    // after the window closes) stays protected.
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, runScenario('R15', 'grace does not clear the stored flag', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var email, victim, intakePhone, data, enduser, response;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        email = emailFor('r15');
+                                        return [4 /*yield*/, stripeVictim('r15', { email: email })];
+                                    case 1:
+                                        victim = _a.sent();
+                                        intakePhone = nextPhone();
+                                        return [4 /*yield*/, postWebhook({
+                                                label: 'r15',
+                                                finalized: true,
+                                                answers: [{ key: 'email', value: email }, { key: 'phone', value: intakePhone }],
+                                            })];
+                                    case 2:
+                                        data = (_a.sent()).data;
+                                        if (!matched('R15', 'grace does not clear the stored flag', data, victim.id))
+                                            return [2 /*return*/];
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.phone === intakePhone; })];
+                                    case 3:
+                                        enduser = _a.sent();
+                                        record('R15', 'grace landed the phone (probe precondition)', (enduser === null || enduser === void 0 ? void 0 : enduser.phone) === intakePhone, "phone=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.phone) || '(unset)', " expected=").concat(intakePhone));
+                                        if (!data.formResponseId) {
+                                            skip('R15', 'grace does not clear the stored flag', 'webhook returned no formResponseId');
+                                            return [2 /*return*/];
+                                        }
+                                        return [4 /*yield*/, sdk.api.form_responses.getOne(data.formResponseId).catch(function () { return null; })];
+                                    case 4:
+                                        response = _a.sent();
+                                        if (!response) {
+                                            skip('R15', 'grace does not clear the stored flag', 'form response not readable');
+                                        }
+                                        else if (response.authFieldIntakeDisabled === undefined) {
+                                            // deliberately absent from schema.ts; if reads project it away there is nothing to assert here
+                                            skip('R15', 'grace does not clear the stored flag', 'authFieldIntakeDisabled not exposed on read');
+                                        }
+                                        else {
+                                            record('R15', 'grace does not clear the stored flag', response.authFieldIntakeDisabled === true, "authFieldIntakeDisabled=".concat(response.authFieldIntakeDisabled, " expected=true"));
+                                        }
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // Report
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 20:
+                    // ---------------------------------------------------------------------------------------------
+                    // R15 — the grace is a per-REQUEST override, exactly like the explicit ?enduserId= hatch in G11: the
+                    // response still records that it attached to a pre-existing contact, so the other consumer of that
+                    // flag (save_enduser_updates_for_form_response, reached by later staff edits and by submissions
+                    // after the window closes) stays protected.
+                    // ---------------------------------------------------------------------------------------------
+                    _h.sent();
+                    failures = results.filter(function (r) { return !r.ok; });
+                    skipped = results.filter(function (r) { return !!r.skipped; });
+                    console.log('');
+                    console.log('   ┌─ Formsort webhook auth-field lock — summary ───────────────────────────');
+                    for (_i = 0, results_1 = results; _i < results_1.length; _i++) {
+                        r = results_1[_i];
+                        status_1 = r.skipped ? 'SKIP' : r.ok ? 'PASS' : 'FAIL';
+                        console.log("   \u2502 ".concat(status_1, "  ").concat(r.group.padEnd(3), "  ").concat(r.name).concat(r.detail ? "  \u2014  ".concat(r.detail) : ''));
+                    }
+                    console.log("   \u2514\u2500 ".concat(results.length - failures.length, "/").concat(results.length, " passed, ").concat(skipped.length, " skipped, ").concat(failures.length, " failed"));
+                    console.log('');
+                    _b = 0, createdFormIds_1 = createdFormIds;
+                    _h.label = 21;
+                case 21:
+                    if (!(_b < createdFormIds_1.length)) return [3 /*break*/, 27];
+                    formId = createdFormIds_1[_b];
+                    return [4 /*yield*/, sdk.api.form_responses.getSome({ filter: { formId: formId } }).catch(function () { return []; })];
+                case 22:
+                    responses = _h.sent();
+                    _c = 0, responses_1 = responses;
+                    _h.label = 23;
+                case 23:
+                    if (!(_c < responses_1.length)) return [3 /*break*/, 26];
+                    response = responses_1[_c];
+                    return [4 /*yield*/, sdk.api.form_responses.deleteOne(response.id).catch(function () { return null; })];
+                case 24:
+                    _h.sent();
+                    _h.label = 25;
+                case 25:
+                    _c++;
+                    return [3 /*break*/, 23];
+                case 26:
+                    _b++;
+                    return [3 /*break*/, 21];
+                case 27:
+                    _d = 0, createdFormIds_2 = createdFormIds;
+                    _h.label = 28;
+                case 28:
+                    if (!(_d < createdFormIds_2.length)) return [3 /*break*/, 31];
+                    id = createdFormIds_2[_d];
+                    return [4 /*yield*/, sdk.api.forms.deleteOne(id).catch(function () { return null; })];
+                case 29:
+                    _h.sent();
+                    _h.label = 30;
+                case 30:
+                    _d++;
+                    return [3 /*break*/, 28];
+                case 31:
+                    uniqueEnduserIds = createdEnduserIds.filter(function (id, i) { return !!id && createdEnduserIds.indexOf(id) === i; });
+                    _e = 0, uniqueEnduserIds_1 = uniqueEnduserIds;
+                    _h.label = 32;
+                case 32:
+                    if (!(_e < uniqueEnduserIds_1.length)) return [3 /*break*/, 35];
+                    id = uniqueEnduserIds_1[_e];
+                    return [4 /*yield*/, sdk.api.endusers.deleteOne(id).catch(function () { return null; })];
+                case 33:
+                    _h.sent();
+                    _h.label = 34;
+                case 34:
+                    _e++;
+                    return [3 /*break*/, 32];
+                case 35:
+                    _f = 0, createdApiKeyIds_1 = createdApiKeyIds;
+                    _h.label = 36;
+                case 36:
+                    if (!(_f < createdApiKeyIds_1.length)) return [3 /*break*/, 39];
+                    id = createdApiKeyIds_1[_f];
+                    return [4 /*yield*/, sdk.api.api_keys.deleteOne(id).catch(function () { return null; })];
+                case 37:
+                    _h.sent();
+                    _h.label = 38;
+                case 38:
+                    _f++;
+                    return [3 /*break*/, 36];
+                case 39:
+                    // ---------------------------------------------------------------------------------------------
+                    // Assert — single pass, last, so the full table above is always printed first.
+                    // ---------------------------------------------------------------------------------------------
+                    for (_g = 0, results_2 = results; _g < results_2.length; _g++) {
+                        r = results_2[_g];
+                        assert(r.ok, "[".concat(r.group, "] ").concat(r.name, " \u2014 ").concat(r.detail), "[".concat(r.group, "] ").concat(r.name));
+                    }
+                    return [2 /*return*/];
+            }
+        });
+    });
+};
+// Allow running this test file independently
+if (require.main === module) {
+    console.log("\uD83C\uDF10 Using API URL: ".concat(host));
+    var sdk_1 = new Session({ host: host });
+    var sdkNonAdmin_1 = new Session({ host: host });
+    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, setup_tests(sdk_1, sdkNonAdmin_1)];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, formsort_webhook_auth_field_lock_tests({ sdk: sdk_1, sdkNonAdmin: sdkNonAdmin_1 })];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); };
+    runTests()
+        .then(function () {
+        console.log("✅ Formsort webhook auth field lock tests completed successfully");
+        process.exit(0);
+    })
+        .catch(function (error) {
+        console.error("❌ Formsort webhook auth field lock tests failed:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=formsort_webhook_auth_field_lock.test.js.map