@tellescope/sdk 1.255.18 → 1.256.0

package/src/sdk.ts

@@ -716,6 +716,9 @@ type Queries = { [K in keyof ClientModelForName]: APIQuery<K> } & {
     remove_conference_attendees: (args: extractFields<CustomActions['phone_calls']['remove_conference_attendees']['parameters']>) => (
       Promise<extractFields<CustomActions['phone_calls']['remove_conference_attendees']['returns']>>
     ),
+    modify_conference_attendee_status: (args: extractFields<CustomActions['phone_calls']['modify_conference_attendee_status']['parameters']>) => (
+      Promise<extractFields<CustomActions['phone_calls']['modify_conference_attendee_status']['returns']>>
+    ),
     end_conference: (args: extractFields<CustomActions['phone_calls']['end_conference']['parameters']>) => (
       Promise<extractFields<CustomActions['phone_calls']['end_conference']['returns']>>
     ),
@@ -1163,6 +1166,7 @@ export class Session extends SessionManager {
     queries.phone_calls.cold_transfer = a => this._POST(`/v1${schema.phone_calls.customActions.cold_transfer.path}`, a)
     queries.phone_calls.add_conference_attendees = a => this._POST(`/v1${schema.phone_calls.customActions.add_conference_attendees.path}`, a)
     queries.phone_calls.remove_conference_attendees = a => this._POST(`/v1${schema.phone_calls.customActions.remove_conference_attendees.path}`, a)
+    queries.phone_calls.modify_conference_attendee_status = a => this._POST(`/v1${schema.phone_calls.customActions.modify_conference_attendee_status.path}`, a)
     queries.phone_calls.end_conference = a => this._POST(`/v1${schema.phone_calls.customActions.end_conference.path}`, a)
     queries.phone_calls.cancel_recording = a => this._POST(`/v1${schema.phone_calls.customActions.cancel_recording.path}`, a)
     queries.phone_calls.delete_recordings = a => this._POST(`/v1${schema.phone_calls.customActions.delete_recordings.path}`, a)

package/src/tests/api_tests/auto_merge_form_submission.test.ts

@@ -547,9 +547,9 @@ export const auto_merge_form_submission_tests = async ({ sdk, sdkNonAdmin }: { s
     { expectedResult: true }
   )
 
-  // Test 12: Intake fields update destination enduser directly
+  // Test 12: Intake fields update destination enduser directly — except the authentication channels
   await async_test(
-    "Auto-merge: Intake fields update destination enduser directly",
+    "Auto-merge: Intake fields update destination enduser directly (email/phone locked)",
     async () => {
       const testEmail = `automerge.intake.${Date.now()}@test.com`
       const destination = await sdk.api.endusers.createOne({
@@ -579,10 +579,19 @@ export const auto_merge_form_submission_tests = async ({ sdk, sdkNonAdmin }: { s
       await sdk.api.forms.deleteOne(form.id)
       await sdk.api.endusers.deleteOne(destination.id)
 
-      // Intake fields should have been applied to the destination enduser
+      // Non-auth intake fields are still applied to the destination — dateOfBirth landing here is
+      // also what proves the intake write ran at all, so the negative assertions below aren't vacuous.
       return sourceDeleted
-        && updatedDestination.phone === newPhone
         && updatedDestination.dateOfBirth === newDOB
+        // ...but email and phone are NOT applied. The merge attaches this response to a contact that
+        // existed before the submission, which sets FormResponse.authFieldIntakeDisabled, and these two
+        // are authentication channels (password reset resolves by email; OTPs are delivered to phone).
+        // Filling a BLANK phone is deliberately blocked too — contact-less patients are the primary
+        // takeover target, so "fill only if empty" would not close the hole. Staff update these fields.
+        // Previously this test asserted `phone === newPhone`; that behaviour was the vulnerability.
+        // See api_tests/security/public_endpoint_auth_field_lock.test.ts (G26).
+        && !updatedDestination.phone
+        && updatedDestination.email === testEmail
     },
     { expectedResult: true }
   )

package/src/tests/api_tests/custom_dashboards.test.ts

@@ -408,8 +408,100 @@ export const custom_dashboards_tests = async ({ sdk, sdkNonAdmin }: { sdk: Sessi
     { shouldError: true, onError: () => true }
   )
 
+  // Test 10: Dashboard mutations stream through /v1/data-sync
+  const syncFrom = new Date()
+  const dashboard_sync_records = (results: { modelName: string, recordId: string, data: string }[], recordId: string) => (
+    results.filter(r => r.modelName === 'custom_dashboards' && r.recordId === recordId)
+  )
+
+  const syncedDashboard = await sdk.api.custom_dashboards.createOne({
+    title: "Sync Create Dashboard",
+    blocks: [{ type: "Inbox", colSpan: 12 }],
+  })
+  await wait(undefined, 100) // sync_record is not awaited by the mutation handler
+
+  await async_test(
+    "Dashboard create streams to sync, admin",
+    () => sdk.sync({ from: syncFrom }),
+    {
+      onResult: ({ results }) => {
+        const records = dashboard_sync_records(results, syncedDashboard.id)
+        return (
+          records.length === 1
+          && records[0].data !== 'deleted'
+          && JSON.parse(records[0].data).title === "Sync Create Dashboard"
+        )
+      }
+    }
+  )
+
+  await sdk.api.custom_dashboards.updateOne(syncedDashboard.id, { title: "Sync Update Dashboard" })
+  await wait(undefined, 100)
+
+  await async_test(
+    "Dashboard update streams to sync, admin",
+    () => sdk.sync({ from: syncFrom }),
+    {
+      onResult: ({ results }) => {
+        const records = dashboard_sync_records(results, syncedDashboard.id)
+        return (
+          records.length === 1
+          && records[0].data !== 'deleted'
+          && JSON.parse(records[0].data).title === "Sync Update Dashboard"
+        )
+      }
+    }
+  )
+
+  await sdk.api.custom_dashboards.deleteOne(syncedDashboard.id)
+  await wait(undefined, 100)
+
+  await async_test(
+    "Dashboard delete streams to sync, admin",
+    () => sdk.sync({ from: syncFrom }),
+    {
+      onResult: ({ results }) => {
+        const records = dashboard_sync_records(results, syncedDashboard.id)
+        return records.length === 1 && records[0].data === 'deleted'
+      }
+    }
+  )
+
+  // Restricted user (read: Default) only receives org-wide and assigned dashboards
+  const restrictedSyncFrom = new Date()
+
+  // re-save each fixture so it lands in the restricted user's sync window
+  await Promise.all([
+    sdk.api.custom_dashboards.updateOne(orgWideDashboard.id, { description: "org-wide sync" }),
+    sdk.api.custom_dashboards.updateOne(assignedDashboard.id, { description: "assigned sync" }),
+    sdk.api.custom_dashboards.updateOne(hiddenDashboard.id, { description: "hidden sync" }),
+    sdk.api.custom_dashboards.updateOne(explicitFalseDashboard.id, { description: "explicit false sync" }),
+  ])
+  await wait(undefined, 100)
+
+  await async_test(
+    "Restricted user syncs org-wide and assigned dashboards only",
+    () => sdkRestricted.sync({ from: restrictedSyncFrom }),
+    {
+      onResult: ({ results }) => (
+        dashboard_sync_records(results, orgWideDashboard.id).length === 1
+        && dashboard_sync_records(results, assignedDashboard.id).length === 1
+        && dashboard_sync_records(results, hiddenDashboard.id).length === 0
+        && dashboard_sync_records(results, explicitFalseDashboard.id).length === 0
+      )
+    }
+  )
+
   // Toggling the flag on takes effect for the restricted user
+  const toggleSyncFrom = new Date()
   await sdk.api.custom_dashboards.updateOne(hiddenDashboard.id, { visibleToAllUsers: true })
+  await wait(undefined, 100)
+
+  await async_test(
+    "Restricted user syncs dashboard after visibleToAllUsers enabled",
+    () => sdkRestricted.sync({ from: toggleSyncFrom }),
+    { onResult: ({ results }) => dashboard_sync_records(results, hiddenDashboard.id).length === 1 }
+  )
 
   await async_test(
     "Restricted user can read dashboard after visibleToAllUsers enabled",

package/src/tests/api_tests/file_download_unicode_names.test.ts

@@ -0,0 +1,223 @@
+require('source-map-support').install();
+
+import axios from "axios"
+import * as buffer from 'buffer'
+import { Session } from "../../sdk"
+import {
+  assert,
+  log_header,
+} from "@tellescope/testing"
+import { setup_tests } from "../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+/**
+ * A presigned download URL signs response-content-disposition, which S3 validates: it rejects any
+ * value containing a character above U+00FF with 400 InvalidArgument "Header value cannot be
+ * represented using ISO-8859-1", and one with unbalanced quoting with "open quoted span". Because
+ * the parameter is part of the signature it cannot be repaired after the fact, so before the fix a
+ * file named with an em dash or a decomposed accent got a 200 from our API and a permanent 400 from
+ * S3 on every fetch.
+ *
+ * This test is the end-to-end check: it uploads files with those names and actually fetches the
+ * returned URL, which is the only thing that exercises S3's validation.
+ */
+
+// Built from code points rather than written out, so that this file stays pure ASCII and so that a
+// combining accent (which renders as a mark on the preceding character) is unambiguous in source.
+const c = (n: number) => String.fromCharCode(n)
+const EM_DASH         = c(0x2014)
+const EN_DASH         = c(0x2013)
+const RIGHT_SINGLE_Q  = c(0x2019)
+const COMBINING_ACUTE = c(0x0301)
+const CJK_BAO_GAO     = c(0x62a5) + c(0x544a)
+
+const IS_ASCII_ONLY = /^[\x20-\x7e]*$/
+
+// The first three are the real filenames from the bug report.
+const TEST_NAMES: { name: string, label: string, expectExtValue: boolean }[] = [
+  {
+    name: `First Aid Classes Information${EM_DASH}NWLI.pdf`,
+    label: 'em dash (U+2014)',
+    expectExtValue: true,
+  },
+  {
+    name: `CHA${RIGHT_SINGLE_Q}s Waitlist Portal ${EN_DASH} Apply.pdf`,
+    label: 'right single quote (U+2019) and en dash (U+2013)',
+    expectExtValue: true,
+  },
+  {
+    name: `Ren${'e' + COMBINING_ACUTE} Test  .pdf`,
+    label: 'decomposed accent (e + U+0301)',
+    expectExtValue: true,
+  },
+  {
+    name: `He said "hi".pdf`,
+    label: 'a double quote, which S3 rejects as an open quoted span',
+    expectExtValue: true,
+  },
+  {
+    name: `${CJK_BAO_GAO}.pdf`,
+    label: 'an entirely non-ASCII name, so the fallback cannot come from the name',
+    expectExtValue: true,
+  },
+  {
+    name: `plain ascii control.pdf`,
+    label: 'control: a plain ASCII name that always worked',
+    expectExtValue: true, // the space means filename* is emitted, carrying the real spaces
+  },
+]
+
+export const file_download_unicode_names_tests = async ({ sdk }: { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("File Download URL with Unicode Filenames")
+
+  const fileIds: string[] = []
+
+  const uploadFile = async (name: string) => {
+    const buff = buffer.Buffer.from(`test file content for ${JSON.stringify(name)}`)
+    const { presignedUpload, file } = await sdk.api.files.prepare_file_upload({
+      name,
+      type: 'application/pdf',
+      size: buff.byteLength,
+    })
+    await sdk.UPLOAD(presignedUpload as any, buff)
+    await sdk.api.files.confirm_file_upload({ id: file.id })
+    fileIds.push(file.id)
+    return { file, contents: buff }
+  }
+
+  // validateStatus so that a failure reports S3's actual status and XML <Message>, rather than an
+  // opaque axios throw. That is what makes this test diagnostic instead of merely red.
+  const fetchURL = (url: string) => axios.get(url, {
+    responseType: 'arraybuffer',
+    validateStatus: () => true,
+  })
+
+  try {
+    for (const { name, label, expectExtValue } of TEST_NAMES) {
+      const { file, contents } = await uploadFile(name)
+
+      const { downloadURL, name: returnedName } = await sdk.api.files.file_download_URL({
+        secureName: file.secureName,
+      })
+
+      assert(
+        returnedName === name,
+        `endpoint returned "${returnedName}" instead of the stored name for ${label}`,
+        `stored name round-trips for ${label}`,
+      )
+
+      const response = await fetchURL(downloadURL)
+
+      // the bug: our API returned 200, S3 returned 400 on every fetch of the URL it gave us
+      assert(
+        response.status === 200,
+        `S3 returned ${response.status} for ${label}: ${buffer.Buffer.from(response.data ?? '').toString().slice(0, 400)}`,
+        `S3 returns 200 for ${label}`,
+      )
+
+      assert(
+        buffer.Buffer.from(response.data).toString() === contents.toString(),
+        `downloaded bytes did not match for ${label}`,
+        `downloaded bytes match for ${label}`,
+      )
+
+      const disposition = (response.headers['content-disposition'] ?? '') as string
+
+      assert(
+        IS_ASCII_ONLY.test(disposition),
+        `Content-Disposition was not ASCII-only for ${label}: ${disposition}`,
+        `Content-Disposition is ASCII-only for ${label}`,
+      )
+      assert(
+        disposition.startsWith('attachment;'),
+        `expected an attachment disposition for ${label}, got: ${disposition}`,
+        `disposition is attachment for ${label}`,
+      )
+      assert(
+        expectExtValue === disposition.includes(`filename*=UTF-8''`),
+        `filename* presence was wrong for ${label}: ${disposition}`,
+        `filename* ${expectExtValue ? 'present' : 'absent'} for ${label}`,
+      )
+    }
+
+    /* ---------------------------------------------------------------- *
+     * The download URL is cached server-side. preferInBrowser changes
+     * whether a Content-Disposition is signed into the URL at all, so it
+     * has to be part of the cache key - otherwise whichever variant is
+     * requested first is served to everyone for ~99 minutes.
+     * ---------------------------------------------------------------- */
+    const { file: cacheFile, contents: cacheContents } = await uploadFile(
+      `Cache Test${EM_DASH}Both Variants.pdf`
+    )
+
+    const asAttachment = await sdk.api.files.file_download_URL({ secureName: cacheFile.secureName })
+    const inBrowser = await sdk.api.files.file_download_URL({
+      secureName: cacheFile.secureName,
+      preferInBrowser: true,
+    })
+
+    assert(
+      asAttachment.downloadURL !== inBrowser.downloadURL,
+      'preferInBrowser returned the cached attachment URL, so the cache key ignores it',
+      'preferInBrowser is cached separately from the attachment URL',
+    )
+    assert(
+      asAttachment.downloadURL.includes('response-content-disposition'),
+      'the default URL was signed without a content disposition',
+      'the default URL signs a content disposition',
+    )
+    assert(
+      !inBrowser.downloadURL.includes('response-content-disposition'),
+      'the preferInBrowser URL was signed with a content disposition',
+      'the preferInBrowser URL omits the content disposition',
+    )
+
+    for (const [variant, { downloadURL }] of [['attachment', asAttachment], ['inBrowser', inBrowser]] as const) {
+      const response = await fetchURL(downloadURL)
+      assert(
+        response.status === 200,
+        `S3 returned ${response.status} for the ${variant} URL: ${buffer.Buffer.from(response.data ?? '').toString().slice(0, 400)}`,
+        `S3 returns 200 for the ${variant} URL`,
+      )
+      assert(
+        buffer.Buffer.from(response.data).toString() === cacheContents.toString(),
+        `downloaded bytes did not match for the ${variant} URL`,
+        `downloaded bytes match for the ${variant} URL`,
+      )
+    }
+
+    // a repeat request with identical arguments must still hit the cache
+    const repeated = await sdk.api.files.file_download_URL({ secureName: cacheFile.secureName })
+    assert(
+      repeated.downloadURL === asAttachment.downloadURL,
+      'an identical repeat request did not hit the cache',
+      'an identical repeat request hits the cache',
+    )
+  } finally {
+    for (const id of fileIds) {
+      await sdk.api.files.deleteOne(id).catch(() => {})
+    }
+  }
+}
+
+if (require.main === module) {
+  console.log(`Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await file_download_unicode_names_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("File download unicode names test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("File download unicode names test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/healthie_multi_integration.test.ts

@@ -8,9 +8,9 @@ import {
   log_header,
   wait,
 } from "@tellescope/testing"
-import { evaluate_conditional_logic_for_enduser_fields } from "@tellescope/utilities"
+import { evaluate_conditional_logic_for_enduser_fields, objects_equivalent } from "@tellescope/utilities"
 import { setup_tests } from "../setup"
-import { BUILT_INS_FOR_SET_FIELDS, HEALTHIE_TITLE } from "@tellescope/constants"
+import { BUILT_INS_FOR_SET_FIELDS, ENDUSER_FIELD_TYPES, EnduserField, HEALTHIE_TITLE } from "@tellescope/constants"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
@@ -27,6 +27,12 @@ export const healthie_multi_integration_tests = async ({ sdk, sdkNonAdmin } : {
   let enduserId = ''
   let formsortEnduserId = ''
   let formId = ''
+  let hiddenFormId = ''
+  let multipleChoiceFormId = ''
+  let hiddenIntakeEnduserId = ''
+  let multipleChoiceIntakeEnduserId = ''
+  let numberIntakeEnduserId = ''
+  const formResponseIds: string[] = []
 
   try {
     // ── Set Fields support ────────────────────────────────────────────────────────────────────
@@ -236,6 +242,90 @@ export const healthie_multi_integration_tests = async ({ sdk, sdkNonAdmin } : {
       { onResult: e => e.healthieIntegrationId === 'somewhere-else' },
     )
 
+    // ── Form intake field: "Update Patient Profile" writes the top-level enduser column ──
+    const submitIntakeResponse = async (enduserId: string, formId: string, response: any) => {
+      const { accessCode, response: prepared } = await sdk.api.form_responses.prepare_form_response({ enduserId, formId })
+      formResponseIds.push(prepared.id)
+      await sdk.api.form_responses.submit_form_response({ accessCode, responses: [response] })
+    }
+
+    const hiddenForm = await sdk.api.forms.createOne({ title: "Multi Healthie Intake (Hidden Value)" })
+    hiddenFormId = hiddenForm.id
+    const hiddenField = await sdk.api.form_fields.createOne({
+      formId: hiddenForm.id,
+      title: "Healthie Integration",
+      type: 'Hidden Value',
+      intakeField: 'healthieIntegrationId',
+      previousFields: [{ type: 'root', info: {} }],
+    })
+
+    const hiddenIntakeEnduser = await sdk.api.endusers.createOne({ email: 'multi-healthie-intake-hidden@tellescope.com' })
+    hiddenIntakeEnduserId = hiddenIntakeEnduser.id
+
+    await submitIntakeResponse(hiddenIntakeEnduserId, hiddenForm.id, {
+      fieldId: hiddenField.id, fieldTitle: hiddenField.title, answer: { type: 'Hidden Value', value: TAG },
+    })
+    await async_test(
+      "Hidden Value intake field sets healthieIntegrationId",
+      () => sdk.api.endusers.getOne(hiddenIntakeEnduserId),
+      { onResult: e => e.healthieIntegrationId === TAG },
+    )
+
+    // Multiple Choice answers arrive as arrays — the stored value must be the collapsed scalar,
+    // otherwise stringValidator100 rejects the update and takes the whole submission's intake down
+    const multipleChoiceForm = await sdk.api.forms.createOne({ title: "Multi Healthie Intake (Multiple Choice)" })
+    multipleChoiceFormId = multipleChoiceForm.id
+    const multipleChoiceField = await sdk.api.form_fields.createOne({
+      formId: multipleChoiceForm.id,
+      title: "Which clinic?",
+      type: 'multiple_choice',
+      intakeField: 'healthieIntegrationId',
+      options: { choices: [TAG, 'other-clinic'], radio: true },
+      previousFields: [{ type: 'root', info: {} }],
+    })
+
+    const multipleChoiceIntakeEnduser = await sdk.api.endusers.createOne({ email: 'multi-healthie-intake-mc@tellescope.com' })
+    multipleChoiceIntakeEnduserId = multipleChoiceIntakeEnduser.id
+
+    await submitIntakeResponse(multipleChoiceIntakeEnduserId, multipleChoiceForm.id, {
+      fieldId: multipleChoiceField.id, fieldTitle: multipleChoiceField.title, answer: { type: 'multiple_choice', value: [TAG] },
+    })
+    await async_test(
+      "Multiple Choice intake field stores healthieIntegrationId as a scalar",
+      () => sdk.api.endusers.getOne(multipleChoiceIntakeEnduserId),
+      { onResult: e => e.healthieIntegrationId === TAG },
+    )
+
+    // Allowed form field types. The form_fields model validates intakeField as a free string (isFormField,
+    // which checks ENDUSER_FIELD_TYPES, is not wired into its schema), so this is enforced in the form editor
+    // rather than by the API — same as every other intake field. Assert the shared constant the editor reads.
+    assert(
+      objects_equivalent(
+        ENDUSER_FIELD_TYPES['healthieIntegrationId' as EnduserField],
+        ['Hidden Value', 'Dropdown', 'multiple_choice', 'string'],
+      ),
+      'ENDUSER_FIELD_TYPES error', 'healthieIntegrationId is limited to Hidden Value, Dropdown, Multiple Choice, and Text',
+    )
+
+    // An incompatible type is accepted by the API but must never write a non-string to the enduser column
+    const numberField = await sdk.api.form_fields.createOne({
+      formId: multipleChoiceForm.id,
+      title: "Bad Type",
+      type: 'number',
+      intakeField: 'healthieIntegrationId',
+      previousFields: [{ type: 'after', info: { fieldId: multipleChoiceField.id } }],
+    })
+    const numberIntakeEnduser = await sdk.api.endusers.createOne({ email: 'multi-healthie-intake-number@tellescope.com' })
+    numberIntakeEnduserId = numberIntakeEnduser.id
+    await submitIntakeResponse(numberIntakeEnduserId, multipleChoiceForm.id, {
+      fieldId: numberField.id, fieldTitle: numberField.title, answer: { type: 'number', value: 5 },
+    })
+    await async_test(
+      "non-string answer for the healthieIntegrationId intake field is ignored",
+      () => sdk.api.endusers.getOne(numberIntakeEnduserId),
+      { onResult: e => !e.healthieIntegrationId },
+    )
+
     // ── Removing the primary must not affect the tagged integration; org list recomputes on delete ──
     await sdk.api.integrations.deleteOne(primaryIntegrationId)
     primaryIntegrationId = ''
@@ -258,9 +348,17 @@ export const healthie_multi_integration_tests = async ({ sdk, sdkNonAdmin } : {
       if (!id) continue
       await sdk.api.integrations.deleteOne(id).catch(console.error)
     }
-    if (enduserId) await sdk.api.endusers.deleteOne(enduserId).catch(console.error)
-    if (formsortEnduserId) await sdk.api.endusers.deleteOne(formsortEnduserId).catch(console.error)
-    if (formId) await sdk.api.forms.deleteOne(formId).catch(console.error)
+    for (const id of formResponseIds) {
+      await sdk.api.form_responses.deleteOne(id).catch(console.error)
+    }
+    for (const id of [enduserId, formsortEnduserId, hiddenIntakeEnduserId, multipleChoiceIntakeEnduserId, numberIntakeEnduserId]) {
+      if (!id) continue
+      await sdk.api.endusers.deleteOne(id).catch(console.error)
+    }
+    for (const id of [formId, hiddenFormId, multipleChoiceFormId]) {
+      if (!id) continue
+      await sdk.api.forms.deleteOne(id).catch(console.error)
+    }
   }
 }