@tellescope/sdk 1.255.18 → 1.256.0

package/src/tests/api_tests/openloop_webhooks.test.ts

@@ -5,6 +5,7 @@ import {
   assert,
   async_test,
   log_header,
+  wait,
 } from "@tellescope/testing"
 import { setup_tests } from "../setup"
 
@@ -80,9 +81,12 @@ export const openloop_webhooks_tests = async ({ sdk, sdkNonAdmin }: { sdk: Sessi
 
   const healthieId1 = 'test-healthie-ol-1'
   const healthieId2 = 'test-healthie-ol-2'
+  const healthieId3 = 'test-healthie-ol-3'
 
   const enduser1 = await sdk.api.endusers.createOne({ source: 'Healthie', externalId: healthieId1 })
   const enduser2 = await sdk.api.endusers.createOne({ source: 'Healthie', externalId: healthieId2 })
+  // dedicated to the frequency-trigger section, so tag assertions stay isolated
+  const enduser3 = await sdk.api.endusers.createOne({ source: 'Healthie', externalId: healthieId3 })
 
   try {
     // ===== SECTION A: V1 Validation =====
@@ -272,6 +276,84 @@ export const openloop_webhooks_tests = async ({ sdk, sdkNonAdmin }: { sdk: Sessi
       { onResult: (r: boolean) => r === true }
     )
 
+    await async_test(
+      'V1: order_shipped updates frequency when weeksOrdered changes',
+      async () => {
+        const orderNum = `ol-ship-weeks-${uid()}`
+        // OLH confirms with weeksOrdered=w4
+        await postV1(makeV1Confirmation({
+          patientID: healthieId1,
+          orderNumber: orderNum,
+          weeksOrdered: 'w4',
+        }))
+
+        // ...then ships the same order with a different weeksOrdered, which is the value to trigger on
+        const res = await postV1(makeV1Shipped({
+          patientID: healthieId1,
+          orderNumber: orderNum,
+          weeksOrdered: 'w8',
+        }))
+        assert(res.status === 200, `Expected 200, got ${res.status}`)
+
+        const orders = await sdk.api.enduser_orders.getSome({
+          filter: { source: 'OpenLoop', externalId: orderNum }
+        })
+        assert(orders.length === 1, `Expected 1 order, got ${orders.length}`)
+        assert(orders[0].frequency === 'w8', `frequency should reflect the shipped event: ${orders[0].frequency}`)
+        return true
+      },
+      { onResult: (r: boolean) => r === true }
+    )
+
+    await async_test(
+      'V1: order_shipped without weeksOrdered preserves confirmed frequency',
+      async () => {
+        const orderNum = `ol-ship-noweeks-${uid()}`
+        await postV1(makeV1Confirmation({
+          patientID: healthieId1,
+          orderNumber: orderNum,
+          weeksOrdered: 'w4',
+        }))
+
+        // makeV1Shipped has no weeksOrdered default, so this ships without restating it
+        const res = await postV1(makeV1Shipped({
+          patientID: healthieId1,
+          orderNumber: orderNum,
+        }))
+        assert(res.status === 200, `Expected 200, got ${res.status}`)
+
+        const orders = await sdk.api.enduser_orders.getSome({
+          filter: { source: 'OpenLoop', externalId: orderNum }
+        })
+        assert(orders.length === 1, `Expected 1 order, got ${orders.length}`)
+        assert(orders[0].frequency === 'w4', `frequency should not be cleared: ${orders[0].frequency}`)
+        return true
+      },
+      { onResult: (r: boolean) => r === true }
+    )
+
+    await async_test(
+      'V1: order_shipped creates new order with frequency',
+      async () => {
+        const orderNum = `ol-ship-new-weeks-${uid()}`
+        // never confirmed, first seen as shipped
+        const res = await postV1(makeV1Shipped({
+          patientID: healthieId1,
+          orderNumber: orderNum,
+          weeksOrdered: 'w12',
+        }))
+        assert(res.status === 200, `Expected 200, got ${res.status}`)
+
+        const orders = await sdk.api.enduser_orders.getSome({
+          filter: { source: 'OpenLoop', externalId: orderNum }
+        })
+        assert(orders.length === 1, `Expected 1 order, got ${orders.length}`)
+        assert(orders[0].frequency === 'w12', `frequency mismatch: ${orders[0].frequency}`)
+        return true
+      },
+      { onResult: (r: boolean) => r === true }
+    )
+
     await async_test(
       'V1: order_shipped creates new order if none exists',
       async () => {
@@ -695,11 +777,67 @@ export const openloop_webhooks_tests = async ({ sdk, sdkNonAdmin }: { sdk: Sessi
       { onResult: (r: boolean) => r === true }
     )
 
+    // ===== SECTION J: V1 weeksOrdered drives Order Status Equals triggers =====
+    // The reason the shipped event's weeksOrdered matters: it is what the frequencies filter matches on.
+    log_header("V1 weeksOrdered trigger integration")
+
+    // Runs last so these OpenLoop/shipped triggers can't tag endusers used by earlier sections.
+    const shippedTrigger = await sdk.api.automation_triggers.createOne({
+      event: { type: 'Order Status Equals', info: { source: 'OpenLoop', status: 'shipped', frequencies: ['w8'] } },
+      action: { type: 'Add Tags', info: { tags: ['OLH Shipped w8'] } },
+      status: 'Active',
+      title: "OpenLoop shipped with weeksOrdered w8",
+    })
+    const staleTrigger = await sdk.api.automation_triggers.createOne({
+      event: { type: 'Order Status Equals', info: { source: 'OpenLoop', status: 'shipped', frequencies: ['w4'] } },
+      action: { type: 'Add Tags', info: { tags: ['OLH Shipped w4'] } },
+      status: 'Active',
+      title: "OpenLoop shipped with weeksOrdered w4",
+    })
+
+    try {
+      await async_test(
+        'V1: shipped weeksOrdered is what Order Status Equals matches on',
+        async () => {
+          const orderNum = `ol-ship-trigger-${uid()}`
+          await postV1(makeV1Confirmation({
+            patientID: healthieId3,
+            orderNumber: orderNum,
+            weeksOrdered: 'w4',
+          }))
+          const res = await postV1(makeV1Shipped({
+            patientID: healthieId3,
+            orderNumber: orderNum,
+            weeksOrdered: 'w8',
+          }))
+          assert(res.status === 200, `Expected 200, got ${res.status}`)
+
+          await wait(undefined, 2000) // allow triggers to happen
+
+          const updated = await sdk.api.endusers.getOne(enduser3.id)
+          assert(
+            !!updated.tags?.includes('OLH Shipped w8'),
+            `expected the shipped weeksOrdered to fire its trigger, tags: ${JSON.stringify(updated.tags)}`
+          )
+          assert(
+            !updated.tags?.includes('OLH Shipped w4'),
+            `the stale confirmed weeksOrdered should not fire, tags: ${JSON.stringify(updated.tags)}`
+          )
+          return true
+        },
+        { onResult: (r: boolean) => r === true }
+      )
+    } finally {
+      await sdk.api.automation_triggers.deleteOne(shippedTrigger.id).catch(console.error)
+      await sdk.api.automation_triggers.deleteOne(staleTrigger.id).catch(console.error)
+    }
+
     console.log("All OpenLoop webhook tests passed!")
 
   } finally {
     await sdk.api.endusers.deleteOne(enduser1.id).catch(console.error)
     await sdk.api.endusers.deleteOne(enduser2.id).catch(console.error)
+    await sdk.api.endusers.deleteOne(enduser3.id).catch(console.error)
   }
 }
 

package/src/tests/api_tests/phone_calls_cold_transfer.test.ts

@@ -6,11 +6,13 @@ import {
   handleAnyError,
   log_header,
 } from "@tellescope/testing"
+import { FULL_ACCESS, PROVIDER_PERMISSIONS } from "@tellescope/constants"
 import { setup_tests } from "../setup"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
 const NONEXISTENT_MONGO_ID = '60398b1131a295e64f084fff'
+const RAND = () => Math.random().toString(36).slice(2, 10)
 
 // Validation-path tests for the cold transfer endpoint. All assertions below hit
 // validations that run before any Twilio access, so no Twilio config is needed.
@@ -19,6 +21,7 @@ export const phone_calls_cold_transfer_tests = async ({ sdk, sdkNonAdmin } : { s
 
   const enduser = await sdk.api.endusers.createOne({ fname: 'Cold', lname: 'Transfer' })
   const targetUsers: { id: string }[] = []
+  const createdRoleIds: string[] = []
 
   try {
     const inboundCall = await sdk.api.phone_calls.createOne({
@@ -81,11 +84,62 @@ export const phone_calls_cold_transfer_tests = async ({ sdk, sdkNonAdmin } : { s
       () => sdkNonAdmin.api.phone_calls.cold_transfer({ callSid: inboundCall.externalId, targetUserId: disabledTargetUser.id }),
       handleAnyError
     )
+
+    // ── target-user lookup must be gated by users READ access, not the endpoint's update access ──
+    // PROVIDER_PERMISSIONS already models the reported bug: users read='All', update='Default'.
+    // phone_calls gets FULL_ACCESS so the call itself is visible under update-level filtering.
+    const mkRoleUser = async (permissions: any) => {
+      const role = `cold-transfer-${RAND()}`
+      const rbap = await sdk.api.role_based_access_permissions.createOne({ role, permissions })
+      createdRoleIds.push(rbap.id)
+
+      const user = await sdk.api.users.createOne({
+        email: `cold.transfer.${RAND()}@tellescope.example`,
+        fname: 'Cold', lname: 'TransferRole',
+        notificationEmailsDisabled: true, verifiedEmail: true,
+        roles: [role],
+      } as any)
+      targetUsers.push(user)
+
+      const { authToken, user: sessionUser } = await sdk.api.users.generate_auth_token({ id: user.id })
+      const session = new Session({ host })
+      session.setAuthToken(authToken)
+      session.setUserInfo(sessionUser as any)
+      return session
+    }
+
+    const sdkUpdateDefault = await mkRoleUser({ ...PROVIDER_PERMISSIONS, phone_calls: FULL_ACCESS })
+    const sdkReadDefault = await mkRoleUser({
+      ...PROVIDER_PERMISSIONS,
+      phone_calls: FULL_ACCESS,
+      users: { create: null, read: 'Default', update: 'Default', delete: null },
+    })
+
+    // regression: previously failed with "Target user not found" because the lookup was
+    // filtered by users update='Default' (self-only); getting past it to the
+    // incoming-calls-disabled validation proves the lookup now uses read access
+    await async_test(
+      "cold_transfer: users update=Default no longer blocks the target lookup",
+      () => sdkUpdateDefault.api.phone_calls.cold_transfer({ callSid: inboundCall.externalId, targetUserId: disabledTargetUser.id }),
+      { shouldError: true, onError: (e: any) => e.message === "Target user has incoming calls disabled" }
+    )
+    // guard: the lookup is read-filtered (not org-wide) — users read='Default' still can't see the target
+    await async_test(
+      "cold_transfer: users read=Default still hides the target user",
+      () => sdkReadDefault.api.phone_calls.cold_transfer({ callSid: inboundCall.externalId, targetUserId: disabledTargetUser.id }),
+      { shouldError: true, onError: (e: any) => e.message === "Target user not found" }
+    )
+    await async_test(
+      "cold_transfer: nonexistent target still rejected for restricted role",
+      () => sdkUpdateDefault.api.phone_calls.cold_transfer({ callSid: inboundCall.externalId, targetUserId: NONEXISTENT_MONGO_ID }),
+      { shouldError: true, onError: (e: any) => e.message === "Target user not found" }
+    )
   } finally {
     // deleting the enduser cascades deletion of its phone_calls records
     await Promise.all([
       sdk.api.endusers.deleteOne(enduser.id),
       ...targetUsers.map(u => sdk.api.users.deleteOne(u.id)),
+      ...createdRoleIds.map(id => sdk.api.role_based_access_permissions.deleteOne(id)),
     ]).catch(console.error)
   }
 }

package/src/tests/api_tests/phone_calls_conference_hold.test.ts

@@ -0,0 +1,62 @@
+require('source-map-support').install();
+
+import { Session } from "../../sdk"
+import {
+  async_test,
+  handleAnyError,
+  log_header,
+} from "@tellescope/testing"
+import { setup_tests } from "../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+// Validation-path tests for the modify-conference-attendee-status endpoint. All assertions
+// below hit validations that run before any Twilio access, so no Twilio config is needed.
+// conferenceId is not settable via the public API (only set internally by conference
+// webhooks), so the Twilio hold/unhold branches are covered by manual E2E testing only.
+export const phone_calls_conference_hold_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("Phone Calls Conference Hold Tests")
+
+  await async_test(
+    "modify_conference_attendee_status: no status fields rejected",
+    () => sdk.api.phone_calls.modify_conference_attendee_status({ conferenceId: 'CAconferenceholdtest0000000000001' }),
+    { shouldError: true, onError: (e: any) => e.message === "At least one status field (e.g. hold) must be provided" }
+  )
+  await async_test(
+    "modify_conference_attendee_status: bogus conferenceId rejected",
+    () => sdk.api.phone_calls.modify_conference_attendee_status({ conferenceId: 'CAdoesnotexist0000000000000000000', hold: true }),
+    { shouldError: true, onError: (e: any) => e.message === "Call not found" }
+  )
+  await async_test(
+    "modify_conference_attendee_status: hold false also validated against record access",
+    () => sdk.api.phone_calls.modify_conference_attendee_status({ conferenceId: 'CAdoesnotexist0000000000000000000', hold: false }),
+    { shouldError: true, onError: (e: any) => e.message === "Call not found" }
+  )
+  await async_test(
+    "modify_conference_attendee_status: non-admin cannot hold an inaccessible conference",
+    () => sdkNonAdmin.api.phone_calls.modify_conference_attendee_status({ conferenceId: 'CAdoesnotexist0000000000000000000', hold: true }),
+    handleAnyError
+  )
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await phone_calls_conference_hold_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ Phone calls conference hold test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Phone calls conference hold test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/scoped_api_keys.test.ts

@@ -78,6 +78,11 @@ export const scoped_api_keys_tests = async ({ sdk, sdkNonAdmin } : { sdk: Sessio
       }),
       { shouldError: true, onError: (e: any) => e.response?.status === 401 },
     )
+    await async_test(
+      "scoped key cannot create API keys (escalation guard)",
+      () => axios.post(`${host}/v1/api-key`, {}, { headers: { Authorization: `API_KEY ${scoped.key}` } }),
+      { shouldError: true, onError: (e: any) => e.response?.status === 401 },
+    )
 
     // =============================================
     // (c) Scoped key IS accepted by the form-ingestion webhook

package/src/tests/api_tests/security/F-0013-sanitize-user-html-with-iframes.test.ts

@@ -0,0 +1,215 @@
+import { DEFAULT_IFRAME_SANDBOX, replace_form_field_template_values, sanitize_user_html, sanitize_user_html_with_iframes } from "@tellescope/utilities"
+
+// Companion to F-0013-sanitize-user-html.test.ts (pattern 06 — XSS via dangerouslySetInnerHTML).
+//
+// sanitize_user_html_with_iframes is the variant used by the live form's field description, so
+// admins can embed video / scheduling widgets. It permits <iframe> and NOTHING else beyond what
+// sanitize_user_html allows. This asserts:
+//   1. permitting iframe did not reopen any of the F-0013 vectors (the full payload list is re-run)
+//   2. only absolute https iframes survive — relative, protocol-relative, http, javascript:, data:
+//      and srcdoc frames are dropped, along with their fallback content
+//   3. the restrictive sandbox is forced, but an author-supplied sandbox is honored
+//   4. sanitize_user_html itself still strips iframes (the boundary between the two functions)
+//
+// Pure-function test — no Session needed. Runs as part of the main suite and standalone:
+//   ./build_cjs.sh && cd packages/public/sdk && node -r dotenv/config lib/cjs/tests/api_tests/security/F-0013-sanitize-user-html-with-iframes.test.js
+
+const fail = (msg: string) => { throw new Error(msg) }
+
+// Same as has_no_executable_vector in the F-0013 test, minus the '<iframe' clause (iframes are
+// expected in this function's output). Everything else must still be neutralized.
+const has_no_executable_vector_allowing_iframe = (out: string) => {
+  const o = out.toLowerCase()
+  const withoutValues = o.replace(/"[^"]*"/g, '""').replace(/'[^']*'/g, "''")
+  return !/\son[a-z]+\s*=/.test(withoutValues)   // no live on*= event-handler attribute
+      && !o.includes('javascript:')
+      && !o.includes('vbscript:')
+      && !o.includes('<script')
+      && !o.includes('<svg')
+      && !o.includes('<math')
+      && !o.includes('<object')
+      && !o.includes('<embed')
+      && !o.includes('<form')
+      && !o.includes('<noscript')
+      && !o.includes('<template')
+      && !o.includes('srcdoc')                   // an inline document is arbitrary markup
+}
+
+// Tokens that must NEVER appear in the forced default. allow-top-navigation is the important one:
+// it is what stops a hostile embed from redirecting the patient's form page to a phishing site.
+const FORBIDDEN_SANDBOX_TOKENS = [
+  'allow-top-navigation',
+  'allow-downloads',
+  'allow-modals',
+  'allow-pointer-lock',
+  'allow-orientation-lock',
+]
+
+export const sanitize_user_html_with_iframes_tests = async () => {
+  console.log("Running sanitize_user_html_with_iframes XSS regression tests")
+
+  // ---------------------------------------------------------------------------------------------
+  // 1. Re-run the full F-0013 payload set — permitting iframe must not be a general regression
+  // ---------------------------------------------------------------------------------------------
+  const xssPayloads: [string, string][] = [
+    ['img onerror', `<img src=x onerror="alert(document.domain)">`],
+    ['svg onload', `<svg onload="alert(1)"></svg>`],
+    ['svg animate onbegin', `<svg><animate onbegin="alert(1)" attributeName="x" dur="1s"></svg>`],
+    ['details ontoggle', `<details open ontoggle="alert(1)"></details>`],
+    ['input onfocus autofocus', `<input autofocus onfocus="alert(1)">`],
+    ['body onpageshow', `<body onpageshow="alert(1)">`],
+    ['a javascript scheme', `<a href="javascript:alert(1)">x</a>`],
+    ['a javascript entity-encoded', `<a href="jav&#x09;ascript:alert(1)">x</a>`],
+    ['script tag', `<script>alert(1)</script>`],
+    ['onerror newline before =', `<img src=x onerror\n="alert(1)">`],
+    ['onerror mixed case', `<IMG SRC=x OnErRoR="alert(1)">`],
+    ['marquee onstart', `<marquee onstart="alert(1)">x</marquee>`],
+    ['mathml mglyph style mxss', `<math><mtext><table><mglyph><style><!--</style><img src=x onerror=alert(1)>`],
+    ['svg foreignObject', `<svg><foreignObject><img src=x onerror=alert(1)></foreignObject></svg>`],
+    ['noscript context confusion', `<noscript><p title="</noscript><img src=x onerror=alert(1)>">`],
+    ['template content', `<template><img src=x onerror=alert(1)></template>`],
+    ['comment confusion', `<!--><img src=x onerror=alert(1)>-->`],
+    ['cdata confusion', `<![CDATA[<img src=x onerror=alert(1)>]]>`],
+    ['markup inside attr value', `<img src="x" alt="<script>alert(1)</script>">`],
+    ['vbscript scheme', `<a href="vbscript:msgbox(1)">x</a>`],
+    ['data text/html href', `<a href="data:text/html,<script>alert(1)</script>">x</a>`],
+    ['javascript decimal entity', `<a href="&#74;avascript:alert(1)">x</a>`],
+    ['javascript newline entity', `<a href="jav&#x0A;ascript:alert(1)">x</a>`],
+  ]
+  for (const [name, payload] of xssPayloads) {
+    const out = sanitize_user_html_with_iframes(payload)
+    if (!has_no_executable_vector_allowing_iframe(out)) fail(`XSS not neutralized [${name}] -> ${out}`)
+  }
+
+  // ---------------------------------------------------------------------------------------------
+  // 2. Only absolute https iframes survive
+  // ---------------------------------------------------------------------------------------------
+  const badSrcs: [string, string][] = [
+    ['javascript scheme', `javascript:alert(1)`],
+    ['data text/html', `data:text/html,<script>alert(1)</script>`],
+    ['http (not https)', `http://evil.example`],
+    // sanitize-html does NOT reject protocol-relative iframe srcs on its own when
+    // allowProtocolRelative is set — this is the self-origin framing vector and the reason the
+    // sanitizer does its own absolute-https check.
+    ['protocol-relative', `//app.tellescope.com/`],
+    ['root-relative', `/portal/settings`],
+    ['bare relative', `settings`],
+    ['whitespace-obfuscated', `  https:/\\/\\evil`],
+    ['tab-entity javascript', `jav&#x09;ascript:alert(1)`],
+    ['scheme-only', `https://`],
+    ['empty', ``],
+  ]
+  for (const [name, src] of badSrcs) {
+    const out = sanitize_user_html_with_iframes(`<iframe src="${src}"></iframe>`)
+    if (out.toLowerCase().includes('<iframe')) fail(`bad iframe src survived [${name}] -> ${out}`)
+  }
+
+  // A dropped iframe must take its fallback content with it (exclusiveFilter, not a tagName swap)
+  const fallback = sanitize_user_html_with_iframes(`<iframe src="/x">FALLBACK-TEXT</iframe>`)
+  if (fallback.includes('FALLBACK-TEXT')) fail(`dropped iframe leaked its fallback text: ${fallback}`)
+  if (fallback.toLowerCase().includes('<iframe')) fail(`dropped iframe survived: ${fallback}`)
+
+  // srcdoc is not allowlisted, even alongside a valid src
+  const srcdoc = sanitize_user_html_with_iframes(`<iframe src="https://ok.example" srcdoc="<img src=x onerror=alert(1)>"></iframe>`)
+  if (srcdoc.toLowerCase().includes('srcdoc')) fail(`srcdoc not stripped: ${srcdoc}`)
+  if (!srcdoc.toLowerCase().includes('<iframe')) fail(`valid iframe dropped alongside srcdoc: ${srcdoc}`)
+
+  // handlers / clobbering attributes stripped, frame itself kept
+  const handlers = sanitize_user_html_with_iframes(`<iframe src="https://ok.example" onload="alert(1)" id="x" name="getElementById"></iframe>`)
+  if (!handlers.toLowerCase().includes('<iframe')) fail(`valid iframe dropped: ${handlers}`)
+  if (/\son[a-z]+\s*=/.test(handlers.toLowerCase())) fail(`iframe event handler survived: ${handlers}`)
+  if (/\b(id|name)\s*=/.test(handlers)) fail(`iframe id/name not stripped (DOM clobbering): ${handlers}`)
+
+  // ---------------------------------------------------------------------------------------------
+  // 3. Legitimate embeds survive, hardened
+  // ---------------------------------------------------------------------------------------------
+  // The exact shape draftjs-to-html emits for the WYSIWYG "embedded" button
+  const yt = sanitize_user_html_with_iframes(`<iframe width="560" height="315" src="https://www.youtube.com/embed/abc" frameBorder="0"></iframe>`)
+  if (!yt.includes('src="https://www.youtube.com/embed/abc"')) fail(`youtube embed src stripped: ${yt}`)
+  if (!(yt.includes('width="560"') && yt.includes('height="315"'))) fail(`iframe dimensions stripped: ${yt}`)
+  if (!yt.toLowerCase().includes('frameborder')) fail(`frameborder stripped: ${yt}`)
+
+  // forced containment
+  if (!yt.includes(`sandbox="${DEFAULT_IFRAME_SANDBOX}"`)) fail(`sandbox not forced: ${yt}`)
+  if (!yt.toLowerCase().includes('referrerpolicy=')) fail(`referrerpolicy not set: ${yt}`)
+  for (const token of FORBIDDEN_SANDBOX_TOKENS) {
+    if (DEFAULT_IFRAME_SANDBOX.includes(token)) fail(`forced sandbox must not grant ${token}: ${DEFAULT_IFRAME_SANDBOX}`)
+  }
+  // allow-same-origin IS granted — required for real embeds (a Loom embed renders blank without it)
+  // and harmless because the src is guaranteed cross-origin by the check asserted above.
+  if (!DEFAULT_IFRAME_SANDBOX.includes('allow-same-origin')) fail(`forced sandbox must grant allow-same-origin so real embeds render: ${DEFAULT_IFRAME_SANDBOX}`)
+
+  // author-supplied sandbox honored verbatim, so a surface can tighten (or loosen) per embed.
+  // Uses a value distinct from the default, so this can't pass by coincidence.
+  const authorSandbox = sanitize_user_html_with_iframes(`<iframe src="https://ok.example" sandbox="allow-scripts"></iframe>`)
+  if (!authorSandbox.includes('sandbox="allow-scripts"')) fail(`author sandbox not honored: ${authorSandbox}`)
+
+  // sandbox="" is the MOST restrictive value and must not be replaced by the default
+  const emptySandbox = sanitize_user_html_with_iframes(`<iframe src="https://ok.example" sandbox=""></iframe>`)
+  if (emptySandbox.includes('allow-')) fail(`empty sandbox was replaced with the permissive default: ${emptySandbox}`)
+  if (!/\ssandbox(\s|>)/.test(emptySandbox)) fail(`empty sandbox attribute lost entirely: ${emptySandbox}`)
+
+  // author referrerpolicy honored
+  const noref = sanitize_user_html_with_iframes(`<iframe src="https://ok.example" referrerpolicy="no-referrer"></iframe>`)
+  if (!noref.includes('referrerpolicy="no-referrer"')) fail(`author referrerpolicy not honored: ${noref}`)
+
+  // `allow` (Permissions-Policy delegation, e.g. YouTube autoplay) preserved
+  const allowAttr = sanitize_user_html_with_iframes(`<iframe src="https://ok.example" allow="autoplay; encrypted-media" allowfullscreen></iframe>`)
+  if (!allowAttr.includes('allow="autoplay; encrypted-media"')) fail(`allow attribute stripped: ${allowAttr}`)
+
+  // ---------------------------------------------------------------------------------------------
+  // 4. Everything sanitize_user_html preserves must still be preserved
+  // ---------------------------------------------------------------------------------------------
+  const heading = sanitize_user_html_with_iframes(`<h1>Welcome</h1><h3 style="color:#333">Sub</h3>`)
+  if (!(heading.includes('<h1>') && heading.includes('<h3') && heading.toLowerCase().includes('color'))) fail(`headings/style stripped: ${heading}`)
+
+  const table = sanitize_user_html_with_iframes(`<table><thead><tr><th>H</th></tr></thead><tbody><tr><td style="padding:4px" colspan="2">cell</td></tr></tbody></table>`)
+  if (!(table.includes('<table') && table.includes('<td') && table.includes('colspan'))) fail(`table stripped: ${table}`)
+
+  const list = sanitize_user_html_with_iframes(`<ul><li>a</li></ul><ol start="3"><li>c</li></ol>`)
+  if (!(list.includes('<ul') && list.includes('<li') && list.includes('<ol'))) fail(`list stripped: ${list}`)
+
+  const link = sanitize_user_html_with_iframes(`<a href="https://example.com">link</a>`)
+  if (!link.includes('href="https://example.com"')) fail(`safe link stripped: ${link}`)
+  if (!link.toLowerCase().includes('noopener')) fail(`external link not hardened: ${link}`)
+
+  const img = sanitize_user_html_with_iframes(`<img src="https://cdn.example.com/a.png" alt="pic" width="200">`)
+  if (!(img.includes('src="https://cdn.example.com/a.png"') && img.includes('alt="pic"'))) fail(`image stripped: ${img}`)
+
+  const dataimg = sanitize_user_html_with_iframes(`<img src="data:image/png;base64,iVBORw0KGgo=">`)
+  if (!dataimg.includes('data:image/png')) fail(`data: image stripped: ${dataimg}`)
+
+  const fmt = sanitize_user_html_with_iframes(`<p><strong>b</strong> <em>i</em> <span style="font-size:14px">s</span></p><blockquote>q</blockquote>`)
+  if (!(fmt.includes('<strong>') && fmt.includes('<span') && fmt.toLowerCase().includes('font-size'))) fail(`formatting stripped: ${fmt}`)
+
+  // ---------------------------------------------------------------------------------------------
+  // 5. The boundary: sanitize_user_html must NOT have been loosened
+  // ---------------------------------------------------------------------------------------------
+  const shared = sanitize_user_html(`<iframe src="https://www.youtube.com/embed/abc"></iframe>`)
+  if (shared.toLowerCase().includes('<iframe')) fail(`sanitize_user_html must still strip iframes: ${shared}`)
+
+  // ---------------------------------------------------------------------------------------------
+  // 6. End to end: an admin's iframe survives templating, a patient-injected one does not
+  // ---------------------------------------------------------------------------------------------
+  const adminTemplate = `<p>Hi {{enduser.fname}}, watch this:</p><iframe src="https://www.youtube.com/embed/abc"></iframe>`
+  const templated = replace_form_field_template_values(adminTemplate, {
+    enduser: { fname: `<iframe src="https://evil.example/phish"></iframe>` } as any,
+    responses: [],
+    escapeNewlinesAsHTMLBreaks: true,
+    escapeHTMLValues: true,
+  })
+  const endToEnd = sanitize_user_html_with_iframes(templated)
+  if (!endToEnd.includes('src="https://www.youtube.com/embed/abc"')) fail(`admin's own iframe did not survive: ${endToEnd}`)
+  // The patient's markup must survive only as inert escaped text — so 'evil.example' may still
+  // appear as visible characters, but there must be exactly one LIVE frame (the admin's).
+  if (!endToEnd.includes('&lt;iframe')) fail(`patient markup not escaped to inert text: ${endToEnd}`)
+  if ((endToEnd.toLowerCase().match(/<iframe/g) || []).length !== 1) fail(`patient-injected iframe became a live frame: ${endToEnd}`)
+
+  console.log("✅ sanitize_user_html_with_iframes XSS regression tests passed")
+}
+
+if (require.main === module) {
+  sanitize_user_html_with_iframes_tests()
+    .then(() => { console.log("✅ suite completed"); process.exit(0) })
+    .catch((err) => { console.error("❌ suite failed:", err); process.exit(1) })
+}

package/src/tests/api_tests/security/F-0106-F-0110-enduser-write-restrictions.test.ts

@@ -43,8 +43,15 @@ const restrictedEnduserUpdates = (staffId: string, mongoId: string): Record<stri
 })
 
 // Every form_responses field marked enduserUpdatesDisabled in schema.ts.
-const restrictedFormResponseUpdates = (staffId: string): Record<string, any> => ({
+// otherEnduserId must be a REAL enduser other than the one submitting the update: enduserId's
+// foreign key is existence-checked, so a nonexistent id would be rejected as a bad dependency
+// rather than by the write restriction under test.
+const restrictedFormResponseUpdates = (staffId: string, otherEnduserId: string): Record<string, any> => ({
   markedAsSubmitted: true,
+  // repointing a response at another patient redirects the intake write in
+  // save_enduser_updates_for_form_response, which is how email/phone (authentication channels)
+  // reach an enduser record — see api_tests/security/public_endpoint_auth_field_lock.test.ts
+  enduserId: otherEnduserId,
   submittedBy: staffId,
   submittedAt: new Date("2024-01-01T00:00:00Z"),
   submittedByIsPlaceholder: true,
@@ -84,6 +91,7 @@ export const enduser_write_restrictions_tests = async ({ sdk } : { sdk: Session,
   log_header("F-0106/F-0110: enduser write restrictions (enduserUpdatesDisabled)")
 
   let enduserId: string | undefined
+  let otherEnduserId: string | undefined
   let formId: string | undefined
   let formResponseId: string | undefined
 
@@ -92,6 +100,12 @@ export const enduser_write_restrictions_tests = async ({ sdk } : { sdk: Session,
     const enduserEmail = `f0106-enduser-${Date.now()}@example.com`
     const enduser = await sdk.api.endusers.createOne({ email: enduserEmail, fname: 'F0106', lname: 'Restricted' })
     enduserId = enduser.id
+
+    // The would-be victim of an enduserId repoint, and the destination for the staff positive control.
+    const otherEnduser = await sdk.api.endusers.createOne({
+      email: `f0106-other-${Date.now()}@example.com`, fname: 'F0106', lname: 'Other',
+    })
+    otherEnduserId = otherEnduser.id
     await sdk.api.endusers.set_password({ id: enduser.id, password: ENDUSER_PASSWORD })
 
     const enduserSDK = new EnduserSession({ host, businessId })
@@ -123,7 +137,7 @@ export const enduser_write_restrictions_tests = async ({ sdk } : { sdk: Session,
     )
 
     // ---- F-0110: enduser self-update of restricted form_responses fields must 400 ----
-    for (const [field, value] of Object.entries(restrictedFormResponseUpdates(sdk.userInfo.id))) {
+    for (const [field, value] of Object.entries(restrictedFormResponseUpdates(sdk.userInfo.id, otherEnduser.id))) {
       await async_test(
         `F-0110: enduser cannot self-update form_responses.${field}`,
         () => enduserSDK.api.form_responses.updateOne(formResponse.id, { [field]: value } as any),
@@ -132,9 +146,13 @@ export const enduser_write_restrictions_tests = async ({ sdk } : { sdk: Session,
     }
 
     await async_test(
-      'F-0110: rejected writes did not persist (markedAsSubmitted, procedureCodes, submittedBy)',
+      'F-0110: rejected writes did not persist (markedAsSubmitted, procedureCodes, submittedBy, enduserId)',
       () => sdk.api.form_responses.getOne(formResponse.id),
-      { onResult: fr => !fr.markedAsSubmitted && !fr.procedureCodes?.length && fr.submittedBy === undefined },
+      { onResult: fr => (
+        !fr.markedAsSubmitted && !fr.procedureCodes?.length && fr.submittedBy === undefined
+        // still points at its own patient: a successful repoint is what redirects the intake write
+        && fr.enduserId === enduser.id
+      ) },
     )
 
     // ---- Positive controls: intended enduser self-updates still work ----
@@ -178,6 +196,19 @@ export const enduser_write_restrictions_tests = async ({ sdk } : { sdk: Session,
         && !!fr.tags?.includes('staff-set-tag')
       ) },
     )
+
+    // enduserId is enduserUpdatesDisabled rather than updatesDisabled specifically so this keeps
+    // working: staff sometimes need to move a response to the correct profile to fix a mistake.
+    await async_test(
+      'staff can still repoint form_responses.enduserId to another patient',
+      () => sdk.api.form_responses.updateOne(formResponse.id, { enduserId: otherEnduser.id }),
+      { onResult: fr => fr.enduserId === otherEnduser.id },
+    )
+    await async_test(
+      'staff can repoint form_responses.enduserId back',
+      () => sdk.api.form_responses.updateOne(formResponse.id, { enduserId: enduser.id }),
+      { onResult: fr => fr.enduserId === enduser.id },
+    )
   } finally {
     if (formResponseId) {
       try { await sdk.api.form_responses.deleteOne(formResponseId) } catch {}
@@ -188,6 +219,9 @@ export const enduser_write_restrictions_tests = async ({ sdk } : { sdk: Session,
     if (enduserId) {
       try { await sdk.api.endusers.deleteOne(enduserId) } catch {}
     }
+    if (otherEnduserId) {
+      try { await sdk.api.endusers.deleteOne(otherEnduserId) } catch {}
+    }
   }
 }