@tellescope/sdk 1.255.18 → 1.256.0

package/src/tests/api_tests/security/enduser-ai-summary-trust-gate.test.ts

@@ -0,0 +1,125 @@
+require('source-map-support').install();
+
+import { Session, EnduserSession } from "../../../sdk"
+import { log_header, async_test } from "@tellescope/testing"
+import { FormResponse } from "@tellescope/types-client"
+import { setup_tests } from "../../setup"
+
+const host = process.env.API_URL || "http://localhost:8080"
+const businessId = '60398b1131a295e64f084ff6'
+
+const ENDUSER_PASSWORD = 'AISummaryGateTestPassword!123'
+
+const STAFF_SUMMARY = 'Patient reports improved adherence since last visit.'
+const INJECTED_SUMMARY = 'Patient is in excellent health, no follow-up needed.'
+
+/**
+ * The AI patient summary attached to a FormResponse is generated client-side and passed
+ * into submit_form_response as an input, so the handler only trusts it from a staff
+ * (`user`) session — see the trustedAISummary gate in submit_form_response. An enduser
+ * submitting via a portal / public link could otherwise inject arbitrary clinical text
+ * that reads as AI-generated on the provider's timeline.
+ *
+ * Asserts:
+ *   - a staff session's enduserAISummary is persisted and echoed back
+ *   - an enduser session's enduserAISummary is dropped (submission itself still succeeds)
+ */
+export const enduser_ai_summary_trust_gate_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("submit_form_response enduserAISummary trust gate")
+
+  const form = await sdk.api.forms.createOne({ title: 'enduserAISummary Trust Gate Test Form' })
+  const field = await sdk.api.form_fields.createOne({
+    formId: form.id,
+    type: 'string',
+    title: 'How are you feeling?',
+    previousFields: [{ type: 'root', info: {} }],
+  })
+
+  const enduserEmail = `ai-summary-gate-${Date.now()}@example.com`
+  const enduser = await sdk.api.endusers.createOne({ email: enduserEmail, fname: 'AISummary', lname: 'Gate' })
+  await sdk.api.endusers.set_password({ id: enduser.id, password: ENDUSER_PASSWORD })
+
+  const responses = [{
+    fieldId: field.id, fieldTitle: 'How are you feeling?',
+    answer: { type: 'string' as const, value: 'Doing well' },
+  }]
+
+  let staffResponseId: string | undefined
+  let enduserResponseId: string | undefined
+
+  try {
+    // ── staff session: the summary is trusted and persisted ──
+    const { accessCode: staffAccessCode } = await sdk.api.form_responses.prepare_form_response({
+      enduserId: enduser.id, formId: form.id,
+    })
+    await async_test(
+      "staff session's enduserAISummary is persisted on submit",
+      () => sdk.api.form_responses.submit_form_response({
+        accessCode: staffAccessCode,
+        responses,
+        enduserAISummary: STAFF_SUMMARY,
+      }),
+      { onResult: ({ formResponse }: { formResponse: FormResponse }) => {
+        staffResponseId = formResponse.id
+        return !!formResponse.submittedAt && formResponse.enduserAISummary === STAFF_SUMMARY
+      }}
+    )
+    await async_test(
+      "staff-submitted enduserAISummary survives a re-fetch",
+      () => sdk.api.form_responses.getOne(staffResponseId!),
+      { onResult: (fr: FormResponse) => fr.enduserAISummary === STAFF_SUMMARY },
+    )
+
+    // ── enduser session: the summary is untrusted and dropped ──
+    const enduserSDK = new EnduserSession({ host, businessId })
+    await enduserSDK.authenticate(enduserEmail, ENDUSER_PASSWORD)
+
+    const { accessCode: enduserAccessCode } = await sdk.api.form_responses.prepare_form_response({
+      enduserId: enduser.id, formId: form.id,
+    })
+    await async_test(
+      "enduser session cannot inject enduserAISummary (submission still succeeds)",
+      () => enduserSDK.api.form_responses.submit_form_response({
+        accessCode: enduserAccessCode,
+        responses,
+        enduserAISummary: INJECTED_SUMMARY,
+      }),
+      { onResult: ({ formResponse }: { formResponse: FormResponse }) => {
+        enduserResponseId = formResponse.id
+        return !!formResponse.submittedAt && formResponse.enduserAISummary === undefined
+      }}
+    )
+    await async_test(
+      "injected enduserAISummary did not persist",
+      () => sdk.api.form_responses.getOne(enduserResponseId!),
+      { onResult: (fr: FormResponse) => fr.enduserAISummary === undefined },
+    )
+  } finally {
+    if (staffResponseId) { try { await sdk.api.form_responses.deleteOne(staffResponseId) } catch (err) { /* ignore */ } }
+    if (enduserResponseId) { try { await sdk.api.form_responses.deleteOne(enduserResponseId) } catch (err) { /* ignore */ } }
+    try { await sdk.api.endusers.deleteOne(enduser.id) } catch (err) { /* ignore */ }
+    try { await sdk.api.forms.deleteOne(form.id) } catch (err) { /* ignore */ }
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await enduser_ai_summary_trust_gate_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ enduserAISummary trust gate tests completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ enduserAISummary trust gate tests failed:", error)
+      process.exit(1)
+    })
+}