@tellescope/sdk 1.255.18 → 1.256.0

package/src/tests/api_tests/security/public_endpoint_auth_field_lock.test.ts

@@ -0,0 +1,1707 @@
+require('source-map-support').install();
+
+import axios from "axios"
+import { Session, EnduserSession } from "../../../sdk"
+import {
+  assert,
+  log_header,
+} from "@tellescope/testing"
+import { setup_tests, authenticate_enduser_via_token } from "../../setup"
+import { Enduser } from "@tellescope/types-client"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+/**
+ * Regression test for: email / phone are locked against writes from public session-start endpoints.
+ *
+ * Two public, unauthenticated endpoints match an existing patient on a loose $or
+ * ({ email } OR { fname, lname, dateOfBirth }) and then update the matched record:
+ *
+ *   A  POST /v1/session-for-public-form
+ *   B  POST /v1/session-for-public-appointment-booking
+ *
+ * Both used to overwrite `email`, `phone` and `state` on the matched patient. `email` and `phone`
+ * are authentication channels, so that overwrite chains to account takeover:
+ *
+ *   - email-less patients are common and cheap to create (sms_messages.leave_message is an
+ *     unauthenticated enduser-creation primitive that writes only phone/fname/lname)
+ *   - attacker submits a public form matching on fname + lname + dateOfBirth with their own email
+ *   - POST /v1/request-enduser-password-reset resolves purely by findOne({ email }) -> mints a
+ *     passwordReset token and mails the reset link to the attacker
+ *   - reset_password sets hashedPassword; the attacker logs into the portal as the patient
+ *
+ * phone is equally load-bearing: begin_login_flow accepts email OR phone, and send_otp delivers
+ * login codes to enduser.phone. A "fill only if blank" fix does NOT close this — the email-less
+ * patient is precisely the common case, which is why the UNSET shapes below are the load-bearing
+ * rows of G1/G2.
+ *
+ * The rule under test: `email` and `phone` may be written only on the INSERT path. On a matched
+ * existing patient they are never written — not even when the stored value is blank.
+ *
+ * `state` deliberately still overwrites on match (G6 pins the status quo): it is not an auth
+ * channel, and moving it behind "if unset" would break a relocated patient booking with a
+ * provider licensed in their new state.
+ *
+ * Scenario groups (pre-fix expectation in parens):
+ *   G1  (RED)   A — overwrite blocked on match, 4 victim shapes (both set / email unset / phone unset / both unset)
+ *   G2  (RED)   B — same 4 shapes
+ *   G3  (RED)   A — overwrite blocked when the victim is targeted directly via the enduserId param
+ *   G4  (RED)   takeover chain: email-less victim -> overwrite via A -> password-reset resolvability
+ *   G5  (GREEN) blank fname/lname/dateOfBirth/gender still filled; blank phone still NOT filled
+ *   G6  (GREEN) state still overwrites on match (status-quo pin)
+ *   G7  (GREEN) brand-new visitor still created WITH submitted email + phone
+ *   G8  (GREEN) form submission completes end-to-end under the returned token
+ *   G9  (GREEN) appointment availability / booking works under the returned session
+ *   G10 (GREEN) skipMatch still inserts, and skipMatch + autoMergeOnSubmission sets eligibleForAutoMerge
+ *
+ * SECOND WRITE PATH (G11-G18). Locking the endpoints is not sufficient on its own. `email` and
+ * `phone` are also UI-selectable form intakeField mappings, and save_enduser_updates_for_form_response
+ * (api/modules/forms.ts) copies those answers onto the enduser named by the form response — with no
+ * session argument and no only-if-blank guard. Two of its callers sit in the 'public-form' session scope
+ * (submit_form_response, and save_field_response for fields with options.saveIntakeOnPartial), so the
+ * whole chain above is reachable with the token the hardened endpoint itself mints: match the victim,
+ * get a session scoped to their id, then answer the form's Email question with the attacker address.
+ *
+ * The lock is scoped to "a public session that matched a PRE-EXISTING patient", not to every public
+ * session, because intakeEmailHidden / intakePhone: 'hidden' are supported configurations in which
+ * the intake question is the only source of a brand-new patient's contact info (G16).
+ *
+ *   G11 (RED)   intake answers do not overwrite a matched patient (submit path), 4 victim shapes
+ *   G12 (RED)   same via save_field_response + saveIntakeOnPartial, without ever submitting
+ *   G13 (RED)   full takeover chain driven through an intake answer
+ *   G14 (RED)   pivot: public session -> prepare_form_response for a NON-public form -> submit
+ *   G15 (RED)   save_field_response rejects another patient's formResponseId (accessCode path stays open)
+ *   G16 (GREEN) brand-new visitor still gets email/phone from intake answers
+ *   G17 (GREEN) authenticated (non-public) portal session can still self-update via intake
+ *   G18 (GREEN) staff submitting on a patient's behalf can still set email/phone
+ *
+ * NULL-MATCH / COLD START (G19-G22). In both handlers' $or, `email` and `dateOfBirth` get `|| "never"`
+ * sentinels but fname/lname are interpolated RAW. `ignoreUndefined` is not set on the Mongo client and
+ * findOne does not strip undefined keys, so an absent fname serializes to `{fname: null}` — which
+ * matches every document where the field is null OR MISSING. A request supplying ONLY dateOfBirth can
+ * therefore match another patient and receive a session scoped to THEIR record. The cold-start pattern
+ * (a public form started with no intake info, which just creates an Enduser with an ID) is what
+ * manufactures those nameless endusers.
+ *
+ *   G19 (RED)   DOB-only request does not hijack a nameless patient — form endpoint
+ *   G20 (RED)   same — booking endpoint (no skipMatch, no phone guard, so reached unconditionally)
+ *   G21 (GREEN) the match sentinel never leaks into a stored fname/lname
+ *   G22 (GREEN) cold start still lets intake answers populate email/phone on the fresh record
+ *
+ * TENANT SCOPING (G23). addPublicEndpoint overwrites the schema's `required: true` for businessId with
+ * mongoIdStringOptional, and a falsy businessId leaves restrictAccess as the IDENTITY function in the
+ * query builders — the tenant clause is never appended, so the handler queries every tenant. It fails
+ * OPEN. session_for_public_appointment_booking already guards this; session_for_public_form did not.
+ *
+ *   G23 (RED)   session_for_public_form rejects a missing or malformed businessId
+ *
+ * LOCK BYPASSES (G24-G26). The lock is defeated two ways, each needing more than one hop — which is
+ * why the single-hop groups above pass while the chain is still open:
+ *   - prepare_form_response mints a token that preserves allowedPaths but DROPS fromPublicSession, so
+ *     a second hop through the same endpoint produces an unlocked response. That flag also gates PHI
+ *     on refresh_session, so the chained token additionally reads the victim's whole record.
+ *   - the lock is a snapshot taken at session start; a later repoint of the response at a pre-existing
+ *     patient leaves a stale `false` behind unless it also writes the flag. Two callers repoint:
+ *     autoMergeOnSubmission (G26) and the staff endusers.merge handler (G27).
+ *
+ *   G24 (RED)   chained prepare_form_response session stays locked
+ *   G25 (RED)   chained session does not expose the enduser record on refresh
+ *   G26 (RED)   auto-merge does not let an intake answer repoint the merged patient
+ *   G27 (RED)   the staff endusers.merge repoint applies the lock too
+ *
+ * SCOPE BOUNDARY (G28). The formsort / form-ingestion webhook re-opens a blank email/phone for one
+ * hour after the Stripe integration creates a contact, because that endpoint is API-key
+ * authenticated. This anonymous path gets no such exemption.
+ *
+ *   G28         a fresh Stripe-created patient gets no grace here
+ *
+ * STRUCTURE: record -> report -> cleanup -> assert.
+ * EXIT_ON_FIRST_ERROR is true in testing.ts, so assert() calls process.exit(1) synchronously on the
+ * first failure. Two consequences shape this file:
+ *   1. No async_test here. Every scenario records into `results`, a summary table prints, and a
+ *      single assert() loop runs LAST — so a pre-fix run prints the complete failure picture
+ *      instead of dying on the first probe.
+ *   2. process.exit() does not unwind pending finally blocks, so cleanup runs BEFORE the assert
+ *      loop; otherwise a by-design-failing run would leak every fixture into the next run.
+ */
+
+const post = async (path: string, body: any) => {
+  try {
+    const res = await axios.post(`${host}${path}`, body, { validateStatus: () => true })
+    return { status: res.status, data: res.data as any }
+  } catch (err: any) {
+    return { status: err?.response?.status as number, data: err?.response?.data as any }
+  }
+}
+
+type ScenarioResult = { group: string, name: string, ok: boolean, skipped?: boolean, detail: string }
+
+// Endpoint A's update is fire-and-forget (.catch(console.error), not awaited); B's is awaited.
+// Reading the victim immediately after calling A would frequently show the un-overwritten value on
+// a VULNERABLE server -> false pass. So poll for the attack landing: fails fast against vulnerable
+// code, burns the full window against fixed code.
+const OVERWRITE_WINDOW_MS = 3000
+const AWAITED_WINDOW_MS = 1200
+const POLL_INTERVAL_MS = 150
+
+const sleep = (ms: number) => new Promise<void>(resolve => setTimeout(resolve, ms))
+
+export const public_endpoint_auth_field_lock_tests = async (
+  { sdk, sdkNonAdmin }: { sdk: Session, sdkNonAdmin: Session }
+) => {
+  log_header("Public Endpoint Auth Field Lock (email / phone)")
+
+  const businessId = sdk.userInfo.businessId
+  // Every identity carries a per-run token so the handlers' $or can only match our own records,
+  // and re-runs never collide.
+  const RUN = Date.now().toString(36)
+
+  const results: ScenarioResult[] = []
+  const record = (group: string, name: string, ok: boolean, detail = '') => {
+    results.push({ group, name, ok, detail })
+    console.log(`   ${ok ? '✓' : '✗'} [${group}] ${name}${detail ? ` — ${detail}` : ''}`)
+  }
+  const skip = (group: string, name: string, detail: string) => {
+    results.push({ group, name, ok: true, skipped: true, detail })
+    console.log(`   ⚠ SKIP [${group}] ${name} — ${detail}`)
+  }
+  // Converts a thrown exception into a recorded failure so one surprise doesn't abort the table.
+  const runScenario = async (group: string, name: string, fn: () => Promise<void>) => {
+    try {
+      await fn()
+    } catch (err: any) {
+      const message = err?.message ?? err?.error ?? JSON.stringify(err ?? {}).slice(0, 300)
+      record(group, name, false, `threw: ${message}`)
+    }
+  }
+
+  // phoneValidator normalizes to E.164, so generate +1555555xxxx values that are byte-comparable
+  // against what gets stored. 555-555-xxxx is the only 555 exchange libphonenumber accepts.
+  let phoneOffset = 0
+  const phoneSeed = Number(RUN.replace(/[^0-9]/g, '') || '0')
+  const nextPhone = () => `+1555555${String((phoneSeed + (phoneOffset += 1)) % 10_000).padStart(4, '0')}`
+
+  // The API lowercases stored emails, so normalize here too — the overwrite predicates compare
+  // submitted and stored values directly.
+  const emailFor = (label: string) => `${label}-${RUN}@tellescope.com`.toLowerCase()
+
+  const createdEnduserIds: string[] = []
+  const createdFormIds: string[] = []
+  const createdFormFieldIds: string[] = []
+  const createdUserIds: string[] = []
+  const createdEventIds: string[] = []
+  const createdTemplateIds: string[] = []
+
+  // matchEmailAndNames makes the email branch of the $or additionally require fname + lname, which
+  // changes which victim shapes are reachable in G5 (a fully blank victim can't be matched at all).
+  const organization: any = await sdk.api.organizations.getOne(businessId).catch(() => null)
+  const MATCH_EMAIL_AND_NAMES = !!organization?.settings?.endusers?.matchEmailAndNames
+
+  // ---------------------------------------------------------------------------------------------
+  // Fixtures
+  // ---------------------------------------------------------------------------------------------
+  // The public form has exactly one question with NO intakeField, so submitting it does not
+  // legitimately write email/phone and therefore cannot confound G8.
+  const form = await sdk.api.forms.createOne({ title: `auth field lock ${RUN}`, allowPublicURL: true })
+  createdFormIds.push(form.id)
+  const plainField = await sdk.api.form_fields.createOne({
+    formId: form.id,
+    title: 'Anything',
+    type: 'string',
+    previousFields: [{ type: 'root', info: {} }],
+  })
+  createdFormFieldIds.push(plainField.id)
+
+  const autoMergeForm = await sdk.api.forms.createOne({
+    title: `auth field lock automerge ${RUN}`,
+    allowPublicURL: true,
+    autoMergeOnSubmission: true,
+  })
+  createdFormIds.push(autoMergeForm.id)
+  const autoMergeField = await sdk.api.form_fields.createOne({
+    formId: autoMergeForm.id,
+    title: 'Anything',
+    type: 'string',
+    previousFields: [{ type: 'root', info: {} }],
+  })
+  createdFormFieldIds.push(autoMergeField.id)
+
+  // Intake-mapped forms, for G11-G18.
+  //
+  // `email` and `phone` are first-class, UI-selectable intakeField mappings (both are keys of
+  // ENDUSER_FIELD_TYPES), and save_enduser_updates_for_form_response (api/modules/forms.ts) copies
+  // those answers onto the enduser named by the form response. That is a SECOND write path, reached
+  // with the very token session_for_public_form mints — so the endpoint-level lock covered by
+  // G1-G4 is worthless unless this path is guarded too.
+  //
+  // intakePhone: 'hidden' removes the endpoint's "Phone number is required" check, which lets these
+  // scenarios call the endpoint with NO email/phone at all. That isolates the intake write path
+  // completely: any change to the victim's email/phone can only have come from an intake answer.
+  // It also mirrors the real intakeEmailHidden/intakePhone:'hidden' configuration in which the
+  // intake question is the ONLY source of a new patient's contact info (see G16).
+  const makeIntakeForm = async (label: string, opts: { public?: boolean, saveIntakeOnPartial?: boolean } = {}) => {
+    const intakeForm = await sdk.api.forms.createOne({
+      title: `auth field lock ${label} ${RUN}`,
+      intakePhone: 'hidden',
+      ...(opts.public === false ? {} : { allowPublicURL: true }),
+    } as any)
+    createdFormIds.push(intakeForm.id)
+
+    const fieldOptions = opts.saveIntakeOnPartial ? { options: { saveIntakeOnPartial: true } } : {}
+
+    const emailField = await sdk.api.form_fields.createOne({
+      formId: intakeForm.id,
+      title: 'Email',
+      type: 'email',
+      intakeField: 'email',
+      previousFields: [{ type: 'root', info: {} }],
+      ...fieldOptions,
+    } as any)
+    createdFormFieldIds.push(emailField.id)
+
+    const phoneField = await sdk.api.form_fields.createOne({
+      formId: intakeForm.id,
+      title: 'Phone Number',
+      type: 'phone',
+      intakeField: 'phone',
+      previousFields: [{ type: 'after', info: { fieldId: emailField.id } }],
+      ...fieldOptions,
+    } as any)
+    createdFormFieldIds.push(phoneField.id)
+
+    return { form: intakeForm, emailField, phoneField }
+  }
+
+  const intake = await makeIntakeForm('intake')
+  const partialIntake = await makeIntakeForm('partial', { saveIntakeOnPartial: true })
+  // Deliberately NOT allowPublicURL. prepare_form_response does not require it, so a public session
+  // can pivot from any public form to any form in the org carrying an email/phone intake mapping.
+  const pivotIntake = await makeIntakeForm('pivot', { public: false })
+
+  // Auto-merge fixture for G26. Needs real intakeField mappings, because resolveAutoMergeBeforeSubmission
+  // derives its match values from the submitted answers via those mappings — and the custom field is the
+  // anti-vacuity control (it proves the intake write ran at all).
+  const MERGE_CUSTOM_KEY = `aflMerge${RUN}`
+  const autoMergeIntake = await (async () => {
+    const form = await sdk.api.forms.createOne({
+      title: `auth field lock automerge intake ${RUN}`,
+      allowPublicURL: true,
+      autoMergeOnSubmission: true,
+      intakePhone: 'hidden',
+    } as any)
+    createdFormIds.push(form.id)
+
+    const spec = [
+      { title: 'First Name', type: 'string', intakeField: 'fname' },
+      { title: 'Last Name', type: 'string', intakeField: 'lname' },
+      { title: 'Date of Birth', type: 'dateString', intakeField: 'dateOfBirth' },
+      { title: 'Email', type: 'email', intakeField: 'email' },
+      { title: 'Custom', type: 'string', intakeField: MERGE_CUSTOM_KEY },
+    ]
+    const made: any[] = []
+    for (const s of spec) {
+      const field = await sdk.api.form_fields.createOne({
+        formId: form.id,
+        title: s.title,
+        type: s.type,
+        intakeField: s.intakeField,
+        previousFields: made.length
+          ? [{ type: 'after', info: { fieldId: made[made.length - 1].id } }]
+          : [{ type: 'root', info: {} }],
+      } as any)
+      createdFormFieldIds.push(field.id)
+      made.push(field)
+    }
+    const [fname, lname, dateOfBirth, email, custom] = made
+    return { form, fname, lname, dateOfBirth, email, custom }
+  })()
+
+  const template = await sdk.api.calendar_event_templates.createOne({
+    title: `auth field lock ${RUN}`,
+    durationInMinutes: 60,
+    confirmationEmailDisabled: true,
+    confirmationSMSDisabled: true,
+    reminders: [],
+  })
+  createdTemplateIds.push(template.id)
+
+  // Throwaway host user with all-7-day availability, so G9 has slots to find without depending on
+  // (or mutating) the shared test user's calendar configuration.
+  const hostUser = await sdk.api.users.createOne({
+    email: emailFor('lock-host'),
+    verifiedEmail: true,
+    fname: 'Lock',
+    lname: `Host${RUN}`,
+  })
+  createdUserIds.push(hostUser.id)
+  await sdk.api.users.updateOne(hostUser.id, {
+    weeklyAvailabilities: [0, 1, 2, 3, 4, 5, 6].map(dayOfWeekStartingSundayIndexedByZero => ({
+      dayOfWeekStartingSundayIndexedByZero,
+      startTimeInMinutes: 9 * 60,
+      endTimeInMinutes: 17 * 60,
+      intervalInMinutes: 60,
+    })),
+    calendarEventLimits: [],
+  }, { replaceObjectFields: true })
+
+  await sleep(250) // let form.numFields settle before the public endpoints validate it
+
+  // ---------------------------------------------------------------------------------------------
+  // Helpers
+  // ---------------------------------------------------------------------------------------------
+  const publicSDK = () => new EnduserSession({ host, businessId })
+
+  const startForm = (args: any) => publicSDK().api.form_responses.session_for_public_form({
+    formId: form.id, businessId, ...args,
+  })
+  const startBooking = (args: any) => publicSDK().api.calendar_events.session_for_public_appointment_booking({
+    calendarEventTemplateId: template.id, businessId, ...args,
+  })
+  const startFormOn = (formId: string, args: any) => publicSDK().api.form_responses.session_for_public_form({
+    formId, businessId, ...args,
+  })
+
+  const asEnduser = (authToken: string) => new EnduserSession({ host, businessId, authToken })
+
+  // Raw POST with a Bearer token, so G25 can inspect exactly which fields the response body carries.
+  const postAuthed = async (path: string, body: any, authToken: string) => {
+    try {
+      const res = await axios.post(`${host}${path}`, body, {
+        headers: { Authorization: `Bearer ${authToken}` },
+        validateStatus: () => true,
+      })
+      return { status: res.status, data: res.data as any }
+    } catch (err: any) {
+      return { status: err?.response?.status as number, data: err?.response?.data as any }
+    }
+  }
+
+  // prepare_form_response returns the token it mints inside fullURL (?token=...). Pulling it out is
+  // the whole point of G24/G25 — that token is what a caller actually receives.
+  const tokenFromURL = (fullURL?: string) => /[?&]token=([^&]+)/.exec(fullURL ?? '')?.[1]
+
+  // Raw PATCH so G15 can assert on the HTTP status; the SDK's parseError discards it.
+  const patchAuthed = async (path: string, body: any, authToken: string) => {
+    try {
+      const res = await axios.patch(`${host}${path}`, body, {
+        headers: { Authorization: `Bearer ${authToken}` },
+        validateStatus: () => true,
+      })
+      return { status: res.status, data: res.data as any }
+    } catch (err: any) {
+      return { status: err?.response?.status as number, data: err?.response?.data as any }
+    }
+  }
+
+  type IntakeFields = { emailField: { id: string, title: string }, phoneField: { id: string, title: string } }
+  const intakeAnswers = (f: IntakeFields, email: string, phone: string) => ([
+    { fieldId: f.emailField.id, fieldTitle: f.emailField.title, answer: { type: 'email' as const, value: email } },
+    { fieldId: f.phoneField.id, fieldTitle: f.phoneField.title, answer: { type: 'phone' as const, value: phone } },
+  ])
+
+  const pollEnduser = async (id: string, landed: (e: Enduser) => boolean, windowMs: number) => {
+    const deadline = Date.now() + windowMs
+    let latest: Enduser | null = null
+    while (true) {
+      latest = await sdk.api.endusers.getOne(id).catch(() => null)
+      if (latest && landed(latest)) return { landed: true, enduser: latest }
+      if (Date.now() >= deadline) return { landed: false, enduser: latest }
+      await sleep(POLL_INTERVAL_MS)
+    }
+  }
+
+  const describe = (e: Enduser | null) => `email=${e?.email || '(unset)'} phone=${e?.phone || '(unset)'}`
+
+  const makeVictim = async (tag: string, fields: Partial<Enduser> = {}) => {
+    const victim = await sdk.api.endusers.createOne({
+      fname: `Lock${RUN}`,
+      lname: `Victim${RUN}${tag}`,
+      dateOfBirth: '01-02-1990',
+      ...fields,
+    } as any)
+    createdEnduserIds.push(victim.id)
+    return victim
+  }
+
+  const VICTIM_SHAPES = [
+    { tag: 'A1', label: 'victim has email + phone', withEmail: true, withPhone: true },
+    { tag: 'A2', label: 'victim email UNSET (load-bearing)', withEmail: false, withPhone: true },
+    { tag: 'A3', label: 'victim phone UNSET', withEmail: true, withPhone: false },
+    { tag: 'A4', label: 'victim email + phone UNSET (load-bearing)', withEmail: false, withPhone: false },
+  ]
+
+  // ---------------------------------------------------------------------------------------------
+  // G1 — Endpoint A: email/phone never written on a matched patient
+  // ---------------------------------------------------------------------------------------------
+  for (const shape of VICTIM_SHAPES) {
+    const name = `A blocks email/phone overwrite — ${shape.label}`
+    await runScenario('G1', name, async () => {
+      const victim = await makeVictim(shape.tag, {
+        ...(shape.withEmail ? { email: emailFor(`lock-v-${shape.tag}`) } : {}),
+        ...(shape.withPhone ? { phone: nextPhone() } : {}),
+      })
+      const attackerEmail = emailFor(`atk-${shape.tag}`)
+      const attackerPhone = nextPhone()
+
+      const session = await startForm({
+        fname: victim.fname,
+        lname: victim.lname,
+        dateOfBirth: victim.dateOfBirth,
+        email: attackerEmail,
+        phone: attackerPhone,
+      })
+
+      // Probe-validity guard: if the handler INSERTED instead of matching, the victim is trivially
+      // unchanged and the test would pass for the wrong reason.
+      if (session.enduserId !== victim.id) {
+        if (session.enduserId) createdEnduserIds.push(session.enduserId)
+        record('G1', name, false, `probe invalid — endpoint inserted ${session.enduserId} instead of matching victim ${victim.id}`)
+        return
+      }
+
+      const { landed, enduser } = await pollEnduser(
+        victim.id,
+        e => e.email === attackerEmail || e.phone === attackerPhone,
+        OVERWRITE_WINDOW_MS,
+      )
+      record('G1', name, !landed, landed
+        ? `EXPLOIT: attacker values landed on victim (${describe(enduser)})`
+        : `unchanged (${describe(enduser)})`
+      )
+    })
+  }
+
+  // ---------------------------------------------------------------------------------------------
+  // G2 — Endpoint B: same rule. B returns only { authToken }, so probe validity is established by
+  // a run-unique lname that must resolve to exactly the victim.
+  // ---------------------------------------------------------------------------------------------
+  for (const shape of VICTIM_SHAPES) {
+    const name = `B blocks email/phone overwrite — ${shape.label}`
+    await runScenario('G2', name, async () => {
+      const victim = await makeVictim(`B${shape.tag}`, {
+        ...(shape.withEmail ? { email: emailFor(`lock-vb-${shape.tag}`) } : {}),
+        ...(shape.withPhone ? { phone: nextPhone() } : {}),
+      })
+      const attackerEmail = emailFor(`atkb-${shape.tag}`)
+      const attackerPhone = nextPhone()
+
+      await startBooking({
+        fname: victim.fname,
+        lname: victim.lname,
+        dateOfBirth: victim.dateOfBirth,
+        email: attackerEmail,
+        phone: attackerPhone,
+      })
+
+      const matching = await sdk.api.endusers.getSome({ filter: { lname: victim.lname } })
+      if (matching.length !== 1 || matching[0].id !== victim.id) {
+        for (const m of matching) if (m.id !== victim.id) createdEnduserIds.push(m.id)
+        record('G2', name, false, `probe invalid — ${matching.length} records match lname ${victim.lname}; endpoint inserted instead of matching`)
+        return
+      }
+
+      const { landed, enduser } = await pollEnduser(
+        victim.id,
+        e => e.email === attackerEmail || e.phone === attackerPhone,
+        AWAITED_WINDOW_MS,
+      )
+      record('G2', name, !landed, landed
+        ? `EXPLOIT: attacker values landed on victim (${describe(enduser)})`
+        : `unchanged (${describe(enduser)})`
+      )
+    })
+  }
+
+  // ---------------------------------------------------------------------------------------------
+  // G3 — Endpoint A with the raw enduserId parameter (findById, no ownership check). Not reachable
+  // as an attack through the first-party frontend, but trivially reachable by POSTing directly.
+  // The field lock must hold on this path too.
+  // ---------------------------------------------------------------------------------------------
+  await runScenario('G3', 'A blocks email/phone overwrite when victim targeted via enduserId', async () => {
+    const victim = await makeVictim('C1') // no email, no phone — the takeover-ready shape
+    const attackerEmail = emailFor('atk-c1')
+    const attackerPhone = nextPhone()
+
+    const session = await startForm({ enduserId: victim.id, email: attackerEmail, phone: attackerPhone })
+
+    if (session.enduserId !== victim.id) {
+      if (session.enduserId) createdEnduserIds.push(session.enduserId)
+      record('G3', 'A blocks email/phone overwrite when victim targeted via enduserId', false,
+        `probe invalid — endpoint returned ${session.enduserId}, expected victim ${victim.id}`)
+      return
+    }
+
+    const { landed, enduser } = await pollEnduser(
+      victim.id,
+      e => e.email === attackerEmail || e.phone === attackerPhone,
+      OVERWRITE_WINDOW_MS,
+    )
+    record('G3', 'A blocks email/phone overwrite when victim targeted via enduserId', !landed, landed
+      ? `EXPLOIT: attacker values landed on victim (${describe(enduser)})`
+      : `unchanged (${describe(enduser)})`
+    )
+  })
+
+  // ---------------------------------------------------------------------------------------------
+  // G4 — The takeover chain itself.
+  //
+  // access_tokens is not readable from a test (written via getInternalQueries(), no schema entry,
+  // no SDK surface) and request-enduser-password-reset returns 204 unconditionally — success,
+  // no-match and throttled alike — so it carries zero signal. Two sound substitutes:
+  //   1. endusers.getSome({ filter: { email: attackerEmail } }) is empty. That is the exact
+  //      predicate the handler gates on (findOne({ email }); if (!enduser) return 204) before
+  //      minting anything, so an empty set proves non-issuance.
+  //   2. begin-enduser-login-flow with the attacker email still returns continue-with-password.
+  //      On a vulnerable server the now-email-bearing, password-less victim flips this to
+  //      sent-email/sent-sms and an OTP is genuinely dispatched to the attacker.
+  // Rate-limit budget: begin_login_flow is 5 / 10 min per identifier and 10 / 60s per IP. Exactly
+  // two calls are made, on the same run-unique identifier. A 429 is recorded as SKIP, not a
+  // failure (reset_db is deliberately NOT called here — it would wipe other suites' fixtures when
+  // this file runs as part of tests.ts).
+  // ---------------------------------------------------------------------------------------------
+  await runScenario('G4', 'takeover chain: email-less victim is not made resolvable by A', async () => {
+    const victim = await makeVictim('D1', { phone: nextPhone() }) // email-less: the common, cheap case
+    const attackerEmail = emailFor('atk-d1')
+
+    const baseline = await post('/v1/begin-enduser-login-flow', { email: attackerEmail, businessId })
+    const baselineResult = baseline.data?.result
+    if (baseline.status === 429) {
+      skip('G4', 'begin_login_flow oracle baseline', 'rate limited (429) — oracle unavailable this run')
+    } else {
+      record('G4', 'begin_login_flow oracle baseline is continue-with-password',
+        baselineResult === 'continue-with-password', `result=${baselineResult} status=${baseline.status}`)
+    }
+
+    const session = await startForm({
+      fname: victim.fname,
+      lname: victim.lname,
+      dateOfBirth: victim.dateOfBirth,
+      email: attackerEmail,
+      phone: nextPhone(),
+    })
+    if (session.enduserId !== victim.id) {
+      if (session.enduserId) createdEnduserIds.push(session.enduserId)
+      record('G4', 'takeover chain: email-less victim is not made resolvable by A', false,
+        `probe invalid — endpoint inserted ${session.enduserId} instead of matching victim ${victim.id}`)
+      return
+    }
+
+    // Burn the fire-and-forget window so a vulnerable server has every chance to land the write.
+    const { enduser } = await pollEnduser(victim.id, e => e.email === attackerEmail, OVERWRITE_WINDOW_MS)
+
+    // Informational only: 204 regardless of outcome.
+    const resetRes = await post('/v1/request-enduser-password-reset', { email: attackerEmail, businessId })
+    console.log(`   (info) request-enduser-password-reset -> HTTP ${resetRes.status} — unconditional, carries no signal`)
+
+    const resolvable = await sdk.api.endusers.getSome({ filter: { email: attackerEmail } })
+    record('G4', 'attacker email resolves to no enduser (password reset cannot be issued)',
+      resolvable.length === 0,
+      resolvable.length === 0
+        ? `no enduser carries ${attackerEmail} (victim still ${describe(enduser)})`
+        : `EXPLOIT: ${resolvable.length} enduser(s) now resolve for ${attackerEmail} — reset token would be minted and mailed to the attacker`
+    )
+
+    const after = await post('/v1/begin-enduser-login-flow', { email: attackerEmail, businessId })
+    const afterResult = after.data?.result
+    if (after.status === 429) {
+      skip('G4', 'begin_login_flow oracle after attack', 'rate limited (429) — oracle unavailable this run')
+    } else {
+      record('G4', 'begin_login_flow still returns continue-with-password after attack',
+        afterResult === 'continue-with-password',
+        afterResult === 'continue-with-password'
+          ? `result=${afterResult}`
+          : `EXPLOIT: result=${afterResult} — an OTP / magic link was dispatched for the attacker's address`
+      )
+    }
+  })
+
+  // ---------------------------------------------------------------------------------------------
+  // G5 — Intended intake behavior preserved: blank match keys still get filled, blank phone does not.
+  // ---------------------------------------------------------------------------------------------
+  await runScenario('G5', 'blank match keys filled on match, blank phone NOT filled', async () => {
+    const victimEmail = emailFor('lock-v-e1')
+    // Matched via the email branch, so the record can start with blank names. Under
+    // matchEmailAndNames that branch also requires fname + lname, so fname/lname must be present
+    // for the match to happen at all — coverage narrows to dateOfBirth/gender in that config.
+    const victim = await sdk.api.endusers.createOne({
+      email: victimEmail,
+      ...(MATCH_EMAIL_AND_NAMES ? { fname: `Lock${RUN}`, lname: `Victim${RUN}E1` } : {}),
+    } as any)
+    createdEnduserIds.push(victim.id)
+    if (MATCH_EMAIL_AND_NAMES) {
+      skip('G5', 'blank fname/lname fill', 'organization has settings.endusers.matchEmailAndNames — a name-less record is unmatchable')
+    }
+
+    const submittedPhone = nextPhone()
+    const session = await startForm({
+      email: victimEmail,
+      fname: `Lock${RUN}`,
+      lname: `Victim${RUN}E1`,
+      dateOfBirth: '03-04-1991',
+      gender: 'Female',
+      phone: submittedPhone,
+    })
+    if (session.enduserId !== victim.id) {
+      if (session.enduserId) createdEnduserIds.push(session.enduserId)
+      record('G5', 'blank match keys filled on match, blank phone NOT filled', false,
+        `probe invalid — endpoint inserted ${session.enduserId} instead of matching victim ${victim.id}`)
+      return
+    }
+
+    const filled = await pollEnduser(
+      victim.id,
+      e => !!e.dateOfBirth && !!e.gender && (MATCH_EMAIL_AND_NAMES || (!!e.fname && !!e.lname)),
+      OVERWRITE_WINDOW_MS,
+    )
+    record('G5', 'blank fname/lname/dateOfBirth/gender still filled on match', filled.landed,
+      `fname=${filled.enduser?.fname || '(unset)'} lname=${filled.enduser?.lname || '(unset)'} `
+      + `dateOfBirth=${filled.enduser?.dateOfBirth || '(unset)'} gender=${filled.enduser?.gender || '(unset)'}`)
+
+    const phoneLanded = await pollEnduser(victim.id, e => !!e.phone, AWAITED_WINDOW_MS)
+    record('G5', 'blank phone still NOT filled on match', !phoneLanded.landed,
+      phoneLanded.landed
+        ? `EXPLOIT: phone=${phoneLanded.enduser?.phone} written into a blank field (submitted ${submittedPhone})`
+        : 'phone remains unset')
+  })
+
+  // ---------------------------------------------------------------------------------------------
+  // G6 — Status-quo pin: state still overwrites on match. This is deliberate, not incidental —
+  // state is not an auth channel, and locking it would break a relocated patient booking with a
+  // provider licensed in their new state.
+  // ---------------------------------------------------------------------------------------------
+  await runScenario('G6', 'state still overwrites on match (status-quo pin)', async () => {
+    const victim = await makeVictim('F1', { email: emailFor('lock-v-f1'), state: 'NY' })
+
+    const session = await startForm({
+      fname: victim.fname,
+      lname: victim.lname,
+      dateOfBirth: victim.dateOfBirth,
+      phone: nextPhone(),
+      state: 'CA',
+    })
+    if (session.enduserId !== victim.id) {
+      if (session.enduserId) createdEnduserIds.push(session.enduserId)
+      record('G6', 'state still overwrites on match (status-quo pin)', false,
+        `probe invalid — endpoint inserted ${session.enduserId} instead of matching victim ${victim.id}`)
+      return
+    }
+
+    const { landed, enduser } = await pollEnduser(victim.id, e => e.state === 'CA', OVERWRITE_WINDOW_MS)
+    record('G6', 'state still overwrites on match (status-quo pin)', landed, `state=${enduser?.state || '(unset)'}`)
+  })
+
+  // ---------------------------------------------------------------------------------------------
+  // G7 — Insert path unchanged: a brand-new visitor is still created with the submitted email/phone.
+  // ---------------------------------------------------------------------------------------------
+  // Accumulator arrays rather than `let ... | null`: values are assigned inside runScenario's
+  // callback, and TS's control-flow narrowing does not account for closure assignments.
+  const formSessions: { accessCode: string, authToken: string, enduserId: string }[] = []
+  await runScenario('G7', 'A creates a new visitor with submitted email + phone', async () => {
+    const email = emailFor('lock-new-a')
+    const phone = nextPhone()
+    const session = await startForm({
+      fname: `Lock${RUN}`, lname: `NewA${RUN}`, dateOfBirth: '05-06-1992', email, phone,
+    })
+    if (session.enduserId) createdEnduserIds.push(session.enduserId)
+
+    const created = await sdk.api.endusers.getOne(session.enduserId)
+    const ok = created.email === email && created.phone === phone
+      && !!session.accessCode && !!session.authToken && !!session.enduserId
+    record('G7', 'A creates a new visitor with submitted email + phone', ok,
+      `${describe(created)}; accessCode=${!!session.accessCode} authToken=${!!session.authToken} enduserId=${!!session.enduserId}`)
+
+    if (ok) formSessions.push(session)
+  })
+
+  const bookingTokens: string[] = []
+  await runScenario('G7', 'B creates a new visitor with submitted email + phone', async () => {
+    const email = emailFor('lock-new-b')
+    const phone = nextPhone()
+    const lname = `NewB${RUN}`
+    const session = await startBooking({
+      fname: `Lock${RUN}`, lname, dateOfBirth: '07-08-1993', email, phone,
+    })
+
+    const matching = await sdk.api.endusers.getSome({ filter: { lname } })
+    for (const m of matching) createdEnduserIds.push(m.id)
+
+    const created = matching.length === 1 ? matching[0] : null
+    const ok = !!session.authToken && !!created && created.email === email && created.phone === phone
+    record('G7', 'B creates a new visitor with submitted email + phone', ok,
+      `authToken=${!!session.authToken}; ${matching.length} record(s); ${describe(created)}`)
+
+    if (session.authToken) bookingTokens.push(session.authToken)
+  })
+
+  // ---------------------------------------------------------------------------------------------
+  // G8 — The returned public-form session still works end-to-end.
+  // ---------------------------------------------------------------------------------------------
+  await runScenario('G8', 'form submission completes under the returned token', async () => {
+    const session = formSessions[0]
+    if (!session) {
+      record('G8', 'form submission completes under the returned token', false, 'no session available from G7')
+      return
+    }
+    const authed = new EnduserSession({ host, businessId, authToken: session.authToken })
+    const { formResponse } = await authed.api.form_responses.submit_form_response({
+      accessCode: session.accessCode,
+      responses: [{
+        fieldId: plainField.id,
+        fieldTitle: plainField.title,
+        answer: { type: 'string' as const, value: `lock test ${RUN}` },
+      }],
+    })
+    record('G8', 'form submission completes under the returned token', !!formResponse?.submittedAt,
+      `formResponse=${formResponse?.id} submittedAt=${formResponse?.submittedAt ? 'set' : '(unset)'}`)
+  })
+
+  // ---------------------------------------------------------------------------------------------
+  // G9 — The returned booking session still works. Tiered: availability is always asserted; an
+  // actual booking is attempted only when a slot exists, so an empty window never reads as a
+  // regression.
+  // ---------------------------------------------------------------------------------------------
+  await runScenario('G9', 'availability + booking work under the returned session', async () => {
+    const bookingAuthToken = bookingTokens[0]
+    if (!bookingAuthToken) {
+      record('G9', 'availability + booking work under the returned session', false, 'no booking session available from G7')
+      return
+    }
+    const booking = new EnduserSession({ host, businessId, authToken: bookingAuthToken })
+    const DAY_IN_MS = 24 * 60 * 60 * 1000
+    const from = new Date(Date.now() + DAY_IN_MS)
+    const to = new Date(from.getTime() + (7 * DAY_IN_MS))
+
+    const { availabilityBlocks } = await booking.api.calendar_events.get_appointment_availability({
+      calendarEventTemplateId: template.id,
+      userIds: [hostUser.id],
+      restrictedByState: false, // the public booking enduser has no state
+      from,
+      to,
+    })
+    const slots = availabilityBlocks.filter(b => b.userId === hostUser.id && b.startTimeInMS > Date.now())
+    record('G9', 'get_appointment_availability succeeds under the confined booking token', true,
+      `${availabilityBlocks.length} block(s), ${slots.length} future slot(s) for the throwaway host`)
+
+    if (slots.length === 0) {
+      skip('G9', 'book_appointment under the confined booking token', 'no future availability slot in the 7-day window')
+      return
+    }
+
+    const { createdEvent } = await booking.api.calendar_events.book_appointment({
+      userId: hostUser.id,
+      calendarEventTemplateId: template.id,
+      startTime: new Date(slots[0].startTimeInMS),
+      timezone: 'America/New_York',
+    })
+    if (createdEvent?.id) createdEventIds.push(createdEvent.id)
+    record('G9', 'book_appointment succeeds under the confined booking token', !!createdEvent?.id,
+      `createdEvent=${createdEvent?.id}`)
+  })
+
+  // ---------------------------------------------------------------------------------------------
+  // G10 — skipMatch behavior unchanged.
+  // ---------------------------------------------------------------------------------------------
+  await runScenario('G10', 'skipMatch=true still inserts a new record', async () => {
+    const victim = await makeVictim('H1', { email: emailFor('lock-v-h1'), phone: nextPhone() })
+
+    const session = await startForm({
+      fname: victim.fname,
+      lname: victim.lname,
+      dateOfBirth: victim.dateOfBirth, // would otherwise match the victim
+      email: emailFor('lock-skip'),
+      phone: nextPhone(),
+      skipMatch: true,
+    })
+    if (session.enduserId) createdEnduserIds.push(session.enduserId)
+    record('G10', 'skipMatch=true still inserts a new record', session.enduserId !== victim.id,
+      `inserted=${session.enduserId} victim=${victim.id}`)
+  })
+
+  await runScenario('G10', 'skipMatch + autoMergeOnSubmission sets eligibleForAutoMerge', async () => {
+    const session = await publicSDK().api.form_responses.session_for_public_form({
+      formId: autoMergeForm.id,
+      businessId,
+      skipMatch: true,
+      fname: `Lock${RUN}`,
+      lname: `Merge${RUN}`,
+      dateOfBirth: '09-10-1994',
+      email: emailFor('lock-merge'),
+      phone: nextPhone(),
+    })
+    if (session.enduserId) createdEnduserIds.push(session.enduserId)
+
+    const created = await sdk.api.endusers.getOne(session.enduserId)
+    record('G10', 'skipMatch + autoMergeOnSubmission sets eligibleForAutoMerge',
+      created.eligibleForAutoMerge === true, `eligibleForAutoMerge=${created.eligibleForAutoMerge}`)
+  })
+
+  // ---------------------------------------------------------------------------------------------
+  // G11 — Intake answers must not overwrite email/phone on a matched patient (submit path).
+  // ---------------------------------------------------------------------------------------------
+  for (const shape of VICTIM_SHAPES) {
+    const name = `intake answers do not overwrite a matched patient — ${shape.label}`
+    await runScenario('G11', name, async () => {
+      const victimEmail = shape.withEmail ? emailFor(`lock-i-${shape.tag}`) : undefined
+      const victimPhone = shape.withPhone ? nextPhone() : undefined
+      const victim = await makeVictim(`I${shape.tag}`, {
+        ...(victimEmail ? { email: victimEmail } : {}),
+        ...(victimPhone ? { phone: victimPhone } : {}),
+      })
+      const attackerEmail = emailFor(`atk-i-${shape.tag}`)
+      const attackerPhone = nextPhone()
+
+      // No email/phone passed to the endpoint at all, so the intake answers below are the only
+      // possible source of a change to the victim's contact info.
+      const session = await startFormOn(intake.form.id, {
+        fname: victim.fname, lname: victim.lname, dateOfBirth: victim.dateOfBirth,
+      })
+      if (session.enduserId) createdEnduserIds.push(session.enduserId)
+      if (session.enduserId !== victim.id) {
+        record('G11', name, false,
+          `probe invalid — endpoint inserted ${session.enduserId} instead of matching victim ${victim.id}`)
+        return
+      }
+
+      await asEnduser(session.authToken).api.form_responses.submit_form_response({
+        accessCode: session.accessCode,
+        responses: intakeAnswers(intake, attackerEmail, attackerPhone),
+      })
+
+      const { enduser } = await pollEnduser(
+        victim.id,
+        e => e.email === attackerEmail || e.phone === attackerPhone,
+        OVERWRITE_WINDOW_MS,
+      )
+      const emailHeld = (enduser?.email || undefined) === victimEmail
+      const phoneHeld = (enduser?.phone || undefined) === victimPhone
+      record('G11', `${name} — email`, emailHeld,
+        emailHeld
+          ? `email still ${victimEmail || '(unset)'}`
+          : `EXPLOIT: intake answer wrote ${enduser?.email} (was ${victimEmail || '(unset)'})`)
+      record('G11', `${name} — phone`, phoneHeld,
+        phoneHeld
+          ? `phone still ${victimPhone || '(unset)'}`
+          : `EXPLOIT: intake answer wrote ${enduser?.phone} (was ${victimPhone || '(unset)'})`)
+    })
+  }
+
+  // ---------------------------------------------------------------------------------------------
+  // G12 — Same bypass via save_field_response, without ever submitting the form.
+  // ---------------------------------------------------------------------------------------------
+  const G12_NAME = 'saveIntakeOnPartial answers do not overwrite a matched patient'
+  await runScenario('G12', G12_NAME, async () => {
+    const victim = await makeVictim('J1', { phone: nextPhone() }) // email-less: the load-bearing shape
+    const attackerEmail = emailFor('atk-j1')
+
+    const session = await startFormOn(partialIntake.form.id, {
+      fname: victim.fname, lname: victim.lname, dateOfBirth: victim.dateOfBirth,
+    })
+    if (session.enduserId) createdEnduserIds.push(session.enduserId)
+    if (session.enduserId !== victim.id) {
+      record('G12', G12_NAME, false,
+        `probe invalid — endpoint inserted ${session.enduserId} instead of matching victim ${victim.id}`)
+      return
+    }
+
+    // No submit at all: for fields carrying options.saveIntakeOnPartial, save_field_response alone
+    // triggers the intake write.
+    await asEnduser(session.authToken).api.form_responses.save_field_response({
+      accessCode: session.accessCode,
+      response: {
+        fieldId: partialIntake.emailField.id,
+        fieldTitle: partialIntake.emailField.title,
+        answer: { type: 'email' as const, value: attackerEmail },
+      },
+    })
+
+    const { enduser } = await pollEnduser(victim.id, e => e.email === attackerEmail, OVERWRITE_WINDOW_MS)
+    record('G12', G12_NAME, !enduser?.email,
+      !enduser?.email
+        ? 'email still (unset) after partial save'
+        : `EXPLOIT: partial save wrote ${enduser?.email} without ever submitting the form`)
+  })
+
+  // ---------------------------------------------------------------------------------------------
+  // G13 — The full takeover chain, driven through an intake answer instead of the endpoint.
+  // ---------------------------------------------------------------------------------------------
+  const G13_NAME = 'takeover chain via intake answer: victim not made resolvable'
+  await runScenario('G13', G13_NAME, async () => {
+    const victim = await makeVictim('K1', { phone: nextPhone() })
+    const attackerEmail = emailFor('atk-k1')
+
+    const session = await startFormOn(intake.form.id, {
+      fname: victim.fname, lname: victim.lname, dateOfBirth: victim.dateOfBirth,
+    })
+    if (session.enduserId) createdEnduserIds.push(session.enduserId)
+    if (session.enduserId !== victim.id) {
+      record('G13', G13_NAME, false,
+        `probe invalid — endpoint inserted ${session.enduserId} instead of matching victim ${victim.id}`)
+      return
+    }
+
+    await asEnduser(session.authToken).api.form_responses.submit_form_response({
+      accessCode: session.accessCode,
+      responses: intakeAnswers(intake, attackerEmail, nextPhone()),
+    })
+    const { enduser } = await pollEnduser(victim.id, e => e.email === attackerEmail, OVERWRITE_WINDOW_MS)
+
+    // Informational only: 204 regardless of outcome.
+    const resetRes = await post('/v1/request-enduser-password-reset', { email: attackerEmail, businessId })
+    console.log(`   (info) request-enduser-password-reset -> HTTP ${resetRes.status} — unconditional, carries no signal`)
+
+    const resolvable = await sdk.api.endusers.getSome({ filter: { email: attackerEmail } })
+    record('G13', 'attacker email resolves to no enduser after intake submit',
+      resolvable.length === 0,
+      resolvable.length === 0
+        ? `no enduser carries ${attackerEmail} (victim still ${describe(enduser)})`
+        : `EXPLOIT: ${resolvable.length} enduser(s) now resolve for ${attackerEmail} — reset token would be mailed to the attacker`)
+
+    const after = await post('/v1/begin-enduser-login-flow', { email: attackerEmail, businessId })
+    const afterResult = after.data?.result
+    if (after.status === 429) {
+      skip('G13', 'begin_login_flow oracle after intake attack', 'rate limited (429) — oracle unavailable this run')
+    } else {
+      record('G13', 'begin_login_flow still returns continue-with-password after intake attack',
+        afterResult === 'continue-with-password',
+        afterResult === 'continue-with-password'
+          ? `result=${afterResult}`
+          : `EXPLOIT: result=${afterResult} — an OTP / magic link was dispatched for the attacker's address`)
+    }
+  })
+
+  // ---------------------------------------------------------------------------------------------
+  // G14 — Pivot: a public session can prepare a response for a NON-public form and submit that.
+  // ---------------------------------------------------------------------------------------------
+  const G14_NAME = 'pivot via prepare_form_response to a non-public form is also blocked'
+  await runScenario('G14', G14_NAME, async () => {
+    const victimPhone = nextPhone()
+    const victim = await makeVictim('L1', { phone: victimPhone })
+    const attackerEmail = emailFor('atk-l1')
+    const attackerPhone = nextPhone()
+
+    const session = await startFormOn(intake.form.id, {
+      fname: victim.fname, lname: victim.lname, dateOfBirth: victim.dateOfBirth,
+    })
+    if (session.enduserId) createdEnduserIds.push(session.enduserId)
+    if (session.enduserId !== victim.id) {
+      record('G14', G14_NAME, false,
+        `probe invalid — endpoint inserted ${session.enduserId} instead of matching victim ${victim.id}`)
+      return
+    }
+
+    const authed = asEnduser(session.authToken)
+    // prepare_form_response is in the 'public-form' session scope and does not require allowPublicURL.
+    // enduserId === session id, so its ownership check passes.
+    const prepared = await authed.api.form_responses.prepare_form_response({
+      formId: pivotIntake.form.id,
+      enduserId: victim.id,
+    })
+    await authed.api.form_responses.submit_form_response({
+      accessCode: prepared.accessCode,
+      responses: intakeAnswers(pivotIntake, attackerEmail, attackerPhone),
+    })
+
+    const { enduser } = await pollEnduser(
+      victim.id,
+      e => e.email === attackerEmail || e.phone === attackerPhone,
+      OVERWRITE_WINDOW_MS,
+    )
+    record('G14', `${G14_NAME} — email`, !enduser?.email,
+      !enduser?.email
+        ? 'email still (unset) after pivot submit'
+        : `EXPLOIT: pivot to a non-public form wrote ${enduser?.email}`)
+    record('G14', `${G14_NAME} — phone`, enduser?.phone === victimPhone,
+      enduser?.phone === victimPhone
+        ? `phone still ${victimPhone}`
+        : `EXPLOIT: pivot to a non-public form wrote ${enduser?.phone} (was ${victimPhone})`)
+  })
+
+  // ---------------------------------------------------------------------------------------------
+  // G15 — save_field_response ownership: a guessable formResponseId must not reach another patient.
+  // ---------------------------------------------------------------------------------------------
+  const G15_NAME = "save_field_response rejects another patient's formResponseId"
+  await runScenario('G15', G15_NAME, async () => {
+    const patientA = await makeVictim('M1', { phone: nextPhone() })
+    const patientB = await makeVictim('M2', { phone: nextPhone() })
+
+    const sessionA = await startFormOn(partialIntake.form.id, {
+      fname: patientA.fname, lname: patientA.lname, dateOfBirth: patientA.dateOfBirth,
+    })
+    if (sessionA.enduserId) createdEnduserIds.push(sessionA.enduserId)
+    if (sessionA.enduserId !== patientA.id) {
+      record('G15', G15_NAME, false,
+        `probe invalid — endpoint inserted ${sessionA.enduserId} instead of matching patient A ${patientA.id}`)
+      return
+    }
+
+    // Patient B's in-progress response, created by staff.
+    const bPrepared = await sdk.api.form_responses.prepare_form_response({
+      formId: partialIntake.form.id, enduserId: patientB.id,
+    })
+    const bResponseId = (bPrepared.response as any)?.id ?? (bPrepared.response as any)?._id
+
+    const answer = {
+      fieldId: partialIntake.emailField.id,
+      fieldTitle: partialIntake.emailField.title,
+      answer: { type: 'email' as const, value: emailFor('atk-m1') },
+    }
+
+    const byId = await patchAuthed(
+      '/v1/save-field-response',
+      { formResponseId: bResponseId, response: answer },
+      sessionA.authToken,
+    )
+    record('G15', G15_NAME, byId.status === 403,
+      byId.status === 403
+        ? 'HTTP 403 as expected'
+        : `EXPLOIT: HTTP ${byId.status} — patient A wrote into patient B's in-progress response`)
+
+    // The accessCode path stays open by design: the code is a 32-byte secret, so holding it IS the
+    // authorization (same model as submit_form_response). Pinned so the distinction is deliberate.
+    const byCode = await patchAuthed(
+      '/v1/save-field-response',
+      { accessCode: bPrepared.accessCode, response: answer },
+      sessionA.authToken,
+    )
+    record('G15', 'save_field_response still accepts a known accessCode', byCode.status === 200,
+      `HTTP ${byCode.status}`)
+
+    // A guessed formResponseId paired with a WRONG accessCode must still be rejected — otherwise
+    // supplying any junk code would defeat the ownership check.
+    const byIdWrongCode = await patchAuthed(
+      '/v1/save-field-response',
+      { formResponseId: bResponseId, accessCode: 'not-a-real-access-code', response: answer },
+      sessionA.authToken,
+    )
+    record('G15', "another patient's formResponseId + wrong accessCode is rejected",
+      byIdWrongCode.status === 403, `HTTP ${byIdWrongCode.status}`)
+
+    // THE REAL UI SHAPE: the form hooks always send accessCode AND formResponseId together
+    // (react/components/src/Forms/hooks.tsx), and formResponseId wins the server-side lookup. Patient
+    // A saving their OWN in-progress response this way must keep working — a naive
+    // "reject whenever formResponseId is present" guard would break every live form.
+    const [aResponse] = await sdk.api.form_responses.getSome({ filter: { accessCode: sessionA.accessCode } })
+    const ownBoth = await patchAuthed(
+      '/v1/save-field-response',
+      {
+        formResponseId: aResponse?.id,
+        accessCode: sessionA.accessCode,
+        response: {
+          fieldId: partialIntake.emailField.id,
+          fieldTitle: partialIntake.emailField.title,
+          answer: { type: 'email' as const, value: emailFor('own-both') },
+        },
+      },
+      sessionA.authToken,
+    )
+    record('G15', 'own response with accessCode + formResponseId still succeeds (real UI shape)',
+      ownBoth.status === 200,
+      ownBoth.status === 200 ? 'HTTP 200' : `REGRESSION: HTTP ${ownBoth.status} — this is how the form UI calls it`)
+  })
+
+  // ---------------------------------------------------------------------------------------------
+  // G16 — No-regression: the intake path is the ONLY source of contact info for a new visitor.
+  // This is the intakeEmailHidden / intakePhone:'hidden' configuration, and the reason the lock is
+  // scoped to "matched a pre-existing patient" rather than "any public session".
+  // ---------------------------------------------------------------------------------------------
+  await runScenario('G16', 'brand-new visitor still gets email/phone from intake answers', async () => {
+    const submittedEmail = emailFor('lock-new-intake')
+    const submittedPhone = nextPhone()
+
+    const session = await startFormOn(intake.form.id, {
+      fname: `Lock${RUN}`, lname: `NewIntake${RUN}`, dateOfBirth: '05-06-1992',
+    })
+    if (session.enduserId) createdEnduserIds.push(session.enduserId)
+
+    const created = await sdk.api.endusers.getOne(session.enduserId)
+    record('G16', 'new visitor starts with no contact info from the endpoint',
+      !created.email && !created.phone, describe(created))
+
+    await asEnduser(session.authToken).api.form_responses.submit_form_response({
+      accessCode: session.accessCode,
+      responses: intakeAnswers(intake, submittedEmail, submittedPhone),
+    })
+
+    const { enduser } = await pollEnduser(session.enduserId, e => !!e.email && !!e.phone, AWAITED_WINDOW_MS)
+    record('G16', 'brand-new visitor still gets email from intake answers',
+      enduser?.email === submittedEmail, `email=${enduser?.email || '(unset)'} expected=${submittedEmail}`)
+    record('G16', 'brand-new visitor still gets phone from intake answers',
+      enduser?.phone === submittedPhone, `phone=${enduser?.phone || '(unset)'} expected=${submittedPhone}`)
+  })
+
+  // ---------------------------------------------------------------------------------------------
+  // G17 — No-regression: a fully authenticated (non-public) portal session may still self-update.
+  // ---------------------------------------------------------------------------------------------
+  await runScenario('G17', 'authenticated portal enduser can still self-update via intake', async () => {
+    const patient = await makeVictim('N1', { email: emailFor('lock-n1'), phone: nextPhone() })
+    const newEmail = emailFor('lock-n1-new')
+    const newPhone = nextPhone()
+
+    // generate_auth_token rather than .authenticate — repeated logins hit the rate limiter.
+    const portalSDK = new EnduserSession({ host, businessId })
+    await authenticate_enduser_via_token(sdk, portalSDK, { id: patient.id })
+
+    const prepared = await sdk.api.form_responses.prepare_form_response({
+      formId: intake.form.id, enduserId: patient.id,
+    })
+    await portalSDK.api.form_responses.submit_form_response({
+      accessCode: prepared.accessCode,
+      responses: intakeAnswers(intake, newEmail, newPhone),
+    })
+
+    const { enduser } = await pollEnduser(patient.id, e => e.email === newEmail, AWAITED_WINDOW_MS)
+    record('G17', 'authenticated portal intake still updates email', enduser?.email === newEmail,
+      `email=${enduser?.email || '(unset)'} expected=${newEmail}`)
+    record('G17', 'authenticated portal intake still updates phone', enduser?.phone === newPhone,
+      `phone=${enduser?.phone || '(unset)'} expected=${newPhone}`)
+  })
+
+  // ---------------------------------------------------------------------------------------------
+  // G18 — No-regression: staff submitting on a patient's behalf may still set email/phone.
+  // ---------------------------------------------------------------------------------------------
+  await runScenario('G18', 'staff intake submission still updates email/phone', async () => {
+    const patient = await makeVictim('O1', { email: emailFor('lock-o1'), phone: nextPhone() })
+    const newEmail = emailFor('lock-o1-new')
+    const newPhone = nextPhone()
+
+    const prepared = await sdk.api.form_responses.prepare_form_response({
+      formId: intake.form.id, enduserId: patient.id,
+    })
+    await sdk.api.form_responses.submit_form_response({
+      accessCode: prepared.accessCode,
+      responses: intakeAnswers(intake, newEmail, newPhone),
+    })
+
+    const { enduser } = await pollEnduser(patient.id, e => e.email === newEmail, AWAITED_WINDOW_MS)
+    record('G18', 'staff intake submission still updates email', enduser?.email === newEmail,
+      `email=${enduser?.email || '(unset)'} expected=${newEmail}`)
+    record('G18', 'staff intake submission still updates phone', enduser?.phone === newPhone,
+      `phone=${enduser?.phone || '(unset)'} expected=${newPhone}`)
+  })
+
+  // ---------------------------------------------------------------------------------------------
+  // G19 / G20 — Cross-patient session via a null fname/lname match.
+  //
+  // In both handlers' $or, `email` and `dateOfBirth` get `|| "never"` sentinels but fname/lname are
+  // interpolated RAW. `ignoreUndefined` is not set on the Mongo client (database.ts connect options;
+  // driver 5.7.0 defaults it to false), and findOne does not strip undefined keys — so an absent
+  // fname serializes to `{fname: null}`, which matches every document where the field is null OR
+  // MISSING. fname/lname have no schema initializer, so a cold-started enduser has them absent.
+  //
+  // Net: a request supplying ONLY dateOfBirth queries {fname: null, lname: null, dateOfBirth: X} and
+  // can match another patient, returning a session scoped to THEIR record. The cold-start pattern is
+  // what manufactures nameless endusers, and a later intakeField: 'dateOfBirth' question fills the DOB.
+  // ---------------------------------------------------------------------------------------------
+
+  // dateOfBirth is only string-validated and the handlers merely trim it, so a run-tokenized value is
+  // accepted. Deliberately opaque rather than date-shaped, so match-vs-insert is unambiguous even when
+  // this file runs inside the full suite (no reset_db between files).
+  const namelessDob = `01-02-1990-${RUN}`
+
+  const makeNamelessVictim = async (tag: string) => {
+    // No fname/lname at all — those fields have no initializer, so the keys stay ABSENT (not ''),
+    // which is precisely what {fname: null} null-matches.
+    const victim = await sdk.api.endusers.createOne({ dateOfBirth: `${namelessDob}-${tag}` } as any)
+    createdEnduserIds.push(victim.id)
+    const stored = await sdk.api.endusers.getOne(victim.id)
+    return { victim, stored }
+  }
+
+  const G19_NAME = 'DOB-only request does not hijack a nameless patient (form endpoint)'
+  await runScenario('G19', G19_NAME, async () => {
+    const { victim, stored } = await makeNamelessVictim('f')
+
+    // Probe validity: a stored '' would not be null-matched and would make this test vacuous.
+    record('G19', 'nameless victim really has absent fname/lname (probe validity)',
+      stored.fname === undefined && stored.lname === undefined,
+      `fname=${JSON.stringify(stored.fname)} lname=${JSON.stringify(stored.lname)}`)
+
+    // Only dateOfBirth. No names, no email/phone, no skipMatch. Reachable because the intake fixture
+    // sets intakePhone: 'hidden', which satisfies the endpoint's phone guard.
+    const session = await startFormOn(intake.form.id, { dateOfBirth: stored.dateOfBirth })
+    if (session.enduserId) createdEnduserIds.push(session.enduserId)
+
+    record('G19', G19_NAME, session.enduserId !== victim.id,
+      session.enduserId !== victim.id
+        ? `inserted a new record (${session.enduserId}) instead of matching the victim`
+        : `EXPLOIT: returned a session for the victim's record ${victim.id} from a DOB-only request`)
+  })
+
+  const G20_NAME = 'DOB-only request does not hijack a nameless patient (booking endpoint)'
+  await runScenario('G20', G20_NAME, async () => {
+    const { victim, stored } = await makeNamelessVictim('b')
+    const dob = stored.dateOfBirth!
+
+    // The booking endpoint has no skipMatch option and no phone guard at all, so this filter is
+    // reached unconditionally. It returns only { authToken }, so detect match-vs-insert by counting
+    // records carrying this run-unique DOB.
+    await startBooking({ dateOfBirth: dob })
+
+    const withDob = await sdk.api.endusers.getSome({ filter: { dateOfBirth: dob } })
+    withDob.forEach(e => { if (e.id !== victim.id) createdEnduserIds.push(e.id) })
+
+    record('G20', G20_NAME, withDob.length > 1,
+      withDob.length > 1
+        ? `inserted a new record (${withDob.length} total with this DOB) instead of matching the victim`
+        : `EXPLOIT: matched the victim's record ${victim.id} from a DOB-only request — a booking session was issued for it`)
+  })
+
+  // ---------------------------------------------------------------------------------------------
+  // G21 — The match sentinel must never be stored as a patient's name.
+  // Guard rail on the fix: the fallback belongs in the filter literal only, never written into
+  // enduserInfo (which is spread into both the enduser insert and the form_responses record).
+  // ---------------------------------------------------------------------------------------------
+  await runScenario('G21', 'match sentinel never leaks into stored fname/lname', async () => {
+    const session = await startFormOn(intake.form.id, { dateOfBirth: `${namelessDob}-sentinel` })
+    if (session.enduserId) createdEnduserIds.push(session.enduserId)
+
+    const created = await sdk.api.endusers.getOne(session.enduserId)
+    const leaked = (v: any) => v === '__never__' || v === 'never'
+    record('G21', 'created enduser fname/lname are not the sentinel',
+      !leaked(created.fname) && !leaked(created.lname),
+      `fname=${JSON.stringify(created.fname)} lname=${JSON.stringify(created.lname)}`)
+
+    const [response] = await sdk.api.form_responses.getSome({ filter: { accessCode: session.accessCode } })
+    record('G21', 'form_responses fname/lname are not the sentinel',
+      !leaked(response?.fname) && !leaked(response?.lname),
+      `fname=${JSON.stringify(response?.fname)} lname=${JSON.stringify(response?.lname)}`)
+  })
+
+  // ---------------------------------------------------------------------------------------------
+  // G22 — The cold-start pattern: a public form started with NO intake info, which just creates an
+  // Enduser with an ID. Intake answers (including the authentication fields email/phone) must still
+  // populate that fresh record — the lock is scoped to "matched a pre-existing patient", not to
+  // "any public session", precisely so this keeps working.
+  // ---------------------------------------------------------------------------------------------
+  const coldStartCase = async (label: string, args: any) => {
+    const group = 'G22'
+    const submittedEmail = emailFor(`cold-${label}`)
+    const submittedPhone = nextPhone()
+
+    const session = await startFormOn(intake.form.id, args)
+    if (session.enduserId) createdEnduserIds.push(session.enduserId)
+
+    const created = await sdk.api.endusers.getOne(session.enduserId)
+    record(group, `${label}: cold start creates a bare enduser`,
+      !created.email && !created.phone && !!session.enduserId, describe(created))
+
+    await asEnduser(session.authToken).api.form_responses.submit_form_response({
+      accessCode: session.accessCode,
+      responses: intakeAnswers(intake, submittedEmail, submittedPhone),
+    })
+
+    const { enduser } = await pollEnduser(session.enduserId, e => !!e.email && !!e.phone, AWAITED_WINDOW_MS)
+    record(group, `${label}: intake email (an auth field) still populates the cold-started record`,
+      enduser?.email === submittedEmail, `email=${enduser?.email || '(unset)'} expected=${submittedEmail}`)
+    record(group, `${label}: intake phone (an auth field) still populates the cold-started record`,
+      enduser?.phone === submittedPhone, `phone=${enduser?.phone || '(unset)'} expected=${submittedPhone}`)
+  }
+
+  // The shape the real webapp sends (public_form.tsx handleNoIntakeRedirect): nothing but ids.
+  await runScenario('G22', 'cold start with skipMatch (real webapp shape)',
+    () => coldStartCase('skipMatch', { skipMatch: true }))
+  // And the same with no skipMatch, which still cannot match: the email branch needs email === "never"
+  // (unstorable) and the name branch needs dateOfBirth === "never" literally.
+  await runScenario('G22', 'cold start without skipMatch',
+    () => coldStartCase('no-skipMatch', {}))
+
+  // ---------------------------------------------------------------------------------------------
+  // G23 — businessId must be required on session_for_public_form.
+  //
+  // addPublicEndpoint overwrites the schema's `required: true` for businessId with
+  // mongoIdStringOptional (routing.ts, and its own "todo: make businessId required"), and TypeScript
+  // cannot catch it because CustomAction declares businessId as a non-optional string.
+  //
+  // A falsy businessId then leaves restrictAccess as the IDENTITY function in
+  // buildAllQueries/buildOrganizationWideQueries (database.ts): the tenant clause is not appended at
+  // all, so every query in the handler runs across ALL tenants. It fails OPEN, which is worse than
+  // matching nothing. login_enduser signs the JWT from enduser.businessId, not from the request, so
+  // the returned token is a fully valid session on whatever record matched.
+  //
+  // session_for_public_appointment_booking already guards this (its own comment says the schema
+  // cannot enforce it); this endpoint did not. Note the sentinel fix in G19/G20 does NOT cover this:
+  // sentinels constrain which record shapes the filter can match, not which tenants it searches.
+  // ---------------------------------------------------------------------------------------------
+  const G23_NAME = 'session_for_public_form requires businessId'
+  await runScenario('G23', G23_NAME, async () => {
+    const victim = await makeVictim('P1', { email: emailFor('lock-bizid'), phone: nextPhone() })
+
+    // (a) THE ISSUE. Omit businessId entirely and name the patient directly via enduserId, which
+    // reaches an untenanted findById — no name/DOB guessing required. Pre-fix this hands back a
+    // working session for that patient; post-fix it must 400 before touching the database.
+    const omitted = await post('/v1/session-for-public-form', {
+      formId: intake.form.id,
+      enduserId: victim.id,
+    })
+    if (omitted.data?.enduserId) createdEnduserIds.push(omitted.data.enduserId)
+
+    const blocked = omitted.status === 400 && omitted.data?.message === 'businessId is required'
+    record('G23', `${G23_NAME} — omitted businessId is rejected`, blocked,
+      blocked
+        ? 'HTTP 400 businessId is required'
+        : `EXPLOIT: HTTP ${omitted.status} — got enduserId=${omitted.data?.enduserId} authToken=${!!omitted.data?.authToken} for victim ${victim.id} with NO businessId, i.e. tenant filtering was disabled entirely`)
+
+    // (b) Contrast probe: a well-formed but WRONG businessId must not reach the patient. This is what
+    // proves (a) is caused by the missing tenant clause rather than by the lookup always failing.
+    const wrongBiz = await post('/v1/session-for-public-form', {
+      formId: intake.form.id,
+      enduserId: victim.id,
+      businessId: '000000000000000000000001',
+    })
+    record('G23', `${G23_NAME} — a wrong businessId cannot reach the patient`,
+      wrongBiz.status !== 200 && wrongBiz.data?.enduserId !== victim.id,
+      `HTTP ${wrongBiz.status} ${JSON.stringify(wrongBiz.data?.message ?? wrongBiz.data?.enduserId ?? '')}`)
+
+    // (c) Malformed businessId. The router's own mongoIdStringOptional already rejects this, so this
+    // pins that the guard's second clause does not regress the rejection.
+    const badBiz = await post('/v1/session-for-public-form', {
+      formId: intake.form.id,
+      enduserId: victim.id,
+      businessId: 'not-a-mongo-id',
+    })
+    record('G23', `${G23_NAME} — a malformed businessId is rejected`, badBiz.status === 400,
+      `HTTP ${badBiz.status} ${JSON.stringify(badBiz.data?.message ?? '')}`)
+  })
+
+  // ---------------------------------------------------------------------------------------------
+  // G24 / G25 — The token prepare_form_response mints drops `fromPublicSession`.
+  //
+  // The lock in prepare_form_response keys off session.fromPublicSession, but the token it mints
+  // preserved the session's confinement WITHOUT that flag and handed it back in fullURL (?token=...).
+  // Since prepare_form_response is itself in the 'public-form' session scope, a caller can hop twice:
+  // the first hop's response is locked, the second hop's is not — because by then the session no longer
+  // looks like a public one. Submitting an intakeField: 'email' answer against that second response
+  // then repoints the victim's login channel.
+  //
+  // The same flag also gates PHI on refresh_session (G25): when it is falsy the handler returns
+  // redact_field(enduser, 'hashedPassword') — the whole record — instead of just assignedTo.
+  // ---------------------------------------------------------------------------------------------
+  const chainForVictim = async (tag: string, victim: Enduser) => {
+    const t1 = await startFormOn(intake.form.id, {
+      fname: victim.fname, lname: victim.lname, dateOfBirth: victim.dateOfBirth,
+    })
+    if (t1.enduserId) createdEnduserIds.push(t1.enduserId)
+    if (t1.enduserId !== victim.id) return { matched: false as const, t1, t2: undefined, hop1: undefined }
+
+    const hop1 = await asEnduser(t1.authToken).api.form_responses.prepare_form_response({
+      formId: pivotIntake.form.id, enduserId: victim.id,
+    } as any)
+    return { matched: true as const, t1, hop1, t2: tokenFromURL((hop1 as any)?.fullURL) }
+  }
+
+  const G24_NAME = 'chained prepare_form_response session stays locked'
+  await runScenario('G24', G24_NAME, async () => {
+    const victimEmail = emailFor('lock-q1')
+    const victim = await makeVictim('Q1', { email: victimEmail, phone: nextPhone() })
+    const attackerEmail = emailFor('atk-q1')
+
+    const { matched, t2 } = await chainForVictim('Q1', victim as Enduser)
+    if (!matched) {
+      record('G24', G24_NAME, false, `probe invalid — first hop did not match victim ${victim.id}`)
+      return
+    }
+    record('G24', 'chained token is returned in fullURL (probe validity)', !!t2, `token extracted=${!!t2}`)
+    if (!t2) return
+
+    // Second hop, using the token the first hop handed back.
+    const hop2 = await asEnduser(t2).api.form_responses.prepare_form_response({
+      formId: pivotIntake.form.id, enduserId: victim.id,
+    } as any)
+    record('G24', 'second-hop prepare succeeds (probe validity)', !!hop2?.accessCode,
+      `accessCode=${!!hop2?.accessCode}`)
+    if (!hop2?.accessCode) return
+
+    const [hop2Response] = await sdk.api.form_responses.getSome({ filter: { accessCode: hop2.accessCode } })
+    record('G24', `${G24_NAME} — second-hop response carries the lock`,
+      (hop2Response as any)?.authFieldIntakeDisabled === true,
+      `authFieldIntakeDisabled=${JSON.stringify((hop2Response as any)?.authFieldIntakeDisabled)}`)
+
+    // The assertion that actually matters: does the victim's login channel move?
+    await asEnduser(t2).api.form_responses.submit_form_response({
+      accessCode: hop2.accessCode,
+      responses: intakeAnswers(pivotIntake, attackerEmail, nextPhone()),
+    })
+    const { enduser } = await pollEnduser(victim.id, e => e.email === attackerEmail, OVERWRITE_WINDOW_MS)
+    record('G24', `${G24_NAME} — victim email unchanged after chained submit`,
+      enduser?.email === victimEmail,
+      enduser?.email === victimEmail
+        ? `email still ${victimEmail}`
+        : `EXPLOIT: chained session wrote ${enduser?.email} via an intake answer`)
+  })
+
+  const G25_NAME = 'chained session does not expose the enduser record on refresh'
+  await runScenario('G25', G25_NAME, async () => {
+    const victim = await makeVictim('R1', { email: emailFor('lock-r1'), phone: nextPhone() })
+    const { matched, t1, t2 } = await chainForVictim('R1', victim as Enduser)
+    if (!matched) {
+      record('G25', G25_NAME, false, `probe invalid — first hop did not match victim ${victim.id}`)
+      return
+    }
+
+    const PHI_KEYS = ['email', 'phone', 'dateOfBirth', 'fname', 'lname'] as const
+    const leakedIn = (body: any) => PHI_KEYS.filter(k => (body?.enduser ?? {})[k] !== undefined)
+
+    // Control: the ORIGINAL public token must already withhold. If this fails the test proves nothing.
+    const base = await postAuthed('/v1/refresh-enduser-session', {}, t1.authToken)
+    record('G25', 'baseline: original public token withholds the record (control)',
+      base.status === 200 && leakedIn(base.data).length === 0,
+      `HTTP ${base.status} leaked=[${leakedIn(base.data).join(', ')}]`)
+
+    if (!t2) { record('G25', G25_NAME, false, 'probe invalid — no chained token'); return }
+    const chained = await postAuthed('/v1/refresh-enduser-session', {}, t2)
+    const leaked = leakedIn(chained.data)
+    record('G25', G25_NAME, chained.status === 200 && leaked.length === 0,
+      leaked.length === 0
+        ? `HTTP ${chained.status}, no PHI fields returned`
+        : `EXPLOIT: refresh under the chained token returned [${leaked.join(', ')}] for victim ${victim.id}`)
+  })
+
+  // ---------------------------------------------------------------------------------------------
+  // G26 — Auto-merge re-points the response after the lock was computed.
+  //
+  // authFieldIntakeDisabled is a snapshot taken at session start (`!!existing`). With skipMatch it is
+  // correctly false, because a fresh record really was inserted. But on submission
+  // resolveAutoMergeBeforeSubmission repoints the response at a PRE-EXISTING patient and persists only
+  // enduserId — so the intake write later reads a stale `false` and lands email/phone on the victim.
+  // The merge matches on { fname, lname, dateOfBirth }, so the attacker never needs to know the
+  // victim's email or phone.
+  //
+  // performAutoMerge copies no demographic fields itself, so the intake write is the only channel —
+  // which is why the custom-field assertion below is essential: it proves the write RAN, so "email
+  // unchanged" cannot pass just because nothing happened.
+  // ---------------------------------------------------------------------------------------------
+  const G26_NAME = 'auto-merge does not let an intake answer repoint the merged patient'
+  await runScenario('G26', G26_NAME, async () => {
+    const victimEmail = emailFor('lock-s1')
+    const victimPhone = nextPhone()
+    const victimDob = '07-08-1988'
+    const victim = await sdk.api.endusers.createOne({
+      fname: `Lock${RUN}`,
+      lname: `Merge${RUN}S1`,
+      dateOfBirth: victimDob,
+      email: victimEmail,
+      phone: victimPhone,
+    } as any)
+    createdEnduserIds.push(victim.id)
+    const attackerEmail = emailFor('atk-s1')
+
+    // skipMatch inserts a fresh record and flags it eligibleForAutoMerge.
+    const session = await startFormOn(autoMergeIntake.form.id, { skipMatch: true })
+    if (session.enduserId) createdEnduserIds.push(session.enduserId)
+    const sourceId = session.enduserId
+
+    const f = autoMergeIntake
+    await asEnduser(session.authToken).api.form_responses.submit_form_response({
+      accessCode: session.accessCode,
+      responses: [
+        { fieldId: f.fname.id, fieldTitle: f.fname.title, answer: { type: 'string' as const, value: victim.fname } },
+        { fieldId: f.lname.id, fieldTitle: f.lname.title, answer: { type: 'string' as const, value: victim.lname } },
+        { fieldId: f.dateOfBirth.id, fieldTitle: f.dateOfBirth.title, answer: { type: 'dateString' as const, value: victimDob } },
+        { fieldId: f.email.id, fieldTitle: f.email.title, answer: { type: 'email' as const, value: attackerEmail } },
+        { fieldId: f.custom.id, fieldTitle: f.custom.title, answer: { type: 'string' as const, value: 'merged-ok' } },
+      ] as any,
+    })
+
+    const { enduser: after } = await pollEnduser(victim.id, e => e.email === attackerEmail, OVERWRITE_WINDOW_MS)
+
+    const merged = (after?.mergedIds ?? []).includes(sourceId)
+    record('G26', 'auto-merge actually resolved to the victim (probe validity)', merged,
+      `mergedIds=${JSON.stringify(after?.mergedIds)} source=${sourceId}`)
+
+    const customLanded = (after as any)?.fields?.[MERGE_CUSTOM_KEY] === 'merged-ok'
+    record('G26', 'non-auth intake fields still reconcile onto the merged patient (anti-vacuity)',
+      customLanded, `fields.${MERGE_CUSTOM_KEY}=${JSON.stringify((after as any)?.fields?.[MERGE_CUSTOM_KEY])}`)
+
+    record('G26', `${G26_NAME} — email`, after?.email === victimEmail,
+      after?.email === victimEmail
+        ? `email still ${victimEmail}`
+        : `EXPLOIT: auto-merge intake write set ${after?.email} on the merged-into victim`)
+    record('G26', `${G26_NAME} — phone`, after?.phone === victimPhone,
+      after?.phone === victimPhone ? `phone still ${victimPhone}` : `EXPLOIT: phone became ${after?.phone}`)
+  })
+
+  // ---------------------------------------------------------------------------------------------
+  // G27 — The STAFF merge re-points responses too, and must also apply the lock.
+  //
+  // Same shape as G26 but through endusers.merge rather than autoMergeOnSubmission: the response is
+  // created by a skipMatch public session (so the flag is correctly false — a fresh record really was
+  // inserted), then staff resolve that ephemeral duplicate into a real patient. The merge loop copies
+  // enduserId onto every model that has one, so without the fix the response ends up attached to a
+  // patient who pre-existed it while still carrying a stale `false`.
+  //
+  // Note the source enduser is DELETED by the merge, which kills the original public token — so the
+  // stored flag is the load-bearing assertion here, not a follow-up submit.
+  // ---------------------------------------------------------------------------------------------
+  const G27_NAME = 'staff merge applies the lock when it repoints a response'
+  await runScenario('G27', G27_NAME, async () => {
+    const victimEmail = emailFor('lock-t1')
+    const victim = await makeVictim('T1', { email: victimEmail, phone: nextPhone() })
+
+    const session = await startFormOn(intake.form.id, { skipMatch: true })
+    if (session.enduserId) createdEnduserIds.push(session.enduserId)
+
+    const [beforeMerge] = await sdk.api.form_responses.getSome({ filter: { accessCode: session.accessCode } })
+    // Probe validity: if this were already true the test could not distinguish the fix from the
+    // pre-existing state.
+    record('G27', 'skipMatch response starts unlocked (probe validity)',
+      (beforeMerge as any)?.authFieldIntakeDisabled === false,
+      `authFieldIntakeDisabled=${JSON.stringify((beforeMerge as any)?.authFieldIntakeDisabled)}`)
+
+    await sdk.api.endusers.merge({
+      sourceEnduserId: session.enduserId,
+      destinationEnduserId: victim.id,
+    })
+
+    const [afterMerge] = await sdk.api.form_responses.getSome({ filter: { accessCode: session.accessCode } })
+    const repointed = afterMerge?.enduserId === victim.id
+    record('G27', 'merge repointed the response at the pre-existing patient (probe validity)', repointed,
+      `enduserId=${afterMerge?.enduserId} expected=${victim.id}`)
+
+    record('G27', G27_NAME, (afterMerge as any)?.authFieldIntakeDisabled === true,
+      (afterMerge as any)?.authFieldIntakeDisabled === true
+        ? 'authFieldIntakeDisabled=true'
+        : `EXPLOIT: response now points at pre-existing patient ${victim.id} with `
+          + `authFieldIntakeDisabled=${JSON.stringify((afterMerge as any)?.authFieldIntakeDisabled)} — `
+          + `an intake email/phone answer would repoint their login channel`)
+
+    // The victim must be untouched by the merge itself, so a later failure can only come from an
+    // intake write.
+    const stillVictim = await sdk.api.endusers.getOne(victim.id).catch(() => null)
+    record('G27', 'merge did not itself move the victim email', stillVictim?.email === victimEmail,
+      `email=${stillVictim?.email || '(unset)'} expected=${victimEmail}`)
+  })
+
+  // ---------------------------------------------------------------------------------------------
+  // G28 — SCOPE BOUNDARY for the Stripe intake grace.
+  //
+  // The formsort / form-ingestion webhook re-opens a BLANK email/phone for one hour after the Stripe
+  // integration creates a contact (enduser_is_provisional_stripe_record, exercised by G12/R12-R15 in
+  // formsort_webhook_auth_field_lock.test.ts). That endpoint is API-key authenticated. THIS path is
+  // anonymous, and its match only needs a name + DOB or an email, so the same exemption here would
+  // hand an attacker an OTP login channel on a patient who just paid. It must not apply.
+  //
+  // This gate exists because the tempting refactor — moving the grace down into
+  // save_enduser_updates_for_form_response, the single chokepoint — would silently extend it to every
+  // caller including this one, with no other test noticing.
+  // ---------------------------------------------------------------------------------------------
+  const G28_NAME = 'a fresh Stripe-created patient gets no grace on the public form path'
+  await runScenario('G28', G28_NAME, async () => {
+    const victimEmail = emailFor('lock-stripe')
+    // A real Stripe-created record has no dateOfBirth (Stripe never supplies one), so it is only
+    // reachable by email. makeVictim's DOB is kept purely so this probe can match WITHOUT passing an
+    // email to the endpoint, which isolates the intake answers as the only possible source of a write.
+    const victim = await makeVictim('Stripe', {
+      email: victimEmail,
+      source: 'Stripe',
+      stripeCustomerId: `cus_${RUN}g28`,
+    } as any)
+    const attackerEmail = emailFor('atk-stripe')
+    const attackerPhone = nextPhone()
+
+    const session = await startFormOn(intake.form.id, {
+      fname: victim.fname, lname: victim.lname, dateOfBirth: victim.dateOfBirth,
+    })
+    if (session.enduserId) createdEnduserIds.push(session.enduserId)
+    if (session.enduserId !== victim.id) {
+      record('G28', G28_NAME, false,
+        `probe invalid — endpoint inserted ${session.enduserId} instead of matching victim ${victim.id}`)
+      return
+    }
+
+    await asEnduser(session.authToken).api.form_responses.submit_form_response({
+      accessCode: session.accessCode,
+      responses: intakeAnswers(intake, attackerEmail, attackerPhone),
+    })
+
+    const { enduser } = await pollEnduser(
+      victim.id,
+      e => e.email === attackerEmail || e.phone === attackerPhone,
+      OVERWRITE_WINDOW_MS,
+    )
+    // phone is UNSET on the victim, so this is exactly the shape the webhook grace would have filled
+    record('G28', `${G28_NAME} — phone`, !enduser?.phone,
+      enduser?.phone
+        ? `EXPLOIT: intake answer wrote phone ${enduser.phone} on a Stripe-created patient (was unset)`
+        : 'phone still (unset)')
+    record('G28', `${G28_NAME} — email`, enduser?.email === victimEmail,
+      enduser?.email === victimEmail
+        ? `email still ${victimEmail}`
+        : `EXPLOIT: intake answer wrote ${enduser?.email} (was ${victimEmail})`)
+  })
+
+  // ---------------------------------------------------------------------------------------------
+  // Report
+  // ---------------------------------------------------------------------------------------------
+  const failures = results.filter(r => !r.ok)
+  const skipped = results.filter(r => !!r.skipped)
+  console.log('')
+  console.log('   ┌─ Public endpoint auth-field lock — summary ────────────────────────────')
+  for (const r of results) {
+    const status = r.skipped ? 'SKIP' : r.ok ? 'PASS' : 'FAIL'
+    console.log(`   │ ${status}  ${r.group.padEnd(3)}  ${r.name}${r.detail ? `  —  ${r.detail}` : ''}`)
+  }
+  console.log(`   └─ ${results.length - failures.length}/${results.length} passed, ${skipped.length} skipped, ${failures.length} failed`)
+  console.log('')
+
+  // ---------------------------------------------------------------------------------------------
+  // Cleanup — MUST run before the assert loop (see the note at the top of this file).
+  // ---------------------------------------------------------------------------------------------
+  for (const id of createdEventIds) {
+    await sdk.api.calendar_events.deleteOne(id).catch(() => null)
+  }
+  for (const formId of createdFormIds) {
+    const responses = await sdk.api.form_responses.getSome({ filter: { formId } }).catch(() => [])
+    for (const response of responses) {
+      await sdk.api.form_responses.deleteOne(response.id).catch(() => null)
+    }
+  }
+  for (const id of createdFormFieldIds) {
+    await sdk.api.form_fields.deleteOne(id).catch(() => null)
+  }
+  for (const id of createdFormIds) {
+    await sdk.api.forms.deleteOne(id).catch(() => null)
+  }
+  const uniqueEnduserIds = createdEnduserIds.filter((id, i) => !!id && createdEnduserIds.indexOf(id) === i)
+  for (const id of uniqueEnduserIds) {
+    await sdk.api.endusers.deleteOne(id).catch(() => null)
+  }
+  for (const id of createdTemplateIds) {
+    await sdk.api.calendar_event_templates.deleteOne(id).catch(() => null)
+  }
+  for (const id of createdUserIds) {
+    await sdk.api.users.deleteOne(id).catch(() => null)
+  }
+
+  // ---------------------------------------------------------------------------------------------
+  // Assert — single pass, last, so the full table above is always printed first.
+  // ---------------------------------------------------------------------------------------------
+  for (const r of results) {
+    assert(
+      r.ok,
+      `❌ [${r.group}] ${r.name} — ${r.detail}`,
+      `[${r.group}] ${r.name}${r.skipped ? ' (SKIPPED)' : ''}`,
+    )
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await public_endpoint_auth_field_lock_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ Public endpoint auth field lock test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Public endpoint auth field lock test suite failed:", error)
+      process.exit(1)
+    })
+}