@tellescope/sdk 1.255.18 → 1.256.0

package/src/tests/api_tests/tickets_bulk_assign_care_team.test.ts

@@ -0,0 +1,132 @@
+require('source-map-support').install();
+
+import { Session } from "../../sdk"
+import {
+  async_test,
+  log_header,
+} from "@tellescope/testing"
+import { setup_tests } from "../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+// Main test function for tickets bulk_assign addToCareTeam flag
+export const tickets_bulk_assign_care_team_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("Tickets Bulk Assign (addToCareTeam) Tests")
+
+  // Throwaway user to act as the new ticket owner
+  const owner = await sdk.api.users.createOne({
+    email: `test-bulk-assign-owner-${Date.now()}@test.com`,
+    fname: 'BulkAssign',
+    lname: 'Owner',
+    verifiedEmail: true,
+  })
+
+  const enduser1 = await sdk.api.endusers.createOne({ fname: 'BulkAssign', lname: 'PatientOne' })
+  const enduser2 = await sdk.api.endusers.createOne({ fname: 'BulkAssign', lname: 'PatientTwo' })
+
+  // Tickets are created without an owner so the on-create care team side effect doesn't run
+  const ticket1 = await sdk.api.tickets.createOne({ title: 'Bulk Assign Test 1', enduserId: enduser1.id })
+  const ticket2 = await sdk.api.tickets.createOne({ title: 'Bulk Assign Test 2', enduserId: enduser1.id })
+  const ticket3 = await sdk.api.tickets.createOne({ title: 'Bulk Assign Test 3', enduserId: enduser2.id, skipCareTeamAssignment: true })
+  const ticketNoEnduser = await sdk.api.tickets.createOne({ title: 'Bulk Assign Test 4' })
+
+  try {
+    // Default behavior (flag omitted): owner set, care team untouched
+    await async_test(
+      "bulk_assign: assigns owner without flag",
+      () => sdk.api.tickets.bulk_assign({ ids: [ticket1.id], userId: owner.id }),
+      { onResult: () => true }
+    )
+    await async_test(
+      "bulk_assign: owner set on ticket (no flag)",
+      () => sdk.api.tickets.getOne(ticket1.id),
+      { onResult: t => t.owner === owner.id }
+    )
+    await async_test(
+      "bulk_assign: care team unchanged without flag",
+      () => sdk.api.endusers.getOne(enduser1.id),
+      { onResult: e => !e.assignedTo?.includes(owner.id) }
+    )
+
+    // addToCareTeam: false behaves like omitted
+    await async_test(
+      "bulk_assign: addToCareTeam false leaves care team unchanged",
+      async () => {
+        await sdk.api.tickets.bulk_assign({ ids: [ticket1.id], userId: owner.id, addToCareTeam: false })
+        return sdk.api.endusers.getOne(enduser1.id)
+      },
+      { onResult: e => !e.assignedTo?.includes(owner.id) }
+    )
+
+    // addToCareTeam: true adds owner to each ticket's enduser care team,
+    // including tickets flagged skipCareTeamAssignment (explicit flag wins),
+    // and tolerates tickets with no enduser
+    await async_test(
+      "bulk_assign: addToCareTeam true assigns owner and updates care teams",
+      () => sdk.api.tickets.bulk_assign({
+        ids: [ticket1.id, ticket2.id, ticket3.id, ticketNoEnduser.id],
+        userId: owner.id,
+        addToCareTeam: true,
+      }),
+      { onResult: () => true }
+    )
+    await async_test(
+      "bulk_assign: owner added to care team (enduser1)",
+      () => sdk.api.endusers.getOne(enduser1.id),
+      { onResult: e => !!e.assignedTo?.includes(owner.id) }
+    )
+    await async_test(
+      "bulk_assign: owner added to care team despite skipCareTeamAssignment (enduser2)",
+      () => sdk.api.endusers.getOne(enduser2.id),
+      { onResult: e => !!e.assignedTo?.includes(owner.id) }
+    )
+    await async_test(
+      "bulk_assign: ticket without enduser still assigned",
+      () => sdk.api.tickets.getOne(ticketNoEnduser.id),
+      { onResult: t => t.owner === owner.id }
+    )
+
+    // Idempotent when owner already on care team
+    await async_test(
+      "bulk_assign: addToCareTeam is idempotent",
+      async () => {
+        await sdk.api.tickets.bulk_assign({ ids: [ticket1.id], userId: owner.id, addToCareTeam: true })
+        return sdk.api.endusers.getOne(enduser1.id)
+      },
+      { onResult: e => e.assignedTo?.filter(id => id === owner.id).length === 1 }
+    )
+  } finally {
+    // Cleanup
+    await Promise.all([
+      sdk.api.tickets.deleteOne(ticket1.id).catch(console.error),
+      sdk.api.tickets.deleteOne(ticket2.id).catch(console.error),
+      sdk.api.tickets.deleteOne(ticket3.id).catch(console.error),
+      sdk.api.tickets.deleteOne(ticketNoEnduser.id).catch(console.error),
+      sdk.api.endusers.deleteOne(enduser1.id).catch(console.error),
+      sdk.api.endusers.deleteOne(enduser2.id).catch(console.error),
+      sdk.api.users.deleteOne(owner.id).catch(console.error),
+    ])
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await tickets_bulk_assign_care_team_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ Tickets bulk assign care team test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Tickets bulk assign care team test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/tests.ts

@@ -17,6 +17,7 @@ import {
   CompoundFilter,
   CreateTicketActionInfo,
   FormResponseValue,
+  JourneyContext,
   ModelName,
   RoundRobinAssignmentInfo,
   User,
@@ -41,6 +42,7 @@ import { user_portal_settings_tests } from "./api_tests/user_portal_settings.tes
 import { integrations_redacted_tests } from "./api_tests/integrations_redacted.test"
 import { healthie_multi_integration_tests } from "./api_tests/healthie_multi_integration.test"
 import { get_some_projection_tests } from "./api_tests/get_some_projection.test"
+import { file_download_unicode_names_tests } from "./api_tests/file_download_unicode_names.test"
 import { mdb_sort_tests } from "./api_tests/mdb_sort.test"
 import { create_user_notifications_trigger_tests } from "./api_tests/create_user_notifications_trigger.test"
 import { inbox_thread_assignment_updates_tests } from "./api_tests/inbox_thread_assignment_updates.test"
@@ -82,6 +84,7 @@ import {
 import fs from "fs"
 import { load_inbox_data_tests } from "./api_tests/load_inbox_data.test";
 import { phone_calls_cold_transfer_tests } from "./api_tests/phone_calls_cold_transfer.test";
+import { phone_calls_conference_hold_tests } from "./api_tests/phone_calls_conference_hold.test";
 import { enduser_login_tests } from "./api_tests/enduser_login.test";
 import { enduser_login_rate_limits_tests } from "./api_tests/enduser_login_rate_limits.test";
 import { eom_procedure_codes_tests } from "./api_tests/eom_procedure_codes.test";
@@ -109,12 +112,18 @@ import { invite_user_enumeration_tests } from "./api_tests/security/F-0007-invit
 import { register_business_id_injection_tests } from "./api_tests/security/register_business_id_injection.test";
 import { handle_incoming_communication_cross_tenant_tests } from "./api_tests/security/F-0008-handle-incoming-communication-cross-tenant.test";
 import { sanitize_user_html_xss_tests } from "./api_tests/security/F-0013-sanitize-user-html.test";
+import { sanitize_user_html_with_iframes_tests } from "./api_tests/security/F-0013-sanitize-user-html-with-iframes.test";
 import { prototype_pollution_tests } from "./api_tests/security/F-0016-prototype-pollution.test";
 import { enduser_cross_create_tests } from "./api_tests/security/F-0116-F-0119-enduser-cross-create.test";
 import { globalunique_leak_tests } from "./api_tests/security/F-0145-globalunique-leak.test";
 import { load_inbox_redaction_tests } from "./api_tests/security/F-0151-load-inbox-redaction.test";
 import { webhook_timeout_tests } from "./api_tests/security/F-0155-webhook-timeout.test";
+import { enduser_ai_summary_trust_gate_tests } from "./api_tests/security/enduser-ai-summary-trust-gate.test";
+import { allowed_paths_confinement_tests } from "./api_tests/security/F-0166-allowed-paths-wildcard-bypass.test";
+import { public_endpoint_auth_field_lock_tests } from "./api_tests/security/public_endpoint_auth_field_lock.test";
+import { formsort_webhook_auth_field_lock_tests } from "./api_tests/security/formsort_webhook_auth_field_lock.test";
 import { bulk_assignment_tests } from "./api_tests/bulk_assignment.test";
+import { tickets_bulk_assign_care_team_tests } from "./api_tests/tickets_bulk_assign_care_team.test";
 import { managed_content_enduser_access_tests } from "./api_tests/managed_content_enduser_access.test";
 import { managed_content_file_access_tests } from "./api_tests/managed_content_file_access.test";
 import { auto_merge_form_submission_tests } from "./api_tests/auto_merge_form_submission.test";
@@ -7945,9 +7954,49 @@ const merge_enduser_tests = async () => {
     { onResult: e => e.attendees.length === 1 && !!e.attendees?.find(a => a.id === destination.id) }
   )
 
+  // merging two endusers that both lack insurance must leave the fields absent, NOT null.
+  // a stored null breaks every later partial update: those get flattened to dotted paths
+  // ('insurance.memberId'), and MongoDB rejects a dotted $set under a null parent
+  const [noInsuranceSource, noInsuranceDestination] = (await sdk.api.endusers.createSome([
+    { email: 'noins-source@tellescope.com', fname: 'no', lname: 'insurance' },
+    { email: 'noins-destination@tellescope.com' },
+  ])).created
+
+  await sdk.api.endusers.merge({
+    sourceEnduserId: noInsuranceSource.id,
+    destinationEnduserId: noInsuranceDestination.id,
+  })
+
+  await async_test(
+    "Merged endusers have no null insurance",
+    () => sdk.api.endusers.getOne(noInsuranceDestination.id),
+    { onResult: e => e.insurance === undefined && e.insuranceSecondary === undefined }
+  )
+
+  await async_test(
+    "Partial insurance update applies after merge",
+    async () => {
+      await sdk.api.endusers.updateOne(noInsuranceDestination.id, {
+        insurance: { memberId: 'M1', payerName: 'Test Payer' },
+      }) // no replaceObjectFields, matching the standard update from the UI
+      return await sdk.api.endusers.getOne(noInsuranceDestination.id)
+    },
+    { onResult: e => e.insurance?.memberId === 'M1' && e.insurance?.payerName === 'Test Payer' }
+  )
+
+  await async_test(
+    "Second partial insurance update merges",
+    async () => {
+      await sdk.api.endusers.updateOne(noInsuranceDestination.id, { insurance: { groupNumber: 'G1' } })
+      return await sdk.api.endusers.getOne(noInsuranceDestination.id)
+    },
+    { onResult: e => e.insurance?.groupNumber === 'G1' && e.insurance?.memberId === 'M1' }
+  )
+
   await Promise.all([
     sdk.api.endusers.deleteOne(destination.id),
     sdk.api.endusers.deleteOne(otherEnduser.id),
+    sdk.api.endusers.deleteOne(noInsuranceDestination.id),
     sdk.api.calendar_events.deleteOne(event.id),
     sdk.api.calendar_events.deleteOne(eventToMove.id),
   ])
@@ -8581,6 +8630,8 @@ const test_ticket_automation_assignment_and_optimization = async () => {
     enduser,
     closedForReason,
     testDelayedChild,
+    calendarEventId,
+    ticketOwner,
   } : {
     assignedTo: string[]
     info: Pick<CreateTicketActionInfo, 'assignmentStrategy' | 'defaultAssignee'>,
@@ -8588,6 +8639,8 @@ const test_ticket_automation_assignment_and_optimization = async () => {
     closedForReason?: string,
     enduser?: Enduser,
     testDelayedChild?: boolean,
+    calendarEventId?: string, // copied into journeyContext by close_ticket
+    ticketOwner?: string, // override the seed ticket's owner, to avoid masking a previous-owner fallback
   }) => {
 
     const e = enduser || await sdk.api.endusers.createOne({ assignedTo, journeys: { [journey.id]: '' }, fields: { Tag: "tag3"} })
@@ -8625,8 +8678,9 @@ const test_ticket_automation_assignment_and_optimization = async () => {
       enduserId: e.id,
       automationStepId: PLACEHOLDER_ID,
       journeyId: journey.id,
-      owner: validOwners[0],
+      owner: ticketOwner ?? validOwners[0],
       closedForReason,
+      ...(calendarEventId ? { calendarEventId } : {}),
     })
 
     await async_test(
@@ -8759,11 +8813,13 @@ const test_ticket_automation_assignment_and_optimization = async () => {
     info,
     validOwners,
     enduser,
+    journeyContext,
   } : {
     assignedTo: string[]
     info: Pick<CreateTicketActionInfo, 'assignmentStrategy' | 'defaultAssignee'>,
     validOwners: string[],
     enduser?: Enduser,
+    journeyContext?: JourneyContext,
   }) => {
     const e = enduser || await sdk.api.endusers.createOne({ assignedTo, fields: { Tag: 'tag3' } })
     await sdk.api.automated_actions.createOne({
@@ -8774,6 +8830,7 @@ const test_ticket_automation_assignment_and_optimization = async () => {
       journeyId: journey.id,
       status: 'active',
       processAfter: Date.now(),
+      ...(journeyContext ? { journeyContext } : {}),
     })
 
     await async_test(
@@ -8874,6 +8931,115 @@ const test_ticket_automation_assignment_and_optimization = async () => {
     validOwners: [sdkNonAdmin.userInfo.id],
   })
 
+  // 'Recently-Booked Appointment Host' assignment
+  // journeyContext.calendarEventId, when it resolves to a host, takes priority over the legacy
+  // "newest event for this enduser" lookup. one enduser per case, to avoid trigger throttling.
+  const HOST_A = sdkNonAdmin.userInfo.id
+  const HOST_B = sdk.userInfo.id
+  const appointmentHostInfo = (defaultAssignee: string) => ({
+    assignmentStrategy: { type: 'Recently-Booked Appointment Host', info: {} } as const,
+    defaultAssignee,
+  })
+  // the legacy filter matches an event having *some* user attendee and *some* attendee with this
+  // enduser's id, so each hosted event carries both
+  const createHostedEvent = (enduserId: string, hostId: string) => sdk.api.calendar_events.createOne({
+    title: 'appointment host test',
+    durationInMinutes: 30,
+    startTimeInMS: Date.now(),
+    attendees: [{ type: 'enduser', id: enduserId }, { type: 'user', id: hostId }],
+  })
+
+  // CORE PROOF: two appointments with different hosts, journey context names the OLDER one.
+  // fails before this fix, which always took the newest-created event (HOST_B).
+  {
+    const e = await sdk.api.endusers.createOne({ fields: { Tag: 'tag3' } })
+    const older = await createHostedEvent(e.id, HOST_A)
+    const newer = await createHostedEvent(e.id, HOST_B) // higher _id, so legacy sort picks this one
+    await testBackgroundTicket({
+      assignedTo: [],
+      enduser: e,
+      info: appointmentHostInfo(HOST_B), // distinct from expected owner, so a fallback would fail
+      validOwners: [HOST_A],
+      journeyContext: { calendarEventId: older.id },
+    })
+    await Promise.all([older, newer].map(ev => sdk.api.calendar_events.deleteOne(ev.id)))
+  }
+
+  // no journey context -> legacy "newest event" behavior is unchanged
+  {
+    const e = await sdk.api.endusers.createOne({ fields: { Tag: 'tag3' } })
+    const older = await createHostedEvent(e.id, HOST_A)
+    const newer = await createHostedEvent(e.id, HOST_B)
+    await testBackgroundTicket({
+      assignedTo: [],
+      enduser: e,
+      info: appointmentHostInfo(HOST_A),
+      validOwners: [HOST_B], // newest created event's host
+    })
+    await Promise.all([older, newer].map(ev => sdk.api.calendar_events.deleteOne(ev.id)))
+  }
+
+  // context event no longer exists -> falls back to the legacy lookup
+  {
+    const e = await sdk.api.endusers.createOne({ fields: { Tag: 'tag3' } })
+    const deleted = await createHostedEvent(e.id, HOST_B)
+    await sdk.api.calendar_events.deleteOne(deleted.id)
+    const hosted = await createHostedEvent(e.id, HOST_A)
+    await testBackgroundTicket({
+      assignedTo: [],
+      enduser: e,
+      info: appointmentHostInfo(HOST_B),
+      validOwners: [HOST_A],
+      journeyContext: { calendarEventId: deleted.id },
+    })
+    await sdk.api.calendar_events.deleteOne(hosted.id)
+  }
+
+  // context event has no user attendee (so yields no host) -> falls back to the legacy lookup
+  {
+    const e = await sdk.api.endusers.createOne({ fields: { Tag: 'tag3' } })
+    const enduserOnly = await sdk.api.calendar_events.createOne({
+      title: 'appointment host test, no host',
+      durationInMinutes: 30,
+      startTimeInMS: Date.now(),
+      attendees: [{ type: 'enduser', id: e.id }],
+    })
+    const hosted = await createHostedEvent(e.id, HOST_A)
+    await testBackgroundTicket({
+      assignedTo: [],
+      enduser: e,
+      info: appointmentHostInfo(HOST_B),
+      validOwners: [HOST_A],
+      journeyContext: { calendarEventId: enduserOnly.id },
+    })
+    await Promise.all([enduserOnly, hosted].map(ev => sdk.api.calendar_events.deleteOne(ev.id)))
+  }
+
+  // no events at all -> no resolvable host, so defaultAssignee wins
+  await testBackgroundTicket({
+    assignedTo: [],
+    info: appointmentHostInfo(HOST_A),
+    validOwners: [HOST_A],
+  })
+
+  // api path: close_ticket copies the original ticket's calendarEventId into journeyContext
+  {
+    const e = await sdk.api.endusers.createOne({
+      journeys: { [journey.id]: '' }, fields: { Tag: 'tag3' },
+    })
+    const older = await createHostedEvent(e.id, HOST_A)
+    const newer = await createHostedEvent(e.id, HOST_B)
+    await testForegroundTicket({
+      assignedTo: [],
+      enduser: e,
+      info: appointmentHostInfo(HOST_B),
+      validOwners: [HOST_A],
+      calendarEventId: older.id,
+      ticketOwner: HOST_B, // so a previous-owner style fallback would also fail
+    })
+    await Promise.all([older, newer].map(ev => sdk.api.calendar_events.deleteOne(ev.id)))
+  }
+
   return Promise.all([
     await sdk.api.journeys.deleteOne(journey.id),
     await sdk.api.ticket_queues.deleteOne(queue.id),
@@ -9560,6 +9726,10 @@ export const formsort_tests = async () => {
         if (!r.formsort?.length) { return false }
         if (!r.responses?.length) { return false }
         if (r.responses.length !== answers.length) { return false }
+        // this response attached to a patient that already existed (created at the SDK call above), so
+        // the webhook flags it and email/phone are withheld from the enduser update — see
+        // authFieldIntakeDisabled in api.ts and formsort_webhook_auth_field_lock.test.ts
+        if (!r.authFieldIntakeDisabled) { return false }
 
         if (!validateResponse(r, 'address', JSON.stringify(address, null, 2))) { return false }
         if (!validateResponse(r, 'email', answersEmail)) { return false }
@@ -9588,7 +9758,10 @@ export const formsort_tests = async () => {
         if (submissionEnduser.fname !== 'Fname') { return false }
         if (submissionEnduser.lname !== 'Lname') { return false }
         if (submissionEnduser.gender !== 'Male') { return false }
-        if (submissionEnduser.phone !== '+15555555555') { return false }
+        // phone is an auth channel (OTP delivery), and this enduser was matched by a $or guess rather
+        // than created by this submission, so the submitted phone must NOT land. Non-auth intake fields
+        // above still flow through.
+        if (submissionEnduser.phone) { return false }
         if (submissionEnduser.defaultFromEmail !== 'from@tellescope.com') { return false }
         if (submissionEnduser.useDefaultFromEmailInAutomations !== true) { return false }
         if (submissionEnduser.defaultFromPhone !== '+15555555555') { return false }
@@ -13751,6 +13924,55 @@ const replace_form_field_template_values_tests = async () => {
     ) === '<p>Locations: NYC<br />SF<br />LA</p>',
     'fail CRLF in substituted value', 'CRLF in substituted value'
   )
+
+  // escapeHTMLValues: substituted values are patient-supplied (their own intake answers / enduser
+  // record), so on any path rendered by a sanitizer that permits iframes they must be escaped —
+  // otherwise a patient can inject a frame into an admin-authored description.
+  const enduserWithMarkupField = {
+    fname: "Multi",
+    fields: { Injected: '<iframe src="https://evil.example"></iframe>' },
+  } as Partial<Enduser>
+
+  const escaped = replace_form_field_template_values(
+    '<p>{{enduser.Injected}}</p>',
+    { enduser: enduserWithMarkupField, escapeNewlinesAsHTMLBreaks: true, escapeHTMLValues: true }
+  )
+  assert(
+    escaped.includes('&lt;iframe') && !escaped.includes('<iframe'),
+    'fail escapeHTMLValues escapes markup', 'escapeHTMLValues escapes markup'
+  )
+
+  // Escaping must run BEFORE the newline conversion, or the injected breaks become &lt;br /&gt;
+  const enduserWithMarkupAndNewline = {
+    fields: { Mixed: 'a<b\nc&d' },
+  } as Partial<Enduser>
+  assert(
+    replace_form_field_template_values(
+      '{{enduser.Mixed}}',
+      { enduser: enduserWithMarkupAndNewline, escapeNewlinesAsHTMLBreaks: true, escapeHTMLValues: true }
+    ) === 'a&lt;b<br />c&amp;d',
+    'fail escapeHTMLValues ordering vs newline breaks', 'escapeHTMLValues ordering vs newline breaks'
+  )
+
+  // Flag absent => byte-identical to today. Plain-text callers (field titles/descriptions rendered
+  // in a Typography) rely on this: escaping there would corrupt e.g. a name containing '&'.
+  const enduserWithAmpersand = {
+    fields: { Practice: 'Smith & Jones <Cardiology>' },
+  } as Partial<Enduser>
+  assert(
+    replace_form_field_template_values(
+      'Practice: {{enduser.Practice}}',
+      { enduser: enduserWithAmpersand }
+    ) === 'Practice: Smith & Jones <Cardiology>',
+    'fail no escaping without the flag', 'no escaping without the flag'
+  )
+  assert(
+    replace_form_field_template_values(
+      'Practice: {{enduser.Practice}}',
+      { enduser: enduserWithAmpersand, escapeHTMLValues: true }
+    ) === 'Practice: Smith &amp; Jones &lt;Cardiology&gt;',
+    'fail escaping with the flag', 'escaping with the flag'
+  )
 }
 
 const inbox_threads_building_tests = async () => {
@@ -15052,6 +15274,9 @@ const ip_address_form_tests = async () => {
     await replace_form_field_template_values_tests()
     await mfa_tests()
     await setup_tests(sdk, sdkNonAdmin)
+    await allowed_paths_confinement_tests({ sdk, sdkNonAdmin })
+    await phone_calls_conference_hold_tests({ sdk, sdkNonAdmin })
+    await tickets_bulk_assign_care_team_tests({ sdk, sdkNonAdmin })
     await custom_dashboards_tests({ sdk, sdkNonAdmin })
     await register_business_id_injection_tests({ sdk, sdkNonAdmin })
     await automation_trigger_tests()
@@ -15060,10 +15285,13 @@ const ip_address_form_tests = async () => {
     await beluga_pharmacy_mappings_tests({ sdk, sdkNonAdmin })
     await mdi_case_offerings_tests({ sdk, sdkNonAdmin })
     await enduser_write_restrictions_tests({ sdk, sdkNonAdmin })
+    await enduser_ai_summary_trust_gate_tests({ sdk, sdkNonAdmin })
     await enduser_cross_create_tests({ sdk, sdkNonAdmin })
     await globalunique_leak_tests({ sdk, sdkNonAdmin })
     await load_inbox_redaction_tests({ sdk, sdkNonAdmin })
     await webhook_timeout_tests({ sdk, sdkNonAdmin })
+    await public_endpoint_auth_field_lock_tests({ sdk, sdkNonAdmin })
+    await formsort_webhook_auth_field_lock_tests({ sdk, sdkNonAdmin })
     await user_portal_settings_tests({ sdk, sdkNonAdmin })
     await invite_user_enumeration_tests({ sdk, sdkNonAdmin })
     await handle_incoming_communication_cross_tenant_tests({ sdk, sdkNonAdmin })
@@ -15076,6 +15304,7 @@ const ip_address_form_tests = async () => {
     await cascade_role_rename_cross_tenant_tests({ sdk, sdkNonAdmin })
     await self_admin_role_assignment_tests({ sdk, sdkNonAdmin })
     await sanitize_user_html_xss_tests()
+    await sanitize_user_html_with_iframes_tests()
     await prototype_pollution_tests()
     await account_switcher_tests({ sdk, sdkNonAdmin })
     await totp_mfa_tests({ sdk, sdkNonAdmin })
@@ -15110,6 +15339,7 @@ const ip_address_form_tests = async () => {
     await time_tracks_appointment_duration_tests({ sdk, sdkNonAdmin })
     await calendar_event_limits_tests({ sdk, sdkNonAdmin })
     await get_some_projection_tests({ sdk, sdkNonAdmin })
+    await file_download_unicode_names_tests({ sdk, sdkNonAdmin })
     await elation_user_id_tests({ sdk, sdkNonAdmin })
     await concurrent_build_threads_tests({ sdk, sdkNonAdmin })
     await custom_aggregation_tests({ sdk, sdkNonAdmin })

package/.env

@@ -1,13 +0,0 @@
-TEST_EMAIL='sebastian.a.coates+test@gmail.com'
-MFA_EMAIL='sebass+mfa@tellescope.com'
-SUB_EMAIL='sebass+sub@tellescope.com'
-OTHER_SUB_EMAIL='sebass+othersub@tellescope.com'
-SUB_SUB_EMAIL='sebass+subsub@tellescope.com'
-TEST_PASSWORD='asdfGHJK1234!@#$'
-TEST_EMAIL_2='sebass192@gmail.com'
-TEST_PASSWORD_2='3009SwagSwag'
-NON_ADMIN_EMAIL='nonadmin@tellescope.com'
-NON_ADMIN_PASSWORD='3009SwagSwag'
-CROSS_ORG_API_KEY='cross-org-testing-api-key-manually-set'
-CROSS_ORG_TARGET_BUSINESS_ID='69efea9b0c4d5bd1da90ca77'
-CROSS_ORG_UNAPPROVED_BUSINESS_ID='63a0d6be40e38ba9e899a490'