npm - @tellescope/sdk - Versions diffs - 1.255.19 → 1.256.0 - Mend

@tellescope/sdk 1.255.19 → 1.256.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (82) hide show

package/src/tests/api_tests/security/F-0013-sanitize-user-html-with-iframes.test.ts ADDED Viewed

@@ -0,0 +1,215 @@
+import { DEFAULT_IFRAME_SANDBOX, replace_form_field_template_values, sanitize_user_html, sanitize_user_html_with_iframes } from "@tellescope/utilities"
+// Companion to F-0013-sanitize-user-html.test.ts (pattern 06 — XSS via dangerouslySetInnerHTML).
+//
+// sanitize_user_html_with_iframes is the variant used by the live form's field description, so
+// admins can embed video / scheduling widgets. It permits <iframe> and NOTHING else beyond what
+// sanitize_user_html allows. This asserts:
+//   1. permitting iframe did not reopen any of the F-0013 vectors (the full payload list is re-run)
+//   2. only absolute https iframes survive — relative, protocol-relative, http, javascript:, data:
+//      and srcdoc frames are dropped, along with their fallback content
+//   3. the restrictive sandbox is forced, but an author-supplied sandbox is honored
+//   4. sanitize_user_html itself still strips iframes (the boundary between the two functions)
+//
+// Pure-function test — no Session needed. Runs as part of the main suite and standalone:
+//   ./build_cjs.sh && cd packages/public/sdk && node -r dotenv/config lib/cjs/tests/api_tests/security/F-0013-sanitize-user-html-with-iframes.test.js
+const fail = (msg: string) => { throw new Error(msg) }
+// Same as has_no_executable_vector in the F-0013 test, minus the '<iframe' clause (iframes are
+// expected in this function's output). Everything else must still be neutralized.
+const has_no_executable_vector_allowing_iframe = (out: string) => {
+  const o = out.toLowerCase()
+  const withoutValues = o.replace(/"[^"]*"/g, '""').replace(/'[^']*'/g, "''")
+  return !/\son[a-z]+\s*=/.test(withoutValues)   // no live on*= event-handler attribute
+      && !o.includes('javascript:')
+      && !o.includes('vbscript:')
+      && !o.includes('<script')
+      && !o.includes('<svg')
+      && !o.includes('<math')
+      && !o.includes('<object')
+      && !o.includes('<embed')
+      && !o.includes('<form')
+      && !o.includes('<noscript')
+      && !o.includes('<template')
+      && !o.includes('srcdoc')                   // an inline document is arbitrary markup
+}
+// Tokens that must NEVER appear in the forced default. allow-top-navigation is the important one:
+// it is what stops a hostile embed from redirecting the patient's form page to a phishing site.
+const FORBIDDEN_SANDBOX_TOKENS = [
+  'allow-top-navigation',
+  'allow-downloads',
+  'allow-modals',
+  'allow-pointer-lock',
+  'allow-orientation-lock',
+]
+export const sanitize_user_html_with_iframes_tests = async () => {
+  console.log("Running sanitize_user_html_with_iframes XSS regression tests")
+  // ---------------------------------------------------------------------------------------------
+  // 1. Re-run the full F-0013 payload set — permitting iframe must not be a general regression
+  // ---------------------------------------------------------------------------------------------
+  const xssPayloads: [string, string][] = [
+    ['img onerror', `<img src=x onerror="alert(document.domain)">`],
+    ['svg onload', `<svg onload="alert(1)"></svg>`],
+    ['svg animate onbegin', `<svg><animate onbegin="alert(1)" attributeName="x" dur="1s"></svg>`],
+    ['details ontoggle', `<details open ontoggle="alert(1)"></details>`],
+    ['input onfocus autofocus', `<input autofocus onfocus="alert(1)">`],
+    ['body onpageshow', `<body onpageshow="alert(1)">`],
+    ['a javascript scheme', `<a href="javascript:alert(1)">x</a>`],
+    ['a javascript entity-encoded', `<a href="jav&#x09;ascript:alert(1)">x</a>`],
+    ['script tag', `<script>alert(1)</script>`],
+    ['onerror newline before =', `<img src=x onerror\n="alert(1)">`],
+    ['onerror mixed case', `<IMG SRC=x OnErRoR="alert(1)">`],
+    ['marquee onstart', `<marquee onstart="alert(1)">x</marquee>`],
+    ['mathml mglyph style mxss', `<math><mtext><table><mglyph><style><!--</style><img src=x onerror=alert(1)>`],
+    ['svg foreignObject', `<svg><foreignObject><img src=x onerror=alert(1)></foreignObject></svg>`],
+    ['noscript context confusion', `<noscript><p title="</noscript><img src=x onerror=alert(1)>">`],
+    ['template content', `<template><img src=x onerror=alert(1)></template>`],
+    ['comment confusion', `<!--><img src=x onerror=alert(1)>-->`],
+    ['cdata confusion', `<![CDATA[<img src=x onerror=alert(1)>]]>`],
+    ['markup inside attr value', `<img src="x" alt="<script>alert(1)</script>">`],
+    ['vbscript scheme', `<a href="vbscript:msgbox(1)">x</a>`],
+    ['data text/html href', `<a href="data:text/html,<script>alert(1)</script>">x</a>`],
+    ['javascript decimal entity', `<a href="&#74;avascript:alert(1)">x</a>`],
+    ['javascript newline entity', `<a href="jav&#x0A;ascript:alert(1)">x</a>`],
+  ]
+  for (const [name, payload] of xssPayloads) {
+    const out = sanitize_user_html_with_iframes(payload)
+    if (!has_no_executable_vector_allowing_iframe(out)) fail(`XSS not neutralized [${name}] -> ${out}`)
+  }
+  // ---------------------------------------------------------------------------------------------
+  // 2. Only absolute https iframes survive
+  // ---------------------------------------------------------------------------------------------
+  const badSrcs: [string, string][] = [
+    ['javascript scheme', `javascript:alert(1)`],
+    ['data text/html', `data:text/html,<script>alert(1)</script>`],
+    ['http (not https)', `http://evil.example`],
+    // sanitize-html does NOT reject protocol-relative iframe srcs on its own when
+    // allowProtocolRelative is set — this is the self-origin framing vector and the reason the
+    // sanitizer does its own absolute-https check.
+    ['protocol-relative', `//app.tellescope.com/`],
+    ['root-relative', `/portal/settings`],
+    ['bare relative', `settings`],
+    ['whitespace-obfuscated', `  https:/\\/\\evil`],
+    ['tab-entity javascript', `jav&#x09;ascript:alert(1)`],
+    ['scheme-only', `https://`],
+    ['empty', ``],
+  ]
+  for (const [name, src] of badSrcs) {
+    const out = sanitize_user_html_with_iframes(`<iframe src="${src}"></iframe>`)
+    if (out.toLowerCase().includes('<iframe')) fail(`bad iframe src survived [${name}] -> ${out}`)
+  }
+  // A dropped iframe must take its fallback content with it (exclusiveFilter, not a tagName swap)
+  const fallback = sanitize_user_html_with_iframes(`<iframe src="/x">FALLBACK-TEXT</iframe>`)
+  if (fallback.includes('FALLBACK-TEXT')) fail(`dropped iframe leaked its fallback text: ${fallback}`)
+  if (fallback.toLowerCase().includes('<iframe')) fail(`dropped iframe survived: ${fallback}`)
+  // srcdoc is not allowlisted, even alongside a valid src
+  const srcdoc = sanitize_user_html_with_iframes(`<iframe src="https://ok.example" srcdoc="<img src=x onerror=alert(1)>"></iframe>`)
+  if (srcdoc.toLowerCase().includes('srcdoc')) fail(`srcdoc not stripped: ${srcdoc}`)
+  if (!srcdoc.toLowerCase().includes('<iframe')) fail(`valid iframe dropped alongside srcdoc: ${srcdoc}`)
+  // handlers / clobbering attributes stripped, frame itself kept
+  const handlers = sanitize_user_html_with_iframes(`<iframe src="https://ok.example" onload="alert(1)" id="x" name="getElementById"></iframe>`)
+  if (!handlers.toLowerCase().includes('<iframe')) fail(`valid iframe dropped: ${handlers}`)
+  if (/\son[a-z]+\s*=/.test(handlers.toLowerCase())) fail(`iframe event handler survived: ${handlers}`)
+  if (/\b(id|name)\s*=/.test(handlers)) fail(`iframe id/name not stripped (DOM clobbering): ${handlers}`)
+  // ---------------------------------------------------------------------------------------------
+  // 3. Legitimate embeds survive, hardened
+  // ---------------------------------------------------------------------------------------------
+  // The exact shape draftjs-to-html emits for the WYSIWYG "embedded" button
+  const yt = sanitize_user_html_with_iframes(`<iframe width="560" height="315" src="https://www.youtube.com/embed/abc" frameBorder="0"></iframe>`)
+  if (!yt.includes('src="https://www.youtube.com/embed/abc"')) fail(`youtube embed src stripped: ${yt}`)
+  if (!(yt.includes('width="560"') && yt.includes('height="315"'))) fail(`iframe dimensions stripped: ${yt}`)
+  if (!yt.toLowerCase().includes('frameborder')) fail(`frameborder stripped: ${yt}`)
+  // forced containment
+  if (!yt.includes(`sandbox="${DEFAULT_IFRAME_SANDBOX}"`)) fail(`sandbox not forced: ${yt}`)
+  if (!yt.toLowerCase().includes('referrerpolicy=')) fail(`referrerpolicy not set: ${yt}`)
+  for (const token of FORBIDDEN_SANDBOX_TOKENS) {
+    if (DEFAULT_IFRAME_SANDBOX.includes(token)) fail(`forced sandbox must not grant ${token}: ${DEFAULT_IFRAME_SANDBOX}`)
+  }
+  // allow-same-origin IS granted — required for real embeds (a Loom embed renders blank without it)
+  // and harmless because the src is guaranteed cross-origin by the check asserted above.
+  if (!DEFAULT_IFRAME_SANDBOX.includes('allow-same-origin')) fail(`forced sandbox must grant allow-same-origin so real embeds render: ${DEFAULT_IFRAME_SANDBOX}`)
+  // author-supplied sandbox honored verbatim, so a surface can tighten (or loosen) per embed.
+  // Uses a value distinct from the default, so this can't pass by coincidence.
+  const authorSandbox = sanitize_user_html_with_iframes(`<iframe src="https://ok.example" sandbox="allow-scripts"></iframe>`)
+  if (!authorSandbox.includes('sandbox="allow-scripts"')) fail(`author sandbox not honored: ${authorSandbox}`)
+  // sandbox="" is the MOST restrictive value and must not be replaced by the default
+  const emptySandbox = sanitize_user_html_with_iframes(`<iframe src="https://ok.example" sandbox=""></iframe>`)
+  if (emptySandbox.includes('allow-')) fail(`empty sandbox was replaced with the permissive default: ${emptySandbox}`)
+  if (!/\ssandbox(\s|>)/.test(emptySandbox)) fail(`empty sandbox attribute lost entirely: ${emptySandbox}`)
+  // author referrerpolicy honored
+  const noref = sanitize_user_html_with_iframes(`<iframe src="https://ok.example" referrerpolicy="no-referrer"></iframe>`)
+  if (!noref.includes('referrerpolicy="no-referrer"')) fail(`author referrerpolicy not honored: ${noref}`)
+  // `allow` (Permissions-Policy delegation, e.g. YouTube autoplay) preserved
+  const allowAttr = sanitize_user_html_with_iframes(`<iframe src="https://ok.example" allow="autoplay; encrypted-media" allowfullscreen></iframe>`)
+  if (!allowAttr.includes('allow="autoplay; encrypted-media"')) fail(`allow attribute stripped: ${allowAttr}`)
+  // ---------------------------------------------------------------------------------------------
+  // 4. Everything sanitize_user_html preserves must still be preserved
+  // ---------------------------------------------------------------------------------------------
+  const heading = sanitize_user_html_with_iframes(`<h1>Welcome</h1><h3 style="color:#333">Sub</h3>`)
+  if (!(heading.includes('<h1>') && heading.includes('<h3') && heading.toLowerCase().includes('color'))) fail(`headings/style stripped: ${heading}`)
+  const table = sanitize_user_html_with_iframes(`<table><thead><tr><th>H</th></tr></thead><tbody><tr><td style="padding:4px" colspan="2">cell</td></tr></tbody></table>`)
+  if (!(table.includes('<table') && table.includes('<td') && table.includes('colspan'))) fail(`table stripped: ${table}`)
+  const list = sanitize_user_html_with_iframes(`<ul><li>a</li></ul><ol start="3"><li>c</li></ol>`)
+  if (!(list.includes('<ul') && list.includes('<li') && list.includes('<ol'))) fail(`list stripped: ${list}`)
+  const link = sanitize_user_html_with_iframes(`<a href="https://example.com">link</a>`)
+  if (!link.includes('href="https://example.com"')) fail(`safe link stripped: ${link}`)
+  if (!link.toLowerCase().includes('noopener')) fail(`external link not hardened: ${link}`)
+  const img = sanitize_user_html_with_iframes(`<img src="https://cdn.example.com/a.png" alt="pic" width="200">`)
+  if (!(img.includes('src="https://cdn.example.com/a.png"') && img.includes('alt="pic"'))) fail(`image stripped: ${img}`)
+  const dataimg = sanitize_user_html_with_iframes(`<img src="data:image/png;base64,iVBORw0KGgo=">`)
+  if (!dataimg.includes('data:image/png')) fail(`data: image stripped: ${dataimg}`)
+  const fmt = sanitize_user_html_with_iframes(`<p><strong>b</strong> <em>i</em> <span style="font-size:14px">s</span></p><blockquote>q</blockquote>`)
+  if (!(fmt.includes('<strong>') && fmt.includes('<span') && fmt.toLowerCase().includes('font-size'))) fail(`formatting stripped: ${fmt}`)
+  // ---------------------------------------------------------------------------------------------
+  // 5. The boundary: sanitize_user_html must NOT have been loosened
+  // ---------------------------------------------------------------------------------------------
+  const shared = sanitize_user_html(`<iframe src="https://www.youtube.com/embed/abc"></iframe>`)
+  if (shared.toLowerCase().includes('<iframe')) fail(`sanitize_user_html must still strip iframes: ${shared}`)
+  // ---------------------------------------------------------------------------------------------
+  // 6. End to end: an admin's iframe survives templating, a patient-injected one does not
+  // ---------------------------------------------------------------------------------------------
+  const adminTemplate = `<p>Hi {{enduser.fname}}, watch this:</p><iframe src="https://www.youtube.com/embed/abc"></iframe>`
+  const templated = replace_form_field_template_values(adminTemplate, {
+    enduser: { fname: `<iframe src="https://evil.example/phish"></iframe>` } as any,
+    responses: [],
+    escapeNewlinesAsHTMLBreaks: true,
+    escapeHTMLValues: true,
+  })
+  const endToEnd = sanitize_user_html_with_iframes(templated)
+  if (!endToEnd.includes('src="https://www.youtube.com/embed/abc"')) fail(`admin's own iframe did not survive: ${endToEnd}`)
+  // The patient's markup must survive only as inert escaped text — so 'evil.example' may still
+  // appear as visible characters, but there must be exactly one LIVE frame (the admin's).
+  if (!endToEnd.includes('&lt;iframe')) fail(`patient markup not escaped to inert text: ${endToEnd}`)
+  if ((endToEnd.toLowerCase().match(/<iframe/g) || []).length !== 1) fail(`patient-injected iframe became a live frame: ${endToEnd}`)
+  console.log("✅ sanitize_user_html_with_iframes XSS regression tests passed")
+}
+if (require.main === module) {
+  sanitize_user_html_with_iframes_tests()
+    .then(() => { console.log("✅ suite completed"); process.exit(0) })
+    .catch((err) => { console.error("❌ suite failed:", err); process.exit(1) })
+}

package/src/tests/api_tests/security/F-0166-allowed-paths-wildcard-bypass.test.ts CHANGED Viewed

@@ -146,6 +146,8 @@ export const allowed_paths_confinement_tests = async ({ sdk } : { sdk: Session,
   let joinEnduserId: string | undefined
   let formEnduserEmail: string | undefined
   let hostUserId: string | undefined
+  let templateId: string | undefined
+  let bookingEnduserId: string | undefined
   const eventIds: string[] = []
   try {
@@ -245,6 +247,120 @@ export const allowed_paths_confinement_tests = async ({ sdk } : { sdk: Session,
     // bare '/product' prefix entry did — that used to reach /products/prepare-stripe-checkout too
     await expectDenied(S1, 'exact matching: /products not granted by get:/product', publicFormSession.authToken, baselineEnduserToken, 'get', '/products')
+    /* ---- field confinement on the granted generic update route ----
+     * 'patch:/enduser/:id' is granted for Portal V2's terms gate, so the route check alone no longer
+     * protects this session — SESSION_SCOPE_WRITABLE_FIELDS does. These probes are the live control:
+     * the consent write lands, and every contactable/identity field is refused. Without them the
+     * module test is the only thing standing between a scope-table edit and account takeover.
+     */
+    const formEnduserId = publicFormSession.enduserId
+    // The refresh payload for a fromPublicSession token must carry the session's OWN id — portal V2
+    // seeds its store from it and then addresses itself by id, so without it every write goes to
+    // /enduser/undefined — while still withholding everything else about the patient. Both halves
+    // matter: adding the id must not become a foothold for widening this payload.
+    const publicRefresh = await request(publicFormSession.authToken, 'post', '/refresh-enduser-session', {})
+    const refreshedEnduser = publicRefresh.body?.enduser ?? {}
+    probes.push({
+      scenario: S1,
+      label: 'public refresh exposes the session\'s own id',
+      path: '/refresh-enduser-session',
+      expected: 'allowed',
+      status: refreshedEnduser.id === formEnduserId ? 200 : 500,
+      pass: refreshedEnduser.id === formEnduserId,
+      note: `id=${refreshedEnduser.id}`,
+    })
+    const withheld = ['email', 'phone', 'dateOfBirth', 'fname', 'lname', 'note', 'insurance', 'tags']
+      .filter(f => refreshedEnduser[f] !== undefined)
+    probes.push({
+      scenario: S1,
+      label: 'public refresh still withholds the patient record',
+      path: '/refresh-enduser-session',
+      expected: 'denied',
+      status: withheld.length ? 200 : 403,
+      pass: withheld.length === 0,
+      note: withheld.length ? `LEAKED [${withheld}]` : `keys=[${Object.keys(refreshedEnduser)}]`,
+    })
+    await expectAllowed(
+      S1, 'field-restricted: may record terms consent', publicFormSession.authToken,
+      'patch', `/enduser/${formEnduserId}`,
+      { updates: { termsSigned: new Date().toISOString(), termsVersion: '1' } },
+    )
+    // The write being confined is not enough: the update RESPONSE is not redacted for enduser sessions
+    // (applyRedactions runs only for user sessions on that path), so an unprojected echo would hand
+    // this session the record it can't otherwise read — GET /enduser/:id is not even in this scope.
+    // Assert the response carries ONLY what the session was allowed to write.
+    const consentEcho = await request(
+      publicFormSession.authToken, 'patch', `/enduser/${formEnduserId}`,
+      { updates: { termsVersion: '2' } },
+    )
+    const echoedKeys = Object.keys(consentEcho.body ?? {})
+    const leakedKeys = echoedKeys.filter(k => !['id', 'termsSigned', 'termsVersion'].includes(k))
+    probes.push({
+      scenario: S1,
+      label: 'field-restricted: update response echoes only the writable fields',
+      path: `/enduser/${formEnduserId}`,
+      expected: 'allowed',
+      status: leakedKeys.length === 0 ? consentEcho.status : 500,
+      pass: consentEcho.status === 200 && leakedKeys.length === 0,
+      note: leakedKeys.length ? `LEAKED [${leakedKeys}]` : `echoed [${echoedKeys}]`,
+    })
+    // email/phone are the takeover vector: password reset resolves by findOne({ email }) and OTP codes
+    // deliver to enduser.phone. dateOfBirth/fname are the public-form MATCH keys, so writing them would
+    // let a session redirect which patient a later submission attaches to.
+    const fieldsThatMustBeRefused: [string, any][] = [
+      ['email', `f0166-takeover-${RAND()}@tellescope.example`],
+      ['phone', '+15555550123'],
+      ['landline', '+15555550124'],
+      ['dateOfBirth', '1990-01-01'],
+      ['fname', 'F0166Overwritten'],
+    ]
+    for (const [field, value] of fieldsThatMustBeRefused) {
+      const r = await request(
+        publicFormSession.authToken, 'patch', `/enduser/${formEnduserId}`, { updates: { [field]: value } },
+      )
+      probes.push({
+        scenario: S1,
+        label: `field-restricted: cannot write enduser '${field}'`,
+        path: `/enduser/${formEnduserId}`,
+        expected: 'denied',
+        status: r.status,
+        pass: r.status === 403,
+        note: 'route is granted; the field allowlist is what refuses this',
+      })
+    }
+    // the field guard must reject the whole request rather than filtering, or the allowed key would
+    // carry a disallowed one through alongside it
+    const mixed = await request(
+      publicFormSession.authToken, 'patch', `/enduser/${formEnduserId}`,
+      { updates: { termsVersion: '2', email: `f0166-mixed-${RAND()}@tellescope.example` } },
+    )
+    probes.push({
+      scenario: S1,
+      label: 'field-restricted: a mixed allowed+denied update is refused whole',
+      path: `/enduser/${formEnduserId}`,
+      expected: 'denied',
+      status: mixed.status,
+      pass: mixed.status === 403,
+      note: 'no partial application — email must not ride along with termsVersion',
+    })
+    // and the email on record must be untouched by all of the above
+    const afterProbes = await sdk.api.endusers.getOne(formEnduserId)
+    probes.push({
+      scenario: S1,
+      label: 'field-restricted: stored email survived every attempt',
+      path: `/enduser/${formEnduserId}`,
+      expected: 'denied',
+      status: afterProbes.email === formEnduserEmail ? 403 : 200,
+      pass: afterProbes.email === formEnduserEmail,
+      note: `stored=${afterProbes.email}`,
+    })
     /* ============ S2: join-link session — RED before the fix ============ */
     const S2 = 'S2 join-link (enduser)'
@@ -264,6 +380,36 @@ export const allowed_paths_confinement_tests = async ({ sdk } : { sdk: Session,
     await expectAllowed(S2, 'widened: calendar events list', joinSession.authToken, 'get', '/calendar-events')
     await expectAllowed(S2, 'widened: join meeting for event', joinSession.authToken, 'post', '/join-meeting-for-event', { calendarEventId: joinEvent.id })
+    // The WaitingRoom marks attendance here. This write is deliberately NOT field-restricted: the
+    // portal reads the event back through useCalendarEvents, whose updateElement REPLACES the local
+    // record with the update response (react state.tsx), so a truncated response would drop event
+    // fields out of local state mid-visit and break a live Twilio call. Assert both halves of that
+    // contract — the write lands, AND the response is still a whole event.
+    const attendanceWrite = await request(
+      joinSession.authToken, 'patch', `/calendar-event/${joinEvent.id}`,
+      { updates: { joinedVideoCall: [{ id: joinEnduserId, at: new Date().toISOString() }] } },
+    )
+    probes.push({
+      scenario: S2,
+      label: 'marks joinedVideoCall on its pinned event',
+      path: `/calendar-event/${joinEvent.id}`,
+      expected: 'allowed',
+      status: attendanceWrite.status,
+      pass: attendanceWrite.status === 200,
+    })
+    // title/durationInMinutes were set at fixture creation, so their presence proves the response was
+    // not projected down to the written field
+    const echoedEvent = attendanceWrite.body ?? {}
+    probes.push({
+      scenario: S2,
+      label: 'attendance write returns the WHOLE event (client replaces local state from it)',
+      path: `/calendar-event/${joinEvent.id}`,
+      expected: 'allowed',
+      status: (echoedEvent.title && echoedEvent.durationInMinutes) ? 200 : 500,
+      pass: !!echoedEvent.title && !!echoedEvent.durationInMinutes && !!echoedEvent.joinedVideoCall,
+      note: `echoed ${Object.keys(echoedEvent).length} keys`,
+    })
     // confinement must survive a refresh rather than widening
     const refreshedJoin = await request(joinSession.authToken, 'post', '/refresh-enduser-session', {})
     const refreshedJoinToken = refreshedJoin.body?.authToken
@@ -398,6 +544,73 @@ export const allowed_paths_confinement_tests = async ({ sdk } : { sdk: Session,
       await expectAllowed(S6, 'after refresh: my-meetings still allowed', rescopedToken, 'get', '/my-meetings')
     }
+    /* ============ S7: appointment-booking session — the SAME terms gate as S1 ============
+     * Portal V2's terms gate wraps the booking route too, so this scope needs the same enduser write
+     * (and only that write). Without the grant the gate is unpassable and the patient never reaches the
+     * booking page at all. Field restriction and response projection must behave exactly as in S1 —
+     * mirrored here rather than assumed, since the two scopes are separate table entries.
+     */
+    const S7 = 'S7 appointment-booking'
+    const bookingTemplate = await sdk.api.calendar_event_templates.createOne({
+      title: `F-0166 booking ${RAND()}`, durationInMinutes: 30,
+    })
+    templateId = bookingTemplate.id
+    const bookingEnduserEmail = `f0166-booking-${RAND()}@tellescope.example`
+    const bookingEnduser = await sdk.api.endusers.createOne({
+      email: bookingEnduserEmail, fname: 'Booking', lname: 'Confinement',
+    })
+    bookingEnduserId = bookingEnduser.id
+    const bookingSession = await new EnduserSession({ host, businessId })
+      .api.calendar_events.session_for_public_appointment_booking({
+        businessId,
+        calendarEventTemplateId: bookingTemplate.id,
+        email: bookingEnduserEmail,
+        fname: 'Booking',
+        lname: 'Confinement',
+      })
+    await expectAllowed(
+      S7, 'field-restricted: may record terms consent', bookingSession.authToken,
+      'patch', `/enduser/${bookingEnduser.id}`,
+      { updates: { termsSigned: new Date().toISOString(), termsVersion: '1' } },
+    )
+    const bookingEcho = await request(
+      bookingSession.authToken, 'patch', `/enduser/${bookingEnduser.id}`, { updates: { termsVersion: '2' } },
+    )
+    const bookingLeaked = Object.keys(bookingEcho.body ?? {})
+      .filter(k => !['id', 'termsSigned', 'termsVersion'].includes(k))
+    probes.push({
+      scenario: S7,
+      label: 'field-restricted: update response echoes only the writable fields',
+      path: `/enduser/${bookingEnduser.id}`,
+      expected: 'allowed',
+      status: bookingLeaked.length === 0 ? bookingEcho.status : 500,
+      pass: bookingEcho.status === 200 && bookingLeaked.length === 0,
+      note: bookingLeaked.length ? `LEAKED [${bookingLeaked}]` : undefined,
+    })
+    for (const [field, value] of [['email', `f0166-bt-${RAND()}@tellescope.example`], ['phone', '+15555550188']] as [string, any][]) {
+      const r = await request(bookingSession.authToken, 'patch', `/enduser/${bookingEnduser.id}`, { updates: { [field]: value } })
+      probes.push({
+        scenario: S7,
+        label: `field-restricted: cannot write enduser '${field}'`,
+        path: `/enduser/${bookingEnduser.id}`,
+        expected: 'denied',
+        status: r.status,
+        pass: r.status === 403,
+        note: 'route is granted; the field allowlist is what refuses this',
+      })
+    }
+    // the booking scope must not have gained anything else along with the enduser write
+    await expectDenied(S7, 'unlisted: form responses', bookingSession.authToken, baselineEnduserToken, 'get', '/form-responses')
+    await expectDenied(S7, 'unlisted: calendar events', bookingSession.authToken, baselineEnduserToken, 'get', '/calendar-events')
+    await expectAllowed(S7, 'listed: refresh enduser session', bookingSession.authToken, 'post', '/refresh-enduser-session')
     /* ============ S5: ordinary sessions with no allowedPaths claim ============ */
     const S5 = 'S5 unconfined sessions'
@@ -479,6 +692,8 @@ export const allowed_paths_confinement_tests = async ({ sdk } : { sdk: Session,
       } catch {}
     }
     if (hostUserId) { try { await sdk.api.users.deleteOne(hostUserId) } catch {} }
+    if (bookingEnduserId) { try { await sdk.api.endusers.deleteOne(bookingEnduserId) } catch {} }
+    if (templateId) { try { await sdk.api.calendar_event_templates.deleteOne(templateId) } catch {} }
     if (productId) { try { await sdk.api.products.deleteOne(productId) } catch {} }
     if (formId) { try { await sdk.api.forms.deleteOne(formId) } catch {} }
   }