@tellescope/sdk 1.255.19 → 1.256.0

package/lib/cjs/tests/api_tests/security/F-0166-allowed-paths-wildcard-bypass.test.js

@@ -102,10 +102,11 @@ var OBJECT_ID = '68a1b2c3d4e5f60718293a4b';
 var allowed_paths_confinement_tests = function (_a) {
     var sdk = _a.sdk;
     return __awaiter(void 0, void 0, void 0, function () {
-        var probes, request, isPathDenial, expectDenied, expectAllowed, formId, productId, joinEnduserId, formEnduserEmail, hostUserId, eventIds, businessId, form, publicFormSession, product, joinEnduser, joinLinkToken, joinEvent, unrelatedEvent, joinSession, hostUser, startLinkToken, startEvent, startSession, baselineEnduserToken, baselineUserToken, S1, S2, refreshedJoin, refreshedJoinToken, S3, refreshedStart, refreshedStartToken, S4, prefixGranted, _i, prefixGranted_1, _b, method, path, r, S6, ABSENT_ID_A, ABSENT_ID_B, INVALID_EMAIL, consentAttempt, refreshedForScopes, rescopedToken, S5, _c, _d, path, _e, _f, path, adminAuthenticated, apiKeySDK, _g, _h, path, r, failures, scenarios, _loop_1, _j, scenarios_1, scenario, _k, probes_1, p, _l, eventIds_1, id, _m, _o, e, _p, _q, _r, _s;
-        var _t, _u, _v, _w;
-        return __generator(this, function (_x) {
-            switch (_x.label) {
+        var probes, request, isPathDenial, expectDenied, expectAllowed, formId, productId, joinEnduserId, formEnduserEmail, hostUserId, templateId, bookingEnduserId, eventIds, businessId, form, publicFormSession, product, joinEnduser, joinLinkToken, joinEvent, unrelatedEvent, joinSession, hostUser, startLinkToken, startEvent, startSession, baselineEnduserToken, baselineUserToken, S1, formEnduserId, publicRefresh, refreshedEnduser_1, withheld, consentEcho, echoedKeys, leakedKeys, fieldsThatMustBeRefused, _i, fieldsThatMustBeRefused_1, _b, field, value, r, mixed, afterProbes, S2, attendanceWrite, echoedEvent, refreshedJoin, refreshedJoinToken, S3, refreshedStart, refreshedStartToken, S4, prefixGranted, _c, prefixGranted_1, _d, method, path, r, S6, ABSENT_ID_A, ABSENT_ID_B, INVALID_EMAIL, consentAttempt, refreshedForScopes, rescopedToken, S7, bookingTemplate, bookingEnduserEmail, bookingEnduser, bookingSession, bookingEcho, bookingLeaked, _e, _f, _g, field, value, r, S5, _h, _j, path, _k, _l, path, adminAuthenticated, apiKeySDK, _m, _o, path, r, failures, scenarios, _loop_1, _p, scenarios_1, scenario, _q, probes_1, p, _r, eventIds_1, id, _s, _t, e, _u, _v, _w, _x, _y, _z;
+        var _0, _1;
+        var _2, _3, _4, _5, _6, _7, _8, _9, _10;
+        return __generator(this, function (_11) {
+            switch (_11.label) {
                 case 0:
                     (0, testing_1.log_header)("F-0166: allowedPaths wildcard bypasses session path confinement");
                     probes = [];
@@ -172,16 +173,16 @@ var allowed_paths_confinement_tests = function (_a) {
                         });
                     };
                     eventIds = [];
-                    _x.label = 1;
+                    _11.label = 1;
                 case 1:
-                    _x.trys.push([1, , 101, 130]);
+                    _11.trys.push([1, , 123, 160]);
                     businessId = sdk.userInfo.businessId;
                     return [4 /*yield*/, sdk.api.forms.createOne({
                             title: "F-0166 path confinement ".concat(RAND()),
                             allowPublicURL: true,
                         })];
                 case 2:
-                    form = _x.sent();
+                    form = _11.sent();
                     formId = form.id;
                     return [4 /*yield*/, sdk.api.form_fields.createOne({
                             formId: form.id,
@@ -190,7 +191,7 @@ var allowed_paths_confinement_tests = function (_a) {
                             previousFields: [{ type: 'root', info: {} }],
                         })];
                 case 3:
-                    _x.sent();
+                    _11.sent();
                     formEnduserEmail = "f0166-form-".concat(RAND(), "@tellescope.example");
                     return [4 /*yield*/, new sdk_1.EnduserSession({ host: host, businessId: businessId })
                             .api.form_responses.session_for_public_form({
@@ -202,20 +203,20 @@ var allowed_paths_confinement_tests = function (_a) {
                             skipMatch: true, // also skips the intake-phone requirement
                         })];
                 case 4:
-                    publicFormSession = _x.sent();
+                    publicFormSession = _11.sent();
                     return [4 /*yield*/, sdk.api.products.createOne({
                             title: "F-0166 product ".concat(RAND()),
                             cost: { amount: 500, currency: 'USD' },
                             processor: 'Stripe',
                         })];
                 case 5:
-                    product = _x.sent();
+                    product = _11.sent();
                     productId = product.id;
                     return [4 /*yield*/, sdk.api.endusers.createOne({
                             email: "f0166-join-".concat(RAND(), "@tellescope.example"),
                         })];
                 case 6:
-                    joinEnduser = _x.sent();
+                    joinEnduser = _11.sent();
                     joinEnduserId = joinEnduser.id;
                     joinLinkToken = "f0166-join-".concat(RAND()).concat(RAND());
                     return [4 /*yield*/, sdk.api.calendar_events.createOne({
@@ -223,14 +224,14 @@ var allowed_paths_confinement_tests = function (_a) {
                             attendees: [{ type: 'enduser', id: joinEnduser.id, joinLinkToken: joinLinkToken }],
                         })];
                 case 7:
-                    joinEvent = _x.sent();
+                    joinEvent = _11.sent();
                     eventIds.push(joinEvent.id);
                     return [4 /*yield*/, sdk.api.calendar_events.createOne({
                             title: 'F-0166 unrelated', durationInMinutes: 30, startTimeInMS: Date.now() + 3600000,
                             attendees: [{ type: 'enduser', id: joinEnduser.id }],
                         })];
                 case 8:
-                    unrelatedEvent = _x.sent();
+                    unrelatedEvent = _11.sent();
                     eventIds.push(unrelatedEvent.id);
                     return [4 /*yield*/, new sdk_1.EnduserSession({ host: host, businessId: businessId })
                             .api.calendar_events.session_for_join_link({ token: joinLinkToken })
@@ -238,7 +239,7 @@ var allowed_paths_confinement_tests = function (_a) {
                         // throwaway user; verifiedEmail must be set at create time (it is rejected on update)
                     ];
                 case 9:
-                    joinSession = _x.sent();
+                    joinSession = _11.sent();
                     return [4 /*yield*/, sdk.api.users.createOne({
                             email: "f0166-host-".concat(RAND(), "@tellescope.example"),
                             fname: 'Path', lname: 'Host',
@@ -246,7 +247,7 @@ var allowed_paths_confinement_tests = function (_a) {
                             notificationEmailsDisabled: true,
                         })];
                 case 10:
-                    hostUser = _x.sent();
+                    hostUser = _11.sent();
                     hostUserId = hostUser.id;
                     startLinkToken = "f0166-start-".concat(RAND()).concat(RAND());
                     return [4 /*yield*/, sdk.api.calendar_events.createOne({
@@ -255,204 +256,333 @@ var allowed_paths_confinement_tests = function (_a) {
                             startLinkToken: startLinkToken,
                         })];
                 case 11:
-                    startEvent = _x.sent();
+                    startEvent = _11.sent();
                     eventIds.push(startEvent.id);
                     return [4 /*yield*/, sdk.api.calendar_events.session_for_start_link({ token: startLinkToken })
                         // -- unconfined baselines of each session type (generate_auth_token, never .authenticate)
                     ];
                 case 12:
-                    startSession = _x.sent();
+                    startSession = _11.sent();
                     return [4 /*yield*/, sdk.api.endusers.generate_auth_token({ id: joinEnduser.id })];
                 case 13:
-                    baselineEnduserToken = (_x.sent()).authToken;
+                    baselineEnduserToken = (_11.sent()).authToken;
                     return [4 /*yield*/, sdk.api.users.generate_auth_token({ id: hostUser.id })
                         /* ============ S1: public-form session — no wildcard, correctly confined already ============ */
                     ];
                 case 14:
-                    baselineUserToken = (_x.sent()).authToken;
+                    baselineUserToken = (_11.sent()).authToken;
                     S1 = 'S1 public-form';
                     return [4 /*yield*/, expectAllowed(S1, 'always-allowed path', publicFormSession.authToken, 'get', '/test-authenticated')];
                 case 15:
-                    _x.sent();
+                    _11.sent();
                     return [4 /*yield*/, expectAllowed(S1, 'listed: form info for access code', publicFormSession.authToken, 'get', '/form-info-for-access-code', { accessCode: publicFormSession.accessCode })];
                 case 16:
-                    _x.sent();
+                    _11.sent();
                     return [4 /*yield*/, expectAllowed(S1, 'listed: refresh enduser session', publicFormSession.authToken, 'post', '/refresh-enduser-session')];
                 case 17:
-                    _x.sent();
+                    _11.sent();
                     return [4 /*yield*/, expectAllowed(S1, 'listed: product by id', publicFormSession.authToken, 'get', "/product/".concat(productId))];
                 case 18:
-                    _x.sent();
+                    _11.sent();
                     return [4 /*yield*/, expectDenied(S1, 'unlisted: calendar events', publicFormSession.authToken, baselineEnduserToken, 'get', '/calendar-events')];
                 case 19:
-                    _x.sent();
+                    _11.sent();
                     return [4 /*yield*/, expectDenied(S1, 'unlisted: form responses', publicFormSession.authToken, baselineEnduserToken, 'get', '/form-responses')];
                 case 20:
-                    _x.sent();
+                    _11.sent();
                     return [4 /*yield*/, expectDenied(S1, 'unlisted: files', publicFormSession.authToken, baselineEnduserToken, 'get', '/files')
                         // 'get:/product' names one route, so it no longer leaks the whole /products namespace the way a
                         // bare '/product' prefix entry did — that used to reach /products/prepare-stripe-checkout too
                     ];
                 case 21:
-                    _x.sent();
+                    _11.sent();
                     // 'get:/product' names one route, so it no longer leaks the whole /products namespace the way a
                     // bare '/product' prefix entry did — that used to reach /products/prepare-stripe-checkout too
                     return [4 /*yield*/, expectDenied(S1, 'exact matching: /products not granted by get:/product', publicFormSession.authToken, baselineEnduserToken, 'get', '/products')
-                        /* ============ S2: join-link session — RED before the fix ============ */
+                        /* ---- field confinement on the granted generic update route ----
+                         * 'patch:/enduser/:id' is granted for Portal V2's terms gate, so the route check alone no longer
+                         * protects this session — SESSION_SCOPE_WRITABLE_FIELDS does. These probes are the live control:
+                         * the consent write lands, and every contactable/identity field is refused. Without them the
+                         * module test is the only thing standing between a scope-table edit and account takeover.
+                         */
                     ];
                 case 22:
                     // 'get:/product' names one route, so it no longer leaks the whole /products namespace the way a
                     // bare '/product' prefix entry did — that used to reach /products/prepare-stripe-checkout too
-                    _x.sent();
+                    _11.sent();
+                    formEnduserId = publicFormSession.enduserId;
+                    return [4 /*yield*/, request(publicFormSession.authToken, 'post', '/refresh-enduser-session', {})];
+                case 23:
+                    publicRefresh = _11.sent();
+                    refreshedEnduser_1 = (_3 = (_2 = publicRefresh.body) === null || _2 === void 0 ? void 0 : _2.enduser) !== null && _3 !== void 0 ? _3 : {};
+                    probes.push({
+                        scenario: S1,
+                        label: 'public refresh exposes the session\'s own id',
+                        path: '/refresh-enduser-session',
+                        expected: 'allowed',
+                        status: refreshedEnduser_1.id === formEnduserId ? 200 : 500,
+                        pass: refreshedEnduser_1.id === formEnduserId,
+                        note: "id=".concat(refreshedEnduser_1.id),
+                    });
+                    withheld = ['email', 'phone', 'dateOfBirth', 'fname', 'lname', 'note', 'insurance', 'tags']
+                        .filter(function (f) { return refreshedEnduser_1[f] !== undefined; });
+                    probes.push({
+                        scenario: S1,
+                        label: 'public refresh still withholds the patient record',
+                        path: '/refresh-enduser-session',
+                        expected: 'denied',
+                        status: withheld.length ? 200 : 403,
+                        pass: withheld.length === 0,
+                        note: withheld.length ? "LEAKED [".concat(withheld, "]") : "keys=[".concat(Object.keys(refreshedEnduser_1), "]"),
+                    });
+                    return [4 /*yield*/, expectAllowed(S1, 'field-restricted: may record terms consent', publicFormSession.authToken, 'patch', "/enduser/".concat(formEnduserId), { updates: { termsSigned: new Date().toISOString(), termsVersion: '1' } })
+                        // The write being confined is not enough: the update RESPONSE is not redacted for enduser sessions
+                        // (applyRedactions runs only for user sessions on that path), so an unprojected echo would hand
+                        // this session the record it can't otherwise read — GET /enduser/:id is not even in this scope.
+                        // Assert the response carries ONLY what the session was allowed to write.
+                    ];
+                case 24:
+                    _11.sent();
+                    return [4 /*yield*/, request(publicFormSession.authToken, 'patch', "/enduser/".concat(formEnduserId), { updates: { termsVersion: '2' } })];
+                case 25:
+                    consentEcho = _11.sent();
+                    echoedKeys = Object.keys((_4 = consentEcho.body) !== null && _4 !== void 0 ? _4 : {});
+                    leakedKeys = echoedKeys.filter(function (k) { return !['id', 'termsSigned', 'termsVersion'].includes(k); });
+                    probes.push({
+                        scenario: S1,
+                        label: 'field-restricted: update response echoes only the writable fields',
+                        path: "/enduser/".concat(formEnduserId),
+                        expected: 'allowed',
+                        status: leakedKeys.length === 0 ? consentEcho.status : 500,
+                        pass: consentEcho.status === 200 && leakedKeys.length === 0,
+                        note: leakedKeys.length ? "LEAKED [".concat(leakedKeys, "]") : "echoed [".concat(echoedKeys, "]"),
+                    });
+                    fieldsThatMustBeRefused = [
+                        ['email', "f0166-takeover-".concat(RAND(), "@tellescope.example")],
+                        ['phone', '+15555550123'],
+                        ['landline', '+15555550124'],
+                        ['dateOfBirth', '1990-01-01'],
+                        ['fname', 'F0166Overwritten'],
+                    ];
+                    _i = 0, fieldsThatMustBeRefused_1 = fieldsThatMustBeRefused;
+                    _11.label = 26;
+                case 26:
+                    if (!(_i < fieldsThatMustBeRefused_1.length)) return [3 /*break*/, 29];
+                    _b = fieldsThatMustBeRefused_1[_i], field = _b[0], value = _b[1];
+                    return [4 /*yield*/, request(publicFormSession.authToken, 'patch', "/enduser/".concat(formEnduserId), { updates: (_0 = {}, _0[field] = value, _0) })];
+                case 27:
+                    r = _11.sent();
+                    probes.push({
+                        scenario: S1,
+                        label: "field-restricted: cannot write enduser '".concat(field, "'"),
+                        path: "/enduser/".concat(formEnduserId),
+                        expected: 'denied',
+                        status: r.status,
+                        pass: r.status === 403,
+                        note: 'route is granted; the field allowlist is what refuses this',
+                    });
+                    _11.label = 28;
+                case 28:
+                    _i++;
+                    return [3 /*break*/, 26];
+                case 29: return [4 /*yield*/, request(publicFormSession.authToken, 'patch', "/enduser/".concat(formEnduserId), { updates: { termsVersion: '2', email: "f0166-mixed-".concat(RAND(), "@tellescope.example") } })];
+                case 30:
+                    mixed = _11.sent();
+                    probes.push({
+                        scenario: S1,
+                        label: 'field-restricted: a mixed allowed+denied update is refused whole',
+                        path: "/enduser/".concat(formEnduserId),
+                        expected: 'denied',
+                        status: mixed.status,
+                        pass: mixed.status === 403,
+                        note: 'no partial application — email must not ride along with termsVersion',
+                    });
+                    return [4 /*yield*/, sdk.api.endusers.getOne(formEnduserId)];
+                case 31:
+                    afterProbes = _11.sent();
+                    probes.push({
+                        scenario: S1,
+                        label: 'field-restricted: stored email survived every attempt',
+                        path: "/enduser/".concat(formEnduserId),
+                        expected: 'denied',
+                        status: afterProbes.email === formEnduserEmail ? 403 : 200,
+                        pass: afterProbes.email === formEnduserEmail,
+                        note: "stored=".concat(afterProbes.email),
+                    });
                     S2 = 'S2 join-link (enduser)';
                     return [4 /*yield*/, expectDenied(S2, 'unlisted: form responses', joinSession.authToken, baselineEnduserToken, 'get', '/form-responses')];
-                case 23:
-                    _x.sent();
+                case 32:
+                    _11.sent();
                     return [4 /*yield*/, expectDenied(S2, 'unlisted: files', joinSession.authToken, baselineEnduserToken, 'get', '/files')];
-                case 24:
-                    _x.sent();
+                case 33:
+                    _11.sent();
                     return [4 /*yield*/, expectDenied(S2, 'unlisted: portal customizations', joinSession.authToken, baselineEnduserToken, 'get', '/portal-customizations')];
-                case 25:
-                    _x.sent();
+                case 34:
+                    _11.sent();
                     return [4 /*yield*/, expectDenied(S2, 'unlisted: UNRELATED calendar event', joinSession.authToken, baselineEnduserToken, 'get', "/calendar-event/".concat(unrelatedEvent.id))];
-                case 26:
-                    _x.sent();
+                case 35:
+                    _11.sent();
                     return [4 /*yield*/, expectAllowed(S2, 'always-allowed path', joinSession.authToken, 'get', '/test-authenticated')];
-                case 27:
-                    _x.sent();
+                case 36:
+                    _11.sent();
                     return [4 /*yield*/, expectAllowed(S2, 'listed: my meetings', joinSession.authToken, 'get', '/my-meetings')
                         // enduserActions for organizations is {}, so an enduser 401s here regardless of confinement
                     ];
-                case 28:
-                    _x.sent();
+                case 37:
+                    _11.sent();
                     // enduserActions for organizations is {}, so an enduser 401s here regardless of confinement
                     return [4 /*yield*/, expectAllowed(S2, 'listed: organizations', joinSession.authToken, 'get', '/organizations', undefined, { allow401: true })];
-                case 29:
+                case 38:
                     // enduserActions for organizations is {}, so an enduser 401s here regardless of confinement
-                    _x.sent();
+                    _11.sent();
                     return [4 /*yield*/, expectAllowed(S2, 'listed: users', joinSession.authToken, 'get', '/users')];
-                case 30:
-                    _x.sent();
+                case 39:
+                    _11.sent();
                     return [4 /*yield*/, expectAllowed(S2, 'listed: pinned calendar event', joinSession.authToken, 'get', "/calendar-event/".concat(joinEvent.id))];
-                case 31:
-                    _x.sent();
+                case 40:
+                    _11.sent();
                     return [4 /*yield*/, expectAllowed(S2, 'wildcard: meeting by id', joinSession.authToken, 'get', "/meeting/".concat(OBJECT_ID))
                         // the two paths widened in this change so the portal video flow keeps working
                     ];
-                case 32:
-                    _x.sent();
+                case 41:
+                    _11.sent();
                     // the two paths widened in this change so the portal video flow keeps working
                     return [4 /*yield*/, expectAllowed(S2, 'widened: calendar events list', joinSession.authToken, 'get', '/calendar-events')];
-                case 33:
+                case 42:
                     // the two paths widened in this change so the portal video flow keeps working
-                    _x.sent();
+                    _11.sent();
                     return [4 /*yield*/, expectAllowed(S2, 'widened: join meeting for event', joinSession.authToken, 'post', '/join-meeting-for-event', { calendarEventId: joinEvent.id })
-                        // confinement must survive a refresh rather than widening
+                        // The WaitingRoom marks attendance here. This write is deliberately NOT field-restricted: the
+                        // portal reads the event back through useCalendarEvents, whose updateElement REPLACES the local
+                        // record with the update response (react state.tsx), so a truncated response would drop event
+                        // fields out of local state mid-visit and break a live Twilio call. Assert both halves of that
+                        // contract — the write lands, AND the response is still a whole event.
                     ];
-                case 34:
-                    _x.sent();
+                case 43:
+                    _11.sent();
+                    return [4 /*yield*/, request(joinSession.authToken, 'patch', "/calendar-event/".concat(joinEvent.id), { updates: { joinedVideoCall: [{ id: joinEnduserId, at: new Date().toISOString() }] } })];
+                case 44:
+                    attendanceWrite = _11.sent();
+                    probes.push({
+                        scenario: S2,
+                        label: 'marks joinedVideoCall on its pinned event',
+                        path: "/calendar-event/".concat(joinEvent.id),
+                        expected: 'allowed',
+                        status: attendanceWrite.status,
+                        pass: attendanceWrite.status === 200,
+                    });
+                    echoedEvent = (_5 = attendanceWrite.body) !== null && _5 !== void 0 ? _5 : {};
+                    probes.push({
+                        scenario: S2,
+                        label: 'attendance write returns the WHOLE event (client replaces local state from it)',
+                        path: "/calendar-event/".concat(joinEvent.id),
+                        expected: 'allowed',
+                        status: (echoedEvent.title && echoedEvent.durationInMinutes) ? 200 : 500,
+                        pass: !!echoedEvent.title && !!echoedEvent.durationInMinutes && !!echoedEvent.joinedVideoCall,
+                        note: "echoed ".concat(Object.keys(echoedEvent).length, " keys"),
+                    });
                     return [4 /*yield*/, request(joinSession.authToken, 'post', '/refresh-enduser-session', {})];
-                case 35:
-                    refreshedJoin = _x.sent();
-                    refreshedJoinToken = (_t = refreshedJoin.body) === null || _t === void 0 ? void 0 : _t.authToken;
+                case 45:
+                    refreshedJoin = _11.sent();
+                    refreshedJoinToken = (_6 = refreshedJoin.body) === null || _6 === void 0 ? void 0 : _6.authToken;
                     probes.push({
                         scenario: S2, label: 'refresh returned a new token', path: '/refresh-enduser-session',
                         expected: 'allowed', status: refreshedJoin.status, pass: !!refreshedJoinToken,
                     });
-                    if (!refreshedJoinToken) return [3 /*break*/, 38];
+                    if (!refreshedJoinToken) return [3 /*break*/, 48];
                     return [4 /*yield*/, expectDenied(S2, 'after refresh: still denied form responses', refreshedJoinToken, baselineEnduserToken, 'get', '/form-responses')];
-                case 36:
-                    _x.sent();
+                case 46:
+                    _11.sent();
                     return [4 /*yield*/, expectAllowed(S2, 'after refresh: still allowed my meetings', refreshedJoinToken, 'get', '/my-meetings')];
-                case 37:
-                    _x.sent();
-                    _x.label = 38;
-                case 38:
+                case 47:
+                    _11.sent();
+                    _11.label = 48;
+                case 48:
                     S3 = 'S3 start-link (STAFF)';
                     return [4 /*yield*/, expectDenied(S3, 'unlisted: form responses', startSession.authToken, baselineUserToken, 'get', '/form-responses')];
-                case 39:
-                    _x.sent();
+                case 49:
+                    _11.sent();
                     return [4 /*yield*/, expectDenied(S3, 'unlisted: journeys', startSession.authToken, baselineUserToken, 'get', '/journeys')];
-                case 40:
-                    _x.sent();
+                case 50:
+                    _11.sent();
                     return [4 /*yield*/, expectDenied(S3, 'unlisted: tickets', startSession.authToken, baselineUserToken, 'get', '/tickets')];
-                case 41:
-                    _x.sent();
+                case 51:
+                    _11.sent();
                     return [4 /*yield*/, expectDenied(S3, 'unlisted: data sync (org-wide change firehose)', startSession.authToken, baselineUserToken, 'get', '/data-sync', { from: new Date(Date.now() - 60000).toISOString() })];
-                case 42:
-                    _x.sent();
+                case 52:
+                    _11.sent();
                     return [4 /*yield*/, expectDenied(S3, 'unlisted: file download URL', startSession.authToken, baselineUserToken, 'get', '/file-download-URL', { secureName: 'f0166-does-not-exist' })];
-                case 43:
-                    _x.sent();
+                case 53:
+                    _11.sent();
                     return [4 /*yield*/, expectDenied(S3, 'unlisted: UNRELATED calendar event', startSession.authToken, baselineUserToken, 'get', "/calendar-event/".concat(unrelatedEvent.id))];
-                case 44:
-                    _x.sent();
+                case 54:
+                    _11.sent();
                     return [4 /*yield*/, expectAllowed(S3, 'always-allowed path', startSession.authToken, 'get', '/test-authenticated')];
-                case 45:
-                    _x.sent();
+                case 55:
+                    _11.sent();
                     return [4 /*yield*/, expectAllowed(S3, 'listed: my meetings', startSession.authToken, 'get', '/my-meetings')];
-                case 46:
-                    _x.sent();
+                case 56:
+                    _11.sent();
                     return [4 /*yield*/, expectAllowed(S3, 'listed: calendar events', startSession.authToken, 'get', '/calendar-events')];
-                case 47:
-                    _x.sent();
+                case 57:
+                    _11.sent();
                     return [4 /*yield*/, expectAllowed(S3, 'listed: organizations', startSession.authToken, 'get', '/organizations')];
-                case 48:
-                    _x.sent();
+                case 58:
+                    _11.sent();
                     return [4 /*yield*/, expectAllowed(S3, 'listed: users', startSession.authToken, 'get', '/users')];
-                case 49:
-                    _x.sent();
+                case 59:
+                    _11.sent();
                     return [4 /*yield*/, expectAllowed(S3, 'listed: endusers', startSession.authToken, 'get', '/endusers')];
-                case 50:
-                    _x.sent();
+                case 60:
+                    _11.sent();
                     return [4 /*yield*/, expectAllowed(S3, 'listed: pinned calendar event', startSession.authToken, 'get', "/calendar-event/".concat(startEvent.id))];
-                case 51:
-                    _x.sent();
+                case 61:
+                    _11.sent();
                     return [4 /*yield*/, expectAllowed(S3, 'wildcard: meeting by id', startSession.authToken, 'get', "/meeting/".concat(OBJECT_ID))];
-                case 52:
-                    _x.sent();
+                case 62:
+                    _11.sent();
                     return [4 /*yield*/, expectAllowed(S3, 'prefix descendant: users bulk-read', startSession.authToken, 'post', '/users/bulk-read', { ids: [hostUser.id] })];
-                case 53:
-                    _x.sent();
+                case 63:
+                    _11.sent();
                     return [4 /*yield*/, expectAllowed(S3, 'prefix descendant: endusers bulk-read', startSession.authToken, 'post', '/endusers/bulk-read', { ids: [joinEnduser.id] })];
-                case 54:
-                    _x.sent();
+                case 64:
+                    _11.sent();
                     return [4 /*yield*/, expectAllowed(S3, 'widened: join meeting for event', startSession.authToken, 'post', '/join-meeting-for-event', { calendarEventId: startEvent.id })];
-                case 55:
-                    _x.sent();
+                case 65:
+                    _11.sent();
                     return [4 /*yield*/, expectAllowed(S3, 'widened: add attendees to meeting', startSession.authToken, 'post', '/add-attendees-to-meeting', { id: OBJECT_ID })
                         // login_user propagates allowedPaths implicitly through its ...toSign rest spread — the
                         // "(ASSUMPTION)" comments in the mint sites depend on this, so assert it explicitly
                     ];
-                case 56:
-                    _x.sent();
+                case 66:
+                    _11.sent();
                     return [4 /*yield*/, request(startSession.authToken, 'post', '/refresh-session', {})];
-                case 57:
-                    refreshedStart = _x.sent();
-                    refreshedStartToken = (_u = refreshedStart.body) === null || _u === void 0 ? void 0 : _u.authToken;
+                case 67:
+                    refreshedStart = _11.sent();
+                    refreshedStartToken = (_7 = refreshedStart.body) === null || _7 === void 0 ? void 0 : _7.authToken;
                     probes.push({
                         scenario: S3, label: 'refresh returned a new token', path: '/refresh-session',
                         expected: 'allowed', status: refreshedStart.status, pass: !!refreshedStartToken,
                     });
-                    if (!refreshedStartToken) return [3 /*break*/, 60];
+                    if (!refreshedStartToken) return [3 /*break*/, 70];
                     return [4 /*yield*/, expectDenied(S3, 'after refresh: still denied journeys', refreshedStartToken, baselineUserToken, 'get', '/journeys')];
-                case 58:
-                    _x.sent();
+                case 68:
+                    _11.sent();
                     return [4 /*yield*/, expectAllowed(S3, 'after refresh: still allowed my meetings', refreshedStartToken, 'get', '/my-meetings')];
-                case 59:
-                    _x.sent();
-                    _x.label = 60;
-                case 60:
+                case 69:
+                    _11.sent();
+                    _11.label = 70;
+                case 70:
                     S4 = 'S4 widening side-effects';
                     prefixGranted = [
                         ['patch', '/calendar-events/bulk-update'],
                         ['post', '/calendar-events/report'],
                     ];
-                    _i = 0, prefixGranted_1 = prefixGranted;
-                    _x.label = 61;
-                case 61:
-                    if (!(_i < prefixGranted_1.length)) return [3 /*break*/, 64];
-                    _b = prefixGranted_1[_i], method = _b[0], path = _b[1];
+                    _c = 0, prefixGranted_1 = prefixGranted;
+                    _11.label = 71;
+                case 71:
+                    if (!(_c < prefixGranted_1.length)) return [3 /*break*/, 74];
+                    _d = prefixGranted_1[_c], method = _d[0], path = _d[1];
                     return [4 /*yield*/, axios_1.default.request({
                             method: method,
                             url: "".concat(host, "/v1").concat(path),
@@ -460,8 +590,8 @@ var allowed_paths_confinement_tests = function (_a) {
                             headers: { Authorization: "Bearer ".concat(joinSession.authToken) },
                             validateStatus: function () { return true; },
                         })];
-                case 62:
-                    r = _x.sent();
+                case 72:
+                    r = _11.sent();
                     probes.push({
                         scenario: S4,
                         label: "enduser action gating blocks ".concat(method.toUpperCase(), " ").concat(path),
@@ -471,146 +601,222 @@ var allowed_paths_confinement_tests = function (_a) {
                         pass: r.status === 401 || r.status === 403,
                         note: 'prefix-granted by /calendar-events; blocked by enduserActions instead',
                     });
-                    _x.label = 63;
-                case 63:
-                    _i++;
-                    return [3 /*break*/, 61];
-                case 64:
+                    _11.label = 73;
+                case 73:
+                    _c++;
+                    return [3 /*break*/, 71];
+                case 74:
                     S6 = 'S6 namespace escapes';
                     ABSENT_ID_A = '68a1b2c3d4e5f60718293a4b';
                     ABSENT_ID_B = '68a1b2c3d4e5f60718293a4c';
                     INVALID_EMAIL = 'f0166-not-an-email';
                     return [4 /*yield*/, expectDenied(S6, 'ESCAPE: /users/consent (minted an unconfined token)', startSession.authToken, baselineUserToken, 'patch', '/users/consent', { termsVersion: '1' })];
-                case 65:
-                    _x.sent();
+                case 75:
+                    _11.sent();
                     return [4 /*yield*/, expectDenied(S6, 'ESCAPE: /users/switch-account', startSession.authToken, baselineUserToken, 'post', '/users/switch-account', { targetUserId: ABSENT_ID_A })];
-                case 66:
-                    _x.sent();
+                case 76:
+                    _11.sent();
                     return [4 /*yield*/, expectDenied(S6, 'ESCAPE: /users/configure-inbox', startSession.authToken, baselineUserToken, 'post', '/users/configure-inbox', {})];
-                case 67:
-                    _x.sent();
+                case 77:
+                    _11.sent();
                     return [4 /*yield*/, expectDenied(S6, 'PHI: /endusers/load-inbox-data', startSession.authToken, baselineUserToken, 'get', '/endusers/load-inbox-data')];
-                case 68:
-                    _x.sent();
+                case 78:
+                    _11.sent();
                     return [4 /*yield*/, expectDenied(S6, 'PHI: /endusers/report', startSession.authToken, baselineUserToken, 'get', '/endusers/report')];
-                case 69:
-                    _x.sent();
+                case 79:
+                    _11.sent();
                     return [4 /*yield*/, expectDenied(S6, 'PHI: /endusers/engagement', startSession.authToken, baselineUserToken, 'get', '/endusers/engagement')];
-                case 70:
-                    _x.sent();
+                case 80:
+                    _11.sent();
                     return [4 /*yield*/, expectDenied(S6, 'DESTRUCTIVE: /endusers/merge', startSession.authToken, baselineUserToken, 'post', '/endusers/merge', { sourceEnduserId: ABSENT_ID_A, destinationEnduserId: ABSENT_ID_B })];
-                case 71:
-                    _x.sent();
+                case 81:
+                    _11.sent();
                     return [4 /*yield*/, expectDenied(S6, 'DESTRUCTIVE: /endusers/bulk-update', startSession.authToken, baselineUserToken, 'patch', '/endusers/bulk-update', { ids: [ABSENT_ID_A], fields: {} })
                         // method scoping, end to end: the same path is readable but not writable.
                         // Baselines use the ADMIN token — the throwaway host user cannot create users or endusers, so it
                         // would 403 on permissions and the probe could not distinguish that from a confinement denial.
                     ];
-                case 72:
-                    _x.sent();
+                case 82:
+                    _11.sent();
                     // method scoping, end to end: the same path is readable but not writable.
                     // Baselines use the ADMIN token — the throwaway host user cannot create users or endusers, so it
                     // would 403 on permissions and the probe could not distinguish that from a confinement denial.
                     return [4 /*yield*/, expectAllowed(S6, 'method scoping: GET /endusers allowed', startSession.authToken, 'get', '/endusers')];
-                case 73:
+                case 83:
                     // method scoping, end to end: the same path is readable but not writable.
                     // Baselines use the ADMIN token — the throwaway host user cannot create users or endusers, so it
                     // would 403 on permissions and the probe could not distinguish that from a confinement denial.
-                    _x.sent();
+                    _11.sent();
                     return [4 /*yield*/, expectDenied(S6, 'method scoping: POST /endusers (create) denied', startSession.authToken, sdk.authToken, 'post', '/endusers', { email: INVALID_EMAIL })];
-                case 74:
-                    _x.sent();
+                case 84:
+                    _11.sent();
                     return [4 /*yield*/, expectAllowed(S6, 'method scoping: GET /users allowed', startSession.authToken, 'get', '/users')];
-                case 75:
-                    _x.sent();
+                case 85:
+                    _11.sent();
                     return [4 /*yield*/, expectDenied(S6, 'method scoping: POST /users (create) denied', startSession.authToken, sdk.authToken, 'post', '/users', { email: INVALID_EMAIL })
                         // even if consent were reachable, the token it mints must stay confined (defense in depth)
                     ];
-                case 76:
-                    _x.sent();
+                case 86:
+                    _11.sent();
                     return [4 /*yield*/, request(startSession.authToken, 'patch', '/users/consent', { termsVersion: '1' })];
-                case 77:
-                    consentAttempt = _x.sent();
-                    if (!(consentAttempt.status === 200 && ((_v = consentAttempt.body) === null || _v === void 0 ? void 0 : _v.authToken))) return [3 /*break*/, 79];
+                case 87:
+                    consentAttempt = _11.sent();
+                    if (!(consentAttempt.status === 200 && ((_8 = consentAttempt.body) === null || _8 === void 0 ? void 0 : _8.authToken))) return [3 /*break*/, 89];
                     return [4 /*yield*/, expectDenied(S6, 'consent-minted token is still confined', consentAttempt.body.authToken, baselineUserToken, 'get', '/journeys')];
-                case 78:
-                    _x.sent();
-                    _x.label = 79;
-                case 79: return [4 /*yield*/, request(startSession.authToken, 'post', '/refresh-session', {})];
-                case 80:
-                    refreshedForScopes = _x.sent();
-                    rescopedToken = (_w = refreshedForScopes.body) === null || _w === void 0 ? void 0 : _w.authToken;
+                case 88:
+                    _11.sent();
+                    _11.label = 89;
+                case 89: return [4 /*yield*/, request(startSession.authToken, 'post', '/refresh-session', {})];
+                case 90:
+                    refreshedForScopes = _11.sent();
+                    rescopedToken = (_9 = refreshedForScopes.body) === null || _9 === void 0 ? void 0 : _9.authToken;
                     probes.push({
                         scenario: S6, label: 'refresh returned a new token', path: '/refresh-session',
                         expected: 'allowed', status: refreshedForScopes.status, pass: !!rescopedToken,
                     });
-                    if (!rescopedToken) return [3 /*break*/, 86];
+                    if (!rescopedToken) return [3 /*break*/, 96];
                     return [4 /*yield*/, expectDenied(S6, 'after refresh: still cannot reach /users/consent', rescopedToken, baselineUserToken, 'patch', '/users/consent', { termsVersion: '1' })];
-                case 81:
-                    _x.sent();
+                case 91:
+                    _11.sent();
                     return [4 /*yield*/, expectDenied(S6, 'after refresh: still cannot reach /endusers/load-inbox-data', rescopedToken, baselineUserToken, 'get', '/endusers/load-inbox-data')];
-                case 82:
-                    _x.sent();
+                case 92:
+                    _11.sent();
                     return [4 /*yield*/, expectDenied(S6, 'after refresh: POST /endusers still denied', rescopedToken, baselineUserToken, 'post', '/endusers', { email: "f0166-should-not-exist-".concat(RAND(), "@tellescope.example") })];
-                case 83:
-                    _x.sent();
+                case 93:
+                    _11.sent();
                     return [4 /*yield*/, expectAllowed(S6, 'after refresh: GET /endusers still allowed', rescopedToken, 'get', '/endusers')];
-                case 84:
-                    _x.sent();
+                case 94:
+                    _11.sent();
                     return [4 /*yield*/, expectAllowed(S6, 'after refresh: my-meetings still allowed', rescopedToken, 'get', '/my-meetings')];
-                case 85:
-                    _x.sent();
-                    _x.label = 86;
-                case 86:
+                case 95:
+                    _11.sent();
+                    _11.label = 96;
+                case 96:
+                    S7 = 'S7 appointment-booking';
+                    return [4 /*yield*/, sdk.api.calendar_event_templates.createOne({
+                            title: "F-0166 booking ".concat(RAND()), durationInMinutes: 30,
+                        })];
+                case 97:
+                    bookingTemplate = _11.sent();
+                    templateId = bookingTemplate.id;
+                    bookingEnduserEmail = "f0166-booking-".concat(RAND(), "@tellescope.example");
+                    return [4 /*yield*/, sdk.api.endusers.createOne({
+                            email: bookingEnduserEmail, fname: 'Booking', lname: 'Confinement',
+                        })];
+                case 98:
+                    bookingEnduser = _11.sent();
+                    bookingEnduserId = bookingEnduser.id;
+                    return [4 /*yield*/, new sdk_1.EnduserSession({ host: host, businessId: businessId })
+                            .api.calendar_events.session_for_public_appointment_booking({
+                            businessId: businessId,
+                            calendarEventTemplateId: bookingTemplate.id,
+                            email: bookingEnduserEmail,
+                            fname: 'Booking',
+                            lname: 'Confinement',
+                        })];
+                case 99:
+                    bookingSession = _11.sent();
+                    return [4 /*yield*/, expectAllowed(S7, 'field-restricted: may record terms consent', bookingSession.authToken, 'patch', "/enduser/".concat(bookingEnduser.id), { updates: { termsSigned: new Date().toISOString(), termsVersion: '1' } })];
+                case 100:
+                    _11.sent();
+                    return [4 /*yield*/, request(bookingSession.authToken, 'patch', "/enduser/".concat(bookingEnduser.id), { updates: { termsVersion: '2' } })];
+                case 101:
+                    bookingEcho = _11.sent();
+                    bookingLeaked = Object.keys((_10 = bookingEcho.body) !== null && _10 !== void 0 ? _10 : {})
+                        .filter(function (k) { return !['id', 'termsSigned', 'termsVersion'].includes(k); });
+                    probes.push({
+                        scenario: S7,
+                        label: 'field-restricted: update response echoes only the writable fields',
+                        path: "/enduser/".concat(bookingEnduser.id),
+                        expected: 'allowed',
+                        status: bookingLeaked.length === 0 ? bookingEcho.status : 500,
+                        pass: bookingEcho.status === 200 && bookingLeaked.length === 0,
+                        note: bookingLeaked.length ? "LEAKED [".concat(bookingLeaked, "]") : undefined,
+                    });
+                    _e = 0, _f = [['email', "f0166-bt-".concat(RAND(), "@tellescope.example")], ['phone', '+15555550188']];
+                    _11.label = 102;
+                case 102:
+                    if (!(_e < _f.length)) return [3 /*break*/, 105];
+                    _g = _f[_e], field = _g[0], value = _g[1];
+                    return [4 /*yield*/, request(bookingSession.authToken, 'patch', "/enduser/".concat(bookingEnduser.id), { updates: (_1 = {}, _1[field] = value, _1) })];
+                case 103:
+                    r = _11.sent();
+                    probes.push({
+                        scenario: S7,
+                        label: "field-restricted: cannot write enduser '".concat(field, "'"),
+                        path: "/enduser/".concat(bookingEnduser.id),
+                        expected: 'denied',
+                        status: r.status,
+                        pass: r.status === 403,
+                        note: 'route is granted; the field allowlist is what refuses this',
+                    });
+                    _11.label = 104;
+                case 104:
+                    _e++;
+                    return [3 /*break*/, 102];
+                case 105: 
+                // the booking scope must not have gained anything else along with the enduser write
+                return [4 /*yield*/, expectDenied(S7, 'unlisted: form responses', bookingSession.authToken, baselineEnduserToken, 'get', '/form-responses')];
+                case 106:
+                    // the booking scope must not have gained anything else along with the enduser write
+                    _11.sent();
+                    return [4 /*yield*/, expectDenied(S7, 'unlisted: calendar events', bookingSession.authToken, baselineEnduserToken, 'get', '/calendar-events')];
+                case 107:
+                    _11.sent();
+                    return [4 /*yield*/, expectAllowed(S7, 'listed: refresh enduser session', bookingSession.authToken, 'post', '/refresh-enduser-session')
+                        /* ============ S5: ordinary sessions with no allowedPaths claim ============ */
+                    ];
+                case 108:
+                    _11.sent();
                     S5 = 'S5 unconfined sessions';
-                    _c = 0, _d = ['/journeys', '/form-responses', '/endusers', '/calendar-events', '/tickets'];
-                    _x.label = 87;
-                case 87:
-                    if (!(_c < _d.length)) return [3 /*break*/, 90];
-                    path = _d[_c];
+                    _h = 0, _j = ['/journeys', '/form-responses', '/endusers', '/calendar-events', '/tickets'];
+                    _11.label = 109;
+                case 109:
+                    if (!(_h < _j.length)) return [3 /*break*/, 112];
+                    path = _j[_h];
                     return [4 /*yield*/, expectAllowed(S5, "staff session reaches ".concat(path), baselineUserToken, 'get', path)];
-                case 88:
-                    _x.sent();
-                    _x.label = 89;
-                case 89:
-                    _c++;
-                    return [3 /*break*/, 87];
-                case 90: return [4 /*yield*/, expectAllowed(S5, 'staff session reaches /data-sync', baselineUserToken, 'get', '/data-sync', { from: new Date(Date.now() - 60000).toISOString() })];
-                case 91:
-                    _x.sent();
-                    _e = 0, _f = ['/form-responses', '/calendar-events', '/files'];
-                    _x.label = 92;
-                case 92:
-                    if (!(_e < _f.length)) return [3 /*break*/, 95];
-                    path = _f[_e];
+                case 110:
+                    _11.sent();
+                    _11.label = 111;
+                case 111:
+                    _h++;
+                    return [3 /*break*/, 109];
+                case 112: return [4 /*yield*/, expectAllowed(S5, 'staff session reaches /data-sync', baselineUserToken, 'get', '/data-sync', { from: new Date(Date.now() - 60000).toISOString() })];
+                case 113:
+                    _11.sent();
+                    _k = 0, _l = ['/form-responses', '/calendar-events', '/files'];
+                    _11.label = 114;
+                case 114:
+                    if (!(_k < _l.length)) return [3 /*break*/, 117];
+                    path = _l[_k];
                     return [4 /*yield*/, expectAllowed(S5, "enduser session reaches ".concat(path), baselineEnduserToken, 'get', path)];
-                case 93:
-                    _x.sent();
-                    _x.label = 94;
-                case 94:
-                    _e++;
-                    return [3 /*break*/, 92];
-                case 95: return [4 /*yield*/, sdk.test_authenticated()];
-                case 96:
-                    adminAuthenticated = _x.sent();
+                case 115:
+                    _11.sent();
+                    _11.label = 116;
+                case 116:
+                    _k++;
+                    return [3 /*break*/, 114];
+                case 117: return [4 /*yield*/, sdk.test_authenticated()];
+                case 118:
+                    adminAuthenticated = _11.sent();
                     probes.push({
                         scenario: S5, label: 'admin sdk still authenticated', path: '/test-authenticated',
                         expected: 'allowed', status: 200, pass: adminAuthenticated === 'Authenticated!',
                     });
                     apiKeySDK = new sdk_1.Session({ host: host, apiKey: '3n5q0SCBT_iUvZz-b9BJtX7o7HQUVJ9v132PgHJNJsg.' });
-                    _g = 0, _h = ['/journeys', '/form-responses', '/endusers', '/calendar-events', '/files'];
-                    _x.label = 97;
-                case 97:
-                    if (!(_g < _h.length)) return [3 /*break*/, 100];
-                    path = _h[_g];
+                    _m = 0, _o = ['/journeys', '/form-responses', '/endusers', '/calendar-events', '/files'];
+                    _11.label = 119;
+                case 119:
+                    if (!(_m < _o.length)) return [3 /*break*/, 122];
+                    path = _o[_m];
                     return [4 /*yield*/, axios_1.default.request({
                             method: 'get',
                             url: "".concat(host, "/v1").concat(path),
                             headers: { Authorization: "API_KEY ".concat(apiKeySDK.apiKey) },
                             validateStatus: function () { return true; },
                         })];
-                case 98:
-                    r = _x.sent();
+                case 120:
+                    r = _11.sent();
                     probes.push({
                         scenario: S5,
                         label: "API key (headless) reaches ".concat(path),
@@ -619,11 +825,11 @@ var allowed_paths_confinement_tests = function (_a) {
                         status: r.status,
                         pass: r.status !== 403,
                     });
-                    _x.label = 99;
-                case 99:
-                    _g++;
-                    return [3 /*break*/, 97];
-                case 100:
+                    _11.label = 121;
+                case 121:
+                    _m++;
+                    return [3 /*break*/, 119];
+                case 122:
                     failures = probes.filter(function (p) { return !p.pass; });
                     console.log('');
                     console.log('  F-0166 — full probe table');
@@ -633,111 +839,135 @@ var allowed_paths_confinement_tests = function (_a) {
                         var inScenario = probes.filter(function (p) { return p.scenario === scenario; });
                         var failed = inScenario.filter(function (p) { return !p.pass; }).length;
                         console.log("  ".concat(scenario, ": ").concat(inScenario.length - failed, "/").concat(inScenario.length, " passing").concat(failed ? "  <-- ".concat(failed, " FAILING") : ''));
-                        for (var _y = 0, inScenario_1 = inScenario; _y < inScenario_1.length; _y++) {
-                            var p = inScenario_1[_y];
+                        for (var _12 = 0, inScenario_1 = inScenario; _12 < inScenario_1.length; _12++) {
+                            var p = inScenario_1[_12];
                             var baseline = p.baselineStatus !== undefined ? " baseline=".concat(p.baselineStatus) : '';
                             console.log("    ".concat(p.pass ? ' ok ' : 'FAIL', "  want=").concat(p.expected.padEnd(7), " got=").concat(p.status).concat(baseline, "  ").concat(p.label).concat(p.note ? "  (".concat(p.note, ")") : ''));
                         }
                     };
-                    for (_j = 0, scenarios_1 = scenarios; _j < scenarios_1.length; _j++) {
-                        scenario = scenarios_1[_j];
+                    for (_p = 0, scenarios_1 = scenarios; _p < scenarios_1.length; _p++) {
+                        scenario = scenarios_1[_p];
                         _loop_1(scenario);
                     }
                     console.log('  ' + '-'.repeat(112));
                     console.log("  TOTAL: ".concat(probes.length - failures.length, "/").concat(probes.length, " passing, ").concat(failures.length, " failing"));
                     console.log('');
-                    for (_k = 0, probes_1 = probes; _k < probes_1.length; _k++) {
-                        p = probes_1[_k];
+                    for (_q = 0, probes_1 = probes; _q < probes_1.length; _q++) {
+                        p = probes_1[_q];
                         (0, testing_1.assert)(p.pass, "".concat(p.scenario, " \u2014 ").concat(p.label, " (").concat(p.path, "): wanted ").concat(p.expected, ", got status ").concat(p.status)
                             + (p.baselineStatus !== undefined ? " (unconfined baseline got ".concat(p.baselineStatus, ")") : ''), "".concat(p.scenario, " \u2014 ").concat(p.label));
                     }
-                    return [3 /*break*/, 130];
-                case 101:
-                    _l = 0, eventIds_1 = eventIds;
-                    _x.label = 102;
-                case 102:
-                    if (!(_l < eventIds_1.length)) return [3 /*break*/, 107];
-                    id = eventIds_1[_l];
-                    _x.label = 103;
-                case 103:
-                    _x.trys.push([103, 105, , 106]);
+                    return [3 /*break*/, 160];
+                case 123:
+                    _r = 0, eventIds_1 = eventIds;
+                    _11.label = 124;
+                case 124:
+                    if (!(_r < eventIds_1.length)) return [3 /*break*/, 129];
+                    id = eventIds_1[_r];
+                    _11.label = 125;
+                case 125:
+                    _11.trys.push([125, 127, , 128]);
                     return [4 /*yield*/, sdk.api.calendar_events.deleteOne(id)];
-                case 104:
-                    _x.sent();
-                    return [3 /*break*/, 106];
-                case 105:
-                    _m = _x.sent();
-                    return [3 /*break*/, 106];
-                case 106:
-                    _l++;
-                    return [3 /*break*/, 102];
-                case 107:
-                    if (!joinEnduserId) return [3 /*break*/, 111];
-                    _x.label = 108;
-                case 108:
-                    _x.trys.push([108, 110, , 111]);
+                case 126:
+                    _11.sent();
+                    return [3 /*break*/, 128];
+                case 127:
+                    _s = _11.sent();
+                    return [3 /*break*/, 128];
+                case 128:
+                    _r++;
+                    return [3 /*break*/, 124];
+                case 129:
+                    if (!joinEnduserId) return [3 /*break*/, 133];
+                    _11.label = 130;
+                case 130:
+                    _11.trys.push([130, 132, , 133]);
                     return [4 /*yield*/, sdk.api.endusers.deleteOne(joinEnduserId)];
-                case 109:
-                    _x.sent();
-                    return [3 /*break*/, 111];
-                case 110:
-                    _o = _x.sent();
-                    return [3 /*break*/, 111];
-                case 111:
-                    if (!formEnduserEmail) return [3 /*break*/, 117];
-                    _x.label = 112;
-                case 112:
-                    _x.trys.push([112, 116, , 117]);
+                case 131:
+                    _11.sent();
+                    return [3 /*break*/, 133];
+                case 132:
+                    _t = _11.sent();
+                    return [3 /*break*/, 133];
+                case 133:
+                    if (!formEnduserEmail) return [3 /*break*/, 139];
+                    _11.label = 134;
+                case 134:
+                    _11.trys.push([134, 138, , 139]);
                     return [4 /*yield*/, sdk.api.endusers.getOne({ email: formEnduserEmail })];
-                case 113:
-                    e = _x.sent();
-                    if (!(e === null || e === void 0 ? void 0 : e.id)) return [3 /*break*/, 115];
+                case 135:
+                    e = _11.sent();
+                    if (!(e === null || e === void 0 ? void 0 : e.id)) return [3 /*break*/, 137];
                     return [4 /*yield*/, sdk.api.endusers.deleteOne(e.id)];
-                case 114:
-                    _x.sent();
-                    _x.label = 115;
-                case 115: return [3 /*break*/, 117];
-                case 116:
-                    _p = _x.sent();
-                    return [3 /*break*/, 117];
-                case 117:
-                    if (!hostUserId) return [3 /*break*/, 121];
-                    _x.label = 118;
-                case 118:
-                    _x.trys.push([118, 120, , 121]);
+                case 136:
+                    _11.sent();
+                    _11.label = 137;
+                case 137: return [3 /*break*/, 139];
+                case 138:
+                    _u = _11.sent();
+                    return [3 /*break*/, 139];
+                case 139:
+                    if (!hostUserId) return [3 /*break*/, 143];
+                    _11.label = 140;
+                case 140:
+                    _11.trys.push([140, 142, , 143]);
                     return [4 /*yield*/, sdk.api.users.deleteOne(hostUserId)];
-                case 119:
-                    _x.sent();
-                    return [3 /*break*/, 121];
-                case 120:
-                    _q = _x.sent();
-                    return [3 /*break*/, 121];
-                case 121:
-                    if (!productId) return [3 /*break*/, 125];
-                    _x.label = 122;
-                case 122:
-                    _x.trys.push([122, 124, , 125]);
+                case 141:
+                    _11.sent();
+                    return [3 /*break*/, 143];
+                case 142:
+                    _v = _11.sent();
+                    return [3 /*break*/, 143];
+                case 143:
+                    if (!bookingEnduserId) return [3 /*break*/, 147];
+                    _11.label = 144;
+                case 144:
+                    _11.trys.push([144, 146, , 147]);
+                    return [4 /*yield*/, sdk.api.endusers.deleteOne(bookingEnduserId)];
+                case 145:
+                    _11.sent();
+                    return [3 /*break*/, 147];
+                case 146:
+                    _w = _11.sent();
+                    return [3 /*break*/, 147];
+                case 147:
+                    if (!templateId) return [3 /*break*/, 151];
+                    _11.label = 148;
+                case 148:
+                    _11.trys.push([148, 150, , 151]);
+                    return [4 /*yield*/, sdk.api.calendar_event_templates.deleteOne(templateId)];
+                case 149:
+                    _11.sent();
+                    return [3 /*break*/, 151];
+                case 150:
+                    _x = _11.sent();
+                    return [3 /*break*/, 151];
+                case 151:
+                    if (!productId) return [3 /*break*/, 155];
+                    _11.label = 152;
+                case 152:
+                    _11.trys.push([152, 154, , 155]);
                     return [4 /*yield*/, sdk.api.products.deleteOne(productId)];
-                case 123:
-                    _x.sent();
-                    return [3 /*break*/, 125];
-                case 124:
-                    _r = _x.sent();
-                    return [3 /*break*/, 125];
-                case 125:
-                    if (!formId) return [3 /*break*/, 129];
-                    _x.label = 126;
-                case 126:
-                    _x.trys.push([126, 128, , 129]);
+                case 153:
+                    _11.sent();
+                    return [3 /*break*/, 155];
+                case 154:
+                    _y = _11.sent();
+                    return [3 /*break*/, 155];
+                case 155:
+                    if (!formId) return [3 /*break*/, 159];
+                    _11.label = 156;
+                case 156:
+                    _11.trys.push([156, 158, , 159]);
                     return [4 /*yield*/, sdk.api.forms.deleteOne(formId)];
-                case 127:
-                    _x.sent();
-                    return [3 /*break*/, 129];
-                case 128:
-                    _s = _x.sent();
-                    return [3 /*break*/, 129];
-                case 129: return [7 /*endfinally*/];
-                case 130: return [2 /*return*/];
+                case 157:
+                    _11.sent();
+                    return [3 /*break*/, 159];
+                case 158:
+                    _z = _11.sent();
+                    return [3 /*break*/, 159];
+                case 159: return [7 /*endfinally*/];
+                case 160: return [2 /*return*/];
             }
         });
     });