@tellescope/sdk 1.255.19 → 1.256.1

package/src/tests/api_tests/phone_calls_cold_transfer.test.ts

@@ -6,11 +6,13 @@ import {
   handleAnyError,
   log_header,
 } from "@tellescope/testing"
+import { FULL_ACCESS, PROVIDER_PERMISSIONS } from "@tellescope/constants"
 import { setup_tests } from "../setup"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
 const NONEXISTENT_MONGO_ID = '60398b1131a295e64f084fff'
+const RAND = () => Math.random().toString(36).slice(2, 10)
 
 // Validation-path tests for the cold transfer endpoint. All assertions below hit
 // validations that run before any Twilio access, so no Twilio config is needed.
@@ -19,6 +21,7 @@ export const phone_calls_cold_transfer_tests = async ({ sdk, sdkNonAdmin } : { s
 
   const enduser = await sdk.api.endusers.createOne({ fname: 'Cold', lname: 'Transfer' })
   const targetUsers: { id: string }[] = []
+  const createdRoleIds: string[] = []
 
   try {
     const inboundCall = await sdk.api.phone_calls.createOne({
@@ -81,11 +84,62 @@ export const phone_calls_cold_transfer_tests = async ({ sdk, sdkNonAdmin } : { s
       () => sdkNonAdmin.api.phone_calls.cold_transfer({ callSid: inboundCall.externalId, targetUserId: disabledTargetUser.id }),
       handleAnyError
     )
+
+    // ── target-user lookup must be gated by users READ access, not the endpoint's update access ──
+    // PROVIDER_PERMISSIONS already models the reported bug: users read='All', update='Default'.
+    // phone_calls gets FULL_ACCESS so the call itself is visible under update-level filtering.
+    const mkRoleUser = async (permissions: any) => {
+      const role = `cold-transfer-${RAND()}`
+      const rbap = await sdk.api.role_based_access_permissions.createOne({ role, permissions })
+      createdRoleIds.push(rbap.id)
+
+      const user = await sdk.api.users.createOne({
+        email: `cold.transfer.${RAND()}@tellescope.example`,
+        fname: 'Cold', lname: 'TransferRole',
+        notificationEmailsDisabled: true, verifiedEmail: true,
+        roles: [role],
+      } as any)
+      targetUsers.push(user)
+
+      const { authToken, user: sessionUser } = await sdk.api.users.generate_auth_token({ id: user.id })
+      const session = new Session({ host })
+      session.setAuthToken(authToken)
+      session.setUserInfo(sessionUser as any)
+      return session
+    }
+
+    const sdkUpdateDefault = await mkRoleUser({ ...PROVIDER_PERMISSIONS, phone_calls: FULL_ACCESS })
+    const sdkReadDefault = await mkRoleUser({
+      ...PROVIDER_PERMISSIONS,
+      phone_calls: FULL_ACCESS,
+      users: { create: null, read: 'Default', update: 'Default', delete: null },
+    })
+
+    // regression: previously failed with "Target user not found" because the lookup was
+    // filtered by users update='Default' (self-only); getting past it to the
+    // incoming-calls-disabled validation proves the lookup now uses read access
+    await async_test(
+      "cold_transfer: users update=Default no longer blocks the target lookup",
+      () => sdkUpdateDefault.api.phone_calls.cold_transfer({ callSid: inboundCall.externalId, targetUserId: disabledTargetUser.id }),
+      { shouldError: true, onError: (e: any) => e.message === "Target user has incoming calls disabled" }
+    )
+    // guard: the lookup is read-filtered (not org-wide) — users read='Default' still can't see the target
+    await async_test(
+      "cold_transfer: users read=Default still hides the target user",
+      () => sdkReadDefault.api.phone_calls.cold_transfer({ callSid: inboundCall.externalId, targetUserId: disabledTargetUser.id }),
+      { shouldError: true, onError: (e: any) => e.message === "Target user not found" }
+    )
+    await async_test(
+      "cold_transfer: nonexistent target still rejected for restricted role",
+      () => sdkUpdateDefault.api.phone_calls.cold_transfer({ callSid: inboundCall.externalId, targetUserId: NONEXISTENT_MONGO_ID }),
+      { shouldError: true, onError: (e: any) => e.message === "Target user not found" }
+    )
   } finally {
     // deleting the enduser cascades deletion of its phone_calls records
     await Promise.all([
       sdk.api.endusers.deleteOne(enduser.id),
       ...targetUsers.map(u => sdk.api.users.deleteOne(u.id)),
+      ...createdRoleIds.map(id => sdk.api.role_based_access_permissions.deleteOne(id)),
     ]).catch(console.error)
   }
 }

package/src/tests/api_tests/security/F-0013-sanitize-user-html-with-iframes.test.ts

@@ -0,0 +1,215 @@
+import { DEFAULT_IFRAME_SANDBOX, replace_form_field_template_values, sanitize_user_html, sanitize_user_html_with_iframes } from "@tellescope/utilities"
+
+// Companion to F-0013-sanitize-user-html.test.ts (pattern 06 — XSS via dangerouslySetInnerHTML).
+//
+// sanitize_user_html_with_iframes is the variant used by the live form's field description, so
+// admins can embed video / scheduling widgets. It permits <iframe> and NOTHING else beyond what
+// sanitize_user_html allows. This asserts:
+//   1. permitting iframe did not reopen any of the F-0013 vectors (the full payload list is re-run)
+//   2. only absolute https iframes survive — relative, protocol-relative, http, javascript:, data:
+//      and srcdoc frames are dropped, along with their fallback content
+//   3. the restrictive sandbox is forced, but an author-supplied sandbox is honored
+//   4. sanitize_user_html itself still strips iframes (the boundary between the two functions)
+//
+// Pure-function test — no Session needed. Runs as part of the main suite and standalone:
+//   ./build_cjs.sh && cd packages/public/sdk && node -r dotenv/config lib/cjs/tests/api_tests/security/F-0013-sanitize-user-html-with-iframes.test.js
+
+const fail = (msg: string) => { throw new Error(msg) }
+
+// Same as has_no_executable_vector in the F-0013 test, minus the '<iframe' clause (iframes are
+// expected in this function's output). Everything else must still be neutralized.
+const has_no_executable_vector_allowing_iframe = (out: string) => {
+  const o = out.toLowerCase()
+  const withoutValues = o.replace(/"[^"]*"/g, '""').replace(/'[^']*'/g, "''")
+  return !/\son[a-z]+\s*=/.test(withoutValues)   // no live on*= event-handler attribute
+      && !o.includes('javascript:')
+      && !o.includes('vbscript:')
+      && !o.includes('<script')
+      && !o.includes('<svg')
+      && !o.includes('<math')
+      && !o.includes('<object')
+      && !o.includes('<embed')
+      && !o.includes('<form')
+      && !o.includes('<noscript')
+      && !o.includes('<template')
+      && !o.includes('srcdoc')                   // an inline document is arbitrary markup
+}
+
+// Tokens that must NEVER appear in the forced default. allow-top-navigation is the important one:
+// it is what stops a hostile embed from redirecting the patient's form page to a phishing site.
+const FORBIDDEN_SANDBOX_TOKENS = [
+  'allow-top-navigation',
+  'allow-downloads',
+  'allow-modals',
+  'allow-pointer-lock',
+  'allow-orientation-lock',
+]
+
+export const sanitize_user_html_with_iframes_tests = async () => {
+  console.log("Running sanitize_user_html_with_iframes XSS regression tests")
+
+  // ---------------------------------------------------------------------------------------------
+  // 1. Re-run the full F-0013 payload set — permitting iframe must not be a general regression
+  // ---------------------------------------------------------------------------------------------
+  const xssPayloads: [string, string][] = [
+    ['img onerror', `<img src=x onerror="alert(document.domain)">`],
+    ['svg onload', `<svg onload="alert(1)"></svg>`],
+    ['svg animate onbegin', `<svg><animate onbegin="alert(1)" attributeName="x" dur="1s"></svg>`],
+    ['details ontoggle', `<details open ontoggle="alert(1)"></details>`],
+    ['input onfocus autofocus', `<input autofocus onfocus="alert(1)">`],
+    ['body onpageshow', `<body onpageshow="alert(1)">`],
+    ['a javascript scheme', `<a href="javascript:alert(1)">x</a>`],
+    ['a javascript entity-encoded', `<a href="jav&#x09;ascript:alert(1)">x</a>`],
+    ['script tag', `<script>alert(1)</script>`],
+    ['onerror newline before =', `<img src=x onerror\n="alert(1)">`],
+    ['onerror mixed case', `<IMG SRC=x OnErRoR="alert(1)">`],
+    ['marquee onstart', `<marquee onstart="alert(1)">x</marquee>`],
+    ['mathml mglyph style mxss', `<math><mtext><table><mglyph><style><!--</style><img src=x onerror=alert(1)>`],
+    ['svg foreignObject', `<svg><foreignObject><img src=x onerror=alert(1)></foreignObject></svg>`],
+    ['noscript context confusion', `<noscript><p title="</noscript><img src=x onerror=alert(1)>">`],
+    ['template content', `<template><img src=x onerror=alert(1)></template>`],
+    ['comment confusion', `<!--><img src=x onerror=alert(1)>-->`],
+    ['cdata confusion', `<![CDATA[<img src=x onerror=alert(1)>]]>`],
+    ['markup inside attr value', `<img src="x" alt="<script>alert(1)</script>">`],
+    ['vbscript scheme', `<a href="vbscript:msgbox(1)">x</a>`],
+    ['data text/html href', `<a href="data:text/html,<script>alert(1)</script>">x</a>`],
+    ['javascript decimal entity', `<a href="&#74;avascript:alert(1)">x</a>`],
+    ['javascript newline entity', `<a href="jav&#x0A;ascript:alert(1)">x</a>`],
+  ]
+  for (const [name, payload] of xssPayloads) {
+    const out = sanitize_user_html_with_iframes(payload)
+    if (!has_no_executable_vector_allowing_iframe(out)) fail(`XSS not neutralized [${name}] -> ${out}`)
+  }
+
+  // ---------------------------------------------------------------------------------------------
+  // 2. Only absolute https iframes survive
+  // ---------------------------------------------------------------------------------------------
+  const badSrcs: [string, string][] = [
+    ['javascript scheme', `javascript:alert(1)`],
+    ['data text/html', `data:text/html,<script>alert(1)</script>`],
+    ['http (not https)', `http://evil.example`],
+    // sanitize-html does NOT reject protocol-relative iframe srcs on its own when
+    // allowProtocolRelative is set — this is the self-origin framing vector and the reason the
+    // sanitizer does its own absolute-https check.
+    ['protocol-relative', `//app.tellescope.com/`],
+    ['root-relative', `/portal/settings`],
+    ['bare relative', `settings`],
+    ['whitespace-obfuscated', `  https:/\\/\\evil`],
+    ['tab-entity javascript', `jav&#x09;ascript:alert(1)`],
+    ['scheme-only', `https://`],
+    ['empty', ``],
+  ]
+  for (const [name, src] of badSrcs) {
+    const out = sanitize_user_html_with_iframes(`<iframe src="${src}"></iframe>`)
+    if (out.toLowerCase().includes('<iframe')) fail(`bad iframe src survived [${name}] -> ${out}`)
+  }
+
+  // A dropped iframe must take its fallback content with it (exclusiveFilter, not a tagName swap)
+  const fallback = sanitize_user_html_with_iframes(`<iframe src="/x">FALLBACK-TEXT</iframe>`)
+  if (fallback.includes('FALLBACK-TEXT')) fail(`dropped iframe leaked its fallback text: ${fallback}`)
+  if (fallback.toLowerCase().includes('<iframe')) fail(`dropped iframe survived: ${fallback}`)
+
+  // srcdoc is not allowlisted, even alongside a valid src
+  const srcdoc = sanitize_user_html_with_iframes(`<iframe src="https://ok.example" srcdoc="<img src=x onerror=alert(1)>"></iframe>`)
+  if (srcdoc.toLowerCase().includes('srcdoc')) fail(`srcdoc not stripped: ${srcdoc}`)
+  if (!srcdoc.toLowerCase().includes('<iframe')) fail(`valid iframe dropped alongside srcdoc: ${srcdoc}`)
+
+  // handlers / clobbering attributes stripped, frame itself kept
+  const handlers = sanitize_user_html_with_iframes(`<iframe src="https://ok.example" onload="alert(1)" id="x" name="getElementById"></iframe>`)
+  if (!handlers.toLowerCase().includes('<iframe')) fail(`valid iframe dropped: ${handlers}`)
+  if (/\son[a-z]+\s*=/.test(handlers.toLowerCase())) fail(`iframe event handler survived: ${handlers}`)
+  if (/\b(id|name)\s*=/.test(handlers)) fail(`iframe id/name not stripped (DOM clobbering): ${handlers}`)
+
+  // ---------------------------------------------------------------------------------------------
+  // 3. Legitimate embeds survive, hardened
+  // ---------------------------------------------------------------------------------------------
+  // The exact shape draftjs-to-html emits for the WYSIWYG "embedded" button
+  const yt = sanitize_user_html_with_iframes(`<iframe width="560" height="315" src="https://www.youtube.com/embed/abc" frameBorder="0"></iframe>`)
+  if (!yt.includes('src="https://www.youtube.com/embed/abc"')) fail(`youtube embed src stripped: ${yt}`)
+  if (!(yt.includes('width="560"') && yt.includes('height="315"'))) fail(`iframe dimensions stripped: ${yt}`)
+  if (!yt.toLowerCase().includes('frameborder')) fail(`frameborder stripped: ${yt}`)
+
+  // forced containment
+  if (!yt.includes(`sandbox="${DEFAULT_IFRAME_SANDBOX}"`)) fail(`sandbox not forced: ${yt}`)
+  if (!yt.toLowerCase().includes('referrerpolicy=')) fail(`referrerpolicy not set: ${yt}`)
+  for (const token of FORBIDDEN_SANDBOX_TOKENS) {
+    if (DEFAULT_IFRAME_SANDBOX.includes(token)) fail(`forced sandbox must not grant ${token}: ${DEFAULT_IFRAME_SANDBOX}`)
+  }
+  // allow-same-origin IS granted — required for real embeds (a Loom embed renders blank without it)
+  // and harmless because the src is guaranteed cross-origin by the check asserted above.
+  if (!DEFAULT_IFRAME_SANDBOX.includes('allow-same-origin')) fail(`forced sandbox must grant allow-same-origin so real embeds render: ${DEFAULT_IFRAME_SANDBOX}`)
+
+  // author-supplied sandbox honored verbatim, so a surface can tighten (or loosen) per embed.
+  // Uses a value distinct from the default, so this can't pass by coincidence.
+  const authorSandbox = sanitize_user_html_with_iframes(`<iframe src="https://ok.example" sandbox="allow-scripts"></iframe>`)
+  if (!authorSandbox.includes('sandbox="allow-scripts"')) fail(`author sandbox not honored: ${authorSandbox}`)
+
+  // sandbox="" is the MOST restrictive value and must not be replaced by the default
+  const emptySandbox = sanitize_user_html_with_iframes(`<iframe src="https://ok.example" sandbox=""></iframe>`)
+  if (emptySandbox.includes('allow-')) fail(`empty sandbox was replaced with the permissive default: ${emptySandbox}`)
+  if (!/\ssandbox(\s|>)/.test(emptySandbox)) fail(`empty sandbox attribute lost entirely: ${emptySandbox}`)
+
+  // author referrerpolicy honored
+  const noref = sanitize_user_html_with_iframes(`<iframe src="https://ok.example" referrerpolicy="no-referrer"></iframe>`)
+  if (!noref.includes('referrerpolicy="no-referrer"')) fail(`author referrerpolicy not honored: ${noref}`)
+
+  // `allow` (Permissions-Policy delegation, e.g. YouTube autoplay) preserved
+  const allowAttr = sanitize_user_html_with_iframes(`<iframe src="https://ok.example" allow="autoplay; encrypted-media" allowfullscreen></iframe>`)
+  if (!allowAttr.includes('allow="autoplay; encrypted-media"')) fail(`allow attribute stripped: ${allowAttr}`)
+
+  // ---------------------------------------------------------------------------------------------
+  // 4. Everything sanitize_user_html preserves must still be preserved
+  // ---------------------------------------------------------------------------------------------
+  const heading = sanitize_user_html_with_iframes(`<h1>Welcome</h1><h3 style="color:#333">Sub</h3>`)
+  if (!(heading.includes('<h1>') && heading.includes('<h3') && heading.toLowerCase().includes('color'))) fail(`headings/style stripped: ${heading}`)
+
+  const table = sanitize_user_html_with_iframes(`<table><thead><tr><th>H</th></tr></thead><tbody><tr><td style="padding:4px" colspan="2">cell</td></tr></tbody></table>`)
+  if (!(table.includes('<table') && table.includes('<td') && table.includes('colspan'))) fail(`table stripped: ${table}`)
+
+  const list = sanitize_user_html_with_iframes(`<ul><li>a</li></ul><ol start="3"><li>c</li></ol>`)
+  if (!(list.includes('<ul') && list.includes('<li') && list.includes('<ol'))) fail(`list stripped: ${list}`)
+
+  const link = sanitize_user_html_with_iframes(`<a href="https://example.com">link</a>`)
+  if (!link.includes('href="https://example.com"')) fail(`safe link stripped: ${link}`)
+  if (!link.toLowerCase().includes('noopener')) fail(`external link not hardened: ${link}`)
+
+  const img = sanitize_user_html_with_iframes(`<img src="https://cdn.example.com/a.png" alt="pic" width="200">`)
+  if (!(img.includes('src="https://cdn.example.com/a.png"') && img.includes('alt="pic"'))) fail(`image stripped: ${img}`)
+
+  const dataimg = sanitize_user_html_with_iframes(`<img src="data:image/png;base64,iVBORw0KGgo=">`)
+  if (!dataimg.includes('data:image/png')) fail(`data: image stripped: ${dataimg}`)
+
+  const fmt = sanitize_user_html_with_iframes(`<p><strong>b</strong> <em>i</em> <span style="font-size:14px">s</span></p><blockquote>q</blockquote>`)
+  if (!(fmt.includes('<strong>') && fmt.includes('<span') && fmt.toLowerCase().includes('font-size'))) fail(`formatting stripped: ${fmt}`)
+
+  // ---------------------------------------------------------------------------------------------
+  // 5. The boundary: sanitize_user_html must NOT have been loosened
+  // ---------------------------------------------------------------------------------------------
+  const shared = sanitize_user_html(`<iframe src="https://www.youtube.com/embed/abc"></iframe>`)
+  if (shared.toLowerCase().includes('<iframe')) fail(`sanitize_user_html must still strip iframes: ${shared}`)
+
+  // ---------------------------------------------------------------------------------------------
+  // 6. End to end: an admin's iframe survives templating, a patient-injected one does not
+  // ---------------------------------------------------------------------------------------------
+  const adminTemplate = `<p>Hi {{enduser.fname}}, watch this:</p><iframe src="https://www.youtube.com/embed/abc"></iframe>`
+  const templated = replace_form_field_template_values(adminTemplate, {
+    enduser: { fname: `<iframe src="https://evil.example/phish"></iframe>` } as any,
+    responses: [],
+    escapeNewlinesAsHTMLBreaks: true,
+    escapeHTMLValues: true,
+  })
+  const endToEnd = sanitize_user_html_with_iframes(templated)
+  if (!endToEnd.includes('src="https://www.youtube.com/embed/abc"')) fail(`admin's own iframe did not survive: ${endToEnd}`)
+  // The patient's markup must survive only as inert escaped text — so 'evil.example' may still
+  // appear as visible characters, but there must be exactly one LIVE frame (the admin's).
+  if (!endToEnd.includes('&lt;iframe')) fail(`patient markup not escaped to inert text: ${endToEnd}`)
+  if ((endToEnd.toLowerCase().match(/<iframe/g) || []).length !== 1) fail(`patient-injected iframe became a live frame: ${endToEnd}`)
+
+  console.log("✅ sanitize_user_html_with_iframes XSS regression tests passed")
+}
+
+if (require.main === module) {
+  sanitize_user_html_with_iframes_tests()
+    .then(() => { console.log("✅ suite completed"); process.exit(0) })
+    .catch((err) => { console.error("❌ suite failed:", err); process.exit(1) })
+}

package/src/tests/api_tests/security/F-0015-webhook-outbound-ssrf.test.ts

@@ -0,0 +1,292 @@
+require('source-map-support').install();
+
+import http from "http"
+import os from "os"
+import { Session } from "../../../sdk"
+import {
+  assert,
+  async_test,
+  log_header,
+} from "@tellescope/testing"
+import { setup_tests } from "../../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const LOCAL_HOSTNAMES = ['localhost', '127.0.0.1', '::1']
+
+const TEST_SECRET = "f0015 outbound ssrf test secret"
+
+/**
+ * The sentinel — the destination that must NEVER be reached — is bound to this machine's own RFC1918
+ * address rather than to loopback, and that choice is load-bearing.
+ *
+ * Loopback is deliberately permitted outside prod/staging (see api/modules/outbound_url.ts), because
+ * several test suites bind their receivers with `listen(0, '127.0.0.1')` and an ephemeral port cannot be
+ * allowlisted ahead of time. A loopback sentinel would therefore be ALLOWED in exactly the environment
+ * where this test runs, and "the sentinel was not contacted" would pass by allowance while proving
+ * nothing.
+ *
+ * RFC1918 is refused in every environment, so binding there keeps the assertion meaningful AND keeps a
+ * real listener present — which is what lets us prove non-delivery by observation rather than by
+ * reading a log message.
+ */
+const first_private_ipv4 = () => {
+  for (const addresses of Object.values(os.networkInterfaces())) {
+    for (const address of addresses ?? []) {
+      if (address.family !== 'IPv4' || address.internal) continue
+      if (/^10\./.test(address.address)) return address.address
+      if (/^192\.168\./.test(address.address)) return address.address
+      if (/^172\.(1[6-9]|2\d|3[01])\./.test(address.address)) return address.address
+    }
+  }
+  return undefined
+}
+
+/**
+ * 127.0.0.1 only means "the machine running this test" when the API is also local. Against staging or
+ * prod it is the API server itself — the sentinel would never be contacted, every assertion here would
+ * pass for the wrong reason, and we would be creating a real webhook in a live tenant. Fail loudly.
+ */
+const assert_local_api = () => {
+  const hostname = new URL(host).hostname
+  if (!LOCAL_HOSTNAMES.includes(hostname)) {
+    throw new Error(
+      `F-0015 SSRF tests must run against a local API (got ${host}). `
+      + `127.0.0.1 would resolve to the API server rather than this machine, and this test configures a webhook.`
+    )
+  }
+}
+
+const listen = (server: http.Server, address: string) => new Promise<void>((resolve, reject) => {
+  server.once('error', reject)
+  server.listen(0, address, () => resolve()) // ephemeral port — nothing here needs a fixed one
+})
+
+const port_of = (server: http.Server) => (server.address() as any).port
+
+/** Webhook delivery is fire-and-forget, so absence has to be established by waiting. */
+const settle = (ms: number) => new Promise<void>(resolve => setTimeout(resolve, ms))
+const wait_until = async (predicate: () => boolean, ms: number) => {
+  const deadline = Date.now() + ms
+  while (Date.now() < deadline) {
+    if (predicate()) return true
+    await settle(100)
+  }
+  return predicate()
+}
+
+/**
+ * Regression tests for F-0015
+ * (security-audit/findings/F-0015-webhook-outbound-ssrf.md).
+ *
+ * Outbound webhooks request customer-configured URLs that are validated only for SYNTAX
+ * (urlValidator -> validator.isURL, which happily accepts http://10.0.0.1/). Four call sites are
+ * affected: api/modules/webhooks.ts:145, :214, :270, and the five-method block at api/v1/api.ts:9723.
+ *
+ * Two properties make this worse than a blind SSRF:
+ *  - A non-2xx response body is stored in log.response, and webhook_logs is surfaced to customers for
+ *    debugging — so an internal endpoint's error body is readable by the tenant that configured it.
+ *  - The automation send-webhook action builds its URL at runtime through five nested template
+ *    replacers over action.info.url, so patient-controlled field values can reach the destination.
+ *
+ * And critically: axios@0.30.2 follows redirects by default (maxRedirects: 5). A pre-flight check on
+ * the configured URL is therefore NOT sufficient — a receiver can simply 302 to an internal address
+ * after validation has already passed. T4 exists to prove exactly that, which is why the fix has to
+ * validate at connect time (a guarded agent) rather than as a string check.
+ *
+ * Each test below asserts ABSENCE ("the sentinel was never contacted"), which passes trivially if the
+ * request never happened at all — a missing allowlist entry, a webhook that never fired, a broken
+ * subscription. So each is paired with a positive control that proves the attempt really was made.
+ */
+export const webhook_outbound_ssrf_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("F-0015: outbound webhook SSRF")
+  assert_local_api()
+
+  const SENTINEL = `f0015-sentinel-${Date.now()}-${Math.random().toString(36).slice(2)}`
+
+  const privateIP = first_private_ipv4()
+  if (!privateIP) {
+    // Degrade loudly rather than silently passing. Everything below needs a bindable address that the
+    // guard refuses in every environment, and loopback does not qualify (see the note above).
+    assert(
+      false,
+      'F-0015 SKIPPED: no non-loopback RFC1918 interface on this host, so the SSRF sentinel cannot be '
+      + 'bound anywhere the guard refuses. Run on a host with a private network interface.',
+      'F-0015 outbound SSRF',
+    )
+    return
+  }
+
+  let sentinelHits = 0   // must NEVER be reached once fixed
+  let okHits = 0         // permitted target: must stay reachable
+  let redirectHits = 0   // permitted hop 1 of the redirect chain
+
+  let sentinelURL = ''
+
+  // Stands in for an internal-only service, on an RFC1918 address that is refused in dev, staging and
+  // prod alike.
+  const sentinel = http.createServer((_, res) => {
+    sentinelHits++
+    res.writeHead(200, { 'content-type': 'application/json' })
+    res.end(JSON.stringify({ sentinel: SENTINEL, credentials: 'internal-only' }))
+  })
+
+  // The legitimate receiver, on loopback — permitted in local dev exactly like every other webhook test.
+  const allowed = http.createServer((req, res) => {
+    if ((req.url || '').startsWith('/redirect-to-internal')) {
+      redirectHits++
+      // Hop 1 is permitted and genuinely succeeds; hop 2 points somewhere that is not.
+      res.writeHead(302, { location: sentinelURL })
+      res.end()
+      return
+    }
+    okHits++
+    res.writeHead(200, { 'content-type': 'application/json' })
+    res.end(JSON.stringify({ ok: true }))
+  })
+
+  let enduserId: string | undefined
+  let templateEnduserId: string | undefined
+  let configuredWebhook = false
+
+  try {
+    await listen(sentinel, privateIP)
+    const sentinelPort = port_of(sentinel)
+    sentinelURL = `http://${privateIP}:${sentinelPort}/ssrf-sentinel`
+
+    await listen(allowed, '127.0.0.1')
+    const okURL = `http://127.0.0.1:${port_of(allowed)}/webhook-ok`
+    const redirectURL = `http://127.0.0.1:${port_of(allowed)}/redirect-to-internal`
+
+    const enduser = await sdk.api.endusers.createOne({
+      email: `f0015-${Date.now()}@example.com`, fname: 'F0015', lname: 'Ssrf',
+    })
+    enduserId = enduser.id
+
+    const send_automation_webhook_to = async (url: string, forEnduserId = enduser.id) => {
+      sentinelHits = 0; okHits = 0; redirectHits = 0
+      const outcome = await sdk.api.webhooks.send_automation_webhook({
+        enduserId: forEnduserId,
+        action: { info: { url } },
+      } as any).then(() => 'resolved').catch(() => 'rejected')
+      // The action awaits its own axios call, but give redirect chains a moment to land.
+      await settle(750)
+      return { outcome, sentinelHits, okHits, redirectHits }
+    }
+
+    // ---------------------------------------------------------------------------------------------
+    // T6 first: the positive control for the whole file. If an allowlisted target does not receive the
+    // webhook, every "sentinel not contacted" assertion below is meaningless.
+    // ---------------------------------------------------------------------------------------------
+    await async_test(
+      'F-0015: automation webhook to a permitted target still delivers (regression baseline)',
+      () => send_automation_webhook_to(okURL),
+      { onResult: (r: any) => r.okHits === 1 && r.sentinelHits === 0 },
+    )
+
+    // T3 — direct non-allowlisted private destination.
+    await async_test(
+      'F-0015: automation webhook does not reach a private destination',
+      () => send_automation_webhook_to(sentinelURL),
+      { onResult: (r: any) => r.sentinelHits === 0 },
+    )
+
+    // T4 — the redirect bypass. THE test that justifies a connect-time guard over a pre-flight check.
+    await async_test(
+      'F-0015: automation webhook does not follow a redirect from a permitted host into a private one',
+      () => send_automation_webhook_to(redirectURL),
+      {
+        // redirectHits === 1 is the positive control: hop 1 was allowlisted and really was reached, so
+        // sentinelHits === 0 can only mean hop 2 was refused — not that the request never happened.
+        onResult: (r: any) => r.redirectHits === 1 && r.sentinelHits === 0,
+      },
+    )
+
+    // T5 — the destination arrives via template interpolation, so validation must run AFTER the
+    // replacers rather than against the stored config. {{enduser.<key>}} resolves from enduser.fields.
+    const templateEnduser = await sdk.api.endusers.createOne({
+      email: `f0015-tpl-${Date.now()}@example.com`,
+      fname: 'F0015', lname: 'Template',
+      fields: { ssrfTarget: `${privateIP}:${sentinelPort}` },
+    })
+    templateEnduserId = templateEnduser.id
+
+    await async_test(
+      'F-0015: automation webhook validates the URL after template interpolation, not before',
+      () => send_automation_webhook_to('http://{{enduser.ssrfTarget}}/ssrf-sentinel', templateEnduser.id),
+      { onResult: (r: any) => r.sentinelHits === 0 },
+    )
+
+    // ---------------------------------------------------------------------------------------------
+    // The configured-webhook delivery path (api/modules/webhooks.ts:145), which is a different code
+    // path from the automation action above. Paired: allowlisted target proves the subscription and
+    // trigger plumbing works, then the same plumbing pointed at the sentinel must not reach it.
+    // ---------------------------------------------------------------------------------------------
+    // CUDSubscription is an object of booleans, not a list of verbs (see webhooks_tests.ts fullSubscription).
+    await sdk.api.webhooks.configure({
+      url: okURL, secret: TEST_SECRET, subscriptions: { endusers: { create: true } },
+    })
+    configuredWebhook = true
+
+    await async_test(
+      'F-0015: configured webhook to a permitted target still delivers (positive control)',
+      async () => {
+        sentinelHits = 0; okHits = 0
+        const e = await sdk.api.endusers.createOne({ email: `f0015-ok-${Date.now()}@example.com` })
+        const delivered = await wait_until(() => okHits > 0, 8_000)
+        await sdk.api.endusers.deleteOne(e.id).catch(() => {})
+        return { delivered, okHits, sentinelHits }
+      },
+      { onResult: (r: any) => r.delivered === true && r.sentinelHits === 0 },
+    )
+
+    // Repoint the same configuration at the sentinel, keeping the subscription intact.
+    await sdk.api.webhooks.update({ url: sentinelURL })
+
+    await async_test(
+      'F-0015: configured webhook does not deliver to a private destination',
+      async () => {
+        sentinelHits = 0; okHits = 0
+        const e = await sdk.api.endusers.createOne({ email: `f0015-blocked-${Date.now()}@example.com` })
+        // Wait out the window a real delivery would have landed in, then assert it did not.
+        await settle(6_000)
+        await sdk.api.endusers.deleteOne(e.id).catch(() => {})
+        return { sentinelHits }
+      },
+      { onResult: (r: any) => r.sentinelHits === 0 },
+    )
+  } finally {
+    // Leaving a webhook configured would fire on every subsequent create in the shared suite run.
+    if (configuredWebhook) {
+      try {
+        const { webhooks } = await sdk.api.webhooks.getSome({}) as any
+        for (const w of (webhooks ?? [])) { await sdk.api.webhooks.deleteOne(w.id).catch(() => {}) }
+      } catch {}
+    }
+    if (enduserId) { try { await sdk.api.endusers.deleteOne(enduserId) } catch {} }
+    if (templateEnduserId) { try { await sdk.api.endusers.deleteOne(templateEnduserId) } catch {} }
+    sentinel.close()
+    allowed.close()
+  }
+}
+
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await webhook_outbound_ssrf_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ F-0015 outbound webhook SSRF test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ F-0015 outbound webhook SSRF test suite failed:", error)
+      process.exit(1)
+    })
+}