@tellescope/sdk 1.255.19 → 1.256.1

package/src/tests/api_tests/security/F-0025-proxy-image-unauth-ssrf.test.ts

@@ -0,0 +1,179 @@
+require('source-map-support').install();
+
+import http from "http"
+import axios from "axios"
+import { Session } from "../../../sdk"
+import {
+  async_test,
+  log_header,
+} from "@tellescope/testing"
+import { setup_tests } from "../../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const LOCAL_HOSTNAMES = ['localhost', '127.0.0.1', '::1']
+
+/**
+ * 127.0.0.1 only means "the machine running this test" when the API is also local. Against staging or
+ * prod it is the API server itself — the sentinel below would never be contacted, every assertion
+ * here would pass for the wrong reason, and we would be probing a live environment. Fail loudly.
+ */
+const assert_local_api = () => {
+  const hostname = new URL(host).hostname
+  if (!LOCAL_HOSTNAMES.includes(hostname)) {
+    throw new Error(
+      `F-0025 SSRF tests must run against a local API (got ${host}). `
+      + `127.0.0.1 would resolve to the API server rather than this machine, so the tests would be meaningless.`
+    )
+  }
+}
+
+/**
+ * Regression tests for F-0025
+ * (security-audit/findings/F-0025-proxy-image-unauth-ssrf.md).
+ *
+ * GET /v1/proxy-image accepted an arbitrary ?url= and streamed the upstream response body straight
+ * back with Access-Control-Allow-Origin: *, with no authentication, no destination validation and no
+ * content-type restriction. That reaches http://169.254.169.254/ (EC2 instance credentials under
+ * IMDSv1), 127.0.0.1, and anything else inside the VPC.
+ *
+ * The endpoint's only legitimate job is to re-serve an image that ALREADY renders in the staff
+ * browser, with permissive CORS headers, so html2canvas can rasterize a form-response PDF without
+ * tainting the canvas (canvas.toDataURL() throws on a tainted canvas, and the form-response view sets
+ * crossOrigin="anonymous"). Anything reachable only from inside our network was therefore never a
+ * legitimate input — which is why refusing non-public destinations cannot regress the feature.
+ *
+ * Repro: stand up a local HTTP server that serves a JSON secret, point proxy-image at it with no
+ * credentials, and assert the secret does not come back.
+ *   - red  (unfixed): the sentinel body is streamed back to an unauthenticated caller
+ *   - green (fixed):  the request is refused and the sentinel server is never contacted
+ *
+ * Assertions are deliberately written as "4xx and nothing leaked" rather than pinning an exact status,
+ * because the fix both authenticates the endpoint and moves it to POST (the url moves into the body so
+ * presigned S3 URLs for patient attachments stop landing in access logs). Either 401 or 404/405 on the
+ * old GET shape is an acceptable outcome; streaming the body is not.
+ *
+ * The authenticated happy-path test lives with the Phase 2 endpoint change — it cannot exist here
+ * because the POST route does not yet exist, and a test that fails for "not implemented" would muddy
+ * the vulnerability proof.
+ */
+export const proxy_image_ssrf_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("F-0025: proxy-image unauthenticated SSRF")
+  assert_local_api()
+
+  const SENTINEL = `f0025-sentinel-${Date.now()}-${Math.random().toString(36).slice(2)}`
+  let sentinelHits = 0
+
+  // Stands in for an internal-only service (IMDS, an internal admin API, a VPC-local port). Serves
+  // JSON rather than an image, so it also exercises the missing content-type restriction.
+  const sentinel = http.createServer((_, res) => {
+    sentinelHits++
+    res.writeHead(200, { 'content-type': 'application/json' })
+    res.end(JSON.stringify({ sentinel: SENTINEL, credentials: 'internal-only' }))
+  })
+
+  try {
+    await new Promise<void>(resolve => sentinel.listen(0, '127.0.0.1', () => resolve()))
+    const sentinelPort = (sentinel.address() as any).port
+    const sentinelURL = `http://127.0.0.1:${sentinelPort}/latest/meta-data/iam/security-credentials/`
+
+    // Raw axios rather than the SDK: the SDK always attaches an Authorization header, and the point
+    // here is that no credential is presented at all.
+    const call_unauthenticated = async () => {
+      sentinelHits = 0
+      const res = await axios.get(`${host}/v1/proxy-image`, {
+        params: { url: sentinelURL },
+        validateStatus: () => true, // capture 4xx/5xx instead of throwing
+        responseType: 'text',
+        transformResponse: [(d: any) => d], // keep the raw body as a string
+        timeout: 10_000,
+      } as any)
+
+      const body = typeof res.data === 'string' ? res.data : JSON.stringify(res.data ?? '')
+      return { status: res.status, leaked: body.includes(SENTINEL), sentinelHits }
+    }
+
+    // T1 — the core SSRF: an unauthenticated caller must not be able to read an internal resource.
+    await async_test(
+      'F-0025: proxy-image does not stream an internal non-image resource to an unauthenticated caller',
+      call_unauthenticated,
+      {
+        // Positive control: a numeric status proves we actually reached our API rather than failing to
+        // connect (a connection error would make "nothing leaked" true for the wrong reason).
+        onResult: (r: any) => (
+          typeof r.status === 'number'
+          && r.leaked === false
+          && r.sentinelHits === 0
+        ),
+      },
+    )
+
+    // T2 — the unauthenticated surface itself: the request must be refused outright, and the
+    // destination must never be contacted (no SSRF-as-a-side-effect even when the body is withheld).
+    await async_test(
+      'F-0025: proxy-image refuses an unauthenticated request without contacting the destination',
+      call_unauthenticated,
+      { onResult: (r: any) => r.status >= 400 && r.status < 500 && r.sentinelHits === 0 },
+    )
+
+    // Authenticating is not enough on its own — a staff session must not be able to reach an internal
+    // address either. These use the real session, and are deterministic (no external network).
+    const call_authenticated = async (url: string) => {
+      sentinelHits = 0
+      const res = await axios.post(`${host}/v1/proxy-image`, { url }, {
+        headers: { Authorization: `Bearer ${sdk.authToken}` },
+        validateStatus: () => true,
+        timeout: 10_000,
+      } as any)
+      return { status: res.status, sentinelHits }
+    }
+
+    await async_test(
+      'F-0025: proxy-image refuses a private destination even for an authenticated staff session',
+      () => call_authenticated(sentinelURL),
+      { onResult: (r: any) => r.status === 400 && r.sentinelHits === 0 },
+    )
+
+    await async_test(
+      'F-0025: proxy-image refuses cloud metadata for an authenticated staff session',
+      () => call_authenticated('https://169.254.169.254/latest/meta-data/'),
+      { onResult: (r: any) => r.status === 400 },
+    )
+
+    // Scheme and port are pinned: only https on 443, which is all the PDF export ever needs.
+    await async_test(
+      'F-0025: proxy-image refuses a plain http destination',
+      () => call_authenticated('http://example.com/logo.png'),
+      { onResult: (r: any) => r.status === 400 },
+    )
+
+    await async_test(
+      'F-0025: proxy-image refuses a non-443 port',
+      () => call_authenticated('https://example.com:8443/logo.png'),
+      { onResult: (r: any) => r.status === 400 },
+    )
+  } finally {
+    sentinel.close()
+  }
+}
+
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await proxy_image_ssrf_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ F-0025 proxy-image SSRF test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ F-0025 proxy-image SSRF test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/security/F-0166-allowed-paths-wildcard-bypass.test.ts

@@ -146,6 +146,8 @@ export const allowed_paths_confinement_tests = async ({ sdk } : { sdk: Session,
   let joinEnduserId: string | undefined
   let formEnduserEmail: string | undefined
   let hostUserId: string | undefined
+  let templateId: string | undefined
+  let bookingEnduserId: string | undefined
   const eventIds: string[] = []
 
   try {
@@ -245,6 +247,120 @@ export const allowed_paths_confinement_tests = async ({ sdk } : { sdk: Session,
     // bare '/product' prefix entry did — that used to reach /products/prepare-stripe-checkout too
     await expectDenied(S1, 'exact matching: /products not granted by get:/product', publicFormSession.authToken, baselineEnduserToken, 'get', '/products')
 
+    /* ---- field confinement on the granted generic update route ----
+     * 'patch:/enduser/:id' is granted for Portal V2's terms gate, so the route check alone no longer
+     * protects this session — SESSION_SCOPE_WRITABLE_FIELDS does. These probes are the live control:
+     * the consent write lands, and every contactable/identity field is refused. Without them the
+     * module test is the only thing standing between a scope-table edit and account takeover.
+     */
+    const formEnduserId = publicFormSession.enduserId
+
+    // The refresh payload for a fromPublicSession token must carry the session's OWN id — portal V2
+    // seeds its store from it and then addresses itself by id, so without it every write goes to
+    // /enduser/undefined — while still withholding everything else about the patient. Both halves
+    // matter: adding the id must not become a foothold for widening this payload.
+    const publicRefresh = await request(publicFormSession.authToken, 'post', '/refresh-enduser-session', {})
+    const refreshedEnduser = publicRefresh.body?.enduser ?? {}
+    probes.push({
+      scenario: S1,
+      label: 'public refresh exposes the session\'s own id',
+      path: '/refresh-enduser-session',
+      expected: 'allowed',
+      status: refreshedEnduser.id === formEnduserId ? 200 : 500,
+      pass: refreshedEnduser.id === formEnduserId,
+      note: `id=${refreshedEnduser.id}`,
+    })
+    const withheld = ['email', 'phone', 'dateOfBirth', 'fname', 'lname', 'note', 'insurance', 'tags']
+      .filter(f => refreshedEnduser[f] !== undefined)
+    probes.push({
+      scenario: S1,
+      label: 'public refresh still withholds the patient record',
+      path: '/refresh-enduser-session',
+      expected: 'denied',
+      status: withheld.length ? 200 : 403,
+      pass: withheld.length === 0,
+      note: withheld.length ? `LEAKED [${withheld}]` : `keys=[${Object.keys(refreshedEnduser)}]`,
+    })
+
+    await expectAllowed(
+      S1, 'field-restricted: may record terms consent', publicFormSession.authToken,
+      'patch', `/enduser/${formEnduserId}`,
+      { updates: { termsSigned: new Date().toISOString(), termsVersion: '1' } },
+    )
+
+    // The write being confined is not enough: the update RESPONSE is not redacted for enduser sessions
+    // (applyRedactions runs only for user sessions on that path), so an unprojected echo would hand
+    // this session the record it can't otherwise read — GET /enduser/:id is not even in this scope.
+    // Assert the response carries ONLY what the session was allowed to write.
+    const consentEcho = await request(
+      publicFormSession.authToken, 'patch', `/enduser/${formEnduserId}`,
+      { updates: { termsVersion: '2' } },
+    )
+    const echoedKeys = Object.keys(consentEcho.body ?? {})
+    const leakedKeys = echoedKeys.filter(k => !['id', 'termsSigned', 'termsVersion'].includes(k))
+    probes.push({
+      scenario: S1,
+      label: 'field-restricted: update response echoes only the writable fields',
+      path: `/enduser/${formEnduserId}`,
+      expected: 'allowed',
+      status: leakedKeys.length === 0 ? consentEcho.status : 500,
+      pass: consentEcho.status === 200 && leakedKeys.length === 0,
+      note: leakedKeys.length ? `LEAKED [${leakedKeys}]` : `echoed [${echoedKeys}]`,
+    })
+
+    // email/phone are the takeover vector: password reset resolves by findOne({ email }) and OTP codes
+    // deliver to enduser.phone. dateOfBirth/fname are the public-form MATCH keys, so writing them would
+    // let a session redirect which patient a later submission attaches to.
+    const fieldsThatMustBeRefused: [string, any][] = [
+      ['email', `f0166-takeover-${RAND()}@tellescope.example`],
+      ['phone', '+15555550123'],
+      ['landline', '+15555550124'],
+      ['dateOfBirth', '1990-01-01'],
+      ['fname', 'F0166Overwritten'],
+    ]
+    for (const [field, value] of fieldsThatMustBeRefused) {
+      const r = await request(
+        publicFormSession.authToken, 'patch', `/enduser/${formEnduserId}`, { updates: { [field]: value } },
+      )
+      probes.push({
+        scenario: S1,
+        label: `field-restricted: cannot write enduser '${field}'`,
+        path: `/enduser/${formEnduserId}`,
+        expected: 'denied',
+        status: r.status,
+        pass: r.status === 403,
+        note: 'route is granted; the field allowlist is what refuses this',
+      })
+    }
+
+    // the field guard must reject the whole request rather than filtering, or the allowed key would
+    // carry a disallowed one through alongside it
+    const mixed = await request(
+      publicFormSession.authToken, 'patch', `/enduser/${formEnduserId}`,
+      { updates: { termsVersion: '2', email: `f0166-mixed-${RAND()}@tellescope.example` } },
+    )
+    probes.push({
+      scenario: S1,
+      label: 'field-restricted: a mixed allowed+denied update is refused whole',
+      path: `/enduser/${formEnduserId}`,
+      expected: 'denied',
+      status: mixed.status,
+      pass: mixed.status === 403,
+      note: 'no partial application — email must not ride along with termsVersion',
+    })
+
+    // and the email on record must be untouched by all of the above
+    const afterProbes = await sdk.api.endusers.getOne(formEnduserId)
+    probes.push({
+      scenario: S1,
+      label: 'field-restricted: stored email survived every attempt',
+      path: `/enduser/${formEnduserId}`,
+      expected: 'denied',
+      status: afterProbes.email === formEnduserEmail ? 403 : 200,
+      pass: afterProbes.email === formEnduserEmail,
+      note: `stored=${afterProbes.email}`,
+    })
+
     /* ============ S2: join-link session — RED before the fix ============ */
 
     const S2 = 'S2 join-link (enduser)'
@@ -264,6 +380,36 @@ export const allowed_paths_confinement_tests = async ({ sdk } : { sdk: Session,
     await expectAllowed(S2, 'widened: calendar events list', joinSession.authToken, 'get', '/calendar-events')
     await expectAllowed(S2, 'widened: join meeting for event', joinSession.authToken, 'post', '/join-meeting-for-event', { calendarEventId: joinEvent.id })
 
+    // The WaitingRoom marks attendance here. This write is deliberately NOT field-restricted: the
+    // portal reads the event back through useCalendarEvents, whose updateElement REPLACES the local
+    // record with the update response (react state.tsx), so a truncated response would drop event
+    // fields out of local state mid-visit and break a live Twilio call. Assert both halves of that
+    // contract — the write lands, AND the response is still a whole event.
+    const attendanceWrite = await request(
+      joinSession.authToken, 'patch', `/calendar-event/${joinEvent.id}`,
+      { updates: { joinedVideoCall: [{ id: joinEnduserId, at: new Date().toISOString() }] } },
+    )
+    probes.push({
+      scenario: S2,
+      label: 'marks joinedVideoCall on its pinned event',
+      path: `/calendar-event/${joinEvent.id}`,
+      expected: 'allowed',
+      status: attendanceWrite.status,
+      pass: attendanceWrite.status === 200,
+    })
+    // title/durationInMinutes were set at fixture creation, so their presence proves the response was
+    // not projected down to the written field
+    const echoedEvent = attendanceWrite.body ?? {}
+    probes.push({
+      scenario: S2,
+      label: 'attendance write returns the WHOLE event (client replaces local state from it)',
+      path: `/calendar-event/${joinEvent.id}`,
+      expected: 'allowed',
+      status: (echoedEvent.title && echoedEvent.durationInMinutes) ? 200 : 500,
+      pass: !!echoedEvent.title && !!echoedEvent.durationInMinutes && !!echoedEvent.joinedVideoCall,
+      note: `echoed ${Object.keys(echoedEvent).length} keys`,
+    })
+
     // confinement must survive a refresh rather than widening
     const refreshedJoin = await request(joinSession.authToken, 'post', '/refresh-enduser-session', {})
     const refreshedJoinToken = refreshedJoin.body?.authToken
@@ -398,6 +544,73 @@ export const allowed_paths_confinement_tests = async ({ sdk } : { sdk: Session,
       await expectAllowed(S6, 'after refresh: my-meetings still allowed', rescopedToken, 'get', '/my-meetings')
     }
 
+    /* ============ S7: appointment-booking session — the SAME terms gate as S1 ============
+     * Portal V2's terms gate wraps the booking route too, so this scope needs the same enduser write
+     * (and only that write). Without the grant the gate is unpassable and the patient never reaches the
+     * booking page at all. Field restriction and response projection must behave exactly as in S1 —
+     * mirrored here rather than assumed, since the two scopes are separate table entries.
+     */
+    const S7 = 'S7 appointment-booking'
+
+    const bookingTemplate = await sdk.api.calendar_event_templates.createOne({
+      title: `F-0166 booking ${RAND()}`, durationInMinutes: 30,
+    })
+    templateId = bookingTemplate.id
+
+    const bookingEnduserEmail = `f0166-booking-${RAND()}@tellescope.example`
+    const bookingEnduser = await sdk.api.endusers.createOne({
+      email: bookingEnduserEmail, fname: 'Booking', lname: 'Confinement',
+    })
+    bookingEnduserId = bookingEnduser.id
+
+    const bookingSession = await new EnduserSession({ host, businessId })
+      .api.calendar_events.session_for_public_appointment_booking({
+        businessId,
+        calendarEventTemplateId: bookingTemplate.id,
+        email: bookingEnduserEmail,
+        fname: 'Booking',
+        lname: 'Confinement',
+      })
+
+    await expectAllowed(
+      S7, 'field-restricted: may record terms consent', bookingSession.authToken,
+      'patch', `/enduser/${bookingEnduser.id}`,
+      { updates: { termsSigned: new Date().toISOString(), termsVersion: '1' } },
+    )
+
+    const bookingEcho = await request(
+      bookingSession.authToken, 'patch', `/enduser/${bookingEnduser.id}`, { updates: { termsVersion: '2' } },
+    )
+    const bookingLeaked = Object.keys(bookingEcho.body ?? {})
+      .filter(k => !['id', 'termsSigned', 'termsVersion'].includes(k))
+    probes.push({
+      scenario: S7,
+      label: 'field-restricted: update response echoes only the writable fields',
+      path: `/enduser/${bookingEnduser.id}`,
+      expected: 'allowed',
+      status: bookingLeaked.length === 0 ? bookingEcho.status : 500,
+      pass: bookingEcho.status === 200 && bookingLeaked.length === 0,
+      note: bookingLeaked.length ? `LEAKED [${bookingLeaked}]` : undefined,
+    })
+
+    for (const [field, value] of [['email', `f0166-bt-${RAND()}@tellescope.example`], ['phone', '+15555550188']] as [string, any][]) {
+      const r = await request(bookingSession.authToken, 'patch', `/enduser/${bookingEnduser.id}`, { updates: { [field]: value } })
+      probes.push({
+        scenario: S7,
+        label: `field-restricted: cannot write enduser '${field}'`,
+        path: `/enduser/${bookingEnduser.id}`,
+        expected: 'denied',
+        status: r.status,
+        pass: r.status === 403,
+        note: 'route is granted; the field allowlist is what refuses this',
+      })
+    }
+
+    // the booking scope must not have gained anything else along with the enduser write
+    await expectDenied(S7, 'unlisted: form responses', bookingSession.authToken, baselineEnduserToken, 'get', '/form-responses')
+    await expectDenied(S7, 'unlisted: calendar events', bookingSession.authToken, baselineEnduserToken, 'get', '/calendar-events')
+    await expectAllowed(S7, 'listed: refresh enduser session', bookingSession.authToken, 'post', '/refresh-enduser-session')
+
     /* ============ S5: ordinary sessions with no allowedPaths claim ============ */
 
     const S5 = 'S5 unconfined sessions'
@@ -479,6 +692,8 @@ export const allowed_paths_confinement_tests = async ({ sdk } : { sdk: Session,
       } catch {}
     }
     if (hostUserId) { try { await sdk.api.users.deleteOne(hostUserId) } catch {} }
+    if (bookingEnduserId) { try { await sdk.api.endusers.deleteOne(bookingEnduserId) } catch {} }
+    if (templateId) { try { await sdk.api.calendar_event_templates.deleteOne(templateId) } catch {} }
     if (productId) { try { await sdk.api.products.deleteOne(productId) } catch {} }
     if (formId) { try { await sdk.api.forms.deleteOne(formId) } catch {} }
   }