@tellescope/sdk 1.255.2 → 1.255.4

package/src/tests/api_tests/medication_added_trigger.test.ts

@@ -182,7 +182,7 @@ export const medication_added_trigger_tests = async ({ sdk, sdkNonAdmin } : { sd
     title: "Medication - Beluga Protocol Test"
   })
 
-  // Simulate the Beluga RX_WRITTEN webhook with two meds covering category present (typical) and "N/A"
+  // Simulate the Beluga RX_WRITTEN webhook with two meds covering category/pharmacyNotes present (typical) and "N/A"/absent
   const webhookResponse = await fetch(`${host}/v1/webhooks/beluga`, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
@@ -198,6 +198,7 @@ export const medication_added_trigger_tests = async ({ sdk, sdkNonAdmin } : { sd
         medId: 'test-ndc-123',
         rxId: 'test-rx-456',
         category: 'weightloss1',
+        pharmacyNotes: 'Dispense with syringes',
       }, {
         name: 'Metformin',
         strength: '500mg',
@@ -245,6 +246,16 @@ export const medication_added_trigger_tests = async ({ sdk, sdkNonAdmin } : { sd
     async () => belugaMedMetformin,
     { onResult: (m: EnduserMedication) => m?.category === 'N/A' }
   )
+  await async_test(
+    "Beluga RX_WRITTEN - Medication has notes from webhook pharmacyNotes",
+    async () => belugaMedSemaglutide,
+    { onResult: (m: EnduserMedication) => m?.notes === 'Dispense with syringes' }
+  )
+  await async_test(
+    "Beluga RX_WRITTEN - Medication omits notes when pharmacyNotes not provided on med",
+    async () => belugaMedMetformin,
+    { onResult: (m: EnduserMedication) => m?.notes === undefined || m?.notes === null }
+  )
 
   // Backwards-compatibility: a webhook with no category on any med should result in undefined category
   const belugaFormNoCategory = await sdk.api.forms.createOne({
@@ -294,6 +305,11 @@ export const medication_added_trigger_tests = async ({ sdk, sdkNonAdmin } : { sd
     async () => belugaMedNoCategory,
     { onResult: (m: EnduserMedication) => m?.category === undefined || m?.category === null }
   )
+  await async_test(
+    "Beluga RX_WRITTEN - Medication omits notes when pharmacyNotes not provided",
+    async () => belugaMedNoCategory,
+    { onResult: (m: EnduserMedication) => m?.notes === undefined || m?.notes === null }
+  )
 
   try {
     // Clean up Beluga test data
@@ -389,14 +405,56 @@ export const medication_added_trigger_tests = async ({ sdk, sdkNonAdmin } : { sd
     { onResult: (e: Enduser) => e.fields?.['Medication Category'] === '' }
   )
 
+  // ---- Set Fields with {{medication.notes}} Test ----
+  log_header("Medication Added - Set Fields with {{medication.notes}}")
+
+  const setFieldsPharmacyNotesTrigger = await sdk.api.automation_triggers.createOne({
+    event: { type: 'Medication Added', info: { titles: [], protocols: [] } },
+    action: { type: 'Set Fields', info: { fields: [{ name: 'Medication Notes', type: 'Custom Value' as const, value: '{{medication.notes}}' }] }},
+    status: 'Active',
+    title: "Medication - Set Fields medication.notes"
+  })
+
+  const setFieldsPharmacyNotesEnduser = await sdk.api.endusers.createOne({})
+
+  const setFieldsPharmacyNotesMed = await sdk.api.enduser_medications.createOne({
+    enduserId: setFieldsPharmacyNotesEnduser.id,
+    title: 'Ozempic 1mg',
+    notes: 'Dispense with syringes',
+  })
+  await wait(undefined, 500)
+
+  await async_test(
+    "Medication Added - Set Fields copies medication.notes to enduser field",
+    () => sdk.api.endusers.getOne(setFieldsPharmacyNotesEnduser.id),
+    { onResult: (e: Enduser) => e.fields?.['Medication Notes'] === 'Dispense with syringes' }
+  )
+
+  // notes absent on medication → placeholder resolves to empty string
+  const setFieldsPharmacyNotesEnduserEmpty = await sdk.api.endusers.createOne({})
+  const setFieldsPharmacyNotesMedEmpty = await sdk.api.enduser_medications.createOne({
+    enduserId: setFieldsPharmacyNotesEnduserEmpty.id,
+    title: 'Lisinopril 40mg',
+  })
+  await wait(undefined, 500)
+
+  await async_test(
+    "Medication Added - Set Fields with no notes resolves to empty string",
+    () => sdk.api.endusers.getOne(setFieldsPharmacyNotesEnduserEmpty.id),
+    { onResult: (e: Enduser) => e.fields?.['Medication Notes'] === '' }
+  )
+
   try {
     await sdk.api.automation_triggers.deleteOne(setFieldsTrigger.id)
     await sdk.api.automation_triggers.deleteOne(setFieldsTriggerFiltered.id)
     await sdk.api.automation_triggers.deleteOne(setFieldsCategoryTrigger.id)
+    await sdk.api.automation_triggers.deleteOne(setFieldsPharmacyNotesTrigger.id)
     await sdk.api.endusers.deleteOne(setFieldsEnduser.id)
     await sdk.api.endusers.deleteOne(setFieldsEnduser2.id)
     await sdk.api.endusers.deleteOne(setFieldsCategoryEnduser.id)
     await sdk.api.endusers.deleteOne(setFieldsCategoryEnduserEmpty.id)
+    await sdk.api.endusers.deleteOne(setFieldsPharmacyNotesEnduser.id)
+    await sdk.api.endusers.deleteOne(setFieldsPharmacyNotesEnduserEmpty.id)
   } finally {}
 
   // ---- titleCondition (compound conditional logic on title) ----

package/src/tests/api_tests/security/F-0005-ai-conversations-rbac.test.ts

@@ -28,6 +28,16 @@ const [nonAdminEmail, nonAdminPassword] = [process.env.NON_ADMIN_EMAIL, process.
  *   2. Assigns the role to the non-admin user.
  *   3. Calls each endpoint as the non-admin.
  *   4. Asserts each endpoint returns a 403-equivalent error (not 200).
+ *   5. Positive case: a role granting ai_conversations create (read/update denied) must pass
+ *      the send_message gate — generating a NEW conversation requires only create access.
+ *   6. But the same role must still 403 when passing a conversationId: continuing an existing
+ *      conversation reads its stored history (returned in the response) and appends to it,
+ *      so it requires read + update access in addition to create.
+ *   7. Default-provider-permissions role (ai_conversations = Assigned): send_message must not
+ *      500. Regression: the post-generation $push previously ran through the caller's
+ *      access-scoped DB, where "Assigned" filters can't match the just-created conversation,
+ *      returning null and crashing the handler (Cannot read properties of null '_id') after
+ *      credits were consumed. bedrock.ts now persists via tenant-scoped org-wide queries.
  *
  * Pre-fix:
  *   - send_message: 200 (or some downstream error from Bedrock) — NOT 403. Test fails.
@@ -39,7 +49,11 @@ export const ai_conversations_rbac_tests = async ({ sdk, sdkNonAdmin } : { sdk:
   log_header("F-0005: ai_conversations RBAC bypass regression")
 
   const roleName = `f0005-ai-conversations-no-access-${Date.now()}`
+  const grantRoleName = `f0005-ai-conversations-create-granted-${Date.now()}`
+  const assignedRoleName = `f0005-ai-conversations-assigned-default-${Date.now()}`
   let rbapId: string | undefined
+  let grantRbapId: string | undefined
+  let assignedRbapId: string | undefined
   const originalRoles = sdkNonAdmin.userInfo.roles
 
   try {
@@ -109,6 +123,109 @@ export const ai_conversations_rbac_tests = async ({ sdk, sdkNonAdmin } : { sdk:
         },
       },
     )
+
+    // 4. Positive case: granting only ai_conversations create must pass the RBAC gate.
+    //    send_message may still fail downstream (e.g. 400 "Organization has not set up credits"),
+    //    but it must NOT be an access-denial error.
+    const grantRbap = await sdk.api.role_based_access_permissions.createOne({
+      role: grantRoleName,
+      permissions: {
+        ...PROVIDER_PERMISSIONS,
+        ai_conversations: { create: 'All', read: null, update: null, delete: null },
+      },
+    })
+    grantRbapId = grantRbap.id
+
+    await sdk.api.users.updateOne(
+      sdkNonAdmin.userInfo.id,
+      { roles: [grantRoleName] },
+      { replaceObjectFields: true },
+    )
+    await wait(undefined, 1500)
+    await sdkNonAdmin.authenticate(nonAdminEmail!, nonAdminPassword!)
+
+    await async_test(
+      "F-0005: ai_conversations.send_message must NOT be access-denied when role grants create",
+      () => sdkNonAdmin.api.ai_conversations.send_message({
+        message: 'F-0005 positive-case test',
+        type: 'Test',
+        maxTokens: 1,
+      } as any)
+        .then(() => 'allowed' as const)
+        .catch((e: any) => {
+          const msg = (e?.message ?? '').toLowerCase()
+          const status = e?.status ?? e?.code
+          if (status === 403 || status === 401
+            || msg.includes('access') || msg.includes('permission') || msg.includes('forbidden')) {
+            throw e // access denial — the gate incorrectly blocked a create-granted role
+          }
+          return 'allowed' as const // downstream (e.g. credits) error is fine — the gate passed
+        }),
+      { onResult: r => r === 'allowed' },
+    )
+
+    // 5. The create-granted (read/update-denied) role must still be blocked from CONTINUING an
+    //    existing conversation — send_message with conversationId returns the full stored history
+    //    and appends to it. Fake id is fine: the access check must fire before any lookup.
+    await async_test(
+      "F-0005: ai_conversations.send_message with conversationId must 403 when role denies read/update",
+      () => sdkNonAdmin.api.ai_conversations.send_message({
+        message: 'F-0005 conversationId bypass test',
+        type: 'Test',
+        maxTokens: 1,
+        conversationId: new ObjectId().toHexString(),
+      } as any),
+      {
+        shouldError: true,
+        onError: (e: any) => {
+          const msg = (e?.message ?? '').toLowerCase()
+          const status = e?.status ?? e?.code
+          return status === 403 || status === 401
+            || msg.includes('access') || msg.includes('permission') || msg.includes('forbidden')
+        },
+      },
+    )
+
+    // 6. Regression: a role with default provider permissions (ai_conversations = Assigned)
+    //    must be able to generate a new conversation without a 500. Previously the
+    //    post-generation $push ran through the access-scoped DB, matched nothing under
+    //    "Assigned", and crashed the handler with "Cannot read properties of null ('_id')".
+    const assignedRbap = await sdk.api.role_based_access_permissions.createOne({
+      role: assignedRoleName,
+      permissions: { ...PROVIDER_PERMISSIONS },
+    })
+    assignedRbapId = assignedRbap.id
+
+    await sdk.api.users.updateOne(
+      sdkNonAdmin.userInfo.id,
+      { roles: [assignedRoleName] },
+      { replaceObjectFields: true },
+    )
+    await wait(undefined, 1500)
+    await sdkNonAdmin.authenticate(nonAdminEmail!, nonAdminPassword!)
+
+    await async_test(
+      "F-0005: ai_conversations.send_message must not 500 for Assigned-access (default provider) role",
+      () => sdkNonAdmin.api.ai_conversations.send_message({
+        message: 'F-0005 assigned-access regression test',
+        type: 'Test',
+        maxTokens: 1,
+      } as any)
+        .then(() => 'ok' as const)
+        .catch((e: any) => {
+          const msg = (e?.message ?? '').toLowerCase()
+          const status = e?.status ?? e?.code
+          if (status === 500 || msg.includes('internal error') || msg.includes('cannot read properties')) {
+            throw e // the null-update crash — regression
+          }
+          if (status === 403 || status === 401
+            || msg.includes('access') || msg.includes('permission') || msg.includes('forbidden')) {
+            throw e // Assigned access must pass the RBAC gate
+          }
+          return 'ok' as const // downstream (e.g. credits) error is fine
+        }),
+      { onResult: r => r === 'ok' },
+    )
   } finally {
     // Cleanup: restore original roles, delete the test role.
     try {
@@ -121,6 +238,12 @@ export const ai_conversations_rbac_tests = async ({ sdk, sdkNonAdmin } : { sdk:
     if (rbapId) {
       try { await sdk.api.role_based_access_permissions.deleteOne(rbapId) } catch {}
     }
+    if (grantRbapId) {
+      try { await sdk.api.role_based_access_permissions.deleteOne(grantRbapId) } catch {}
+    }
+    if (assignedRbapId) {
+      try { await sdk.api.role_based_access_permissions.deleteOne(assignedRbapId) } catch {}
+    }
     // Re-authenticate the non-admin to drop the no-access role from their JWT
     // before subsequent tests run.
     // Role restore above re-triggers deauthenticate_user; wait > 1s so the freshly minted

package/src/tests/api_tests/translations.test.ts

@@ -0,0 +1,83 @@
+require('source-map-support').install();
+
+import { Session } from "../../sdk"
+import {
+  assert,
+  log_header,
+} from "@tellescope/testing"
+import { setup_tests } from "../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+// Modular test for the translations framework.
+// Validates that a model's `translations` field (nested { field: { language: text } }) is accepted by
+// schema validation, persists, and accumulates multiple languages (uses phone_calls as the MVP model).
+//
+// NOTE: this test deliberately does NOT invoke the AI translation endpoint (ai_conversations.send_message).
+// That path consumes AI credits and belongs in an eval, not a regularly-run test. The endpoint itself is
+// already covered by the AI Summary feature, and the translation-specific logic (the system-prompt
+// builder in @tellescope/utilities) is a pure function verified at compile time.
+export const translations_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("Translations Framework Tests")
+
+  const enduser = await sdk.api.endusers.createOne({ fname: 'Translation', lname: 'Tester' })
+  let callId: string | undefined
+
+  try {
+    const call = await sdk.api.phone_calls.createOne({
+      enduserId: enduser.id,
+      inbound: true,
+      userId: sdk.userInfo.id,
+      transcription: 'Hola, por favor devuélvame la llamada cuando pueda.',
+    })
+    callId = call.id
+
+    // --- 1. translations field accepted + persisted ---
+    const translations = { transcription: { en: 'Hi, please call me back when you can.' } }
+    await sdk.api.phone_calls.updateOne(call.id, { translations }, { replaceObjectFields: true })
+
+    const updated = await sdk.api.phone_calls.getOne(call.id)
+    assert(
+      updated.translations?.transcription?.en === translations.transcription.en,
+      `translations not persisted: ${JSON.stringify(updated.translations)}`,
+      'translations field persisted correctly',
+    )
+
+    // add a second language and confirm accumulation (full merged object written by convention)
+    const merged = {
+      ...updated.translations,
+      transcription: { ...updated.translations?.transcription, es: 'Hola de nuevo.' },
+    }
+    await sdk.api.phone_calls.updateOne(call.id, { translations: merged }, { replaceObjectFields: true })
+    const updated2 = await sdk.api.phone_calls.getOne(call.id)
+    assert(
+      !!updated2.translations?.transcription?.en && !!updated2.translations?.transcription?.es,
+      `translations did not accumulate: ${JSON.stringify(updated2.translations)}`,
+      'multiple language translations accumulate under one field',
+    )
+  } finally {
+    if (callId) await sdk.api.phone_calls.deleteOne(callId).catch(() => {})
+    await sdk.api.endusers.deleteOne(enduser.id).catch(() => {})
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await translations_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ Translations test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Translations test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/tests.ts

@@ -36,6 +36,7 @@ import {
 
 import { Session, APIQuery, EnduserSession } from "../sdk"
 import { enduser_observations_acknowledge_tests } from "./api_tests/enduser_observations_acknowledge.test"
+import { translations_tests } from "./api_tests/translations.test"
 import { user_portal_settings_tests } from "./api_tests/user_portal_settings.test"
 import { integrations_redacted_tests } from "./api_tests/integrations_redacted.test"
 import { get_some_projection_tests } from "./api_tests/get_some_projection.test"
@@ -15113,6 +15114,7 @@ const ip_address_form_tests = async () => {
     await inbox_threads_loading_tests()
     await load_inbox_data_tests({ sdk, sdkNonAdmin })
     await enduser_observations_acknowledge_tests({ sdk, sdkNonAdmin })
+    await translations_tests({ sdk, sdkNonAdmin })
     await create_user_notifications_trigger_tests({ sdk })
     await group_mms_active_tests()
     await auto_reply_tests()