@tellescope/sdk 1.255.3 → 1.255.4

package/src/tests/api_tests/medication_added_trigger.test.ts

@@ -182,7 +182,7 @@ export const medication_added_trigger_tests = async ({ sdk, sdkNonAdmin } : { sd
     title: "Medication - Beluga Protocol Test"
   })
 
-  // Simulate the Beluga RX_WRITTEN webhook with two meds covering category present (typical) and "N/A"
+  // Simulate the Beluga RX_WRITTEN webhook with two meds covering category/pharmacyNotes present (typical) and "N/A"/absent
   const webhookResponse = await fetch(`${host}/v1/webhooks/beluga`, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
@@ -198,6 +198,7 @@ export const medication_added_trigger_tests = async ({ sdk, sdkNonAdmin } : { sd
         medId: 'test-ndc-123',
         rxId: 'test-rx-456',
         category: 'weightloss1',
+        pharmacyNotes: 'Dispense with syringes',
       }, {
         name: 'Metformin',
         strength: '500mg',
@@ -245,6 +246,16 @@ export const medication_added_trigger_tests = async ({ sdk, sdkNonAdmin } : { sd
     async () => belugaMedMetformin,
     { onResult: (m: EnduserMedication) => m?.category === 'N/A' }
   )
+  await async_test(
+    "Beluga RX_WRITTEN - Medication has notes from webhook pharmacyNotes",
+    async () => belugaMedSemaglutide,
+    { onResult: (m: EnduserMedication) => m?.notes === 'Dispense with syringes' }
+  )
+  await async_test(
+    "Beluga RX_WRITTEN - Medication omits notes when pharmacyNotes not provided on med",
+    async () => belugaMedMetformin,
+    { onResult: (m: EnduserMedication) => m?.notes === undefined || m?.notes === null }
+  )
 
   // Backwards-compatibility: a webhook with no category on any med should result in undefined category
   const belugaFormNoCategory = await sdk.api.forms.createOne({
@@ -294,6 +305,11 @@ export const medication_added_trigger_tests = async ({ sdk, sdkNonAdmin } : { sd
     async () => belugaMedNoCategory,
     { onResult: (m: EnduserMedication) => m?.category === undefined || m?.category === null }
   )
+  await async_test(
+    "Beluga RX_WRITTEN - Medication omits notes when pharmacyNotes not provided",
+    async () => belugaMedNoCategory,
+    { onResult: (m: EnduserMedication) => m?.notes === undefined || m?.notes === null }
+  )
 
   try {
     // Clean up Beluga test data
@@ -389,14 +405,56 @@ export const medication_added_trigger_tests = async ({ sdk, sdkNonAdmin } : { sd
     { onResult: (e: Enduser) => e.fields?.['Medication Category'] === '' }
   )
 
+  // ---- Set Fields with {{medication.notes}} Test ----
+  log_header("Medication Added - Set Fields with {{medication.notes}}")
+
+  const setFieldsPharmacyNotesTrigger = await sdk.api.automation_triggers.createOne({
+    event: { type: 'Medication Added', info: { titles: [], protocols: [] } },
+    action: { type: 'Set Fields', info: { fields: [{ name: 'Medication Notes', type: 'Custom Value' as const, value: '{{medication.notes}}' }] }},
+    status: 'Active',
+    title: "Medication - Set Fields medication.notes"
+  })
+
+  const setFieldsPharmacyNotesEnduser = await sdk.api.endusers.createOne({})
+
+  const setFieldsPharmacyNotesMed = await sdk.api.enduser_medications.createOne({
+    enduserId: setFieldsPharmacyNotesEnduser.id,
+    title: 'Ozempic 1mg',
+    notes: 'Dispense with syringes',
+  })
+  await wait(undefined, 500)
+
+  await async_test(
+    "Medication Added - Set Fields copies medication.notes to enduser field",
+    () => sdk.api.endusers.getOne(setFieldsPharmacyNotesEnduser.id),
+    { onResult: (e: Enduser) => e.fields?.['Medication Notes'] === 'Dispense with syringes' }
+  )
+
+  // notes absent on medication → placeholder resolves to empty string
+  const setFieldsPharmacyNotesEnduserEmpty = await sdk.api.endusers.createOne({})
+  const setFieldsPharmacyNotesMedEmpty = await sdk.api.enduser_medications.createOne({
+    enduserId: setFieldsPharmacyNotesEnduserEmpty.id,
+    title: 'Lisinopril 40mg',
+  })
+  await wait(undefined, 500)
+
+  await async_test(
+    "Medication Added - Set Fields with no notes resolves to empty string",
+    () => sdk.api.endusers.getOne(setFieldsPharmacyNotesEnduserEmpty.id),
+    { onResult: (e: Enduser) => e.fields?.['Medication Notes'] === '' }
+  )
+
   try {
     await sdk.api.automation_triggers.deleteOne(setFieldsTrigger.id)
     await sdk.api.automation_triggers.deleteOne(setFieldsTriggerFiltered.id)
     await sdk.api.automation_triggers.deleteOne(setFieldsCategoryTrigger.id)
+    await sdk.api.automation_triggers.deleteOne(setFieldsPharmacyNotesTrigger.id)
     await sdk.api.endusers.deleteOne(setFieldsEnduser.id)
     await sdk.api.endusers.deleteOne(setFieldsEnduser2.id)
     await sdk.api.endusers.deleteOne(setFieldsCategoryEnduser.id)
     await sdk.api.endusers.deleteOne(setFieldsCategoryEnduserEmpty.id)
+    await sdk.api.endusers.deleteOne(setFieldsPharmacyNotesEnduser.id)
+    await sdk.api.endusers.deleteOne(setFieldsPharmacyNotesEnduserEmpty.id)
   } finally {}
 
   // ---- titleCondition (compound conditional logic on title) ----

package/src/tests/api_tests/security/F-0005-ai-conversations-rbac.test.ts

@@ -28,6 +28,16 @@ const [nonAdminEmail, nonAdminPassword] = [process.env.NON_ADMIN_EMAIL, process.
  *   2. Assigns the role to the non-admin user.
  *   3. Calls each endpoint as the non-admin.
  *   4. Asserts each endpoint returns a 403-equivalent error (not 200).
+ *   5. Positive case: a role granting ai_conversations create (read/update denied) must pass
+ *      the send_message gate — generating a NEW conversation requires only create access.
+ *   6. But the same role must still 403 when passing a conversationId: continuing an existing
+ *      conversation reads its stored history (returned in the response) and appends to it,
+ *      so it requires read + update access in addition to create.
+ *   7. Default-provider-permissions role (ai_conversations = Assigned): send_message must not
+ *      500. Regression: the post-generation $push previously ran through the caller's
+ *      access-scoped DB, where "Assigned" filters can't match the just-created conversation,
+ *      returning null and crashing the handler (Cannot read properties of null '_id') after
+ *      credits were consumed. bedrock.ts now persists via tenant-scoped org-wide queries.
  *
  * Pre-fix:
  *   - send_message: 200 (or some downstream error from Bedrock) — NOT 403. Test fails.
@@ -39,7 +49,11 @@ export const ai_conversations_rbac_tests = async ({ sdk, sdkNonAdmin } : { sdk:
   log_header("F-0005: ai_conversations RBAC bypass regression")
 
   const roleName = `f0005-ai-conversations-no-access-${Date.now()}`
+  const grantRoleName = `f0005-ai-conversations-create-granted-${Date.now()}`
+  const assignedRoleName = `f0005-ai-conversations-assigned-default-${Date.now()}`
   let rbapId: string | undefined
+  let grantRbapId: string | undefined
+  let assignedRbapId: string | undefined
   const originalRoles = sdkNonAdmin.userInfo.roles
 
   try {
@@ -109,6 +123,109 @@ export const ai_conversations_rbac_tests = async ({ sdk, sdkNonAdmin } : { sdk:
         },
       },
     )
+
+    // 4. Positive case: granting only ai_conversations create must pass the RBAC gate.
+    //    send_message may still fail downstream (e.g. 400 "Organization has not set up credits"),
+    //    but it must NOT be an access-denial error.
+    const grantRbap = await sdk.api.role_based_access_permissions.createOne({
+      role: grantRoleName,
+      permissions: {
+        ...PROVIDER_PERMISSIONS,
+        ai_conversations: { create: 'All', read: null, update: null, delete: null },
+      },
+    })
+    grantRbapId = grantRbap.id
+
+    await sdk.api.users.updateOne(
+      sdkNonAdmin.userInfo.id,
+      { roles: [grantRoleName] },
+      { replaceObjectFields: true },
+    )
+    await wait(undefined, 1500)
+    await sdkNonAdmin.authenticate(nonAdminEmail!, nonAdminPassword!)
+
+    await async_test(
+      "F-0005: ai_conversations.send_message must NOT be access-denied when role grants create",
+      () => sdkNonAdmin.api.ai_conversations.send_message({
+        message: 'F-0005 positive-case test',
+        type: 'Test',
+        maxTokens: 1,
+      } as any)
+        .then(() => 'allowed' as const)
+        .catch((e: any) => {
+          const msg = (e?.message ?? '').toLowerCase()
+          const status = e?.status ?? e?.code
+          if (status === 403 || status === 401
+            || msg.includes('access') || msg.includes('permission') || msg.includes('forbidden')) {
+            throw e // access denial — the gate incorrectly blocked a create-granted role
+          }
+          return 'allowed' as const // downstream (e.g. credits) error is fine — the gate passed
+        }),
+      { onResult: r => r === 'allowed' },
+    )
+
+    // 5. The create-granted (read/update-denied) role must still be blocked from CONTINUING an
+    //    existing conversation — send_message with conversationId returns the full stored history
+    //    and appends to it. Fake id is fine: the access check must fire before any lookup.
+    await async_test(
+      "F-0005: ai_conversations.send_message with conversationId must 403 when role denies read/update",
+      () => sdkNonAdmin.api.ai_conversations.send_message({
+        message: 'F-0005 conversationId bypass test',
+        type: 'Test',
+        maxTokens: 1,
+        conversationId: new ObjectId().toHexString(),
+      } as any),
+      {
+        shouldError: true,
+        onError: (e: any) => {
+          const msg = (e?.message ?? '').toLowerCase()
+          const status = e?.status ?? e?.code
+          return status === 403 || status === 401
+            || msg.includes('access') || msg.includes('permission') || msg.includes('forbidden')
+        },
+      },
+    )
+
+    // 6. Regression: a role with default provider permissions (ai_conversations = Assigned)
+    //    must be able to generate a new conversation without a 500. Previously the
+    //    post-generation $push ran through the access-scoped DB, matched nothing under
+    //    "Assigned", and crashed the handler with "Cannot read properties of null ('_id')".
+    const assignedRbap = await sdk.api.role_based_access_permissions.createOne({
+      role: assignedRoleName,
+      permissions: { ...PROVIDER_PERMISSIONS },
+    })
+    assignedRbapId = assignedRbap.id
+
+    await sdk.api.users.updateOne(
+      sdkNonAdmin.userInfo.id,
+      { roles: [assignedRoleName] },
+      { replaceObjectFields: true },
+    )
+    await wait(undefined, 1500)
+    await sdkNonAdmin.authenticate(nonAdminEmail!, nonAdminPassword!)
+
+    await async_test(
+      "F-0005: ai_conversations.send_message must not 500 for Assigned-access (default provider) role",
+      () => sdkNonAdmin.api.ai_conversations.send_message({
+        message: 'F-0005 assigned-access regression test',
+        type: 'Test',
+        maxTokens: 1,
+      } as any)
+        .then(() => 'ok' as const)
+        .catch((e: any) => {
+          const msg = (e?.message ?? '').toLowerCase()
+          const status = e?.status ?? e?.code
+          if (status === 500 || msg.includes('internal error') || msg.includes('cannot read properties')) {
+            throw e // the null-update crash — regression
+          }
+          if (status === 403 || status === 401
+            || msg.includes('access') || msg.includes('permission') || msg.includes('forbidden')) {
+            throw e // Assigned access must pass the RBAC gate
+          }
+          return 'ok' as const // downstream (e.g. credits) error is fine
+        }),
+      { onResult: r => r === 'ok' },
+    )
   } finally {
     // Cleanup: restore original roles, delete the test role.
     try {
@@ -121,6 +238,12 @@ export const ai_conversations_rbac_tests = async ({ sdk, sdkNonAdmin } : { sdk:
     if (rbapId) {
       try { await sdk.api.role_based_access_permissions.deleteOne(rbapId) } catch {}
     }
+    if (grantRbapId) {
+      try { await sdk.api.role_based_access_permissions.deleteOne(grantRbapId) } catch {}
+    }
+    if (assignedRbapId) {
+      try { await sdk.api.role_based_access_permissions.deleteOne(assignedRbapId) } catch {}
+    }
     // Re-authenticate the non-admin to drop the no-access role from their JWT
     // before subsequent tests run.
     // Role restore above re-triggers deauthenticate_user; wait > 1s so the freshly minted