@tellescope/sdk 1.255.6 → 1.255.7

package/src/tests/api_tests/journey_delete_cancels_actions.test.ts

@@ -0,0 +1,152 @@
+import { Session } from '../../sdk'
+import { log_header, wait } from "@tellescope/testing"
+import { AUTOMATED_ACTION_CANCEL_REASONS } from "@tellescope/constants"
+
+const host = process.env.API_URL || 'http://localhost:8080'
+
+export const journey_delete_cancels_actions_tests = async ({ sdk, sdkNonAdmin }: { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("Journey Delete Cancels Pending Actions Tests")
+
+  let journeyId: string | undefined
+  let enduserId: string | undefined
+  let stepId: string | undefined
+
+  try {
+    // Create a journey + an automation_step
+    const journey = await sdk.api.journeys.createOne({ title: "Cascade Cancel Journey " + Date.now() })
+    journeyId = journey.id
+
+    const step = await sdk.api.automation_steps.createOne({
+      journeyId: journey.id,
+      action: { type: 'setEnduserStatus', info: { status: 'Test Status' } },
+      events: [{ type: 'onJourneyStart', info: {} }],
+    })
+    stepId = step.id
+
+    // Create an enduser
+    const enduser = await sdk.api.endusers.createOne({
+      fname: 'Cascade',
+      lname: 'Cancel',
+      email: 'test-cascade-cancel-' + Date.now() + '@example.com',
+    })
+    enduserId = enduser.id
+
+    // Create an active action with a far-future processAfter so the worker won't process it during the test
+    const activeAction = await sdk.api.automated_actions.createOne({
+      journeyId: journey.id,
+      automationStepId: step.id,
+      enduserId: enduser.id,
+      processAfter: Date.now() + 1000000, // far future so the worker won't process it
+      status: 'active',
+      event: { type: 'onJourneyStart', info: {} },
+      action: { type: 'setEnduserStatus', info: { status: 'Test Status' } },
+    })
+
+    // Create a finished action to confirm it is left untouched by the cascade
+    const finishedAction = await sdk.api.automated_actions.createOne({
+      journeyId: journey.id,
+      automationStepId: step.id,
+      enduserId: enduser.id,
+      processAfter: Date.now() + 1000000,
+      status: 'finished',
+      event: { type: 'onJourneyStart', info: {} },
+      action: { type: 'setEnduserStatus', info: { status: 'Test Status' } },
+    })
+
+    // Assert the action starts active
+    const before = await sdk.api.automated_actions.getOne(activeAction.id)
+    if (before.status !== 'active') {
+      throw new Error(`Expected action to start 'active', got '${before.status}'`)
+    }
+    console.log("✓ Action is active before journey deletion")
+
+    // Delete the journey — this should cascade cancel the pending action
+    await sdk.api.journeys.deleteOne(journey.id)
+    journeyId = undefined // already deleted, skip in cleanup
+
+    // Poll until the active action transitions to cancelled with the Journey Deleted reason,
+    // attributed to the deleting user via cancelledBy
+    const expectedReason = AUTOMATED_ACTION_CANCEL_REASONS.indexOf('Journey Deleted')
+    await pollForResults(
+      async () => {
+        const actions = await sdk.api.automated_actions.getSome({ filter: { enduserId: enduser.id } })
+        const active = actions.find(a => a.id === activeAction.id)
+        const finished = actions.find(a => a.id === finishedAction.id)
+        return { active, finished }
+      },
+      ({ active }) => (
+        active?.status === 'cancelled'
+        && active?.cancelReason === expectedReason
+        && active?.cancelledBy === sdk.userInfo.id
+      ),
+      'Active action should be cancelled with Journey Deleted reason and cancelledBy after journey deletion',
+    )
+    console.log("✓ Active action cancelled with Journey Deleted reason and cancelledBy set to deleting user")
+
+    // Not covered here: journey deletion also removes outstanding_froms_trackers. Creating a tracker
+    // requires an automation to actually send an email/SMS with multiple form links, and the collection
+    // is internal-only (no API read access), so it can't be verified from an SDK test.
+
+    // Confirm the finished action was left untouched
+    const finishedAfter = await sdk.api.automated_actions.getOne(finishedAction.id)
+    if (finishedAfter.status !== 'finished') {
+      throw new Error(`Expected finished action to remain 'finished', got '${finishedAfter.status}'`)
+    }
+    console.log("✓ Finished action left untouched")
+
+    console.log("✅ Journey Delete Cancels Pending Actions tests completed successfully")
+  } finally {
+    // Cleanup — journey is already deleted if the flow completed
+    await Promise.all([
+      enduserId ? sdk.api.endusers.deleteOne(enduserId).catch(() => {}) : undefined,
+      stepId ? sdk.api.automation_steps.deleteOne(stepId).catch(() => {}) : undefined,
+      journeyId ? sdk.api.journeys.deleteOne(journeyId).catch(() => {}) : undefined,
+    ])
+  }
+}
+
+const pollForResults = async <T>(
+  fetchFn: () => Promise<T>,
+  evaluateFn: (result: T) => boolean,
+  description: string,
+  intervalMs = 500,
+  maxIterations = 30,
+): Promise<void> => {
+  let lastResult: T | undefined
+
+  for (let i = 0; i < maxIterations; i++) {
+    await wait(undefined, intervalMs)
+
+    lastResult = await fetchFn()
+    if (evaluateFn(lastResult)) {
+      console.log(`✓ ${description} - completed after ${(i + 1) * intervalMs}ms`)
+      return
+    }
+  }
+
+  console.log('Final polling result:', lastResult)
+  throw new Error(`Polling timeout: ${description} - waited ${maxIterations * intervalMs}ms`)
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    const { setup_tests } = await import("../setup")
+    await setup_tests(sdk, sdkNonAdmin)
+    await journey_delete_cancels_actions_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ Journey Delete Cancels Pending Actions test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Journey Delete Cancels Pending Actions test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/security/register_business_id_injection.test.ts

@@ -0,0 +1,140 @@
+require('source-map-support').install();
+
+import axios from "axios"
+import { Session } from "../../../sdk"
+import {
+  assert,
+  log_header,
+  wait,
+} from "@tellescope/testing"
+import { setup_tests } from "../../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const post = async (path: string, body: any, headers: Record<string, string> = {}) => {
+  try {
+    const res = await axios.post(`${host}${path}`, body, {
+      validateStatus: () => true,
+      headers,
+    })
+    return { status: res.status, data: res.data }
+  } catch (err: any) {
+    return { status: err?.response?.status, data: err?.response?.data }
+  }
+}
+
+/**
+ * Reproduction + regression test for the reported vulnerability:
+ *
+ *   A @wearehackerone.com email "joined" a customer's organization without being invited, and
+ *   duplicate user records existed for that email — each bound to a different businessId.
+ *
+ * Root cause: the public `POST /v1/users/register` endpoint. `addPublicEndpoint` accepts an
+ * OPTIONAL, caller-supplied `businessId` (routing.ts) and bakes it into the handler's DB. The
+ * register handler's only duplicate guard (`DB.users.findOne({ email })`) is therefore scoped to
+ * whatever org the caller named, and the subsequent `DB.users.insertOne(...)` stamps that
+ * caller-supplied businessId onto a new `accountType: 'Business'` user — bypassing the
+ * globalUnique: ['email'] enforcement that only runs in the generic create route.
+ *
+ * The "victim org" here is the test admin's own org (sdk.userInfo.businessId): an org the
+ * anonymous caller was never invited to. The admin is used purely to OBSERVE whether an
+ * uninvited user record materialized inside their org (getOne({ email }) is org-scoped and
+ * throws when the email is absent from the caller's tenant).
+ *
+ * Expected results:
+ *   - VULNERABLE code: the assertions FAIL — the planted user appears inside the victim org,
+ *     proving the exploit ("EXPLOIT CONFIRMED" in the failure message).
+ *   - FIXED code: register ignores the caller-supplied businessId (self-signups are created
+ *     org-less and duplicates are rejected globally), so nothing appears in the victim org and
+ *     the assertions PASS.
+ *
+ * Uses unique emails per run (Date.now()) so re-runs never collide on the platform-wide unique
+ * email constraint. NOTE: on the FIXED path these registrations create org-less user records
+ * that an org-scoped admin cannot delete — harmless residue (unique emails), inherent to the
+ * legitimate "root register, no org" signup behavior.
+ */
+export const register_business_id_injection_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("register businessId injection")
+
+  const victimBusinessId = sdk.userInfo.businessId
+  const password = 'testpassword123!'
+  const termsVersion = '1'
+
+  // ==================================================================================
+  // Scenario 1 — uninvited org join
+  // An anonymous caller registers with businessId set to the victim org. On vulnerable
+  // code this creates a Business user INSIDE the victim org that no one invited.
+  // ==================================================================================
+  const email1 = `security+reg-inject-${Date.now()}@wearehackerone.com`
+
+  const before = await sdk.api.users.getOne({ email: email1 }).catch(() => null)
+  assert(before === null, `precondition failed: ${email1} already present in victim org`, 'precondition: victim org has no such user')
+
+  const res1 = await post('/v1/users/register', { email: email1, password, termsVersion, businessId: victimBusinessId })
+  console.log(`   register(businessId=victim) -> HTTP ${res1.status}`)
+
+  const planted1: any = await sdk.api.users.getOne({ email: email1 }).catch(() => null)
+  const injectedIntoVictimOrg = !!planted1 && planted1.businessId === victimBusinessId
+
+  // Clean up BEFORE asserting (a failed assert calls process.exit(1) and would skip cleanup).
+  if (planted1?.id) await sdk.api.users.deleteOne(planted1.id).catch(() => {})
+
+  assert(
+    !injectedIntoVictimOrg,
+    `❌ EXPLOIT CONFIRMED: anonymous POST /v1/users/register with businessId=${victimBusinessId} created user `
+      + `${email1} (accountType=${planted1?.accountType}) inside the victim org — no invite required`,
+    '✅ register ignores caller-supplied businessId — no user injected into victim org',
+  )
+
+  await wait(undefined, 1200) // register endpoint rate-limits ~1/sec per IP
+
+  // ==================================================================================
+  // Scenario 2 — cross-org duplicate for the same email
+  // First register with NO businessId (the legitimate "root register, no org" record —
+  // the "oldest" account in the report). Then register the SAME email WITH the victim
+  // businessId. On vulnerable code the scoped duplicate check misses the org-less record,
+  // so a SECOND user record for the same email is created inside the victim org.
+  // ==================================================================================
+  const email2 = `security+reg-dup-${Date.now()}@wearehackerone.com`
+
+  const resRoot = await post('/v1/users/register', { email: email2, password, termsVersion })
+  console.log(`   register(no businessId) -> HTTP ${resRoot.status}`)
+
+  await wait(undefined, 1200)
+
+  const resDup = await post('/v1/users/register', { email: email2, password, termsVersion, businessId: victimBusinessId })
+  console.log(`   register(same email, businessId=victim) -> HTTP ${resDup.status}`)
+
+  const planted2: any = await sdk.api.users.getOne({ email: email2 }).catch(() => null)
+  const duplicateInVictimOrg = !!planted2 && planted2.businessId === victimBusinessId
+
+  if (planted2?.id) await sdk.api.users.deleteOne(planted2.id).catch(() => {})
+
+  assert(
+    !duplicateInVictimOrg,
+    `❌ EXPLOIT CONFIRMED: same email ${email2} registered into a second org — duplicate user `
+      + `(accountType=${planted2?.accountType}) created in victim org ${victimBusinessId}`,
+    '✅ register enforces global email uniqueness — no cross-org duplicate created',
+  )
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await register_business_id_injection_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ register businessId injection test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ register businessId injection test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/tests.ts

@@ -53,6 +53,7 @@ import { appointment_rescheduled_trigger_tests } from "./api_tests/appointment_r
 import { appointment_no_showed_trigger_tests } from "./api_tests/appointment_no_showed_trigger.test"
 import { group_event_attendee_status_triggers_tests } from "./api_tests/group_event_attendee_status_triggers.test"
 import { journey_error_branching_tests } from "./api_tests/journey_error_branching.test"
+import { journey_delete_cancels_actions_tests } from "./api_tests/journey_delete_cancels_actions.test"
 import { afteraction_day_of_month_delay_tests } from "./api_tests/afteraction_day_of_month_delay.test"
 import { push_forms_to_portal_group_completion_tests } from "./api_tests/push_forms_to_portal_group_completion.test"
 import { setup_tests } from "./setup"
@@ -102,6 +103,7 @@ import { ai_conversations_rbac_tests } from "./api_tests/security/F-0005-ai-conv
 import { cascade_role_rename_cross_tenant_tests } from "./api_tests/security/F-0053-cascade-role-rename-cross-tenant.test";
 import { self_admin_role_assignment_tests } from "./api_tests/security/F-0076-self-admin-role-assignment.test";
 import { invite_user_enumeration_tests } from "./api_tests/security/F-0007-invite-user-enumeration.test";
+import { register_business_id_injection_tests } from "./api_tests/security/register_business_id_injection.test";
 import { handle_incoming_communication_cross_tenant_tests } from "./api_tests/security/F-0008-handle-incoming-communication-cross-tenant.test";
 import { sanitize_user_html_xss_tests } from "./api_tests/security/F-0013-sanitize-user-html.test";
 import { prototype_pollution_tests } from "./api_tests/security/F-0016-prototype-pollution.test";
@@ -15036,6 +15038,7 @@ const ip_address_form_tests = async () => {
     await replace_form_field_template_values_tests()
     await mfa_tests()
     await setup_tests(sdk, sdkNonAdmin)
+    await register_business_id_injection_tests({ sdk, sdkNonAdmin })
     await automation_trigger_tests()
     await resource_access_tags_tests({ sdk, sdkNonAdmin })
     await beluga_manual_sync_tests({ sdk, sdkNonAdmin })
@@ -15111,6 +15114,7 @@ const ip_address_form_tests = async () => {
     await test_ticket_automation_assignment_and_optimization()
     await monthly_availability_restrictions_tests({ sdk, sdkNonAdmin })
     await journey_error_branching_tests({ sdk, sdkNonAdmin })
+    await journey_delete_cancels_actions_tests({ sdk, sdkNonAdmin })
     await message_assignment_trigger_tests({ sdk })
     await inbox_threads_building_tests()
     await inbox_threads_loading_tests()