@tellescope/sdk 1.255.6 → 1.255.8

package/src/tests/api_tests/custom_dashboards.test.ts

@@ -4,6 +4,7 @@ import { Session } from "../../sdk"
 import {
   async_test,
   log_header,
+  wait,
 } from "@tellescope/testing"
 import { setup_tests } from "../setup"
 
@@ -199,6 +200,56 @@ export const custom_dashboards_tests = async ({ sdk, sdkNonAdmin }: { sdk: Sessi
     }
   )
 
+  // Test 6b: Create dashboard with every built-in block type (legacy renderer set)
+  const dashboardWithBuiltInTypes = await sdk.api.custom_dashboards.createOne({
+    title: "Built-In Block Types Dashboard",
+    blocks: [
+      { type: "Inbox" },
+      { type: "Tickets" },
+      { type: "Team Chats" },
+      { type: "Upcoming Events" },
+      { type: "To-Dos" },
+      { type: "Database", info: { databaseId: "60398b0231a295e64f084fd9" } },
+    ],
+  })
+
+  await async_test(
+    "Dashboard with all built-in block types created correctly",
+    async () => dashboardWithBuiltInTypes,
+    {
+      onResult: r => (
+        r.blocks.length === 6
+        && r.blocks[0].type === "Inbox"
+        && r.blocks[1].type === "Tickets"
+        && r.blocks[2].type === "Team Chats"
+        && r.blocks[3].type === "Upcoming Events"
+        && r.blocks[4].type === "To-Dos"
+        && r.blocks[5].type === "Database"
+        && r.blocks[5].info !== undefined && r.blocks[5].info.databaseId === "60398b0231a295e64f084fd9"
+      )
+    }
+  )
+
+  // Test 6c: Unknown top-level block fields are stripped on save (params belong in info)
+  const dashboardWithUnknownBlockField = await sdk.api.custom_dashboards.createOne({
+    title: "Unknown Block Field Dashboard",
+    blocks: [
+      { type: "Inbox", customTopLevel: "x", info: { kept: true } } as any,
+    ],
+  })
+
+  await async_test(
+    "Unknown top-level block fields stripped, info preserved",
+    async () => dashboardWithUnknownBlockField,
+    {
+      onResult: r => (
+        r.blocks.length === 1
+        && (r.blocks[0] as any).customTopLevel === undefined
+        && r.blocks[0].info !== undefined && r.blocks[0].info.kept === true
+      )
+    }
+  )
+
   // Test 7: Update gridConfig only
   const updatedGridConfig = await sdk.api.custom_dashboards.updateOne(dashboardWithNewTypes.id, {
     gridConfig: { columns: 24, gap: 8 },
@@ -215,6 +266,67 @@ export const custom_dashboards_tests = async ({ sdk, sdkNonAdmin }: { sdk: Sessi
     }
   )
 
+  // Test 7b: Create dashboard with top-level type field
+  const typedDashboard = await sdk.api.custom_dashboards.createOne({
+    title: "Typed Dashboard",
+    type: "home",
+    blocks: [{ type: "Inbox", colSpan: 12 }],
+  })
+
+  await async_test(
+    "Dashboard with top-level type created correctly",
+    async () => typedDashboard,
+    { onResult: r => r.type === "home" }
+  )
+
+  // Test 7c: Dashboards without type still work (backwards compatibility)
+  await async_test(
+    "Dashboard without type has undefined type",
+    async () => sdk.api.custom_dashboards.getOne(basicDashboard.id),
+    { onResult: r => r.type === undefined }
+  )
+
+  // Test 7d: Update top-level type
+  const updatedType = await sdk.api.custom_dashboards.updateOne(typedDashboard.id, {
+    type: "clinical",
+  })
+
+  await async_test(
+    "Dashboard type updated correctly",
+    async () => updatedType,
+    { onResult: r => r.type === "clinical" }
+  )
+
+  // Test 7e: Filter dashboards by type
+  const secondTypedDashboard = await sdk.api.custom_dashboards.createOne({
+    title: "Second Typed Dashboard",
+    type: "clinical",
+    blocks: [{ type: "Tickets", colSpan: 12 }],
+  })
+
+  await async_test(
+    "Dashboards filtered by type via filter",
+    async () => sdk.api.custom_dashboards.getSome({ filter: { type: "clinical" } }),
+    {
+      onResult: r => (
+        r.length === 2
+        && r.every(d => d.type === "clinical")
+      )
+    }
+  )
+
+  // Test 7f: Filter dashboards by type via mdbFilter
+  await async_test(
+    "Dashboards filtered by type via mdbFilter",
+    async () => sdk.api.custom_dashboards.getSome({ mdbFilter: { type: "clinical" } }),
+    {
+      onResult: r => (
+        r.length === 2
+        && r.every(d => d.type === "clinical")
+      )
+    }
+  )
+
   // Test 8: Non-admin can read all dashboards by default
   const nonAdminList = await sdkNonAdmin.api.custom_dashboards.getSome({ filter: {} })
 
@@ -224,14 +336,110 @@ export const custom_dashboards_tests = async ({ sdk, sdkNonAdmin }: { sdk: Sessi
     { onResult: r => r.length >= 2 }
   )
 
+  // Test 9: visibleToAllUsers grants org-wide access to users without full read access
+  const restrictedRole = await sdk.api.role_based_access_permissions.createOne({
+    role: 'Dashboard Default Access',
+    permissions: {
+      custom_dashboards: { read: 'Default', create: null, update: null, delete: null },
+    },
+  })
+
+  const restrictedUserEmail = 'dashboard.restricted.test@tellescope.com'
+  let restrictedUser = await sdk.api.users.getOne({ email: restrictedUserEmail }).catch(() => null) // throws error on none found
+  if (restrictedUser && !restrictedUser.verifiedEmail) { // verifiedEmail can only be set on create, so recreate stale users
+    await sdk.api.users.deleteOne(restrictedUser.id)
+    restrictedUser = null
+  }
+  if (!restrictedUser) {
+    restrictedUser = await sdk.api.users.createOne({ email: restrictedUserEmail, notificationEmailsDisabled: true, verifiedEmail: true })
+  }
+  // ensure role is set, in case GET returned a user without a role or with a different role
+  await sdk.api.users.updateOne(restrictedUser.id, { roles: [restrictedRole.role] }, { replaceObjectFields: true })
+  await wait(undefined, 2000) // role change triggers a logout
+
+  const sdkRestricted = new Session({
+    host,
+    authToken: (await sdk.api.users.generate_auth_token({ id: restrictedUser.id })).authToken,
+  })
+  await async_test('test_authenticated (restricted dashboard user)', sdkRestricted.test_authenticated, { expectedResult: 'Authenticated!' })
+
+  const hiddenDashboard = await sdk.api.custom_dashboards.createOne({
+    title: "Hidden From Restricted",
+    blocks: [{ type: "Inbox", colSpan: 12 }],
+  })
+  const orgWideDashboard = await sdk.api.custom_dashboards.createOne({
+    title: "Org-Wide Dashboard",
+    visibleToAllUsers: true,
+    blocks: [{ type: "Inbox", colSpan: 12 }],
+  })
+  const explicitFalseDashboard = await sdk.api.custom_dashboards.createOne({
+    title: "Explicit False Dashboard",
+    visibleToAllUsers: false,
+    blocks: [{ type: "Inbox", colSpan: 12 }],
+  })
+  const assignedDashboard = await sdk.api.custom_dashboards.createOne({
+    title: "Assigned To Restricted",
+    userIds: [restrictedUser.id],
+    blocks: [{ type: "Inbox", colSpan: 12 }],
+  })
+
+  await async_test(
+    "Restricted user sees org-wide and assigned dashboards only",
+    () => sdkRestricted.api.custom_dashboards.getSome({ filter: {} }),
+    {
+      onResult: r => (
+        !!r.find(d => d.id === orgWideDashboard.id)
+        && !!r.find(d => d.id === assignedDashboard.id)
+        && !r.find(d => d.id === hiddenDashboard.id)
+        && !r.find(d => d.id === explicitFalseDashboard.id)
+      )
+    }
+  )
+
+  await async_test(
+    "Restricted user can read org-wide dashboard by id",
+    () => sdkRestricted.api.custom_dashboards.getOne(orgWideDashboard.id),
+    { onResult: r => r.id === orgWideDashboard.id && r.visibleToAllUsers === true }
+  )
+
+  await async_test(
+    "Restricted user cannot read unshared dashboard by id",
+    () => sdkRestricted.api.custom_dashboards.getOne(hiddenDashboard.id),
+    { shouldError: true, onError: () => true }
+  )
+
+  // Toggling the flag on takes effect for the restricted user
+  await sdk.api.custom_dashboards.updateOne(hiddenDashboard.id, { visibleToAllUsers: true })
+
+  await async_test(
+    "Restricted user can read dashboard after visibleToAllUsers enabled",
+    () => sdkRestricted.api.custom_dashboards.getOne(hiddenDashboard.id),
+    { onResult: r => r.id === hiddenDashboard.id }
+  )
+
+  // Admin continues to see everything, including unshared dashboards
+  await async_test(
+    "Admin still sees explicit-false dashboard",
+    () => sdk.api.custom_dashboards.getOne(explicitFalseDashboard.id),
+    { onResult: r => r.id === explicitFalseDashboard.id }
+  )
+
   // Cleanup
   await Promise.all([
+    sdk.api.custom_dashboards.deleteOne(hiddenDashboard.id),
+    sdk.api.custom_dashboards.deleteOne(orgWideDashboard.id),
+    sdk.api.custom_dashboards.deleteOne(explicitFalseDashboard.id),
+    sdk.api.custom_dashboards.deleteOne(assignedDashboard.id),
     sdk.api.custom_dashboards.deleteOne(basicDashboard.id),
     sdk.api.custom_dashboards.deleteOne(duplicateTitleDashboard.id),
     sdk.api.custom_dashboards.deleteOne(fullDashboard.id),
     sdk.api.custom_dashboards.deleteOne(dashboardWithUserIds.id),
     sdk.api.custom_dashboards.deleteOne(dashboardWithNewTypes.id),
     sdk.api.custom_dashboards.deleteOne(dashboardWithComplexBlocks.id),
+    sdk.api.custom_dashboards.deleteOne(dashboardWithBuiltInTypes.id),
+    sdk.api.custom_dashboards.deleteOne(dashboardWithUnknownBlockField.id),
+    sdk.api.custom_dashboards.deleteOne(typedDashboard.id),
+    sdk.api.custom_dashboards.deleteOne(secondTypedDashboard.id),
   ])
 }
 

package/src/tests/api_tests/journey_delete_cancels_actions.test.ts

@@ -0,0 +1,152 @@
+import { Session } from '../../sdk'
+import { log_header, wait } from "@tellescope/testing"
+import { AUTOMATED_ACTION_CANCEL_REASONS } from "@tellescope/constants"
+
+const host = process.env.API_URL || 'http://localhost:8080'
+
+export const journey_delete_cancels_actions_tests = async ({ sdk, sdkNonAdmin }: { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("Journey Delete Cancels Pending Actions Tests")
+
+  let journeyId: string | undefined
+  let enduserId: string | undefined
+  let stepId: string | undefined
+
+  try {
+    // Create a journey + an automation_step
+    const journey = await sdk.api.journeys.createOne({ title: "Cascade Cancel Journey " + Date.now() })
+    journeyId = journey.id
+
+    const step = await sdk.api.automation_steps.createOne({
+      journeyId: journey.id,
+      action: { type: 'setEnduserStatus', info: { status: 'Test Status' } },
+      events: [{ type: 'onJourneyStart', info: {} }],
+    })
+    stepId = step.id
+
+    // Create an enduser
+    const enduser = await sdk.api.endusers.createOne({
+      fname: 'Cascade',
+      lname: 'Cancel',
+      email: 'test-cascade-cancel-' + Date.now() + '@example.com',
+    })
+    enduserId = enduser.id
+
+    // Create an active action with a far-future processAfter so the worker won't process it during the test
+    const activeAction = await sdk.api.automated_actions.createOne({
+      journeyId: journey.id,
+      automationStepId: step.id,
+      enduserId: enduser.id,
+      processAfter: Date.now() + 1000000, // far future so the worker won't process it
+      status: 'active',
+      event: { type: 'onJourneyStart', info: {} },
+      action: { type: 'setEnduserStatus', info: { status: 'Test Status' } },
+    })
+
+    // Create a finished action to confirm it is left untouched by the cascade
+    const finishedAction = await sdk.api.automated_actions.createOne({
+      journeyId: journey.id,
+      automationStepId: step.id,
+      enduserId: enduser.id,
+      processAfter: Date.now() + 1000000,
+      status: 'finished',
+      event: { type: 'onJourneyStart', info: {} },
+      action: { type: 'setEnduserStatus', info: { status: 'Test Status' } },
+    })
+
+    // Assert the action starts active
+    const before = await sdk.api.automated_actions.getOne(activeAction.id)
+    if (before.status !== 'active') {
+      throw new Error(`Expected action to start 'active', got '${before.status}'`)
+    }
+    console.log("✓ Action is active before journey deletion")
+
+    // Delete the journey — this should cascade cancel the pending action
+    await sdk.api.journeys.deleteOne(journey.id)
+    journeyId = undefined // already deleted, skip in cleanup
+
+    // Poll until the active action transitions to cancelled with the Journey Deleted reason,
+    // attributed to the deleting user via cancelledBy
+    const expectedReason = AUTOMATED_ACTION_CANCEL_REASONS.indexOf('Journey Deleted')
+    await pollForResults(
+      async () => {
+        const actions = await sdk.api.automated_actions.getSome({ filter: { enduserId: enduser.id } })
+        const active = actions.find(a => a.id === activeAction.id)
+        const finished = actions.find(a => a.id === finishedAction.id)
+        return { active, finished }
+      },
+      ({ active }) => (
+        active?.status === 'cancelled'
+        && active?.cancelReason === expectedReason
+        && active?.cancelledBy === sdk.userInfo.id
+      ),
+      'Active action should be cancelled with Journey Deleted reason and cancelledBy after journey deletion',
+    )
+    console.log("✓ Active action cancelled with Journey Deleted reason and cancelledBy set to deleting user")
+
+    // Not covered here: journey deletion also removes outstanding_froms_trackers. Creating a tracker
+    // requires an automation to actually send an email/SMS with multiple form links, and the collection
+    // is internal-only (no API read access), so it can't be verified from an SDK test.
+
+    // Confirm the finished action was left untouched
+    const finishedAfter = await sdk.api.automated_actions.getOne(finishedAction.id)
+    if (finishedAfter.status !== 'finished') {
+      throw new Error(`Expected finished action to remain 'finished', got '${finishedAfter.status}'`)
+    }
+    console.log("✓ Finished action left untouched")
+
+    console.log("✅ Journey Delete Cancels Pending Actions tests completed successfully")
+  } finally {
+    // Cleanup — journey is already deleted if the flow completed
+    await Promise.all([
+      enduserId ? sdk.api.endusers.deleteOne(enduserId).catch(() => {}) : undefined,
+      stepId ? sdk.api.automation_steps.deleteOne(stepId).catch(() => {}) : undefined,
+      journeyId ? sdk.api.journeys.deleteOne(journeyId).catch(() => {}) : undefined,
+    ])
+  }
+}
+
+const pollForResults = async <T>(
+  fetchFn: () => Promise<T>,
+  evaluateFn: (result: T) => boolean,
+  description: string,
+  intervalMs = 500,
+  maxIterations = 30,
+): Promise<void> => {
+  let lastResult: T | undefined
+
+  for (let i = 0; i < maxIterations; i++) {
+    await wait(undefined, intervalMs)
+
+    lastResult = await fetchFn()
+    if (evaluateFn(lastResult)) {
+      console.log(`✓ ${description} - completed after ${(i + 1) * intervalMs}ms`)
+      return
+    }
+  }
+
+  console.log('Final polling result:', lastResult)
+  throw new Error(`Polling timeout: ${description} - waited ${maxIterations * intervalMs}ms`)
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    const { setup_tests } = await import("../setup")
+    await setup_tests(sdk, sdkNonAdmin)
+    await journey_delete_cancels_actions_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ Journey Delete Cancels Pending Actions test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Journey Delete Cancels Pending Actions test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/security/register_business_id_injection.test.ts

@@ -0,0 +1,140 @@
+require('source-map-support').install();
+
+import axios from "axios"
+import { Session } from "../../../sdk"
+import {
+  assert,
+  log_header,
+  wait,
+} from "@tellescope/testing"
+import { setup_tests } from "../../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const post = async (path: string, body: any, headers: Record<string, string> = {}) => {
+  try {
+    const res = await axios.post(`${host}${path}`, body, {
+      validateStatus: () => true,
+      headers,
+    })
+    return { status: res.status, data: res.data }
+  } catch (err: any) {
+    return { status: err?.response?.status, data: err?.response?.data }
+  }
+}
+
+/**
+ * Reproduction + regression test for the reported vulnerability:
+ *
+ *   A @wearehackerone.com email "joined" a customer's organization without being invited, and
+ *   duplicate user records existed for that email — each bound to a different businessId.
+ *
+ * Root cause: the public `POST /v1/users/register` endpoint. `addPublicEndpoint` accepts an
+ * OPTIONAL, caller-supplied `businessId` (routing.ts) and bakes it into the handler's DB. The
+ * register handler's only duplicate guard (`DB.users.findOne({ email })`) is therefore scoped to
+ * whatever org the caller named, and the subsequent `DB.users.insertOne(...)` stamps that
+ * caller-supplied businessId onto a new `accountType: 'Business'` user — bypassing the
+ * globalUnique: ['email'] enforcement that only runs in the generic create route.
+ *
+ * The "victim org" here is the test admin's own org (sdk.userInfo.businessId): an org the
+ * anonymous caller was never invited to. The admin is used purely to OBSERVE whether an
+ * uninvited user record materialized inside their org (getOne({ email }) is org-scoped and
+ * throws when the email is absent from the caller's tenant).
+ *
+ * Expected results:
+ *   - VULNERABLE code: the assertions FAIL — the planted user appears inside the victim org,
+ *     proving the exploit ("EXPLOIT CONFIRMED" in the failure message).
+ *   - FIXED code: register ignores the caller-supplied businessId (self-signups are created
+ *     org-less and duplicates are rejected globally), so nothing appears in the victim org and
+ *     the assertions PASS.
+ *
+ * Uses unique emails per run (Date.now()) so re-runs never collide on the platform-wide unique
+ * email constraint. NOTE: on the FIXED path these registrations create org-less user records
+ * that an org-scoped admin cannot delete — harmless residue (unique emails), inherent to the
+ * legitimate "root register, no org" signup behavior.
+ */
+export const register_business_id_injection_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("register businessId injection")
+
+  const victimBusinessId = sdk.userInfo.businessId
+  const password = 'testpassword123!'
+  const termsVersion = '1'
+
+  // ==================================================================================
+  // Scenario 1 — uninvited org join
+  // An anonymous caller registers with businessId set to the victim org. On vulnerable
+  // code this creates a Business user INSIDE the victim org that no one invited.
+  // ==================================================================================
+  const email1 = `security+reg-inject-${Date.now()}@wearehackerone.com`
+
+  const before = await sdk.api.users.getOne({ email: email1 }).catch(() => null)
+  assert(before === null, `precondition failed: ${email1} already present in victim org`, 'precondition: victim org has no such user')
+
+  const res1 = await post('/v1/users/register', { email: email1, password, termsVersion, businessId: victimBusinessId })
+  console.log(`   register(businessId=victim) -> HTTP ${res1.status}`)
+
+  const planted1: any = await sdk.api.users.getOne({ email: email1 }).catch(() => null)
+  const injectedIntoVictimOrg = !!planted1 && planted1.businessId === victimBusinessId
+
+  // Clean up BEFORE asserting (a failed assert calls process.exit(1) and would skip cleanup).
+  if (planted1?.id) await sdk.api.users.deleteOne(planted1.id).catch(() => {})
+
+  assert(
+    !injectedIntoVictimOrg,
+    `❌ EXPLOIT CONFIRMED: anonymous POST /v1/users/register with businessId=${victimBusinessId} created user `
+      + `${email1} (accountType=${planted1?.accountType}) inside the victim org — no invite required`,
+    '✅ register ignores caller-supplied businessId — no user injected into victim org',
+  )
+
+  await wait(undefined, 1200) // register endpoint rate-limits ~1/sec per IP
+
+  // ==================================================================================
+  // Scenario 2 — cross-org duplicate for the same email
+  // First register with NO businessId (the legitimate "root register, no org" record —
+  // the "oldest" account in the report). Then register the SAME email WITH the victim
+  // businessId. On vulnerable code the scoped duplicate check misses the org-less record,
+  // so a SECOND user record for the same email is created inside the victim org.
+  // ==================================================================================
+  const email2 = `security+reg-dup-${Date.now()}@wearehackerone.com`
+
+  const resRoot = await post('/v1/users/register', { email: email2, password, termsVersion })
+  console.log(`   register(no businessId) -> HTTP ${resRoot.status}`)
+
+  await wait(undefined, 1200)
+
+  const resDup = await post('/v1/users/register', { email: email2, password, termsVersion, businessId: victimBusinessId })
+  console.log(`   register(same email, businessId=victim) -> HTTP ${resDup.status}`)
+
+  const planted2: any = await sdk.api.users.getOne({ email: email2 }).catch(() => null)
+  const duplicateInVictimOrg = !!planted2 && planted2.businessId === victimBusinessId
+
+  if (planted2?.id) await sdk.api.users.deleteOne(planted2.id).catch(() => {})
+
+  assert(
+    !duplicateInVictimOrg,
+    `❌ EXPLOIT CONFIRMED: same email ${email2} registered into a second org — duplicate user `
+      + `(accountType=${planted2?.accountType}) created in victim org ${victimBusinessId}`,
+    '✅ register enforces global email uniqueness — no cross-org duplicate created',
+  )
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await register_business_id_injection_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ register businessId injection test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ register businessId injection test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/tests.ts

@@ -53,6 +53,7 @@ import { appointment_rescheduled_trigger_tests } from "./api_tests/appointment_r
 import { appointment_no_showed_trigger_tests } from "./api_tests/appointment_no_showed_trigger.test"
 import { group_event_attendee_status_triggers_tests } from "./api_tests/group_event_attendee_status_triggers.test"
 import { journey_error_branching_tests } from "./api_tests/journey_error_branching.test"
+import { journey_delete_cancels_actions_tests } from "./api_tests/journey_delete_cancels_actions.test"
 import { afteraction_day_of_month_delay_tests } from "./api_tests/afteraction_day_of_month_delay.test"
 import { push_forms_to_portal_group_completion_tests } from "./api_tests/push_forms_to_portal_group_completion.test"
 import { setup_tests } from "./setup"
@@ -102,6 +103,7 @@ import { ai_conversations_rbac_tests } from "./api_tests/security/F-0005-ai-conv
 import { cascade_role_rename_cross_tenant_tests } from "./api_tests/security/F-0053-cascade-role-rename-cross-tenant.test";
 import { self_admin_role_assignment_tests } from "./api_tests/security/F-0076-self-admin-role-assignment.test";
 import { invite_user_enumeration_tests } from "./api_tests/security/F-0007-invite-user-enumeration.test";
+import { register_business_id_injection_tests } from "./api_tests/security/register_business_id_injection.test";
 import { handle_incoming_communication_cross_tenant_tests } from "./api_tests/security/F-0008-handle-incoming-communication-cross-tenant.test";
 import { sanitize_user_html_xss_tests } from "./api_tests/security/F-0013-sanitize-user-html.test";
 import { prototype_pollution_tests } from "./api_tests/security/F-0016-prototype-pollution.test";
@@ -15036,6 +15038,8 @@ const ip_address_form_tests = async () => {
     await replace_form_field_template_values_tests()
     await mfa_tests()
     await setup_tests(sdk, sdkNonAdmin)
+    await custom_dashboards_tests({ sdk, sdkNonAdmin })
+    await register_business_id_injection_tests({ sdk, sdkNonAdmin })
     await automation_trigger_tests()
     await resource_access_tags_tests({ sdk, sdkNonAdmin })
     await beluga_manual_sync_tests({ sdk, sdkNonAdmin })
@@ -15088,7 +15092,6 @@ const ip_address_form_tests = async () => {
     await calendar_event_limits_tests({ sdk, sdkNonAdmin })
     await get_some_projection_tests({ sdk, sdkNonAdmin })
     await elation_user_id_tests({ sdk, sdkNonAdmin })
-    await custom_dashboards_tests({ sdk, sdkNonAdmin })
     await concurrent_build_threads_tests({ sdk, sdkNonAdmin })
     await custom_aggregation_tests({ sdk, sdkNonAdmin })
     await no_access_permission_checks_tests({ sdk, sdkNonAdmin })
@@ -15111,6 +15114,7 @@ const ip_address_form_tests = async () => {
     await test_ticket_automation_assignment_and_optimization()
     await monthly_availability_restrictions_tests({ sdk, sdkNonAdmin })
     await journey_error_branching_tests({ sdk, sdkNonAdmin })
+    await journey_delete_cancels_actions_tests({ sdk, sdkNonAdmin })
     await message_assignment_trigger_tests({ sdk })
     await inbox_threads_building_tests()
     await inbox_threads_loading_tests()