@tellescope/sdk 1.255.7 → 1.255.9

package/src/tests/api_tests/custom_dashboards.test.ts

@@ -4,6 +4,7 @@ import { Session } from "../../sdk"
 import {
   async_test,
   log_header,
+  wait,
 } from "@tellescope/testing"
 import { setup_tests } from "../setup"
 
@@ -199,6 +200,56 @@ export const custom_dashboards_tests = async ({ sdk, sdkNonAdmin }: { sdk: Sessi
     }
   )
 
+  // Test 6b: Create dashboard with every built-in block type (legacy renderer set)
+  const dashboardWithBuiltInTypes = await sdk.api.custom_dashboards.createOne({
+    title: "Built-In Block Types Dashboard",
+    blocks: [
+      { type: "Inbox" },
+      { type: "Tickets" },
+      { type: "Team Chats" },
+      { type: "Upcoming Events" },
+      { type: "To-Dos" },
+      { type: "Database", info: { databaseId: "60398b0231a295e64f084fd9" } },
+    ],
+  })
+
+  await async_test(
+    "Dashboard with all built-in block types created correctly",
+    async () => dashboardWithBuiltInTypes,
+    {
+      onResult: r => (
+        r.blocks.length === 6
+        && r.blocks[0].type === "Inbox"
+        && r.blocks[1].type === "Tickets"
+        && r.blocks[2].type === "Team Chats"
+        && r.blocks[3].type === "Upcoming Events"
+        && r.blocks[4].type === "To-Dos"
+        && r.blocks[5].type === "Database"
+        && r.blocks[5].info !== undefined && r.blocks[5].info.databaseId === "60398b0231a295e64f084fd9"
+      )
+    }
+  )
+
+  // Test 6c: Unknown top-level block fields are stripped on save (params belong in info)
+  const dashboardWithUnknownBlockField = await sdk.api.custom_dashboards.createOne({
+    title: "Unknown Block Field Dashboard",
+    blocks: [
+      { type: "Inbox", customTopLevel: "x", info: { kept: true } } as any,
+    ],
+  })
+
+  await async_test(
+    "Unknown top-level block fields stripped, info preserved",
+    async () => dashboardWithUnknownBlockField,
+    {
+      onResult: r => (
+        r.blocks.length === 1
+        && (r.blocks[0] as any).customTopLevel === undefined
+        && r.blocks[0].info !== undefined && r.blocks[0].info.kept === true
+      )
+    }
+  )
+
   // Test 7: Update gridConfig only
   const updatedGridConfig = await sdk.api.custom_dashboards.updateOne(dashboardWithNewTypes.id, {
     gridConfig: { columns: 24, gap: 8 },
@@ -215,6 +266,67 @@ export const custom_dashboards_tests = async ({ sdk, sdkNonAdmin }: { sdk: Sessi
     }
   )
 
+  // Test 7b: Create dashboard with top-level type field
+  const typedDashboard = await sdk.api.custom_dashboards.createOne({
+    title: "Typed Dashboard",
+    type: "home",
+    blocks: [{ type: "Inbox", colSpan: 12 }],
+  })
+
+  await async_test(
+    "Dashboard with top-level type created correctly",
+    async () => typedDashboard,
+    { onResult: r => r.type === "home" }
+  )
+
+  // Test 7c: Dashboards without type still work (backwards compatibility)
+  await async_test(
+    "Dashboard without type has undefined type",
+    async () => sdk.api.custom_dashboards.getOne(basicDashboard.id),
+    { onResult: r => r.type === undefined }
+  )
+
+  // Test 7d: Update top-level type
+  const updatedType = await sdk.api.custom_dashboards.updateOne(typedDashboard.id, {
+    type: "clinical",
+  })
+
+  await async_test(
+    "Dashboard type updated correctly",
+    async () => updatedType,
+    { onResult: r => r.type === "clinical" }
+  )
+
+  // Test 7e: Filter dashboards by type
+  const secondTypedDashboard = await sdk.api.custom_dashboards.createOne({
+    title: "Second Typed Dashboard",
+    type: "clinical",
+    blocks: [{ type: "Tickets", colSpan: 12 }],
+  })
+
+  await async_test(
+    "Dashboards filtered by type via filter",
+    async () => sdk.api.custom_dashboards.getSome({ filter: { type: "clinical" } }),
+    {
+      onResult: r => (
+        r.length === 2
+        && r.every(d => d.type === "clinical")
+      )
+    }
+  )
+
+  // Test 7f: Filter dashboards by type via mdbFilter
+  await async_test(
+    "Dashboards filtered by type via mdbFilter",
+    async () => sdk.api.custom_dashboards.getSome({ mdbFilter: { type: "clinical" } }),
+    {
+      onResult: r => (
+        r.length === 2
+        && r.every(d => d.type === "clinical")
+      )
+    }
+  )
+
   // Test 8: Non-admin can read all dashboards by default
   const nonAdminList = await sdkNonAdmin.api.custom_dashboards.getSome({ filter: {} })
 
@@ -224,14 +336,110 @@ export const custom_dashboards_tests = async ({ sdk, sdkNonAdmin }: { sdk: Sessi
     { onResult: r => r.length >= 2 }
   )
 
+  // Test 9: visibleToAllUsers grants org-wide access to users without full read access
+  const restrictedRole = await sdk.api.role_based_access_permissions.createOne({
+    role: 'Dashboard Default Access',
+    permissions: {
+      custom_dashboards: { read: 'Default', create: null, update: null, delete: null },
+    },
+  })
+
+  const restrictedUserEmail = 'dashboard.restricted.test@tellescope.com'
+  let restrictedUser = await sdk.api.users.getOne({ email: restrictedUserEmail }).catch(() => null) // throws error on none found
+  if (restrictedUser && !restrictedUser.verifiedEmail) { // verifiedEmail can only be set on create, so recreate stale users
+    await sdk.api.users.deleteOne(restrictedUser.id)
+    restrictedUser = null
+  }
+  if (!restrictedUser) {
+    restrictedUser = await sdk.api.users.createOne({ email: restrictedUserEmail, notificationEmailsDisabled: true, verifiedEmail: true })
+  }
+  // ensure role is set, in case GET returned a user without a role or with a different role
+  await sdk.api.users.updateOne(restrictedUser.id, { roles: [restrictedRole.role] }, { replaceObjectFields: true })
+  await wait(undefined, 2000) // role change triggers a logout
+
+  const sdkRestricted = new Session({
+    host,
+    authToken: (await sdk.api.users.generate_auth_token({ id: restrictedUser.id })).authToken,
+  })
+  await async_test('test_authenticated (restricted dashboard user)', sdkRestricted.test_authenticated, { expectedResult: 'Authenticated!' })
+
+  const hiddenDashboard = await sdk.api.custom_dashboards.createOne({
+    title: "Hidden From Restricted",
+    blocks: [{ type: "Inbox", colSpan: 12 }],
+  })
+  const orgWideDashboard = await sdk.api.custom_dashboards.createOne({
+    title: "Org-Wide Dashboard",
+    visibleToAllUsers: true,
+    blocks: [{ type: "Inbox", colSpan: 12 }],
+  })
+  const explicitFalseDashboard = await sdk.api.custom_dashboards.createOne({
+    title: "Explicit False Dashboard",
+    visibleToAllUsers: false,
+    blocks: [{ type: "Inbox", colSpan: 12 }],
+  })
+  const assignedDashboard = await sdk.api.custom_dashboards.createOne({
+    title: "Assigned To Restricted",
+    userIds: [restrictedUser.id],
+    blocks: [{ type: "Inbox", colSpan: 12 }],
+  })
+
+  await async_test(
+    "Restricted user sees org-wide and assigned dashboards only",
+    () => sdkRestricted.api.custom_dashboards.getSome({ filter: {} }),
+    {
+      onResult: r => (
+        !!r.find(d => d.id === orgWideDashboard.id)
+        && !!r.find(d => d.id === assignedDashboard.id)
+        && !r.find(d => d.id === hiddenDashboard.id)
+        && !r.find(d => d.id === explicitFalseDashboard.id)
+      )
+    }
+  )
+
+  await async_test(
+    "Restricted user can read org-wide dashboard by id",
+    () => sdkRestricted.api.custom_dashboards.getOne(orgWideDashboard.id),
+    { onResult: r => r.id === orgWideDashboard.id && r.visibleToAllUsers === true }
+  )
+
+  await async_test(
+    "Restricted user cannot read unshared dashboard by id",
+    () => sdkRestricted.api.custom_dashboards.getOne(hiddenDashboard.id),
+    { shouldError: true, onError: () => true }
+  )
+
+  // Toggling the flag on takes effect for the restricted user
+  await sdk.api.custom_dashboards.updateOne(hiddenDashboard.id, { visibleToAllUsers: true })
+
+  await async_test(
+    "Restricted user can read dashboard after visibleToAllUsers enabled",
+    () => sdkRestricted.api.custom_dashboards.getOne(hiddenDashboard.id),
+    { onResult: r => r.id === hiddenDashboard.id }
+  )
+
+  // Admin continues to see everything, including unshared dashboards
+  await async_test(
+    "Admin still sees explicit-false dashboard",
+    () => sdk.api.custom_dashboards.getOne(explicitFalseDashboard.id),
+    { onResult: r => r.id === explicitFalseDashboard.id }
+  )
+
   // Cleanup
   await Promise.all([
+    sdk.api.custom_dashboards.deleteOne(hiddenDashboard.id),
+    sdk.api.custom_dashboards.deleteOne(orgWideDashboard.id),
+    sdk.api.custom_dashboards.deleteOne(explicitFalseDashboard.id),
+    sdk.api.custom_dashboards.deleteOne(assignedDashboard.id),
     sdk.api.custom_dashboards.deleteOne(basicDashboard.id),
     sdk.api.custom_dashboards.deleteOne(duplicateTitleDashboard.id),
     sdk.api.custom_dashboards.deleteOne(fullDashboard.id),
     sdk.api.custom_dashboards.deleteOne(dashboardWithUserIds.id),
     sdk.api.custom_dashboards.deleteOne(dashboardWithNewTypes.id),
     sdk.api.custom_dashboards.deleteOne(dashboardWithComplexBlocks.id),
+    sdk.api.custom_dashboards.deleteOne(dashboardWithBuiltInTypes.id),
+    sdk.api.custom_dashboards.deleteOne(dashboardWithUnknownBlockField.id),
+    sdk.api.custom_dashboards.deleteOne(typedDashboard.id),
+    sdk.api.custom_dashboards.deleteOne(secondTypedDashboard.id),
   ])
 }
 

package/src/tests/api_tests/webhook_error_handling.test.ts

@@ -0,0 +1,190 @@
+require('source-map-support').install();
+
+import express from "express"
+import bodyParser from "body-parser"
+import crypto from "crypto"
+import http from "http"
+
+import { Session } from "../../sdk"
+import {
+  assert,
+  async_test,
+  log_header,
+  wait,
+} from "@tellescope/testing"
+import { setup_tests } from "../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const TEST_SECRET = "this is a test secret for verifying integrity of web hooks"
+const sha256 = (s: string) => crypto.createHash('sha256').update(s).digest('hex')
+
+// DNS resolution for the reserved .invalid TLD always fails => axios ENOTFOUND (no err.response)
+const ENOTFOUND_URL = `http://webhook-error-handling-test.invalid/hook`
+
+const POLL_TIMEOUT_MS = 10_000
+const POLL_INTERVAL_MS = 500
+
+const find_log_for_url = async (sdk: Session, url: string) => {
+  const start = Date.now()
+  while (Date.now() - start < POLL_TIMEOUT_MS) {
+    const logs = await sdk.api.webhook_logs.getSome({ limit: 50, sort: 'newFirst' as any }) as Array<any>
+    const match = logs.find(l => l.url === url)
+    if (match) return match
+    await wait(undefined, POLL_INTERVAL_MS)
+  }
+  return null
+}
+
+const get_failure_count = async (sdk: Session) => {
+  const configs = await sdk.api.webhooks.getSome() as Array<any>
+  return (configs[0]?.deliveryFailureCount ?? 0) as number
+}
+
+// the $inc on the webhook config is fire-and-forget — poll until it lands
+const wait_for_failure_count = async (sdk: Session, expected: number) => {
+  const start = Date.now()
+  let count = -1
+  while (Date.now() - start < POLL_TIMEOUT_MS) {
+    count = await get_failure_count(sdk)
+    if (count === expected) return count
+    await wait(undefined, POLL_INTERVAL_MS)
+  }
+  return count
+}
+
+// Main test function that can be called independently
+export const webhook_error_handling_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("Webhook Error Handling Tests")
+
+  // local receiver: error paths for failure scenarios, a healthy path that verifies integrity
+  const app = express()
+  app.use(bodyParser.json({ limit: '25mb' }))
+
+  let successIntegrityVerified = false
+  app.post('/fail-400', (_, res) => { res.status(400).json({ error: 'bad request' }) })
+  app.post('/fail-500', (_, res) => { res.status(500).json({ error: 'server error' }) })
+  app.post('/success', (req, res) => {
+    const { records, timestamp, integrity } = req.body
+    successIntegrityVerified = (
+      sha256((records ?? []).map((r: { id: string }) => r.id).join('') + timestamp + TEST_SECRET) === integrity
+    )
+    res.status(200).json({})
+  })
+
+  const server: http.Server = await new Promise(resolve => {
+    const s = app.listen(0, '127.0.0.1', () => resolve(s))
+  })
+  const receiverBase = `http://127.0.0.1:${(server.address() as any).port}`
+
+  const enduserIds: string[] = []
+  const trigger_delivery = async (label: string) => {
+    const enduser = await sdk.api.endusers.createOne({ email: `webhook-error-${label}-${Date.now()}@tellescope.com` })
+    enduserIds.push(enduser.id)
+  }
+
+  try {
+    await async_test(
+      'configure webhook',
+      () => sdk.api.webhooks.configure({ url: ENOTFOUND_URL, secret: TEST_SECRET }),
+      { shouldError: false, onResult: () => true },
+    )
+    await sdk.api.webhooks.update({ subscriptionUpdates: { endusers: { create: true, update: false, delete: false } } })
+
+    const initialCount = await get_failure_count(sdk)
+
+    // Scenario 1: ENOTFOUND — no HTTP response at all
+    await trigger_delivery('enotfound')
+    const enotfoundLog = await find_log_for_url(sdk, ENOTFOUND_URL)
+    assert(!!enotfoundLog, 'no webhook_logs entry for ENOTFOUND delivery', 'ENOTFOUND failure logged to webhook_logs')
+    assert(
+      typeof enotfoundLog?.response === 'string' && enotfoundLog.response.length > 0,
+      `expected string error message response, got: ${JSON.stringify(enotfoundLog?.response)}`,
+      'ENOTFOUND log has error message as response'
+    )
+    assert(enotfoundLog?.responseCode === undefined, 'unexpected responseCode for ENOTFOUND', 'ENOTFOUND log has no responseCode')
+    assert(
+      await wait_for_failure_count(sdk, initialCount + 1) === initialCount + 1,
+      'deliveryFailureCount not incremented after ENOTFOUND',
+      'deliveryFailureCount incremented after ENOTFOUND'
+    )
+
+    // Scenario 2a: HTTP 400 from the receiver
+    await sdk.api.webhooks.update({ url: `${receiverBase}/fail-400` })
+    await trigger_delivery('http400')
+    const log400 = await find_log_for_url(sdk, `${receiverBase}/fail-400`)
+    assert(log400?.responseCode === 400, `expected responseCode 400, got ${log400?.responseCode}`, 'HTTP 400 responseCode recorded')
+    assert(
+      await wait_for_failure_count(sdk, initialCount + 2) === initialCount + 2,
+      'deliveryFailureCount not incremented after HTTP 400',
+      'deliveryFailureCount incremented after HTTP 400'
+    )
+
+    // Scenario 2b: HTTP 500 from the receiver
+    await sdk.api.webhooks.update({ url: `${receiverBase}/fail-500` })
+    await trigger_delivery('http500')
+    const log500 = await find_log_for_url(sdk, `${receiverBase}/fail-500`)
+    assert(log500?.responseCode === 500, `expected responseCode 500, got ${log500?.responseCode}`, 'HTTP 500 responseCode recorded')
+    assert(
+      await wait_for_failure_count(sdk, initialCount + 3) === initialCount + 3,
+      'deliveryFailureCount not incremented after HTTP 500',
+      'deliveryFailureCount incremented after HTTP 500'
+    )
+
+    // Scenario 3 (timeout): skipped — WEBHOOK_TIMEOUT_MS is a constant (15s), not env-overridable,
+    // and a 15s+ non-responding receiver would make this suite unacceptably slow.
+    // Covered by security/F-0155-webhook-timeout.test.ts via send_automation_webhook.
+
+    // Scenario 4: success path unchanged — 200 logged, counter untouched
+    await sdk.api.webhooks.update({ url: `${receiverBase}/success` })
+    await trigger_delivery('success')
+    const successLog = await find_log_for_url(sdk, `${receiverBase}/success`)
+    assert(successLog?.responseCode === 200, `expected responseCode 200, got ${successLog?.responseCode}`, 'success responseCode recorded')
+    assert(successIntegrityVerified, 'integrity check failed on success delivery', 'success delivery integrity verified')
+    await wait(undefined, 1000) // allow any (erroneous) counter update to land before checking
+    assert(
+      await get_failure_count(sdk) === initialCount + 3,
+      'deliveryFailureCount changed on successful delivery',
+      'deliveryFailureCount untouched on success'
+    )
+
+    // deliveryFailureCount is server-managed: not settable through the public update endpoint
+    const configs = await sdk.api.webhooks.getSome() as Array<any>
+    const webhookId = configs[0]?.id
+    await sdk.api.webhooks.updateOne(webhookId, { deliveryFailureCount: 9999 } as any).catch(() => {}) // may reject (readonly)
+    assert(
+      await get_failure_count(sdk) === initialCount + 3,
+      'customer was able to overwrite deliveryFailureCount',
+      'deliveryFailureCount not customer-settable'
+    )
+  } finally {
+    // stop deliveries for subsequent tests and shut down the local receiver
+    await sdk.api.webhooks.update({ subscriptionUpdates: { endusers: { create: false, update: false, delete: false } } }).catch(() => {})
+    server.close()
+    for (const id of enduserIds) {
+      try { await sdk.api.endusers.deleteOne(id) } catch {}
+    }
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await webhook_error_handling_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ Webhook error handling test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Webhook error handling test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/tests.ts

@@ -136,6 +136,7 @@ import { date_string_validation_tests } from "./api_tests/date_string_validation
 import { enduser_session_invalidation_tests } from "./api_tests/enduser_session_invalidation.test";
 import { enduser_cross_access_isolation_tests } from "./api_tests/enduser_cross_access_isolation.test";
 import { calendar_event_webhook_template_tests } from "./api_tests/calendar_event_webhook_template.test";
+import { webhook_error_handling_tests } from "./api_tests/webhook_error_handling.test";
 
 const UniquenessViolationMessage = 'Uniqueness Violation'
 
@@ -15038,6 +15039,7 @@ const ip_address_form_tests = async () => {
     await replace_form_field_template_values_tests()
     await mfa_tests()
     await setup_tests(sdk, sdkNonAdmin)
+    await custom_dashboards_tests({ sdk, sdkNonAdmin })
     await register_business_id_injection_tests({ sdk, sdkNonAdmin })
     await automation_trigger_tests()
     await resource_access_tags_tests({ sdk, sdkNonAdmin })
@@ -15053,6 +15055,7 @@ const ip_address_form_tests = async () => {
     await invite_user_enumeration_tests({ sdk, sdkNonAdmin })
     await handle_incoming_communication_cross_tenant_tests({ sdk, sdkNonAdmin })
     await calendar_event_webhook_template_tests({ sdk, sdkNonAdmin })
+    await webhook_error_handling_tests({ sdk, sdkNonAdmin })
     await outbound_chat_sent_trigger_tests({ sdk })
     await enduser_login_rate_limits_tests({ sdk, sdkNonAdmin })
     await data_sync_redaction_bypass_tests({ sdk, sdkNonAdmin })
@@ -15091,7 +15094,6 @@ const ip_address_form_tests = async () => {
     await calendar_event_limits_tests({ sdk, sdkNonAdmin })
     await get_some_projection_tests({ sdk, sdkNonAdmin })
     await elation_user_id_tests({ sdk, sdkNonAdmin })
-    await custom_dashboards_tests({ sdk, sdkNonAdmin })
     await concurrent_build_threads_tests({ sdk, sdkNonAdmin })
     await custom_aggregation_tests({ sdk, sdkNonAdmin })
     await no_access_permission_checks_tests({ sdk, sdkNonAdmin })