@tellescope/sdk 1.255.8 → 1.255.10

package/src/tests/api_tests/webhook_error_handling.test.ts

@@ -0,0 +1,190 @@
+require('source-map-support').install();
+
+import express from "express"
+import bodyParser from "body-parser"
+import crypto from "crypto"
+import http from "http"
+
+import { Session } from "../../sdk"
+import {
+  assert,
+  async_test,
+  log_header,
+  wait,
+} from "@tellescope/testing"
+import { setup_tests } from "../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const TEST_SECRET = "this is a test secret for verifying integrity of web hooks"
+const sha256 = (s: string) => crypto.createHash('sha256').update(s).digest('hex')
+
+// DNS resolution for the reserved .invalid TLD always fails => axios ENOTFOUND (no err.response)
+const ENOTFOUND_URL = `http://webhook-error-handling-test.invalid/hook`
+
+const POLL_TIMEOUT_MS = 10_000
+const POLL_INTERVAL_MS = 500
+
+const find_log_for_url = async (sdk: Session, url: string) => {
+  const start = Date.now()
+  while (Date.now() - start < POLL_TIMEOUT_MS) {
+    const logs = await sdk.api.webhook_logs.getSome({ limit: 50, sort: 'newFirst' as any }) as Array<any>
+    const match = logs.find(l => l.url === url)
+    if (match) return match
+    await wait(undefined, POLL_INTERVAL_MS)
+  }
+  return null
+}
+
+const get_failure_count = async (sdk: Session) => {
+  const configs = await sdk.api.webhooks.getSome() as Array<any>
+  return (configs[0]?.deliveryFailureCount ?? 0) as number
+}
+
+// the $inc on the webhook config is fire-and-forget — poll until it lands
+const wait_for_failure_count = async (sdk: Session, expected: number) => {
+  const start = Date.now()
+  let count = -1
+  while (Date.now() - start < POLL_TIMEOUT_MS) {
+    count = await get_failure_count(sdk)
+    if (count === expected) return count
+    await wait(undefined, POLL_INTERVAL_MS)
+  }
+  return count
+}
+
+// Main test function that can be called independently
+export const webhook_error_handling_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("Webhook Error Handling Tests")
+
+  // local receiver: error paths for failure scenarios, a healthy path that verifies integrity
+  const app = express()
+  app.use(bodyParser.json({ limit: '25mb' }))
+
+  let successIntegrityVerified = false
+  app.post('/fail-400', (_, res) => { res.status(400).json({ error: 'bad request' }) })
+  app.post('/fail-500', (_, res) => { res.status(500).json({ error: 'server error' }) })
+  app.post('/success', (req, res) => {
+    const { records, timestamp, integrity } = req.body
+    successIntegrityVerified = (
+      sha256((records ?? []).map((r: { id: string }) => r.id).join('') + timestamp + TEST_SECRET) === integrity
+    )
+    res.status(200).json({})
+  })
+
+  const server: http.Server = await new Promise(resolve => {
+    const s = app.listen(0, '127.0.0.1', () => resolve(s))
+  })
+  const receiverBase = `http://127.0.0.1:${(server.address() as any).port}`
+
+  const enduserIds: string[] = []
+  const trigger_delivery = async (label: string) => {
+    const enduser = await sdk.api.endusers.createOne({ email: `webhook-error-${label}-${Date.now()}@tellescope.com` })
+    enduserIds.push(enduser.id)
+  }
+
+  try {
+    await async_test(
+      'configure webhook',
+      () => sdk.api.webhooks.configure({ url: ENOTFOUND_URL, secret: TEST_SECRET }),
+      { shouldError: false, onResult: () => true },
+    )
+    await sdk.api.webhooks.update({ subscriptionUpdates: { endusers: { create: true, update: false, delete: false } } })
+
+    const initialCount = await get_failure_count(sdk)
+
+    // Scenario 1: ENOTFOUND — no HTTP response at all
+    await trigger_delivery('enotfound')
+    const enotfoundLog = await find_log_for_url(sdk, ENOTFOUND_URL)
+    assert(!!enotfoundLog, 'no webhook_logs entry for ENOTFOUND delivery', 'ENOTFOUND failure logged to webhook_logs')
+    assert(
+      typeof enotfoundLog?.response === 'string' && enotfoundLog.response.length > 0,
+      `expected string error message response, got: ${JSON.stringify(enotfoundLog?.response)}`,
+      'ENOTFOUND log has error message as response'
+    )
+    assert(enotfoundLog?.responseCode === undefined, 'unexpected responseCode for ENOTFOUND', 'ENOTFOUND log has no responseCode')
+    assert(
+      await wait_for_failure_count(sdk, initialCount + 1) === initialCount + 1,
+      'deliveryFailureCount not incremented after ENOTFOUND',
+      'deliveryFailureCount incremented after ENOTFOUND'
+    )
+
+    // Scenario 2a: HTTP 400 from the receiver
+    await sdk.api.webhooks.update({ url: `${receiverBase}/fail-400` })
+    await trigger_delivery('http400')
+    const log400 = await find_log_for_url(sdk, `${receiverBase}/fail-400`)
+    assert(log400?.responseCode === 400, `expected responseCode 400, got ${log400?.responseCode}`, 'HTTP 400 responseCode recorded')
+    assert(
+      await wait_for_failure_count(sdk, initialCount + 2) === initialCount + 2,
+      'deliveryFailureCount not incremented after HTTP 400',
+      'deliveryFailureCount incremented after HTTP 400'
+    )
+
+    // Scenario 2b: HTTP 500 from the receiver
+    await sdk.api.webhooks.update({ url: `${receiverBase}/fail-500` })
+    await trigger_delivery('http500')
+    const log500 = await find_log_for_url(sdk, `${receiverBase}/fail-500`)
+    assert(log500?.responseCode === 500, `expected responseCode 500, got ${log500?.responseCode}`, 'HTTP 500 responseCode recorded')
+    assert(
+      await wait_for_failure_count(sdk, initialCount + 3) === initialCount + 3,
+      'deliveryFailureCount not incremented after HTTP 500',
+      'deliveryFailureCount incremented after HTTP 500'
+    )
+
+    // Scenario 3 (timeout): skipped — WEBHOOK_TIMEOUT_MS is a constant (15s), not env-overridable,
+    // and a 15s+ non-responding receiver would make this suite unacceptably slow.
+    // Covered by security/F-0155-webhook-timeout.test.ts via send_automation_webhook.
+
+    // Scenario 4: success path unchanged — 200 logged, counter untouched
+    await sdk.api.webhooks.update({ url: `${receiverBase}/success` })
+    await trigger_delivery('success')
+    const successLog = await find_log_for_url(sdk, `${receiverBase}/success`)
+    assert(successLog?.responseCode === 200, `expected responseCode 200, got ${successLog?.responseCode}`, 'success responseCode recorded')
+    assert(successIntegrityVerified, 'integrity check failed on success delivery', 'success delivery integrity verified')
+    await wait(undefined, 1000) // allow any (erroneous) counter update to land before checking
+    assert(
+      await get_failure_count(sdk) === initialCount + 3,
+      'deliveryFailureCount changed on successful delivery',
+      'deliveryFailureCount untouched on success'
+    )
+
+    // deliveryFailureCount is server-managed: not settable through the public update endpoint
+    const configs = await sdk.api.webhooks.getSome() as Array<any>
+    const webhookId = configs[0]?.id
+    await sdk.api.webhooks.updateOne(webhookId, { deliveryFailureCount: 9999 } as any).catch(() => {}) // may reject (readonly)
+    assert(
+      await get_failure_count(sdk) === initialCount + 3,
+      'customer was able to overwrite deliveryFailureCount',
+      'deliveryFailureCount not customer-settable'
+    )
+  } finally {
+    // stop deliveries for subsequent tests and shut down the local receiver
+    await sdk.api.webhooks.update({ subscriptionUpdates: { endusers: { create: false, update: false, delete: false } } }).catch(() => {})
+    server.close()
+    for (const id of enduserIds) {
+      try { await sdk.api.endusers.deleteOne(id) } catch {}
+    }
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await webhook_error_handling_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ Webhook error handling test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Webhook error handling test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/setup.ts

@@ -159,4 +159,17 @@ export const setup_tests = async (sdk: Session, sdkNonAdmin: Session) => {
     sdk.api.users.updateOne(sdk.userInfo.id, { notificationEmailsDisabled: true }),
     sdk.api.users.updateOne(sdkNonAdmin.userInfo.id, { notificationEmailsDisabled: true }),
   ]).catch(console.error)
+}
+
+// Establishes an enduser session WITHOUT hitting the IP-rate-limited /login-enduser endpoint
+// (throttleByIp: 20/min + 100/hr per IP — the full suite shares one IP and can exceed both).
+// Use for test setup; reserve enduserSDK.authenticate for tests OF the login flow itself.
+export const authenticate_enduser_via_token = async (
+  sdk: Session,
+  enduserSDK: EnduserSession,
+  filter: { id?: string, email?: string, externalId?: string },
+) => {
+  const { authToken, enduser } = await sdk.api.endusers.generate_auth_token(filter)
+  await enduserSDK.handle_new_session({ authToken, enduser })
+  return enduser
 }

package/src/tests/tests.ts

@@ -56,7 +56,7 @@ import { journey_error_branching_tests } from "./api_tests/journey_error_branchi
 import { journey_delete_cancels_actions_tests } from "./api_tests/journey_delete_cancels_actions.test"
 import { afteraction_day_of_month_delay_tests } from "./api_tests/afteraction_day_of_month_delay.test"
 import { push_forms_to_portal_group_completion_tests } from "./api_tests/push_forms_to_portal_group_completion.test"
-import { setup_tests } from "./setup"
+import { authenticate_enduser_via_token, setup_tests } from "./setup"
 import { evaluate_conditional_logic_for_enduser_fields, FORM_LOGIC_CALCULATED_FIELDS, get_care_team_primary, get_flattened_fields, get_next_reminder_timestamp, object_is_empty, replace_enduser_template_values, replace_form_field_template_values, responses_satisfy_conditions, truncate_string, weighted_round_robin, YYYY_MM_DD_to_MM_DD_YYYY } from "@tellescope/utilities"
 import { DEFAULT_OPERATIONS, PLACEHOLDER_ID, ZENDESK_INTEGRATIONS_TITLE, ZOOM_TITLE } from "@tellescope/constants"
 import { 
@@ -94,6 +94,7 @@ import { monthly_availability_restrictions_tests } from "./api_tests/monthly_ava
 import { calendar_event_limits_tests } from "./api_tests/calendar_event_limits.test";
 import { custom_aggregation_tests } from "./api_tests/custom_aggregation.test";
 import { chats_analytics_tests } from "./api_tests/chats_analytics.test";
+import { nutrition_tracking_tests } from "./api_tests/nutrition_tracking.test";
 import { no_access_permission_checks_tests } from "./api_tests/no_access_permission_checks.test";
 import { resource_access_tags_tests } from "./api_tests/resource_access_tags.test";
 import { field_redaction_tests } from "./api_tests/field_redaction.test";
@@ -120,6 +121,7 @@ import { ai_conversations_tests } from "./api_tests/ai_conversations.test";
 import { load_team_chat_tests } from "./api_tests/load_team_chat.test";
 import { form_started_trigger_tests } from "./api_tests/form_started_trigger.test";
 import { form_submitted_trigger_tests } from "./api_tests/form_submitted_trigger.test";
+import { dont_sync_to_elation_form_submission_tests } from "./api_tests/dont_sync_to_elation_form_submission.test";
 import { medication_added_trigger_tests } from "./api_tests/medication_added_trigger.test";
 import { conditional_logic_medication_unit_tests } from "./unit_tests/conditional_logic_medication.test";
 import { elation_user_id_tests } from "./api_tests/elation_user_id.test";
@@ -136,6 +138,7 @@ import { date_string_validation_tests } from "./api_tests/date_string_validation
 import { enduser_session_invalidation_tests } from "./api_tests/enduser_session_invalidation.test";
 import { enduser_cross_access_isolation_tests } from "./api_tests/enduser_cross_access_isolation.test";
 import { calendar_event_webhook_template_tests } from "./api_tests/calendar_event_webhook_template.test";
+import { webhook_error_handling_tests } from "./api_tests/webhook_error_handling.test";
 
 const UniquenessViolationMessage = 'Uniqueness Violation'
 
@@ -282,7 +285,7 @@ const sub_organization_tests = async() => {
   await async_test(`subsub get subsub`, () => sdkSubSub.api.endusers.getOne(subSubEnduser.id), passOnAnyResult)
 
   await sdk.api.endusers.set_password({ id: rootEnduser.id, password })
-  await enduserSDK.authenticate(rootEnduser.email!, password)
+  await authenticate_enduser_via_token(sdk, enduserSDK, { id: rootEnduser.id })
   await async_test(
     `root enduser create`, 
     () => enduserSDK.api.engagement_events.createOne({ significance: 1, type: 'test', enduserId: rootEnduser.id }), 
@@ -294,7 +297,7 @@ const sub_organization_tests = async() => {
 
 
   await sdk.api.endusers.set_password({ id: subEnduser.id, password })
-  await enduserSDK.authenticate(subEnduser.email!, password)
+  await authenticate_enduser_via_token(sdk, enduserSDK, { id: subEnduser.id })
   await async_test(
     `sub enduser create`, 
     () => enduserSDK.api.engagement_events.createOne({ significance: 1, type: 'test', enduserId: subEnduser.id }), 
@@ -302,7 +305,7 @@ const sub_organization_tests = async() => {
   )
 
   await sdk.api.endusers.set_password({ id: subSubEnduser.id, password })
-  await enduserSDK.authenticate(subSubEnduser.email!, password)
+  await authenticate_enduser_via_token(sdk, enduserSDK, { id: subSubEnduser.id })
   await async_test(
     `subSub enduser create`, 
     () => enduserSDK.api.engagement_events.createOne({ significance: 1, type: 'test', enduserId: subSubEnduser.id }), 
@@ -826,9 +829,14 @@ const enduser_tests = async (queries=sdk.api.endusers) => {
   )
   await async_test(
     `enduser registered can log in`,
-    () => enduserSDK.authenticate('test3@gmail.com', 'testenduserpassword'), 
+    () => enduserSDK.authenticate('test3@gmail.com', 'testenduserpassword'),
     { onResult: e => !!e.authToken && e.enduser.email === 'test3@gmail.com' },
   )
+  await async_test(
+    `enduser login rejects a wrong password`,
+    () => new EnduserSession({ host, businessId }).authenticate('test3@gmail.com', 'wrong-password'),
+    handleAnyError,
+  )
 
   await async_test(
     `update-enduser email conflict`, 
@@ -1378,7 +1386,7 @@ const chat_tests = async() => {
 
   const enduser = await sdk.api.endusers.createOne({ email })
   await sdk.api.endusers.set_password({ id: enduser.id, password }).catch(console.error)
-  await enduserSDK.authenticate(email, password).catch(console.error)
+  await authenticate_enduser_via_token(sdk, enduserSDK, { id: enduser.id }).catch(console.error)
 
   const room  = await sdk.api.chat_rooms.createOne({ type: 'internal', userIds: [userId] })
   const chat  = await sdk.api.chats.createOne({ roomId: room.id, message: "Hello!" })
@@ -1521,7 +1529,7 @@ const enduserAccessTests = async () => {
   const enduser = await sdk.api.endusers.createOne({ email })
   const enduser2 = await sdk.api.endusers.createOne({ email: 'hi' + email })
   await sdk.api.endusers.set_password({ id: enduser.id, password }).catch(console.error)
-  await enduserSDK.authenticate(email, password).catch(console.error)
+  await authenticate_enduser_via_token(sdk, enduserSDK, { id: enduser.id }).catch(console.error)
 
   await wait(undefined, 1000) // wait so that refresh_session generates a new authToken (different timestamp)
 
@@ -1706,7 +1714,7 @@ const files_tests = async () => {
   log_header("Files")
   const enduser = await sdk.api.endusers.createOne({ email })
   await sdk.api.endusers.set_password({ id: enduser.id, password }).catch(console.error)
-  await enduserSDK.authenticate(email, password).catch(console.error)
+  await authenticate_enduser_via_token(sdk, enduserSDK, { id: enduser.id }).catch(console.error)
   await sdkNonAdmin.authenticate(nonAdminEmail, nonAdminPassword) // to use new role, handle logout on role change
 
   const buff = buffer.Buffer.from('test file data')
@@ -1817,7 +1825,7 @@ const enduser_session_tests = async () => {
 
   const enduser = await sdk.api.endusers.createOne({ email })
   await sdk.api.endusers.set_password({ id: enduser.id, password }).catch(console.error)
-  await enduserSDK.authenticate(email, password).catch(console.error)
+  await authenticate_enduser_via_token(sdk, enduserSDK, { id: enduser.id }).catch(console.error)
 
   const users = await enduserSDK.api.users.display_info()
   assert(users && users.length > 0, 'No users returned', 'Get user display info for enduser')
@@ -5839,7 +5847,7 @@ export const meetings_tests = async () => {
 
   const enduser = await sdk.api.endusers.createOne({ email })
   await sdk.api.endusers.set_password({ id: enduser.id, password }).catch(console.error)
-  await enduserSDK.authenticate(email, password).catch(console.error) 
+  await authenticate_enduser_via_token(sdk, enduserSDK, { id: enduser.id }).catch(console.error)
 
   const privateMeeting = await sdk.api.meetings.start_meeting({ })
   const publicMeeting = await sdk.api.meetings.start_meeting({ publicRead: true })
@@ -6205,7 +6213,7 @@ const community_tests = async () => {
 
   const enduser = await sdk.api.endusers.createOne({ email })
   await sdk.api.endusers.set_password({ id: enduser.id, password }).catch(console.error)
-  await enduserSDK.authenticate(email, password).catch(console.error) 
+  await authenticate_enduser_via_token(sdk, enduserSDK, { id: enduser.id }).catch(console.error)
 
   const forum = await sdk.api.forums.createOne({ title: 'test', publicRead: true })
   const privateForum = await sdk.api.forums.createOne({ title: 'test 2', publicRead: false })
@@ -6352,7 +6360,7 @@ const redaction_tests = async () => {
     unredactedFields: [{ field: 'testField', value: 'testValue' }] as any,
   })
   await sdk.api.endusers.set_password({ id: enduser.id, password }).catch(console.error)
-  await enduserSDK.authenticate(email, password).catch(console.error)
+  await authenticate_enduser_via_token(sdk, enduserSDK, { id: enduser.id }).catch(console.error)
 
   const endusers = await enduserSDK.api.endusers.getSome()
   const forUser  = await sdk.api.endusers.getSome()
@@ -6599,7 +6607,7 @@ export const calendar_event_RSVPs_tests = async () => {
   log_header("Calendar Event RSVPs")
 
   await enduserSDK.register({ email: 'rsvps@tellescope.com', password: "testenduserpassword" })
-  await enduserSDK.authenticate('rsvps@tellescope.com', "testenduserpassword")
+  await authenticate_enduser_via_token(sdk, enduserSDK, { email: 'rsvps@tellescope.com' })
 
   const event = await sdk.api.calendar_events.createOne({
     title: "RSVP Event",
@@ -6684,7 +6692,7 @@ const post_comments_tests = async () => {
   log_header("Post Comments")
 
   await enduserSDK.register({ email: 'rsvps@tellescope.com', password: "testenduserpassword" })
-  await enduserSDK.authenticate('rsvps@tellescope.com', "testenduserpassword")
+  await authenticate_enduser_via_token(sdk, enduserSDK, { email: 'rsvps@tellescope.com' })
 
   const forumId = (await sdk.api.forums.createOne({ title: "RSVP Event", publicRead: true })).id
   const postId = (await sdk.api.forum_posts.createOne({ forumId, title: 'Post', htmlContent: '', textContent: '',  })).id
@@ -6902,13 +6910,13 @@ export const self_serve_appointment_booking_tests = async () => {
   })
 
   const enduserSDK2 = new EnduserSession({ host, businessId })
-  await enduserSDK2.authenticate('sebass+ca@tellescope.com', password).catch(console.error) 
+  await authenticate_enduser_via_token(sdk, enduserSDK2, { email: 'sebass+ca@tellescope.com' }).catch(console.error)
 
   const enduserSDK3 = new EnduserSession({ host, businessId })
-  await enduserSDK3.authenticate('sebass+3@tellescope.com', password).catch(console.error) 
+  await authenticate_enduser_via_token(sdk, enduserSDK3, { email: 'sebass+3@tellescope.com' }).catch(console.error)
 
   // NY Enduser Tests
-  await enduserSDK.authenticate('sebass+ny@tellescope.com', password).catch(console.error) 
+  await authenticate_enduser_via_token(sdk, enduserSDK, { email: 'sebass+ny@tellescope.com' }).catch(console.error)
   await async_test(
     '30 minute slots for state restriction',
     () => enduserSDK.api.calendar_events.get_appointment_availability({
@@ -7569,7 +7577,7 @@ const run_autoreply_test = async (title: string, { expectingAutoreply, autoreply
 
   const enduser = await sdk.api.endusers.createOne({ fname: 'Autoreply', lname: "Test", email: "autoreply@tellescope.com" })
   await sdk.api.endusers.set_password({ id: enduser.id, password })
-  await enduserSDK.authenticate(enduser.email!, password)
+  await authenticate_enduser_via_token(sdk, enduserSDK, { id: enduser.id })
 
   const room = await sdk.api.chat_rooms.createOne({ 
     userIds: [sdk.userInfo.id],
@@ -15054,6 +15062,7 @@ const ip_address_form_tests = async () => {
     await invite_user_enumeration_tests({ sdk, sdkNonAdmin })
     await handle_incoming_communication_cross_tenant_tests({ sdk, sdkNonAdmin })
     await calendar_event_webhook_template_tests({ sdk, sdkNonAdmin })
+    await webhook_error_handling_tests({ sdk, sdkNonAdmin })
     await outbound_chat_sent_trigger_tests({ sdk })
     await enduser_login_rate_limits_tests({ sdk, sdkNonAdmin })
     await data_sync_redaction_bypass_tests({ sdk, sdkNonAdmin })
@@ -15074,6 +15083,7 @@ const ip_address_form_tests = async () => {
     await chats_analytics_tests({ sdk, sdkNonAdmin })
     await field_redaction_tests({ sdk, sdkNonAdmin })
     await form_submitted_trigger_tests({ sdk, sdkNonAdmin })
+    await dont_sync_to_elation_form_submission_tests({ sdk, sdkNonAdmin })
     await date_string_validation_tests({ sdk, sdkNonAdmin })
     await openloop_webhooks_tests({ sdk, sdkNonAdmin })
     await mdi_webhooks_tests({ sdk, sdkNonAdmin })
@@ -15120,6 +15130,7 @@ const ip_address_form_tests = async () => {
     await inbox_threads_loading_tests()
     await load_inbox_data_tests({ sdk, sdkNonAdmin })
     await enduser_observations_acknowledge_tests({ sdk, sdkNonAdmin })
+    await nutrition_tracking_tests({ sdk, sdkNonAdmin })
     await translations_tests({ sdk, sdkNonAdmin })
     await create_user_notifications_trigger_tests({ sdk })
     await group_mms_active_tests()