@tellescope/sdk 1.256.10 → 1.256.11

package/lib/cjs/sdk.d.ts

@@ -4193,7 +4193,7 @@ export declare class Session extends SessionManager {
         iat: number;
         exp: number;
         requiresMFA?: boolean | undefined;
-        sessionScopes?: ("video-join-link" | "video-start-link" | "public-form" | "appointment-booking" | "ics-download" | "embeddables-token")[] | undefined;
+        sessionScopes?: ("video-join-link" | "video-start-link" | "public-form" | "appointment-booking" | "ics-download" | "embeddables-token" | "portal-preview")[] | undefined;
         scopeContext?: import("@tellescope/types-models").SessionScopeContext | undefined;
         allowedPaths?: string[] | undefined;
         users?: number | undefined;
@@ -4358,7 +4358,7 @@ export declare class Session extends SessionManager {
         iat: number;
         exp: number;
         requiresMFA?: boolean | undefined;
-        sessionScopes?: ("video-join-link" | "video-start-link" | "public-form" | "appointment-booking" | "ics-download" | "embeddables-token")[] | undefined;
+        sessionScopes?: ("video-join-link" | "video-start-link" | "public-form" | "appointment-booking" | "ics-download" | "embeddables-token" | "portal-preview")[] | undefined;
         scopeContext?: import("@tellescope/types-models").SessionScopeContext | undefined;
         allowedPaths?: string[] | undefined;
         users?: number | undefined;

package/lib/cjs/tests/api_tests/generate_suggested_reply.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate_suggested_reply.test.d.ts","sourceRoot":"","sources":["../../../../src/tests/api_tests/generate_suggested_reply.test.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAiBnC,eAAO,MAAM,8BAA8B;SAAwC,OAAO;iBAAe,OAAO;mBAgR/G,CAAA"}

package/lib/cjs/tests/api_tests/security/suggested-reply-redaction.test.d.ts

@@ -0,0 +1,26 @@
+import { Session } from "../../../sdk";
+/**
+ * Security regressions for the generateSuggestedReply journey step.
+ *
+ * `suggestedReply` holds a staff-facing draft that may be AI-generated and unreviewed, built from the
+ * patient's own chart context. Four defects were fixed:
+ *
+ *   1. emails / sms_messages / group_mms_conversations `suggestedReply` had no `redactions: ['enduser']`
+ *      (only the sibling `suggestedReplyIsAIGenerated` flag did, so content leaked but the "machine
+ *      generated" marker was stripped).
+ *   2. POST /v1/bulk-actions/read admitted enduser sessions via schema.users.enduserActions.readMany but
+ *      never checked the REQUESTED model's enduserActions — so any model in the enduser query map was
+ *      readable, regardless of whether it grants endusers read.
+ *   3. chat_rooms.mark_read spread the whole room with no applyRedactions, bypassing the redaction that
+ *      *was* declared. The patient portal calls mark_read on every chat view.
+ *   4. generateSuggestedReply accepted an OUTBOUND message as its target (journeyContext carries outbound
+ *      ids for the Message Delivery Failure and Message Link Clicked triggers).
+ *
+ * NO BEDROCK: drafts are written directly with a staff updateOne, and the fix-4 case returns from the
+ * inbound guard before the context load / Bedrock call are reached. Deterministic, consumes no AI credits.
+ */
+export declare const suggested_reply_redaction_tests: ({ sdk }: {
+    sdk: Session;
+    sdkNonAdmin: Session;
+}) => Promise<void>;
+//# sourceMappingURL=suggested-reply-redaction.test.d.ts.map

package/lib/cjs/tests/api_tests/security/suggested-reply-redaction.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"suggested-reply-redaction.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/suggested-reply-redaction.test.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAStC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,+BAA+B;SAA2B,OAAO;iBAAe,OAAO;mBAmLnG,CAAA"}

package/lib/cjs/tests/api_tests/security/suggested-reply-redaction.test.js

@@ -0,0 +1,336 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.suggested_reply_redaction_tests = void 0;
+require('source-map-support').install();
+var sdk_1 = require("../../../sdk");
+var schema_1 = require("@tellescope/schema");
+var testing_1 = require("@tellescope/testing");
+var setup_1 = require("../../setup");
+var host = process.env.API_URL || 'http://localhost:8080';
+var DRAFT = 'STAFF-ONLY-DRAFT-do-not-show-the-patient';
+/**
+ * Security regressions for the generateSuggestedReply journey step.
+ *
+ * `suggestedReply` holds a staff-facing draft that may be AI-generated and unreviewed, built from the
+ * patient's own chart context. Four defects were fixed:
+ *
+ *   1. emails / sms_messages / group_mms_conversations `suggestedReply` had no `redactions: ['enduser']`
+ *      (only the sibling `suggestedReplyIsAIGenerated` flag did, so content leaked but the "machine
+ *      generated" marker was stripped).
+ *   2. POST /v1/bulk-actions/read admitted enduser sessions via schema.users.enduserActions.readMany but
+ *      never checked the REQUESTED model's enduserActions — so any model in the enduser query map was
+ *      readable, regardless of whether it grants endusers read.
+ *   3. chat_rooms.mark_read spread the whole room with no applyRedactions, bypassing the redaction that
+ *      *was* declared. The patient portal calls mark_read on every chat view.
+ *   4. generateSuggestedReply accepted an OUTBOUND message as its target (journeyContext carries outbound
+ *      ids for the Message Delivery Failure and Message Link Clicked triggers).
+ *
+ * NO BEDROCK: drafts are written directly with a staff updateOne, and the fix-4 case returns from the
+ * inbound guard before the context load / Bedrock call are reached. Deterministic, consumes no AI credits.
+ */
+var suggested_reply_redaction_tests = function (_a) {
+    var sdk = _a.sdk;
+    return __awaiter(void 0, void 0, void 0, function () {
+        var enduserId, emailId, inboundSMSId, outboundSMSId, roomId, journeyId, enduser, email, inboundSMS, outboundSMS, room, _i, _b, _c, model, id, roomAsAdmin, emailAsAdmin, smsAsAdmin, authToken, asEnduser_1, roomAsEnduser, roomsAsEnduser, foundRoom, bulk, bulkAsStaff, _d, _e, model, field, journey, step, automatedAction, processResult, outboundAfter, _f, _g, _h, _j, _k, _l;
+        var _m, _o, _p, _q;
+        return __generator(this, function (_r) {
+            switch (_r.label) {
+                case 0:
+                    (0, testing_1.log_header)("Suggested Reply redaction + inbound guard");
+                    _r.label = 1;
+                case 1:
+                    _r.trys.push([1, , 25, 50]);
+                    return [4 /*yield*/, sdk.api.endusers.createOne({
+                            fname: 'SRRedaction', lname: 'Test', phone: '+15555550188',
+                            email: "sr-redaction-".concat(Date.now(), "@example.com"),
+                        })];
+                case 2:
+                    enduser = _r.sent();
+                    enduserId = enduser.id;
+                    return [4 /*yield*/, sdk.api.emails.createOne({
+                            enduserId: enduserId,
+                            subject: 'SR seed', textContent: 'seed', logOnly: true, inbound: true,
+                        })];
+                case 3:
+                    email = _r.sent();
+                    emailId = email.id;
+                    return [4 /*yield*/, sdk.api.sms_messages.createOne({
+                            enduserId: enduserId,
+                            message: 'inbound seed', logOnly: true, inbound: true,
+                        })];
+                case 4:
+                    inboundSMS = _r.sent();
+                    inboundSMSId = inboundSMS.id;
+                    return [4 /*yield*/, sdk.api.sms_messages.createOne({
+                            enduserId: enduserId,
+                            message: 'outbound seed', logOnly: true, inbound: false,
+                        })];
+                case 5:
+                    outboundSMS = _r.sent();
+                    outboundSMSId = outboundSMS.id;
+                    return [4 /*yield*/, sdk.api.chat_rooms.createOne({
+                            type: 'internal', userIds: [], enduserIds: [enduserId], title: 'SR redaction room',
+                        })];
+                case 6:
+                    room = _r.sent();
+                    roomId = room.id;
+                    _i = 0, _b = [['emails', emailId], ['sms_messages', inboundSMSId], ['chat_rooms', roomId]];
+                    _r.label = 7;
+                case 7:
+                    if (!(_i < _b.length)) return [3 /*break*/, 10];
+                    _c = _b[_i], model = _c[0], id = _c[1];
+                    return [4 /*yield*/, sdk.api[model].updateOne(id, { suggestedReply: DRAFT, suggestedReplyIsAIGenerated: true })];
+                case 8:
+                    _r.sent();
+                    _r.label = 9;
+                case 9:
+                    _i++;
+                    return [3 /*break*/, 7];
+                case 10: return [4 /*yield*/, sdk.api.chat_rooms.getOne(roomId)];
+                case 11:
+                    roomAsAdmin = _r.sent();
+                    return [4 /*yield*/, sdk.api.emails.getOne(emailId)];
+                case 12:
+                    emailAsAdmin = _r.sent();
+                    return [4 /*yield*/, sdk.api.sms_messages.getOne(inboundSMSId)];
+                case 13:
+                    smsAsAdmin = _r.sent();
+                    (0, testing_1.assert)(roomAsAdmin.suggestedReply === DRAFT && roomAsAdmin.suggestedReplyIsAIGenerated === true
+                        && emailAsAdmin.suggestedReply === DRAFT && smsAsAdmin.suggestedReply === DRAFT, 'drafts did not persist / are not visible to staff — the API server is likely running a stale '
+                        + '@tellescope/schema, so the redaction assertions below would pass spuriously. Restart it.', 'CONTROL: drafts persist and staff can read them on all three models');
+                    return [4 /*yield*/, sdk.api.endusers.generate_auth_token({ id: enduserId })];
+                case 14:
+                    authToken = (_r.sent()).authToken;
+                    asEnduser_1 = new sdk_1.Session({ host: host });
+                    asEnduser_1.setAuthToken(authToken);
+                    /*************** Fix 3: mark_read must redact ***************/
+                    return [4 /*yield*/, (0, testing_1.async_test)('chat_rooms.mark_read does not leak suggestedReply to the patient', function () { return asEnduser_1.api.chat_rooms.mark_read({ id: roomId }); }, {
+                            onResult: function (r) {
+                                var _a, _b;
+                                var updated = r === null || r === void 0 ? void 0 : r.updated;
+                                if (!updated)
+                                    return false;
+                                // unreadCount proves the handler still did its job rather than erroring out
+                                var stillWorks = ((_b = (_a = updated.infoForUser) === null || _a === void 0 ? void 0 : _a[enduserId]) === null || _b === void 0 ? void 0 : _b.unreadCount) === 0;
+                                return stillWorks
+                                    && updated.suggestedReply === undefined
+                                    && updated.suggestedReplyIsAIGenerated === undefined;
+                            },
+                        })
+                        /*************** Fix 1: plain reads on chat_rooms must redact ***************/
+                    ];
+                case 15:
+                    /*************** Fix 3: mark_read must redact ***************/
+                    _r.sent();
+                    return [4 /*yield*/, asEnduser_1.api.chat_rooms.getOne(roomId)];
+                case 16:
+                    roomAsEnduser = _r.sent();
+                    (0, testing_1.assert)(roomAsEnduser.suggestedReply === undefined && roomAsEnduser.suggestedReplyIsAIGenerated === undefined, "enduser read chat_rooms.suggestedReply: ".concat(roomAsEnduser.suggestedReply), 'chat_rooms.getOne redacts suggestedReply for endusers');
+                    return [4 /*yield*/, asEnduser_1.api.chat_rooms.getSome({ limit: 50 })];
+                case 17:
+                    roomsAsEnduser = _r.sent();
+                    foundRoom = roomsAsEnduser.find(function (r) { return r.id === roomId; });
+                    (0, testing_1.assert)(!!foundRoom && foundRoom.suggestedReply === undefined, 'enduser readMany leaked chat_rooms.suggestedReply', 'chat_rooms.getSome redacts suggestedReply for endusers');
+                    return [4 /*yield*/, asEnduser_1.bulk_load({
+                            load: [{ model: 'emails' }, { model: 'sms_messages' }, { model: 'chat_rooms' }],
+                        })];
+                case 18:
+                    bulk = _r.sent();
+                    (0, testing_1.assert)(bulk.results[0] === null && bulk.results[1] === null, "bulk_load exposed models without enduser readMany: emails=".concat(JSON.stringify(bulk.results[0]), " sms=").concat(JSON.stringify(bulk.results[1])), 'bulk_load returns null for models with no enduser readMany (emails, sms_messages)');
+                    (0, testing_1.assert)(!!((_m = bulk.results[2]) === null || _m === void 0 ? void 0 : _m.records) && !bulk.results[2].records.some(function (r) { return r.suggestedReply !== undefined; }), 'bulk_load leaked chat_rooms.suggestedReply', 'bulk_load still returns chat_rooms for endusers, with suggestedReply redacted');
+                    return [4 /*yield*/, sdk.bulk_load({ load: [{ model: 'emails' }] })];
+                case 19:
+                    bulkAsStaff = _r.sent();
+                    (0, testing_1.assert)(!!((_o = bulkAsStaff.results[0]) === null || _o === void 0 ? void 0 : _o.records) && bulkAsStaff.results[0].records.length > 0, 'bulk_load stopped returning emails for staff — the enduser gate leaked into staff sessions', 'bulk_load unchanged for staff sessions');
+                    /*************** Fix 1 (defense-in-depth): redaction is declared in schema ***************/
+                    // Once the bulk-read gate is in place, emails/sms_messages are unreachable by enduser sessions, so
+                    // their redaction is no longer observable end-to-end. Assert it structurally so it survives the
+                    // gate ever being relaxed.
+                    for (_d = 0, _e = ['emails', 'sms_messages', 'group_mms_conversations']; _d < _e.length; _d++) {
+                        model = _e[_d];
+                        field = schema_1.schema[model].fields.suggestedReply;
+                        (0, testing_1.assert)(!!((_p = field === null || field === void 0 ? void 0 : field.redactions) === null || _p === void 0 ? void 0 : _p.includes('enduser')), "".concat(model, ".suggestedReply is missing redactions: ['enduser']"), "".concat(model, ".suggestedReply declares an enduser redaction"));
+                    }
+                    return [4 /*yield*/, sdk.api.journeys.createOne({ title: "SR Inbound Guard ".concat(Date.now()) })];
+                case 20:
+                    journey = _r.sent();
+                    journeyId = journey.id;
+                    return [4 /*yield*/, sdk.api.automation_steps.createOne({
+                            journeyId: journeyId,
+                            events: [{ type: 'onJourneyStart', info: {} }],
+                            action: { type: 'generateSuggestedReply', info: {} },
+                        })];
+                case 21:
+                    step = _r.sent();
+                    return [4 /*yield*/, sdk.api.automated_actions.createOne({
+                            enduserId: enduserId,
+                            journeyId: journeyId,
+                            automationStepId: step.id,
+                            event: { type: 'onJourneyStart', info: {} },
+                            action: { type: 'generateSuggestedReply', info: {} },
+                            status: 'active',
+                            processAfter: Date.now(),
+                            journeyContext: { smsId: outboundSMSId },
+                        })
+                        // returns before loadAISummaryContextFromDB / Bedrock.sendMessage — no AI credits consumed
+                    ];
+                case 22:
+                    automatedAction = _r.sent();
+                    return [4 /*yield*/, sdk.api.automated_actions.process({ automatedActionId: automatedAction.id })];
+                case 23:
+                    processResult = _r.sent();
+                    return [4 /*yield*/, sdk.api.sms_messages.getOne(outboundSMSId)];
+                case 24:
+                    outboundAfter = _r.sent();
+                    (0, testing_1.assert)(!outboundAfter.suggestedReply, "a draft was written onto an OUTBOUND message: ".concat(outboundAfter.suggestedReply), 'outbound target is rejected without writing suggestedReply');
+                    // success:false is what makes the worker throw — which marks the automated_action 'error', fires
+                    // any onError branch, honors continueOnError, and logs the background_error. Returning
+                    // success:true here would report a clean run and silently skip all of that. Asserted on the
+                    // response rather than on background_errors because this calls the API directly, so the worker
+                    // (which writes that row) is not in the loop.
+                    (0, testing_1.assert)(processResult.success === false
+                        && /outbound message, not an incoming one/i.test((_q = processResult.error) !== null && _q !== void 0 ? _q : ''), "expected success:false with an outbound-specific error, got: ".concat(JSON.stringify(processResult)), 'outbound rejection returns success:false so journey error handling engages');
+                    return [3 /*break*/, 50];
+                case 25:
+                    if (!journeyId) return [3 /*break*/, 29];
+                    _r.label = 26;
+                case 26:
+                    _r.trys.push([26, 28, , 29]);
+                    return [4 /*yield*/, sdk.api.journeys.deleteOne(journeyId)];
+                case 27:
+                    _r.sent();
+                    return [3 /*break*/, 29];
+                case 28:
+                    _f = _r.sent();
+                    return [3 /*break*/, 29];
+                case 29:
+                    if (!roomId) return [3 /*break*/, 33];
+                    _r.label = 30;
+                case 30:
+                    _r.trys.push([30, 32, , 33]);
+                    return [4 /*yield*/, sdk.api.chat_rooms.deleteOne(roomId)];
+                case 31:
+                    _r.sent();
+                    return [3 /*break*/, 33];
+                case 32:
+                    _g = _r.sent();
+                    return [3 /*break*/, 33];
+                case 33:
+                    if (!emailId) return [3 /*break*/, 37];
+                    _r.label = 34;
+                case 34:
+                    _r.trys.push([34, 36, , 37]);
+                    return [4 /*yield*/, sdk.api.emails.deleteOne(emailId)];
+                case 35:
+                    _r.sent();
+                    return [3 /*break*/, 37];
+                case 36:
+                    _h = _r.sent();
+                    return [3 /*break*/, 37];
+                case 37:
+                    if (!inboundSMSId) return [3 /*break*/, 41];
+                    _r.label = 38;
+                case 38:
+                    _r.trys.push([38, 40, , 41]);
+                    return [4 /*yield*/, sdk.api.sms_messages.deleteOne(inboundSMSId)];
+                case 39:
+                    _r.sent();
+                    return [3 /*break*/, 41];
+                case 40:
+                    _j = _r.sent();
+                    return [3 /*break*/, 41];
+                case 41:
+                    if (!outboundSMSId) return [3 /*break*/, 45];
+                    _r.label = 42;
+                case 42:
+                    _r.trys.push([42, 44, , 45]);
+                    return [4 /*yield*/, sdk.api.sms_messages.deleteOne(outboundSMSId)];
+                case 43:
+                    _r.sent();
+                    return [3 /*break*/, 45];
+                case 44:
+                    _k = _r.sent();
+                    return [3 /*break*/, 45];
+                case 45:
+                    if (!enduserId) return [3 /*break*/, 49];
+                    _r.label = 46;
+                case 46:
+                    _r.trys.push([46, 48, , 49]);
+                    return [4 /*yield*/, sdk.api.endusers.deleteOne(enduserId)];
+                case 47:
+                    _r.sent();
+                    return [3 /*break*/, 49];
+                case 48:
+                    _l = _r.sent();
+                    return [3 /*break*/, 49];
+                case 49: return [7 /*endfinally*/];
+                case 50: return [2 /*return*/];
+            }
+        });
+    });
+};
+exports.suggested_reply_redaction_tests = suggested_reply_redaction_tests;
+if (require.main === module) {
+    console.log("\uD83C\uDF10 Using API URL: ".concat(host));
+    var sdk_2 = new sdk_1.Session({ host: host });
+    var sdkNonAdmin_1 = new sdk_1.Session({ host: host });
+    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, (0, setup_1.setup_tests)(sdk_2, sdkNonAdmin_1)];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, (0, exports.suggested_reply_redaction_tests)({ sdk: sdk_2, sdkNonAdmin: sdkNonAdmin_1 })];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); };
+    runTests()
+        .then(function () {
+        console.log("✅ Suggested Reply redaction test suite completed successfully");
+        process.exit(0);
+    })
+        .catch(function (error) {
+        console.error("❌ Suggested Reply redaction test suite failed:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=suggested-reply-redaction.test.js.map

package/lib/cjs/tests/api_tests/security/suggested-reply-redaction.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"suggested-reply-redaction.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/suggested-reply-redaction.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,oCAAsC;AACtC,6CAA2C;AAC3C,+CAAoE;AACpE,qCAAyC;AAEzC,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE,IAAM,KAAK,GAAG,0CAA0C,CAAA;AAExD;;;;;;;;;;;;;;;;;;;GAmBG;AACI,IAAM,+BAA+B,GAAG,UAAO,EAAgD;QAA9C,GAAG,SAAA;;;;;;;oBACzD,IAAA,oBAAU,EAAC,2CAA2C,CAAC,CAAA;;;;oBAWrC,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;4BAC/C,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc;4BAC1D,KAAK,EAAE,uBAAgB,IAAI,CAAC,GAAG,EAAE,iBAAc;yBAChD,CAAC,EAAA;;oBAHI,OAAO,GAAG,SAGd;oBACF,SAAS,GAAG,OAAO,CAAC,EAAE,CAAA;oBAER,qBAAM,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC;4BAC3C,SAAS,WAAA;4BAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI;yBAC1E,CAAC,EAAA;;oBAFH,KAAK,GAAG,SAEL;oBACT,OAAO,GAAG,KAAK,CAAC,EAAE,CAAA;oBAEC,qBAAM,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC;4BACtD,SAAS,WAAA;4BAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI;yBAC1D,CAAC,EAAA;;oBAFH,UAAU,GAAG,SAEV;oBACT,YAAY,GAAG,UAAU,CAAC,EAAE,CAAA;oBAER,qBAAM,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC;4BACvD,SAAS,WAAA;4BAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK;yBAC5D,CAAC,EAAA;;oBAFH,WAAW,GAAG,SAEX;oBACT,aAAa,GAAG,WAAW,CAAC,EAAE,CAAA;oBAEjB,qBAAM,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;4BAC9C,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAmB;yBACnF,CAAC,EAAA;;oBAFI,IAAI,GAAG,SAEX;oBACF,MAAM,GAAG,IAAI,CAAC,EAAE,CAAA;0BAEgG,EAAtF,KAAA,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,cAAc,EAAE,YAAY,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,CAAC,CAAU;;;yBAAtF,CAAA,cAAsF,CAAA;oBAArG,WAAW,EAAV,KAAK,QAAA,EAAE,EAAE,QAAA;oBACnB,qBAAO,GAAG,CAAC,GAAG,CAAC,KAAK,CAAS,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,2BAA2B,EAAE,IAAI,EAAE,CAAC,EAAA;;oBAAzG,SAAyG,CAAA;;;oBADjF,IAAsF,CAAA;;yBAO5F,qBAAM,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAA;;oBAArD,WAAW,GAAG,SAAuC;oBACtC,qBAAM,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAA;;oBAAnD,YAAY,GAAG,SAAoC;oBACtC,qBAAM,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,EAAA;;oBAA5D,UAAU,GAAG,SAA+C;oBAClE,IAAA,gBAAM,EACJ,WAAW,CAAC,cAAc,KAAK,KAAK,IAAI,WAAW,CAAC,2BAA2B,KAAK,IAAI;2BACrF,YAAY,CAAC,cAAc,KAAK,KAAK,IAAI,UAAU,CAAC,cAAc,KAAK,KAAK,EAC/E,+FAA+F;0BAC7F,0FAA0F,EAC5F,qEAAqE,CACtE,CAAA;oBAIqB,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAA;;oBAA3E,SAAS,GAAK,CAAA,SAA6D,CAAA,UAAlE;oBACX,cAAY,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;oBACvC,WAAS,CAAC,YAAY,CAAC,SAAS,CAAC,CAAA;oBAEjC,8DAA8D;oBAC9D,qBAAM,IAAA,oBAAU,EACd,kEAAkE,EAClE,cAAM,OAAA,WAAS,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,MAAgB,EAAE,CAAC,EAA5D,CAA4D,EAClE;4BACE,QAAQ,EAAE,UAAC,CAAM;;gCACf,IAAM,OAAO,GAAG,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,CAAA;gCAC1B,IAAI,CAAC,OAAO;oCAAE,OAAO,KAAK,CAAA;gCAC1B,4EAA4E;gCAC5E,IAAM,UAAU,GAAG,CAAA,MAAA,MAAA,OAAO,CAAC,WAAW,0CAAG,SAAmB,CAAC,0CAAE,WAAW,MAAK,CAAC,CAAA;gCAChF,OAAO,UAAU;uCACZ,OAAO,CAAC,cAAc,KAAK,SAAS;uCACpC,OAAO,CAAC,2BAA2B,KAAK,SAAS,CAAA;4BACxD,CAAC;yBACF,CACF;wBAED,8EAA8E;sBAF7E;;oBAfD,8DAA8D;oBAC9D,SAcC,CAAA;oBAGqB,qBAAM,WAAS,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAA;;oBAA7D,aAAa,GAAG,SAA6C;oBACnE,IAAA,gBAAM,EACJ,aAAa,CAAC,cAAc,KAAK,SAAS,IAAI,aAAa,CAAC,2BAA2B,KAAK,SAAS,EACrG,kDAA2C,aAAa,CAAC,cAAc,CAAE,EACzE,uDAAuD,CACxD,CAAA;oBAEsB,qBAAM,WAAS,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAA;;oBAAtE,cAAc,GAAG,SAAqD;oBACtE,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,EAAE,KAAK,MAAM,EAAf,CAAe,CAAC,CAAA;oBAC3D,IAAA,gBAAM,EACJ,CAAC,CAAC,SAAS,IAAI,SAAS,CAAC,cAAc,KAAK,SAAS,EACrD,mDAAmD,EACnD,wDAAwD,CACzD,CAAA;oBAGY,qBAAO,WAAiB,CAAC,SAAS,CAAC;4BAC9C,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;yBAChF,CAAC,EAAA;;oBAFI,IAAI,GAAG,SAEX;oBACF,IAAA,gBAAM,EACJ,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EACpD,oEAA6D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,kBAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAE,EACrI,mFAAmF,CACpF,CAAA;oBACD,IAAA,gBAAM,EACJ,CAAC,CAAC,CAAA,MAAA,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,0CAAE,OAAO,CAAA,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,UAAC,CAAM,IAAK,OAAA,CAAC,CAAC,cAAc,KAAK,SAAS,EAA9B,CAA8B,CAAC,EACvG,4CAA4C,EAC5C,+EAA+E,CAChF,CAAA;oBAGmB,qBAAM,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,EAAA;;oBAAlE,WAAW,GAAG,SAAoD;oBACxE,IAAA,gBAAM,EACJ,CAAC,CAAC,CAAA,MAAA,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,0CAAE,OAAO,CAAA,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAC9E,4FAA4F,EAC5F,wCAAwC,CACzC,CAAA;oBAED,2FAA2F;oBAC3F,mGAAmG;oBACnG,gGAAgG;oBAChG,2BAA2B;oBAC3B,WAAkF,EAA9D,KAAA,CAAC,QAAQ,EAAE,cAAc,EAAE,yBAAyB,CAAU,EAA9D,cAA8D,EAA9D,IAA8D,EAAE;wBAAzE,KAAK;wBACR,KAAK,GAAI,eAAc,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAAA;wBAC1D,IAAA,gBAAM,EACJ,CAAC,CAAC,CAAA,MAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,UAAU,0CAAE,QAAQ,CAAC,SAAS,CAAC,CAAA,EACxC,UAAG,KAAK,uDAAoD,EAC5D,UAAG,KAAK,kDAA+C,CACxD,CAAA;qBACF;oBAGe,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,2BAAoB,IAAI,CAAC,GAAG,EAAE,CAAE,EAAE,CAAC,EAAA;;oBAAvF,OAAO,GAAG,SAA6E;oBAC7F,SAAS,GAAG,OAAO,CAAC,EAAE,CAAA;oBACT,qBAAM,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,SAAS,CAAC;4BACpD,SAAS,WAAA;4BACT,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;4BAC9C,MAAM,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,EAAE,EAAE;yBACrD,CAAC,EAAA;;oBAJI,IAAI,GAAG,SAIX;oBAEsB,qBAAM,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,SAAS,CAAC;4BAChE,SAAS,WAAA;4BACT,SAAS,WAAA;4BACT,gBAAgB,EAAE,IAAI,CAAC,EAAE;4BACzB,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,EAAE;4BAC3C,MAAM,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,EAAE,EAAE;4BACpD,MAAM,EAAE,QAAQ;4BAChB,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;4BACxB,cAAc,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE;yBAClC,CAAC;wBACT,2FAA2F;sBADlF;;oBATH,eAAe,GAAG,SASf;oBAEa,qBAAM,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,iBAAiB,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC,EAAA;;oBAAlG,aAAa,GAAG,SAAkF;oBAElF,qBAAM,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,EAAA;;oBAAhE,aAAa,GAAG,SAAgD;oBACtE,IAAA,gBAAM,EACJ,CAAC,aAAa,CAAC,cAAc,EAC7B,wDAAiD,aAAa,CAAC,cAAc,CAAE,EAC/E,4DAA4D,CAC7D,CAAA;oBAED,iGAAiG;oBACjG,uFAAuF;oBACvF,4FAA4F;oBAC5F,+FAA+F;oBAC/F,8CAA8C;oBAC9C,IAAA,gBAAM,EACH,aAAqB,CAAC,OAAO,KAAK,KAAK;2BACrC,wCAAwC,CAAC,IAAI,CAAC,MAAC,aAAqB,CAAC,KAAK,mCAAI,EAAE,CAAC,EACpF,uEAAgE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAE,EAC/F,4EAA4E,CAC7E,CAAA;;;yBAEG,SAAS,EAAT,yBAAS;;;;oBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,EAAA;;oBAA3C,SAA2C,CAAA;;;;;;yBAC9D,MAAM,EAAN,yBAAM;;;;oBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,EAAA;;oBAA1C,SAA0C,CAAA;;;;;;yBAC1D,OAAO,EAAP,yBAAO;;;;oBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EAAA;;oBAAvC,SAAuC,CAAA;;;;;;yBACxD,YAAY,EAAZ,yBAAY;;;;oBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC,YAAY,CAAC,EAAA;;oBAAlD,SAAkD,CAAA;;;;;;yBACxE,aAAa,EAAb,yBAAa;;;;oBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC,aAAa,CAAC,EAAA;;oBAAnD,SAAmD,CAAA;;;;;;yBAC1E,SAAS,EAAT,yBAAS;;;;oBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,EAAA;;oBAA3C,SAA2C,CAAA;;;;;;;;;;CAErE,CAAA;AAnLY,QAAA,+BAA+B,mCAmL3C;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAM,KAAG,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACjC,IAAM,aAAW,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IAEzC,IAAM,QAAQ,GAAG;;;wBACf,qBAAM,IAAA,mBAAW,EAAC,KAAG,EAAE,aAAW,CAAC,EAAA;;oBAAnC,SAAmC,CAAA;oBACnC,qBAAM,IAAA,uCAA+B,EAAC,EAAE,GAAG,OAAA,EAAE,WAAW,eAAA,EAAE,CAAC,EAAA;;oBAA3D,SAA2D,CAAA;;;;SAC5D,CAAA;IAED,QAAQ,EAAE;SACP,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAA;QAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,gDAAgD,EAAE,KAAK,CAAC,CAAA;QACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}

package/lib/cjs/tests/api_tests/stedi_approval.test.d.ts

@@ -0,0 +1,6 @@
+import { Session } from "../../sdk";
+export declare const stedi_approval_tests: ({ sdk, sdkNonAdmin }: {
+    sdk: Session;
+    sdkNonAdmin: Session;
+}) => Promise<void>;
+//# sourceMappingURL=stedi_approval.test.d.ts.map

package/lib/cjs/tests/api_tests/stedi_approval.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stedi_approval.test.d.ts","sourceRoot":"","sources":["../../../../src/tests/api_tests/stedi_approval.test.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAkB,MAAM,WAAW,CAAA;AAenD,eAAO,MAAM,oBAAoB;SAAwC,OAAO;iBAAe,OAAO;mBA+HrG,CAAA"}

package/lib/cjs/tests/api_tests/stedi_approval.test.js

@@ -0,0 +1,205 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stedi_approval_tests = void 0;
+require('source-map-support').install();
+var sdk_1 = require("../../sdk");
+var testing_1 = require("@tellescope/testing");
+var constants_1 = require("@tellescope/constants");
+var setup_1 = require("../setup");
+var host = process.env.API_URL || 'http://localhost:8080';
+// Stedi runs on Tellescope's own platform credentials (zz_secrets) and each eligibility check costs
+// Tellescope $0.10, so an organization must be approved by a Tellescope super admin
+// (Organization.stediAllowed) before any Stedi call is made on its behalf.
+//
+// Every assertion here is a REJECTION assertion, so nothing in this file ever reaches Stedi.
+var stedi_approval_tests = function (_a) {
+    var sdk = _a.sdk, sdkNonAdmin = _a.sdkNonAdmin;
+    return __awaiter(void 0, void 0, void 0, function () {
+        var orgId, businessId, organization, enduser, enduserSdk_1, messageIsGenericForEnduser;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    (0, testing_1.log_header)("Stedi Pre-Approval (stediAllowed) Tests");
+                    orgId = sdk.userInfo.businessId;
+                    businessId = orgId;
+                    // A. Super-admin write gate.
+                    //
+                    // `isa` is only minted by GET /switch-tenant, so this plainly-authenticated admin session never
+                    // has it — even when TEST_EMAIL happens to be in the API's SUPER_ADMINS allowlist.
+                    (0, testing_1.log_header)("A. stediAllowed is writable by super admins only");
+                    return [4 /*yield*/, (0, testing_1.async_test)("org admin cannot enable stediAllowed for their own organization", function () { return sdk.api.organizations.updateOne(orgId, { stediAllowed: true }); }, { shouldError: true, onError: function (e) { return /not allowed/i.test(e.message); } })
+                        // Regression test for the truthiness hole in the shared super-admin relationship constraint:
+                        // it used to test `options.updates?.stediAllowed` (falsy for `false`), so an org admin could
+                        // clear super-admin-owned flags even though they could never set them.
+                    ];
+                case 1:
+                    _b.sent();
+                    // Regression test for the truthiness hole in the shared super-admin relationship constraint:
+                    // it used to test `options.updates?.stediAllowed` (falsy for `false`), so an org admin could
+                    // clear super-admin-owned flags even though they could never set them.
+                    return [4 /*yield*/, (0, testing_1.async_test)("org admin cannot disable stediAllowed either (guard is key-presence, not truthiness)", function () { return sdk.api.organizations.updateOne(orgId, { stediAllowed: false }); }, { shouldError: true, onError: function (e) { return /not allowed/i.test(e.message); } })
+                        // Same bug, pre-existing field — proves the fix wasn't scoped to the new flag only.
+                    ];
+                case 2:
+                    // Regression test for the truthiness hole in the shared super-admin relationship constraint:
+                    // it used to test `options.updates?.stediAllowed` (falsy for `false`), so an org admin could
+                    // clear super-admin-owned flags even though they could never set them.
+                    _b.sent();
+                    // Same bug, pre-existing field — proves the fix wasn't scoped to the new flag only.
+                    return [4 /*yield*/, (0, testing_1.async_test)("org admin cannot disable bedrockAIAllowed", function () { return sdk.api.organizations.updateOne(orgId, { bedrockAIAllowed: false }); }, { shouldError: true, onError: function (e) { return /not allowed/i.test(e.message); } })
+                        // ...and that it covers the whole gated list, not just the two booleans.
+                    ];
+                case 3:
+                    // Same bug, pre-existing field — proves the fix wasn't scoped to the new flag only.
+                    _b.sent();
+                    // ...and that it covers the whole gated list, not just the two booleans.
+                    return [4 /*yield*/, (0, testing_1.async_test)("org admin cannot disable allowCreateSuborganizations", function () { return sdk.api.organizations.updateOne(orgId, { allowCreateSuborganizations: false }); }, { shouldError: true, onError: function (e) { return /not allowed/i.test(e.message); } })
+                        // B. An unapproved organization is rejected at every Stedi entry point.
+                    ];
+                case 4:
+                    // ...and that it covers the whole gated list, not just the two booleans.
+                    _b.sent();
+                    // B. An unapproved organization is rejected at every Stedi entry point.
+                    (0, testing_1.log_header)("B. Unapproved organizations cannot reach Stedi");
+                    return [4 /*yield*/, sdk.api.organizations.getOne(orgId)];
+                case 5:
+                    organization = _b.sent();
+                    if (organization.stediAllowed) {
+                        console.log("⚠️  SKIPPING section B: the test organization already has stediAllowed=true "
+                            + "(hand-toggled in this dev database). Turn it off in the super admin console and re-run — "
+                            + "these assertions would otherwise report a false pass.");
+                        return [2 /*return*/];
+                    }
+                    return [4 /*yield*/, sdk.api.endusers.createOne({
+                            email: "stedi-approval-".concat(Date.now(), "@test.tellescope.com"),
+                            fname: 'Stedi',
+                            lname: 'Approval',
+                        })];
+                case 6:
+                    enduser = _b.sent();
+                    _b.label = 7;
+                case 7:
+                    _b.trys.push([7, , 14, 16]);
+                    return [4 /*yield*/, (0, testing_1.async_test)("staff: Stedi payer search (proxy_read) is rejected", function () { return sdk.api.integrations.proxy_read({ integration: constants_1.STEDI_TITLE, type: 'payers', query: 'aetna' }); }, { shouldError: true, onError: function (e) { return /not enabled for this organization/i.test(e.message); } })];
+                case 8:
+                    _b.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)("staff: Stedi payer importer (load_payers) is rejected", function () { return sdk.api.integrations.load_payers({ integration: constants_1.STEDI_TITLE, query: 'aetna' }); }, { shouldError: true, onError: function (e) { return /not enabled for this organization/i.test(e.message); } })];
+                case 9:
+                    _b.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)("staff: Stedi eligibility check is rejected on approval, before the credit checks", function () { return sdk.api.integrations.proxy_read({
+                            integration: constants_1.STEDI_TITLE,
+                            type: 'stedi-eligibility',
+                            id: enduser.id,
+                            query: JSON.stringify({ serviceCode: '30', npi: '1234567890' }),
+                        }); }, {
+                            shouldError: true,
+                            // The absence of /credit/ is the real assertion: it proves the approval gate fires ahead of
+                            // the credit gate, so an unapproved org is never told to go buy credits.
+                            onError: function (e) { return (/not enabled for this organization/i.test(e.message) && !/credit/i.test(e.message)); },
+                        })
+                        // Enduser sessions reach both branches for real: StediEligibilityInput auto-runs the check, and
+                        // InsuranceInput search-on-types against the payer branch. Approval/billing state must not leak
+                        // to patients.
+                    ];
+                case 10:
+                    _b.sent();
+                    enduserSdk_1 = new sdk_1.EnduserSession({ host: host, businessId: businessId });
+                    return [4 /*yield*/, (0, setup_1.authenticate_enduser_via_token)(sdk, enduserSdk_1, { id: enduser.id })
+                        // Exact-match on the generic copy: no "Stedi", no "credits", no "contact sales", no mention that
+                        // approval is the reason. Note this is deliberately the SAME string the enduser-facing credit
+                        // rejection uses, so it cannot prove which gate fired — the staff assertion above is what pins
+                        // down the approval-before-credits ordering.
+                    ];
+                case 11:
+                    _b.sent();
+                    messageIsGenericForEnduser = function (e) { return (e.message === 'Eligibility check is currently unavailable'); };
+                    return [4 /*yield*/, (0, testing_1.async_test)("enduser: eligibility check rejected with a generic message (no approval/billing leak)", function () { return enduserSdk_1.api.integrations.proxy_read({
+                            integration: constants_1.STEDI_TITLE,
+                            type: 'stedi-eligibility',
+                            query: JSON.stringify({ serviceCode: '30', npi: '1234567890' }),
+                        }); }, { shouldError: true, onError: messageIsGenericForEnduser })];
+                case 12:
+                    _b.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)("enduser: payer search rejected with a generic message (no approval/billing leak)", function () { return enduserSdk_1.api.integrations.proxy_read({
+                            integration: constants_1.STEDI_TITLE,
+                            type: 'payers',
+                            query: 'aetna',
+                        }); }, { shouldError: true, onError: messageIsGenericForEnduser })];
+                case 13:
+                    _b.sent();
+                    return [3 /*break*/, 16];
+                case 14: return [4 /*yield*/, sdk.api.endusers.deleteOne(enduser.id).catch(console.error)];
+                case 15:
+                    _b.sent();
+                    return [7 /*endfinally*/];
+                case 16: return [2 /*return*/];
+            }
+        });
+    });
+};
+exports.stedi_approval_tests = stedi_approval_tests;
+// Allow running this test file independently
+if (require.main === module) {
+    console.log("Using API URL: ".concat(host));
+    var sdk_2 = new sdk_1.Session({ host: host });
+    var sdkNonAdmin_1 = new sdk_1.Session({ host: host });
+    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, (0, setup_1.setup_tests)(sdk_2, sdkNonAdmin_1)];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, (0, exports.stedi_approval_tests)({ sdk: sdk_2, sdkNonAdmin: sdkNonAdmin_1 })];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); };
+    runTests()
+        .then(function () {
+        console.log("✅ Stedi pre-approval tests completed successfully");
+        process.exit(0);
+    })
+        .catch(function (error) {
+        console.error("❌ Stedi pre-approval tests failed:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=stedi_approval.test.js.map