@tellescope/sdk 1.256.12 → 1.256.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tellescope/sdk",
-  "version": "1.256.12",
+  "version": "1.256.13",
   "description": "Code for interacting with the Tellescope API",
   "main": "./lib/cjs/sdk.js",
   "module": "./lib/esm/sdk.js",
@@ -32,14 +32,14 @@
   },
   "homepage": "https://github.com/tellescope-os/tellescope#readme",
   "dependencies": {
-    "@tellescope/constants": "1.256.12",
-    "@tellescope/schema": "1.256.12",
-    "@tellescope/testing": "1.256.12",
-    "@tellescope/types-client": "1.256.12",
-    "@tellescope/types-models": "1.256.12",
-    "@tellescope/types-utilities": "1.256.12",
-    "@tellescope/utilities": "1.256.12",
-    "@tellescope/validation": "1.256.12",
+    "@tellescope/constants": "1.256.13",
+    "@tellescope/schema": "1.256.13",
+    "@tellescope/testing": "1.256.13",
+    "@tellescope/types-client": "1.256.13",
+    "@tellescope/types-models": "1.256.13",
+    "@tellescope/types-utilities": "1.256.13",
+    "@tellescope/utilities": "1.256.13",
+    "@tellescope/validation": "1.256.13",
     "axios": "0.30.3",
     "dotenv": "14.3.2",
     "form-data": "4.0.4",
@@ -55,5 +55,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "137bfca8fc8d2229a8eee245265536e507a3afae"
+  "gitHead": "457e037174ead2b05f585d810de05f724659430a"
 }

package/src/sdk.ts

@@ -810,6 +810,9 @@ type Queries = { [K in keyof ClientModelForName]: APIQuery<K> } & {
     load_events: (args: extractFields<CustomActions['calendar_events']['load_events']['parameters']>) => (
       Promise<extractFields<CustomActions['calendar_events']['load_events']['returns']>>
     ),
+    out_of_office: (args?: extractFields<CustomActions['calendar_events']['out_of_office']['parameters']>) => (
+      Promise<extractFields<CustomActions['calendar_events']['out_of_office']['returns']>>
+    ),
     generate_zoom_meeting: (args: extractFields<CustomActions['calendar_events']['generate_zoom_meeting']['parameters']>) => (
       Promise<extractFields<CustomActions['calendar_events']['generate_zoom_meeting']['returns']>>
     ),
@@ -1146,6 +1149,7 @@ export class Session extends SessionManager {
     queries.calendar_events.session_for_start_link = a => this._GET(`/v1${schema.calendar_events.publicActions.session_for_start_link.path}`, a)
     queries.calendar_events.get_events_for_user = a => this._GET(`/v1/${schema.calendar_events.customActions.get_events_for_user.path}`, a)
     queries.calendar_events.load_events = a => this._GET(`/v1/${schema.calendar_events.customActions.load_events.path}`, a)
+    queries.calendar_events.out_of_office = a => this._GET(`/v1${schema.calendar_events.customActions.out_of_office.path}`, a)
     queries.calendar_events.generate_meeting_link = a => this._POST(`/v1/${schema.calendar_events.customActions.generate_meeting_link.path}`, a)
     queries.calendar_events.generate_zoom_meeting = a => this._POST(`/v1/${schema.calendar_events.customActions.generate_zoom_meeting.path}`, a)
     queries.calendar_events.change_zoom_host = a => this._POST(`/v1/${schema.calendar_events.customActions.change_zoom_host.path}`, a)

package/src/tests/api_tests/out_of_office_endpoint.test.ts

@@ -0,0 +1,162 @@
+require('source-map-support').install();
+
+import { Session } from "../../sdk"
+import {
+  assert,
+  log_header,
+} from "@tellescope/testing"
+import { setup_tests } from "../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const MS_PER_MINUTE = 60 * 1000
+const MS_PER_HOUR = 60 * MS_PER_MINUTE
+
+// Covers the calendar_events.out_of_office endpoint, whose whole reason to exist is that it reads
+// ACROSS users: calendar_events is row-filtered on attendees.id and a non-admin defaults to
+// read: 'Assigned', so the ordinary read path returns only the caller's own blocks. The endpoint
+// therefore queries organization-wide on purpose, and returns no event content to make that safe.
+//
+// The cross-user assertion below is the one that matters: swapping the handler's
+// buildOrganizationWideQueries back to the request-scoped DB would silently break peer visibility in
+// Team Chat without breaking a build or any other test.
+export const out_of_office_endpoint_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("Out of Office Endpoint")
+
+  const adminId = sdk.userInfo.id
+  const nonAdminId = sdkNonAdmin.userInfo.id
+  const now = Date.now()
+
+  // active right now, on the ADMIN, so the non-admin is neither an attendee nor the creator
+  const active = await sdk.api.calendar_events.createOne({
+    title: 'Out of Office',
+    outOfOffice: true,
+    startTimeInMS: now - 2 * MS_PER_HOUR,
+    durationInMinutes: 8 * 60,
+    attendees: [{ id: adminId, type: 'user' }],
+  })
+  // ended three hours ago — inside the query's start-time range, so only the handler's computed
+  // end-time check excludes it
+  const ended = await sdk.api.calendar_events.createOne({
+    title: 'Out of Office',
+    outOfOffice: true,
+    startTimeInMS: now - 5 * MS_PER_HOUR,
+    durationInMinutes: 2 * 60,
+    attendees: [{ id: adminId, type: 'user' }],
+  })
+  const cancelled = await sdk.api.calendar_events.createOne({
+    title: 'Out of Office',
+    outOfOffice: true,
+    startTimeInMS: now - MS_PER_HOUR,
+    durationInMinutes: 4 * 60,
+    attendees: [{ id: adminId, type: 'user' }],
+    cancelledAt: new Date(),
+  })
+  // not flagged: a normal event overlapping now must never appear
+  const normal = await sdk.api.calendar_events.createOne({
+    title: 'Regular Appointment',
+    startTimeInMS: now - MS_PER_HOUR,
+    durationInMinutes: 4 * 60,
+    attendees: [{ id: adminId, type: 'user' }],
+  })
+  // on the non-admin, used for the userIds scoping check
+  const nonAdminOwn = await sdk.api.calendar_events.createOne({
+    title: 'Out of Office',
+    outOfOffice: true,
+    startTimeInMS: now - MS_PER_HOUR,
+    durationInMinutes: 4 * 60,
+    attendees: [{ id: nonAdminId, type: 'user' }],
+  })
+
+  try {
+    const { outOfOffice } = await sdkNonAdmin.api.calendar_events.out_of_office()
+
+    // assert(assertion, failureMessage, successTitle)
+    assert(
+      !!outOfOffice.find(o => o.userId === adminId && o.startTimeInMS === active.startTimeInMS),
+      'non-admin does NOT see a peer out of office window — is the handler using the request-scoped DB instead of buildOrganizationWideQueries?',
+      'non-admin sees a peer out of office window',
+    )
+
+    assert(
+      outOfOffice.every(o => (
+        Object.keys(o).sort().join(',') === 'endTimeInMS,startTimeInMS,userId'
+      )),
+      `response leaked event fields: ${JSON.stringify(outOfOffice[0] ?? {})}`,
+      'response carries no event content',
+    )
+
+    const forAdmin = outOfOffice.filter(o => o.userId === adminId)
+    assert(
+      forAdmin.length === 1,
+      `expected exactly the one active window for the admin, got ${forAdmin.length}: ${JSON.stringify(forAdmin)}`,
+      'ended, cancelled and unflagged events are excluded',
+    )
+    assert(
+      forAdmin[0]?.endTimeInMS === active.startTimeInMS + active.durationInMinutes * MS_PER_MINUTE,
+      `endTimeInMS was ${forAdmin[0]?.endTimeInMS}, expected ${active.startTimeInMS + active.durationInMinutes * MS_PER_MINUTE}`,
+      'endTimeInMS is resolved from startTimeInMS + durationInMinutes',
+    )
+
+    // An admin's reads are unrestricted anyway, so this passes even if the handler were reverted to
+    // the request-scoped DB — it's the non-admin assertion above that pins the design. Kept as the
+    // pair, so the two together show the result is role-independent rather than role-dependent.
+    const asAdmin = await sdk.api.calendar_events.out_of_office()
+    assert(
+      !!asAdmin.outOfOffice.find(o => o.userId === adminId && o.startTimeInMS === active.startTimeInMS)
+      && !!asAdmin.outOfOffice.find(o => o.userId === nonAdminId),
+      `admin load missing windows: ${JSON.stringify(asAdmin.outOfOffice)}`,
+      'admin sees both its own and a peer out of office window',
+    )
+    assert(
+      asAdmin.outOfOffice.filter(o => o.userId === adminId).length === forAdmin.length,
+      `admin and non-admin disagree on the admin's windows: ${JSON.stringify(asAdmin.outOfOffice.filter(o => o.userId === adminId))} vs ${JSON.stringify(forAdmin)}`,
+      'admin and non-admin loads return the same windows',
+    )
+
+    const scoped = await sdkNonAdmin.api.calendar_events.out_of_office({ userIds: [nonAdminId] })
+    assert(
+      scoped.outOfOffice.length === 1 && scoped.outOfOffice[0].userId === nonAdminId,
+      `expected only the requested user, got ${JSON.stringify(scoped.outOfOffice)}`,
+      'userIds scopes the result',
+    )
+
+    // a real ObjectId that belongs to no user in this business
+    const foreign = await sdkNonAdmin.api.calendar_events.out_of_office({ userIds: ['5fdb3d4a4e6e2a0016a1a1a1'] })
+    assert(
+      foreign.outOfOffice.length === 0,
+      `expected empty for unknown userIds, got ${JSON.stringify(foreign.outOfOffice)}`,
+      'unknown userIds return nothing',
+    )
+  } finally {
+    await Promise.all([
+      sdk.api.calendar_events.deleteOne(active.id),
+      sdk.api.calendar_events.deleteOne(ended.id),
+      sdk.api.calendar_events.deleteOne(cancelled.id),
+      sdk.api.calendar_events.deleteOne(normal.id),
+      sdk.api.calendar_events.deleteOne(nonAdminOwn.id),
+    ])
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await out_of_office_endpoint_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ Out of office endpoint test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Out of office endpoint test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/tests.ts

@@ -103,6 +103,7 @@ import { outbound_chat_sent_trigger_tests } from "./api_tests/outbound_chat_sent
 import { time_tracks_tests, time_tracks_historical_tests, time_tracks_correction_tests, time_tracks_review_tests, time_tracks_lock_tests, time_tracks_edge_case_tests, time_tracks_resubmit_tests, time_tracks_appointment_duration_tests } from "./api_tests/time_tracks.test";
 import { monthly_availability_restrictions_tests } from "./api_tests/monthly_availability_restrictions.test";
 import { calendar_event_limits_tests } from "./api_tests/calendar_event_limits.test";
+import { out_of_office_endpoint_tests } from "./api_tests/out_of_office_endpoint.test";
 import { appointment_link_expiration_tests } from "./api_tests/appointment_link_expiration.test";
 import { custom_aggregation_tests } from "./api_tests/custom_aggregation.test";
 import { chats_analytics_tests } from "./api_tests/chats_analytics.test";
@@ -15446,6 +15447,7 @@ const ip_address_form_tests = async () => {
     await time_tracks_resubmit_tests({ sdk, sdkNonAdmin })
     await time_tracks_appointment_duration_tests({ sdk, sdkNonAdmin })
     await calendar_event_limits_tests({ sdk, sdkNonAdmin })
+    await out_of_office_endpoint_tests({ sdk, sdkNonAdmin })
     await appointment_link_expiration_tests({ sdk, sdkNonAdmin })
     await get_some_projection_tests({ sdk, sdkNonAdmin })
     await file_download_unicode_names_tests({ sdk, sdkNonAdmin })