@tellescope/sdk 1.256.12 → 1.256.14

package/src/tests/api_tests/security/F-0192-automated-actions-process-gate.test.ts

@@ -0,0 +1,238 @@
+require('source-map-support').install();
+
+import axios from "axios"
+
+import { Session } from "../../../sdk"
+import {
+  assert,
+  log_header,
+} from "@tellescope/testing"
+import { PROVIDER_PERMISSIONS, PLACEHOLDER_ID } from "@tellescope/constants"
+import { setup_tests } from "../../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
+const ALL = 'All' as const
+const FULL_ACCESS = { create: ALL, read: ALL, update: ALL, delete: ALL }
+
+const PROCESS_PATH = '/v1/automated-actions/process'
+
+// A single collected check. Everything is gathered first and asserted at the end, because the
+// testing harness exits the process on the first failed assert — collecting first means a RED run
+// prints the full evidence table (and reaches `finally` cleanup) before the first assert exits.
+type Check = {
+  label: string,
+  pass: boolean,
+  detail: string,
+}
+
+/**
+ * Regression test for F-0192
+ * (security-audit/findings/F-0192-automated-actions-process-fire-replay.md).
+ *
+ * `automated_actions.process` (api.ts:3902) is the WORKER's action runner — its schema description
+ * reads "Used by worker for new action types". It was registered with only
+ * `{ requiresSubscription: true }`, so the framework gated it on the ordinary
+ * `automated_actions.update` verb, which the default provider role holds ('Assigned'). The handler
+ * then dispatched `automatedAction.action` through a 14-branch if-chain reaching real vendors:
+ * chargebeeChargeCardOnFile (card charge), belugaAutoRx / belugaTriggerRefill / mdiTriggerRefill
+ * (prescriptions and refills), createScriptSureDraft (medication draft), healthiePushForms /
+ * metriportPushFormResponse (PHI export). It checked neither the row's `status` nor whether it had
+ * already run, so any row was replayable: MDI advances to the next scheduled refill each call,
+ * Chargebee charges again. And there was no storeUserLog, so the action was attributed to the
+ * worker rather than the caller.
+ *
+ * The fix has three parts:
+ *   1. `adminOnly: true` on the api.ts registration (routing.ts:944 reads the flag from that
+ *      options object — a schema-only flag is inert, which is the separate finding F-0191).
+ *   2. A single-fire claim for human callers: an atomic findOneAndUpdate with `status: 'active'` in
+ *      the filter, stamping `finished` + `processedAt` before the vendor dispatch. The worker
+ *      (`wasAutomated`) is exempt because its own claim in
+ *      worker/modules/database.ts:114 is already atomic and it needs the row to stay 'active'
+ *      across the call so a retryable failure (worker/modules/automations.ts:2053) can be
+ *      re-claimed after the lock times out.
+ *   3. storeUserLog on the human path, recording the caller and the automatedActionId.
+ *
+ * The seeded row uses `setEnduserStatus`, which is NOT one of the API's if-chain branches, so it
+ * falls through to `{ success: false, unimplemented: true }` (api.ts) — no vendor call, no Bedrock,
+ * no PHI export. `processAfter` is set an hour out so the live worker cannot race the row (the same
+ * trick mdi_trigger_refill / beluga_trigger_refill use).
+ *
+ * RED (pre-fix): A1 fails (a non-admin holding only `automated_actions.update` reaches the handler)
+ * and C1 fails (the second call on the same row executes again instead of being rejected).
+ * B1 (admin positive control) passes pre-fix and must keep passing.
+ * GREEN (post-fix): all five checks pass.
+ */
+export const automated_actions_process_gate_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("F-0192: automated_actions.process must be admin-only and single-fire")
+
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  // Raw axios: the SDK's parseError discards the HTTP status, and the whole point here is WHICH
+  // status the gate returns.
+  const post = async (authToken: string, automatedActionId: string) => {
+    const r = await axios.request({
+      method: 'post',
+      url: `${host}${PROCESS_PATH}`,
+      data: { automatedActionId },
+      headers: { Authorization: `Bearer ${authToken}` },
+      validateStatus: () => true,
+    })
+    return { status: r.status, body: r.data }
+  }
+
+  let roleId = ''
+  let attackerId = ''
+  let enduserId = ''
+  const automatedActionIds: string[] = []
+
+  try {
+    /* ================= fixtures ================= */
+
+    // A non-admin role that explicitly HOLDS automated_actions update — the point of the finding is
+    // that holding the declared verb was enough to fire vendor actions.
+    const role = `f0192-automations-${RAND()}`
+    const rbap = await sdk.api.role_based_access_permissions.createOne({
+      role,
+      permissions: { ...PROVIDER_PERMISSIONS, automated_actions: FULL_ACCESS },
+    } as any)
+    roleId = rbap.id
+
+    // Throwaway staff user — never mutate an existing user's roles. verifiedEmail must be set at
+    // create time (it is rejected on update), otherwise calls are blocked on email verification
+    // rather than on the gate under test.
+    const attacker = await sdk.api.users.createOne({
+      email: `f0192-attacker-${RAND()}@tellescope.example`,
+      fname: 'F0192', lname: 'Staff',
+      verifiedEmail: true,
+      notificationEmailsDisabled: true,
+      roles: [role],
+    } as any)
+    attackerId = attacker.id
+
+    // Admin-minted token, not .authenticate — /login is IP rate-limited and the suite shares an IP.
+    const attackerToken = (await sdk.api.users.generate_auth_token({ id: attackerId })).authToken
+    const adminToken = (await sdk.api.users.generate_auth_token({ id: sdk.userInfo.id })).authToken
+
+    const attackerSDK = new Session({ host, authToken: attackerToken })
+    await attackerSDK.refresh_session()
+    record(
+      'setup: attacker session is a non-admin holding automated_actions.update',
+      attackerSDK.userInfo.id === attackerId && !(attackerSDK.userInfo.roles ?? []).includes('Admin'),
+      `id=${attackerSDK.userInfo.id} roles=${JSON.stringify(attackerSDK.userInfo.roles)}`,
+    )
+
+    const enduser = await sdk.api.endusers.createOne({ fname: 'F0192', lname: 'Patient' })
+    enduserId = enduser.id
+
+    // `setEnduserStatus` is handled by the worker, NOT by the API's process if-chain, so it falls
+    // through to `unimplemented: true`. processAfter is an hour out so the live worker cannot claim
+    // the row before the explicit calls below.
+    const seedAction = async () => {
+      const a = await sdk.api.automated_actions.createOne({
+        enduserId,
+        journeyId: PLACEHOLDER_ID,
+        automationStepId: PLACEHOLDER_ID,
+        event: { type: 'onJourneyStart', info: {} },
+        action: { type: 'setEnduserStatus', info: { status: 'Working' } },
+        status: 'active',
+        processAfter: Date.now() + 60 * 60 * 1000,
+      } as any)
+      automatedActionIds.push(a.id)
+      return a
+    }
+
+    /* ===== A: the privilege gap — a non-admin with the declared verb must be rejected ===== */
+
+    const attackerRow = await seedAction()
+    const attackerAttempt = await post(attackerToken, attackerRow.id)
+
+    // Baseline on the same path with an admin token, so a blanket 401 (expired subscription,
+    // bad route, broken fixture) cannot masquerade as a working gate.
+    const baselineRow = await seedAction()
+    const baseline = await post(adminToken, baselineRow.id)
+    const badProbe = baseline.status === 401 || baseline.status === 403
+
+    record(
+      'A1: a non-admin holding automated_actions.update cannot call process',
+      !badProbe && (attackerAttempt.status === 401 || attackerAttempt.status === 403),
+      `attacker=${attackerAttempt.status} ${JSON.stringify(attackerAttempt.body)} baseline(admin)=${baseline.status}`
+        + (badProbe ? ' BAD PROBE: admin baseline was also rejected' : ''),
+    )
+
+    // The attacker's row must be untouched — the gate has to fire before the claim and the dispatch.
+    const attackerRowAfter = await sdk.api.automated_actions.getOne(attackerRow.id)
+    record(
+      'A2: a rejected non-admin call leaves the row unfired (status still active)',
+      attackerRowAfter.status === 'active',
+      `status=${attackerRowAfter.status} (expected active)`,
+    )
+
+    /* ===== B: positive control — an admin can still call it ===== */
+
+    record(
+      'B1: an admin can still process a pending row',
+      baseline.status === 200 && baseline.body?.unimplemented === true,
+      `status=${baseline.status} body=${JSON.stringify(baseline.body)}`,
+    )
+
+    /* ===== C: the replay gate — the same row must not fire twice ===== */
+
+    const replay = await post(adminToken, baselineRow.id)
+    record(
+      'C1: processing the same row twice is rejected (no replay)',
+      replay.status === 409,
+      `second call status=${replay.status} body=${JSON.stringify(replay.body)} (expected 409)`,
+    )
+
+    const baselineRowAfter = await sdk.api.automated_actions.getOne(baselineRow.id)
+    record(
+      'C2: a processed row is marked finished so neither a replay nor the worker re-runs it',
+      baselineRowAfter.status === 'finished',
+      `status=${baselineRowAfter.status} (expected finished)`,
+    )
+
+    /* ===== report: print full table first, then assert (harness exits on first failure) ===== */
+    console.log('\n  F-0192 check summary:')
+    for (const c of checks) {
+      console.log(`    ${c.pass ? 'PASS' : 'FAIL'}  ${c.label}  —  ${c.detail}`)
+    }
+    console.log('')
+
+    for (const c of checks) {
+      assert(c.pass, `${c.label} — ${c.detail}`, c.label)
+    }
+  } finally {
+    // Reverse order. The automated_actions go first: they hang off enduserId with
+    // onDependencyDelete 'delete', so deleting the enduser would take them with it.
+    for (const id of automatedActionIds) { try { await sdk.api.automated_actions.deleteOne(id) } catch {} }
+    if (enduserId) { try { await sdk.api.endusers.deleteOne(enduserId) } catch {} }
+    if (attackerId) { try { await sdk.api.users.deleteOne(attackerId) } catch {} }
+    if (roleId) { try { await sdk.api.role_based_access_permissions.deleteOne(roleId) } catch {} }
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await automated_actions_process_gate_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ F-0192 automated_actions.process gate test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ F-0192 automated_actions.process gate test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/security/F-0196-add-to-journey-foreign-enduserid.test.ts

@@ -0,0 +1,208 @@
+require('source-map-support').install();
+
+import {
+  assert_checks,
+  Check,
+  setup_isolated_tenant,
+} from "../../setup_isolated"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
+// far enough out that a locally running worker never claims the rows we inspect
+const FUTURE_START = () => new Date(Date.now() + 60 * 60 * 1000)
+
+/**
+ * Regression test for F-0196
+ * (security-audit/findings/F-0196-add-to-journey-plants-foreign-enduserid.md).
+ *
+ * `endusers.add_to_journey` inserted an `automated_actions` row for EACH caller-supplied `enduserId`
+ * with only mongoId-shape validation and no tenant-membership check. The preceding
+ * `DB.endusers.updateMany` is scoped but its result was discarded, and
+ * `DB.automated_actions.insertMany` is a direct write that bypasses the `ensureValidDependentKeys`
+ * foreign-key check the generic CRUD route gets. The resulting row is stamped
+ * `businessId: <caller's tenant>` while carrying `enduserId: <a victim in another tenant>`.
+ *
+ * The worker then dereferences that enduser with the raw driver and no `businessId`
+ * (worker/modules/automations.ts, the F-0074/F-0111/F-0159 family), so the victim's record loads
+ * under the attacker's automation: `pushFormsToPortal` copies the victim's PHI into the attacker's
+ * `form_responses` (readable by their staff) and `iterableCustomEvent` writes an attacker-authored
+ * note into the victim's chart. F-0196 is the reachability that made those three exploitable.
+ *
+ * There are TWO independent plant sites and a fix to only one is a half fix:
+ *   - inline branch, taken when `automationStepId` is supplied (api.ts add_to_journey handler)
+ *   - module branch, taken when it is not: `handle_automation_event`'s
+ *     `validEnduserIds = conditionsQuery ? <scoped find> : event.enduserIds` passes caller ids
+ *     straight through for a step with NO conditions.
+ * Both are covered below (A1/A2).
+ *
+ * Design notes:
+ *   - Two provisioned tenants, so the victim is a real foreign enduser and we can also assert their
+ *     record was not mutated. Both must come from provisioning: `add_to_journey` is
+ *     `requiresSubscription: true`, and a `create_and_join` org is born with an expired subscription.
+ *   - The steps use `setEnduserStatus` — no vendor, no Bedrock — and `startAt` is an hour out so a
+ *     running worker cannot process the rows before we read them.
+ *   - `throttle` is deliberately omitted: it is the only way add_to_journey's per-pair rate limit can
+ *     throw.
+ *   - Everything is observable through `automated_actions` reads, so the worker is never needed.
+ *
+ * RED (pre-fix): A1, A2 and B2 fail — the victim's id appears in the attacker tenant's
+ * automated_actions. GREEN (post-fix): the foreign id is silently dropped and the caller's own
+ * endusers still enroll normally.
+ */
+export const add_to_journey_foreign_enduserid_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  let attacker: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+  let victimTenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+
+  try {
+    /* ================= fixtures: two isolated tenants ================= */
+
+    ;[attacker, victimTenant] = await Promise.all([
+      setup_isolated_tenant({ name: `F0196 attacker ${RAND()}`, users: [{ isAdmin: true }], apiKeys: 0 }),
+      setup_isolated_tenant({ name: `F0196 victim ${RAND()}`, users: [{ isAdmin: true }], apiKeys: 0 }),
+    ])
+
+    const victim = await victimTenant.sdk.api.endusers.createOne({ fname: 'F0196', lname: 'Victim' })
+    const own = await attacker.sdk.api.endusers.createOne({ fname: 'F0196', lname: 'OwnPatient' })
+
+    record(
+      'setup: two separate tenants, victim belongs to the other one',
+      attacker.businessId !== victimTenant.businessId && !!victim.id && !!own.id,
+      `attacker=${attacker.businessId} victim tenant=${victimTenant.businessId} victimEnduser=${victim.id}`,
+    )
+
+    // one journey + onJourneyStart step per branch, so the per-(enduser,journey) throttle bucket and
+    // the row sets stay independent
+    const makeJourney = async (title: string) => {
+      const journey = await attacker!.sdk.api.journeys.createOne({ title: `${title} ${RAND()}` })
+      const step = await attacker!.sdk.api.automation_steps.createOne({
+        journeyId: journey.id,
+        // benign and worker-local: no vendor, no Bedrock. NO `conditions`, which is precisely the
+        // vulnerable branch in handle_automation_event.
+        action: { type: 'setEnduserStatus', info: { status: 'F0196' } },
+        events: [{ type: 'onJourneyStart', info: {} }],
+      } as any)
+      return { journey, step }
+    }
+
+    const inline = await makeJourney('F0196 inline')
+    const modulePath = await makeJourney('F0196 module')
+    const mixed = await makeJourney('F0196 mixed')
+
+    /** every automated_actions row the attacker tenant can see for a journey */
+    const rowsFor = async (journeyId: string) => (
+      await attacker!.sdk.api.automated_actions.getSome({ filter: { journeyId } } as any)
+    )
+    const enduserIdsFor = async (journeyId: string) => (await rowsFor(journeyId)).map((r: any) => r.enduserId)
+
+    /* ===== A: the foreign id must never be planted, on EITHER branch ===== */
+
+    // A1 — inline branch: automationStepId supplied
+    const inlineResult = await attacker.sdk.api.endusers.add_to_journey({
+      enduserIds: [victim.id],
+      journeyId: inline.journey.id,
+      automationStepId: inline.step.id,
+      startAt: FUTURE_START(),
+    } as any).then(() => 'resolved').catch((e: any) => `rejected: ${e?.message || e}`)
+
+    const inlineIds = await enduserIdsFor(inline.journey.id)
+    record(
+      'A1: inline branch (automationStepId) does not plant a foreign enduserId',
+      !inlineIds.includes(victim.id),
+      `call=${inlineResult}; automated_actions enduserIds=${JSON.stringify(inlineIds)} (must not contain ${victim.id})`,
+    )
+
+    // A2 — module branch: no automationStepId, so it routes through handle_automation_event
+    const moduleResult = await attacker.sdk.api.endusers.add_to_journey({
+      enduserIds: [victim.id],
+      journeyId: modulePath.journey.id,
+      startAt: FUTURE_START(),
+    } as any).then(() => 'resolved').catch((e: any) => `rejected: ${e?.message || e}`)
+
+    const moduleIds = await enduserIdsFor(modulePath.journey.id)
+    record(
+      'A2: module branch (no automationStepId) does not plant a foreign enduserId',
+      !moduleIds.includes(victim.id),
+      `call=${moduleResult}; automated_actions enduserIds=${JSON.stringify(moduleIds)} (must not contain ${victim.id})`,
+    )
+
+    // A3 — the victim's own record must be untouched (the scoped updateMany should already ensure it)
+    const victimAfter = await victimTenant.sdk.api.endusers.getOne(victim.id)
+    const victimJourneys = (victimAfter as any)?.journeys ?? {}
+    record(
+      'A3: the victim enduser was not enrolled in the attacker\'s journey',
+      !victimJourneys[inline.journey.id] && !victimJourneys[modulePath.journey.id],
+      `victim journeys=${JSON.stringify(victimJourneys)}`,
+    )
+
+    /* ===== B: legitimate use must keep working ===== */
+
+    // B1 — positive control on both branches, so a blanket failure can't masquerade as a fix
+    await attacker.sdk.api.endusers.add_to_journey({
+      enduserIds: [own.id],
+      journeyId: inline.journey.id,
+      automationStepId: inline.step.id,
+      startAt: FUTURE_START(),
+    } as any)
+    await attacker.sdk.api.endusers.add_to_journey({
+      enduserIds: [own.id],
+      journeyId: modulePath.journey.id,
+      startAt: FUTURE_START(),
+    } as any)
+
+    const inlineOwn = await enduserIdsFor(inline.journey.id)
+    const moduleOwn = await enduserIdsFor(modulePath.journey.id)
+    record(
+      'B1: the caller\'s OWN enduser still enrolls on both branches',
+      inlineOwn.includes(own.id) && moduleOwn.includes(own.id),
+      `inline=${JSON.stringify(inlineOwn)} module=${JSON.stringify(moduleOwn)} (both must contain ${own.id})`,
+    )
+
+    // B2 — a mixed list must enroll the visible id and drop only the foreign one: proves an
+    // intersect, not an all-or-nothing rejection
+    const mixedResult = await attacker.sdk.api.endusers.add_to_journey({
+      enduserIds: [own.id, victim.id],
+      journeyId: mixed.journey.id,
+      automationStepId: mixed.step.id,
+      startAt: FUTURE_START(),
+    } as any).then(() => 'resolved').catch((e: any) => `rejected: ${e?.message || e}`)
+
+    const mixedIds = await enduserIdsFor(mixed.journey.id)
+    record(
+      'B2: a mixed list enrolls the visible enduser and drops only the foreign one',
+      mixedIds.includes(own.id) && !mixedIds.includes(victim.id),
+      `call=${mixedResult}; enduserIds=${JSON.stringify(mixedIds)} (want ${own.id}, not ${victim.id})`,
+    )
+  } finally {
+    // Teardown happens here, BEFORE anything asserts — assert calls process.exit and would otherwise
+    // strand these tenants permanently (nothing can delete an organization record).
+    for (const t of [attacker, victimTenant]) {
+      if (t) { try { await t.teardown() } catch (e) { console.error('teardown failed', e) } }
+    }
+  }
+
+  return checks
+}
+
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+export const add_to_journey_foreign_enduserid_tests = async () => {
+  assert_checks('F-0196 add_to_journey foreign enduserId', await add_to_journey_foreign_enduserid_checks())
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  add_to_journey_foreign_enduserid_tests()
+    .then(() => {
+      console.log("✅ F-0196 add_to_journey foreign enduserId test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ F-0196 add_to_journey foreign enduserId test suite failed:", error)
+      process.exit(1)
+    })
+}