@tellescope/sdk 1.256.12 → 1.256.14

package/src/tests/api_tests/tickets_bulk_assign_from_queue.test.ts

@@ -0,0 +1,279 @@
+require('source-map-support').install();
+
+import { Session } from "../../sdk"
+import {
+  assert_checks,
+  Check,
+  setup_isolated_tenant,
+} from "../setup_isolated"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
+/**
+ * Coverage for `tickets.bulk_assign` when a `queueId` is supplied — the bulk equivalent of
+ * `tickets.assign_from_queue`, added so a Ticket Queue's tickets can be checkbox-selected and handed
+ * to one user in a single call instead of one `assign_from_queue` round trip per ticket.
+ *
+ * Without `queueId` the endpoint only does `$set: { owner }`. That is insufficient for a QUEUED
+ * ticket: it would stay in the queue (still pullable by someone else), carry no dequeue provenance,
+ * and leave `ticket_queues.count` drifting upward forever. The queue branch therefore also unsets
+ * `queueId`, sets `dequeuedAt`/`dequeuedFrom`, and decrements the queue's count — the same
+ * bookkeeping `assign_from_queue` does for a single ticket. A/B/C below pin each of those.
+ *
+ * D is the check that actually justifies the handler's shape. The tickets model declares
+ * `constraints.access: [{ type: 'filter', field: 'owner' }]`, which the DB layer turns into
+ * `owner === self OR creator === self` for any non-`All` access. A queued ticket has no owner, and
+ * was typically created by someone else, so a non-admin queue manager's `DB.tickets.updateMany`
+ * matches NOTHING — the call would return 200 having assigned zero tickets, silently. The handler
+ * uses `buildOrganizationWideQueries` to get past that, exactly as `assign_from_queue` does, and
+ * re-adds the queue-membership check that those queries bypass. D1 proves the escape hatch works for
+ * a legitimate queue member; D2 proves it is still gated, and is the check that fails if someone
+ * later drops the membership check while keeping the organization-wide queries.
+ *
+ * A provisioned non-admin gets `tickets: ASSIGNED_AND_DEFAULT_ACCESS` (read/update = 'Assigned'),
+ * which is what makes D meaningful. The D tickets deliberately have NO enduserId, so the 'Assigned'
+ * role filter's other branch (enduserId in assignedEnduserIds) cannot match either — the ONLY way
+ * they can be assigned is through the organization-wide path.
+ *
+ * E is the regression guard on the pre-existing no-`queueId` behavior, which must be unchanged.
+ *
+ * Cross-tenant (F) is covered because `buildOrganizationWideQueries` is bound to the caller's
+ * businessId: another tenant's queue is invisible even to an admin, who skips the membership check.
+ *
+ * `ticket_queues.count` is maintained by asynchronous side effects (increment on ticket create) and
+ * the decrement here is deliberately fire-and-forget, so every count read polls.
+ */
+
+// count is maintained by async side effects; give it a moment to settle before reading
+const poll_for = async <T,>(get: () => Promise<T>, done: (v: T) => boolean, attempts=20): Promise<T> => {
+  let value = await get()
+  for (let i = 0; i < attempts && !done(value); i++) {
+    await new Promise(resolve => setTimeout(resolve, 250))
+    value = await get()
+  }
+  return value
+}
+
+export const tickets_bulk_assign_from_queue_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+  let otherTenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+
+  try {
+    /* ================= fixtures ================= */
+
+    // users[1] joins the queue, users[2] deliberately does not (D2)
+    ;[tenant, otherTenant] = await Promise.all([
+      setup_isolated_tenant({
+        name: `BulkAssignQueue ${RAND()}`,
+        users: [{ isAdmin: true }, { roles: ['Non-Admin'] }, { roles: ['Non-Admin'] }],
+        apiKeys: 0,
+      }),
+      setup_isolated_tenant({
+        name: `BulkAssignQueue other ${RAND()}`,
+        users: [{ isAdmin: true }],
+        apiKeys: 0,
+      }),
+    ])
+
+    const { sdk, sdkNonAdmin } = tenant
+    const queueMember = tenant.users[1]
+    const outsider = tenant.users[2]
+
+    // a session for users[2] — setup_isolated_tenant only builds sessions for users[0] and users[1]
+    const sdkOutsider = new Session({ host, authToken: outsider.authToken })
+    await sdkOutsider.refresh_session()
+
+    const owner = await sdk.api.users.createOne({
+      email: `dontsend-bulk-assign-queue-${RAND()}@tellescope.com`,
+      fname: 'BulkAssign', lname: 'QueueOwner',
+      verifiedEmail: true,
+    })
+
+    const queue = await sdk.api.ticket_queues.createOne({
+      title: `Bulk Assign Queue ${RAND()}`,
+      userIds: [owner.id, queueMember.id], // outsider is NOT a member
+    })
+
+    const enduser = await sdk.api.endusers.createOne({ fname: 'BulkAssign', lname: 'QueuePatient' })
+
+    // A/B/C fixtures — one carries an enduser so care team behavior is exercised alongside dequeue
+    const queued1 = await sdk.api.tickets.createOne({ title: 'BAQ 1', enduserId: enduser.id, queueId: queue.id })
+    const queued2 = await sdk.api.tickets.createOne({ title: 'BAQ 2', queueId: queue.id })
+
+    const countBefore = await poll_for(
+      () => sdk.api.ticket_queues.getOne(queue.id).then(q => q.count ?? 0),
+      c => c === 2,
+    )
+    record(
+      'setup: queue count reflects both queued tickets',
+      countBefore === 2,
+      `count=${countBefore} (want 2); queue=${queue.id}`,
+    )
+
+    /* ===== A: the dequeue bookkeeping ===== */
+
+    const assignResult = await sdk.api.tickets.bulk_assign({
+      ids: [queued1.id, queued2.id], userId: owner.id, queueId: queue.id, addToCareTeam: true,
+    })
+    record(
+      'A1: reports both tickets assigned and none skipped',
+      assignResult.assigned === 2 && assignResult.skipped === 0,
+      `assigned=${assignResult.assigned} skipped=${assignResult.skipped} (want 2 / 0)`,
+    )
+
+    const after1 = await sdk.api.tickets.getOne(queued1.id)
+    record(
+      'A2: ticket left the queue with owner and dequeue provenance set',
+      !after1.queueId && after1.owner === owner.id && !!after1.dequeuedAt && after1.dequeuedFrom === queue.id,
+      `queueId=${JSON.stringify(after1.queueId)} owner=${after1.owner} dequeuedAt=${JSON.stringify(after1.dequeuedAt)} dequeuedFrom=${after1.dequeuedFrom}`,
+    )
+
+    const countAfter = await poll_for(
+      () => sdk.api.ticket_queues.getOne(queue.id).then(q => q.count ?? 0),
+      c => c === 0,
+    )
+    record(
+      'A3: queue count decremented by the number assigned',
+      countAfter === 0,
+      `count=${countAfter} (want 0, was ${countBefore})`,
+    )
+
+    record(
+      'A4: addToCareTeam adds the new owner to the ticket enduser\'s care team',
+      !!(await sdk.api.endusers.getOne(enduser.id)).assignedTo?.includes(owner.id),
+      `assignedTo must contain ${owner.id}`,
+    )
+
+    /* ===== B: ids no longer in the queue are skipped, not re-assigned ===== */
+
+    const replayResult = await sdk.api.tickets.bulk_assign({
+      ids: [queued1.id, queued2.id], userId: owner.id, queueId: queue.id,
+    })
+    record(
+      'B1: already-dequeued ids are reported as skipped',
+      replayResult.assigned === 0 && replayResult.skipped === 2,
+      `assigned=${replayResult.assigned} skipped=${replayResult.skipped} (want 0 / 2)`,
+    )
+
+    const countAfterReplay = await sdk.api.ticket_queues.getOne(queue.id).then(q => q.count ?? 0)
+    record(
+      'B2: queue count is not decremented again when nothing was assigned',
+      countAfterReplay === 0,
+      `count=${countAfterReplay} (want 0 — a decrement here would drive it negative)`,
+    )
+
+    /* ===== C: the queue scope is honored ===== */
+
+    const otherQueue = await sdk.api.ticket_queues.createOne({
+      title: `Bulk Assign Other Queue ${RAND()}`,
+      userIds: [owner.id],
+    })
+    const inOtherQueue = await sdk.api.tickets.createOne({ title: 'BAQ other queue', queueId: otherQueue.id })
+
+    const wrongQueueResult = await sdk.api.tickets.bulk_assign({
+      ids: [inOtherQueue.id], userId: owner.id, queueId: queue.id,
+    })
+    const stillInOther = await sdk.api.tickets.getOne(inOtherQueue.id)
+    record(
+      'C1: a ticket in a different queue is not assigned when the wrong queueId is passed',
+      wrongQueueResult.assigned === 0 && stillInOther.queueId === otherQueue.id && !stillInOther.owner,
+      `assigned=${wrongQueueResult.assigned} (want 0); ticket queueId=${stillInOther.queueId} owner=${JSON.stringify(stillInOther.owner)}`,
+    )
+
+    /* ===== D: the organization-wide path, and its gate ===== */
+
+    // NO enduserId: the 'Assigned' role filter cannot match these by owner, creator, or enduser,
+    // so they are assignable only through the organization-wide queries
+    const forMember1 = await sdk.api.tickets.createOne({ title: 'BAQ member 1', queueId: queue.id })
+    const forMember2 = await sdk.api.tickets.createOne({ title: 'BAQ member 2', queueId: queue.id })
+
+    const memberResult = await sdkNonAdmin.api.tickets.bulk_assign({
+      ids: [forMember1.id, forMember2.id], userId: owner.id, queueId: queue.id,
+    }).then(r => r).catch((e: any) => ({ error: e?.message || String(e) } as any))
+
+    const memberAfter = await sdk.api.tickets.getOne(forMember1.id)
+    record(
+      'D1: a non-admin queue member can bulk assign queued tickets they do not own',
+      memberResult?.assigned === 2 && !memberAfter.queueId && memberAfter.owner === owner.id,
+      `result=${JSON.stringify(memberResult)}; ticket queueId=${JSON.stringify(memberAfter.queueId)} owner=${memberAfter.owner}`
+      + ` — 0 assigned here means the handler fell back to the owner-filtered DB`,
+    )
+
+    const forOutsider = await sdk.api.tickets.createOne({ title: 'BAQ outsider', queueId: queue.id })
+    const outsiderResult = await sdkOutsider.api.tickets.bulk_assign({
+      ids: [forOutsider.id], userId: outsider.id, queueId: queue.id,
+    }).then((r: any) => ({ resolved: r })).catch((e: any) => ({ rejected: e?.message || String(e) }))
+
+    const outsiderAfter = await sdk.api.tickets.getOne(forOutsider.id)
+    record(
+      'D2: a non-admin who is not a member of the queue is rejected',
+      !!(outsiderResult as any).rejected && outsiderAfter.queueId === queue.id && !outsiderAfter.owner,
+      `result=${JSON.stringify(outsiderResult)}; ticket queueId=${outsiderAfter.queueId} owner=${JSON.stringify(outsiderAfter.owner)}`,
+    )
+
+    /* ===== E: regression guard — the no-queueId path is unchanged ===== */
+
+    const stayQueued = await sdk.api.tickets.createOne({ title: 'BAQ not dequeued', queueId: queue.id })
+    const legacyResult = await sdk.api.tickets.bulk_assign({ ids: [stayQueued.id], userId: owner.id })
+    const stayedAfter = await sdk.api.tickets.getOne(stayQueued.id)
+    record(
+      'E1: without queueId the ticket is assigned but NOT dequeued',
+      legacyResult.assigned === 1 && stayedAfter.owner === owner.id
+        && stayedAfter.queueId === queue.id && !stayedAfter.dequeuedAt,
+      `assigned=${legacyResult.assigned}; owner=${stayedAfter.owner} queueId=${stayedAfter.queueId} dequeuedAt=${JSON.stringify(stayedAfter.dequeuedAt)}`,
+    )
+
+    // a ticket already owned by the target user is still "assigned", not counted as skipped
+    const repeatResult = await sdk.api.tickets.bulk_assign({ ids: [stayQueued.id], userId: owner.id })
+    record(
+      'E2: re-assigning to the same owner is not reported as skipped',
+      repeatResult.assigned === 1 && repeatResult.skipped === 0,
+      `assigned=${repeatResult.assigned} skipped=${repeatResult.skipped} (want 1 / 0 — matchedCount, not modifiedCount)`,
+    )
+
+    /* ===== F: another tenant's queue is invisible, even to an admin ===== */
+
+    const foreignResult = await otherTenant.sdk.api.tickets.bulk_assign({
+      ids: [forOutsider.id], userId: otherTenant.users[0].id, queueId: queue.id,
+    }).then((r: any) => ({ resolved: r })).catch((e: any) => ({ rejected: e?.message || String(e) }))
+
+    const foreignAfter = await sdk.api.tickets.getOne(forOutsider.id)
+    record(
+      'F1: another tenant cannot assign tickets out of this tenant\'s queue',
+      (foreignAfter.queueId === queue.id && !foreignAfter.owner)
+        && ((foreignResult as any).rejected || (foreignResult as any).resolved?.assigned === 0),
+      `result=${JSON.stringify(foreignResult)}; ticket queueId=${foreignAfter.queueId} owner=${JSON.stringify(foreignAfter.owner)}`,
+    )
+  } finally {
+    // Teardown BEFORE anything asserts — assert calls process.exit, which would strand these tenants.
+    for (const t of [tenant, otherTenant]) {
+      if (t) { try { await t.teardown() } catch (e) { console.error('teardown failed', e) } }
+    }
+  }
+
+  return checks
+}
+
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+export const tickets_bulk_assign_from_queue_tests = async () => {
+  assert_checks('Tickets bulk assign from queue', await tickets_bulk_assign_from_queue_checks())
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  tickets_bulk_assign_from_queue_tests()
+    .then(() => {
+      console.log("✅ Tickets bulk assign from queue test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Tickets bulk assign from queue test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/setup_isolated.ts

@@ -0,0 +1,170 @@
+import axios from "axios"
+
+import { assert, log_header } from "@tellescope/testing"
+
+import { Session } from "../sdk"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+/**
+ * Provisions a throwaway tenant for a test, via the API's /test-support endpoints.
+ *
+ * Why this exists alongside setup.ts: setup_tests authenticates two hand-seeded users named by
+ * TEST_EMAIL / NON_ADMIN_EMAIL against a hardcoded businessId, so running the suite requires a copy
+ * of someone's local database, and every test shares one tenant. This helper needs **no environment
+ * configuration at all** against a local API — clone, empty Mongo, run.
+ *
+ * setup.ts is deliberately untouched; existing tests keep the shared org. Use this for new tests.
+ *
+ * Isolated tests must NOT call sdk.reset_db(): it clears six global throttle namespaces, so it
+ * disturbs the rate-limit state of any concurrently running suite even though record data is
+ * tenant-scoped.
+ */
+
+const TEST_SUPPORT_HEADER = 'x-tellescope-test-support'
+
+export type IsolatedUser = {
+  id: string,
+  email: string,
+  password: string,
+  authToken: string,
+  roles: string[],
+}
+
+export type IsolatedTenant = {
+  businessId: string,
+  subdomain: string,
+  users: IsolatedUser[],
+  apiKeys: string[],
+  roles: string[],
+  /** Admin session (users[0]) */
+  sdk: Session,
+  /** Non-admin session (users[1]), when the spec provisioned one */
+  sdkNonAdmin: Session,
+  teardown: () => Promise<void>,
+}
+
+export type IsolatedTenantSpec = {
+  name?: string,
+  users?: { roles?: string[], isAdmin?: boolean }[],
+  apiKeys?: number,
+  roles?: { role: string, permissions?: any }[],
+}
+
+const post = async (path: string, body: object) => {
+  const r = await axios.request({
+    method: 'post',
+    url: `${host}/test-support${path}`,
+    // forwarded only if present — required on staging, unnecessary (and unset) locally
+    data: { ...body, ...(process.env.SERVICES_SECRET ? { servicesSecret: process.env.SERVICES_SECRET } : {}) },
+    headers: { [TEST_SUPPORT_HEADER]: '1' },
+    validateStatus: () => true,
+  })
+
+  if (r.status !== 200) {
+    // Surface the server's reason. setup.ts's bare process.exit() on missing credentials turns a
+    // misconfiguration into a silent green pass; a provisioning failure must be loud.
+    throw new Error(
+      `test-support ${path} failed (${r.status}): ${JSON.stringify(r.data)}`
+      + (r.status === 404
+        ? `\nThe route is not mounted — LOCAL is probably not "true" in the API's environment.`
+        : '')
+    )
+  }
+  return r.data
+}
+
+export const setup_isolated_tenant = async (spec: IsolatedTenantSpec = {}): Promise<IsolatedTenant> => {
+  const tenant = await post('/provision-tenant', spec)
+
+  const sessionFor = async (user?: IsolatedUser) => {
+    if (!user) return new Session({ host })
+    const session = new Session({ host, authToken: user.authToken })
+    await session.refresh_session()
+    return session
+  }
+
+  const [sdk, sdkNonAdmin] = await Promise.all([
+    sessionFor(tenant.users[0]),
+    sessionFor(tenant.users[1]),
+  ])
+
+  return {
+    ...tenant,
+    sdk,
+    sdkNonAdmin,
+    teardown: async () => { await post('/teardown-tenant', { businessId: tenant.businessId }) },
+  }
+}
+
+/** Sets the pending email-verification code for an unverified user, so a test can drive the real
+ *  submit_email_verification endpoint. The address must be a `dontsend...@tellescope.com` one. */
+export const set_email_verification_code = async (email: string, code: string) => (
+  post('/set-email-verification-code', { email, code })
+)
+
+/** Raw access, for tests that need to assert on the response of a rejected call. */
+export const test_support_request = async (path: string, body: object) => {
+  const r = await axios.request({
+    method: 'post',
+    url: `${host}/test-support${path}`,
+    data: { ...body, ...(process.env.SERVICES_SECRET ? { servicesSecret: process.env.SERVICES_SECRET } : {}) },
+    headers: { [TEST_SUPPORT_HEADER]: '1' },
+    validateStatus: () => true,
+  })
+  return { status: r.status, body: r.data }
+}
+
+/* ============================ isolated-test result plumbing ============================ */
+
+export type Check = { label: string, pass: boolean, detail: string }
+
+/** Prints a suite's evidence table, then asserts. Split out so the assert phase can be deferred until
+ *  after every concurrent suite has torn down — see run_isolated_in_parallel. */
+export const assert_checks = (name: string, checks: Check[]) => {
+  console.log(`\n  ${name} check summary:`)
+  for (const c of checks) {
+    console.log(`    ${c.pass ? 'PASS' : 'FAIL'}  ${c.label}  —  ${c.detail}`)
+  }
+  console.log('')
+
+  for (const c of checks) {
+    assert(c.pass, `${c.label} — ${c.detail}`, c.label)
+  }
+}
+
+/**
+ * Runs isolated test bodies CONCURRENTLY.
+ *
+ * Why this exists rather than a bare Promise.all: the harness's `assert` calls process.exit(1) on
+ * failure, and process.exit does not run pending `finally` blocks. So if one suite asserted while
+ * another was still in flight, the other's teardown would never run and its provisioned tenants would
+ * be stranded permanently (nothing in the system can delete an organization record). `assert` also
+ * exits rather than throwing, so Promise.allSettled cannot recover it either.
+ *
+ * The contract that makes concurrency safe: each `run` collects Check[] and tears down its OWN tenants
+ * in a finally, and never asserts. Nothing here asserts until every suite has settled.
+ *
+ * Each suite's table prints as one non-yielding burst, so concurrent output stays readable.
+ */
+export const run_isolated_in_parallel = async (
+  suites: { name: string, run: () => Promise<Check[]> }[],
+) => {
+  log_header(`Isolated (parallel): ${suites.map(s => s.name).join(' | ')}`)
+
+  const settled = await Promise.allSettled(suites.map(s => s.run()))
+
+  // Surface an infrastructure failure (a throw, not a failed check) before asserting anything, so the
+  // reason isn't buried under another suite's table.
+  const rejected = settled.flatMap((r, i) => r.status === 'rejected' ? [{ name: suites[i].name, reason: r.reason }] : [])
+  for (const { name, reason } of rejected) {
+    console.error(`  ${name} threw before producing checks:`, reason)
+  }
+  if (rejected.length) throw rejected[0].reason
+
+  for (let i = 0; i < settled.length; i++) {
+    const r = settled[i]
+    if (r.status !== 'fulfilled') continue
+    assert_checks(suites[i].name, r.value)
+  }
+}

package/src/tests/tests.ts

@@ -103,6 +103,7 @@ import { outbound_chat_sent_trigger_tests } from "./api_tests/outbound_chat_sent
 import { time_tracks_tests, time_tracks_historical_tests, time_tracks_correction_tests, time_tracks_review_tests, time_tracks_lock_tests, time_tracks_edge_case_tests, time_tracks_resubmit_tests, time_tracks_appointment_duration_tests } from "./api_tests/time_tracks.test";
 import { monthly_availability_restrictions_tests } from "./api_tests/monthly_availability_restrictions.test";
 import { calendar_event_limits_tests } from "./api_tests/calendar_event_limits.test";
+import { out_of_office_endpoint_tests } from "./api_tests/out_of_office_endpoint.test";
 import { appointment_link_expiration_tests } from "./api_tests/appointment_link_expiration.test";
 import { custom_aggregation_tests } from "./api_tests/custom_aggregation.test";
 import { chats_analytics_tests } from "./api_tests/chats_analytics.test";
@@ -134,6 +135,10 @@ import { proxy_image_ssrf_tests } from "./api_tests/security/F-0025-proxy-image-
 import { webhook_outbound_ssrf_tests } from "./api_tests/security/F-0015-webhook-outbound-ssrf.test";
 import { public_endpoint_auth_field_lock_tests } from "./api_tests/security/public_endpoint_auth_field_lock.test";
 import { formsort_webhook_auth_field_lock_tests } from "./api_tests/security/formsort_webhook_auth_field_lock.test";
+import { booking_info_idor_tests } from "./api_tests/security/F-0179-booking-info-idor-token-mint.test";
+import { automated_actions_process_gate_tests } from "./api_tests/security/F-0192-automated-actions-process-gate.test";
+import { schema_adminonly_enforcement_tests } from "./api_tests/security/F-0191-schema-adminonly-enforcement.test";
+import { startlinktoken_escalation_tests } from "./api_tests/security/F-0185-startlinktoken-enduser-staff-escalation.test";
 import { bulk_assignment_tests } from "./api_tests/bulk_assignment.test";
 import { tickets_bulk_assign_care_team_tests } from "./api_tests/tickets_bulk_assign_care_team.test";
 import { managed_content_enduser_access_tests } from "./api_tests/managed_content_enduser_access.test";
@@ -151,6 +156,12 @@ import { dont_sync_to_elation_form_submission_tests } from "./api_tests/dont_syn
 import { medication_added_trigger_tests } from "./api_tests/medication_added_trigger.test";
 import { conditional_logic_medication_unit_tests } from "./unit_tests/conditional_logic_medication.test";
 import { phone_validation_unit_tests } from "./unit_tests/phone_validation.test";
+import { openapi_spec_freshness_unit_tests } from "./unit_tests/openapi_spec_freshness.test";
+import { do_not_send_address_unit_tests } from "./unit_tests/do_not_send_address.test";
+import { organization_signup_checks } from "./api_tests/organization_signup.test";
+import { add_to_journey_foreign_enduserid_checks } from "./api_tests/security/F-0196-add-to-journey-foreign-enduserid.test";
+import { tickets_bulk_assign_from_queue_checks } from "./api_tests/tickets_bulk_assign_from_queue.test";
+import { run_isolated_in_parallel } from "./setup_isolated";
 import { elation_user_id_tests } from "./api_tests/elation_user_id.test";
 import { organization_settings_duplicates_tests } from "./api_tests/organization_settings_duplicates.test";
 import { stedi_approval_tests } from "./api_tests/stedi_approval.test";
@@ -15362,11 +15373,22 @@ const ip_address_form_tests = async () => {
     await enduser_conditional_logic_tests()
     await conditional_logic_medication_unit_tests()
     await phone_validation_unit_tests()
+    await openapi_spec_freshness_unit_tests()
+    await do_not_send_address_unit_tests()
     await replace_enduser_template_values_tests()
     await safe_json_parse_template_tests()
     await replace_form_field_template_values_tests()
     await mfa_tests()
     await setup_tests(sdk, sdkNonAdmin)
+    // Isolated, tenant-provisioned suites run first and CONCURRENTLY: each provisions its own
+    // throwaway tenant via /test-support, so they cannot collide with each other or with the
+    // shared fixture. Both collect Check[] and tear down before anything asserts — assert calls
+    // process.exit, which would otherwise strand the other suite's tenants.
+    await run_isolated_in_parallel([
+      { name: 'Organization signup', run: organization_signup_checks },
+      { name: 'F-0196 add_to_journey foreign enduserId', run: add_to_journey_foreign_enduserid_checks },
+      { name: 'Tickets bulk assign from queue', run: tickets_bulk_assign_from_queue_checks },
+    ])
     await embeddables_auth_token_tests({ sdk, sdkNonAdmin })
     await proxy_image_ssrf_tests({ sdk, sdkNonAdmin })
     await webhook_outbound_ssrf_tests({ sdk, sdkNonAdmin })
@@ -15386,6 +15408,10 @@ const ip_address_form_tests = async () => {
     await enduser_write_restrictions_tests({ sdk, sdkNonAdmin })
     await enduser_ai_summary_trust_gate_tests({ sdk, sdkNonAdmin })
     await enduser_cross_create_tests({ sdk, sdkNonAdmin })
+    await booking_info_idor_tests({ sdk, sdkNonAdmin })
+    await automated_actions_process_gate_tests({ sdk, sdkNonAdmin })
+    await schema_adminonly_enforcement_tests({ sdk, sdkNonAdmin })
+    await startlinktoken_escalation_tests({ sdk, sdkNonAdmin })
     await globalunique_leak_tests({ sdk, sdkNonAdmin })
     await load_inbox_redaction_tests({ sdk, sdkNonAdmin })
     await suggested_reply_redaction_tests({ sdk, sdkNonAdmin })
@@ -15446,6 +15472,7 @@ const ip_address_form_tests = async () => {
     await time_tracks_resubmit_tests({ sdk, sdkNonAdmin })
     await time_tracks_appointment_duration_tests({ sdk, sdkNonAdmin })
     await calendar_event_limits_tests({ sdk, sdkNonAdmin })
+    await out_of_office_endpoint_tests({ sdk, sdkNonAdmin })
     await appointment_link_expiration_tests({ sdk, sdkNonAdmin })
     await get_some_projection_tests({ sdk, sdkNonAdmin })
     await file_download_unicode_names_tests({ sdk, sdkNonAdmin })

package/src/tests/unit_tests/do_not_send_address.test.ts

@@ -0,0 +1,60 @@
+require('source-map-support').install();
+
+import {
+  assert,
+  log_header,
+} from "@tellescope/testing"
+
+/**
+ * The email-suppression predicate from packages/private/api/api/modules/sqs.ts.
+ *
+ * Mirrored here rather than imported: the API is a private package the SDK does not depend on. The
+ * point of the test is to pin the CONTRACT — prefix AND domain both required — because the guard is
+ * otherwise unobservable from a test (a suppressed message simply never reaches SQS), and because
+ * loosening it in either direction would start suppressing real mail or start sending test mail.
+ *
+ * If this drifts from sqs.ts, that is the signal to look at why.
+ */
+const is_do_not_send_address = (emailAddress?: string) => (
+  !!emailAddress && emailAddress.endsWith('@tellescope.com') && emailAddress.startsWith('dontsend')
+)
+
+export const do_not_send_address_unit_tests = async () => {
+  log_header("Do-not-send address predicate")
+
+  const cases: [string | undefined, boolean, string][] = [
+    ['dontsend@tellescope.com', true, 'exact prefix and domain'],
+    ['dontsend-signup-ab12@tellescope.com', true, 'suffixed local part (what provisioning generates)'],
+    ['dontsend3@tellescope.com', true, 'numbered variant already used by the suite'],
+
+    // near misses — both halves are load-bearing
+    ['dontsend@example.com', false, 'right prefix, wrong domain: must NOT suppress'],
+    ['realuser@tellescope.com', false, 'right domain, wrong prefix: must NOT suppress'],
+    ['notdontsend@tellescope.com', false, 'prefix must be at the START, not anywhere'],
+    ['dontsend@tellescope.com.evil.com', false, 'domain must be a suffix, not a substring'],
+
+    [undefined, false, 'undefined is not suppressed (and must not throw)'],
+    ['', false, 'empty string is not suppressed'],
+  ]
+
+  for (const [input, expected, why] of cases) {
+    assert(
+      is_do_not_send_address(input) === expected,
+      `${JSON.stringify(input)} should be ${expected ? 'suppressed' : 'sent'} — ${why}`,
+      `${JSON.stringify(input)} -> ${expected ? 'suppressed' : 'sent'} (${why})`,
+    )
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  do_not_send_address_unit_tests()
+    .then(() => {
+      console.log("✅ Do-not-send address predicate tests completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Do-not-send address predicate tests failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/unit_tests/openapi_spec_freshness.test.ts

@@ -0,0 +1,88 @@
+require('source-map-support').install();
+
+import * as fs from "fs"
+import * as os from "os"
+import * as path from "path"
+import { execFileSync } from "child_process"
+
+import {
+  assert,
+  log_header,
+} from "@tellescope/testing"
+
+/**
+ * Guard: packages/public/schema/openapi.json must match what the generator currently produces.
+ *
+ * The spec is git-tracked AND published inside @tellescope/schema (no `files` field, and the
+ * .npmignore covers only set_vars.sh), but nothing in the build or CI regenerates it. It had
+ * therefore drifted several commits behind schema.ts — which mattered because `adminOnly` is
+ * rendered into the spec as an "**Admin only.**" description prefix, so the published docs were
+ * advertising gates that had changed. That drift is the doc half of F-0191; the runtime half was
+ * fixed by making getCustomEndpointFields fall back to the schema flag.
+ *
+ * The generator is byte-deterministic (date `getExample`s are pinned in validation.ts precisely so
+ * this comparison is possible), so an exact match is a fair assertion.
+ *
+ * If this fails: cd packages/public/schema && node lib/cjs/generate-openapi.js ./openapi.json
+ */
+export const openapi_spec_freshness_unit_tests = async () => {
+  log_header("OpenAPI spec freshness")
+
+  // resolve the schema package from its manifest, so this works regardless of hoisting
+  const schemaPkgJson = require.resolve('@tellescope/schema/package.json')
+  const schemaRoot = path.dirname(schemaPkgJson)
+  const generator = path.join(schemaRoot, 'lib', 'cjs', 'generate-openapi.js')
+  const committed = path.join(schemaRoot, 'openapi.json')
+
+  // Don't fail the suite for a stale/absent build — that is a build problem, not spec drift.
+  if (!fs.existsSync(generator)) {
+    console.log(`  SKIPPED: generator not built at ${generator} (run ./build_cjs.sh)`)
+    return
+  }
+  assert(fs.existsSync(committed), `openapi.json missing at ${committed}`, 'openapi.json is present')
+
+  const tmp = path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'openapi-freshness-')), 'openapi.json')
+  try {
+    execFileSync('node', [generator, tmp], { stdio: 'pipe' })
+
+    const regenerated = fs.readFileSync(tmp, 'utf8')
+    const onDisk = fs.readFileSync(committed, 'utf8')
+
+    if (regenerated !== onDisk) {
+      // a line count is far more useful than a 6000-line dump
+      const a = regenerated.split('\n')
+      const b = onDisk.split('\n')
+      const firstDiff = a.findIndex((line, i) => line !== b[i])
+      console.log(
+        `  regenerated ${a.length} lines vs committed ${b.length} lines;`
+        + ` first difference at line ${firstDiff + 1}`
+      )
+      if (firstDiff >= 0) {
+        console.log(`    committed:   ${(b[firstDiff] ?? '<missing>').trim().slice(0, 160)}`)
+        console.log(`    regenerated: ${(a[firstDiff] ?? '<missing>').trim().slice(0, 160)}`)
+      }
+    }
+
+    assert(
+      regenerated === onDisk,
+      'openapi.json is stale — regenerate it: '
+        + 'cd packages/public/schema && node lib/cjs/generate-openapi.js ./openapi.json',
+      'openapi.json matches the generator output',
+    )
+  } finally {
+    try { fs.rmSync(path.dirname(tmp), { recursive: true, force: true }) } catch {}
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  openapi_spec_freshness_unit_tests()
+    .then(() => {
+      console.log("✅ OpenAPI spec freshness test completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ OpenAPI spec freshness test failed:", error)
+      process.exit(1)
+    })
+}