@tellescope/sdk 1.256.13 → 1.256.14

package/lib/esm/tests/api_tests/security/F-0196-add-to-journey-foreign-enduserid.test.js

@@ -0,0 +1,277 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+require('source-map-support').install();
+import { assert_checks, setup_isolated_tenant, } from "../../setup_isolated";
+var host = process.env.API_URL || 'http://localhost:8080';
+var RAND = function () { return Math.random().toString(36).slice(2, 10); };
+// far enough out that a locally running worker never claims the rows we inspect
+var FUTURE_START = function () { return new Date(Date.now() + 60 * 60 * 1000); };
+/**
+ * Regression test for F-0196
+ * (security-audit/findings/F-0196-add-to-journey-plants-foreign-enduserid.md).
+ *
+ * `endusers.add_to_journey` inserted an `automated_actions` row for EACH caller-supplied `enduserId`
+ * with only mongoId-shape validation and no tenant-membership check. The preceding
+ * `DB.endusers.updateMany` is scoped but its result was discarded, and
+ * `DB.automated_actions.insertMany` is a direct write that bypasses the `ensureValidDependentKeys`
+ * foreign-key check the generic CRUD route gets. The resulting row is stamped
+ * `businessId: <caller's tenant>` while carrying `enduserId: <a victim in another tenant>`.
+ *
+ * The worker then dereferences that enduser with the raw driver and no `businessId`
+ * (worker/modules/automations.ts, the F-0074/F-0111/F-0159 family), so the victim's record loads
+ * under the attacker's automation: `pushFormsToPortal` copies the victim's PHI into the attacker's
+ * `form_responses` (readable by their staff) and `iterableCustomEvent` writes an attacker-authored
+ * note into the victim's chart. F-0196 is the reachability that made those three exploitable.
+ *
+ * There are TWO independent plant sites and a fix to only one is a half fix:
+ *   - inline branch, taken when `automationStepId` is supplied (api.ts add_to_journey handler)
+ *   - module branch, taken when it is not: `handle_automation_event`'s
+ *     `validEnduserIds = conditionsQuery ? <scoped find> : event.enduserIds` passes caller ids
+ *     straight through for a step with NO conditions.
+ * Both are covered below (A1/A2).
+ *
+ * Design notes:
+ *   - Two provisioned tenants, so the victim is a real foreign enduser and we can also assert their
+ *     record was not mutated. Both must come from provisioning: `add_to_journey` is
+ *     `requiresSubscription: true`, and a `create_and_join` org is born with an expired subscription.
+ *   - The steps use `setEnduserStatus` — no vendor, no Bedrock — and `startAt` is an hour out so a
+ *     running worker cannot process the rows before we read them.
+ *   - `throttle` is deliberately omitted: it is the only way add_to_journey's per-pair rate limit can
+ *     throw.
+ *   - Everything is observable through `automated_actions` reads, so the worker is never needed.
+ *
+ * RED (pre-fix): A1, A2 and B2 fail — the victim's id appears in the attacker tenant's
+ * automated_actions. GREEN (post-fix): the foreign id is silently dropped and the caller's own
+ * endusers still enroll normally.
+ */
+export var add_to_journey_foreign_enduserid_checks = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var checks, record, attacker, victimTenant, victim, own, makeJourney, inline, modulePath, mixed, rowsFor_1, enduserIdsFor, inlineResult, inlineIds, moduleResult, moduleIds, victimAfter, victimJourneys, inlineOwn, moduleOwn, mixedResult, mixedIds, _i, _a, t, e_1;
+    var _b;
+    var _c;
+    return __generator(this, function (_d) {
+        switch (_d.label) {
+            case 0:
+                checks = [];
+                record = function (label, pass, detail) { return checks.push({ label: label, pass: pass, detail: detail }); };
+                _d.label = 1;
+            case 1:
+                _d.trys.push([1, , 19, 26]);
+                /* ================= fixtures: two isolated tenants ================= */
+                ;
+                return [4 /*yield*/, Promise.all([
+                        setup_isolated_tenant({ name: "F0196 attacker ".concat(RAND()), users: [{ isAdmin: true }], apiKeys: 0 }),
+                        setup_isolated_tenant({ name: "F0196 victim ".concat(RAND()), users: [{ isAdmin: true }], apiKeys: 0 }),
+                    ])];
+            case 2:
+                _b = _d.sent(), attacker = _b[0], victimTenant = _b[1];
+                return [4 /*yield*/, victimTenant.sdk.api.endusers.createOne({ fname: 'F0196', lname: 'Victim' })];
+            case 3:
+                victim = _d.sent();
+                return [4 /*yield*/, attacker.sdk.api.endusers.createOne({ fname: 'F0196', lname: 'OwnPatient' })];
+            case 4:
+                own = _d.sent();
+                record('setup: two separate tenants, victim belongs to the other one', attacker.businessId !== victimTenant.businessId && !!victim.id && !!own.id, "attacker=".concat(attacker.businessId, " victim tenant=").concat(victimTenant.businessId, " victimEnduser=").concat(victim.id));
+                makeJourney = function (title) { return __awaiter(void 0, void 0, void 0, function () {
+                    var journey, step;
+                    return __generator(this, function (_a) {
+                        switch (_a.label) {
+                            case 0: return [4 /*yield*/, attacker.sdk.api.journeys.createOne({ title: "".concat(title, " ").concat(RAND()) })];
+                            case 1:
+                                journey = _a.sent();
+                                return [4 /*yield*/, attacker.sdk.api.automation_steps.createOne({
+                                        journeyId: journey.id,
+                                        // benign and worker-local: no vendor, no Bedrock. NO `conditions`, which is precisely the
+                                        // vulnerable branch in handle_automation_event.
+                                        action: { type: 'setEnduserStatus', info: { status: 'F0196' } },
+                                        events: [{ type: 'onJourneyStart', info: {} }],
+                                    })];
+                            case 2:
+                                step = _a.sent();
+                                return [2 /*return*/, { journey: journey, step: step }];
+                        }
+                    });
+                }); };
+                return [4 /*yield*/, makeJourney('F0196 inline')];
+            case 5:
+                inline = _d.sent();
+                return [4 /*yield*/, makeJourney('F0196 module')];
+            case 6:
+                modulePath = _d.sent();
+                return [4 /*yield*/, makeJourney('F0196 mixed')
+                    /** every automated_actions row the attacker tenant can see for a journey */
+                ];
+            case 7:
+                mixed = _d.sent();
+                rowsFor_1 = function (journeyId) { return __awaiter(void 0, void 0, void 0, function () {
+                    return __generator(this, function (_a) {
+                        switch (_a.label) {
+                            case 0: return [4 /*yield*/, attacker.sdk.api.automated_actions.getSome({ filter: { journeyId: journeyId } })];
+                            case 1: return [2 /*return*/, (_a.sent())];
+                        }
+                    });
+                }); };
+                enduserIdsFor = function (journeyId) { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                    switch (_a.label) {
+                        case 0: return [4 /*yield*/, rowsFor_1(journeyId)];
+                        case 1: return [2 /*return*/, (_a.sent()).map(function (r) { return r.enduserId; })
+                            /* ===== A: the foreign id must never be planted, on EITHER branch ===== */
+                            // A1 — inline branch: automationStepId supplied
+                        ];
+                    }
+                }); }); };
+                return [4 /*yield*/, attacker.sdk.api.endusers.add_to_journey({
+                        enduserIds: [victim.id],
+                        journeyId: inline.journey.id,
+                        automationStepId: inline.step.id,
+                        startAt: FUTURE_START(),
+                    }).then(function () { return 'resolved'; }).catch(function (e) { return "rejected: ".concat((e === null || e === void 0 ? void 0 : e.message) || e); })];
+            case 8:
+                inlineResult = _d.sent();
+                return [4 /*yield*/, enduserIdsFor(inline.journey.id)];
+            case 9:
+                inlineIds = _d.sent();
+                record('A1: inline branch (automationStepId) does not plant a foreign enduserId', !inlineIds.includes(victim.id), "call=".concat(inlineResult, "; automated_actions enduserIds=").concat(JSON.stringify(inlineIds), " (must not contain ").concat(victim.id, ")"));
+                return [4 /*yield*/, attacker.sdk.api.endusers.add_to_journey({
+                        enduserIds: [victim.id],
+                        journeyId: modulePath.journey.id,
+                        startAt: FUTURE_START(),
+                    }).then(function () { return 'resolved'; }).catch(function (e) { return "rejected: ".concat((e === null || e === void 0 ? void 0 : e.message) || e); })];
+            case 10:
+                moduleResult = _d.sent();
+                return [4 /*yield*/, enduserIdsFor(modulePath.journey.id)];
+            case 11:
+                moduleIds = _d.sent();
+                record('A2: module branch (no automationStepId) does not plant a foreign enduserId', !moduleIds.includes(victim.id), "call=".concat(moduleResult, "; automated_actions enduserIds=").concat(JSON.stringify(moduleIds), " (must not contain ").concat(victim.id, ")"));
+                return [4 /*yield*/, victimTenant.sdk.api.endusers.getOne(victim.id)];
+            case 12:
+                victimAfter = _d.sent();
+                victimJourneys = (_c = victimAfter === null || victimAfter === void 0 ? void 0 : victimAfter.journeys) !== null && _c !== void 0 ? _c : {};
+                record('A3: the victim enduser was not enrolled in the attacker\'s journey', !victimJourneys[inline.journey.id] && !victimJourneys[modulePath.journey.id], "victim journeys=".concat(JSON.stringify(victimJourneys)));
+                /* ===== B: legitimate use must keep working ===== */
+                // B1 — positive control on both branches, so a blanket failure can't masquerade as a fix
+                return [4 /*yield*/, attacker.sdk.api.endusers.add_to_journey({
+                        enduserIds: [own.id],
+                        journeyId: inline.journey.id,
+                        automationStepId: inline.step.id,
+                        startAt: FUTURE_START(),
+                    })];
+            case 13:
+                /* ===== B: legitimate use must keep working ===== */
+                // B1 — positive control on both branches, so a blanket failure can't masquerade as a fix
+                _d.sent();
+                return [4 /*yield*/, attacker.sdk.api.endusers.add_to_journey({
+                        enduserIds: [own.id],
+                        journeyId: modulePath.journey.id,
+                        startAt: FUTURE_START(),
+                    })];
+            case 14:
+                _d.sent();
+                return [4 /*yield*/, enduserIdsFor(inline.journey.id)];
+            case 15:
+                inlineOwn = _d.sent();
+                return [4 /*yield*/, enduserIdsFor(modulePath.journey.id)];
+            case 16:
+                moduleOwn = _d.sent();
+                record('B1: the caller\'s OWN enduser still enrolls on both branches', inlineOwn.includes(own.id) && moduleOwn.includes(own.id), "inline=".concat(JSON.stringify(inlineOwn), " module=").concat(JSON.stringify(moduleOwn), " (both must contain ").concat(own.id, ")"));
+                return [4 /*yield*/, attacker.sdk.api.endusers.add_to_journey({
+                        enduserIds: [own.id, victim.id],
+                        journeyId: mixed.journey.id,
+                        automationStepId: mixed.step.id,
+                        startAt: FUTURE_START(),
+                    }).then(function () { return 'resolved'; }).catch(function (e) { return "rejected: ".concat((e === null || e === void 0 ? void 0 : e.message) || e); })];
+            case 17:
+                mixedResult = _d.sent();
+                return [4 /*yield*/, enduserIdsFor(mixed.journey.id)];
+            case 18:
+                mixedIds = _d.sent();
+                record('B2: a mixed list enrolls the visible enduser and drops only the foreign one', mixedIds.includes(own.id) && !mixedIds.includes(victim.id), "call=".concat(mixedResult, "; enduserIds=").concat(JSON.stringify(mixedIds), " (want ").concat(own.id, ", not ").concat(victim.id, ")"));
+                return [3 /*break*/, 26];
+            case 19:
+                _i = 0, _a = [attacker, victimTenant];
+                _d.label = 20;
+            case 20:
+                if (!(_i < _a.length)) return [3 /*break*/, 25];
+                t = _a[_i];
+                if (!t) return [3 /*break*/, 24];
+                _d.label = 21;
+            case 21:
+                _d.trys.push([21, 23, , 24]);
+                return [4 /*yield*/, t.teardown()];
+            case 22:
+                _d.sent();
+                return [3 /*break*/, 24];
+            case 23:
+                e_1 = _d.sent();
+                console.error('teardown failed', e_1);
+                return [3 /*break*/, 24];
+            case 24:
+                _i++;
+                return [3 /*break*/, 20];
+            case 25: return [7 /*endfinally*/];
+            case 26: return [2 /*return*/, checks];
+        }
+    });
+}); };
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+export var add_to_journey_foreign_enduserid_tests = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var _a, _b;
+    return __generator(this, function (_c) {
+        switch (_c.label) {
+            case 0:
+                _a = assert_checks;
+                _b = ['F-0196 add_to_journey foreign enduserId'];
+                return [4 /*yield*/, add_to_journey_foreign_enduserid_checks()];
+            case 1:
+                _a.apply(void 0, _b.concat([_c.sent()]));
+                return [2 /*return*/];
+        }
+    });
+}); };
+// Allow running this test file independently
+if (require.main === module) {
+    console.log("\uD83C\uDF10 Using API URL: ".concat(host));
+    add_to_journey_foreign_enduserid_tests()
+        .then(function () {
+        console.log("✅ F-0196 add_to_journey foreign enduserId test suite completed successfully");
+        process.exit(0);
+    })
+        .catch(function (error) {
+        console.error("❌ F-0196 add_to_journey foreign enduserId test suite failed:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=F-0196-add-to-journey-foreign-enduserid.test.js.map

package/lib/esm/tests/api_tests/security/F-0196-add-to-journey-foreign-enduserid.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"F-0196-add-to-journey-foreign-enduserid.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/F-0196-add-to-journey-foreign-enduserid.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,OAAO,EACL,aAAa,EAEb,qBAAqB,GACtB,MAAM,sBAAsB,CAAA;AAE7B,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE,IAAM,IAAI,GAAG,cAAM,OAAA,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAvC,CAAuC,CAAA;AAE1D,gFAAgF;AAChF,IAAM,YAAY,GAAG,cAAM,OAAA,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,EAArC,CAAqC,CAAA;AAEhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,CAAC,IAAM,uCAAuC,GAAG;;;;;;;gBAC/C,MAAM,GAAY,EAAE,CAAA;gBACpB,MAAM,GAAG,UAAC,KAAa,EAAE,IAAa,EAAE,MAAc,IAAK,OAAA,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,OAAA,EAAE,IAAI,MAAA,EAAE,MAAM,QAAA,EAAE,CAAC,EAApC,CAAoC,CAAA;;;;gBAMnG,wEAAwE;gBAExE,CAAC;gBAA2B,qBAAM,OAAO,CAAC,GAAG,CAAC;wBAC5C,qBAAqB,CAAC,EAAE,IAAI,EAAE,yBAAkB,IAAI,EAAE,CAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;wBACnG,qBAAqB,CAAC,EAAE,IAAI,EAAE,uBAAgB,IAAI,EAAE,CAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;qBAClG,CAAC,EAAA;;gBAHD,KAA2B,SAG1B,EAHA,QAAQ,QAAA,EAAE,YAAY,QAAA,CAGtB;gBAEa,qBAAM,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAA;;gBAA3F,MAAM,GAAG,SAAkF;gBACrF,qBAAM,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAA;;gBAAxF,GAAG,GAAG,SAAkF;gBAE9F,MAAM,CACJ,8DAA8D,EAC9D,QAAQ,CAAC,UAAU,KAAK,YAAY,CAAC,UAAU,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,EAC1E,mBAAY,QAAQ,CAAC,UAAU,4BAAkB,YAAY,CAAC,UAAU,4BAAkB,MAAM,CAAC,EAAE,CAAE,CACtG,CAAA;gBAIK,WAAW,GAAG,UAAO,KAAa;;;;oCACtB,qBAAM,QAAS,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,UAAG,KAAK,cAAI,IAAI,EAAE,CAAE,EAAE,CAAC,EAAA;;gCAArF,OAAO,GAAG,SAA2E;gCAC9E,qBAAM,QAAS,CAAC,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,SAAS,CAAC;wCAC9D,SAAS,EAAE,OAAO,CAAC,EAAE;wCACrB,0FAA0F;wCAC1F,gDAAgD;wCAChD,MAAM,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE;wCAC/D,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;qCACxC,CAAC,EAAA;;gCANH,IAAI,GAAG,SAMJ;gCACT,sBAAO,EAAE,OAAO,SAAA,EAAE,IAAI,MAAA,EAAE,EAAA;;;qBACzB,CAAA;gBAEc,qBAAM,WAAW,CAAC,cAAc,CAAC,EAAA;;gBAA1C,MAAM,GAAG,SAAiC;gBAC7B,qBAAM,WAAW,CAAC,cAAc,CAAC,EAAA;;gBAA9C,UAAU,GAAG,SAAiC;gBACtC,qBAAM,WAAW,CAAC,aAAa,CAAC;oBAE9C,4EAA4E;kBAF9B;;gBAAxC,KAAK,GAAG,SAAgC;gBAGxC,YAAU,UAAO,SAAiB;;;oCACtC,qBAAM,QAAS,CAAC,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,WAAA,EAAE,EAAS,CAAC,EAAA;oCADxC,sBAAA,CAC3C,SAAmF,CACpF,EAAA;;;qBAAA,CAAA;gBACK,aAAa,GAAG,UAAO,SAAiB;;gCAAM,qBAAM,SAAO,CAAC,SAAS,CAAC,EAAA;gCAAzB,sBAAA,CAAC,SAAwB,CAAC,CAAC,GAAG,CAAC,UAAC,CAAM,IAAK,OAAA,CAAC,CAAC,SAAS,EAAX,CAAW,CAAC;4BAE1G,2EAA2E;4BAE3E,gDAAgD;0BAJ0D;;yBAAA,CAAA;gBAKrF,qBAAM,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC;wBAClE,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;wBACvB,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE;wBAC5B,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;wBAChC,OAAO,EAAE,YAAY,EAAE;qBACjB,CAAC,CAAC,IAAI,CAAC,cAAM,OAAA,UAAU,EAAV,CAAU,CAAC,CAAC,KAAK,CAAC,UAAC,CAAM,IAAK,OAAA,oBAAa,CAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,KAAI,CAAC,CAAE,EAA9B,CAA8B,CAAC,EAAA;;gBAL5E,YAAY,GAAG,SAK6D;gBAEhE,qBAAM,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAA;;gBAAlD,SAAS,GAAG,SAAsC;gBACxD,MAAM,CACJ,yEAAyE,EACzE,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAC9B,eAAQ,YAAY,4CAAkC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,gCAAsB,MAAM,CAAC,EAAE,MAAG,CAClH,CAAA;gBAGoB,qBAAM,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC;wBAClE,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;wBACvB,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE;wBAChC,OAAO,EAAE,YAAY,EAAE;qBACjB,CAAC,CAAC,IAAI,CAAC,cAAM,OAAA,UAAU,EAAV,CAAU,CAAC,CAAC,KAAK,CAAC,UAAC,CAAM,IAAK,OAAA,oBAAa,CAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,KAAI,CAAC,CAAE,EAA9B,CAA8B,CAAC,EAAA;;gBAJ5E,YAAY,GAAG,SAI6D;gBAEhE,qBAAM,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,EAAA;;gBAAtD,SAAS,GAAG,SAA0C;gBAC5D,MAAM,CACJ,4EAA4E,EAC5E,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAC9B,eAAQ,YAAY,4CAAkC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,gCAAsB,MAAM,CAAC,EAAE,MAAG,CAClH,CAAA;gBAGmB,qBAAM,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAA;;gBAAnE,WAAW,GAAG,SAAqD;gBACnE,cAAc,GAAG,MAAC,WAAmB,aAAnB,WAAW,uBAAX,WAAW,CAAU,QAAQ,mCAAI,EAAE,CAAA;gBAC3D,MAAM,CACJ,oEAAoE,EACpE,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,EAC5E,0BAAmB,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAE,CACpD,CAAA;gBAED,qDAAqD;gBAErD,yFAAyF;gBACzF,qBAAM,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC;wBAC7C,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;wBACpB,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE;wBAC5B,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;wBAChC,OAAO,EAAE,YAAY,EAAE;qBACjB,CAAC,EAAA;;gBART,qDAAqD;gBAErD,yFAAyF;gBACzF,SAKS,CAAA;gBACT,qBAAM,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC;wBAC7C,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;wBACpB,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE;wBAChC,OAAO,EAAE,YAAY,EAAE;qBACjB,CAAC,EAAA;;gBAJT,SAIS,CAAA;gBAES,qBAAM,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAA;;gBAAlD,SAAS,GAAG,SAAsC;gBACtC,qBAAM,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,EAAA;;gBAAtD,SAAS,GAAG,SAA0C;gBAC5D,MAAM,CACJ,8DAA8D,EAC9D,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EACxD,iBAAU,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,qBAAW,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,iCAAuB,GAAG,CAAC,EAAE,MAAG,CACxG,CAAA;gBAImB,qBAAM,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC;wBACjE,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC;wBAC/B,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE;wBAC3B,gBAAgB,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE;wBAC/B,OAAO,EAAE,YAAY,EAAE;qBACjB,CAAC,CAAC,IAAI,CAAC,cAAM,OAAA,UAAU,EAAV,CAAU,CAAC,CAAC,KAAK,CAAC,UAAC,CAAM,IAAK,OAAA,oBAAa,CAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,KAAI,CAAC,CAAE,EAA9B,CAA8B,CAAC,EAAA;;gBAL5E,WAAW,GAAG,SAK8D;gBAEjE,qBAAM,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,EAAA;;gBAAhD,QAAQ,GAAG,SAAqC;gBACtD,MAAM,CACJ,6EAA6E,EAC7E,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAC1D,eAAQ,WAAW,0BAAgB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,oBAAU,GAAG,CAAC,EAAE,mBAAS,MAAM,CAAC,EAAE,MAAG,CACjG,CAAA;;;sBAIuC,EAAxB,MAAC,QAAQ,EAAE,YAAY,CAAC;;;qBAAxB,CAAA,cAAwB,CAAA;gBAA7B,CAAC;qBACN,CAAC,EAAD,yBAAC;;;;gBAAU,qBAAM,CAAC,CAAC,QAAQ,EAAE,EAAA;;gBAAlB,SAAkB,CAAA;;;;gBAAe,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,GAAC,CAAC,CAAA;;;gBADrE,IAAwB,CAAA;;;qBAK1C,sBAAO,MAAM,EAAA;;;KACd,CAAA;AAED,kFAAkF;AAClF,MAAM,CAAC,IAAM,sCAAsC,GAAG;;;;;gBACpD,KAAA,aAAa,CAAA;sBAAC,yCAAyC;gBAAE,qBAAM,uCAAuC,EAAE,EAAA;;gBAAxG,4BAAyD,SAA+C,GAAC,CAAA;;;;KAC1G,CAAA;AAED,6CAA6C;AAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,sCAAsC,EAAE;SACrC,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAA;QAC1F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,8DAA8D,EAAE,KAAK,CAAC,CAAA;QACpF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}

package/lib/esm/tests/api_tests/tickets_bulk_assign_from_queue.test.d.ts

@@ -0,0 +1,5 @@
+import { Check } from "../setup_isolated";
+export declare const tickets_bulk_assign_from_queue_checks: () => Promise<Check[]>;
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+export declare const tickets_bulk_assign_from_queue_tests: () => Promise<void>;
+//# sourceMappingURL=tickets_bulk_assign_from_queue.test.d.ts.map

package/lib/esm/tests/api_tests/tickets_bulk_assign_from_queue.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tickets_bulk_assign_from_queue.test.d.ts","sourceRoot":"","sources":["../../../../src/tests/api_tests/tickets_bulk_assign_from_queue.test.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,EAEN,MAAM,mBAAmB,CAAA;AAmD1B,eAAO,MAAM,qCAAqC,QAAa,QAAQ,KAAK,EAAE,CAyM7E,CAAA;AAED,kFAAkF;AAClF,eAAO,MAAM,oCAAoC,qBAEhD,CAAA"}

package/lib/esm/tests/api_tests/tickets_bulk_assign_from_queue.test.js

@@ -0,0 +1,324 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+require('source-map-support').install();
+import { Session } from "../../sdk";
+import { assert_checks, setup_isolated_tenant, } from "../setup_isolated";
+var host = process.env.API_URL || 'http://localhost:8080';
+var RAND = function () { return Math.random().toString(36).slice(2, 10); };
+/**
+ * Coverage for `tickets.bulk_assign` when a `queueId` is supplied — the bulk equivalent of
+ * `tickets.assign_from_queue`, added so a Ticket Queue's tickets can be checkbox-selected and handed
+ * to one user in a single call instead of one `assign_from_queue` round trip per ticket.
+ *
+ * Without `queueId` the endpoint only does `$set: { owner }`. That is insufficient for a QUEUED
+ * ticket: it would stay in the queue (still pullable by someone else), carry no dequeue provenance,
+ * and leave `ticket_queues.count` drifting upward forever. The queue branch therefore also unsets
+ * `queueId`, sets `dequeuedAt`/`dequeuedFrom`, and decrements the queue's count — the same
+ * bookkeeping `assign_from_queue` does for a single ticket. A/B/C below pin each of those.
+ *
+ * D is the check that actually justifies the handler's shape. The tickets model declares
+ * `constraints.access: [{ type: 'filter', field: 'owner' }]`, which the DB layer turns into
+ * `owner === self OR creator === self` for any non-`All` access. A queued ticket has no owner, and
+ * was typically created by someone else, so a non-admin queue manager's `DB.tickets.updateMany`
+ * matches NOTHING — the call would return 200 having assigned zero tickets, silently. The handler
+ * uses `buildOrganizationWideQueries` to get past that, exactly as `assign_from_queue` does, and
+ * re-adds the queue-membership check that those queries bypass. D1 proves the escape hatch works for
+ * a legitimate queue member; D2 proves it is still gated, and is the check that fails if someone
+ * later drops the membership check while keeping the organization-wide queries.
+ *
+ * A provisioned non-admin gets `tickets: ASSIGNED_AND_DEFAULT_ACCESS` (read/update = 'Assigned'),
+ * which is what makes D meaningful. The D tickets deliberately have NO enduserId, so the 'Assigned'
+ * role filter's other branch (enduserId in assignedEnduserIds) cannot match either — the ONLY way
+ * they can be assigned is through the organization-wide path.
+ *
+ * E is the regression guard on the pre-existing no-`queueId` behavior, which must be unchanged.
+ *
+ * Cross-tenant (F) is covered because `buildOrganizationWideQueries` is bound to the caller's
+ * businessId: another tenant's queue is invisible even to an admin, who skips the membership check.
+ *
+ * `ticket_queues.count` is maintained by asynchronous side effects (increment on ticket create) and
+ * the decrement here is deliberately fire-and-forget, so every count read polls.
+ */
+// count is maintained by async side effects; give it a moment to settle before reading
+var poll_for = function (get, done, attempts) {
+    if (attempts === void 0) { attempts = 20; }
+    return __awaiter(void 0, void 0, void 0, function () {
+        var value, i;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, get()];
+                case 1:
+                    value = _a.sent();
+                    i = 0;
+                    _a.label = 2;
+                case 2:
+                    if (!(i < attempts && !done(value))) return [3 /*break*/, 6];
+                    return [4 /*yield*/, new Promise(function (resolve) { return setTimeout(resolve, 250); })];
+                case 3:
+                    _a.sent();
+                    return [4 /*yield*/, get()];
+                case 4:
+                    value = _a.sent();
+                    _a.label = 5;
+                case 5:
+                    i++;
+                    return [3 /*break*/, 2];
+                case 6: return [2 /*return*/, value];
+            }
+        });
+    });
+};
+export var tickets_bulk_assign_from_queue_checks = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var checks, record, tenant, otherTenant, sdk_1, sdkNonAdmin, queueMember, outsider, sdkOutsider, owner, queue_1, enduser, queued1, queued2, countBefore, assignResult, after1, countAfter, _a, _b, replayResult, countAfterReplay, otherQueue, inOtherQueue, wrongQueueResult, stillInOther, forMember1, forMember2, memberResult, memberAfter, forOutsider, outsiderResult, outsiderAfter, stayQueued, legacyResult, stayedAfter, repeatResult, foreignResult, foreignAfter, _i, _c, t, e_1;
+    var _d;
+    var _e, _f;
+    return __generator(this, function (_g) {
+        switch (_g.label) {
+            case 0:
+                checks = [];
+                record = function (label, pass, detail) { return checks.push({ label: label, pass: pass, detail: detail }); };
+                _g.label = 1;
+            case 1:
+                _g.trys.push([1, , 33, 40]);
+                /* ================= fixtures ================= */
+                // users[1] joins the queue, users[2] deliberately does not (D2)
+                ;
+                return [4 /*yield*/, Promise.all([
+                        setup_isolated_tenant({
+                            name: "BulkAssignQueue ".concat(RAND()),
+                            users: [{ isAdmin: true }, { roles: ['Non-Admin'] }, { roles: ['Non-Admin'] }],
+                            apiKeys: 0,
+                        }),
+                        setup_isolated_tenant({
+                            name: "BulkAssignQueue other ".concat(RAND()),
+                            users: [{ isAdmin: true }],
+                            apiKeys: 0,
+                        }),
+                    ])];
+            case 2:
+                _d = _g.sent(), tenant = _d[0], otherTenant = _d[1];
+                sdk_1 = tenant.sdk, sdkNonAdmin = tenant.sdkNonAdmin;
+                queueMember = tenant.users[1];
+                outsider = tenant.users[2];
+                sdkOutsider = new Session({ host: host, authToken: outsider.authToken });
+                return [4 /*yield*/, sdkOutsider.refresh_session()];
+            case 3:
+                _g.sent();
+                return [4 /*yield*/, sdk_1.api.users.createOne({
+                        email: "dontsend-bulk-assign-queue-".concat(RAND(), "@tellescope.com"),
+                        fname: 'BulkAssign', lname: 'QueueOwner',
+                        verifiedEmail: true,
+                    })];
+            case 4:
+                owner = _g.sent();
+                return [4 /*yield*/, sdk_1.api.ticket_queues.createOne({
+                        title: "Bulk Assign Queue ".concat(RAND()),
+                        userIds: [owner.id, queueMember.id], // outsider is NOT a member
+                    })];
+            case 5:
+                queue_1 = _g.sent();
+                return [4 /*yield*/, sdk_1.api.endusers.createOne({ fname: 'BulkAssign', lname: 'QueuePatient' })
+                    // A/B/C fixtures — one carries an enduser so care team behavior is exercised alongside dequeue
+                ];
+            case 6:
+                enduser = _g.sent();
+                return [4 /*yield*/, sdk_1.api.tickets.createOne({ title: 'BAQ 1', enduserId: enduser.id, queueId: queue_1.id })];
+            case 7:
+                queued1 = _g.sent();
+                return [4 /*yield*/, sdk_1.api.tickets.createOne({ title: 'BAQ 2', queueId: queue_1.id })];
+            case 8:
+                queued2 = _g.sent();
+                return [4 /*yield*/, poll_for(function () { return sdk_1.api.ticket_queues.getOne(queue_1.id).then(function (q) { var _a; return (_a = q.count) !== null && _a !== void 0 ? _a : 0; }); }, function (c) { return c === 2; })];
+            case 9:
+                countBefore = _g.sent();
+                record('setup: queue count reflects both queued tickets', countBefore === 2, "count=".concat(countBefore, " (want 2); queue=").concat(queue_1.id));
+                return [4 /*yield*/, sdk_1.api.tickets.bulk_assign({
+                        ids: [queued1.id, queued2.id], userId: owner.id, queueId: queue_1.id, addToCareTeam: true,
+                    })];
+            case 10:
+                assignResult = _g.sent();
+                record('A1: reports both tickets assigned and none skipped', assignResult.assigned === 2 && assignResult.skipped === 0, "assigned=".concat(assignResult.assigned, " skipped=").concat(assignResult.skipped, " (want 2 / 0)"));
+                return [4 /*yield*/, sdk_1.api.tickets.getOne(queued1.id)];
+            case 11:
+                after1 = _g.sent();
+                record('A2: ticket left the queue with owner and dequeue provenance set', !after1.queueId && after1.owner === owner.id && !!after1.dequeuedAt && after1.dequeuedFrom === queue_1.id, "queueId=".concat(JSON.stringify(after1.queueId), " owner=").concat(after1.owner, " dequeuedAt=").concat(JSON.stringify(after1.dequeuedAt), " dequeuedFrom=").concat(after1.dequeuedFrom));
+                return [4 /*yield*/, poll_for(function () { return sdk_1.api.ticket_queues.getOne(queue_1.id).then(function (q) { var _a; return (_a = q.count) !== null && _a !== void 0 ? _a : 0; }); }, function (c) { return c === 0; })];
+            case 12:
+                countAfter = _g.sent();
+                record('A3: queue count decremented by the number assigned', countAfter === 0, "count=".concat(countAfter, " (want 0, was ").concat(countBefore, ")"));
+                _a = record;
+                _b = ['A4: addToCareTeam adds the new owner to the ticket enduser\'s care team'];
+                return [4 /*yield*/, sdk_1.api.endusers.getOne(enduser.id)];
+            case 13:
+                _a.apply(void 0, _b.concat([!!((_e = (_g.sent()).assignedTo) === null || _e === void 0 ? void 0 : _e.includes(owner.id)), "assignedTo must contain ".concat(owner.id)]));
+                return [4 /*yield*/, sdk_1.api.tickets.bulk_assign({
+                        ids: [queued1.id, queued2.id], userId: owner.id, queueId: queue_1.id,
+                    })];
+            case 14:
+                replayResult = _g.sent();
+                record('B1: already-dequeued ids are reported as skipped', replayResult.assigned === 0 && replayResult.skipped === 2, "assigned=".concat(replayResult.assigned, " skipped=").concat(replayResult.skipped, " (want 0 / 2)"));
+                return [4 /*yield*/, sdk_1.api.ticket_queues.getOne(queue_1.id).then(function (q) { var _a; return (_a = q.count) !== null && _a !== void 0 ? _a : 0; })];
+            case 15:
+                countAfterReplay = _g.sent();
+                record('B2: queue count is not decremented again when nothing was assigned', countAfterReplay === 0, "count=".concat(countAfterReplay, " (want 0 \u2014 a decrement here would drive it negative)"));
+                return [4 /*yield*/, sdk_1.api.ticket_queues.createOne({
+                        title: "Bulk Assign Other Queue ".concat(RAND()),
+                        userIds: [owner.id],
+                    })];
+            case 16:
+                otherQueue = _g.sent();
+                return [4 /*yield*/, sdk_1.api.tickets.createOne({ title: 'BAQ other queue', queueId: otherQueue.id })];
+            case 17:
+                inOtherQueue = _g.sent();
+                return [4 /*yield*/, sdk_1.api.tickets.bulk_assign({
+                        ids: [inOtherQueue.id], userId: owner.id, queueId: queue_1.id,
+                    })];
+            case 18:
+                wrongQueueResult = _g.sent();
+                return [4 /*yield*/, sdk_1.api.tickets.getOne(inOtherQueue.id)];
+            case 19:
+                stillInOther = _g.sent();
+                record('C1: a ticket in a different queue is not assigned when the wrong queueId is passed', wrongQueueResult.assigned === 0 && stillInOther.queueId === otherQueue.id && !stillInOther.owner, "assigned=".concat(wrongQueueResult.assigned, " (want 0); ticket queueId=").concat(stillInOther.queueId, " owner=").concat(JSON.stringify(stillInOther.owner)));
+                return [4 /*yield*/, sdk_1.api.tickets.createOne({ title: 'BAQ member 1', queueId: queue_1.id })];
+            case 20:
+                forMember1 = _g.sent();
+                return [4 /*yield*/, sdk_1.api.tickets.createOne({ title: 'BAQ member 2', queueId: queue_1.id })];
+            case 21:
+                forMember2 = _g.sent();
+                return [4 /*yield*/, sdkNonAdmin.api.tickets.bulk_assign({
+                        ids: [forMember1.id, forMember2.id], userId: owner.id, queueId: queue_1.id,
+                    }).then(function (r) { return r; }).catch(function (e) { return ({ error: (e === null || e === void 0 ? void 0 : e.message) || String(e) }); })];
+            case 22:
+                memberResult = _g.sent();
+                return [4 /*yield*/, sdk_1.api.tickets.getOne(forMember1.id)];
+            case 23:
+                memberAfter = _g.sent();
+                record('D1: a non-admin queue member can bulk assign queued tickets they do not own', (memberResult === null || memberResult === void 0 ? void 0 : memberResult.assigned) === 2 && !memberAfter.queueId && memberAfter.owner === owner.id, "result=".concat(JSON.stringify(memberResult), "; ticket queueId=").concat(JSON.stringify(memberAfter.queueId), " owner=").concat(memberAfter.owner)
+                    + " \u2014 0 assigned here means the handler fell back to the owner-filtered DB");
+                return [4 /*yield*/, sdk_1.api.tickets.createOne({ title: 'BAQ outsider', queueId: queue_1.id })];
+            case 24:
+                forOutsider = _g.sent();
+                return [4 /*yield*/, sdkOutsider.api.tickets.bulk_assign({
+                        ids: [forOutsider.id], userId: outsider.id, queueId: queue_1.id,
+                    }).then(function (r) { return ({ resolved: r }); }).catch(function (e) { return ({ rejected: (e === null || e === void 0 ? void 0 : e.message) || String(e) }); })];
+            case 25:
+                outsiderResult = _g.sent();
+                return [4 /*yield*/, sdk_1.api.tickets.getOne(forOutsider.id)];
+            case 26:
+                outsiderAfter = _g.sent();
+                record('D2: a non-admin who is not a member of the queue is rejected', !!outsiderResult.rejected && outsiderAfter.queueId === queue_1.id && !outsiderAfter.owner, "result=".concat(JSON.stringify(outsiderResult), "; ticket queueId=").concat(outsiderAfter.queueId, " owner=").concat(JSON.stringify(outsiderAfter.owner)));
+                return [4 /*yield*/, sdk_1.api.tickets.createOne({ title: 'BAQ not dequeued', queueId: queue_1.id })];
+            case 27:
+                stayQueued = _g.sent();
+                return [4 /*yield*/, sdk_1.api.tickets.bulk_assign({ ids: [stayQueued.id], userId: owner.id })];
+            case 28:
+                legacyResult = _g.sent();
+                return [4 /*yield*/, sdk_1.api.tickets.getOne(stayQueued.id)];
+            case 29:
+                stayedAfter = _g.sent();
+                record('E1: without queueId the ticket is assigned but NOT dequeued', legacyResult.assigned === 1 && stayedAfter.owner === owner.id
+                    && stayedAfter.queueId === queue_1.id && !stayedAfter.dequeuedAt, "assigned=".concat(legacyResult.assigned, "; owner=").concat(stayedAfter.owner, " queueId=").concat(stayedAfter.queueId, " dequeuedAt=").concat(JSON.stringify(stayedAfter.dequeuedAt)));
+                return [4 /*yield*/, sdk_1.api.tickets.bulk_assign({ ids: [stayQueued.id], userId: owner.id })];
+            case 30:
+                repeatResult = _g.sent();
+                record('E2: re-assigning to the same owner is not reported as skipped', repeatResult.assigned === 1 && repeatResult.skipped === 0, "assigned=".concat(repeatResult.assigned, " skipped=").concat(repeatResult.skipped, " (want 1 / 0 \u2014 matchedCount, not modifiedCount)"));
+                return [4 /*yield*/, otherTenant.sdk.api.tickets.bulk_assign({
+                        ids: [forOutsider.id], userId: otherTenant.users[0].id, queueId: queue_1.id,
+                    }).then(function (r) { return ({ resolved: r }); }).catch(function (e) { return ({ rejected: (e === null || e === void 0 ? void 0 : e.message) || String(e) }); })];
+            case 31:
+                foreignResult = _g.sent();
+                return [4 /*yield*/, sdk_1.api.tickets.getOne(forOutsider.id)];
+            case 32:
+                foreignAfter = _g.sent();
+                record('F1: another tenant cannot assign tickets out of this tenant\'s queue', (foreignAfter.queueId === queue_1.id && !foreignAfter.owner)
+                    && (foreignResult.rejected || ((_f = foreignResult.resolved) === null || _f === void 0 ? void 0 : _f.assigned) === 0), "result=".concat(JSON.stringify(foreignResult), "; ticket queueId=").concat(foreignAfter.queueId, " owner=").concat(JSON.stringify(foreignAfter.owner)));
+                return [3 /*break*/, 40];
+            case 33:
+                _i = 0, _c = [tenant, otherTenant];
+                _g.label = 34;
+            case 34:
+                if (!(_i < _c.length)) return [3 /*break*/, 39];
+                t = _c[_i];
+                if (!t) return [3 /*break*/, 38];
+                _g.label = 35;
+            case 35:
+                _g.trys.push([35, 37, , 38]);
+                return [4 /*yield*/, t.teardown()];
+            case 36:
+                _g.sent();
+                return [3 /*break*/, 38];
+            case 37:
+                e_1 = _g.sent();
+                console.error('teardown failed', e_1);
+                return [3 /*break*/, 38];
+            case 38:
+                _i++;
+                return [3 /*break*/, 34];
+            case 39: return [7 /*endfinally*/];
+            case 40: return [2 /*return*/, checks];
+        }
+    });
+}); };
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+export var tickets_bulk_assign_from_queue_tests = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var _a, _b;
+    return __generator(this, function (_c) {
+        switch (_c.label) {
+            case 0:
+                _a = assert_checks;
+                _b = ['Tickets bulk assign from queue'];
+                return [4 /*yield*/, tickets_bulk_assign_from_queue_checks()];
+            case 1:
+                _a.apply(void 0, _b.concat([_c.sent()]));
+                return [2 /*return*/];
+        }
+    });
+}); };
+// Allow running this test file independently
+if (require.main === module) {
+    console.log("\uD83C\uDF10 Using API URL: ".concat(host));
+    tickets_bulk_assign_from_queue_tests()
+        .then(function () {
+        console.log("✅ Tickets bulk assign from queue test suite completed successfully");
+        process.exit(0);
+    })
+        .catch(function (error) {
+        console.error("❌ Tickets bulk assign from queue test suite failed:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=tickets_bulk_assign_from_queue.test.js.map