@tellescope/sdk 1.256.13 → 1.256.15

package/lib/cjs/tests/api_tests/security/booking-info-idor-token-mint.test.js

@@ -0,0 +1,335 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.booking_info_idor_tests = void 0;
+require('source-map-support').install();
+var sdk_1 = require("../../../sdk");
+var testing_1 = require("@tellescope/testing");
+var setup_1 = require("../../setup");
+var host = process.env.API_URL || 'http://localhost:8080';
+var businessId = '60398b1131a295e64f084ff6';
+var RAND = function () { return Math.random().toString(36).slice(2, 10); };
+var VICTIM_STATE = 'CA';
+var ATTACKER_STATE_WRITE = 'NY';
+/**
+ * Regression test: `form_fields.booking_info` must not mint a booking token for another patient.
+ *
+ * `form_fields.booking_info` resolved its target patient as
+ * `DB.endusers.findById(enduserId || req.session.id)` with no ownership check for enduser
+ * sessions. The enduser DB branch builds the endusers collection with `enduserAccess: true`
+ * (database.ts), so a FOREIGN in-tenant id resolves — and the handler then writes
+ * `enduserFields.state` onto that record and calls `login_enduser` with
+ * `sessionScopes: ['appointment-booking']`, returning a live 24h token for the victim inside
+ * `bookingURL`. booking_info is enduser-callable AND granted to the 'public-form' scope, so a
+ * portal patient or an anonymous form-filler could mint a working session as any co-tenant patient.
+ *
+ * The fix mirrors `prepare_form_response` (api.ts): reject when an enduser session supplies an
+ * `enduserId` other than its own, before the booking-page lookup and before the `state` write.
+ *
+ * RED (pre-fix): A1 and A2 fail — the exploit returns 200 with a bookingURL whose token decodes to
+ * the VICTIM's id, and the victim's `state` is overwritten. B/C (positive controls) pass pre-fix.
+ * GREEN (post-fix): all six checks pass.
+ *
+ * Checks are collected and printed before any assert runs: the testing harness has
+ * EXIT_ON_FIRST_ERROR, so asserting inline would kill the process before the evidence table and
+ * before `finally` cleanup.
+ */
+var booking_info_idor_tests = function (_a) {
+    var sdk = _a.sdk;
+    return __awaiter(void 0, void 0, void 0, function () {
+        var checks, record, token_enduser_id, templateId, bookingPageId, enduserIds, template, bookingPage, attacker, victim, attackerSDK, a1Detail, a1Pass, r, mintedFor, e_1, a2Attempt, e_2, victimAfter, b1Detail, b1Pass, r, mintedFor, e_3, b2Detail, b2Pass, r, mintedFor, e_4, c1Detail, c1Pass, r, mintedFor, e_5, c2Detail, c2Pass, r, e_6, _i, checks_1, c, _b, checks_2, c, _c, enduserIds_1, id, _d, _e, _f;
+        return __generator(this, function (_g) {
+            switch (_g.label) {
+                case 0:
+                    (0, testing_1.log_header)("booking_info must not mint an appointment-booking token for another enduser");
+                    checks = [];
+                    record = function (label, pass, detail) { return checks.push({ label: label, pass: pass, detail: detail }); };
+                    token_enduser_id = function (bookingURL) {
+                        var _a;
+                        var token = (_a = /[?&]token=([^&]+)/.exec(bookingURL || '')) === null || _a === void 0 ? void 0 : _a[1];
+                        var payload = token === null || token === void 0 ? void 0 : token.split('.')[1];
+                        if (!payload)
+                            return '';
+                        try {
+                            return JSON.parse(Buffer.from(payload, 'base64').toString()).id;
+                        }
+                        catch (_b) {
+                            return '';
+                        }
+                    };
+                    templateId = '';
+                    bookingPageId = '';
+                    enduserIds = [];
+                    _g.label = 1;
+                case 1:
+                    _g.trys.push([1, , 32, 47]);
+                    return [4 /*yield*/, sdk.api.calendar_event_templates.createOne({
+                            title: "F0179 template ".concat(RAND()), durationInMinutes: 30,
+                        })];
+                case 2:
+                    template = _g.sent();
+                    templateId = template.id;
+                    return [4 /*yield*/, sdk.api.appointment_booking_pages.createOne({
+                            title: "F0179 booking page ".concat(RAND()),
+                            calendarEventTemplateIds: [templateId],
+                            locationIds: [],
+                        })];
+                case 3:
+                    bookingPage = _g.sent();
+                    bookingPageId = bookingPage.id;
+                    return [4 /*yield*/, sdk.api.endusers.createOne({
+                            email: "f0179-attacker-".concat(RAND(), "@tellescope.example"), fname: 'F0179', lname: 'Attacker',
+                        })];
+                case 4:
+                    attacker = _g.sent();
+                    enduserIds.push(attacker.id);
+                    return [4 /*yield*/, sdk.api.endusers.createOne({
+                            email: "f0179-victim-".concat(RAND(), "@tellescope.example"), fname: 'F0179', lname: 'Victim',
+                            state: VICTIM_STATE,
+                        })];
+                case 5:
+                    victim = _g.sent();
+                    enduserIds.push(victim.id);
+                    attackerSDK = new sdk_1.EnduserSession({ host: host, businessId: businessId });
+                    return [4 /*yield*/, (0, setup_1.authenticate_enduser_via_token)(sdk, attackerSDK, { id: attacker.id })
+                        /* ===== A: the exploit — enduser mints a booking session as another patient ===== */
+                    ];
+                case 6:
+                    _g.sent();
+                    a1Detail = '';
+                    a1Pass = false;
+                    _g.label = 7;
+                case 7:
+                    _g.trys.push([7, 9, , 10]);
+                    return [4 /*yield*/, attackerSDK.api.form_fields.booking_info({ bookingPageId: bookingPageId, enduserId: victim.id })];
+                case 8:
+                    r = _g.sent();
+                    mintedFor = token_enduser_id(r.bookingURL);
+                    a1Detail = ("EXPLOITED: 200 with a bookingURL; token subject=".concat(mintedFor, " ")
+                        + "(victim=".concat(victim.id, ", attacker=").concat(attacker.id, ")")
+                        + (mintedFor === victim.id ? ' — a live appointment-booking session AS THE VICTIM' : ''));
+                    return [3 /*break*/, 10];
+                case 9:
+                    e_1 = _g.sent();
+                    a1Pass = true;
+                    a1Detail = "rejected: ".concat((e_1 === null || e_1 === void 0 ? void 0 : e_1.message) || (e_1 === null || e_1 === void 0 ? void 0 : e_1.toString()));
+                    return [3 /*break*/, 10];
+                case 10:
+                    record('A1: enduser cannot mint a booking token for another enduser', a1Pass, a1Detail);
+                    a2Attempt = '';
+                    _g.label = 11;
+                case 11:
+                    _g.trys.push([11, 13, , 14]);
+                    return [4 /*yield*/, attackerSDK.api.form_fields.booking_info({
+                            bookingPageId: bookingPageId,
+                            enduserId: victim.id, enduserFields: { state: ATTACKER_STATE_WRITE },
+                        })];
+                case 12:
+                    _g.sent();
+                    a2Attempt = 'call returned 200';
+                    return [3 /*break*/, 14];
+                case 13:
+                    e_2 = _g.sent();
+                    a2Attempt = "call rejected: ".concat((e_2 === null || e_2 === void 0 ? void 0 : e_2.message) || (e_2 === null || e_2 === void 0 ? void 0 : e_2.toString()));
+                    return [3 /*break*/, 14];
+                case 14: return [4 /*yield*/, sdk.api.endusers.getOne(victim.id)];
+                case 15:
+                    victimAfter = _g.sent();
+                    record('A2: enduser cannot write `state` onto another enduser via enduserFields', victimAfter.state === VICTIM_STATE, "".concat(a2Attempt, "; victim.state=").concat(victimAfter.state, " (expected ").concat(VICTIM_STATE, ")"));
+                    b1Detail = '';
+                    b1Pass = false;
+                    _g.label = 16;
+                case 16:
+                    _g.trys.push([16, 18, , 19]);
+                    return [4 /*yield*/, attackerSDK.api.form_fields.booking_info({ bookingPageId: bookingPageId })];
+                case 17:
+                    r = _g.sent();
+                    mintedFor = token_enduser_id(r.bookingURL);
+                    b1Pass = mintedFor === attacker.id;
+                    b1Detail = "token subject=".concat(mintedFor, " (self=").concat(attacker.id, ")");
+                    return [3 /*break*/, 19];
+                case 18:
+                    e_3 = _g.sent();
+                    b1Detail = "unexpectedly rejected: ".concat((e_3 === null || e_3 === void 0 ? void 0 : e_3.message) || (e_3 === null || e_3 === void 0 ? void 0 : e_3.toString()));
+                    return [3 /*break*/, 19];
+                case 19:
+                    record('B1: enduser can still load booking info with no enduserId', b1Pass, b1Detail);
+                    b2Detail = '';
+                    b2Pass = false;
+                    _g.label = 20;
+                case 20:
+                    _g.trys.push([20, 22, , 23]);
+                    return [4 /*yield*/, attackerSDK.api.form_fields.booking_info({ bookingPageId: bookingPageId, enduserId: attacker.id })];
+                case 21:
+                    r = _g.sent();
+                    mintedFor = token_enduser_id(r.bookingURL);
+                    b2Pass = mintedFor === attacker.id;
+                    b2Detail = "token subject=".concat(mintedFor, " (self=").concat(attacker.id, ")");
+                    return [3 /*break*/, 23];
+                case 22:
+                    e_4 = _g.sent();
+                    b2Detail = "unexpectedly rejected: ".concat((e_4 === null || e_4 === void 0 ? void 0 : e_4.message) || (e_4 === null || e_4 === void 0 ? void 0 : e_4.toString()));
+                    return [3 /*break*/, 23];
+                case 23:
+                    record('B2: enduser can still load booking info for its OWN enduserId', b2Pass, b2Detail);
+                    c1Detail = '';
+                    c1Pass = false;
+                    _g.label = 24;
+                case 24:
+                    _g.trys.push([24, 26, , 27]);
+                    return [4 /*yield*/, sdk.api.form_fields.booking_info({ bookingPageId: bookingPageId, enduserId: victim.id })];
+                case 25:
+                    r = _g.sent();
+                    mintedFor = token_enduser_id(r.bookingURL);
+                    c1Pass = mintedFor === victim.id;
+                    c1Detail = "token subject=".concat(mintedFor, " (target=").concat(victim.id, ")");
+                    return [3 /*break*/, 27];
+                case 26:
+                    e_5 = _g.sent();
+                    c1Detail = "unexpectedly rejected: ".concat((e_5 === null || e_5 === void 0 ? void 0 : e_5.message) || (e_5 === null || e_5 === void 0 ? void 0 : e_5.toString()));
+                    return [3 /*break*/, 27];
+                case 27:
+                    record('C1: staff can still load booking info for a specific enduser', c1Pass, c1Detail);
+                    c2Detail = '';
+                    c2Pass = false;
+                    _g.label = 28;
+                case 28:
+                    _g.trys.push([28, 30, , 31]);
+                    return [4 /*yield*/, sdk.api.form_fields.booking_info({ bookingPageId: bookingPageId })];
+                case 29:
+                    r = _g.sent();
+                    c2Pass = !!r.bookingURL && !!r.warningMessage;
+                    c2Detail = "warningMessage=".concat(JSON.stringify(r.warningMessage), " bookingURL=").concat(!!r.bookingURL);
+                    return [3 /*break*/, 31];
+                case 30:
+                    e_6 = _g.sent();
+                    c2Detail = "unexpectedly rejected: ".concat((e_6 === null || e_6 === void 0 ? void 0 : e_6.message) || (e_6 === null || e_6 === void 0 ? void 0 : e_6.toString()));
+                    return [3 /*break*/, 31];
+                case 31:
+                    record('C2: staff test-contact preview branch still works', c2Pass, c2Detail);
+                    /* ===== report: print full table first, then assert (harness exits on first failure) ===== */
+                    console.log('\n  check summary:');
+                    for (_i = 0, checks_1 = checks; _i < checks_1.length; _i++) {
+                        c = checks_1[_i];
+                        console.log("    ".concat(c.pass ? 'PASS' : 'FAIL', "  ").concat(c.label, "  \u2014  ").concat(c.detail));
+                    }
+                    console.log('');
+                    for (_b = 0, checks_2 = checks; _b < checks_2.length; _b++) {
+                        c = checks_2[_b];
+                        (0, testing_1.assert)(c.pass, "".concat(c.label, " \u2014 ").concat(c.detail), c.label);
+                    }
+                    return [3 /*break*/, 47];
+                case 32:
+                    _c = 0, enduserIds_1 = enduserIds;
+                    _g.label = 33;
+                case 33:
+                    if (!(_c < enduserIds_1.length)) return [3 /*break*/, 38];
+                    id = enduserIds_1[_c];
+                    _g.label = 34;
+                case 34:
+                    _g.trys.push([34, 36, , 37]);
+                    return [4 /*yield*/, sdk.api.endusers.deleteOne(id)];
+                case 35:
+                    _g.sent();
+                    return [3 /*break*/, 37];
+                case 36:
+                    _d = _g.sent();
+                    return [3 /*break*/, 37];
+                case 37:
+                    _c++;
+                    return [3 /*break*/, 33];
+                case 38:
+                    if (!bookingPageId) return [3 /*break*/, 42];
+                    _g.label = 39;
+                case 39:
+                    _g.trys.push([39, 41, , 42]);
+                    return [4 /*yield*/, sdk.api.appointment_booking_pages.deleteOne(bookingPageId)];
+                case 40:
+                    _g.sent();
+                    return [3 /*break*/, 42];
+                case 41:
+                    _e = _g.sent();
+                    return [3 /*break*/, 42];
+                case 42:
+                    if (!templateId) return [3 /*break*/, 46];
+                    _g.label = 43;
+                case 43:
+                    _g.trys.push([43, 45, , 46]);
+                    return [4 /*yield*/, sdk.api.calendar_event_templates.deleteOne(templateId)];
+                case 44:
+                    _g.sent();
+                    return [3 /*break*/, 46];
+                case 45:
+                    _f = _g.sent();
+                    return [3 /*break*/, 46];
+                case 46: return [7 /*endfinally*/];
+                case 47: return [2 /*return*/];
+            }
+        });
+    });
+};
+exports.booking_info_idor_tests = booking_info_idor_tests;
+// Allow running this test file independently
+if (require.main === module) {
+    console.log("\uD83C\uDF10 Using API URL: ".concat(host));
+    var sdk_2 = new sdk_1.Session({ host: host });
+    var sdkNonAdmin_1 = new sdk_1.Session({ host: host });
+    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, (0, setup_1.setup_tests)(sdk_2, sdkNonAdmin_1)];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, (0, exports.booking_info_idor_tests)({ sdk: sdk_2, sdkNonAdmin: sdkNonAdmin_1 })];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); };
+    runTests()
+        .then(function () {
+        console.log("✅ booking_info IDOR test suite completed successfully");
+        process.exit(0);
+    })
+        .catch(function (error) {
+        console.error("❌ booking_info IDOR test suite failed:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=booking-info-idor-token-mint.test.js.map

package/lib/cjs/tests/api_tests/security/booking-info-idor-token-mint.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"booking-info-idor-token-mint.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/booking-info-idor-token-mint.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,oCAAsD;AACtD,+CAG4B;AAC5B,qCAAyE;AAEzE,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AACpE,IAAM,UAAU,GAAG,0BAA0B,CAAA;AAE7C,IAAM,IAAI,GAAG,cAAM,OAAA,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAvC,CAAuC,CAAA;AAE1D,IAAM,YAAY,GAAG,IAAI,CAAA;AACzB,IAAM,oBAAoB,GAAG,IAAI,CAAA;AAQjC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACI,IAAM,uBAAuB,GAAG,UAAO,EAAgD;QAA9C,GAAG,SAAA;;;;;;oBACjD,IAAA,oBAAU,EAAC,6EAA6E,CAAC,CAAA;oBAEnF,MAAM,GAAY,EAAE,CAAA;oBACpB,MAAM,GAAG,UAAC,KAAa,EAAE,IAAa,EAAE,MAAc,IAAK,OAAA,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,OAAA,EAAE,IAAI,MAAA,EAAE,MAAM,QAAA,EAAE,CAAC,EAApC,CAAoC,CAAA;oBAI/F,gBAAgB,GAAG,UAAC,UAAkB;;wBAC1C,IAAM,KAAK,GAAG,MAAA,mBAAmB,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,0CAAG,CAAC,CAAC,CAAA;wBAC7D,IAAM,OAAO,GAAG,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;wBACpC,IAAI,CAAC,OAAO;4BAAE,OAAO,EAAE,CAAA;wBACvB,IAAI;4BACF,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAY,CAAA;yBAC1E;wBAAC,WAAM;4BACN,OAAO,EAAE,CAAA;yBACV;oBACH,CAAC,CAAA;oBAEG,UAAU,GAAG,EAAE,CAAA;oBACf,aAAa,GAAG,EAAE,CAAA;oBAChB,UAAU,GAAa,EAAE,CAAA;;;;oBAKZ,qBAAM,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,SAAS,CAAC;4BAChE,KAAK,EAAE,yBAAkB,IAAI,EAAE,CAAE,EAAE,iBAAiB,EAAE,EAAE;yBAClD,CAAC,EAAA;;oBAFH,QAAQ,GAAG,SAER;oBACT,UAAU,GAAG,QAAQ,CAAC,EAAE,CAAA;oBAEJ,qBAAM,GAAG,CAAC,GAAG,CAAC,yBAAyB,CAAC,SAAS,CAAC;4BACpE,KAAK,EAAE,6BAAsB,IAAI,EAAE,CAAE;4BACrC,wBAAwB,EAAE,CAAC,UAAU,CAAC;4BACtC,WAAW,EAAE,EAAE;yBACT,CAAC,EAAA;;oBAJH,WAAW,GAAG,SAIX;oBACT,aAAa,GAAG,WAAW,CAAC,EAAE,CAAA;oBAEb,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;4BAChD,KAAK,EAAE,yBAAkB,IAAI,EAAE,wBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU;yBACxF,CAAC,EAAA;;oBAFI,QAAQ,GAAG,SAEf;oBACF,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;oBAEb,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;4BAC9C,KAAK,EAAE,uBAAgB,IAAI,EAAE,wBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ;4BACnF,KAAK,EAAE,YAAY;yBACpB,CAAC,EAAA;;oBAHI,MAAM,GAAG,SAGb;oBACF,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;oBAIpB,WAAW,GAAG,IAAI,oBAAc,CAAC,EAAE,IAAI,MAAA,EAAE,UAAU,YAAA,EAAE,CAAC,CAAA;oBAC5D,qBAAM,IAAA,sCAA8B,EAAC,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;wBAE3E,qFAAqF;sBAFV;;oBAA3E,SAA2E,CAAA;oBAIvE,QAAQ,GAAG,EAAE,CAAA;oBACb,MAAM,GAAG,KAAK,CAAA;;;;oBAEN,qBAAM,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,aAAa,eAAA,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,EAAA;;oBAA3F,CAAC,GAAG,SAAuF;oBAC3F,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;oBAChD,QAAQ,GAAG,CACT,0DAAmD,SAAS,MAAG;0BAC7D,kBAAW,MAAM,CAAC,EAAE,wBAAc,QAAQ,CAAC,EAAE,MAAG;0BAChD,CAAC,SAAS,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,qDAAqD,CAAC,CAAC,CAAC,EAAE,CAAC,CACzF,CAAA;;;;oBAED,MAAM,GAAG,IAAI,CAAA;oBACb,QAAQ,GAAG,oBAAa,CAAA,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,OAAO,MAAI,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,QAAQ,EAAE,CAAA,CAAE,CAAA;;;oBAEvD,MAAM,CAAC,6DAA6D,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;oBAGnF,SAAS,GAAG,EAAE,CAAA;;;;oBAEhB,qBAAM,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC;4BAC7C,aAAa,eAAA;4BAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE;yBACpF,CAAC,EAAA;;oBAFF,SAEE,CAAA;oBACF,SAAS,GAAG,mBAAmB,CAAA;;;;oBAE/B,SAAS,GAAG,yBAAkB,CAAA,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,OAAO,MAAI,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,QAAQ,EAAE,CAAA,CAAE,CAAA;;yBAEzC,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAA;;oBAAtD,WAAW,GAAG,SAAwC;oBAC5D,MAAM,CACJ,yEAAyE,EACzE,WAAW,CAAC,KAAK,KAAK,YAAY,EAClC,UAAG,SAAS,4BAAkB,WAAW,CAAC,KAAK,wBAAc,YAAY,MAAG,CAC7E,CAAA;oBAIG,QAAQ,GAAG,EAAE,CAAA;oBACb,MAAM,GAAG,KAAK,CAAA;;;;oBAEN,qBAAM,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,aAAa,eAAA,EAAE,CAAC,EAAA;;oBAArE,CAAC,GAAG,SAAiE;oBACrE,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;oBAChD,MAAM,GAAG,SAAS,KAAK,QAAQ,CAAC,EAAE,CAAA;oBAClC,QAAQ,GAAG,wBAAiB,SAAS,oBAAU,QAAQ,CAAC,EAAE,MAAG,CAAA;;;;oBAE7D,QAAQ,GAAG,iCAA0B,CAAA,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,OAAO,MAAI,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,QAAQ,EAAE,CAAA,CAAE,CAAA;;;oBAEpE,MAAM,CAAC,2DAA2D,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;oBAEjF,QAAQ,GAAG,EAAE,CAAA;oBACb,MAAM,GAAG,KAAK,CAAA;;;;oBAEN,qBAAM,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,aAAa,eAAA,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,EAAA;;oBAA7F,CAAC,GAAG,SAAyF;oBAC7F,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;oBAChD,MAAM,GAAG,SAAS,KAAK,QAAQ,CAAC,EAAE,CAAA;oBAClC,QAAQ,GAAG,wBAAiB,SAAS,oBAAU,QAAQ,CAAC,EAAE,MAAG,CAAA;;;;oBAE7D,QAAQ,GAAG,iCAA0B,CAAA,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,OAAO,MAAI,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,QAAQ,EAAE,CAAA,CAAE,CAAA;;;oBAEpE,MAAM,CAAC,+DAA+D,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;oBAIrF,QAAQ,GAAG,EAAE,CAAA;oBACb,MAAM,GAAG,KAAK,CAAA;;;;oBAEN,qBAAM,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,aAAa,eAAA,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,EAAA;;oBAAnF,CAAC,GAAG,SAA+E;oBACnF,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;oBAChD,MAAM,GAAG,SAAS,KAAK,MAAM,CAAC,EAAE,CAAA;oBAChC,QAAQ,GAAG,wBAAiB,SAAS,sBAAY,MAAM,CAAC,EAAE,MAAG,CAAA;;;;oBAE7D,QAAQ,GAAG,iCAA0B,CAAA,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,OAAO,MAAI,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,QAAQ,EAAE,CAAA,CAAE,CAAA;;;oBAEpE,MAAM,CAAC,8DAA8D,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;oBAEpF,QAAQ,GAAG,EAAE,CAAA;oBACb,MAAM,GAAG,KAAK,CAAA;;;;oBAEN,qBAAM,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,aAAa,eAAA,EAAE,CAAC,EAAA;;oBAA7D,CAAC,GAAG,SAAyD;oBACnE,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAA;oBAC7C,QAAQ,GAAG,yBAAkB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,yBAAe,CAAC,CAAC,CAAC,CAAC,UAAU,CAAE,CAAA;;;;oBAE5F,QAAQ,GAAG,iCAA0B,CAAA,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,OAAO,MAAI,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,QAAQ,EAAE,CAAA,CAAE,CAAA;;;oBAEpE,MAAM,CAAC,mDAAmD,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;oBAE7E,8FAA8F;oBAC9F,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;oBACjC,WAAsB,EAAN,iBAAM,EAAN,oBAAM,EAAN,IAAM,EAAE;wBAAb,CAAC;wBACV,OAAO,CAAC,GAAG,CAAC,cAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,eAAK,CAAC,CAAC,KAAK,uBAAQ,CAAC,CAAC,MAAM,CAAE,CAAC,CAAA;qBAC3E;oBACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;oBAEf,WAAsB,EAAN,iBAAM,EAAN,oBAAM,EAAN,IAAM,EAAE;wBAAb,CAAC;wBACV,IAAA,gBAAM,EAAC,CAAC,CAAC,IAAI,EAAE,UAAG,CAAC,CAAC,KAAK,qBAAM,CAAC,CAAC,MAAM,CAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAA;qBACpD;;;0BAE0B,EAAV,yBAAU;;;yBAAV,CAAA,wBAAU,CAAA;oBAAhB,EAAE;;;;oBAAwB,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,EAAA;;oBAApC,SAAoC,CAAA;;;;;;oBAAxD,IAAU,CAAA;;;yBACvB,aAAa,EAAb,yBAAa;;;;oBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,yBAAyB,CAAC,SAAS,CAAC,aAAa,CAAC,EAAA;;oBAAhE,SAAgE,CAAA;;;;;;yBACvF,UAAU,EAAV,yBAAU;;;;oBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,SAAS,CAAC,UAAU,CAAC,EAAA;;oBAA5D,SAA4D,CAAA;;;;;;;;;;CAEvF,CAAA;AA3JY,QAAA,uBAAuB,2BA2JnC;AAED,6CAA6C;AAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAM,KAAG,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACjC,IAAM,aAAW,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IAEzC,IAAM,QAAQ,GAAG;;;wBACf,qBAAM,IAAA,mBAAW,EAAC,KAAG,EAAE,aAAW,CAAC,EAAA;;oBAAnC,SAAmC,CAAA;oBACnC,qBAAM,IAAA,+BAAuB,EAAC,EAAE,GAAG,OAAA,EAAE,WAAW,eAAA,EAAE,CAAC,EAAA;;oBAAnD,SAAmD,CAAA;;;;SACpD,CAAA;IAED,QAAQ,EAAE;SACP,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAA;QACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAA;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}

package/lib/cjs/tests/api_tests/security/cascade-role-rename-cross-tenant.test.d.ts

@@ -0,0 +1,32 @@
+import { Session } from "../../../sdk";
+/**
+ * Tenant-boundary guard for cascade_role_rename (relates to a prior internal review,
+ * which was investigated and closed as a FALSE POSITIVE — see that file for the code trace).
+ *
+ * The `cascade_role_rename` side-effect handler
+ * ([event_handlers_v2/role_based_access_permissions.ts](packages/private/api/api/v1/event_handlers_v2/role_based_access_permissions.ts))
+ * runs when a `role_based_access_permissions` doc's `role` field changes. It finds every user
+ * with the old role name (via `DBUnrestricted.users`) and rewrites their `roles` array, then
+ * deauthenticates them. An earlier review hypothesized this query was globally cross-tenant. It is NOT:
+ * `DBUnrestricted` bypasses per-user/per-role RBAC but is STILL scoped to the acting session's
+ * `businessId` (see `modifyFilterForAccessConstraint` injecting `{ businessId }` at
+ * database.ts:1761-1763, reached via the `unrestricted: true` branch at database.ts:2137-2144).
+ *
+ * This test locks that boundary in place so a future refactor of `DBUnrestricted` semantics
+ * can't silently turn the cascade into a cross-tenant write:
+ *   1. Tenant A creates a role `ROLE_OLD` and assigns it to a Tenant A user (positive control).
+ *   2. Tenant B (separate businessId) has a user whose roles include the SAME `ROLE_OLD`.
+ *   3. Tenant A renames the role `ROLE_OLD` -> `ROLE_NEW`.
+ *   4. Assert the Tenant B user's roles are UNCHANGED (still `[ROLE_OLD]`)  <-- guards the tenant boundary.
+ *   5. Assert the Tenant A user's roles ARE renamed to `[ROLE_NEW]`         <-- same-tenant cascade works.
+ *
+ * Expected on current (correct) code: BOTH assertions pass. A regression that drops the
+ * `businessId` scoping would flip assertion #4 to red (Tenant B user becomes `[ROLE_NEW]`).
+ *
+ * A collision-proof unique role name (timestamped) is used so the test never touches real roles.
+ */
+export declare const cascade_role_rename_cross_tenant_tests: ({ sdk }: {
+    sdk: Session;
+    sdkNonAdmin: Session;
+}) => Promise<void>;
+//# sourceMappingURL=cascade-role-rename-cross-tenant.test.d.ts.map

package/lib/cjs/tests/api_tests/security/cascade-role-rename-cross-tenant.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cascade-role-rename-cross-tenant.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/cascade-role-rename-cross-tenant.test.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAetC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,sCAAsC;SAA2B,OAAO;iBAAe,OAAO;mBA+F1G,CAAA"}

package/lib/cjs/tests/api_tests/security/cascade-role-rename-cross-tenant.test.js

@@ -0,0 +1,237 @@
+"use strict";
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cascade_role_rename_cross_tenant_tests = void 0;
+require('source-map-support').install();
+var sdk_1 = require("../../../sdk");
+var testing_1 = require("@tellescope/testing");
+var setup_1 = require("../../setup");
+var constants_1 = require("@tellescope/constants");
+var host = process.env.API_URL || 'http://localhost:8080';
+// Separate tenant (different businessId), reusing the same hardcoded apiKey that
+// multi_tenant_tests relies on in tests.ts.
+var OTHER_TENANT_API_KEY = "ba745e25162bb95a795c5fa1af70df188d93c4d3aac9c48b34a5c8c9dd7b80f7";
+/**
+ * Tenant-boundary guard for cascade_role_rename (relates to a prior internal review,
+ * which was investigated and closed as a FALSE POSITIVE — see that file for the code trace).
+ *
+ * The `cascade_role_rename` side-effect handler
+ * ([event_handlers_v2/role_based_access_permissions.ts](packages/private/api/api/v1/event_handlers_v2/role_based_access_permissions.ts))
+ * runs when a `role_based_access_permissions` doc's `role` field changes. It finds every user
+ * with the old role name (via `DBUnrestricted.users`) and rewrites their `roles` array, then
+ * deauthenticates them. An earlier review hypothesized this query was globally cross-tenant. It is NOT:
+ * `DBUnrestricted` bypasses per-user/per-role RBAC but is STILL scoped to the acting session's
+ * `businessId` (see `modifyFilterForAccessConstraint` injecting `{ businessId }` at
+ * database.ts:1761-1763, reached via the `unrestricted: true` branch at database.ts:2137-2144).
+ *
+ * This test locks that boundary in place so a future refactor of `DBUnrestricted` semantics
+ * can't silently turn the cascade into a cross-tenant write:
+ *   1. Tenant A creates a role `ROLE_OLD` and assigns it to a Tenant A user (positive control).
+ *   2. Tenant B (separate businessId) has a user whose roles include the SAME `ROLE_OLD`.
+ *   3. Tenant A renames the role `ROLE_OLD` -> `ROLE_NEW`.
+ *   4. Assert the Tenant B user's roles are UNCHANGED (still `[ROLE_OLD]`)  <-- guards the tenant boundary.
+ *   5. Assert the Tenant A user's roles ARE renamed to `[ROLE_NEW]`         <-- same-tenant cascade works.
+ *
+ * Expected on current (correct) code: BOTH assertions pass. A regression that drops the
+ * `businessId` scoping would flip assertion #4 to red (Tenant B user becomes `[ROLE_NEW]`).
+ *
+ * A collision-proof unique role name (timestamped) is used so the test never touches real roles.
+ */
+var cascade_role_rename_cross_tenant_tests = function (_a) {
+    var sdk = _a.sdk;
+    return __awaiter(void 0, void 0, void 0, function () {
+        var stamp, ROLE_OLD, ROLE_NEW, sdkOther, rbapId, controlUserId, victimUserId, tenantABusinessId, rbap, controlUser, victimUser, victimBefore, controlBefore, victimAfter, controlAfter, _b, _c, _d;
+        return __generator(this, function (_e) {
+            switch (_e.label) {
+                case 0:
+                    (0, testing_1.log_header)("cascade role rename cross-tenant regression");
+                    stamp = Date.now();
+                    ROLE_OLD = "XTenantRename_".concat(stamp);
+                    ROLE_NEW = "".concat(ROLE_OLD, "_renamed");
+                    sdkOther = new sdk_1.Session({ host: host, apiKey: OTHER_TENANT_API_KEY });
+                    _e.label = 1;
+                case 1:
+                    _e.trys.push([1, , 13, 26]);
+                    tenantABusinessId = sdk.userInfo.businessId;
+                    return [4 /*yield*/, sdk.api.role_based_access_permissions.createOne({
+                            role: ROLE_OLD,
+                            permissions: __assign({}, constants_1.PROVIDER_PERMISSIONS),
+                        })];
+                case 2:
+                    rbap = _e.sent();
+                    rbapId = rbap.id;
+                    return [4 /*yield*/, sdk.api.users.createOne({
+                            email: "f0053-control-".concat(stamp, "@example.com"),
+                            notificationEmailsDisabled: true,
+                        })];
+                case 3:
+                    controlUser = _e.sent();
+                    controlUserId = controlUser.id;
+                    return [4 /*yield*/, sdk.api.users.updateOne(controlUserId, { roles: [ROLE_OLD] }, { replaceObjectFields: true })
+                        // 3. Tenant B: create a throwaway victim user holding the SAME ROLE_OLD.
+                    ];
+                case 4:
+                    _e.sent();
+                    return [4 /*yield*/, sdkOther.api.users.createOne({
+                            email: "f0053-victim-".concat(stamp, "@example.com"),
+                            notificationEmailsDisabled: true,
+                        })];
+                case 5:
+                    victimUser = _e.sent();
+                    victimUserId = victimUser.id;
+                    return [4 /*yield*/, sdkOther.api.users.updateOne(victimUserId, { roles: [ROLE_OLD] }, { replaceObjectFields: true })
+                        // 4. Setup sanity: tenants are distinct and both users actually hold ROLE_OLD before the rename.
+                        //    (Distinguishes a setup failure from the security assertion below.)
+                    ];
+                case 6:
+                    _e.sent();
+                    // 4. Setup sanity: tenants are distinct and both users actually hold ROLE_OLD before the rename.
+                    //    (Distinguishes a setup failure from the security assertion below.)
+                    (0, testing_1.assert)(victimUser.businessId !== tenantABusinessId, "Victim user shares businessId with Tenant A (".concat(victimUser.businessId, ") \u2014 not a cross-tenant scenario"), 'setup: tenants are distinct');
+                    return [4 /*yield*/, sdkOther.api.users.getOne(victimUserId)];
+                case 7:
+                    victimBefore = _e.sent();
+                    return [4 /*yield*/, sdk.api.users.getOne(controlUserId)];
+                case 8:
+                    controlBefore = _e.sent();
+                    (0, testing_1.assert)(JSON.stringify(victimBefore.roles) === JSON.stringify([ROLE_OLD])
+                        && JSON.stringify(controlBefore.roles) === JSON.stringify([ROLE_OLD]), "Setup failed: expected both users to hold [".concat(ROLE_OLD, "] (victim=").concat(JSON.stringify(victimBefore.roles), ", control=").concat(JSON.stringify(controlBefore.roles), ")"), 'setup: both users hold ROLE_OLD');
+                    // 5. Tenant A renames the role. This triggers cascade_role_rename.
+                    return [4 /*yield*/, sdk.api.role_based_access_permissions.updateOne(rbapId, { role: ROLE_NEW })];
+                case 9:
+                    // 5. Tenant A renames the role. This triggers cascade_role_rename.
+                    _e.sent();
+                    return [4 /*yield*/, (0, testing_1.wait)(undefined, 1500)
+                        // 6. SECURITY ASSERTION — the Tenant B victim must be untouched by Tenant A's rename.
+                    ]; // let the side effect run
+                case 10:
+                    _e.sent(); // let the side effect run
+                    return [4 /*yield*/, sdkOther.api.users.getOne(victimUserId)];
+                case 11:
+                    victimAfter = _e.sent();
+                    (0, testing_1.assert)(JSON.stringify(victimAfter.roles) === JSON.stringify([ROLE_OLD]), "CROSS-TENANT LEAK: Tenant B victim roles changed to ".concat(JSON.stringify(victimAfter.roles), " ")
+                        + "after Tenant A renamed its role. Expected [".concat(ROLE_OLD, "]."), 'Tenant B user roles unaffected by other-tenant role rename');
+                    return [4 /*yield*/, sdk.api.users.getOne(controlUserId)];
+                case 12:
+                    controlAfter = _e.sent();
+                    (0, testing_1.assert)(JSON.stringify(controlAfter.roles) === JSON.stringify([ROLE_NEW]), "Same-tenant cascade broken: Tenant A control roles are ".concat(JSON.stringify(controlAfter.roles), ", ")
+                        + "expected [".concat(ROLE_NEW, "]."), 'Tenant A user roles renamed by same-tenant cascade');
+                    return [3 /*break*/, 26];
+                case 13:
+                    if (!victimUserId) return [3 /*break*/, 17];
+                    _e.label = 14;
+                case 14:
+                    _e.trys.push([14, 16, , 17]);
+                    return [4 /*yield*/, sdkOther.api.users.deleteOne(victimUserId)];
+                case 15:
+                    _e.sent();
+                    return [3 /*break*/, 17];
+                case 16:
+                    _b = _e.sent();
+                    return [3 /*break*/, 17];
+                case 17:
+                    if (!controlUserId) return [3 /*break*/, 21];
+                    _e.label = 18;
+                case 18:
+                    _e.trys.push([18, 20, , 21]);
+                    return [4 /*yield*/, sdk.api.users.deleteOne(controlUserId)];
+                case 19:
+                    _e.sent();
+                    return [3 /*break*/, 21];
+                case 20:
+                    _c = _e.sent();
+                    return [3 /*break*/, 21];
+                case 21:
+                    if (!rbapId) return [3 /*break*/, 25];
+                    _e.label = 22;
+                case 22:
+                    _e.trys.push([22, 24, , 25]);
+                    return [4 /*yield*/, sdk.api.role_based_access_permissions.deleteOne(rbapId)];
+                case 23:
+                    _e.sent();
+                    return [3 /*break*/, 25];
+                case 24:
+                    _d = _e.sent();
+                    return [3 /*break*/, 25];
+                case 25: return [7 /*endfinally*/];
+                case 26: return [2 /*return*/];
+            }
+        });
+    });
+};
+exports.cascade_role_rename_cross_tenant_tests = cascade_role_rename_cross_tenant_tests;
+// Allow running this test file independently
+if (require.main === module) {
+    console.log("\uD83C\uDF10 Using API URL: ".concat(host));
+    var sdk_2 = new sdk_1.Session({ host: host });
+    var sdkNonAdmin_1 = new sdk_1.Session({ host: host });
+    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, (0, setup_1.setup_tests)(sdk_2, sdkNonAdmin_1)];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, (0, exports.cascade_role_rename_cross_tenant_tests)({ sdk: sdk_2, sdkNonAdmin: sdkNonAdmin_1 })];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); };
+    runTests()
+        .then(function () {
+        console.log("✅ cascade role rename cross-tenant test suite completed successfully");
+        process.exit(0);
+    })
+        .catch(function (error) {
+        console.error("❌ cascade role rename cross-tenant test suite failed:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=cascade-role-rename-cross-tenant.test.js.map

package/lib/cjs/tests/api_tests/security/cascade-role-rename-cross-tenant.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cascade-role-rename-cross-tenant.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/cascade-role-rename-cross-tenant.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,oCAAsC;AACtC,+CAI4B;AAC5B,qCAAyC;AACzC,mDAA4D;AAE5D,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE,iFAAiF;AACjF,4CAA4C;AAC5C,IAAM,oBAAoB,GAAG,kEAAkE,CAAA;AAE/F;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACI,IAAM,sCAAsC,GAAG,UAAO,EAAgD;QAA9C,GAAG,SAAA;;;;;;oBAChE,IAAA,oBAAU,EAAC,6CAA6C,CAAC,CAAA;oBAEnD,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;oBAClB,QAAQ,GAAG,wBAAiB,KAAK,CAAE,CAAA;oBACnC,QAAQ,GAAG,UAAG,QAAQ,aAAU,CAAA;oBAIhC,QAAQ,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAA;;;;oBAY5D,iBAAiB,GAAG,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAA;oBAGpC,qBAAM,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,SAAS,CAAC;4BACjE,IAAI,EAAE,QAAQ;4BACd,WAAW,eAAO,gCAAoB,CAAE;yBACzC,CAAC,EAAA;;oBAHI,IAAI,GAAG,SAGX;oBACF,MAAM,GAAG,IAAI,CAAC,EAAE,CAAA;oBAGI,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;4BAChD,KAAK,EAAE,wBAAiB,KAAK,iBAAc;4BAC3C,0BAA0B,EAAE,IAAI;yBAC1B,CAAC,EAAA;;oBAHH,WAAW,GAAG,SAGX;oBACT,aAAa,GAAG,WAAW,CAAC,EAAE,CAAA;oBAC9B,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC;wBAElG,yEAAyE;sBAFyB;;oBAAlG,SAAkG,CAAA;oBAG/E,qBAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;4BACpD,KAAK,EAAE,uBAAgB,KAAK,iBAAc;4BAC1C,0BAA0B,EAAE,IAAI;yBAC1B,CAAC,EAAA;;oBAHH,UAAU,GAAG,SAGV;oBACT,YAAY,GAAG,UAAU,CAAC,EAAE,CAAA;oBAC5B,qBAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC;wBAEtG,iGAAiG;wBACjG,wEAAwE;sBAH8B;;oBAAtG,SAAsG,CAAA;oBAEtG,iGAAiG;oBACjG,wEAAwE;oBACxE,IAAA,gBAAM,EACJ,UAAU,CAAC,UAAU,KAAK,iBAAiB,EAC3C,uDAAgD,UAAU,CAAC,UAAU,yCAAiC,EACtG,6BAA6B,CAC9B,CAAA;oBACoB,qBAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAA;;oBAA5D,YAAY,GAAG,SAA6C;oBAC5C,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,EAAA;;oBAAzD,aAAa,GAAG,SAAyC;oBAC/D,IAAA,gBAAM,EACJ,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC;2BAC5D,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,EACvE,qDAA8C,QAAQ,uBAAa,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,uBAAa,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,MAAG,EACxJ,iCAAiC,CAClC,CAAA;oBAED,mEAAmE;oBACnE,qBAAM,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAA;;oBADjF,mEAAmE;oBACnE,SAAiF,CAAA;oBACjF,qBAAM,IAAA,cAAI,EAAC,SAAS,EAAE,IAAI,CAAC;wBAE3B,sFAAsF;sBAF3D,CAAC,0BAA0B;;oBAAtD,SAA2B,CAAA,CAAC,0BAA0B;oBAGlC,qBAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAA;;oBAA3D,WAAW,GAAG,SAA6C;oBACjE,IAAA,gBAAM,EACJ,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,EAChE,8DAAuD,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,MAAG;0BACvF,qDAA8C,QAAQ,OAAI,EAC9D,4DAA4D,CAC7D,CAAA;oBAGoB,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,EAAA;;oBAAxD,YAAY,GAAG,SAAyC;oBAC9D,IAAA,gBAAM,EACJ,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,EACjE,iEAA0D,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,OAAI;0BAC5F,oBAAa,QAAQ,OAAI,EAC7B,oDAAoD,CACrD,CAAA;;;yBAGG,YAAY,EAAZ,yBAAY;;;;oBACR,qBAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,YAAY,CAAC,EAAA;;oBAAhD,SAAgD,CAAA;;;;;;yBAEpD,aAAa,EAAb,yBAAa;;;;oBACT,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC,EAAA;;oBAA5C,SAA4C,CAAA;;;;;;yBAEhD,MAAM,EAAN,yBAAM;;;;oBACF,qBAAM,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,SAAS,CAAC,MAAM,CAAC,EAAA;;oBAA7D,SAA6D,CAAA;;;;;;;;;;CAGxE,CAAA;AA/FY,QAAA,sCAAsC,0CA+FlD;AAED,6CAA6C;AAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAM,KAAG,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACjC,IAAM,aAAW,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IAEzC,IAAM,QAAQ,GAAG;;;wBACf,qBAAM,IAAA,mBAAW,EAAC,KAAG,EAAE,aAAW,CAAC,EAAA;;oBAAnC,SAAmC,CAAA;oBACnC,qBAAM,IAAA,8CAAsC,EAAC,EAAE,GAAG,OAAA,EAAE,WAAW,eAAA,EAAE,CAAC,EAAA;;oBAAlE,SAAkE,CAAA;;;;SACnE,CAAA;IAED,QAAQ,EAAE;SACP,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,sEAAsE,CAAC,CAAA;QACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,uDAAuD,EAAE,KAAK,CAAC,CAAA;QAC7E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}