@tellescope/sdk 1.256.13 → 1.256.15

package/lib/cjs/tests/api_tests/security/form-logic-js-execution.test.js

@@ -0,0 +1,248 @@
+"use strict";
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.form_logic_js_execution_tests = exports.form_logic_js_execution_checks = void 0;
+require('source-map-support').install();
+var setup_isolated_1 = require("../../setup_isolated");
+var host = process.env.API_URL || 'http://localhost:8080';
+var RAND = function () { return Math.random().toString(36).slice(2, 10); };
+/**
+ * Regression test: `$JS(...)` must be rejected in stored conditional logic.
+ *
+ * `responses_satisfy_conditions` (utilities/src/utils.ts) compiled a stored condition value of the
+ * form `$JS(...)` with `new Function()` and executed it — in every form-filler's browser, including
+ * anonymous visitors on public intake pages, AND inside the API process (automation_triggers.ts
+ * trigger matching on every form submission, ai_agent/form_filling.ts voice-agent navigation). The
+ * API process holds every tenant's database handle, so a condition authored by staff in one tenant
+ * reached all of them. Any staff user or API key with form_fields write access could plant one by
+ * typing into the free-text $gt/$lt box — no API call required.
+ *
+ * The sink is removed. This asserts the second half of the fix: `compoundFilterValidator` rejects the
+ * syntax at write time on every field that feeds that evaluator, so it cannot be reintroduced through
+ * stored configuration. The runtime half — that a `$JS` value is never evaluated — is covered by the
+ * pure-function cases in `form_conditional_logic_tests` in tests.ts.
+ *
+ * The five condition locations were established by enumerating every `responses_satisfy_conditions`
+ * call site, and all five are covered here. That completeness matters: the first run of this test
+ * caught a half fix. `event.conditions` is wrapped in an `orValidator`, which returns the first arm
+ * that does not throw, and its permissive `optional: optionalAnyObjectValidator` arm was declared
+ * before the guarded one — so the payload was accepted and stored even though the validator had been
+ * swapped. Pointing a field at the guard is not the same as the guard being reachable, which is why
+ * every location gets an assertion rather than an argument.
+ *
+ * Each rejection is paired with a positive control using the same shape without `$JS(`, so a passing
+ * test cannot be explained by the write failing for an unrelated reason.
+ */
+var form_logic_js_execution_checks = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var checks, record, JS_PAYLOAD, SAFE_VALUE, condition, previousFields, attempt, tenant, sdk_1, form_1, field_1, controlCreate, payloadCreate, payloadUpdate, groupControl, groupPayload, optionControl, optionPayload, productControl, productPayload, trigger_1, triggerControl, triggerPayload, byFormIdPayload, e_1;
+    return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0:
+                checks = [];
+                record = function (label, pass, detail) { return checks.push({ label: label, pass: pass, detail: detail }); };
+                JS_PAYLOAD = '$JS(return 0)';
+                SAFE_VALUE = '18';
+                condition = function (value) { return ({ $and: [{ condition: { 'someFieldId': { $gt: value } } }] }); };
+                previousFields = function (value) { return ([{
+                        type: 'compoundLogic',
+                        info: { fieldId: '000000000000000000000000', priority: 5, label: '', condition: condition(value) },
+                    }]); };
+                attempt = function (fn) { return __awaiter(void 0, void 0, void 0, function () {
+                    return __generator(this, function (_a) {
+                        return [2 /*return*/, (fn().then(function () { return ({ accepted: true, detail: 'accepted' }); })
+                                .catch(function (e) { return ({ accepted: false, detail: "rejected: ".concat((e === null || e === void 0 ? void 0 : e.message) || e) }); }))];
+                    });
+                }); };
+                _a.label = 1;
+            case 1:
+                _a.trys.push([1, , 17, 22]);
+                return [4 /*yield*/, (0, setup_isolated_1.setup_isolated_tenant)({ name: "F0200 ".concat(RAND()), users: [{ isAdmin: true }], apiKeys: 0 })];
+            case 2:
+                tenant = _a.sent();
+                sdk_1 = tenant.sdk;
+                return [4 /*yield*/, sdk_1.api.forms.createOne({ title: "".concat(RAND()) })];
+            case 3:
+                form_1 = _a.sent();
+                return [4 /*yield*/, sdk_1.api.form_fields.createOne({
+                        formId: form_1.id, title: 'anchor', type: 'string', previousFields: [{ type: 'root', info: {} }],
+                    })
+                    /* ===== 1. previousFields[].info.condition — the field the finding was reported against ===== */
+                ];
+            case 4:
+                field_1 = _a.sent();
+                return [4 /*yield*/, attempt(function () { return sdk_1.api.form_fields.createOne({
+                        formId: form_1.id, title: 'control', type: 'string',
+                        previousFields: previousFields(SAFE_VALUE),
+                    }); })];
+            case 5:
+                controlCreate = _a.sent();
+                record('control: form_fields.createOne accepts a normal $gt condition', controlCreate.accepted, controlCreate.detail);
+                return [4 /*yield*/, attempt(function () { return sdk_1.api.form_fields.createOne({
+                        formId: form_1.id, title: 'payload', type: 'string',
+                        previousFields: previousFields(JS_PAYLOAD),
+                    }); })];
+            case 6:
+                payloadCreate = _a.sent();
+                record('1a: form_fields.createOne rejects $JS( in previousFields condition', !payloadCreate.accepted, payloadCreate.detail);
+                return [4 /*yield*/, attempt(function () { return sdk_1.api.form_fields.updateOne(field_1.id, {
+                        previousFields: previousFields(JS_PAYLOAD),
+                    }); })];
+            case 7:
+                payloadUpdate = _a.sent();
+                record('1b: form_fields.updateOne rejects $JS( in previousFields condition', !payloadUpdate.accepted, payloadUpdate.detail);
+                return [4 /*yield*/, attempt(function () { return sdk_1.api.form_fields.updateOne(field_1.id, {
+                        groupShowCondition: condition(SAFE_VALUE),
+                    }); })];
+            case 8:
+                groupControl = _a.sent();
+                record('control: groupShowCondition accepts a normal condition', groupControl.accepted, groupControl.detail);
+                return [4 /*yield*/, attempt(function () { return sdk_1.api.form_fields.updateOne(field_1.id, {
+                        groupShowCondition: condition(JS_PAYLOAD),
+                    }); })];
+            case 9:
+                groupPayload = _a.sent();
+                record('2: form_fields.updateOne rejects $JS( in groupShowCondition', !groupPayload.accepted, groupPayload.detail);
+                return [4 /*yield*/, attempt(function () { return sdk_1.api.form_fields.updateOne(field_1.id, {
+                        options: { optionDetails: [{ option: 'A', showCondition: condition(SAFE_VALUE) }] },
+                    }); })];
+            case 10:
+                optionControl = _a.sent();
+                record('control: optionDetails showCondition accepts a normal condition', optionControl.accepted, optionControl.detail);
+                return [4 /*yield*/, attempt(function () { return sdk_1.api.form_fields.updateOne(field_1.id, {
+                        options: { optionDetails: [{ option: 'A', showCondition: condition(JS_PAYLOAD) }] },
+                    }); })];
+            case 11:
+                optionPayload = _a.sent();
+                record('3: form_fields.updateOne rejects $JS( in optionDetails showCondition', !optionPayload.accepted, optionPayload.detail);
+                return [4 /*yield*/, attempt(function () { return sdk_1.api.form_fields.updateOne(field_1.id, {
+                        options: { productConditions: [{ productId: '000000000000000000000000', showCondition: condition(SAFE_VALUE) }] },
+                    }); })];
+            case 12:
+                productControl = _a.sent();
+                record('control: productConditions showCondition accepts a normal condition', productControl.accepted, productControl.detail);
+                return [4 /*yield*/, attempt(function () { return sdk_1.api.form_fields.updateOne(field_1.id, {
+                        options: { productConditions: [{ productId: '000000000000000000000000', showCondition: condition(JS_PAYLOAD) }] },
+                    }); })];
+            case 13:
+                productPayload = _a.sent();
+                record('4: form_fields.updateOne rejects $JS( in productConditions showCondition', !productPayload.accepted, productPayload.detail);
+                trigger_1 = function (conditions, extraInfo) {
+                    if (extraInfo === void 0) { extraInfo = {}; }
+                    return ({
+                        title: "".concat(RAND()),
+                        status: 'Inactive',
+                        event: __assign({ type: 'Form Submitted', info: __assign({ formId: form_1.id }, extraInfo) }, conditions),
+                        action: { type: 'Add Tags', info: { tags: ['security-regression'] } },
+                    });
+                };
+                return [4 /*yield*/, attempt(function () { return sdk_1.api.automation_triggers.createOne(trigger_1({ conditions: condition(SAFE_VALUE) })); })];
+            case 14:
+                triggerControl = _a.sent();
+                record('control: automation_triggers accepts normal event conditions', triggerControl.accepted, triggerControl.detail);
+                return [4 /*yield*/, attempt(function () { return sdk_1.api.automation_triggers.createOne(trigger_1({ conditions: condition(JS_PAYLOAD) })); })];
+            case 15:
+                triggerPayload = _a.sent();
+                record('5a: automation_triggers rejects $JS( in event.conditions', !triggerPayload.accepted, triggerPayload.detail);
+                return [4 /*yield*/, attempt(function () {
+                        var _a;
+                        return sdk_1.api.automation_triggers.createOne(trigger_1({}, { conditionsByFormId: (_a = {}, _a[form_1.id] = condition(JS_PAYLOAD), _a) }));
+                    })];
+            case 16:
+                byFormIdPayload = _a.sent();
+                record('5b: automation_triggers rejects $JS( in event.info.conditionsByFormId', !byFormIdPayload.accepted, byFormIdPayload.detail);
+                return [3 /*break*/, 22];
+            case 17:
+                if (!tenant) return [3 /*break*/, 21];
+                _a.label = 18;
+            case 18:
+                _a.trys.push([18, 20, , 21]);
+                return [4 /*yield*/, tenant.teardown()];
+            case 19:
+                _a.sent();
+                return [3 /*break*/, 21];
+            case 20:
+                e_1 = _a.sent();
+                console.error('teardown failed', e_1);
+                return [3 /*break*/, 21];
+            case 21: return [7 /*endfinally*/];
+            case 22: return [2 /*return*/, checks];
+        }
+    });
+}); };
+exports.form_logic_js_execution_checks = form_logic_js_execution_checks;
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+var form_logic_js_execution_tests = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var _a, _b;
+    return __generator(this, function (_c) {
+        switch (_c.label) {
+            case 0:
+                _a = setup_isolated_1.assert_checks;
+                _b = ['$JS in stored conditional logic'];
+                return [4 /*yield*/, (0, exports.form_logic_js_execution_checks)()];
+            case 1:
+                _a.apply(void 0, _b.concat([_c.sent()]));
+                return [2 /*return*/];
+        }
+    });
+}); };
+exports.form_logic_js_execution_tests = form_logic_js_execution_tests;
+// Allow running this test file independently
+if (require.main === module) {
+    console.log("\uD83C\uDF10 Using API URL: ".concat(host));
+    (0, exports.form_logic_js_execution_tests)()
+        .then(function () {
+        console.log("✅ form logic JS execution test suite completed successfully");
+        process.exit(0);
+    })
+        .catch(function (error) {
+        console.error("❌ form logic JS execution test suite failed:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=form-logic-js-execution.test.js.map

package/lib/cjs/tests/api_tests/security/form-logic-js-execution.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"form-logic-js-execution.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/form-logic-js-execution.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,uDAI6B;AAE7B,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE,IAAM,IAAI,GAAG,cAAM,OAAA,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAvC,CAAuC,CAAA;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACI,IAAM,8BAA8B,GAAG;;;;;gBACtC,MAAM,GAAY,EAAE,CAAA;gBACpB,MAAM,GAAG,UAAC,KAAa,EAAE,IAAa,EAAE,MAAc,IAAK,OAAA,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,OAAA,EAAE,IAAI,MAAA,EAAE,MAAM,QAAA,EAAE,CAAC,EAApC,CAAoC,CAAA;gBAE/F,UAAU,GAAG,eAAe,CAAA;gBAC5B,UAAU,GAAG,IAAI,CAAA;gBAEjB,SAAS,GAAG,UAAC,KAAa,IAAK,OAAA,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,aAAa,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAA9D,CAA8D,CAAA;gBAC7F,cAAc,GAAG,UAAC,KAAa,IAAK,OAAA,CAAC,CAAC;wBAC1C,IAAI,EAAE,eAAe;wBACrB,IAAI,EAAE,EAAE,OAAO,EAAE,0BAA0B,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE;qBACnG,CAAC,CAAC,EAHuC,CAGvC,CAAA;gBAEG,OAAO,GAAG,UAAO,EAAsB;;wBAAK,sBAAA,CAChD,EAAE,EAAE,CAAC,IAAI,CAAC,cAAM,OAAA,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAG,MAAM,EAAE,UAAU,EAAE,CAAC,EAAzC,CAAyC,CAAC;iCACrD,KAAK,CAAC,UAAC,CAAM,IAAK,OAAA,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAa,CAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,KAAI,CAAC,CAAE,EAAE,CAAC,EAA7D,CAA6D,CAAC,CACtF,EAAA;;qBAAA,CAAA;;;;gBAKU,qBAAM,IAAA,sCAAqB,EAAC,EAAE,IAAI,EAAE,gBAAS,IAAI,EAAE,CAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,EAAA;;gBAAzG,MAAM,GAAG,SAAgG,CAAA;gBACnG,QAAM,MAAM,CAAC,GAAG,CAAA;gBAET,qBAAM,KAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,UAAG,IAAI,EAAE,CAAE,EAAE,CAAC,EAAA;;gBAA5D,SAAO,SAAqD;gBACpD,qBAAM,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC;wBAChD,MAAM,EAAE,MAAI,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;qBAC/F,CAAC;oBAEF,iGAAiG;kBAF/F;;gBAFI,UAAQ,SAEZ;gBAIoB,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC;wBACtE,MAAM,EAAE,MAAI,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ;wBACjD,cAAc,EAAE,cAAc,CAAC,UAAU,CAAQ;qBAClD,CAAC,EAHwC,CAGxC,CAAC,EAAA;;gBAHG,aAAa,GAAG,SAGnB;gBACH,MAAM,CACJ,+DAA+D,EAC/D,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAC7C,CAAA;gBAEqB,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC;wBACtE,MAAM,EAAE,MAAI,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ;wBACjD,cAAc,EAAE,cAAc,CAAC,UAAU,CAAQ;qBAClD,CAAC,EAHwC,CAGxC,CAAC,EAAA;;gBAHG,aAAa,GAAG,SAGnB;gBACH,MAAM,CACJ,oEAAoE,EACpE,CAAC,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAC9C,CAAA;gBAEqB,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,OAAK,CAAC,EAAE,EAAE;wBAChF,cAAc,EAAE,cAAc,CAAC,UAAU,CAAQ;qBAClD,CAAC,EAFwC,CAExC,CAAC,EAAA;;gBAFG,aAAa,GAAG,SAEnB;gBACH,MAAM,CACJ,oEAAoE,EACpE,CAAC,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAC9C,CAAA;gBAIoB,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,OAAK,CAAC,EAAE,EAAE;wBAC/E,kBAAkB,EAAE,SAAS,CAAC,UAAU,CAAQ;qBACjD,CAAC,EAFuC,CAEvC,CAAC,EAAA;;gBAFG,YAAY,GAAG,SAElB;gBACH,MAAM,CAAC,wDAAwD,EAAE,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC,CAAA;gBAEvF,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,OAAK,CAAC,EAAE,EAAE;wBAC/E,kBAAkB,EAAE,SAAS,CAAC,UAAU,CAAQ;qBACjD,CAAC,EAFuC,CAEvC,CAAC,EAAA;;gBAFG,YAAY,GAAG,SAElB;gBACH,MAAM,CAAC,6DAA6D,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC,CAAA;gBAI5F,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,OAAK,CAAC,EAAE,EAAE;wBAChF,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,EAAS;qBAC3F,CAAC,EAFwC,CAExC,CAAC,EAAA;;gBAFG,aAAa,GAAG,SAEnB;gBACH,MAAM,CAAC,iEAAiE,EAAE,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;gBAEjG,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,OAAK,CAAC,EAAE,EAAE;wBAChF,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,EAAS;qBAC3F,CAAC,EAFwC,CAExC,CAAC,EAAA;;gBAFG,aAAa,GAAG,SAEnB;gBACH,MAAM,CAAC,sEAAsE,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;gBAItG,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,OAAK,CAAC,EAAE,EAAE;wBACjF,OAAO,EAAE,EAAE,iBAAiB,EAAE,CAAC,EAAE,SAAS,EAAE,0BAA0B,EAAE,aAAa,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,EAAS;qBACzH,CAAC,EAFyC,CAEzC,CAAC,EAAA;;gBAFG,cAAc,GAAG,SAEpB;gBACH,MAAM,CAAC,qEAAqE,EAAE,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,CAAA;gBAEtG,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,OAAK,CAAC,EAAE,EAAE;wBACjF,OAAO,EAAE,EAAE,iBAAiB,EAAE,CAAC,EAAE,SAAS,EAAE,0BAA0B,EAAE,aAAa,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,EAAS;qBACzH,CAAC,EAFyC,CAEzC,CAAC,EAAA;;gBAFG,cAAc,GAAG,SAEpB;gBACH,MAAM,CAAC,0EAA0E,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,CAAA;gBAI7H,YAAU,UAAC,UAAkB,EAAE,SAAsB;oBAAtB,0BAAA,EAAA,cAAsB;oBAAK,OAAA,CAAC;wBAC/D,KAAK,EAAE,UAAG,IAAI,EAAE,CAAE;wBAClB,MAAM,EAAE,UAAU;wBAClB,KAAK,aAAI,IAAI,EAAE,gBAAgB,EAAE,IAAI,aAAI,MAAM,EAAE,MAAI,CAAC,EAAE,IAAK,SAAS,KAAO,UAAU,CAAE;wBACzF,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,qBAAqB,CAAC,EAAE,EAAE;qBAC9D,CAAA;gBALuD,CAKvD,CAAA;gBAEc,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,SAAS,CAC9E,SAAO,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAC/C,EAF0C,CAE1C,CAAC,EAAA;;gBAFI,cAAc,GAAG,SAErB;gBACF,MAAM,CAAC,8DAA8D,EAAE,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,CAAA;gBAG/F,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,SAAS,CAC9E,SAAO,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAC/C,EAF0C,CAE1C,CAAC,EAAA;;gBAFI,cAAc,GAAG,SAErB;gBACF,MAAM,CAAC,0DAA0D,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,CAAA;gBAE3F,qBAAM,OAAO,CAAC;;wBAAM,OAAA,KAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,SAAS,CAC/E,SAAO,CAAC,EAAE,EAAE,EAAE,kBAAkB,YAAI,GAAC,MAAI,CAAC,EAAE,IAAG,SAAS,CAAC,UAAU,CAAC,KAAE,EAAE,CAAC,CAC1E;oBAF2C,CAE3C,CAAC,EAAA;;gBAFI,eAAe,GAAG,SAEtB;gBACF,MAAM,CAAC,uEAAuE,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,eAAe,CAAC,MAAM,CAAC,CAAA;;;qBAI9H,MAAM,EAAN,yBAAM;;;;gBAAU,qBAAM,MAAM,CAAC,QAAQ,EAAE,EAAA;;gBAAvB,SAAuB,CAAA;;;;gBAAe,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,GAAC,CAAC,CAAA;;;qBAG/F,sBAAO,MAAM,EAAA;;;KACd,CAAA;AA5HY,QAAA,8BAA8B,kCA4H1C;AAED,kFAAkF;AAC3E,IAAM,6BAA6B,GAAG;;;;;gBAC3C,KAAA,8BAAa,CAAA;sBAAC,iCAAiC;gBAAE,qBAAM,IAAA,sCAA8B,GAAE,EAAA;;gBAAvF,4BAAiD,SAAsC,GAAC,CAAA;;;;KACzF,CAAA;AAFY,QAAA,6BAA6B,iCAEzC;AAED,6CAA6C;AAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAA,qCAA6B,GAAE;SAC5B,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAA;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAE,KAAK,CAAC,CAAA;QACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}

package/lib/cjs/tests/api_tests/security/globalunique-conflict-redaction.test.d.ts

@@ -0,0 +1,19 @@
+import { Session } from "../../../sdk";
+/**
+ * Regression test: a globalUnique conflict response must not echo the matched record.
+ *
+ * The create endpoint generator's unconditional globalUnique-enforcement block
+ * (routing.ts, "globalUnique should be enforced even if _overrideUnique is true")
+ * threw uniquenessError([{ existingRecord: matches[0] }]) with the RAW matched record.
+ * `findSomeByMatchAny_Global` deletes businessId, so the match is global; for `users`
+ * (globalUnique: ['email','phone']) the 409 body leaked the full record incl. hashedPass.
+ *
+ * Fix: redact existingRecord to { _id, businessId } like the safe validateUniquenessConstraints
+ * path. This reproduces the leak with a same-tenant collision (same code path) and asserts the
+ * 409 body's existingRecord exposes nothing beyond _id + businessId.
+ */
+export declare const globalunique_leak_tests: ({ sdk }: {
+    sdk: Session;
+    sdkNonAdmin: Session;
+}) => Promise<void>;
+//# sourceMappingURL=globalunique-conflict-redaction.test.d.ts.map

package/lib/cjs/tests/api_tests/security/globalunique-conflict-redaction.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"globalunique-conflict-redaction.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/globalunique-conflict-redaction.test.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAStC;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB;SAA2B,OAAO;iBAAe,OAAO;mBA+B3F,CAAA"}

package/lib/cjs/tests/api_tests/security/globalunique-conflict-redaction.test.js

@@ -0,0 +1,138 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.globalunique_leak_tests = void 0;
+require('source-map-support').install();
+var sdk_1 = require("../../../sdk");
+var testing_1 = require("@tellescope/testing");
+var setup_1 = require("../../setup");
+var host = process.env.API_URL || 'http://localhost:8080';
+/**
+ * Regression test: a globalUnique conflict response must not echo the matched record.
+ *
+ * The create endpoint generator's unconditional globalUnique-enforcement block
+ * (routing.ts, "globalUnique should be enforced even if _overrideUnique is true")
+ * threw uniquenessError([{ existingRecord: matches[0] }]) with the RAW matched record.
+ * `findSomeByMatchAny_Global` deletes businessId, so the match is global; for `users`
+ * (globalUnique: ['email','phone']) the 409 body leaked the full record incl. hashedPass.
+ *
+ * Fix: redact existingRecord to { _id, businessId } like the safe validateUniquenessConstraints
+ * path. This reproduces the leak with a same-tenant collision (same code path) and asserts the
+ * 409 body's existingRecord exposes nothing beyond _id + businessId.
+ */
+var globalunique_leak_tests = function (_a) {
+    var sdk = _a.sdk;
+    return __awaiter(void 0, void 0, void 0, function () {
+        var userId, email_1, user, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0:
+                    (0, testing_1.log_header)("globalUnique conflict response redaction");
+                    _c.label = 1;
+                case 1:
+                    _c.trys.push([1, , 4, 9]);
+                    email_1 = "f0145-victim-".concat(Date.now(), "@example.com");
+                    return [4 /*yield*/, sdk.api.users.createOne({ email: email_1 })];
+                case 2:
+                    user = _c.sent();
+                    userId = user.id;
+                    return [4 /*yield*/, (0, testing_1.async_test)('globalUnique 409 existingRecord exposes only _id + businessId (no email/hashedPass)', function () { return sdk.api.users.createOne({ email: email_1, _overrideUnique: true }); }, {
+                            shouldError: true,
+                            onError: function (e) {
+                                var _a, _b;
+                                var rec = (_b = (_a = e === null || e === void 0 ? void 0 : e.info) === null || _a === void 0 ? void 0 : _a[0]) === null || _b === void 0 ? void 0 : _b.existingRecord;
+                                if (!rec || typeof rec !== 'object')
+                                    return false;
+                                var keys = Object.keys(rec);
+                                return (keys.length > 0
+                                    && keys.every(function (k) { return k === '_id' || k === 'businessId' || k === 'id'; })
+                                    && !('email' in rec)
+                                    && !('hashedPass' in rec)
+                                    && !('hashedInviteCode' in rec));
+                            },
+                        })];
+                case 3:
+                    _c.sent();
+                    return [3 /*break*/, 9];
+                case 4:
+                    if (!userId) return [3 /*break*/, 8];
+                    _c.label = 5;
+                case 5:
+                    _c.trys.push([5, 7, , 8]);
+                    return [4 /*yield*/, sdk.api.users.deleteOne(userId)];
+                case 6:
+                    _c.sent();
+                    return [3 /*break*/, 8];
+                case 7:
+                    _b = _c.sent();
+                    return [3 /*break*/, 8];
+                case 8: return [7 /*endfinally*/];
+                case 9: return [2 /*return*/];
+            }
+        });
+    });
+};
+exports.globalunique_leak_tests = globalunique_leak_tests;
+if (require.main === module) {
+    console.log("\uD83C\uDF10 Using API URL: ".concat(host));
+    var sdk_2 = new sdk_1.Session({ host: host });
+    var sdkNonAdmin_1 = new sdk_1.Session({ host: host });
+    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, (0, setup_1.setup_tests)(sdk_2, sdkNonAdmin_1)];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, (0, exports.globalunique_leak_tests)({ sdk: sdk_2, sdkNonAdmin: sdkNonAdmin_1 })];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); };
+    runTests()
+        .then(function () {
+        console.log("✅ globalUnique leak test suite completed successfully");
+        process.exit(0);
+    })
+        .catch(function (error) {
+        console.error("❌ globalUnique leak test suite failed:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=globalunique-conflict-redaction.test.js.map

package/lib/cjs/tests/api_tests/security/globalunique-conflict-redaction.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"globalunique-conflict-redaction.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/globalunique-conflict-redaction.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,oCAAsC;AACtC,+CAG4B;AAC5B,qCAAyC;AAEzC,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE;;;;;;;;;;;;GAYG;AACI,IAAM,uBAAuB,GAAG,UAAO,EAAgD;QAA9C,GAAG,SAAA;;;;;;oBACjD,IAAA,oBAAU,EAAC,0CAA0C,CAAC,CAAA;;;;oBAI9C,UAAQ,uBAAgB,IAAI,CAAC,GAAG,EAAE,iBAAc,CAAA;oBACzC,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,SAAA,EAAS,CAAC,EAAA;;oBAAtD,IAAI,GAAG,SAA+C;oBAC5D,MAAM,GAAG,IAAI,CAAC,EAAE,CAAA;oBAEhB,qBAAM,IAAA,oBAAU,EACd,qFAAqF,EACrF,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,SAAA,EAAE,eAAe,EAAE,IAAI,EAAS,CAAC,EAAhE,CAAgE,EACtE;4BACE,WAAW,EAAE,IAAI;4BACjB,OAAO,EAAE,UAAC,CAAM;;gCACd,IAAM,GAAG,GAAG,MAAA,MAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,IAAI,0CAAG,CAAC,CAAC,0CAAE,cAAc,CAAA;gCACxC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;oCAAE,OAAO,KAAK,CAAA;gCACjD,IAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gCAC7B,OAAO,CACL,IAAI,CAAC,MAAM,GAAG,CAAC;uCACZ,IAAI,CAAC,KAAK,CAAC,UAAA,CAAC,IAAI,OAAA,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,YAAY,IAAI,CAAC,KAAK,IAAI,EAA/C,CAA+C,CAAC;uCAChE,CAAC,CAAC,OAAO,IAAI,GAAG,CAAC;uCACjB,CAAC,CAAC,YAAY,IAAI,GAAG,CAAC;uCACtB,CAAC,CAAC,kBAAkB,IAAI,GAAG,CAAC,CAChC,CAAA;4BACH,CAAC;yBACF,CACF,EAAA;;oBAlBD,SAkBC,CAAA;;;yBAEG,MAAM,EAAN,wBAAM;;;;oBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAA;;oBAArC,SAAqC,CAAA;;;;;;;;;;CAE5D,CAAA;AA/BY,QAAA,uBAAuB,2BA+BnC;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAM,KAAG,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACjC,IAAM,aAAW,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IAEzC,IAAM,QAAQ,GAAG;;;wBACf,qBAAM,IAAA,mBAAW,EAAC,KAAG,EAAE,aAAW,CAAC,EAAA;;oBAAnC,SAAmC,CAAA;oBACnC,qBAAM,IAAA,+BAAuB,EAAC,EAAE,GAAG,OAAA,EAAE,WAAW,eAAA,EAAE,CAAC,EAAA;;oBAAnD,SAAmD,CAAA;;;;SACpD,CAAA;IAED,QAAQ,EAAE;SACP,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAA;QACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAA;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}

package/lib/cjs/tests/api_tests/security/handle-incoming-communication-cross-tenant.test.d.ts

@@ -0,0 +1,24 @@
+import { Session } from "../../../sdk";
+/**
+ * Regression test: `handle_incoming_communication` tenant scoping.
+ *
+ * `journeys.handle_incoming_communication` previously used `buildAllQueries({ unrestricted: true, organizationIds: [] }).endusers.findById(enduserId)`,
+ * permitting cross-tenant lookup of any enduser by id. The handler then called `handleIncomingCommunication(...)`
+ * against the matched enduser, triggering journey progression and automated actions on someone else's tenant.
+ *
+ * The fix switches to the standard tenant-scoped `DB.endusers.findById(enduserId)` wrapper, which automatically
+ * filters by `req.session.businessId`. Cross-tenant lookups now return null → handler returns 404 → no side effect.
+ *
+ * Note: the same-tenant happy path is already covered by the existing test at
+ * `packages/public/sdk/src/tests/tests.ts:7588` ("handle_incoming_communication test for other enduser") — that
+ * test creates endusers in the test tenant, sets up journeys, calls handle_incoming_communication, and asserts
+ * journey-step cancellation. This file covers the negative cases only.
+ *
+ * **Negative-only by design**: the test never drives `handleIncomingCommunication` against a cross-tenant
+ * enduser — the post-fix code returns 404 before any side effects fire, and the assertion confirms that.
+ */
+export declare const handle_incoming_communication_cross_tenant_tests: ({ sdk, sdkNonAdmin }: {
+    sdk: Session;
+    sdkNonAdmin: Session;
+}) => Promise<void>;
+//# sourceMappingURL=handle-incoming-communication-cross-tenant.test.d.ts.map

package/lib/cjs/tests/api_tests/security/handle-incoming-communication-cross-tenant.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handle-incoming-communication-cross-tenant.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/handle-incoming-communication-cross-tenant.test.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAwBtC;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,gDAAgD;SAAwC,OAAO;iBAAe,OAAO;mBA8DjI,CAAA"}