@tellescope/sdk 1.256.13 → 1.256.15

package/lib/esm/tests/api_tests/security/F-0191-schema-adminonly-enforcement.test.js

@@ -0,0 +1,382 @@
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+require('source-map-support').install();
+import axios from "axios";
+import { Session } from "../../../sdk";
+import { assert, log_header, } from "@tellescope/testing";
+import { PROVIDER_PERMISSIONS } from "@tellescope/constants";
+import { setup_tests } from "../../setup";
+var host = process.env.API_URL || 'http://localhost:8080';
+var RAND = function () { return Math.random().toString(36).slice(2, 10); };
+var ALL = 'All';
+var FULL_ACCESS = { create: ALL, read: ALL, update: ALL, delete: ALL };
+/**
+ * Regression test for F-0191
+ * (security-audit/findings/F-0191-schema-adminonly-not-enforced.md).
+ *
+ * `adminOnly: true` on a CUSTOM action in schema.ts was documentation-only. The runtime gate
+ * (routing.ts:944) reads the flag off the options object built by getCustomEndpointFields, and
+ * api.ts:609 set `adminOnly: o.adminOnly` without ever consulting `action.adminOnly`. So every
+ * admin-only custom action had to declare the flag twice, and the copies desynced: 11 of 20
+ * declared custom actions were unenforced at runtime while both public doc artifacts
+ * (openapi.json and the unauthenticated GET /documentation feed, which read the SCHEMA flag)
+ * advertised "**Admin only.**".
+ *
+ * DEFAULT CRUD actions never had this bug — routing.ts:2434 etc. read
+ * model.defaultActions.<op>.adminOnly straight off the schema. The fix
+ * (`adminOnly: o.adminOnly ?? action.adminOnly`) makes custom actions behave the same way.
+ *
+ * Five of the 11 were de-flagged in the schema instead, because the flag itself was wrong and
+ * enforcing it would revert a deliberate decision: users.invite_user carries an explicit
+ * "no longer admin only, but controlled by users.create" and send_invitation_to_existing is its
+ * sibling; organizations.create_and_join is the self-service signup path and would 401 every new
+ * org (a fresh user has no roles — the handler is what grants Admin); sync_note_to_canvas is
+ * designed around `access: 'read'` for non-admin callers; background_errors.mark_read substitutes
+ * its own RBAC check that intentionally admits non-admins holding the verb.
+ *
+ * SAFETY: every probe fails EARLY inside its handler — after the adminOnly gate but before any
+ * vendor call. Pre-fix these requests really do reach the handler, and these handlers talk to
+ * Twilio, Athena and Canvas:
+ *   - trigger_events     : no `action` key + an absent triggerId => the loop `continue`s (inert)
+ *   - athena-subscription: frequency 1 trips the `frequency < 5` guard on the handler's first line
+ *   - sync-athena        : 404s on the missing Athena integration (skipped if one exists)
+ *   - link-twilio        : takes NO parameters and can CREATE A REAL TWILIO SUBACCOUNT, so it is
+ *                          probed only when the org already has a twilioSID (handler short-circuits)
+ *   - twilio-embed       : no phoneNumberSid => 404 no-config or 400, both before any Twilio call
+ *   - handle-autoreply   : absent enduserId => `if (!enduser) return` (communications.ts:42)
+ * Input validation runs BEFORE the adminOnly gate (routing.ts:921 orders access, then validate),
+ * so every probe body must be schema-VALID or the test would prove nothing.
+ *
+ * RED (pre-fix): the six group-B rows fail — each reaches its handler and returns a non-401.
+ * GREEN (post-fix): all six return 401 "Admin access only"; the group-A controls are unchanged.
+ */
+export var schema_adminonly_enforcement_tests = function (_a) {
+    var sdk = _a.sdk;
+    return __awaiter(void 0, void 0, void 0, function () {
+        var checks, record, request, isAdminDenial, summarize, roleId, attackerId, enduserId, role, rbap, attacker, attackerToken, adminToken, attackerSDK, enduser, doomed, ABSENT_ID, athenaIntegrationExists, existing, _b, orgHasTwilioSID, org, _c, groupB, _i, groupB_1, probe, attackerResult, baseline, badProbe, groupA, _d, groupA_1, probe, r, _e, checks_1, c, _f, checks_2, c, _g, _h, _j;
+        var _k;
+        return __generator(this, function (_l) {
+            switch (_l.label) {
+                case 0:
+                    log_header("F-0191: schema-declared adminOnly must be enforced on custom actions");
+                    checks = [];
+                    record = function (label, pass, detail) { return checks.push({ label: label, pass: pass, detail: detail }); };
+                    request = function (authToken, method, path, data) { return __awaiter(void 0, void 0, void 0, function () {
+                        var r;
+                        return __generator(this, function (_a) {
+                            switch (_a.label) {
+                                case 0: return [4 /*yield*/, axios.request(__assign(__assign({ method: method, url: "".concat(host, "/v1").concat(path) }, method === 'get' ? { params: data } : { data: data }), { headers: { Authorization: "Bearer ".concat(authToken) }, validateStatus: function () { return true; } }))];
+                                case 1:
+                                    r = _a.sent();
+                                    return [2 /*return*/, { status: r.status, body: r.data }];
+                            }
+                        });
+                    }); };
+                    isAdminDenial = function (r) {
+                        var _a;
+                        return (r.status === 401 && ((_a = r.body) === null || _a === void 0 ? void 0 : _a.message) === 'Admin access only');
+                    };
+                    summarize = function (r) {
+                        var _a;
+                        return ("".concat(r.status, " ").concat(((_a = JSON.stringify(r.body)) !== null && _a !== void 0 ? _a : '').slice(0, 120)));
+                    };
+                    roleId = '';
+                    attackerId = '';
+                    enduserId = '';
+                    _l.label = 1;
+                case 1:
+                    _l.trys.push([1, , 27, 40]);
+                    role = "f0191-staff-".concat(RAND());
+                    return [4 /*yield*/, sdk.api.role_based_access_permissions.createOne({
+                            role: role,
+                            permissions: __assign(__assign({}, PROVIDER_PERMISSIONS), { 
+                                // grant exactly the verbs the actions under test declare, so a rejection proves the ADMIN
+                                // gate fired rather than ordinary RBAC
+                                automation_triggers: FULL_ACCESS, organizations: FULL_ACCESS, availability_blocks: FULL_ACCESS, background_errors: FULL_ACCESS, users: FULL_ACCESS }),
+                        })];
+                case 2:
+                    rbap = _l.sent();
+                    roleId = rbap.id;
+                    return [4 /*yield*/, sdk.api.users.createOne({
+                            email: "f0191-attacker-".concat(RAND(), "@tellescope.example"),
+                            fname: 'F0191', lname: 'Staff',
+                            verifiedEmail: true,
+                            notificationEmailsDisabled: true,
+                            roles: [role],
+                        })];
+                case 3:
+                    attacker = _l.sent();
+                    attackerId = attacker.id;
+                    return [4 /*yield*/, sdk.api.users.generate_auth_token({ id: attackerId })];
+                case 4:
+                    attackerToken = (_l.sent()).authToken;
+                    return [4 /*yield*/, sdk.api.users.generate_auth_token({ id: sdk.userInfo.id })];
+                case 5:
+                    adminToken = (_l.sent()).authToken;
+                    attackerSDK = new Session({ host: host, authToken: attackerToken });
+                    return [4 /*yield*/, attackerSDK.refresh_session()];
+                case 6:
+                    _l.sent();
+                    record('setup: attacker is a non-admin holding every verb under test', attackerSDK.userInfo.id === attackerId && !((_k = attackerSDK.userInfo.roles) !== null && _k !== void 0 ? _k : []).includes('Admin'), "id=".concat(attackerSDK.userInfo.id, " roles=").concat(JSON.stringify(attackerSDK.userInfo.roles)));
+                    return [4 /*yield*/, sdk.api.endusers.createOne({ fname: 'F0191', lname: 'Patient' })];
+                case 7:
+                    enduser = _l.sent();
+                    enduserId = enduser.id;
+                    return [4 /*yield*/, sdk.api.endusers.createOne({ fname: 'F0191', lname: 'Absent' })];
+                case 8:
+                    doomed = _l.sent();
+                    ABSENT_ID = doomed.id;
+                    return [4 /*yield*/, sdk.api.endusers.deleteOne(ABSENT_ID)
+                        /* ===== environment guards for the two probes input alone cannot make safe ===== */
+                    ];
+                case 9:
+                    _l.sent();
+                    athenaIntegrationExists = false;
+                    _l.label = 10;
+                case 10:
+                    _l.trys.push([10, 12, , 13]);
+                    return [4 /*yield*/, sdk.api.integrations.load_redacted({})];
+                case 11:
+                    existing = _l.sent();
+                    athenaIntegrationExists = !!existing.integrations.find(function (i) { var _a; return /athena/i.test((_a = i.title) !== null && _a !== void 0 ? _a : ''); });
+                    return [3 /*break*/, 13];
+                case 12:
+                    _b = _l.sent();
+                    return [3 /*break*/, 13];
+                case 13:
+                    orgHasTwilioSID = false;
+                    _l.label = 14;
+                case 14:
+                    _l.trys.push([14, 16, , 17]);
+                    return [4 /*yield*/, sdk.api.organizations.getOne(sdk.userInfo.businessId)];
+                case 15:
+                    org = _l.sent();
+                    orgHasTwilioSID = !!(org === null || org === void 0 ? void 0 : org.twilioSID);
+                    return [3 /*break*/, 17];
+                case 16:
+                    _c = _l.sent();
+                    return [3 /*break*/, 17];
+                case 17:
+                    groupB = [
+                        {
+                            label: 'automation_triggers.trigger_events',
+                            method: 'post', path: '/automation-triggers/trigger-events',
+                            // no `action` key: stays off the arbitrary-action-execution branch entirely
+                            data: { triggers: [{ enduserId: enduserId, automationTriggerId: ABSENT_ID }] },
+                        },
+                        {
+                            label: 'organizations.add_athena_subscription',
+                            method: 'post', path: '/organizations/athena-subscription',
+                            data: { type: 'patients', frequency: 1 }, // trips `frequency < 5` on the handler's first line
+                        },
+                        {
+                            label: 'organizations.sync_athena_subscription',
+                            method: 'post', path: '/organizations/sync-athena-subscription',
+                            data: { type: 'patients' },
+                            skip: athenaIntegrationExists
+                                ? 'org HAS an Athena integration — probing would call Athena.process_subscription for real'
+                                : undefined,
+                        },
+                        {
+                            label: 'organizations.link_twilio',
+                            method: 'post', path: '/organizations/link-twilio',
+                            data: {},
+                            skip: orgHasTwilioSID
+                                ? undefined
+                                : 'org has no twilioSID — probing would CREATE A REAL TWILIO SUBACCOUNT',
+                        },
+                        {
+                            label: 'organizations.load_twilio_embed',
+                            method: 'get', path: '/organizations/twilio-embed',
+                            data: { type: 'tfn-verification' }, // no phoneNumberSid => rejected before any Twilio call
+                        },
+                        {
+                            label: 'availability_blocks.handle_autoreply',
+                            method: 'post', path: '/handle-out-of-office-autoreply',
+                            data: { channel: 'Email', enduserId: ABSENT_ID }, // communications.ts:42 `if (!enduser) return`
+                        },
+                    ];
+                    _i = 0, groupB_1 = groupB;
+                    _l.label = 18;
+                case 18:
+                    if (!(_i < groupB_1.length)) return [3 /*break*/, 22];
+                    probe = groupB_1[_i];
+                    if (probe.skip) {
+                        record("B: ".concat(probe.label, " rejects a non-admin"), true, "SKIPPED (safety) \u2014 ".concat(probe.skip));
+                        return [3 /*break*/, 21];
+                    }
+                    return [4 /*yield*/, request(attackerToken, probe.method, probe.path, probe.data)
+                        // baseline: an admin must NOT be admin-denied on the same path, so a blanket 401 can't pass
+                    ];
+                case 19:
+                    attackerResult = _l.sent();
+                    return [4 /*yield*/, request(adminToken, probe.method, probe.path, probe.data)];
+                case 20:
+                    baseline = _l.sent();
+                    badProbe = isAdminDenial(baseline);
+                    record("B: ".concat(probe.label, " rejects a non-admin"), !badProbe && isAdminDenial(attackerResult), "attacker=".concat(summarize(attackerResult), " | admin baseline=").concat(baseline.status)
+                        + (badProbe ? ' BAD PROBE: admin was also admin-denied' : ''));
+                    _l.label = 21;
+                case 21:
+                    _i++;
+                    return [3 /*break*/, 18];
+                case 22:
+                    groupA = [
+                        {
+                            label: 'organizations.sync_note_to_canvas',
+                            method: 'post', path: '/organizations/sync-note-to-canvas',
+                            data: { enduserId: ABSENT_ID, note: 'F-0191 control' }, // 404 Enduser not found
+                        },
+                        {
+                            label: 'background_errors.mark_read',
+                            method: 'post', path: '/background-errors/mark-read', data: {},
+                        },
+                        {
+                            label: 'users.send_invitation_to_existing',
+                            method: 'post', path: '/invite-existing-user-to-organization',
+                            // takes userId (not email); an absent id hits RecordNotFoundError, well short of any invite
+                            data: { userId: ABSENT_ID },
+                        },
+                    ];
+                    _d = 0, groupA_1 = groupA;
+                    _l.label = 23;
+                case 23:
+                    if (!(_d < groupA_1.length)) return [3 /*break*/, 26];
+                    probe = groupA_1[_d];
+                    return [4 /*yield*/, request(attackerToken, probe.method, probe.path, probe.data)];
+                case 24:
+                    r = _l.sent();
+                    record("A: ".concat(probe.label, " stays reachable by a non-admin (flag intentionally dropped)"), !isAdminDenial(r), "".concat(summarize(r), " (expected a handler response, not 401 Admin access only)"));
+                    _l.label = 25;
+                case 25:
+                    _d++;
+                    return [3 /*break*/, 23];
+                case 26:
+                    /* ===== report: print full table first, then assert (harness exits on first failure) ===== */
+                    console.log('\n  F-0191 check summary:');
+                    for (_e = 0, checks_1 = checks; _e < checks_1.length; _e++) {
+                        c = checks_1[_e];
+                        console.log("    ".concat(c.pass ? 'PASS' : 'FAIL', "  ").concat(c.label, "  \u2014  ").concat(c.detail));
+                    }
+                    console.log('');
+                    for (_f = 0, checks_2 = checks; _f < checks_2.length; _f++) {
+                        c = checks_2[_f];
+                        assert(c.pass, "".concat(c.label, " \u2014 ").concat(c.detail), c.label);
+                    }
+                    return [3 /*break*/, 40];
+                case 27:
+                    if (!enduserId) return [3 /*break*/, 31];
+                    _l.label = 28;
+                case 28:
+                    _l.trys.push([28, 30, , 31]);
+                    return [4 /*yield*/, sdk.api.endusers.deleteOne(enduserId)];
+                case 29:
+                    _l.sent();
+                    return [3 /*break*/, 31];
+                case 30:
+                    _g = _l.sent();
+                    return [3 /*break*/, 31];
+                case 31:
+                    if (!attackerId) return [3 /*break*/, 35];
+                    _l.label = 32;
+                case 32:
+                    _l.trys.push([32, 34, , 35]);
+                    return [4 /*yield*/, sdk.api.users.deleteOne(attackerId)];
+                case 33:
+                    _l.sent();
+                    return [3 /*break*/, 35];
+                case 34:
+                    _h = _l.sent();
+                    return [3 /*break*/, 35];
+                case 35:
+                    if (!roleId) return [3 /*break*/, 39];
+                    _l.label = 36;
+                case 36:
+                    _l.trys.push([36, 38, , 39]);
+                    return [4 /*yield*/, sdk.api.role_based_access_permissions.deleteOne(roleId)];
+                case 37:
+                    _l.sent();
+                    return [3 /*break*/, 39];
+                case 38:
+                    _j = _l.sent();
+                    return [3 /*break*/, 39];
+                case 39: return [7 /*endfinally*/];
+                case 40: return [2 /*return*/];
+            }
+        });
+    });
+};
+// Allow running this test file independently
+if (require.main === module) {
+    console.log("\uD83C\uDF10 Using API URL: ".concat(host));
+    var sdk_1 = new Session({ host: host });
+    var sdkNonAdmin_1 = new Session({ host: host });
+    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, setup_tests(sdk_1, sdkNonAdmin_1)];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, schema_adminonly_enforcement_tests({ sdk: sdk_1, sdkNonAdmin: sdkNonAdmin_1 })];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); };
+    runTests()
+        .then(function () {
+        console.log("✅ F-0191 schema adminOnly enforcement test suite completed successfully");
+        process.exit(0);
+    })
+        .catch(function (error) {
+        console.error("❌ F-0191 schema adminOnly enforcement test suite failed:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=F-0191-schema-adminonly-enforcement.test.js.map

package/lib/esm/tests/api_tests/security/F-0191-schema-adminonly-enforcement.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"F-0191-schema-adminonly-enforcement.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/F-0191-schema-adminonly-enforcement.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EACL,MAAM,EACN,UAAU,GACX,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEzC,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE,IAAM,IAAI,GAAG,cAAM,OAAA,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAvC,CAAuC,CAAA;AAE1D,IAAM,GAAG,GAAG,KAAc,CAAA;AAC1B,IAAM,WAAW,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;AAQxE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,CAAC,IAAM,kCAAkC,GAAG,UAAO,EAAgD;QAA9C,GAAG,SAAA;;;;;;;oBAC5D,UAAU,CAAC,sEAAsE,CAAC,CAAA;oBAE5E,MAAM,GAAY,EAAE,CAAA;oBACpB,MAAM,GAAG,UAAC,KAAa,EAAE,IAAa,EAAE,MAAc,IAAK,OAAA,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,OAAA,EAAE,IAAI,MAAA,EAAE,MAAM,QAAA,EAAE,CAAC,EAApC,CAAoC,CAAA;oBAG/F,OAAO,GAAG,UACd,SAAiB,EAAE,MAAsB,EAAE,IAAY,EAAE,IAAU;;;;wCAEzD,qBAAM,KAAK,CAAC,OAAO,qBAC3B,MAAM,QAAA,EACN,GAAG,EAAE,UAAG,IAAI,gBAAM,IAAI,CAAE,IACrB,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,MAAA,EAAE,KACjD,OAAO,EAAE,EAAE,aAAa,EAAE,iBAAU,SAAS,CAAE,EAAE,EACjD,cAAc,EAAE,cAAM,OAAA,IAAI,EAAJ,CAAI,IAC1B,EAAA;;oCANI,CAAC,GAAG,SAMR;oCACF,sBAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAA;;;yBAC1C,CAAA;oBAEK,aAAa,GAAG,UAAC,CAAgC;;wBAAK,OAAA,CAC1D,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAA,MAAA,CAAC,CAAC,IAAI,0CAAE,OAAO,MAAK,mBAAmB,CAC5D,CAAA;qBAAA,CAAA;oBACK,SAAS,GAAG,UAAC,CAAgC;;wBAAK,OAAA,CACtD,UAAG,CAAC,CAAC,MAAM,cAAI,CAAC,MAAA,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,mCAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAE,CAC9D,CAAA;qBAAA,CAAA;oBAEG,MAAM,GAAG,EAAE,CAAA;oBACX,UAAU,GAAG,EAAE,CAAA;oBACf,SAAS,GAAG,EAAE,CAAA;;;;oBAKV,IAAI,GAAG,sBAAe,IAAI,EAAE,CAAE,CAAA;oBACvB,qBAAM,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,SAAS,CAAC;4BACjE,IAAI,MAAA;4BACJ,WAAW,wBACN,oBAAoB;gCACvB,0FAA0F;gCAC1F,uCAAuC;gCACvC,mBAAmB,EAAE,WAAW,EAChC,aAAa,EAAE,WAAW,EAC1B,mBAAmB,EAAE,WAAW,EAChC,iBAAiB,EAAE,WAAW,EAC9B,KAAK,EAAE,WAAW,GACnB;yBACK,CAAC,EAAA;;oBAZH,IAAI,GAAG,SAYJ;oBACT,MAAM,GAAG,IAAI,CAAC,EAAE,CAAA;oBAEC,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;4BAC7C,KAAK,EAAE,yBAAkB,IAAI,EAAE,wBAAqB;4BACpD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO;4BAC9B,aAAa,EAAE,IAAI;4BACnB,0BAA0B,EAAE,IAAI;4BAChC,KAAK,EAAE,CAAC,IAAI,CAAC;yBACP,CAAC,EAAA;;oBANH,QAAQ,GAAG,SAMR;oBACT,UAAU,GAAG,QAAQ,CAAC,EAAE,CAAA;oBAED,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAA;;oBAA5E,aAAa,GAAG,CAAC,SAA2D,CAAC,CAAC,SAAS;oBACzE,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,EAAA;;oBAA9E,UAAU,GAAG,CAAC,SAAgE,CAAC,CAAC,SAAS;oBAEzF,WAAW,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,MAAA,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAA;oBACnE,qBAAM,WAAW,CAAC,eAAe,EAAE,EAAA;;oBAAnC,SAAmC,CAAA;oBACnC,MAAM,CACJ,8DAA8D,EAC9D,WAAW,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,IAAI,CAAC,CAAC,MAAA,WAAW,CAAC,QAAQ,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAC/F,aAAM,WAAW,CAAC,QAAQ,CAAC,EAAE,oBAAU,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAE,CACpF,CAAA;oBAEe,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAA;;oBAAhF,OAAO,GAAG,SAAsE;oBACtF,SAAS,GAAG,OAAO,CAAC,EAAE,CAAA;oBAIP,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAA;;oBAA9E,MAAM,GAAG,SAAqE;oBAC9E,SAAS,GAAG,MAAM,CAAC,EAAE,CAAA;oBAC3B,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC;wBAE3C,oFAAoF;sBAFzC;;oBAA3C,SAA2C,CAAA;oBAIvC,uBAAuB,GAAG,KAAK,CAAA;;;;oBAEhB,qBAAM,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC,EAAE,CAAC,EAAA;;oBAAvD,QAAQ,GAAG,SAA4C;oBAC7D,uBAAuB,GAAG,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,UAAC,CAAM,YAAK,OAAA,SAAS,CAAC,IAAI,CAAC,MAAA,CAAC,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAA,EAAA,CAAC,CAAA;;;;;;oBAG/F,eAAe,GAAG,KAAK,CAAA;;;;oBAEb,qBAAM,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAA;;oBAAjE,GAAG,GAAG,SAA2D;oBACvE,eAAe,GAAG,CAAC,CAAC,CAAC,GAAW,aAAX,GAAG,uBAAH,GAAG,CAAU,SAAS,CAAA,CAAA;;;;;;oBAKvC,MAAM,GAEN;wBACJ;4BACE,KAAK,EAAE,oCAAoC;4BAC3C,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qCAAqC;4BAC3D,4EAA4E;4BAC5E,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,WAAA,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAC,EAAE;yBACpE;wBACD;4BACE,KAAK,EAAE,uCAAuC;4BAC9C,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oCAAoC;4BAC1D,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,oDAAoD;yBAC/F;wBACD;4BACE,KAAK,EAAE,wCAAwC;4BAC/C,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yCAAyC;4BAC/D,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;4BAC1B,IAAI,EAAE,uBAAuB;gCAC3B,CAAC,CAAC,yFAAyF;gCAC3F,CAAC,CAAC,SAAS;yBACd;wBACD;4BACE,KAAK,EAAE,2BAA2B;4BAClC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B;4BAClD,IAAI,EAAE,EAAE;4BACR,IAAI,EAAE,eAAe;gCACnB,CAAC,CAAC,SAAS;gCACX,CAAC,CAAC,sEAAsE;yBAC3E;wBACD;4BACE,KAAK,EAAE,iCAAiC;4BACxC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B;4BAClD,IAAI,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,uDAAuD;yBAC5F;wBACD;4BACE,KAAK,EAAE,sCAAsC;4BAC7C,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC;4BACvD,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,8CAA8C;yBACjG;qBACF,CAAA;0BAEyB,EAAN,iBAAM;;;yBAAN,CAAA,oBAAM,CAAA;oBAAf,KAAK;oBACd,IAAI,KAAK,CAAC,IAAI,EAAE;wBACd,MAAM,CAAC,aAAM,KAAK,CAAC,KAAK,yBAAsB,EAAE,IAAI,EAAE,kCAAsB,KAAK,CAAC,IAAI,CAAE,CAAC,CAAA;wBACzF,yBAAQ;qBACT;oBAEsB,qBAAM,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC;wBACzF,4FAA4F;sBADH;;oBAAnF,cAAc,GAAG,SAAkE;oBAExE,qBAAM,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,EAAA;;oBAA1E,QAAQ,GAAG,SAA+D;oBAC1E,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAA;oBAExC,MAAM,CACJ,aAAM,KAAK,CAAC,KAAK,yBAAsB,EACvC,CAAC,QAAQ,IAAI,aAAa,CAAC,cAAc,CAAC,EAC1C,mBAAY,SAAS,CAAC,cAAc,CAAC,+BAAqB,QAAQ,CAAC,MAAM,CAAE;0BACvE,CAAC,QAAQ,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,EAAE,CAAC,CAChE,CAAA;;;oBAhBiB,IAAM,CAAA;;;oBAqBpB,MAAM,GAA0E;wBACpF;4BACE,KAAK,EAAE,mCAAmC;4BAC1C,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oCAAoC;4BAC1D,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,wBAAwB;yBACjF;wBACD;4BACE,KAAK,EAAE,6BAA6B;4BACpC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,EAAE;yBAC/D;wBACD;4BACE,KAAK,EAAE,mCAAmC;4BAC1C,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uCAAuC;4BAC7D,4FAA4F;4BAC5F,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;yBAC5B;qBACF,CAAA;0BAEyB,EAAN,iBAAM;;;yBAAN,CAAA,oBAAM,CAAA;oBAAf,KAAK;oBACJ,qBAAM,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,EAAA;;oBAAtE,CAAC,GAAG,SAAkE;oBAC5E,MAAM,CACJ,aAAM,KAAK,CAAC,KAAK,iEAA8D,EAC/E,CAAC,aAAa,CAAC,CAAC,CAAC,EACjB,UAAG,SAAS,CAAC,CAAC,CAAC,8DAA2D,CAC3E,CAAA;;;oBANiB,IAAM,CAAA;;;oBAS1B,8FAA8F;oBAC9F,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAA;oBACxC,WAAsB,EAAN,iBAAM,EAAN,oBAAM,EAAN,IAAM,EAAE;wBAAb,CAAC;wBACV,OAAO,CAAC,GAAG,CAAC,cAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,eAAK,CAAC,CAAC,KAAK,uBAAQ,CAAC,CAAC,MAAM,CAAE,CAAC,CAAA;qBAC3E;oBACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;oBAEf,WAAsB,EAAN,iBAAM,EAAN,oBAAM,EAAN,IAAM,EAAE;wBAAb,CAAC;wBACV,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,UAAG,CAAC,CAAC,KAAK,qBAAM,CAAC,CAAC,MAAM,CAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAA;qBACpD;;;yBAEG,SAAS,EAAT,yBAAS;;;;oBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,EAAA;;oBAA3C,SAA2C,CAAA;;;;;;yBAC9D,UAAU,EAAV,yBAAU;;;;oBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,EAAA;;oBAAzC,SAAyC,CAAA;;;;;;yBAC7D,MAAM,EAAN,yBAAM;;;;oBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,SAAS,CAAC,MAAM,CAAC,EAAA;;oBAA7D,SAA6D,CAAA;;;;;;;;;;CAEpF,CAAA;AAED,6CAA6C;AAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAM,KAAG,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACjC,IAAM,aAAW,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IAEzC,IAAM,QAAQ,GAAG;;;wBACf,qBAAM,WAAW,CAAC,KAAG,EAAE,aAAW,CAAC,EAAA;;oBAAnC,SAAmC,CAAA;oBACnC,qBAAM,kCAAkC,CAAC,EAAE,GAAG,OAAA,EAAE,WAAW,eAAA,EAAE,CAAC,EAAA;;oBAA9D,SAA8D,CAAA;;;;SAC/D,CAAA;IAED,QAAQ,EAAE;SACP,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAA;QACtF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,0DAA0D,EAAE,KAAK,CAAC,CAAA;QAChF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}

package/lib/esm/tests/api_tests/security/F-0192-automated-actions-process-gate.test.d.ts

@@ -0,0 +1,43 @@
+import { Session } from "../../../sdk";
+/**
+ * Regression test for F-0192
+ * (security-audit/findings/F-0192-automated-actions-process-fire-replay.md).
+ *
+ * `automated_actions.process` (api.ts:3902) is the WORKER's action runner — its schema description
+ * reads "Used by worker for new action types". It was registered with only
+ * `{ requiresSubscription: true }`, so the framework gated it on the ordinary
+ * `automated_actions.update` verb, which the default provider role holds ('Assigned'). The handler
+ * then dispatched `automatedAction.action` through a 14-branch if-chain reaching real vendors:
+ * chargebeeChargeCardOnFile (card charge), belugaAutoRx / belugaTriggerRefill / mdiTriggerRefill
+ * (prescriptions and refills), createScriptSureDraft (medication draft), healthiePushForms /
+ * metriportPushFormResponse (PHI export). It checked neither the row's `status` nor whether it had
+ * already run, so any row was replayable: MDI advances to the next scheduled refill each call,
+ * Chargebee charges again. And there was no storeUserLog, so the action was attributed to the
+ * worker rather than the caller.
+ *
+ * The fix has three parts:
+ *   1. `adminOnly: true` on the api.ts registration (routing.ts:944 reads the flag from that
+ *      options object — a schema-only flag is inert, which is the separate finding F-0191).
+ *   2. A single-fire claim for human callers: an atomic findOneAndUpdate with `status: 'active'` in
+ *      the filter, stamping `finished` + `processedAt` before the vendor dispatch. The worker
+ *      (`wasAutomated`) is exempt because its own claim in
+ *      worker/modules/database.ts:114 is already atomic and it needs the row to stay 'active'
+ *      across the call so a retryable failure (worker/modules/automations.ts:2053) can be
+ *      re-claimed after the lock times out.
+ *   3. storeUserLog on the human path, recording the caller and the automatedActionId.
+ *
+ * The seeded row uses `setEnduserStatus`, which is NOT one of the API's if-chain branches, so it
+ * falls through to `{ success: false, unimplemented: true }` (api.ts) — no vendor call, no Bedrock,
+ * no PHI export. `processAfter` is set an hour out so the live worker cannot race the row (the same
+ * trick mdi_trigger_refill / beluga_trigger_refill use).
+ *
+ * RED (pre-fix): A1 fails (a non-admin holding only `automated_actions.update` reaches the handler)
+ * and C1 fails (the second call on the same row executes again instead of being rejected).
+ * B1 (admin positive control) passes pre-fix and must keep passing.
+ * GREEN (post-fix): all five checks pass.
+ */
+export declare const automated_actions_process_gate_tests: ({ sdk }: {
+    sdk: Session;
+    sdkNonAdmin: Session;
+}) => Promise<void>;
+//# sourceMappingURL=F-0192-automated-actions-process-gate.test.d.ts.map

package/lib/esm/tests/api_tests/security/F-0192-automated-actions-process-gate.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"F-0192-automated-actions-process-gate.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/F-0192-automated-actions-process-gate.test.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AA0BtC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,eAAO,MAAM,oCAAoC;SAA2B,OAAO;iBAAe,OAAO;mBAoJxG,CAAA"}