@tellescope/sdk 1.256.13 → 1.256.15

package/lib/esm/tests/api_tests/security/F-0196-add-to-journey-foreign-enduserid.test.js

@@ -0,0 +1,277 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+require('source-map-support').install();
+import { assert_checks, setup_isolated_tenant, } from "../../setup_isolated";
+var host = process.env.API_URL || 'http://localhost:8080';
+var RAND = function () { return Math.random().toString(36).slice(2, 10); };
+// far enough out that a locally running worker never claims the rows we inspect
+var FUTURE_START = function () { return new Date(Date.now() + 60 * 60 * 1000); };
+/**
+ * Regression test for F-0196
+ * (security-audit/findings/F-0196-add-to-journey-plants-foreign-enduserid.md).
+ *
+ * `endusers.add_to_journey` inserted an `automated_actions` row for EACH caller-supplied `enduserId`
+ * with only mongoId-shape validation and no tenant-membership check. The preceding
+ * `DB.endusers.updateMany` is scoped but its result was discarded, and
+ * `DB.automated_actions.insertMany` is a direct write that bypasses the `ensureValidDependentKeys`
+ * foreign-key check the generic CRUD route gets. The resulting row is stamped
+ * `businessId: <caller's tenant>` while carrying `enduserId: <a victim in another tenant>`.
+ *
+ * The worker then dereferences that enduser with the raw driver and no `businessId`
+ * (worker/modules/automations.ts, the F-0074/F-0111/F-0159 family), so the victim's record loads
+ * under the attacker's automation: `pushFormsToPortal` copies the victim's PHI into the attacker's
+ * `form_responses` (readable by their staff) and `iterableCustomEvent` writes an attacker-authored
+ * note into the victim's chart. F-0196 is the reachability that made those three exploitable.
+ *
+ * There are TWO independent plant sites and a fix to only one is a half fix:
+ *   - inline branch, taken when `automationStepId` is supplied (api.ts add_to_journey handler)
+ *   - module branch, taken when it is not: `handle_automation_event`'s
+ *     `validEnduserIds = conditionsQuery ? <scoped find> : event.enduserIds` passes caller ids
+ *     straight through for a step with NO conditions.
+ * Both are covered below (A1/A2).
+ *
+ * Design notes:
+ *   - Two provisioned tenants, so the victim is a real foreign enduser and we can also assert their
+ *     record was not mutated. Both must come from provisioning: `add_to_journey` is
+ *     `requiresSubscription: true`, and a `create_and_join` org is born with an expired subscription.
+ *   - The steps use `setEnduserStatus` — no vendor, no Bedrock — and `startAt` is an hour out so a
+ *     running worker cannot process the rows before we read them.
+ *   - `throttle` is deliberately omitted: it is the only way add_to_journey's per-pair rate limit can
+ *     throw.
+ *   - Everything is observable through `automated_actions` reads, so the worker is never needed.
+ *
+ * RED (pre-fix): A1, A2 and B2 fail — the victim's id appears in the attacker tenant's
+ * automated_actions. GREEN (post-fix): the foreign id is silently dropped and the caller's own
+ * endusers still enroll normally.
+ */
+export var add_to_journey_foreign_enduserid_checks = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var checks, record, attacker, victimTenant, victim, own, makeJourney, inline, modulePath, mixed, rowsFor_1, enduserIdsFor, inlineResult, inlineIds, moduleResult, moduleIds, victimAfter, victimJourneys, inlineOwn, moduleOwn, mixedResult, mixedIds, _i, _a, t, e_1;
+    var _b;
+    var _c;
+    return __generator(this, function (_d) {
+        switch (_d.label) {
+            case 0:
+                checks = [];
+                record = function (label, pass, detail) { return checks.push({ label: label, pass: pass, detail: detail }); };
+                _d.label = 1;
+            case 1:
+                _d.trys.push([1, , 19, 26]);
+                /* ================= fixtures: two isolated tenants ================= */
+                ;
+                return [4 /*yield*/, Promise.all([
+                        setup_isolated_tenant({ name: "F0196 attacker ".concat(RAND()), users: [{ isAdmin: true }], apiKeys: 0 }),
+                        setup_isolated_tenant({ name: "F0196 victim ".concat(RAND()), users: [{ isAdmin: true }], apiKeys: 0 }),
+                    ])];
+            case 2:
+                _b = _d.sent(), attacker = _b[0], victimTenant = _b[1];
+                return [4 /*yield*/, victimTenant.sdk.api.endusers.createOne({ fname: 'F0196', lname: 'Victim' })];
+            case 3:
+                victim = _d.sent();
+                return [4 /*yield*/, attacker.sdk.api.endusers.createOne({ fname: 'F0196', lname: 'OwnPatient' })];
+            case 4:
+                own = _d.sent();
+                record('setup: two separate tenants, victim belongs to the other one', attacker.businessId !== victimTenant.businessId && !!victim.id && !!own.id, "attacker=".concat(attacker.businessId, " victim tenant=").concat(victimTenant.businessId, " victimEnduser=").concat(victim.id));
+                makeJourney = function (title) { return __awaiter(void 0, void 0, void 0, function () {
+                    var journey, step;
+                    return __generator(this, function (_a) {
+                        switch (_a.label) {
+                            case 0: return [4 /*yield*/, attacker.sdk.api.journeys.createOne({ title: "".concat(title, " ").concat(RAND()) })];
+                            case 1:
+                                journey = _a.sent();
+                                return [4 /*yield*/, attacker.sdk.api.automation_steps.createOne({
+                                        journeyId: journey.id,
+                                        // benign and worker-local: no vendor, no Bedrock. NO `conditions`, which is precisely the
+                                        // vulnerable branch in handle_automation_event.
+                                        action: { type: 'setEnduserStatus', info: { status: 'F0196' } },
+                                        events: [{ type: 'onJourneyStart', info: {} }],
+                                    })];
+                            case 2:
+                                step = _a.sent();
+                                return [2 /*return*/, { journey: journey, step: step }];
+                        }
+                    });
+                }); };
+                return [4 /*yield*/, makeJourney('F0196 inline')];
+            case 5:
+                inline = _d.sent();
+                return [4 /*yield*/, makeJourney('F0196 module')];
+            case 6:
+                modulePath = _d.sent();
+                return [4 /*yield*/, makeJourney('F0196 mixed')
+                    /** every automated_actions row the attacker tenant can see for a journey */
+                ];
+            case 7:
+                mixed = _d.sent();
+                rowsFor_1 = function (journeyId) { return __awaiter(void 0, void 0, void 0, function () {
+                    return __generator(this, function (_a) {
+                        switch (_a.label) {
+                            case 0: return [4 /*yield*/, attacker.sdk.api.automated_actions.getSome({ filter: { journeyId: journeyId } })];
+                            case 1: return [2 /*return*/, (_a.sent())];
+                        }
+                    });
+                }); };
+                enduserIdsFor = function (journeyId) { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                    switch (_a.label) {
+                        case 0: return [4 /*yield*/, rowsFor_1(journeyId)];
+                        case 1: return [2 /*return*/, (_a.sent()).map(function (r) { return r.enduserId; })
+                            /* ===== A: the foreign id must never be planted, on EITHER branch ===== */
+                            // A1 — inline branch: automationStepId supplied
+                        ];
+                    }
+                }); }); };
+                return [4 /*yield*/, attacker.sdk.api.endusers.add_to_journey({
+                        enduserIds: [victim.id],
+                        journeyId: inline.journey.id,
+                        automationStepId: inline.step.id,
+                        startAt: FUTURE_START(),
+                    }).then(function () { return 'resolved'; }).catch(function (e) { return "rejected: ".concat((e === null || e === void 0 ? void 0 : e.message) || e); })];
+            case 8:
+                inlineResult = _d.sent();
+                return [4 /*yield*/, enduserIdsFor(inline.journey.id)];
+            case 9:
+                inlineIds = _d.sent();
+                record('A1: inline branch (automationStepId) does not plant a foreign enduserId', !inlineIds.includes(victim.id), "call=".concat(inlineResult, "; automated_actions enduserIds=").concat(JSON.stringify(inlineIds), " (must not contain ").concat(victim.id, ")"));
+                return [4 /*yield*/, attacker.sdk.api.endusers.add_to_journey({
+                        enduserIds: [victim.id],
+                        journeyId: modulePath.journey.id,
+                        startAt: FUTURE_START(),
+                    }).then(function () { return 'resolved'; }).catch(function (e) { return "rejected: ".concat((e === null || e === void 0 ? void 0 : e.message) || e); })];
+            case 10:
+                moduleResult = _d.sent();
+                return [4 /*yield*/, enduserIdsFor(modulePath.journey.id)];
+            case 11:
+                moduleIds = _d.sent();
+                record('A2: module branch (no automationStepId) does not plant a foreign enduserId', !moduleIds.includes(victim.id), "call=".concat(moduleResult, "; automated_actions enduserIds=").concat(JSON.stringify(moduleIds), " (must not contain ").concat(victim.id, ")"));
+                return [4 /*yield*/, victimTenant.sdk.api.endusers.getOne(victim.id)];
+            case 12:
+                victimAfter = _d.sent();
+                victimJourneys = (_c = victimAfter === null || victimAfter === void 0 ? void 0 : victimAfter.journeys) !== null && _c !== void 0 ? _c : {};
+                record('A3: the victim enduser was not enrolled in the attacker\'s journey', !victimJourneys[inline.journey.id] && !victimJourneys[modulePath.journey.id], "victim journeys=".concat(JSON.stringify(victimJourneys)));
+                /* ===== B: legitimate use must keep working ===== */
+                // B1 — positive control on both branches, so a blanket failure can't masquerade as a fix
+                return [4 /*yield*/, attacker.sdk.api.endusers.add_to_journey({
+                        enduserIds: [own.id],
+                        journeyId: inline.journey.id,
+                        automationStepId: inline.step.id,
+                        startAt: FUTURE_START(),
+                    })];
+            case 13:
+                /* ===== B: legitimate use must keep working ===== */
+                // B1 — positive control on both branches, so a blanket failure can't masquerade as a fix
+                _d.sent();
+                return [4 /*yield*/, attacker.sdk.api.endusers.add_to_journey({
+                        enduserIds: [own.id],
+                        journeyId: modulePath.journey.id,
+                        startAt: FUTURE_START(),
+                    })];
+            case 14:
+                _d.sent();
+                return [4 /*yield*/, enduserIdsFor(inline.journey.id)];
+            case 15:
+                inlineOwn = _d.sent();
+                return [4 /*yield*/, enduserIdsFor(modulePath.journey.id)];
+            case 16:
+                moduleOwn = _d.sent();
+                record('B1: the caller\'s OWN enduser still enrolls on both branches', inlineOwn.includes(own.id) && moduleOwn.includes(own.id), "inline=".concat(JSON.stringify(inlineOwn), " module=").concat(JSON.stringify(moduleOwn), " (both must contain ").concat(own.id, ")"));
+                return [4 /*yield*/, attacker.sdk.api.endusers.add_to_journey({
+                        enduserIds: [own.id, victim.id],
+                        journeyId: mixed.journey.id,
+                        automationStepId: mixed.step.id,
+                        startAt: FUTURE_START(),
+                    }).then(function () { return 'resolved'; }).catch(function (e) { return "rejected: ".concat((e === null || e === void 0 ? void 0 : e.message) || e); })];
+            case 17:
+                mixedResult = _d.sent();
+                return [4 /*yield*/, enduserIdsFor(mixed.journey.id)];
+            case 18:
+                mixedIds = _d.sent();
+                record('B2: a mixed list enrolls the visible enduser and drops only the foreign one', mixedIds.includes(own.id) && !mixedIds.includes(victim.id), "call=".concat(mixedResult, "; enduserIds=").concat(JSON.stringify(mixedIds), " (want ").concat(own.id, ", not ").concat(victim.id, ")"));
+                return [3 /*break*/, 26];
+            case 19:
+                _i = 0, _a = [attacker, victimTenant];
+                _d.label = 20;
+            case 20:
+                if (!(_i < _a.length)) return [3 /*break*/, 25];
+                t = _a[_i];
+                if (!t) return [3 /*break*/, 24];
+                _d.label = 21;
+            case 21:
+                _d.trys.push([21, 23, , 24]);
+                return [4 /*yield*/, t.teardown()];
+            case 22:
+                _d.sent();
+                return [3 /*break*/, 24];
+            case 23:
+                e_1 = _d.sent();
+                console.error('teardown failed', e_1);
+                return [3 /*break*/, 24];
+            case 24:
+                _i++;
+                return [3 /*break*/, 20];
+            case 25: return [7 /*endfinally*/];
+            case 26: return [2 /*return*/, checks];
+        }
+    });
+}); };
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+export var add_to_journey_foreign_enduserid_tests = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var _a, _b;
+    return __generator(this, function (_c) {
+        switch (_c.label) {
+            case 0:
+                _a = assert_checks;
+                _b = ['F-0196 add_to_journey foreign enduserId'];
+                return [4 /*yield*/, add_to_journey_foreign_enduserid_checks()];
+            case 1:
+                _a.apply(void 0, _b.concat([_c.sent()]));
+                return [2 /*return*/];
+        }
+    });
+}); };
+// Allow running this test file independently
+if (require.main === module) {
+    console.log("\uD83C\uDF10 Using API URL: ".concat(host));
+    add_to_journey_foreign_enduserid_tests()
+        .then(function () {
+        console.log("✅ F-0196 add_to_journey foreign enduserId test suite completed successfully");
+        process.exit(0);
+    })
+        .catch(function (error) {
+        console.error("❌ F-0196 add_to_journey foreign enduserId test suite failed:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=F-0196-add-to-journey-foreign-enduserid.test.js.map

package/lib/esm/tests/api_tests/security/F-0196-add-to-journey-foreign-enduserid.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"F-0196-add-to-journey-foreign-enduserid.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/F-0196-add-to-journey-foreign-enduserid.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,OAAO,EACL,aAAa,EAEb,qBAAqB,GACtB,MAAM,sBAAsB,CAAA;AAE7B,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE,IAAM,IAAI,GAAG,cAAM,OAAA,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAvC,CAAuC,CAAA;AAE1D,gFAAgF;AAChF,IAAM,YAAY,GAAG,cAAM,OAAA,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,EAArC,CAAqC,CAAA;AAEhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,CAAC,IAAM,uCAAuC,GAAG;;;;;;;gBAC/C,MAAM,GAAY,EAAE,CAAA;gBACpB,MAAM,GAAG,UAAC,KAAa,EAAE,IAAa,EAAE,MAAc,IAAK,OAAA,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,OAAA,EAAE,IAAI,MAAA,EAAE,MAAM,QAAA,EAAE,CAAC,EAApC,CAAoC,CAAA;;;;gBAMnG,wEAAwE;gBAExE,CAAC;gBAA2B,qBAAM,OAAO,CAAC,GAAG,CAAC;wBAC5C,qBAAqB,CAAC,EAAE,IAAI,EAAE,yBAAkB,IAAI,EAAE,CAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;wBACnG,qBAAqB,CAAC,EAAE,IAAI,EAAE,uBAAgB,IAAI,EAAE,CAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;qBAClG,CAAC,EAAA;;gBAHD,KAA2B,SAG1B,EAHA,QAAQ,QAAA,EAAE,YAAY,QAAA,CAGtB;gBAEa,qBAAM,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAA;;gBAA3F,MAAM,GAAG,SAAkF;gBACrF,qBAAM,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAA;;gBAAxF,GAAG,GAAG,SAAkF;gBAE9F,MAAM,CACJ,8DAA8D,EAC9D,QAAQ,CAAC,UAAU,KAAK,YAAY,CAAC,UAAU,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,EAC1E,mBAAY,QAAQ,CAAC,UAAU,4BAAkB,YAAY,CAAC,UAAU,4BAAkB,MAAM,CAAC,EAAE,CAAE,CACtG,CAAA;gBAIK,WAAW,GAAG,UAAO,KAAa;;;;oCACtB,qBAAM,QAAS,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,UAAG,KAAK,cAAI,IAAI,EAAE,CAAE,EAAE,CAAC,EAAA;;gCAArF,OAAO,GAAG,SAA2E;gCAC9E,qBAAM,QAAS,CAAC,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,SAAS,CAAC;wCAC9D,SAAS,EAAE,OAAO,CAAC,EAAE;wCACrB,0FAA0F;wCAC1F,gDAAgD;wCAChD,MAAM,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE;wCAC/D,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;qCACxC,CAAC,EAAA;;gCANH,IAAI,GAAG,SAMJ;gCACT,sBAAO,EAAE,OAAO,SAAA,EAAE,IAAI,MAAA,EAAE,EAAA;;;qBACzB,CAAA;gBAEc,qBAAM,WAAW,CAAC,cAAc,CAAC,EAAA;;gBAA1C,MAAM,GAAG,SAAiC;gBAC7B,qBAAM,WAAW,CAAC,cAAc,CAAC,EAAA;;gBAA9C,UAAU,GAAG,SAAiC;gBACtC,qBAAM,WAAW,CAAC,aAAa,CAAC;oBAE9C,4EAA4E;kBAF9B;;gBAAxC,KAAK,GAAG,SAAgC;gBAGxC,YAAU,UAAO,SAAiB;;;oCACtC,qBAAM,QAAS,CAAC,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,WAAA,EAAE,EAAS,CAAC,EAAA;oCADxC,sBAAA,CAC3C,SAAmF,CACpF,EAAA;;;qBAAA,CAAA;gBACK,aAAa,GAAG,UAAO,SAAiB;;gCAAM,qBAAM,SAAO,CAAC,SAAS,CAAC,EAAA;gCAAzB,sBAAA,CAAC,SAAwB,CAAC,CAAC,GAAG,CAAC,UAAC,CAAM,IAAK,OAAA,CAAC,CAAC,SAAS,EAAX,CAAW,CAAC;4BAE1G,2EAA2E;4BAE3E,gDAAgD;0BAJ0D;;yBAAA,CAAA;gBAKrF,qBAAM,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC;wBAClE,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;wBACvB,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE;wBAC5B,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;wBAChC,OAAO,EAAE,YAAY,EAAE;qBACjB,CAAC,CAAC,IAAI,CAAC,cAAM,OAAA,UAAU,EAAV,CAAU,CAAC,CAAC,KAAK,CAAC,UAAC,CAAM,IAAK,OAAA,oBAAa,CAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,KAAI,CAAC,CAAE,EAA9B,CAA8B,CAAC,EAAA;;gBAL5E,YAAY,GAAG,SAK6D;gBAEhE,qBAAM,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAA;;gBAAlD,SAAS,GAAG,SAAsC;gBACxD,MAAM,CACJ,yEAAyE,EACzE,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAC9B,eAAQ,YAAY,4CAAkC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,gCAAsB,MAAM,CAAC,EAAE,MAAG,CAClH,CAAA;gBAGoB,qBAAM,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC;wBAClE,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;wBACvB,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE;wBAChC,OAAO,EAAE,YAAY,EAAE;qBACjB,CAAC,CAAC,IAAI,CAAC,cAAM,OAAA,UAAU,EAAV,CAAU,CAAC,CAAC,KAAK,CAAC,UAAC,CAAM,IAAK,OAAA,oBAAa,CAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,KAAI,CAAC,CAAE,EAA9B,CAA8B,CAAC,EAAA;;gBAJ5E,YAAY,GAAG,SAI6D;gBAEhE,qBAAM,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,EAAA;;gBAAtD,SAAS,GAAG,SAA0C;gBAC5D,MAAM,CACJ,4EAA4E,EAC5E,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAC9B,eAAQ,YAAY,4CAAkC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,gCAAsB,MAAM,CAAC,EAAE,MAAG,CAClH,CAAA;gBAGmB,qBAAM,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAA;;gBAAnE,WAAW,GAAG,SAAqD;gBACnE,cAAc,GAAG,MAAC,WAAmB,aAAnB,WAAW,uBAAX,WAAW,CAAU,QAAQ,mCAAI,EAAE,CAAA;gBAC3D,MAAM,CACJ,oEAAoE,EACpE,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,EAC5E,0BAAmB,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAE,CACpD,CAAA;gBAED,qDAAqD;gBAErD,yFAAyF;gBACzF,qBAAM,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC;wBAC7C,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;wBACpB,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE;wBAC5B,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;wBAChC,OAAO,EAAE,YAAY,EAAE;qBACjB,CAAC,EAAA;;gBART,qDAAqD;gBAErD,yFAAyF;gBACzF,SAKS,CAAA;gBACT,qBAAM,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC;wBAC7C,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;wBACpB,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE;wBAChC,OAAO,EAAE,YAAY,EAAE;qBACjB,CAAC,EAAA;;gBAJT,SAIS,CAAA;gBAES,qBAAM,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAA;;gBAAlD,SAAS,GAAG,SAAsC;gBACtC,qBAAM,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,EAAA;;gBAAtD,SAAS,GAAG,SAA0C;gBAC5D,MAAM,CACJ,8DAA8D,EAC9D,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EACxD,iBAAU,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,qBAAW,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,iCAAuB,GAAG,CAAC,EAAE,MAAG,CACxG,CAAA;gBAImB,qBAAM,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC;wBACjE,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC;wBAC/B,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE;wBAC3B,gBAAgB,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE;wBAC/B,OAAO,EAAE,YAAY,EAAE;qBACjB,CAAC,CAAC,IAAI,CAAC,cAAM,OAAA,UAAU,EAAV,CAAU,CAAC,CAAC,KAAK,CAAC,UAAC,CAAM,IAAK,OAAA,oBAAa,CAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,KAAI,CAAC,CAAE,EAA9B,CAA8B,CAAC,EAAA;;gBAL5E,WAAW,GAAG,SAK8D;gBAEjE,qBAAM,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,EAAA;;gBAAhD,QAAQ,GAAG,SAAqC;gBACtD,MAAM,CACJ,6EAA6E,EAC7E,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAC1D,eAAQ,WAAW,0BAAgB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,oBAAU,GAAG,CAAC,EAAE,mBAAS,MAAM,CAAC,EAAE,MAAG,CACjG,CAAA;;;sBAIuC,EAAxB,MAAC,QAAQ,EAAE,YAAY,CAAC;;;qBAAxB,CAAA,cAAwB,CAAA;gBAA7B,CAAC;qBACN,CAAC,EAAD,yBAAC;;;;gBAAU,qBAAM,CAAC,CAAC,QAAQ,EAAE,EAAA;;gBAAlB,SAAkB,CAAA;;;;gBAAe,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,GAAC,CAAC,CAAA;;;gBADrE,IAAwB,CAAA;;;qBAK1C,sBAAO,MAAM,EAAA;;;KACd,CAAA;AAED,kFAAkF;AAClF,MAAM,CAAC,IAAM,sCAAsC,GAAG;;;;;gBACpD,KAAA,aAAa,CAAA;sBAAC,yCAAyC;gBAAE,qBAAM,uCAAuC,EAAE,EAAA;;gBAAxG,4BAAyD,SAA+C,GAAC,CAAA;;;;KAC1G,CAAA;AAED,6CAA6C;AAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,sCAAsC,EAAE;SACrC,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAA;QAC1F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,8DAA8D,EAAE,KAAK,CAAC,CAAA;QACpF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}

package/lib/esm/tests/api_tests/security/F-0200-form-logic-js-execution.test.d.ts

@@ -0,0 +1,33 @@
+import { Check } from "../../setup_isolated";
+/**
+ * Regression test for F-0200
+ * (security-audit/findings/F-0200-form-logic-js-dynamic-code-execution.md).
+ *
+ * `responses_satisfy_conditions` (utilities/src/utils.ts) compiled a stored condition value of the
+ * form `$JS(...)` with `new Function()` and executed it — in every form-filler's browser, including
+ * anonymous visitors on public intake pages, AND inside the API process (automation_triggers.ts
+ * trigger matching on every form submission, ai_agent/form_filling.ts voice-agent navigation). The
+ * API process holds every tenant's database handle, so a condition authored by staff in one tenant
+ * reached all of them. Any staff user or API key with form_fields write access could plant one by
+ * typing into the free-text $gt/$lt box — no API call required.
+ *
+ * The sink is removed. This asserts the second half of the fix: `compoundFilterValidator` rejects the
+ * syntax at write time on every field that feeds that evaluator, so it cannot be reintroduced through
+ * stored configuration. The runtime half — that a `$JS` value is never evaluated — is covered by the
+ * pure-function cases in `form_conditional_logic_tests` in tests.ts.
+ *
+ * The five condition locations were established by enumerating every `responses_satisfy_conditions`
+ * call site, and all five are covered here. That completeness matters: the first run of this test
+ * caught a half fix. `event.conditions` is wrapped in an `orValidator`, which returns the first arm
+ * that does not throw, and its permissive `optional: optionalAnyObjectValidator` arm was declared
+ * before the guarded one — so the payload was accepted and stored even though the validator had been
+ * swapped. Pointing a field at the guard is not the same as the guard being reachable, which is why
+ * every location gets an assertion rather than an argument.
+ *
+ * Each rejection is paired with a positive control using the same shape without `$JS(`, so a passing
+ * test cannot be explained by the write failing for an unrelated reason.
+ */
+export declare const form_logic_js_execution_checks: () => Promise<Check[]>;
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+export declare const form_logic_js_execution_tests: () => Promise<void>;
+//# sourceMappingURL=F-0200-form-logic-js-execution.test.d.ts.map

package/lib/esm/tests/api_tests/security/F-0200-form-logic-js-execution.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"F-0200-form-logic-js-execution.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/F-0200-form-logic-js-execution.test.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,EAEN,MAAM,sBAAsB,CAAA;AAM7B;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,8BAA8B,QAAa,QAAQ,KAAK,EAAE,CA4HtE,CAAA;AAED,kFAAkF;AAClF,eAAO,MAAM,6BAA6B,qBAEzC,CAAA"}

package/lib/esm/tests/api_tests/security/F-0200-form-logic-js-execution.test.js

@@ -0,0 +1,244 @@
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+require('source-map-support').install();
+import { assert_checks, setup_isolated_tenant, } from "../../setup_isolated";
+var host = process.env.API_URL || 'http://localhost:8080';
+var RAND = function () { return Math.random().toString(36).slice(2, 10); };
+/**
+ * Regression test for F-0200
+ * (security-audit/findings/F-0200-form-logic-js-dynamic-code-execution.md).
+ *
+ * `responses_satisfy_conditions` (utilities/src/utils.ts) compiled a stored condition value of the
+ * form `$JS(...)` with `new Function()` and executed it — in every form-filler's browser, including
+ * anonymous visitors on public intake pages, AND inside the API process (automation_triggers.ts
+ * trigger matching on every form submission, ai_agent/form_filling.ts voice-agent navigation). The
+ * API process holds every tenant's database handle, so a condition authored by staff in one tenant
+ * reached all of them. Any staff user or API key with form_fields write access could plant one by
+ * typing into the free-text $gt/$lt box — no API call required.
+ *
+ * The sink is removed. This asserts the second half of the fix: `compoundFilterValidator` rejects the
+ * syntax at write time on every field that feeds that evaluator, so it cannot be reintroduced through
+ * stored configuration. The runtime half — that a `$JS` value is never evaluated — is covered by the
+ * pure-function cases in `form_conditional_logic_tests` in tests.ts.
+ *
+ * The five condition locations were established by enumerating every `responses_satisfy_conditions`
+ * call site, and all five are covered here. That completeness matters: the first run of this test
+ * caught a half fix. `event.conditions` is wrapped in an `orValidator`, which returns the first arm
+ * that does not throw, and its permissive `optional: optionalAnyObjectValidator` arm was declared
+ * before the guarded one — so the payload was accepted and stored even though the validator had been
+ * swapped. Pointing a field at the guard is not the same as the guard being reachable, which is why
+ * every location gets an assertion rather than an argument.
+ *
+ * Each rejection is paired with a positive control using the same shape without `$JS(`, so a passing
+ * test cannot be explained by the write failing for an unrelated reason.
+ */
+export var form_logic_js_execution_checks = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var checks, record, JS_PAYLOAD, SAFE_VALUE, condition, previousFields, attempt, tenant, sdk_1, form_1, field_1, controlCreate, payloadCreate, payloadUpdate, groupControl, groupPayload, optionControl, optionPayload, productControl, productPayload, trigger_1, triggerControl, triggerPayload, byFormIdPayload, e_1;
+    return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0:
+                checks = [];
+                record = function (label, pass, detail) { return checks.push({ label: label, pass: pass, detail: detail }); };
+                JS_PAYLOAD = '$JS(return 0)';
+                SAFE_VALUE = '18';
+                condition = function (value) { return ({ $and: [{ condition: { 'someFieldId': { $gt: value } } }] }); };
+                previousFields = function (value) { return ([{
+                        type: 'compoundLogic',
+                        info: { fieldId: '000000000000000000000000', priority: 5, label: '', condition: condition(value) },
+                    }]); };
+                attempt = function (fn) { return __awaiter(void 0, void 0, void 0, function () {
+                    return __generator(this, function (_a) {
+                        return [2 /*return*/, (fn().then(function () { return ({ accepted: true, detail: 'accepted' }); })
+                                .catch(function (e) { return ({ accepted: false, detail: "rejected: ".concat((e === null || e === void 0 ? void 0 : e.message) || e) }); }))];
+                    });
+                }); };
+                _a.label = 1;
+            case 1:
+                _a.trys.push([1, , 17, 22]);
+                return [4 /*yield*/, setup_isolated_tenant({ name: "F0200 ".concat(RAND()), users: [{ isAdmin: true }], apiKeys: 0 })];
+            case 2:
+                tenant = _a.sent();
+                sdk_1 = tenant.sdk;
+                return [4 /*yield*/, sdk_1.api.forms.createOne({ title: "F-0200 ".concat(RAND()) })];
+            case 3:
+                form_1 = _a.sent();
+                return [4 /*yield*/, sdk_1.api.form_fields.createOne({
+                        formId: form_1.id, title: 'F-0200 anchor', type: 'string', previousFields: [{ type: 'root', info: {} }],
+                    })
+                    /* ===== 1. previousFields[].info.condition — the field the finding was reported against ===== */
+                ];
+            case 4:
+                field_1 = _a.sent();
+                return [4 /*yield*/, attempt(function () { return sdk_1.api.form_fields.createOne({
+                        formId: form_1.id, title: 'F-0200 control', type: 'string',
+                        previousFields: previousFields(SAFE_VALUE),
+                    }); })];
+            case 5:
+                controlCreate = _a.sent();
+                record('control: form_fields.createOne accepts a normal $gt condition', controlCreate.accepted, controlCreate.detail);
+                return [4 /*yield*/, attempt(function () { return sdk_1.api.form_fields.createOne({
+                        formId: form_1.id, title: 'F-0200 payload', type: 'string',
+                        previousFields: previousFields(JS_PAYLOAD),
+                    }); })];
+            case 6:
+                payloadCreate = _a.sent();
+                record('1a: form_fields.createOne rejects $JS( in previousFields condition', !payloadCreate.accepted, payloadCreate.detail);
+                return [4 /*yield*/, attempt(function () { return sdk_1.api.form_fields.updateOne(field_1.id, {
+                        previousFields: previousFields(JS_PAYLOAD),
+                    }); })];
+            case 7:
+                payloadUpdate = _a.sent();
+                record('1b: form_fields.updateOne rejects $JS( in previousFields condition', !payloadUpdate.accepted, payloadUpdate.detail);
+                return [4 /*yield*/, attempt(function () { return sdk_1.api.form_fields.updateOne(field_1.id, {
+                        groupShowCondition: condition(SAFE_VALUE),
+                    }); })];
+            case 8:
+                groupControl = _a.sent();
+                record('control: groupShowCondition accepts a normal condition', groupControl.accepted, groupControl.detail);
+                return [4 /*yield*/, attempt(function () { return sdk_1.api.form_fields.updateOne(field_1.id, {
+                        groupShowCondition: condition(JS_PAYLOAD),
+                    }); })];
+            case 9:
+                groupPayload = _a.sent();
+                record('2: form_fields.updateOne rejects $JS( in groupShowCondition', !groupPayload.accepted, groupPayload.detail);
+                return [4 /*yield*/, attempt(function () { return sdk_1.api.form_fields.updateOne(field_1.id, {
+                        options: { optionDetails: [{ option: 'A', showCondition: condition(SAFE_VALUE) }] },
+                    }); })];
+            case 10:
+                optionControl = _a.sent();
+                record('control: optionDetails showCondition accepts a normal condition', optionControl.accepted, optionControl.detail);
+                return [4 /*yield*/, attempt(function () { return sdk_1.api.form_fields.updateOne(field_1.id, {
+                        options: { optionDetails: [{ option: 'A', showCondition: condition(JS_PAYLOAD) }] },
+                    }); })];
+            case 11:
+                optionPayload = _a.sent();
+                record('3: form_fields.updateOne rejects $JS( in optionDetails showCondition', !optionPayload.accepted, optionPayload.detail);
+                return [4 /*yield*/, attempt(function () { return sdk_1.api.form_fields.updateOne(field_1.id, {
+                        options: { productConditions: [{ productId: '000000000000000000000000', showCondition: condition(SAFE_VALUE) }] },
+                    }); })];
+            case 12:
+                productControl = _a.sent();
+                record('control: productConditions showCondition accepts a normal condition', productControl.accepted, productControl.detail);
+                return [4 /*yield*/, attempt(function () { return sdk_1.api.form_fields.updateOne(field_1.id, {
+                        options: { productConditions: [{ productId: '000000000000000000000000', showCondition: condition(JS_PAYLOAD) }] },
+                    }); })];
+            case 13:
+                productPayload = _a.sent();
+                record('4: form_fields.updateOne rejects $JS( in productConditions showCondition', !productPayload.accepted, productPayload.detail);
+                trigger_1 = function (conditions, extraInfo) {
+                    if (extraInfo === void 0) { extraInfo = {}; }
+                    return ({
+                        title: "F-0200 ".concat(RAND()),
+                        status: 'Inactive',
+                        event: __assign({ type: 'Form Submitted', info: __assign({ formId: form_1.id }, extraInfo) }, conditions),
+                        action: { type: 'Add Tags', info: { tags: ['F-0200'] } },
+                    });
+                };
+                return [4 /*yield*/, attempt(function () { return sdk_1.api.automation_triggers.createOne(trigger_1({ conditions: condition(SAFE_VALUE) })); })];
+            case 14:
+                triggerControl = _a.sent();
+                record('control: automation_triggers accepts normal event conditions', triggerControl.accepted, triggerControl.detail);
+                return [4 /*yield*/, attempt(function () { return sdk_1.api.automation_triggers.createOne(trigger_1({ conditions: condition(JS_PAYLOAD) })); })];
+            case 15:
+                triggerPayload = _a.sent();
+                record('5a: automation_triggers rejects $JS( in event.conditions', !triggerPayload.accepted, triggerPayload.detail);
+                return [4 /*yield*/, attempt(function () {
+                        var _a;
+                        return sdk_1.api.automation_triggers.createOne(trigger_1({}, { conditionsByFormId: (_a = {}, _a[form_1.id] = condition(JS_PAYLOAD), _a) }));
+                    })];
+            case 16:
+                byFormIdPayload = _a.sent();
+                record('5b: automation_triggers rejects $JS( in event.info.conditionsByFormId', !byFormIdPayload.accepted, byFormIdPayload.detail);
+                return [3 /*break*/, 22];
+            case 17:
+                if (!tenant) return [3 /*break*/, 21];
+                _a.label = 18;
+            case 18:
+                _a.trys.push([18, 20, , 21]);
+                return [4 /*yield*/, tenant.teardown()];
+            case 19:
+                _a.sent();
+                return [3 /*break*/, 21];
+            case 20:
+                e_1 = _a.sent();
+                console.error('teardown failed', e_1);
+                return [3 /*break*/, 21];
+            case 21: return [7 /*endfinally*/];
+            case 22: return [2 /*return*/, checks];
+        }
+    });
+}); };
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+export var form_logic_js_execution_tests = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var _a, _b;
+    return __generator(this, function (_c) {
+        switch (_c.label) {
+            case 0:
+                _a = assert_checks;
+                _b = ['F-0200 $JS in stored conditional logic'];
+                return [4 /*yield*/, form_logic_js_execution_checks()];
+            case 1:
+                _a.apply(void 0, _b.concat([_c.sent()]));
+                return [2 /*return*/];
+        }
+    });
+}); };
+// Allow running this test file independently
+if (require.main === module) {
+    console.log("\uD83C\uDF10 Using API URL: ".concat(host));
+    form_logic_js_execution_tests()
+        .then(function () {
+        console.log("✅ F-0200 form logic JS execution test suite completed successfully");
+        process.exit(0);
+    })
+        .catch(function (error) {
+        console.error("❌ F-0200 form logic JS execution test suite failed:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=F-0200-form-logic-js-execution.test.js.map

package/lib/esm/tests/api_tests/security/F-0200-form-logic-js-execution.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"F-0200-form-logic-js-execution.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/F-0200-form-logic-js-execution.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,OAAO,EACL,aAAa,EAEb,qBAAqB,GACtB,MAAM,sBAAsB,CAAA;AAE7B,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE,IAAM,IAAI,GAAG,cAAM,OAAA,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAvC,CAAuC,CAAA;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,IAAM,8BAA8B,GAAG;;;;;gBACtC,MAAM,GAAY,EAAE,CAAA;gBACpB,MAAM,GAAG,UAAC,KAAa,EAAE,IAAa,EAAE,MAAc,IAAK,OAAA,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,OAAA,EAAE,IAAI,MAAA,EAAE,MAAM,QAAA,EAAE,CAAC,EAApC,CAAoC,CAAA;gBAE/F,UAAU,GAAG,eAAe,CAAA;gBAC5B,UAAU,GAAG,IAAI,CAAA;gBAEjB,SAAS,GAAG,UAAC,KAAa,IAAK,OAAA,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,aAAa,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAA9D,CAA8D,CAAA;gBAC7F,cAAc,GAAG,UAAC,KAAa,IAAK,OAAA,CAAC,CAAC;wBAC1C,IAAI,EAAE,eAAe;wBACrB,IAAI,EAAE,EAAE,OAAO,EAAE,0BAA0B,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE;qBACnG,CAAC,CAAC,EAHuC,CAGvC,CAAA;gBAEG,OAAO,GAAG,UAAO,EAAsB;;wBAAK,sBAAA,CAChD,EAAE,EAAE,CAAC,IAAI,CAAC,cAAM,OAAA,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAG,MAAM,EAAE,UAAU,EAAE,CAAC,EAAzC,CAAyC,CAAC;iCACrD,KAAK,CAAC,UAAC,CAAM,IAAK,OAAA,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAa,CAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,KAAI,CAAC,CAAE,EAAE,CAAC,EAA7D,CAA6D,CAAC,CACtF,EAAA;;qBAAA,CAAA;;;;gBAKU,qBAAM,qBAAqB,CAAC,EAAE,IAAI,EAAE,gBAAS,IAAI,EAAE,CAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,EAAA;;gBAAzG,MAAM,GAAG,SAAgG,CAAA;gBACnG,QAAM,MAAM,CAAC,GAAG,CAAA;gBAET,qBAAM,KAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAU,IAAI,EAAE,CAAE,EAAE,CAAC,EAAA;;gBAAnE,SAAO,SAA4D;gBAC3D,qBAAM,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC;wBAChD,MAAM,EAAE,MAAI,CAAC,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;qBACtG,CAAC;oBAEF,iGAAiG;kBAF/F;;gBAFI,UAAQ,SAEZ;gBAIoB,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC;wBACtE,MAAM,EAAE,MAAI,CAAC,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,QAAQ;wBACxD,cAAc,EAAE,cAAc,CAAC,UAAU,CAAQ;qBAClD,CAAC,EAHwC,CAGxC,CAAC,EAAA;;gBAHG,aAAa,GAAG,SAGnB;gBACH,MAAM,CACJ,+DAA+D,EAC/D,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAC7C,CAAA;gBAEqB,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC;wBACtE,MAAM,EAAE,MAAI,CAAC,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,QAAQ;wBACxD,cAAc,EAAE,cAAc,CAAC,UAAU,CAAQ;qBAClD,CAAC,EAHwC,CAGxC,CAAC,EAAA;;gBAHG,aAAa,GAAG,SAGnB;gBACH,MAAM,CACJ,oEAAoE,EACpE,CAAC,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAC9C,CAAA;gBAEqB,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,OAAK,CAAC,EAAE,EAAE;wBAChF,cAAc,EAAE,cAAc,CAAC,UAAU,CAAQ;qBAClD,CAAC,EAFwC,CAExC,CAAC,EAAA;;gBAFG,aAAa,GAAG,SAEnB;gBACH,MAAM,CACJ,oEAAoE,EACpE,CAAC,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAC9C,CAAA;gBAIoB,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,OAAK,CAAC,EAAE,EAAE;wBAC/E,kBAAkB,EAAE,SAAS,CAAC,UAAU,CAAQ;qBACjD,CAAC,EAFuC,CAEvC,CAAC,EAAA;;gBAFG,YAAY,GAAG,SAElB;gBACH,MAAM,CAAC,wDAAwD,EAAE,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC,CAAA;gBAEvF,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,OAAK,CAAC,EAAE,EAAE;wBAC/E,kBAAkB,EAAE,SAAS,CAAC,UAAU,CAAQ;qBACjD,CAAC,EAFuC,CAEvC,CAAC,EAAA;;gBAFG,YAAY,GAAG,SAElB;gBACH,MAAM,CAAC,6DAA6D,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC,CAAA;gBAI5F,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,OAAK,CAAC,EAAE,EAAE;wBAChF,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,EAAS;qBAC3F,CAAC,EAFwC,CAExC,CAAC,EAAA;;gBAFG,aAAa,GAAG,SAEnB;gBACH,MAAM,CAAC,iEAAiE,EAAE,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;gBAEjG,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,OAAK,CAAC,EAAE,EAAE;wBAChF,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,EAAS;qBAC3F,CAAC,EAFwC,CAExC,CAAC,EAAA;;gBAFG,aAAa,GAAG,SAEnB;gBACH,MAAM,CAAC,sEAAsE,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;gBAItG,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,OAAK,CAAC,EAAE,EAAE;wBACjF,OAAO,EAAE,EAAE,iBAAiB,EAAE,CAAC,EAAE,SAAS,EAAE,0BAA0B,EAAE,aAAa,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,EAAS;qBACzH,CAAC,EAFyC,CAEzC,CAAC,EAAA;;gBAFG,cAAc,GAAG,SAEpB;gBACH,MAAM,CAAC,qEAAqE,EAAE,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,CAAA;gBAEtG,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,OAAK,CAAC,EAAE,EAAE;wBACjF,OAAO,EAAE,EAAE,iBAAiB,EAAE,CAAC,EAAE,SAAS,EAAE,0BAA0B,EAAE,aAAa,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,EAAS;qBACzH,CAAC,EAFyC,CAEzC,CAAC,EAAA;;gBAFG,cAAc,GAAG,SAEpB;gBACH,MAAM,CAAC,0EAA0E,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,CAAA;gBAI7H,YAAU,UAAC,UAAkB,EAAE,SAAsB;oBAAtB,0BAAA,EAAA,cAAsB;oBAAK,OAAA,CAAC;wBAC/D,KAAK,EAAE,iBAAU,IAAI,EAAE,CAAE;wBACzB,MAAM,EAAE,UAAU;wBAClB,KAAK,aAAI,IAAI,EAAE,gBAAgB,EAAE,IAAI,aAAI,MAAM,EAAE,MAAI,CAAC,EAAE,IAAK,SAAS,KAAO,UAAU,CAAE;wBACzF,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE;qBACjD,CAAA;gBALuD,CAKvD,CAAA;gBAEc,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,SAAS,CAC9E,SAAO,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAC/C,EAF0C,CAE1C,CAAC,EAAA;;gBAFI,cAAc,GAAG,SAErB;gBACF,MAAM,CAAC,8DAA8D,EAAE,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,CAAA;gBAG/F,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,SAAS,CAC9E,SAAO,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAC/C,EAF0C,CAE1C,CAAC,EAAA;;gBAFI,cAAc,GAAG,SAErB;gBACF,MAAM,CAAC,0DAA0D,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,CAAA;gBAE3F,qBAAM,OAAO,CAAC;;wBAAM,OAAA,KAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,SAAS,CAC/E,SAAO,CAAC,EAAE,EAAE,EAAE,kBAAkB,YAAI,GAAC,MAAI,CAAC,EAAE,IAAG,SAAS,CAAC,UAAU,CAAC,KAAE,EAAE,CAAC,CAC1E;oBAF2C,CAE3C,CAAC,EAAA;;gBAFI,eAAe,GAAG,SAEtB;gBACF,MAAM,CAAC,uEAAuE,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,eAAe,CAAC,MAAM,CAAC,CAAA;;;qBAI9H,MAAM,EAAN,yBAAM;;;;gBAAU,qBAAM,MAAM,CAAC,QAAQ,EAAE,EAAA;;gBAAvB,SAAuB,CAAA;;;;gBAAe,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,GAAC,CAAC,CAAA;;;qBAG/F,sBAAO,MAAM,EAAA;;;KACd,CAAA;AAED,kFAAkF;AAClF,MAAM,CAAC,IAAM,6BAA6B,GAAG;;;;;gBAC3C,KAAA,aAAa,CAAA;sBAAC,wCAAwC;gBAAE,qBAAM,8BAA8B,EAAE,EAAA;;gBAA9F,4BAAwD,SAAsC,GAAC,CAAA;;;;KAChG,CAAA;AAED,6CAA6C;AAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,6BAA6B,EAAE;SAC5B,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAA;QACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,qDAAqD,EAAE,KAAK,CAAC,CAAA;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}

package/lib/esm/tests/api_tests/security/add-to-journey-foreign-enduserid.test.d.ts

@@ -0,0 +1,42 @@
+import { Check } from "../../setup_isolated";
+/**
+ * Regression test: `endusers.add_to_journey` must not enroll another tenant's enduser.
+ *
+ * `endusers.add_to_journey` inserted an `automated_actions` row for EACH caller-supplied `enduserId`
+ * with only mongoId-shape validation and no tenant-membership check. The preceding
+ * `DB.endusers.updateMany` is scoped but its result was discarded, and
+ * `DB.automated_actions.insertMany` is a direct write that bypasses the `ensureValidDependentKeys`
+ * foreign-key check the generic CRUD route gets. The resulting row is stamped
+ * `businessId: <caller's tenant>` while carrying `enduserId: <a victim in another tenant>`.
+ *
+ * The worker then dereferences that enduser with the raw driver and no `businessId`
+ * (worker/modules/automations.ts, the worker's unscoped raw-driver lookup family), so the victim's record loads
+ * under the attacker's automation: `pushFormsToPortal` copies the victim's PHI into the attacker's
+ * `form_responses` (readable by their staff) and `iterableCustomEvent` writes an attacker-authored
+ * note into the victim's chart. This plant is the reachability that made those three exploitable.
+ *
+ * There are TWO independent plant sites and a fix to only one is a half fix:
+ *   - inline branch, taken when `automationStepId` is supplied (api.ts add_to_journey handler)
+ *   - module branch, taken when it is not: `handle_automation_event`'s
+ *     `validEnduserIds = conditionsQuery ? <scoped find> : event.enduserIds` passes caller ids
+ *     straight through for a step with NO conditions.
+ * Both are covered below (A1/A2).
+ *
+ * Design notes:
+ *   - Two provisioned tenants, so the victim is a real foreign enduser and we can also assert their
+ *     record was not mutated. Both must come from provisioning: `add_to_journey` is
+ *     `requiresSubscription: true`, and a `create_and_join` org is born with an expired subscription.
+ *   - The steps use `setEnduserStatus` — no vendor, no Bedrock — and `startAt` is an hour out so a
+ *     running worker cannot process the rows before we read them.
+ *   - `throttle` is deliberately omitted: it is the only way add_to_journey's per-pair rate limit can
+ *     throw.
+ *   - Everything is observable through `automated_actions` reads, so the worker is never needed.
+ *
+ * RED (pre-fix): A1, A2 and B2 fail — the victim's id appears in the attacker tenant's
+ * automated_actions. GREEN (post-fix): the foreign id is silently dropped and the caller's own
+ * endusers still enroll normally.
+ */
+export declare const add_to_journey_foreign_enduserid_checks: () => Promise<Check[]>;
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+export declare const add_to_journey_foreign_enduserid_tests: () => Promise<void>;
+//# sourceMappingURL=add-to-journey-foreign-enduserid.test.d.ts.map

package/lib/esm/tests/api_tests/security/add-to-journey-foreign-enduserid.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"add-to-journey-foreign-enduserid.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/add-to-journey-foreign-enduserid.test.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,EAEN,MAAM,sBAAsB,CAAA;AAS7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,eAAO,MAAM,uCAAuC,QAAa,QAAQ,KAAK,EAAE,CAuI/E,CAAA;AAED,kFAAkF;AAClF,eAAO,MAAM,sCAAsC,qBAElD,CAAA"}