@tellescope/sdk 1.256.13 → 1.256.15

package/lib/esm/tests/api_tests/security/ai-conversations-rbac.test.js

@@ -0,0 +1,386 @@
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+require('source-map-support').install();
+import { ObjectId } from 'bson';
+import { Session } from "../../../sdk";
+import { async_test, log_header, wait, } from "@tellescope/testing";
+import { setup_tests } from "../../setup";
+import { PROVIDER_PERMISSIONS } from "@tellescope/constants";
+var host = process.env.API_URL || 'http://localhost:8080';
+var _a = [process.env.NON_ADMIN_EMAIL, process.env.NON_ADMIN_PASSWORD], nonAdminEmail = _a[0], nonAdminPassword = _a[1];
+/**
+ * Regression test: `ai_conversations` RBAC.
+ *
+ * Both `ai_conversations.send_message` and `ai_conversations.generate_ai_decision` are
+ * registered with `noAccessPermissions: true` ([api.ts:22699, 22721](packages/private/api/api/v1/api.ts)).
+ * Their only access gate is `if (req.session.type === 'enduser') throw 403`. They must ALSO
+ * check `session.access?.ai_conversations?.<action>` (and `session.access?.endusers?.read`
+ * for generate_ai_decision) — the standard pattern used 16 lines earlier in the same file
+ * at api.ts:22680 for the background_errors handler.
+ *
+ * This test:
+ *   1. Creates a role with explicit NO_ACCESS for ai_conversations (and endusers).
+ *   2. Assigns the role to the non-admin user.
+ *   3. Calls each endpoint as the non-admin.
+ *   4. Asserts each endpoint returns a 403-equivalent error (not 200).
+ *   5. Positive case: a role granting ai_conversations create (read/update denied) must pass
+ *      the send_message gate — generating a NEW conversation requires only create access.
+ *   6. But the same role must still 403 when passing a conversationId: continuing an existing
+ *      conversation reads its stored history (returned in the response) and appends to it,
+ *      so it requires read + update access in addition to create.
+ *   7. Default-provider-permissions role (ai_conversations = Assigned): send_message must not
+ *      500. Regression: the post-generation $push previously ran through the caller's
+ *      access-scoped DB, where "Assigned" filters can't match the just-created conversation,
+ *      returning null and crashing the handler (Cannot read properties of null '_id') after
+ *      credits were consumed. bedrock.ts now persists via tenant-scoped org-wide queries.
+ *
+ * Pre-fix:
+ *   - send_message: 200 (or some downstream error from Bedrock) — NOT 403. Test fails.
+ *   - generate_ai_decision: 200 with `{}` (handler responds early before access check). Test fails.
+ *
+ * Post-fix: both endpoints throw 403 before any work happens. Test passes.
+ */
+export var ai_conversations_rbac_tests = function (_a) {
+    var sdk = _a.sdk, sdkNonAdmin = _a.sdkNonAdmin;
+    return __awaiter(void 0, void 0, void 0, function () {
+        var roleName, grantRoleName, assignedRoleName, rbapId, grantRbapId, assignedRbapId, originalRoles, rbap, grantRbap, assignedRbap, _b, _c, _d, _e, _f;
+        return __generator(this, function (_g) {
+            switch (_g.label) {
+                case 0:
+                    log_header("ai_conversations RBAC bypass regression");
+                    roleName = "f0005-ai-conversations-no-access-".concat(Date.now());
+                    grantRoleName = "f0005-ai-conversations-create-granted-".concat(Date.now());
+                    assignedRoleName = "f0005-ai-conversations-assigned-default-".concat(Date.now());
+                    originalRoles = sdkNonAdmin.userInfo.roles;
+                    _g.label = 1;
+                case 1:
+                    _g.trys.push([1, , 19, 40]);
+                    return [4 /*yield*/, sdk.api.role_based_access_permissions.createOne({
+                            role: roleName,
+                            permissions: __assign(__assign({}, PROVIDER_PERMISSIONS), { ai_conversations: { create: null, read: null, update: null, delete: null }, endusers: { create: null, read: null, update: null, delete: null } }),
+                        })];
+                case 2:
+                    rbap = _g.sent();
+                    rbapId = rbap.id;
+                    // 2. Assign the role to the non-admin user and re-authenticate so the new
+                    //    session reflects the role's denied permissions.
+                    return [4 /*yield*/, sdk.api.users.updateOne(sdkNonAdmin.userInfo.id, { roles: [roleName] }, { replaceObjectFields: true })];
+                case 3:
+                    // 2. Assign the role to the non-admin user and re-authenticate so the new
+                    //    session reflects the role's denied permissions.
+                    _g.sent();
+                    return [4 /*yield*/, wait(undefined, 1500)];
+                case 4:
+                    _g.sent();
+                    return [4 /*yield*/, sdkNonAdmin.authenticate(nonAdminEmail, nonAdminPassword)
+                        // 3a. send_message must throw 403 (or equivalent access error). Pre-fix: succeeds (or
+                        //     fails downstream in Bedrock without 403). Post-fix: throws before any work.
+                    ];
+                case 5:
+                    _g.sent();
+                    // 3a. send_message must throw 403 (or equivalent access error). Pre-fix: succeeds (or
+                    //     fails downstream in Bedrock without 403). Post-fix: throws before any work.
+                    return [4 /*yield*/, async_test("ai_conversations.send_message must throw 403 when role denies ai_conversations", function () { return sdkNonAdmin.api.ai_conversations.send_message({
+                            message: 'regression test',
+                            type: 'Test',
+                        }); }, {
+                            shouldError: true,
+                            onError: function (e) {
+                                var _a, _b;
+                                // Accept any 4xx access-denial response — handler may use 403 (recommended)
+                                // or 400 with "access" / "permission" in the message.
+                                var msg = ((_a = e === null || e === void 0 ? void 0 : e.message) !== null && _a !== void 0 ? _a : '').toLowerCase();
+                                var status = (_b = e === null || e === void 0 ? void 0 : e.status) !== null && _b !== void 0 ? _b : e === null || e === void 0 ? void 0 : e.code;
+                                return status === 403 || status === 401
+                                    || msg.includes('access') || msg.includes('permission') || msg.includes('forbidden');
+                            },
+                        })
+                        // 3b. generate_ai_decision must throw 403 BEFORE the early res.json({}) response.
+                        //     Pre-fix: handler responds 200 with {} immediately and processes in background.
+                        //     Post-fix: handler throws 403 before res.json({}).
+                    ];
+                case 6:
+                    // 3a. send_message must throw 403 (or equivalent access error). Pre-fix: succeeds (or
+                    //     fails downstream in Bedrock without 403). Post-fix: throws before any work.
+                    _g.sent();
+                    // 3b. generate_ai_decision must throw 403 BEFORE the early res.json({}) response.
+                    //     Pre-fix: handler responds 200 with {} immediately and processes in background.
+                    //     Post-fix: handler throws 403 before res.json({}).
+                    return [4 /*yield*/, async_test("ai_conversations.generate_ai_decision must throw 403 when role denies endusers/ai_conversations", function () { return sdkNonAdmin.api.ai_conversations.generate_ai_decision({
+                            enduserId: new ObjectId().toHexString(),
+                            automationStepId: new ObjectId().toHexString(),
+                            outcomes: ['yes', 'no'],
+                            prompt: 'regression test',
+                            sources: [{ type: 'SMS', limit: 1 }], // non-empty so the validator passes; access check then fires
+                        }); }, {
+                            shouldError: true,
+                            onError: function (e) {
+                                var _a, _b;
+                                var msg = ((_a = e === null || e === void 0 ? void 0 : e.message) !== null && _a !== void 0 ? _a : '').toLowerCase();
+                                var status = (_b = e === null || e === void 0 ? void 0 : e.status) !== null && _b !== void 0 ? _b : e === null || e === void 0 ? void 0 : e.code;
+                                return status === 403 || status === 401
+                                    || msg.includes('access') || msg.includes('permission') || msg.includes('forbidden');
+                            },
+                        })
+                        // 4. Positive case: granting only ai_conversations create must pass the RBAC gate.
+                        //    send_message may still fail downstream (e.g. 400 "Organization has not set up credits"),
+                        //    but it must NOT be an access-denial error.
+                    ];
+                case 7:
+                    // 3b. generate_ai_decision must throw 403 BEFORE the early res.json({}) response.
+                    //     Pre-fix: handler responds 200 with {} immediately and processes in background.
+                    //     Post-fix: handler throws 403 before res.json({}).
+                    _g.sent();
+                    return [4 /*yield*/, sdk.api.role_based_access_permissions.createOne({
+                            role: grantRoleName,
+                            permissions: __assign(__assign({}, PROVIDER_PERMISSIONS), { ai_conversations: { create: 'All', read: null, update: null, delete: null } }),
+                        })];
+                case 8:
+                    grantRbap = _g.sent();
+                    grantRbapId = grantRbap.id;
+                    return [4 /*yield*/, sdk.api.users.updateOne(sdkNonAdmin.userInfo.id, { roles: [grantRoleName] }, { replaceObjectFields: true })];
+                case 9:
+                    _g.sent();
+                    return [4 /*yield*/, wait(undefined, 1500)];
+                case 10:
+                    _g.sent();
+                    return [4 /*yield*/, sdkNonAdmin.authenticate(nonAdminEmail, nonAdminPassword)];
+                case 11:
+                    _g.sent();
+                    return [4 /*yield*/, async_test("ai_conversations.send_message must NOT be access-denied when role grants create", function () { return sdkNonAdmin.api.ai_conversations.send_message({
+                            message: 'positive-case test',
+                            type: 'Test',
+                            maxTokens: 1,
+                        })
+                            .then(function () { return 'allowed'; })
+                            .catch(function (e) {
+                            var _a, _b;
+                            var msg = ((_a = e === null || e === void 0 ? void 0 : e.message) !== null && _a !== void 0 ? _a : '').toLowerCase();
+                            var status = (_b = e === null || e === void 0 ? void 0 : e.status) !== null && _b !== void 0 ? _b : e === null || e === void 0 ? void 0 : e.code;
+                            if (status === 403 || status === 401
+                                || msg.includes('access') || msg.includes('permission') || msg.includes('forbidden')) {
+                                throw e; // access denial — the gate incorrectly blocked a create-granted role
+                            }
+                            return 'allowed'; // downstream (e.g. credits) error is fine — the gate passed
+                        }); }, { onResult: function (r) { return r === 'allowed'; } })
+                        // 5. The create-granted (read/update-denied) role must still be blocked from CONTINUING an
+                        //    existing conversation — send_message with conversationId returns the full stored history
+                        //    and appends to it. Fake id is fine: the access check must fire before any lookup.
+                    ];
+                case 12:
+                    _g.sent();
+                    // 5. The create-granted (read/update-denied) role must still be blocked from CONTINUING an
+                    //    existing conversation — send_message with conversationId returns the full stored history
+                    //    and appends to it. Fake id is fine: the access check must fire before any lookup.
+                    return [4 /*yield*/, async_test("ai_conversations.send_message with conversationId must 403 when role denies read/update", function () { return sdkNonAdmin.api.ai_conversations.send_message({
+                            message: 'conversationId bypass test',
+                            type: 'Test',
+                            maxTokens: 1,
+                            conversationId: new ObjectId().toHexString(),
+                        }); }, {
+                            shouldError: true,
+                            onError: function (e) {
+                                var _a, _b;
+                                var msg = ((_a = e === null || e === void 0 ? void 0 : e.message) !== null && _a !== void 0 ? _a : '').toLowerCase();
+                                var status = (_b = e === null || e === void 0 ? void 0 : e.status) !== null && _b !== void 0 ? _b : e === null || e === void 0 ? void 0 : e.code;
+                                return status === 403 || status === 401
+                                    || msg.includes('access') || msg.includes('permission') || msg.includes('forbidden');
+                            },
+                        })
+                        // 6. Regression: a role with default provider permissions (ai_conversations = Assigned)
+                        //    must be able to generate a new conversation without a 500. Previously the
+                        //    post-generation $push ran through the access-scoped DB, matched nothing under
+                        //    "Assigned", and crashed the handler with "Cannot read properties of null ('_id')".
+                    ];
+                case 13:
+                    // 5. The create-granted (read/update-denied) role must still be blocked from CONTINUING an
+                    //    existing conversation — send_message with conversationId returns the full stored history
+                    //    and appends to it. Fake id is fine: the access check must fire before any lookup.
+                    _g.sent();
+                    return [4 /*yield*/, sdk.api.role_based_access_permissions.createOne({
+                            role: assignedRoleName,
+                            permissions: __assign({}, PROVIDER_PERMISSIONS),
+                        })];
+                case 14:
+                    assignedRbap = _g.sent();
+                    assignedRbapId = assignedRbap.id;
+                    return [4 /*yield*/, sdk.api.users.updateOne(sdkNonAdmin.userInfo.id, { roles: [assignedRoleName] }, { replaceObjectFields: true })];
+                case 15:
+                    _g.sent();
+                    return [4 /*yield*/, wait(undefined, 1500)];
+                case 16:
+                    _g.sent();
+                    return [4 /*yield*/, sdkNonAdmin.authenticate(nonAdminEmail, nonAdminPassword)];
+                case 17:
+                    _g.sent();
+                    return [4 /*yield*/, async_test("ai_conversations.send_message must not 500 for Assigned-access (default provider) role", function () { return sdkNonAdmin.api.ai_conversations.send_message({
+                            message: 'assigned-access regression test',
+                            type: 'Test',
+                            maxTokens: 1,
+                        })
+                            .then(function () { return 'ok'; })
+                            .catch(function (e) {
+                            var _a, _b;
+                            var msg = ((_a = e === null || e === void 0 ? void 0 : e.message) !== null && _a !== void 0 ? _a : '').toLowerCase();
+                            var status = (_b = e === null || e === void 0 ? void 0 : e.status) !== null && _b !== void 0 ? _b : e === null || e === void 0 ? void 0 : e.code;
+                            if (status === 500 || msg.includes('internal error') || msg.includes('cannot read properties')) {
+                                throw e; // the null-update crash — regression
+                            }
+                            if (status === 403 || status === 401
+                                || msg.includes('access') || msg.includes('permission') || msg.includes('forbidden')) {
+                                throw e; // Assigned access must pass the RBAC gate
+                            }
+                            return 'ok'; // downstream (e.g. credits) error is fine
+                        }); }, { onResult: function (r) { return r === 'ok'; } })];
+                case 18:
+                    _g.sent();
+                    return [3 /*break*/, 40];
+                case 19:
+                    _g.trys.push([19, 21, , 22]);
+                    return [4 /*yield*/, sdk.api.users.updateOne(sdkNonAdmin.userInfo.id, { roles: originalRoles !== null && originalRoles !== void 0 ? originalRoles : [] }, { replaceObjectFields: true })];
+                case 20:
+                    _g.sent();
+                    return [3 /*break*/, 22];
+                case 21:
+                    _b = _g.sent();
+                    return [3 /*break*/, 22];
+                case 22:
+                    if (!rbapId) return [3 /*break*/, 26];
+                    _g.label = 23;
+                case 23:
+                    _g.trys.push([23, 25, , 26]);
+                    return [4 /*yield*/, sdk.api.role_based_access_permissions.deleteOne(rbapId)];
+                case 24:
+                    _g.sent();
+                    return [3 /*break*/, 26];
+                case 25:
+                    _c = _g.sent();
+                    return [3 /*break*/, 26];
+                case 26:
+                    if (!grantRbapId) return [3 /*break*/, 30];
+                    _g.label = 27;
+                case 27:
+                    _g.trys.push([27, 29, , 30]);
+                    return [4 /*yield*/, sdk.api.role_based_access_permissions.deleteOne(grantRbapId)];
+                case 28:
+                    _g.sent();
+                    return [3 /*break*/, 30];
+                case 29:
+                    _d = _g.sent();
+                    return [3 /*break*/, 30];
+                case 30:
+                    if (!assignedRbapId) return [3 /*break*/, 34];
+                    _g.label = 31;
+                case 31:
+                    _g.trys.push([31, 33, , 34]);
+                    return [4 /*yield*/, sdk.api.role_based_access_permissions.deleteOne(assignedRbapId)];
+                case 32:
+                    _g.sent();
+                    return [3 /*break*/, 34];
+                case 33:
+                    _e = _g.sent();
+                    return [3 /*break*/, 34];
+                case 34: 
+                // Re-authenticate the non-admin to drop the no-access role from their JWT
+                // before subsequent tests run.
+                // Role restore above re-triggers deauthenticate_user; wait > 1s so the freshly minted
+                // token's (second-floored) iat lands after the deauth timestamp and isn't permanently
+                // rejected by is_logged_in's iat-slack check. Matches the in-test re-auth above.
+                return [4 /*yield*/, wait(undefined, 1500)];
+                case 35:
+                    // Re-authenticate the non-admin to drop the no-access role from their JWT
+                    // before subsequent tests run.
+                    // Role restore above re-triggers deauthenticate_user; wait > 1s so the freshly minted
+                    // token's (second-floored) iat lands after the deauth timestamp and isn't permanently
+                    // rejected by is_logged_in's iat-slack check. Matches the in-test re-auth above.
+                    _g.sent();
+                    _g.label = 36;
+                case 36:
+                    _g.trys.push([36, 38, , 39]);
+                    return [4 /*yield*/, sdkNonAdmin.authenticate(nonAdminEmail, nonAdminPassword)];
+                case 37:
+                    _g.sent();
+                    return [3 /*break*/, 39];
+                case 38:
+                    _f = _g.sent();
+                    return [3 /*break*/, 39];
+                case 39: return [7 /*endfinally*/];
+                case 40: return [2 /*return*/];
+            }
+        });
+    });
+};
+// Allow running this test file independently
+if (require.main === module) {
+    console.log("\uD83C\uDF10 Using API URL: ".concat(host));
+    var sdk_1 = new Session({ host: host });
+    var sdkNonAdmin_1 = new Session({ host: host });
+    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, setup_tests(sdk_1, sdkNonAdmin_1)];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, ai_conversations_rbac_tests({ sdk: sdk_1, sdkNonAdmin: sdkNonAdmin_1 })];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); };
+    runTests()
+        .then(function () {
+        console.log("✅ ai_conversations RBAC test suite completed successfully");
+        process.exit(0);
+    })
+        .catch(function (error) {
+        console.error("❌ ai_conversations RBAC test suite failed:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=ai-conversations-rbac.test.js.map

package/lib/esm/tests/api_tests/security/ai-conversations-rbac.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-conversations-rbac.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/ai-conversations-rbac.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,OAAO,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAA;AAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EACL,UAAU,EACV,UAAU,EACV,IAAI,GACL,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AAE5D,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAC9D,IAAA,KAAoC,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAhG,aAAa,QAAA,EAAE,gBAAgB,QAAiE,CAAA;AAEvG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,IAAM,2BAA2B,GAAG,UAAO,EAA6D;QAA3D,GAAG,SAAA,EAAE,WAAW,iBAAA;;;;;;oBAClE,UAAU,CAAC,yCAAyC,CAAC,CAAA;oBAE/C,QAAQ,GAAG,2CAAoC,IAAI,CAAC,GAAG,EAAE,CAAE,CAAA;oBAC3D,aAAa,GAAG,gDAAyC,IAAI,CAAC,GAAG,EAAE,CAAE,CAAA;oBACrE,gBAAgB,GAAG,kDAA2C,IAAI,CAAC,GAAG,EAAE,CAAE,CAAA;oBAI1E,aAAa,GAAG,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAA;;;;oBAMjC,qBAAM,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,SAAS,CAAC;4BACjE,IAAI,EAAE,QAAQ;4BACd,WAAW,wBACN,oBAAoB,KACvB,gBAAgB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAC1E,QAAQ,EAAU,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAC3E;yBACF,CAAC,EAAA;;oBAPI,IAAI,GAAG,SAOX;oBACF,MAAM,GAAG,IAAI,CAAC,EAAE,CAAA;oBAEhB,0EAA0E;oBAC1E,qDAAqD;oBACrD,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAC3B,WAAW,CAAC,QAAQ,CAAC,EAAE,EACvB,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,EACrB,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAC9B,EAAA;;oBAND,0EAA0E;oBAC1E,qDAAqD;oBACrD,SAIC,CAAA;oBACD,qBAAM,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAA;;oBAA3B,SAA2B,CAAA;oBAC3B,qBAAM,WAAW,CAAC,YAAY,CAAC,aAAc,EAAE,gBAAiB,CAAC;wBAEjE,sFAAsF;wBACtF,kFAAkF;sBAHjB;;oBAAjE,SAAiE,CAAA;oBAEjE,sFAAsF;oBACtF,kFAAkF;oBAClF,qBAAM,UAAU,CACd,gFAAgF,EAChF,cAAM,OAAA,WAAW,CAAC,GAAG,CAAC,gBAAgB,CAAC,YAAY,CAAC;4BAClD,OAAO,EAAE,iBAAiB;4BAC1B,IAAI,EAAE,MAAM;yBACN,CAAC,EAHH,CAGG,EACT;4BACE,WAAW,EAAE,IAAI;4BACjB,OAAO,EAAE,UAAC,CAAM;;gCACd,4EAA4E;gCAC5E,sDAAsD;gCACtD,IAAM,GAAG,GAAG,CAAC,MAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,mCAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;gCAC5C,IAAM,MAAM,GAAG,MAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,MAAM,mCAAI,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,IAAI,CAAA;gCACnC,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;uCAClC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;4BACxF,CAAC;yBACF,CACF;wBAED,kFAAkF;wBAClF,qFAAqF;wBACrF,wDAAwD;sBAJvD;;oBAnBD,sFAAsF;oBACtF,kFAAkF;oBAClF,SAiBC,CAAA;oBAED,kFAAkF;oBAClF,qFAAqF;oBACrF,wDAAwD;oBACxD,qBAAM,UAAU,CACd,iGAAiG,EACjG,cAAM,OAAA,WAAW,CAAC,GAAG,CAAC,gBAAgB,CAAC,oBAAoB,CAAC;4BAC1D,SAAS,EAAE,IAAI,QAAQ,EAAE,CAAC,WAAW,EAAE;4BACvC,gBAAgB,EAAE,IAAI,QAAQ,EAAE,CAAC,WAAW,EAAE;4BAC9C,QAAQ,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC;4BACvB,MAAM,EAAE,iBAAiB;4BACzB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAa,6DAA6D;yBACxG,CAAC,EANH,CAMG,EACT;4BACE,WAAW,EAAE,IAAI;4BACjB,OAAO,EAAE,UAAC,CAAM;;gCACd,IAAM,GAAG,GAAG,CAAC,MAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,mCAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;gCAC5C,IAAM,MAAM,GAAG,MAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,MAAM,mCAAI,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,IAAI,CAAA;gCACnC,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;uCAClC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;4BACxF,CAAC;yBACF,CACF;wBAED,mFAAmF;wBACnF,8FAA8F;wBAC9F,gDAAgD;sBAJ/C;;oBArBD,kFAAkF;oBAClF,qFAAqF;oBACrF,wDAAwD;oBACxD,SAkBC,CAAA;oBAKiB,qBAAM,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,SAAS,CAAC;4BACtE,IAAI,EAAE,aAAa;4BACnB,WAAW,wBACN,oBAAoB,KACvB,gBAAgB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAC5E;yBACF,CAAC,EAAA;;oBANI,SAAS,GAAG,SAMhB;oBACF,WAAW,GAAG,SAAS,CAAC,EAAE,CAAA;oBAE1B,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAC3B,WAAW,CAAC,QAAQ,CAAC,EAAE,EACvB,EAAE,KAAK,EAAE,CAAC,aAAa,CAAC,EAAE,EAC1B,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAC9B,EAAA;;oBAJD,SAIC,CAAA;oBACD,qBAAM,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAA;;oBAA3B,SAA2B,CAAA;oBAC3B,qBAAM,WAAW,CAAC,YAAY,CAAC,aAAc,EAAE,gBAAiB,CAAC,EAAA;;oBAAjE,SAAiE,CAAA;oBAEjE,qBAAM,UAAU,CACd,iFAAiF,EACjF,cAAM,OAAA,WAAW,CAAC,GAAG,CAAC,gBAAgB,CAAC,YAAY,CAAC;4BAClD,OAAO,EAAE,oBAAoB;4BAC7B,IAAI,EAAE,MAAM;4BACZ,SAAS,EAAE,CAAC;yBACN,CAAC;6BACN,IAAI,CAAC,cAAM,OAAA,SAAkB,EAAlB,CAAkB,CAAC;6BAC9B,KAAK,CAAC,UAAC,CAAM;;4BACZ,IAAM,GAAG,GAAG,CAAC,MAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,mCAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;4BAC5C,IAAM,MAAM,GAAG,MAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,MAAM,mCAAI,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,IAAI,CAAA;4BACnC,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;mCAC/B,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE;gCACtF,MAAM,CAAC,CAAA,CAAC,qEAAqE;6BAC9E;4BACD,OAAO,SAAkB,CAAA,CAAC,4DAA4D;wBACxF,CAAC,CAAC,EAdE,CAcF,EACJ,EAAE,QAAQ,EAAE,UAAA,CAAC,IAAI,OAAA,CAAC,KAAK,SAAS,EAAf,CAAe,EAAE,CACnC;wBAED,2FAA2F;wBAC3F,8FAA8F;wBAC9F,uFAAuF;sBAJtF;;oBAlBD,SAkBC,CAAA;oBAED,2FAA2F;oBAC3F,8FAA8F;oBAC9F,uFAAuF;oBACvF,qBAAM,UAAU,CACd,yFAAyF,EACzF,cAAM,OAAA,WAAW,CAAC,GAAG,CAAC,gBAAgB,CAAC,YAAY,CAAC;4BAClD,OAAO,EAAE,4BAA4B;4BACrC,IAAI,EAAE,MAAM;4BACZ,SAAS,EAAE,CAAC;4BACZ,cAAc,EAAE,IAAI,QAAQ,EAAE,CAAC,WAAW,EAAE;yBACtC,CAAC,EALH,CAKG,EACT;4BACE,WAAW,EAAE,IAAI;4BACjB,OAAO,EAAE,UAAC,CAAM;;gCACd,IAAM,GAAG,GAAG,CAAC,MAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,mCAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;gCAC5C,IAAM,MAAM,GAAG,MAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,MAAM,mCAAI,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,IAAI,CAAA;gCACnC,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;uCAClC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;4BACxF,CAAC;yBACF,CACF;wBAED,wFAAwF;wBACxF,+EAA+E;wBAC/E,mFAAmF;wBACnF,wFAAwF;sBALvF;;oBApBD,2FAA2F;oBAC3F,8FAA8F;oBAC9F,uFAAuF;oBACvF,SAiBC,CAAA;oBAMoB,qBAAM,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,SAAS,CAAC;4BACzE,IAAI,EAAE,gBAAgB;4BACtB,WAAW,eAAO,oBAAoB,CAAE;yBACzC,CAAC,EAAA;;oBAHI,YAAY,GAAG,SAGnB;oBACF,cAAc,GAAG,YAAY,CAAC,EAAE,CAAA;oBAEhC,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAC3B,WAAW,CAAC,QAAQ,CAAC,EAAE,EACvB,EAAE,KAAK,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAC7B,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAC9B,EAAA;;oBAJD,SAIC,CAAA;oBACD,qBAAM,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAA;;oBAA3B,SAA2B,CAAA;oBAC3B,qBAAM,WAAW,CAAC,YAAY,CAAC,aAAc,EAAE,gBAAiB,CAAC,EAAA;;oBAAjE,SAAiE,CAAA;oBAEjE,qBAAM,UAAU,CACd,wFAAwF,EACxF,cAAM,OAAA,WAAW,CAAC,GAAG,CAAC,gBAAgB,CAAC,YAAY,CAAC;4BAClD,OAAO,EAAE,iCAAiC;4BAC1C,IAAI,EAAE,MAAM;4BACZ,SAAS,EAAE,CAAC;yBACN,CAAC;6BACN,IAAI,CAAC,cAAM,OAAA,IAAa,EAAb,CAAa,CAAC;6BACzB,KAAK,CAAC,UAAC,CAAM;;4BACZ,IAAM,GAAG,GAAG,CAAC,MAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,mCAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;4BAC5C,IAAM,MAAM,GAAG,MAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,MAAM,mCAAI,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,IAAI,CAAA;4BACnC,IAAI,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EAAE;gCAC9F,MAAM,CAAC,CAAA,CAAC,qCAAqC;6BAC9C;4BACD,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;mCAC/B,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE;gCACtF,MAAM,CAAC,CAAA,CAAC,0CAA0C;6BACnD;4BACD,OAAO,IAAa,CAAA,CAAC,0CAA0C;wBACjE,CAAC,CAAC,EAjBE,CAiBF,EACJ,EAAE,QAAQ,EAAE,UAAA,CAAC,IAAI,OAAA,CAAC,KAAK,IAAI,EAAV,CAAU,EAAE,CAC9B,EAAA;;oBArBD,SAqBC,CAAA;;;;oBAIC,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAC3B,WAAW,CAAC,QAAQ,CAAC,EAAE,EACvB,EAAE,KAAK,EAAE,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,EAAE,EAAE,EAC9B,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAC9B,EAAA;;oBAJD,SAIC,CAAA;;;;;;yBAEC,MAAM,EAAN,yBAAM;;;;oBACF,qBAAM,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,SAAS,CAAC,MAAM,CAAC,EAAA;;oBAA7D,SAA6D,CAAA;;;;;;yBAEjE,WAAW,EAAX,yBAAW;;;;oBACP,qBAAM,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,SAAS,CAAC,WAAW,CAAC,EAAA;;oBAAlE,SAAkE,CAAA;;;;;;yBAEtE,cAAc,EAAd,yBAAc;;;;oBACV,qBAAM,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,SAAS,CAAC,cAAc,CAAC,EAAA;;oBAArE,SAAqE,CAAA;;;;;;gBAE7E,0EAA0E;gBAC1E,+BAA+B;gBAC/B,sFAAsF;gBACtF,sFAAsF;gBACtF,iFAAiF;gBACjF,qBAAM,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAA;;oBAL3B,0EAA0E;oBAC1E,+BAA+B;oBAC/B,sFAAsF;oBACtF,sFAAsF;oBACtF,iFAAiF;oBACjF,SAA2B,CAAA;;;;oBACrB,qBAAM,WAAW,CAAC,YAAY,CAAC,aAAc,EAAE,gBAAiB,CAAC,EAAA;;oBAAjE,SAAiE,CAAA;;;;;;;;;;CAE1E,CAAA;AAED,6CAA6C;AAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAM,KAAG,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACjC,IAAM,aAAW,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IAEzC,IAAM,QAAQ,GAAG;;;wBACf,qBAAM,WAAW,CAAC,KAAG,EAAE,aAAW,CAAC,EAAA;;oBAAnC,SAAmC,CAAA;oBACnC,qBAAM,2BAA2B,CAAC,EAAE,GAAG,OAAA,EAAE,WAAW,eAAA,EAAE,CAAC,EAAA;;oBAAvD,SAAuD,CAAA;;;;SACxD,CAAA;IAED,QAAQ,EAAE;SACP,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAA;QACxE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,4CAA4C,EAAE,KAAK,CAAC,CAAA;QAClE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}

package/lib/esm/tests/api_tests/security/allowed-paths-confinement.test.d.ts

@@ -0,0 +1,6 @@
+import { Session } from "../../../sdk";
+export declare const allowed_paths_confinement_tests: ({ sdk }: {
+    sdk: Session;
+    sdkNonAdmin: Session;
+}) => Promise<void>;
+//# sourceMappingURL=allowed-paths-confinement.test.d.ts.map

package/lib/esm/tests/api_tests/security/allowed-paths-confinement.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowed-paths-confinement.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/allowed-paths-confinement.test.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,OAAO,EAAkB,MAAM,cAAc,CAAA;AAkEtD,eAAO,MAAM,+BAA+B;SAA2B,OAAO;iBAAe,OAAO;mBAqnBnG,CAAA"}