@tellescope/sdk 1.256.13 → 1.256.15

package/lib/esm/tests/api_tests/security/enduser-write-restrictions.test.js

@@ -0,0 +1,362 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+require('source-map-support').install();
+import { Session, EnduserSession } from "../../../sdk";
+import { async_test, log_header, } from "@tellescope/testing";
+import { setup_tests } from "../../setup";
+var host = process.env.API_URL || 'http://localhost:8080';
+var businessId = '60398b1131a295e64f084ff6';
+var ENDUSER_PASSWORD = 'F0106TestPassword!123';
+// Every endusers field marked enduserUpdatesDisabled in schema.ts, with a
+// validator-passing sample value so the only rejection in play is the
+// write-restriction (not input validation).
+var restrictedEnduserUpdates = function (staffId, mongoId) {
+    var _a;
+    return ({
+        externalId: 'f0106-attacker-external-id',
+        tags: ['f0106-attacker-tag'],
+        accessTags: ['f0106-attacker-access-tag'],
+        assignedTo: [staffId],
+        customTypeId: mongoId,
+        references: [{ type: 'Vital', id: 'f0106-attacker-reference' }],
+        sharedWithOrganizations: [],
+        journeys: (_a = {}, _a[mongoId] = 'Added', _a),
+        primaryAssignee: staffId,
+        fields: { f0106AttackerField: 'true' },
+        unread: true,
+        source: 'f0106-attacker-source',
+        note: 'f0106 attacker note',
+        insurance: { memberId: 'f0106-attacker-member' },
+        insuranceSecondary: { memberId: 'f0106-attacker-member-2' },
+        diagnoses: [{ code: 'I10' }],
+        lockedFromPortal: false,
+        eligibleForAutoMerge: true,
+        athenaDepartmentId: 'f0106-dept',
+        athenaPracticeId: 'f0106-practice',
+        salesforceId: 'f0106-salesforce',
+        healthie_dietitian_id: 'f0106-healthie',
+        stripeCustomerId: 'f0106-stripe-customer',
+        stripeKey: 'f0106-stripe-key',
+    });
+};
+// Every form_responses field marked enduserUpdatesDisabled in schema.ts.
+// otherEnduserId must be a REAL enduser other than the one submitting the update: enduserId's
+// foreign key is existence-checked, so a nonexistent id would be rejected as a bad dependency
+// rather than by the write restriction under test.
+var restrictedFormResponseUpdates = function (staffId, otherEnduserId) { return ({
+    markedAsSubmitted: true,
+    // repointing a response at another patient redirects the intake write in
+    // save_enduser_updates_for_form_response, which is how email/phone (authentication channels)
+    // reach an enduser record — see api_tests/security/public_endpoint_auth_field_lock.test.ts
+    enduserId: otherEnduserId,
+    submittedBy: staffId,
+    submittedAt: new Date("2024-01-01T00:00:00Z"),
+    submittedByIsPlaceholder: true,
+    procedureCodes: [{ code: '99214', units: 1 }],
+    diagnosisCodes: [{ code: 'I10', description: 'Essential (primary) hypertension' }],
+    enduserAISummary: 'Patient is in excellent health, no follow-up needed.',
+    addenda: [{ text: 'forged staff addendum', timestamp: new Date(), userId: staffId }],
+    isInternalNote: true,
+    pinnedAt: new Date(),
+    hiddenFromTimeline: true,
+    lockedAt: new Date(),
+    tags: ['f0110-attacker-tag'],
+    formTitle: 'Spoofed Form Title',
+    userEmail: 'spoofed-staff@example.com',
+    logoURL: 'https://attacker.example.com/logo.png',
+    logoHeight: 100,
+}); };
+/**
+ * Regression test: enduser self-updates must not write staff-only fields on `endusers` or `form_responses`.
+ *
+ * Endusers could PATCH admin-only / access-bearing / attribution-bearing fields on
+ * their own endusers record (assignedTo, tags, references, ...) and their own
+ * form_responses (procedureCodes, submittedBy, markedAsSubmitted, ...). The fix adds
+ * the `enduserUpdatesDisabled` field option (schema.ts ModelFieldInfo), enforced for
+ * enduser sessions in the generic update handler (routing.ts createDefaultEndpoints).
+ *
+ * This test asserts, for every flagged field on both models:
+ *   - an enduser session updating its OWN record gets a 400 "<field> cannot be updated by endusers"
+ *   - nothing persists (spot-checked on assignedTo, the highest-impact field)
+ *   - enduser self-updates of allowed fields still work (fname, hideFromEnduserPortal)
+ *   - staff sessions can still update the restricted fields
+ */
+export var enduser_write_restrictions_tests = function (_a) {
+    var sdk = _a.sdk;
+    return __awaiter(void 0, void 0, void 0, function () {
+        var enduserId, otherEnduserId, formId, formResponseId, enduserEmail, enduser_1, otherEnduser_1, enduserSDK_1, form, formResponse_1, _loop_1, _i, _b, _c, field, value, _loop_2, _d, _e, _f, field, value, _g, _h, _j, _k;
+        return __generator(this, function (_l) {
+            switch (_l.label) {
+                case 0:
+                    log_header("enduser write restrictions (enduserUpdatesDisabled)");
+                    _l.label = 1;
+                case 1:
+                    _l.trys.push([1, , 24, 41]);
+                    enduserEmail = "f0106-enduser-".concat(Date.now(), "@example.com");
+                    return [4 /*yield*/, sdk.api.endusers.createOne({ email: enduserEmail, fname: 'F0106', lname: 'Restricted' })];
+                case 2:
+                    enduser_1 = _l.sent();
+                    enduserId = enduser_1.id;
+                    return [4 /*yield*/, sdk.api.endusers.createOne({
+                            email: "f0106-other-".concat(Date.now(), "@example.com"), fname: 'F0106', lname: 'Other',
+                        })];
+                case 3:
+                    otherEnduser_1 = _l.sent();
+                    otherEnduserId = otherEnduser_1.id;
+                    return [4 /*yield*/, sdk.api.endusers.set_password({ id: enduser_1.id, password: ENDUSER_PASSWORD })];
+                case 4:
+                    _l.sent();
+                    enduserSDK_1 = new EnduserSession({ host: host, businessId: businessId });
+                    return [4 /*yield*/, enduserSDK_1.authenticate(enduserEmail, ENDUSER_PASSWORD)];
+                case 5:
+                    _l.sent();
+                    return [4 /*yield*/, sdk.api.forms.createOne({ title: 'Write Restriction Test Form' })];
+                case 6:
+                    form = _l.sent();
+                    formId = form.id;
+                    return [4 /*yield*/, sdk.api.form_responses.prepare_form_response({
+                            formId: form.id,
+                            enduserId: enduser_1.id,
+                        })];
+                case 7:
+                    formResponse_1 = (_l.sent()).response;
+                    formResponseId = formResponse_1.id;
+                    _loop_1 = function (field, value) {
+                        return __generator(this, function (_m) {
+                            switch (_m.label) {
+                                case 0: return [4 /*yield*/, async_test("enduser cannot self-update endusers.".concat(field), function () {
+                                        var _a;
+                                        return enduserSDK_1.api.endusers.updateOne(enduser_1.id, (_a = {}, _a[field] = value, _a));
+                                    }, { shouldError: true, onError: function (e) { return e.message === "".concat(field, " cannot be updated by endusers"); } })];
+                                case 1:
+                                    _m.sent();
+                                    return [2 /*return*/];
+                            }
+                        });
+                    };
+                    _i = 0, _b = Object.entries(restrictedEnduserUpdates(sdk.userInfo.id, enduser_1.id));
+                    _l.label = 8;
+                case 8:
+                    if (!(_i < _b.length)) return [3 /*break*/, 11];
+                    _c = _b[_i], field = _c[0], value = _c[1];
+                    return [5 /*yield**/, _loop_1(field, value)];
+                case 9:
+                    _l.sent();
+                    _l.label = 10;
+                case 10:
+                    _i++;
+                    return [3 /*break*/, 8];
+                case 11: 
+                // Variant A persistence check: the rejected assignedTo write must not
+                // have granted the staff read-filter match.
+                return [4 /*yield*/, async_test('rejected assignedTo write did not persist', function () { return sdk.api.endusers.getOne(enduser_1.id); }, { onResult: function (e) { var _a, _b; return !((_a = e.assignedTo) === null || _a === void 0 ? void 0 : _a.length) && !((_b = e.tags) === null || _b === void 0 ? void 0 : _b.length) && e.externalId === undefined; } })
+                    // ---- enduser self-update of restricted form_responses fields must 400 ----
+                ];
+                case 12:
+                    // Variant A persistence check: the rejected assignedTo write must not
+                    // have granted the staff read-filter match.
+                    _l.sent();
+                    _loop_2 = function (field, value) {
+                        return __generator(this, function (_o) {
+                            switch (_o.label) {
+                                case 0: return [4 /*yield*/, async_test("enduser cannot self-update form_responses.".concat(field), function () {
+                                        var _a;
+                                        return enduserSDK_1.api.form_responses.updateOne(formResponse_1.id, (_a = {}, _a[field] = value, _a));
+                                    }, { shouldError: true, onError: function (e) { return e.message === "".concat(field, " cannot be updated by endusers"); } })];
+                                case 1:
+                                    _o.sent();
+                                    return [2 /*return*/];
+                            }
+                        });
+                    };
+                    _d = 0, _e = Object.entries(restrictedFormResponseUpdates(sdk.userInfo.id, otherEnduser_1.id));
+                    _l.label = 13;
+                case 13:
+                    if (!(_d < _e.length)) return [3 /*break*/, 16];
+                    _f = _e[_d], field = _f[0], value = _f[1];
+                    return [5 /*yield**/, _loop_2(field, value)];
+                case 14:
+                    _l.sent();
+                    _l.label = 15;
+                case 15:
+                    _d++;
+                    return [3 /*break*/, 13];
+                case 16: return [4 /*yield*/, async_test('rejected writes did not persist (markedAsSubmitted, procedureCodes, submittedBy, enduserId)', function () { return sdk.api.form_responses.getOne(formResponse_1.id); }, { onResult: function (fr) {
+                            var _a;
+                            return (!fr.markedAsSubmitted && !((_a = fr.procedureCodes) === null || _a === void 0 ? void 0 : _a.length) && fr.submittedBy === undefined
+                                // still points at its own patient: a successful repoint is what redirects the intake write
+                                && fr.enduserId === enduser_1.id);
+                        } })
+                    // ---- Positive controls: intended enduser self-updates still work ----
+                ];
+                case 17:
+                    _l.sent();
+                    // ---- Positive controls: intended enduser self-updates still work ----
+                    return [4 /*yield*/, async_test('enduser can still update own profile fields (fname/lname)', function () { return enduserSDK_1.api.endusers.updateOne(enduser_1.id, { fname: 'StillAllowed', lname: 'Patient' }); }, { onResult: function (e) { return e.fname === 'StillAllowed' && e.lname === 'Patient'; } })];
+                case 18:
+                    // ---- Positive controls: intended enduser self-updates still work ----
+                    _l.sent();
+                    return [4 /*yield*/, async_test('enduser can still update own form_response (hideFromEnduserPortal — intended per schema)', function () { return enduserSDK_1.api.form_responses.updateOne(formResponse_1.id, { hideFromEnduserPortal: true }); }, { onResult: function (fr) { return fr.hideFromEnduserPortal === true; } })
+                        // ---- Positive controls: staff sessions are unaffected by enduserUpdatesDisabled ----
+                    ];
+                case 19:
+                    _l.sent();
+                    // ---- Positive controls: staff sessions are unaffected by enduserUpdatesDisabled ----
+                    return [4 /*yield*/, async_test('staff can still update restricted endusers fields (tags, assignedTo, externalId, note, source)', function () { return sdk.api.endusers.updateOne(enduser_1.id, {
+                            tags: ['staff-set-tag'],
+                            assignedTo: [sdk.userInfo.id],
+                            externalId: 'staff-set-external-id',
+                            note: 'staff-set note',
+                            source: 'staff-set-source',
+                        }); }, { onResult: function (e) {
+                                var _a, _b;
+                                return (!!((_a = e.tags) === null || _a === void 0 ? void 0 : _a.includes('staff-set-tag'))
+                                    && !!((_b = e.assignedTo) === null || _b === void 0 ? void 0 : _b.includes(sdk.userInfo.id))
+                                    && e.externalId === 'staff-set-external-id');
+                            } })];
+                case 20:
+                    // ---- Positive controls: staff sessions are unaffected by enduserUpdatesDisabled ----
+                    _l.sent();
+                    return [4 /*yield*/, async_test('staff can still update restricted form_responses fields (procedureCodes, diagnosisCodes, tags)', function () { return sdk.api.form_responses.updateOne(formResponse_1.id, {
+                            procedureCodes: [{ code: 'G0019', units: 1 }],
+                            diagnosisCodes: [{ code: 'Z71.3', description: 'Dietary counseling and surveillance' }],
+                            tags: ['staff-set-tag'],
+                        }); }, { onResult: function (fr) {
+                                var _a, _b, _c, _d, _e;
+                                return (((_b = (_a = fr.procedureCodes) === null || _a === void 0 ? void 0 : _a[0]) === null || _b === void 0 ? void 0 : _b.code) === 'G0019'
+                                    && ((_d = (_c = fr.diagnosisCodes) === null || _c === void 0 ? void 0 : _c[0]) === null || _d === void 0 ? void 0 : _d.code) === 'Z71.3'
+                                    && !!((_e = fr.tags) === null || _e === void 0 ? void 0 : _e.includes('staff-set-tag')));
+                            } })
+                        // enduserId is enduserUpdatesDisabled rather than updatesDisabled specifically so this keeps
+                        // working: staff sometimes need to move a response to the correct profile to fix a mistake.
+                    ];
+                case 21:
+                    _l.sent();
+                    // enduserId is enduserUpdatesDisabled rather than updatesDisabled specifically so this keeps
+                    // working: staff sometimes need to move a response to the correct profile to fix a mistake.
+                    return [4 /*yield*/, async_test('staff can still repoint form_responses.enduserId to another patient', function () { return sdk.api.form_responses.updateOne(formResponse_1.id, { enduserId: otherEnduser_1.id }); }, { onResult: function (fr) { return fr.enduserId === otherEnduser_1.id; } })];
+                case 22:
+                    // enduserId is enduserUpdatesDisabled rather than updatesDisabled specifically so this keeps
+                    // working: staff sometimes need to move a response to the correct profile to fix a mistake.
+                    _l.sent();
+                    return [4 /*yield*/, async_test('staff can repoint form_responses.enduserId back', function () { return sdk.api.form_responses.updateOne(formResponse_1.id, { enduserId: enduser_1.id }); }, { onResult: function (fr) { return fr.enduserId === enduser_1.id; } })];
+                case 23:
+                    _l.sent();
+                    return [3 /*break*/, 41];
+                case 24:
+                    if (!formResponseId) return [3 /*break*/, 28];
+                    _l.label = 25;
+                case 25:
+                    _l.trys.push([25, 27, , 28]);
+                    return [4 /*yield*/, sdk.api.form_responses.deleteOne(formResponseId)];
+                case 26:
+                    _l.sent();
+                    return [3 /*break*/, 28];
+                case 27:
+                    _g = _l.sent();
+                    return [3 /*break*/, 28];
+                case 28:
+                    if (!formId) return [3 /*break*/, 32];
+                    _l.label = 29;
+                case 29:
+                    _l.trys.push([29, 31, , 32]);
+                    return [4 /*yield*/, sdk.api.forms.deleteOne(formId)];
+                case 30:
+                    _l.sent();
+                    return [3 /*break*/, 32];
+                case 31:
+                    _h = _l.sent();
+                    return [3 /*break*/, 32];
+                case 32:
+                    if (!enduserId) return [3 /*break*/, 36];
+                    _l.label = 33;
+                case 33:
+                    _l.trys.push([33, 35, , 36]);
+                    return [4 /*yield*/, sdk.api.endusers.deleteOne(enduserId)];
+                case 34:
+                    _l.sent();
+                    return [3 /*break*/, 36];
+                case 35:
+                    _j = _l.sent();
+                    return [3 /*break*/, 36];
+                case 36:
+                    if (!otherEnduserId) return [3 /*break*/, 40];
+                    _l.label = 37;
+                case 37:
+                    _l.trys.push([37, 39, , 40]);
+                    return [4 /*yield*/, sdk.api.endusers.deleteOne(otherEnduserId)];
+                case 38:
+                    _l.sent();
+                    return [3 /*break*/, 40];
+                case 39:
+                    _k = _l.sent();
+                    return [3 /*break*/, 40];
+                case 40: return [7 /*endfinally*/];
+                case 41: return [2 /*return*/];
+            }
+        });
+    });
+};
+// Allow running this test file independently
+if (require.main === module) {
+    console.log("\uD83C\uDF10 Using API URL: ".concat(host));
+    var sdk_1 = new Session({ host: host });
+    var sdkNonAdmin_1 = new Session({ host: host });
+    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, setup_tests(sdk_1, sdkNonAdmin_1)];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, enduser_write_restrictions_tests({ sdk: sdk_1, sdkNonAdmin: sdkNonAdmin_1 })];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); };
+    runTests()
+        .then(function () {
+        console.log("✅ enduser write-restriction test suite completed successfully");
+        process.exit(0);
+    })
+        .catch(function (error) {
+        console.error("❌ enduser write-restriction test suite failed:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=enduser-write-restrictions.test.js.map

package/lib/esm/tests/api_tests/security/enduser-write-restrictions.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enduser-write-restrictions.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/enduser-write-restrictions.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AACtD,OAAO,EACL,UAAU,EACV,UAAU,GACX,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEzC,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AACpE,IAAM,UAAU,GAAG,0BAA0B,CAAA;AAE7C,IAAM,gBAAgB,GAAG,uBAAuB,CAAA;AAEhD,0EAA0E;AAC1E,sEAAsE;AACtE,4CAA4C;AAC5C,IAAM,wBAAwB,GAAG,UAAC,OAAe,EAAE,OAAe;;IAA0B,OAAA,CAAC;QAC3F,UAAU,EAAE,4BAA4B;QACxC,IAAI,EAAE,CAAC,oBAAoB,CAAC;QAC5B,UAAU,EAAE,CAAC,2BAA2B,CAAC;QACzC,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,YAAY,EAAE,OAAO;QACrB,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,0BAA0B,EAAE,CAAC;QAC/D,uBAAuB,EAAE,EAAE;QAC3B,QAAQ,YAAI,GAAC,OAAO,IAAG,OAAO,KAAE;QAChC,eAAe,EAAE,OAAO;QACxB,MAAM,EAAE,EAAE,kBAAkB,EAAE,MAAM,EAAE;QACtC,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,uBAAuB;QAC/B,IAAI,EAAE,qBAAqB;QAC3B,SAAS,EAAE,EAAE,QAAQ,EAAE,uBAAuB,EAAE;QAChD,kBAAkB,EAAE,EAAE,QAAQ,EAAE,yBAAyB,EAAE;QAC3D,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC5B,gBAAgB,EAAE,KAAK;QACvB,oBAAoB,EAAE,IAAI;QAC1B,kBAAkB,EAAE,YAAY;QAChC,gBAAgB,EAAE,gBAAgB;QAClC,YAAY,EAAE,kBAAkB;QAChC,qBAAqB,EAAE,gBAAgB;QACvC,gBAAgB,EAAE,uBAAuB;QACzC,SAAS,EAAE,kBAAkB;KAC9B,CAAC;AAzB0F,CAyB1F,CAAA;AAEF,yEAAyE;AACzE,8FAA8F;AAC9F,8FAA8F;AAC9F,mDAAmD;AACnD,IAAM,6BAA6B,GAAG,UAAC,OAAe,EAAE,cAAsB,IAA0B,OAAA,CAAC;IACvG,iBAAiB,EAAE,IAAI;IACvB,yEAAyE;IACzE,6FAA6F;IAC7F,2FAA2F;IAC3F,SAAS,EAAE,cAAc;IACzB,WAAW,EAAE,OAAO;IACpB,WAAW,EAAE,IAAI,IAAI,CAAC,sBAAsB,CAAC;IAC7C,wBAAwB,EAAE,IAAI;IAC9B,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAC7C,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;IAClF,gBAAgB,EAAE,sDAAsD;IACxE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACpF,cAAc,EAAE,IAAI;IACpB,QAAQ,EAAE,IAAI,IAAI,EAAE;IACpB,kBAAkB,EAAE,IAAI;IACxB,QAAQ,EAAE,IAAI,IAAI,EAAE;IACpB,IAAI,EAAE,CAAC,oBAAoB,CAAC;IAC5B,SAAS,EAAE,oBAAoB;IAC/B,SAAS,EAAE,2BAA2B;IACtC,OAAO,EAAE,uCAAuC;IAChD,UAAU,EAAE,GAAG;CAChB,CAAC,EAtBsG,CAsBtG,CAAA;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,IAAM,gCAAgC,GAAG,UAAO,EAAgD;QAA9C,GAAG,SAAA;;;;;;oBAC1D,UAAU,CAAC,qDAAqD,CAAC,CAAA;;;;oBASzD,YAAY,GAAG,wBAAiB,IAAI,CAAC,GAAG,EAAE,iBAAc,CAAA;oBAC9C,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAA;;oBAAxG,YAAU,SAA8F;oBAC9G,SAAS,GAAG,SAAO,CAAC,EAAE,CAAA;oBAGD,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;4BACpD,KAAK,EAAE,sBAAe,IAAI,CAAC,GAAG,EAAE,iBAAc,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO;yBAC/E,CAAC,EAAA;;oBAFI,iBAAe,SAEnB;oBACF,cAAc,GAAG,cAAY,CAAC,EAAE,CAAA;oBAChC,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,SAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,EAAA;;oBAAnF,SAAmF,CAAA;oBAE7E,eAAa,IAAI,cAAc,CAAC,EAAE,IAAI,MAAA,EAAE,UAAU,YAAA,EAAE,CAAC,CAAA;oBAC3D,qBAAM,YAAU,CAAC,YAAY,CAAC,YAAY,EAAE,gBAAgB,CAAC,EAAA;;oBAA7D,SAA6D,CAAA;oBAEhD,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,EAAA;;oBAA9E,IAAI,GAAG,SAAuE;oBACpF,MAAM,GAAG,IAAI,CAAC,EAAE,CAAA;oBACmB,qBAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,qBAAqB,CAAC;4BACpF,MAAM,EAAE,IAAI,CAAC,EAAE;4BACf,SAAS,EAAE,SAAO,CAAC,EAAE;yBACtB,CAAC,EAAA;;oBAHM,iBAA2B,CAAA,SAGjC,CAAA,SAH4B;oBAI9B,cAAc,GAAG,cAAY,CAAC,EAAE,CAAA;wCAGpB,KAAK,EAAE,KAAK;;;wCACtB,qBAAM,UAAU,CACd,8CAAuC,KAAK,CAAE,EAC9C;;wCAAM,OAAA,YAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAO,CAAC,EAAE,EAAE,CAAA,SAAE,GAAC,KAAK,IAAG,KAAK,IAAS,CAAA,CAAC;oCAAxE,CAAwE,EAC9E,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,OAAO,KAAK,UAAG,KAAK,mCAAgC,EAAtD,CAAsD,EAAE,CAC5F,EAAA;;oCAJD,SAIC,CAAA;;;;;0BAL+F,EAArE,KAAA,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAO,CAAC,EAAE,CAAC,CAAC;;;yBAArE,CAAA,cAAqE,CAAA;oBAAvF,WAAc,EAAb,KAAK,QAAA,EAAE,KAAK,QAAA;kDAAZ,KAAK,EAAE,KAAK;;;;;oBAAK,IAAqE,CAAA;;;gBAQlG,sEAAsE;gBACtE,4CAA4C;gBAC5C,qBAAM,UAAU,CACd,2CAA2C,EAC3C,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAO,CAAC,EAAE,CAAC,EAAnC,CAAmC,EACzC,EAAE,QAAQ,EAAE,UAAA,CAAC,gBAAI,OAAA,CAAC,CAAA,MAAA,CAAC,CAAC,UAAU,0CAAE,MAAM,CAAA,IAAI,CAAC,CAAA,MAAA,CAAC,CAAC,IAAI,0CAAE,MAAM,CAAA,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,CAAA,EAAA,EAAE,CAC1F;oBAED,6EAA6E;kBAF5E;;oBAND,sEAAsE;oBACtE,4CAA4C;oBAC5C,SAIC,CAAA;wCAGW,KAAK,EAAE,KAAK;;;wCACtB,qBAAM,UAAU,CACd,oDAA6C,KAAK,CAAE,EACpD;;wCAAM,OAAA,YAAU,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,cAAY,CAAC,EAAE,EAAE,CAAA,SAAE,GAAC,KAAK,IAAG,KAAK,IAAS,CAAA,CAAC;oCAAnF,CAAmF,EACzF,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,OAAO,KAAK,UAAG,KAAK,mCAAgC,EAAtD,CAAsD,EAAE,CAC5F,EAAA;;oCAJD,SAIC,CAAA;;;;;0BALyG,EAA/E,KAAA,MAAM,CAAC,OAAO,CAAC,6BAA6B,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,cAAY,CAAC,EAAE,CAAC,CAAC;;;yBAA/E,CAAA,cAA+E,CAAA;oBAAjG,WAAc,EAAb,KAAK,QAAA,EAAE,KAAK,QAAA;kDAAZ,KAAK,EAAE,KAAK;;;;;oBAAK,IAA+E,CAAA;;yBAQ5G,qBAAM,UAAU,CACd,6FAA6F,EAC7F,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,cAAY,CAAC,EAAE,CAAC,EAA9C,CAA8C,EACpD,EAAE,QAAQ,EAAE,UAAA,EAAE;;4BAAI,OAAA,CAChB,CAAC,EAAE,CAAC,iBAAiB,IAAI,CAAC,CAAA,MAAA,EAAE,CAAC,cAAc,0CAAE,MAAM,CAAA,IAAI,EAAE,CAAC,WAAW,KAAK,SAAS;gCACnF,2FAA2F;mCACxF,EAAE,CAAC,SAAS,KAAK,SAAO,CAAC,EAAE,CAC/B,CAAA;yBAAA,EAAE,CACJ;oBAED,wEAAwE;kBAFvE;;oBARD,SAQC,CAAA;oBAED,wEAAwE;oBACxE,qBAAM,UAAU,CACd,2DAA2D,EAC3D,cAAM,OAAA,YAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAA1F,CAA0F,EAChG,EAAE,QAAQ,EAAE,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,KAAK,KAAK,cAAc,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAnD,CAAmD,EAAE,CACvE,EAAA;;oBALD,wEAAwE;oBACxE,SAIC,CAAA;oBACD,qBAAM,UAAU,CACd,0FAA0F,EAC1F,cAAM,OAAA,YAAU,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,cAAY,CAAC,EAAE,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,EAAzF,CAAyF,EAC/F,EAAE,QAAQ,EAAE,UAAA,EAAE,IAAI,OAAA,EAAE,CAAC,qBAAqB,KAAK,IAAI,EAAjC,CAAiC,EAAE,CACtD;wBAED,uFAAuF;sBAFtF;;oBAJD,SAIC,CAAA;oBAED,uFAAuF;oBACvF,qBAAM,UAAU,CACd,gGAAgG,EAChG,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAO,CAAC,EAAE,EAAE;4BAC3C,IAAI,EAAE,CAAC,eAAe,CAAC;4BACvB,UAAU,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;4BAC7B,UAAU,EAAE,uBAAuB;4BACnC,IAAI,EAAE,gBAAgB;4BACtB,MAAM,EAAE,kBAAkB;yBAC3B,CAAC,EANI,CAMJ,EACF,EAAE,QAAQ,EAAE,UAAA,CAAC;;gCAAI,OAAA,CACf,CAAC,CAAC,CAAA,MAAA,CAAC,CAAC,IAAI,0CAAE,QAAQ,CAAC,eAAe,CAAC,CAAA;uCAChC,CAAC,CAAC,CAAA,MAAA,CAAC,CAAC,UAAU,0CAAE,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;uCACzC,CAAC,CAAC,UAAU,KAAK,uBAAuB,CAC5C,CAAA;6BAAA,EAAE,CACJ,EAAA;;oBAfD,uFAAuF;oBACvF,SAcC,CAAA;oBACD,qBAAM,UAAU,CACd,gGAAgG,EAChG,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,cAAY,CAAC,EAAE,EAAE;4BACtD,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;4BAC7C,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC;4BACvF,IAAI,EAAE,CAAC,eAAe,CAAC;yBACxB,CAAC,EAJI,CAIJ,EACF,EAAE,QAAQ,EAAE,UAAA,EAAE;;gCAAI,OAAA,CAChB,CAAA,MAAA,MAAA,EAAE,CAAC,cAAc,0CAAG,CAAC,CAAC,0CAAE,IAAI,MAAK,OAAO;uCACrC,CAAA,MAAA,MAAA,EAAE,CAAC,cAAc,0CAAG,CAAC,CAAC,0CAAE,IAAI,MAAK,OAAO;uCACxC,CAAC,CAAC,CAAA,MAAA,EAAE,CAAC,IAAI,0CAAE,QAAQ,CAAC,eAAe,CAAC,CAAA,CACxC,CAAA;6BAAA,EAAE,CACJ;wBAED,6FAA6F;wBAC7F,4FAA4F;sBAH3F;;oBAZD,SAYC,CAAA;oBAED,6FAA6F;oBAC7F,4FAA4F;oBAC5F,qBAAM,UAAU,CACd,qEAAqE,EACrE,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,cAAY,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,cAAY,CAAC,EAAE,EAAE,CAAC,EAAjF,CAAiF,EACvF,EAAE,QAAQ,EAAE,UAAA,EAAE,IAAI,OAAA,EAAE,CAAC,SAAS,KAAK,cAAY,CAAC,EAAE,EAAhC,CAAgC,EAAE,CACrD,EAAA;;oBAND,6FAA6F;oBAC7F,4FAA4F;oBAC5F,SAIC,CAAA;oBACD,qBAAM,UAAU,CACd,iDAAiD,EACjD,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,cAAY,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,SAAO,CAAC,EAAE,EAAE,CAAC,EAA5E,CAA4E,EAClF,EAAE,QAAQ,EAAE,UAAA,EAAE,IAAI,OAAA,EAAE,CAAC,SAAS,KAAK,SAAO,CAAC,EAAE,EAA3B,CAA2B,EAAE,CAChD,EAAA;;oBAJD,SAIC,CAAA;;;yBAEG,cAAc,EAAd,yBAAc;;;;oBACV,qBAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,cAAc,CAAC,EAAA;;oBAAtD,SAAsD,CAAA;;;;;;yBAE1D,MAAM,EAAN,yBAAM;;;;oBACF,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAA;;oBAArC,SAAqC,CAAA;;;;;;yBAEzC,SAAS,EAAT,yBAAS;;;;oBACL,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,EAAA;;oBAA3C,SAA2C,CAAA;;;;;;yBAE/C,cAAc,EAAd,yBAAc;;;;oBACV,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,cAAc,CAAC,EAAA;;oBAAhD,SAAgD,CAAA;;;;;;;;;;CAG3D,CAAA;AAED,6CAA6C;AAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAM,KAAG,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACjC,IAAM,aAAW,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IAEzC,IAAM,QAAQ,GAAG;;;wBACf,qBAAM,WAAW,CAAC,KAAG,EAAE,aAAW,CAAC,EAAA;;oBAAnC,SAAmC,CAAA;oBACnC,qBAAM,gCAAgC,CAAC,EAAE,GAAG,OAAA,EAAE,WAAW,eAAA,EAAE,CAAC,EAAA;;oBAA5D,SAA4D,CAAA;;;;SAC7D,CAAA;IAED,QAAQ,EAAE;SACP,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAA;QAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,gDAAgD,EAAE,KAAK,CAAC,CAAA;QACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}

package/lib/esm/tests/api_tests/security/form-logic-js-execution.test.d.ts

@@ -0,0 +1,32 @@
+import { Check } from "../../setup_isolated";
+/**
+ * Regression test: `$JS(...)` must be rejected in stored conditional logic.
+ *
+ * `responses_satisfy_conditions` (utilities/src/utils.ts) compiled a stored condition value of the
+ * form `$JS(...)` with `new Function()` and executed it — in every form-filler's browser, including
+ * anonymous visitors on public intake pages, AND inside the API process (automation_triggers.ts
+ * trigger matching on every form submission, ai_agent/form_filling.ts voice-agent navigation). The
+ * API process holds every tenant's database handle, so a condition authored by staff in one tenant
+ * reached all of them. Any staff user or API key with form_fields write access could plant one by
+ * typing into the free-text $gt/$lt box — no API call required.
+ *
+ * The sink is removed. This asserts the second half of the fix: `compoundFilterValidator` rejects the
+ * syntax at write time on every field that feeds that evaluator, so it cannot be reintroduced through
+ * stored configuration. The runtime half — that a `$JS` value is never evaluated — is covered by the
+ * pure-function cases in `form_conditional_logic_tests` in tests.ts.
+ *
+ * The five condition locations were established by enumerating every `responses_satisfy_conditions`
+ * call site, and all five are covered here. That completeness matters: the first run of this test
+ * caught a half fix. `event.conditions` is wrapped in an `orValidator`, which returns the first arm
+ * that does not throw, and its permissive `optional: optionalAnyObjectValidator` arm was declared
+ * before the guarded one — so the payload was accepted and stored even though the validator had been
+ * swapped. Pointing a field at the guard is not the same as the guard being reachable, which is why
+ * every location gets an assertion rather than an argument.
+ *
+ * Each rejection is paired with a positive control using the same shape without `$JS(`, so a passing
+ * test cannot be explained by the write failing for an unrelated reason.
+ */
+export declare const form_logic_js_execution_checks: () => Promise<Check[]>;
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+export declare const form_logic_js_execution_tests: () => Promise<void>;
+//# sourceMappingURL=form-logic-js-execution.test.d.ts.map

package/lib/esm/tests/api_tests/security/form-logic-js-execution.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"form-logic-js-execution.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/form-logic-js-execution.test.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,EAEN,MAAM,sBAAsB,CAAA;AAM7B;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,8BAA8B,QAAa,QAAQ,KAAK,EAAE,CA4HtE,CAAA;AAED,kFAAkF;AAClF,eAAO,MAAM,6BAA6B,qBAEzC,CAAA"}