@tellescope/sdk 1.256.13 → 1.256.15

package/lib/cjs/tests/api_tests/security/F-0185-startlinktoken-enduser-staff-escalation.test.js

@@ -0,0 +1,354 @@
+"use strict";
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startlinktoken_escalation_tests = void 0;
+require('source-map-support').install();
+var sdk_1 = require("../../../sdk");
+var testing_1 = require("@tellescope/testing");
+var setup_1 = require("../../setup");
+var constants_1 = require("@tellescope/constants");
+var host = process.env.API_URL || 'http://localhost:8080';
+/**
+ * Regression test for F-0185 — `calendar_events.startLinkToken` privilege escalation.
+ *
+ * startLinkToken is a DOCUMENTED feature ("Video Call Start Links"): a tenant's staff / API-key
+ * integration PATCHes a CalendarEvent to set a random token, then sends the host user the
+ * `/video/startlink?token=...` link, which `session_for_start_link` exchanges for a scope-limited
+ * User (staff) authToken for the first `type:'user'` attendee, MFA bypassed. Nothing in the codebase
+ * reads the token value back (the redeem matches server-side; the integration holds its own copy), so
+ * the field is write-only-by-design.
+ *
+ * TWO escalation vectors let a patient (or a low-privilege staff user) obtain the host's session:
+ *   WRITE — `enduserActions.update` + no `enduserUpdatesDisabled` let an enduser attendee PATCH
+ *           `startLinkToken` to a value they choose, then redeem it.
+ *   READ  — no `redactions` let an enduser attendee (or a non-admin staff user with calendar read)
+ *           read a LEGITIMATELY staff-set token and redeem it, with no write.
+ *
+ * Complete fix = TWO flags on schema.ts `startLinkToken`:
+ *   enduserUpdatesDisabled: true   (closes WRITE; preserves the staff/API-key write the feature needs)
+ *   redactions: ['all']            (closes READ for endusers AND non-admin users; safe — nothing reads
+ *                                   the value back). NOT `readonly` (would break the staff write — A2).
+ *
+ * Checks (collected, then asserted, so a RED run shows every failing vector):
+ *   A1  enduser attendee PATCH of startLinkToken is REJECTED                (WRITE gate)
+ *   A2  a staff-set token still redeems for the host's session             (feature preserved)
+ *   A3  an enduser-set token (if the write lands) does NOT redeem          (defence-in-depth)
+ *   A4  an enduser attendee does NOT receive startLinkToken on read        (READ gate, endusers)
+ *   A5  a non-admin staff user does NOT receive startLinkToken on read     (READ gate, users)
+ *
+ * No vendor, no Bedrock; the "host" is a throwaway user. Cleans up every created record.
+ */
+var RAND = function () { return Math.random().toString(36).slice(2, 10); };
+var startlinktoken_escalation_tests = function (_a) {
+    var sdk = _a.sdk;
+    return __awaiter(void 0, void 0, void 0, function () {
+        var businessId, userIds, enduserIds, eventIds, roleIds, checks, record, host_user, patient, event_1, patientSDK, attackerToken, wrote, writeErr, err_1, adminView, redeemed, _b, staffToken, staffWriteErr, e_1, legit, e_2, enduserRead, _c, rbap, nonAdmin, authToken, nonAdminSDK, staffRead, _d, _i, checks_1, c, _e, checks_2, c, _f, eventIds_1, id, _g, _h, enduserIds_1, id, _j, _k, userIds_1, id, _l, _m, roleIds_1, id, _o;
+        var _p, _q, _r, _s, _t;
+        return __generator(this, function (_u) {
+            switch (_u.label) {
+                case 0:
+                    (0, testing_1.log_header)("F-0185: startLinkToken enduser-writable / readable → staff session escalation");
+                    businessId = sdk.userInfo.businessId;
+                    userIds = [];
+                    enduserIds = [];
+                    eventIds = [];
+                    roleIds = [];
+                    checks = [];
+                    record = function (label, pass, detail) { return checks.push({ label: label, pass: pass, detail: detail }); };
+                    _u.label = 1;
+                case 1:
+                    _u.trys.push([1, , 38, 63]);
+                    return [4 /*yield*/, sdk.api.users.createOne({
+                            email: "f0185-host-".concat(RAND(), "@tellescope.example"), fname: 'F0185', lname: 'Host',
+                            verifiedEmail: true, notificationEmailsDisabled: true,
+                        })];
+                case 2:
+                    host_user = _u.sent();
+                    userIds.push(host_user.id);
+                    return [4 /*yield*/, sdk.api.endusers.createOne({
+                            email: "f0185-patient-".concat(RAND(), "@tellescope.example"), fname: 'F0185', lname: 'Patient',
+                        })];
+                case 3:
+                    patient = _u.sent();
+                    enduserIds.push(patient.id);
+                    return [4 /*yield*/, sdk.api.calendar_events.createOne({
+                            title: 'F-0185 appointment', durationInMinutes: 30, startTimeInMS: Date.now() + 3600000,
+                            attendees: [{ type: 'user', id: host_user.id }, { type: 'enduser', id: patient.id }],
+                        })];
+                case 4:
+                    event_1 = _u.sent();
+                    eventIds.push(event_1.id);
+                    patientSDK = new sdk_1.EnduserSession({ host: host, businessId: businessId });
+                    return [4 /*yield*/, (0, setup_1.authenticate_enduser_via_token)(sdk, patientSDK, { id: patient.id })
+                        // ---- A1: WRITE gate — enduser attendee cannot PATCH startLinkToken ----
+                    ];
+                case 5:
+                    _u.sent();
+                    attackerToken = "f0185-attacker-".concat(RAND()).concat(RAND());
+                    wrote = false, writeErr = '';
+                    _u.label = 6;
+                case 6:
+                    _u.trys.push([6, 8, , 9]);
+                    return [4 /*yield*/, patientSDK.api.calendar_events.updateOne(event_1.id, { startLinkToken: attackerToken })];
+                case 7:
+                    _u.sent();
+                    wrote = true;
+                    return [3 /*break*/, 9];
+                case 8:
+                    err_1 = _u.sent();
+                    writeErr = (_p = err_1 === null || err_1 === void 0 ? void 0 : err_1.message) !== null && _p !== void 0 ? _p : String(err_1);
+                    return [3 /*break*/, 9];
+                case 9:
+                    record('A1: enduser cannot write startLinkToken', !wrote, wrote ? 'PATCH ACCEPTED — patient set a staff start-link token' : "rejected (".concat(writeErr, ")"));
+                    return [4 /*yield*/, sdk.api.calendar_events.getOne(event_1.id)];
+                case 10:
+                    adminView = _u.sent();
+                    if (!(adminView.startLinkToken === attackerToken)) return [3 /*break*/, 15];
+                    redeemed = null;
+                    _u.label = 11;
+                case 11:
+                    _u.trys.push([11, 13, , 14]);
+                    return [4 /*yield*/, new sdk_1.Session({ host: host }).api.calendar_events.session_for_start_link({ token: attackerToken })];
+                case 12:
+                    redeemed = _u.sent();
+                    return [3 /*break*/, 14];
+                case 13:
+                    _b = _u.sent();
+                    return [3 /*break*/, 14];
+                case 14:
+                    record('A3: enduser-set token does not mint a staff session', !(redeemed === null || redeemed === void 0 ? void 0 : redeemed.authToken), (redeemed === null || redeemed === void 0 ? void 0 : redeemed.authToken) ? "minted a STAFF authToken for host ".concat(host_user.id) : 'not redeemable');
+                    return [3 /*break*/, 16];
+                case 15:
+                    record('A3: enduser-set token does not mint a staff session', true, '(n/a — write blocked, value never landed)');
+                    _u.label = 16;
+                case 16:
+                    staffToken = "f0185-staff-".concat(RAND()).concat(RAND());
+                    staffWriteErr = '';
+                    _u.label = 17;
+                case 17:
+                    _u.trys.push([17, 19, , 20]);
+                    return [4 /*yield*/, sdk.api.calendar_events.updateOne(event_1.id, { startLinkToken: staffToken })];
+                case 18:
+                    _u.sent();
+                    return [3 /*break*/, 20];
+                case 19:
+                    e_1 = _u.sent();
+                    staffWriteErr = (_q = e_1 === null || e_1 === void 0 ? void 0 : e_1.message) !== null && _q !== void 0 ? _q : String(e_1);
+                    return [3 /*break*/, 20];
+                case 20:
+                    legit = null;
+                    _u.label = 21;
+                case 21:
+                    _u.trys.push([21, 23, , 24]);
+                    return [4 /*yield*/, new sdk_1.Session({ host: host }).api.calendar_events.session_for_start_link({ token: staffToken })];
+                case 22:
+                    legit = _u.sent();
+                    return [3 /*break*/, 24];
+                case 23:
+                    e_2 = _u.sent();
+                    legit = { error: (_r = e_2 === null || e_2 === void 0 ? void 0 : e_2.message) !== null && _r !== void 0 ? _r : String(e_2) };
+                    return [3 /*break*/, 24];
+                case 24:
+                    record('A2: staff-set start link still works', !!(legit === null || legit === void 0 ? void 0 : legit.authToken) && legit.eventId === event_1.id, "staffWrite=".concat(staffWriteErr ? 'REJECTED(' + staffWriteErr + ')' : 'ok', " authToken=").concat(!!(legit === null || legit === void 0 ? void 0 : legit.authToken), " eventId=").concat(legit === null || legit === void 0 ? void 0 : legit.eventId, " ").concat((legit === null || legit === void 0 ? void 0 : legit.error) ? '(' + legit.error + ')' : ''));
+                    enduserRead = null;
+                    _u.label = 25;
+                case 25:
+                    _u.trys.push([25, 27, , 28]);
+                    return [4 /*yield*/, patientSDK.api.calendar_events.getOne(event_1.id)];
+                case 26:
+                    enduserRead = _u.sent();
+                    return [3 /*break*/, 28];
+                case 27:
+                    _c = _u.sent();
+                    return [3 /*break*/, 28];
+                case 28:
+                    record('A4: startLinkToken redacted from enduser reads', !enduserRead || enduserRead.startLinkToken === undefined, "enduser read startLinkToken=".concat((_s = enduserRead === null || enduserRead === void 0 ? void 0 : enduserRead.startLinkToken) !== null && _s !== void 0 ? _s : '(absent)', " \u2014 could redeem a staff-set token"));
+                    return [4 /*yield*/, sdk.api.role_based_access_permissions.createOne({
+                            role: "F0185NonAdmin-".concat(RAND()),
+                            // Non-admin (non-Admin-role) staff with tenant-wide calendar READ — enough to load the event,
+                            // so the assertion isolates redaction (not access). Spread a valid full permissions shape.
+                            permissions: __assign(__assign({}, constants_1.PROVIDER_PERMISSIONS), { calendar_events: __assign(__assign({}, constants_1.PROVIDER_PERMISSIONS.calendar_events), { read: 'All', readMany: 'All' }) }),
+                        }).catch(function (e) { var _a; console.warn('A5 role create failed:', (_a = e === null || e === void 0 ? void 0 : e.message) !== null && _a !== void 0 ? _a : e); return null; })];
+                case 29:
+                    rbap = _u.sent();
+                    if (!rbap) return [3 /*break*/, 36];
+                    roleIds.push(rbap.id);
+                    return [4 /*yield*/, sdk.api.users.createOne({
+                            email: "f0185-nonadmin-".concat(RAND(), "@tellescope.example"), fname: 'F0185', lname: 'NonAdmin',
+                            verifiedEmail: true, notificationEmailsDisabled: true, roles: [rbap.role],
+                        })];
+                case 30:
+                    nonAdmin = _u.sent();
+                    userIds.push(nonAdmin.id);
+                    return [4 /*yield*/, sdk.api.users.generate_auth_token({ id: nonAdmin.id })];
+                case 31:
+                    authToken = (_u.sent()).authToken;
+                    nonAdminSDK = new sdk_1.Session({ host: host, authToken: authToken });
+                    staffRead = null;
+                    _u.label = 32;
+                case 32:
+                    _u.trys.push([32, 34, , 35]);
+                    return [4 /*yield*/, nonAdminSDK.api.calendar_events.getOne(event_1.id)];
+                case 33:
+                    staffRead = _u.sent();
+                    return [3 /*break*/, 35];
+                case 34:
+                    _d = _u.sent();
+                    return [3 /*break*/, 35];
+                case 35:
+                    record('A5: startLinkToken redacted from non-admin user reads', !staffRead || staffRead.startLinkToken === undefined, "non-admin user read startLinkToken=".concat((_t = staffRead === null || staffRead === void 0 ? void 0 : staffRead.startLinkToken) !== null && _t !== void 0 ? _t : '(absent)', " \u2014 staff\u2192host escalation via read"));
+                    return [3 /*break*/, 37];
+                case 36:
+                    record('A5: startLinkToken redacted from non-admin user reads', true, '(n/a — could not create a non-admin role in this env)');
+                    _u.label = 37;
+                case 37:
+                    // Report the full table before asserting (the harness exits on the first failed assert).
+                    console.log('\n  F-0185 check summary:');
+                    for (_i = 0, checks_1 = checks; _i < checks_1.length; _i++) {
+                        c = checks_1[_i];
+                        console.log("    ".concat(c.pass ? 'PASS' : 'FAIL', "  ").concat(c.label, "  \u2014  ").concat(c.detail));
+                    }
+                    console.log('');
+                    for (_e = 0, checks_2 = checks; _e < checks_2.length; _e++) {
+                        c = checks_2[_e];
+                        (0, testing_1.assert)(c.pass, "".concat(c.label, " \u2014 ").concat(c.detail), c.label);
+                    }
+                    return [3 /*break*/, 63];
+                case 38:
+                    _f = 0, eventIds_1 = eventIds;
+                    _u.label = 39;
+                case 39:
+                    if (!(_f < eventIds_1.length)) return [3 /*break*/, 44];
+                    id = eventIds_1[_f];
+                    _u.label = 40;
+                case 40:
+                    _u.trys.push([40, 42, , 43]);
+                    return [4 /*yield*/, sdk.api.calendar_events.deleteOne(id)];
+                case 41:
+                    _u.sent();
+                    return [3 /*break*/, 43];
+                case 42:
+                    _g = _u.sent();
+                    return [3 /*break*/, 43];
+                case 43:
+                    _f++;
+                    return [3 /*break*/, 39];
+                case 44:
+                    _h = 0, enduserIds_1 = enduserIds;
+                    _u.label = 45;
+                case 45:
+                    if (!(_h < enduserIds_1.length)) return [3 /*break*/, 50];
+                    id = enduserIds_1[_h];
+                    _u.label = 46;
+                case 46:
+                    _u.trys.push([46, 48, , 49]);
+                    return [4 /*yield*/, sdk.api.endusers.deleteOne(id)];
+                case 47:
+                    _u.sent();
+                    return [3 /*break*/, 49];
+                case 48:
+                    _j = _u.sent();
+                    return [3 /*break*/, 49];
+                case 49:
+                    _h++;
+                    return [3 /*break*/, 45];
+                case 50:
+                    _k = 0, userIds_1 = userIds;
+                    _u.label = 51;
+                case 51:
+                    if (!(_k < userIds_1.length)) return [3 /*break*/, 56];
+                    id = userIds_1[_k];
+                    _u.label = 52;
+                case 52:
+                    _u.trys.push([52, 54, , 55]);
+                    return [4 /*yield*/, sdk.api.users.deleteOne(id)];
+                case 53:
+                    _u.sent();
+                    return [3 /*break*/, 55];
+                case 54:
+                    _l = _u.sent();
+                    return [3 /*break*/, 55];
+                case 55:
+                    _k++;
+                    return [3 /*break*/, 51];
+                case 56:
+                    _m = 0, roleIds_1 = roleIds;
+                    _u.label = 57;
+                case 57:
+                    if (!(_m < roleIds_1.length)) return [3 /*break*/, 62];
+                    id = roleIds_1[_m];
+                    _u.label = 58;
+                case 58:
+                    _u.trys.push([58, 60, , 61]);
+                    return [4 /*yield*/, sdk.api.role_based_access_permissions.deleteOne(id)];
+                case 59:
+                    _u.sent();
+                    return [3 /*break*/, 61];
+                case 60:
+                    _o = _u.sent();
+                    return [3 /*break*/, 61];
+                case 61:
+                    _m++;
+                    return [3 /*break*/, 57];
+                case 62: return [7 /*endfinally*/];
+                case 63: return [2 /*return*/];
+            }
+        });
+    });
+};
+exports.startlinktoken_escalation_tests = startlinktoken_escalation_tests;
+if (require.main === module) {
+    var sdk_2 = new sdk_1.Session({ host: host });
+    var sdkNonAdmin_1 = new sdk_1.Session({ host: host });
+    (0, setup_1.setup_tests)(sdk_2, sdkNonAdmin_1)
+        .then(function () { return (0, exports.startlinktoken_escalation_tests)({ sdk: sdk_2, sdkNonAdmin: sdkNonAdmin_1 }); })
+        .then(function () { console.log("✅ F-0185 startLinkToken escalation test suite completed successfully"); process.exit(0); })
+        .catch(function (error) { console.error("❌ F-0185 startLinkToken escalation test suite failed:", error); process.exit(1); });
+}
+//# sourceMappingURL=F-0185-startlinktoken-enduser-staff-escalation.test.js.map

package/lib/cjs/tests/api_tests/security/F-0185-startlinktoken-enduser-staff-escalation.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"F-0185-startlinktoken-enduser-staff-escalation.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/F-0185-startlinktoken-enduser-staff-escalation.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,oCAAsD;AACtD,+CAAwD;AACxD,qCAAyE;AACzE,mDAA4D;AAE5D,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,IAAM,IAAI,GAAG,cAAM,OAAA,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAvC,CAAuC,CAAA;AAEnD,IAAM,+BAA+B,GAAG,UAAO,EAAgD;QAA9C,GAAG,SAAA;;;;;;;oBACzD,IAAA,oBAAU,EAAC,+EAA+E,CAAC,CAAA;oBAErF,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAA;oBACpC,OAAO,GAAa,EAAE,CAAA;oBACtB,UAAU,GAAa,EAAE,CAAA;oBACzB,QAAQ,GAAa,EAAE,CAAA;oBACvB,OAAO,GAAa,EAAE,CAAA;oBAEtB,MAAM,GAAuD,EAAE,CAAA;oBAC/D,MAAM,GAAG,UAAC,KAAa,EAAE,IAAa,EAAE,MAAc,IAAK,OAAA,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,OAAA,EAAE,IAAI,MAAA,EAAE,MAAM,QAAA,EAAE,CAAC,EAApC,CAAoC,CAAA;;;;oBAIjF,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;4BAC9C,KAAK,EAAE,qBAAc,IAAI,EAAE,wBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM;4BAC/E,aAAa,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI;yBAC/C,CAAC,EAAA;;oBAHH,SAAS,GAAG,SAGT;oBACT,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;oBAGV,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;4BAC/C,KAAK,EAAE,wBAAiB,IAAI,EAAE,wBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;yBACtF,CAAC,EAAA;;oBAFI,OAAO,GAAG,SAEd;oBACF,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;oBAEb,qBAAM,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC;4BACpD,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAQ;4BACxF,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;yBAC9E,CAAC,EAAA;;oBAHH,UAAQ,SAGL;oBACT,QAAQ,CAAC,IAAI,CAAC,OAAK,CAAC,EAAE,CAAC,CAAA;oBAEjB,UAAU,GAAG,IAAI,oBAAc,CAAC,EAAE,IAAI,MAAA,EAAE,UAAU,YAAA,EAAE,CAAC,CAAA;oBAC3D,qBAAM,IAAA,sCAA8B,EAAC,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;wBAEzE,0EAA0E;sBAFD;;oBAAzE,SAAyE,CAAA;oBAGnE,aAAa,GAAG,yBAAkB,IAAI,EAAE,SAAG,IAAI,EAAE,CAAE,CAAA;oBACrD,KAAK,GAAG,KAAK,EAAE,QAAQ,GAAG,EAAE,CAAA;;;;oBAE9B,qBAAM,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC,OAAK,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,aAAa,EAAS,CAAC,EAAA;;oBAAlG,SAAkG,CAAA;oBAClG,KAAK,GAAG,IAAI,CAAA;;;;oBACO,QAAQ,GAAG,MAAA,KAAG,aAAH,KAAG,uBAAH,KAAG,CAAE,OAAO,mCAAI,MAAM,CAAC,KAAG,CAAC,CAAA;;;oBAC3D,MAAM,CAAC,yCAAyC,EAAE,CAAC,KAAK,EACtD,KAAK,CAAC,CAAC,CAAC,uDAAuD,CAAC,CAAC,CAAC,oBAAa,QAAQ,MAAG,CAAC,CAAA;oBAI3E,qBAAM,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,OAAK,CAAC,EAAE,CAAC,EAAA;;oBAA1D,SAAS,GAAG,SAA8C;yBAC5D,CAAC,SAAiB,CAAC,cAAc,KAAK,aAAa,CAAA,EAAnD,yBAAmD;oBACjD,QAAQ,GAAQ,IAAI,CAAA;;;;oBACP,qBAAM,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,sBAAsB,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,EAAA;;oBAA3G,QAAQ,GAAG,SAAgG,CAAA;;;;;;oBACjH,MAAM,CAAC,qDAAqD,EAAE,CAAC,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,SAAS,CAAA,EAChF,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,SAAS,EAAC,CAAC,CAAC,4CAAqC,SAAS,CAAC,EAAE,CAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAA;;;oBAE/F,MAAM,CAAC,qDAAqD,EAAE,IAAI,EAAE,2CAA2C,CAAC,CAAA;;;oBAI5G,UAAU,GAAG,sBAAe,IAAI,EAAE,SAAG,IAAI,EAAE,CAAE,CAAA;oBAC/C,aAAa,GAAG,EAAE,CAAA;;;;oBAChB,qBAAM,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC,OAAK,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,UAAU,EAAS,CAAC,EAAA;;oBAAxF,SAAwF,CAAA;;;;oBAC7E,aAAa,GAAG,MAAA,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,OAAO,mCAAI,MAAM,CAAC,GAAC,CAAC,CAAA;;;oBACpD,KAAK,GAAQ,IAAI,CAAA;;;;oBACP,qBAAM,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,sBAAsB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAA;;oBAArG,KAAK,GAAG,SAA6F,CAAA;;;;oBAC1F,KAAK,GAAG,EAAE,KAAK,EAAE,MAAA,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,OAAO,mCAAI,MAAM,CAAC,GAAC,CAAC,EAAE,CAAA;;;oBAC3D,MAAM,CAAC,sCAAsC,EAAE,CAAC,CAAC,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,SAAS,CAAA,IAAI,KAAK,CAAC,OAAO,KAAK,OAAK,CAAC,EAAE,EAC7F,qBAAc,aAAa,CAAC,CAAC,CAAC,WAAW,GAAG,aAAa,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,wBAAc,CAAC,CAAC,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,SAAS,CAAA,sBAAY,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,OAAO,cAAI,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,KAAK,EAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAE,CAAC,CAAA;oBAGhL,WAAW,GAAQ,IAAI,CAAA;;;;oBACP,qBAAM,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,OAAK,CAAC,EAAE,CAAC,EAAA;;oBAAnE,WAAW,GAAG,SAAqD,CAAA;;;;;;oBACzE,MAAM,CAAC,gDAAgD,EACrD,CAAC,WAAW,IAAK,WAAmB,CAAC,cAAc,KAAK,SAAS,EACjE,sCAA+B,MAAC,WAAmB,aAAnB,WAAW,uBAAX,WAAW,CAAU,cAAc,mCAAI,UAAU,2CAAmC,CAAC,CAAA;oBAG1G,qBAAM,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,SAAS,CAAC;4BACjE,IAAI,EAAE,wBAAiB,IAAI,EAAE,CAAE;4BAC/B,8FAA8F;4BAC9F,2FAA2F;4BAC3F,WAAW,wBAAO,gCAAoB,KAAE,eAAe,wBAAQ,gCAA4B,CAAC,eAAe,KAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,MAAI;yBACvI,CAAC,CAAC,KAAK,CAAC,UAAC,CAAM,YAAO,OAAO,CAAC,IAAI,CAAC,wBAAwB,EAAE,MAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,mCAAI,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAA,CAAC,CAAC,CAAC,EAAA;;oBAL/F,IAAI,GAAG,SAKwF;yBACjG,IAAI,EAAJ,yBAAI;oBACN,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;oBACJ,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;4BAC7C,KAAK,EAAE,yBAAkB,IAAI,EAAE,wBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU;4BACvF,aAAa,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;yBACnE,CAAC,EAAA;;oBAHH,QAAQ,GAAG,SAGR;oBACT,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;oBACH,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,EAAA;;oBAA1E,SAAS,GAAK,CAAA,SAA4D,CAAA,UAAjE;oBACX,WAAW,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,SAAS,WAAA,EAAE,CAAC,CAAA;oBAChD,SAAS,GAAQ,IAAI,CAAA;;;;oBACP,qBAAM,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,OAAK,CAAC,EAAE,CAAC,EAAA;;oBAAlE,SAAS,GAAG,SAAsD,CAAA;;;;;;oBACxE,MAAM,CAAC,uDAAuD,EAC5D,CAAC,SAAS,IAAK,SAAiB,CAAC,cAAc,KAAK,SAAS,EAC7D,6CAAsC,MAAC,SAAiB,aAAjB,SAAS,uBAAT,SAAS,CAAU,cAAc,mCAAI,UAAU,gDAAmC,CAAC,CAAA;;;oBAE5H,MAAM,CAAC,uDAAuD,EAAE,IAAI,EAAE,uDAAuD,CAAC,CAAA;;;oBAGhI,yFAAyF;oBACzF,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAA;oBACxC,WAAsB,EAAN,iBAAM,EAAN,oBAAM,EAAN,IAAM;wBAAX,CAAC;wBAAY,OAAO,CAAC,GAAG,CAAC,cAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,eAAK,CAAC,CAAC,KAAK,uBAAQ,CAAC,CAAC,MAAM,CAAE,CAAC,CAAA;qBAAA;oBAClG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;oBACf,WAAsB,EAAN,iBAAM,EAAN,oBAAM,EAAN,IAAM;wBAAX,CAAC;wBAAY,IAAA,gBAAM,EAAC,CAAC,CAAC,IAAI,EAAE,UAAG,CAAC,CAAC,KAAK,qBAAM,CAAC,CAAC,MAAM,CAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAA;qBAAA;;;0BAElD,EAAR,qBAAQ;;;yBAAR,CAAA,sBAAQ,CAAA;oBAAd,EAAE;;;;oBAAsB,qBAAM,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC,EAAA;;oBAA3C,SAA2C,CAAA;;;;;;oBAA7D,IAAQ,CAAA;;;0BACE,EAAV,yBAAU;;;yBAAV,CAAA,wBAAU,CAAA;oBAAhB,EAAE;;;;oBAAwB,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,EAAA;;oBAApC,SAAoC,CAAA;;;;;;oBAAxD,IAAU,CAAA;;;0BACH,EAAP,mBAAO;;;yBAAP,CAAA,qBAAO,CAAA;oBAAb,EAAE;;;;oBAAqB,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,EAAA;;oBAAjC,SAAiC,CAAA;;;;;;oBAAlD,IAAO,CAAA;;;0BACA,EAAP,mBAAO;;;yBAAP,CAAA,qBAAO,CAAA;oBAAb,EAAE;;;;oBAAqB,qBAAM,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,SAAS,CAAC,EAAE,CAAC,EAAA;;oBAAzD,SAAyD,CAAA;;;;;;oBAA1E,IAAO,CAAA;;;;;;;CAE3B,CAAA;AA/GY,QAAA,+BAA+B,mCA+G3C;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,IAAM,KAAG,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACjC,IAAM,aAAW,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACzC,IAAA,mBAAW,EAAC,KAAG,EAAE,aAAW,CAAC;SAC1B,IAAI,CAAC,cAAM,OAAA,IAAA,uCAA+B,EAAC,EAAE,GAAG,OAAA,EAAE,WAAW,eAAA,EAAE,CAAC,EAArD,CAAqD,CAAC;SACjE,IAAI,CAAC,cAAQ,OAAO,CAAC,GAAG,CAAC,sEAAsE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC;SACpH,KAAK,CAAC,UAAC,KAAK,IAAO,OAAO,CAAC,KAAK,CAAC,uDAAuD,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;CACxH"}

package/lib/cjs/tests/api_tests/security/F-0191-schema-adminonly-enforcement.test.d.ts

@@ -0,0 +1,46 @@
+import { Session } from "../../../sdk";
+/**
+ * Regression test for F-0191
+ * (security-audit/findings/F-0191-schema-adminonly-not-enforced.md).
+ *
+ * `adminOnly: true` on a CUSTOM action in schema.ts was documentation-only. The runtime gate
+ * (routing.ts:944) reads the flag off the options object built by getCustomEndpointFields, and
+ * api.ts:609 set `adminOnly: o.adminOnly` without ever consulting `action.adminOnly`. So every
+ * admin-only custom action had to declare the flag twice, and the copies desynced: 11 of 20
+ * declared custom actions were unenforced at runtime while both public doc artifacts
+ * (openapi.json and the unauthenticated GET /documentation feed, which read the SCHEMA flag)
+ * advertised "**Admin only.**".
+ *
+ * DEFAULT CRUD actions never had this bug — routing.ts:2434 etc. read
+ * model.defaultActions.<op>.adminOnly straight off the schema. The fix
+ * (`adminOnly: o.adminOnly ?? action.adminOnly`) makes custom actions behave the same way.
+ *
+ * Five of the 11 were de-flagged in the schema instead, because the flag itself was wrong and
+ * enforcing it would revert a deliberate decision: users.invite_user carries an explicit
+ * "no longer admin only, but controlled by users.create" and send_invitation_to_existing is its
+ * sibling; organizations.create_and_join is the self-service signup path and would 401 every new
+ * org (a fresh user has no roles — the handler is what grants Admin); sync_note_to_canvas is
+ * designed around `access: 'read'` for non-admin callers; background_errors.mark_read substitutes
+ * its own RBAC check that intentionally admits non-admins holding the verb.
+ *
+ * SAFETY: every probe fails EARLY inside its handler — after the adminOnly gate but before any
+ * vendor call. Pre-fix these requests really do reach the handler, and these handlers talk to
+ * Twilio, Athena and Canvas:
+ *   - trigger_events     : no `action` key + an absent triggerId => the loop `continue`s (inert)
+ *   - athena-subscription: frequency 1 trips the `frequency < 5` guard on the handler's first line
+ *   - sync-athena        : 404s on the missing Athena integration (skipped if one exists)
+ *   - link-twilio        : takes NO parameters and can CREATE A REAL TWILIO SUBACCOUNT, so it is
+ *                          probed only when the org already has a twilioSID (handler short-circuits)
+ *   - twilio-embed       : no phoneNumberSid => 404 no-config or 400, both before any Twilio call
+ *   - handle-autoreply   : absent enduserId => `if (!enduser) return` (communications.ts:42)
+ * Input validation runs BEFORE the adminOnly gate (routing.ts:921 orders access, then validate),
+ * so every probe body must be schema-VALID or the test would prove nothing.
+ *
+ * RED (pre-fix): the six group-B rows fail — each reaches its handler and returns a non-401.
+ * GREEN (post-fix): all six return 401 "Admin access only"; the group-A controls are unchanged.
+ */
+export declare const schema_adminonly_enforcement_tests: ({ sdk }: {
+    sdk: Session;
+    sdkNonAdmin: Session;
+}) => Promise<void>;
+//# sourceMappingURL=F-0191-schema-adminonly-enforcement.test.d.ts.map

package/lib/cjs/tests/api_tests/security/F-0191-schema-adminonly-enforcement.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"F-0191-schema-adminonly-enforcement.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/F-0191-schema-adminonly-enforcement.test.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAqBtC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,eAAO,MAAM,kCAAkC;SAA2B,OAAO;iBAAe,OAAO;mBAwMtG,CAAA"}