@tellescope/sdk 1.256.13 → 1.256.15

package/src/tests/api_tests/security/automated-actions-process-gate.test.ts

@@ -0,0 +1,237 @@
+require('source-map-support').install();
+
+import axios from "axios"
+
+import { Session } from "../../../sdk"
+import {
+  assert,
+  log_header,
+} from "@tellescope/testing"
+import { PROVIDER_PERMISSIONS, PLACEHOLDER_ID } from "@tellescope/constants"
+import { setup_tests } from "../../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
+const ALL = 'All' as const
+const FULL_ACCESS = { create: ALL, read: ALL, update: ALL, delete: ALL }
+
+const PROCESS_PATH = '/v1/automated-actions/process'
+
+// A single collected check. Everything is gathered first and asserted at the end, because the
+// testing harness exits the process on the first failed assert — collecting first means a RED run
+// prints the full evidence table (and reaches `finally` cleanup) before the first assert exits.
+type Check = {
+  label: string,
+  pass: boolean,
+  detail: string,
+}
+
+/**
+ * Regression test: `automated_actions.process` must be admin-gated, single-fire and audited.
+ *
+ * `automated_actions.process` (api.ts:3902) is the WORKER's action runner — its schema description
+ * reads "Used by worker for new action types". It was registered with only
+ * `{ requiresSubscription: true }`, so the framework gated it on the ordinary
+ * `automated_actions.update` verb, which the default provider role holds ('Assigned'). The handler
+ * then dispatched `automatedAction.action` through a 14-branch if-chain reaching real vendors:
+ * chargebeeChargeCardOnFile (card charge), belugaAutoRx / belugaTriggerRefill / mdiTriggerRefill
+ * (prescriptions and refills), createScriptSureDraft (medication draft), healthiePushForms /
+ * metriportPushFormResponse (PHI export). It checked neither the row's `status` nor whether it had
+ * already run, so any row was replayable: MDI advances to the next scheduled refill each call,
+ * Chargebee charges again. And there was no storeUserLog, so the action was attributed to the
+ * worker rather than the caller.
+ *
+ * The fix has three parts:
+ *   1. `adminOnly: true` on the api.ts registration (routing.ts:944 reads the flag from that
+ *      options object — a schema-only flag is inert, which is a separate issue).
+ *   2. A single-fire claim for human callers: an atomic findOneAndUpdate with `status: 'active'` in
+ *      the filter, stamping `finished` + `processedAt` before the vendor dispatch. The worker
+ *      (`wasAutomated`) is exempt because its own claim in
+ *      worker/modules/database.ts:114 is already atomic and it needs the row to stay 'active'
+ *      across the call so a retryable failure (worker/modules/automations.ts:2053) can be
+ *      re-claimed after the lock times out.
+ *   3. storeUserLog on the human path, recording the caller and the automatedActionId.
+ *
+ * The seeded row uses `setEnduserStatus`, which is NOT one of the API's if-chain branches, so it
+ * falls through to `{ success: false, unimplemented: true }` (api.ts) — no vendor call, no Bedrock,
+ * no PHI export. `processAfter` is set an hour out so the live worker cannot race the row (the same
+ * trick mdi_trigger_refill / beluga_trigger_refill use).
+ *
+ * RED (pre-fix): A1 fails (a non-admin holding only `automated_actions.update` reaches the handler)
+ * and C1 fails (the second call on the same row executes again instead of being rejected).
+ * B1 (admin positive control) passes pre-fix and must keep passing.
+ * GREEN (post-fix): all five checks pass.
+ */
+export const automated_actions_process_gate_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("automated_actions.process must be admin-only and single-fire")
+
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  // Raw axios: the SDK's parseError discards the HTTP status, and the whole point here is WHICH
+  // status the gate returns.
+  const post = async (authToken: string, automatedActionId: string) => {
+    const r = await axios.request({
+      method: 'post',
+      url: `${host}${PROCESS_PATH}`,
+      data: { automatedActionId },
+      headers: { Authorization: `Bearer ${authToken}` },
+      validateStatus: () => true,
+    })
+    return { status: r.status, body: r.data }
+  }
+
+  let roleId = ''
+  let attackerId = ''
+  let enduserId = ''
+  const automatedActionIds: string[] = []
+
+  try {
+    /* ================= fixtures ================= */
+
+    // A non-admin role that explicitly HOLDS automated_actions update — the point of the finding is
+    // that holding the declared verb was enough to fire vendor actions.
+    const role = `f0192-automations-${RAND()}`
+    const rbap = await sdk.api.role_based_access_permissions.createOne({
+      role,
+      permissions: { ...PROVIDER_PERMISSIONS, automated_actions: FULL_ACCESS },
+    } as any)
+    roleId = rbap.id
+
+    // Throwaway staff user — never mutate an existing user's roles. verifiedEmail must be set at
+    // create time (it is rejected on update), otherwise calls are blocked on email verification
+    // rather than on the gate under test.
+    const attacker = await sdk.api.users.createOne({
+      email: `f0192-attacker-${RAND()}@tellescope.example`,
+      fname: 'F0192', lname: 'Staff',
+      verifiedEmail: true,
+      notificationEmailsDisabled: true,
+      roles: [role],
+    } as any)
+    attackerId = attacker.id
+
+    // Admin-minted token, not .authenticate — /login is IP rate-limited and the suite shares an IP.
+    const attackerToken = (await sdk.api.users.generate_auth_token({ id: attackerId })).authToken
+    const adminToken = (await sdk.api.users.generate_auth_token({ id: sdk.userInfo.id })).authToken
+
+    const attackerSDK = new Session({ host, authToken: attackerToken })
+    await attackerSDK.refresh_session()
+    record(
+      'setup: attacker session is a non-admin holding automated_actions.update',
+      attackerSDK.userInfo.id === attackerId && !(attackerSDK.userInfo.roles ?? []).includes('Admin'),
+      `id=${attackerSDK.userInfo.id} roles=${JSON.stringify(attackerSDK.userInfo.roles)}`,
+    )
+
+    const enduser = await sdk.api.endusers.createOne({ fname: 'F0192', lname: 'Patient' })
+    enduserId = enduser.id
+
+    // `setEnduserStatus` is handled by the worker, NOT by the API's process if-chain, so it falls
+    // through to `unimplemented: true`. processAfter is an hour out so the live worker cannot claim
+    // the row before the explicit calls below.
+    const seedAction = async () => {
+      const a = await sdk.api.automated_actions.createOne({
+        enduserId,
+        journeyId: PLACEHOLDER_ID,
+        automationStepId: PLACEHOLDER_ID,
+        event: { type: 'onJourneyStart', info: {} },
+        action: { type: 'setEnduserStatus', info: { status: 'Working' } },
+        status: 'active',
+        processAfter: Date.now() + 60 * 60 * 1000,
+      } as any)
+      automatedActionIds.push(a.id)
+      return a
+    }
+
+    /* ===== A: the privilege gap — a non-admin with the declared verb must be rejected ===== */
+
+    const attackerRow = await seedAction()
+    const attackerAttempt = await post(attackerToken, attackerRow.id)
+
+    // Baseline on the same path with an admin token, so a blanket 401 (expired subscription,
+    // bad route, broken fixture) cannot masquerade as a working gate.
+    const baselineRow = await seedAction()
+    const baseline = await post(adminToken, baselineRow.id)
+    const badProbe = baseline.status === 401 || baseline.status === 403
+
+    record(
+      'A1: a non-admin holding automated_actions.update cannot call process',
+      !badProbe && (attackerAttempt.status === 401 || attackerAttempt.status === 403),
+      `attacker=${attackerAttempt.status} ${JSON.stringify(attackerAttempt.body)} baseline(admin)=${baseline.status}`
+        + (badProbe ? ' BAD PROBE: admin baseline was also rejected' : ''),
+    )
+
+    // The attacker's row must be untouched — the gate has to fire before the claim and the dispatch.
+    const attackerRowAfter = await sdk.api.automated_actions.getOne(attackerRow.id)
+    record(
+      'A2: a rejected non-admin call leaves the row unfired (status still active)',
+      attackerRowAfter.status === 'active',
+      `status=${attackerRowAfter.status} (expected active)`,
+    )
+
+    /* ===== B: positive control — an admin can still call it ===== */
+
+    record(
+      'B1: an admin can still process a pending row',
+      baseline.status === 200 && baseline.body?.unimplemented === true,
+      `status=${baseline.status} body=${JSON.stringify(baseline.body)}`,
+    )
+
+    /* ===== C: the replay gate — the same row must not fire twice ===== */
+
+    const replay = await post(adminToken, baselineRow.id)
+    record(
+      'C1: processing the same row twice is rejected (no replay)',
+      replay.status === 409,
+      `second call status=${replay.status} body=${JSON.stringify(replay.body)} (expected 409)`,
+    )
+
+    const baselineRowAfter = await sdk.api.automated_actions.getOne(baselineRow.id)
+    record(
+      'C2: a processed row is marked finished so neither a replay nor the worker re-runs it',
+      baselineRowAfter.status === 'finished',
+      `status=${baselineRowAfter.status} (expected finished)`,
+    )
+
+    /* ===== report: print full table first, then assert (harness exits on first failure) ===== */
+    console.log('\n  check summary:')
+    for (const c of checks) {
+      console.log(`    ${c.pass ? 'PASS' : 'FAIL'}  ${c.label}  —  ${c.detail}`)
+    }
+    console.log('')
+
+    for (const c of checks) {
+      assert(c.pass, `${c.label} — ${c.detail}`, c.label)
+    }
+  } finally {
+    // Reverse order. The automated_actions go first: they hang off enduserId with
+    // onDependencyDelete 'delete', so deleting the enduser would take them with it.
+    for (const id of automatedActionIds) { try { await sdk.api.automated_actions.deleteOne(id) } catch {} }
+    if (enduserId) { try { await sdk.api.endusers.deleteOne(enduserId) } catch {} }
+    if (attackerId) { try { await sdk.api.users.deleteOne(attackerId) } catch {} }
+    if (roleId) { try { await sdk.api.role_based_access_permissions.deleteOne(roleId) } catch {} }
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await automated_actions_process_gate_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ automated_actions.process gate test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ automated_actions.process gate test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/security/booking-info-idor-token-mint.test.ts

@@ -0,0 +1,224 @@
+require('source-map-support').install();
+
+import { Session, EnduserSession } from "../../../sdk"
+import {
+  assert,
+  log_header,
+} from "@tellescope/testing"
+import { authenticate_enduser_via_token, setup_tests } from "../../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+const businessId = '60398b1131a295e64f084ff6'
+
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
+const VICTIM_STATE = 'CA'
+const ATTACKER_STATE_WRITE = 'NY'
+
+type Check = {
+  label: string,
+  pass: boolean,
+  detail: string,
+}
+
+/**
+ * Regression test: `form_fields.booking_info` must not mint a booking token for another patient.
+ *
+ * `form_fields.booking_info` resolved its target patient as
+ * `DB.endusers.findById(enduserId || req.session.id)` with no ownership check for enduser
+ * sessions. The enduser DB branch builds the endusers collection with `enduserAccess: true`
+ * (database.ts), so a FOREIGN in-tenant id resolves — and the handler then writes
+ * `enduserFields.state` onto that record and calls `login_enduser` with
+ * `sessionScopes: ['appointment-booking']`, returning a live 24h token for the victim inside
+ * `bookingURL`. booking_info is enduser-callable AND granted to the 'public-form' scope, so a
+ * portal patient or an anonymous form-filler could mint a working session as any co-tenant patient.
+ *
+ * The fix mirrors `prepare_form_response` (api.ts): reject when an enduser session supplies an
+ * `enduserId` other than its own, before the booking-page lookup and before the `state` write.
+ *
+ * RED (pre-fix): A1 and A2 fail — the exploit returns 200 with a bookingURL whose token decodes to
+ * the VICTIM's id, and the victim's `state` is overwritten. B/C (positive controls) pass pre-fix.
+ * GREEN (post-fix): all six checks pass.
+ *
+ * Checks are collected and printed before any assert runs: the testing harness has
+ * EXIT_ON_FIRST_ERROR, so asserting inline would kill the process before the evidence table and
+ * before `finally` cleanup.
+ */
+export const booking_info_idor_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("booking_info must not mint an appointment-booking token for another enduser")
+
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  // The minted JWT carries `id: enduser._id.toString()` (authentication.ts login_enduser). Decode
+  // it straight out of the returned URL — the whole point of the finding is WHOSE session it is.
+  const token_enduser_id = (bookingURL: string) => {
+    const token = /[?&]token=([^&]+)/.exec(bookingURL || '')?.[1]
+    const payload = token?.split('.')[1]
+    if (!payload) return ''
+    try {
+      return JSON.parse(Buffer.from(payload, 'base64').toString()).id as string
+    } catch {
+      return ''
+    }
+  }
+
+  let templateId = ''
+  let bookingPageId = ''
+  const enduserIds: string[] = []
+
+  try {
+    /* ================= fixtures ================= */
+
+    const template = await sdk.api.calendar_event_templates.createOne({
+      title: `F0179 template ${RAND()}`, durationInMinutes: 30,
+    } as any)
+    templateId = template.id
+
+    const bookingPage = await sdk.api.appointment_booking_pages.createOne({
+      title: `F0179 booking page ${RAND()}`,
+      calendarEventTemplateIds: [templateId],
+      locationIds: [],
+    } as any)
+    bookingPageId = bookingPage.id
+
+    const attacker = await sdk.api.endusers.createOne({
+      email: `f0179-attacker-${RAND()}@tellescope.example`, fname: 'F0179', lname: 'Attacker',
+    })
+    enduserIds.push(attacker.id)
+
+    const victim = await sdk.api.endusers.createOne({
+      email: `f0179-victim-${RAND()}@tellescope.example`, fname: 'F0179', lname: 'Victim',
+      state: VICTIM_STATE,
+    })
+    enduserIds.push(victim.id)
+
+    // Token mint, NOT enduserSDK.authenticate — /login-enduser is IP rate-limited and the suite
+    // shares one IP.
+    const attackerSDK = new EnduserSession({ host, businessId })
+    await authenticate_enduser_via_token(sdk, attackerSDK, { id: attacker.id })
+
+    /* ===== A: the exploit — enduser mints a booking session as another patient ===== */
+
+    let a1Detail = ''
+    let a1Pass = false
+    try {
+      const r = await attackerSDK.api.form_fields.booking_info({ bookingPageId, enduserId: victim.id })
+      const mintedFor = token_enduser_id(r.bookingURL)
+      a1Detail = (
+        `EXPLOITED: 200 with a bookingURL; token subject=${mintedFor} `
+        + `(victim=${victim.id}, attacker=${attacker.id})`
+        + (mintedFor === victim.id ? ' — a live appointment-booking session AS THE VICTIM' : '')
+      )
+    } catch (e: any) {
+      a1Pass = true
+      a1Detail = `rejected: ${e?.message || e?.toString()}`
+    }
+    record('A1: enduser cannot mint a booking token for another enduser', a1Pass, a1Detail)
+
+    // A2: the same call also writes enduserFields.state onto the target before minting.
+    let a2Attempt = ''
+    try {
+      await attackerSDK.api.form_fields.booking_info({
+        bookingPageId, enduserId: victim.id, enduserFields: { state: ATTACKER_STATE_WRITE },
+      })
+      a2Attempt = 'call returned 200'
+    } catch (e: any) {
+      a2Attempt = `call rejected: ${e?.message || e?.toString()}`
+    }
+    const victimAfter = await sdk.api.endusers.getOne(victim.id)
+    record(
+      'A2: enduser cannot write `state` onto another enduser via enduserFields',
+      victimAfter.state === VICTIM_STATE,
+      `${a2Attempt}; victim.state=${victimAfter.state} (expected ${VICTIM_STATE})`,
+    )
+
+    /* ===== B: positive controls — the patient's own booking flow still works ===== */
+
+    let b1Detail = ''
+    let b1Pass = false
+    try {
+      const r = await attackerSDK.api.form_fields.booking_info({ bookingPageId })
+      const mintedFor = token_enduser_id(r.bookingURL)
+      b1Pass = mintedFor === attacker.id
+      b1Detail = `token subject=${mintedFor} (self=${attacker.id})`
+    } catch (e: any) {
+      b1Detail = `unexpectedly rejected: ${e?.message || e?.toString()}`
+    }
+    record('B1: enduser can still load booking info with no enduserId', b1Pass, b1Detail)
+
+    let b2Detail = ''
+    let b2Pass = false
+    try {
+      const r = await attackerSDK.api.form_fields.booking_info({ bookingPageId, enduserId: attacker.id })
+      const mintedFor = token_enduser_id(r.bookingURL)
+      b2Pass = mintedFor === attacker.id
+      b2Detail = `token subject=${mintedFor} (self=${attacker.id})`
+    } catch (e: any) {
+      b2Detail = `unexpectedly rejected: ${e?.message || e?.toString()}`
+    }
+    record('B2: enduser can still load booking info for its OWN enduserId', b2Pass, b2Detail)
+
+    /* ===== C: positive controls — the staff branches are untouched ===== */
+
+    let c1Detail = ''
+    let c1Pass = false
+    try {
+      const r = await sdk.api.form_fields.booking_info({ bookingPageId, enduserId: victim.id })
+      const mintedFor = token_enduser_id(r.bookingURL)
+      c1Pass = mintedFor === victim.id
+      c1Detail = `token subject=${mintedFor} (target=${victim.id})`
+    } catch (e: any) {
+      c1Detail = `unexpectedly rejected: ${e?.message || e?.toString()}`
+    }
+    record('C1: staff can still load booking info for a specific enduser', c1Pass, c1Detail)
+
+    let c2Detail = ''
+    let c2Pass = false
+    try {
+      const r = await sdk.api.form_fields.booking_info({ bookingPageId })
+      c2Pass = !!r.bookingURL && !!r.warningMessage
+      c2Detail = `warningMessage=${JSON.stringify(r.warningMessage)} bookingURL=${!!r.bookingURL}`
+    } catch (e: any) {
+      c2Detail = `unexpectedly rejected: ${e?.message || e?.toString()}`
+    }
+    record('C2: staff test-contact preview branch still works', c2Pass, c2Detail)
+
+    /* ===== report: print full table first, then assert (harness exits on first failure) ===== */
+    console.log('\n  check summary:')
+    for (const c of checks) {
+      console.log(`    ${c.pass ? 'PASS' : 'FAIL'}  ${c.label}  —  ${c.detail}`)
+    }
+    console.log('')
+
+    for (const c of checks) {
+      assert(c.pass, `${c.label} — ${c.detail}`, c.label)
+    }
+  } finally {
+    for (const id of enduserIds) { try { await sdk.api.endusers.deleteOne(id) } catch {} }
+    if (bookingPageId) { try { await sdk.api.appointment_booking_pages.deleteOne(bookingPageId) } catch {} }
+    if (templateId) { try { await sdk.api.calendar_event_templates.deleteOne(templateId) } catch {} }
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await booking_info_idor_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ booking_info IDOR test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ booking_info IDOR test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/security/{F-0053-cascade-role-rename-cross-tenant.test.ts → cascade-role-rename-cross-tenant.test.ts}

@@ -16,14 +16,14 @@ const host = process.env.API_URL || 'http://localhost:8080' as const
 const OTHER_TENANT_API_KEY = "ba745e25162bb95a795c5fa1af70df188d93c4d3aac9c48b34a5c8c9dd7b80f7"
 
 /**
- * Tenant-boundary guard for cascade_role_rename (relates to security-audit finding F-0053,
+ * Tenant-boundary guard for cascade_role_rename (relates to a prior internal review,
  * which was investigated and closed as a FALSE POSITIVE — see that file for the code trace).
  *
  * The `cascade_role_rename` side-effect handler
  * ([event_handlers_v2/role_based_access_permissions.ts](packages/private/api/api/v1/event_handlers_v2/role_based_access_permissions.ts))
  * runs when a `role_based_access_permissions` doc's `role` field changes. It finds every user
  * with the old role name (via `DBUnrestricted.users`) and rewrites their `roles` array, then
- * deauthenticates them. F-0053 hypothesized this query was globally cross-tenant. It is NOT:
+ * deauthenticates them. An earlier review hypothesized this query was globally cross-tenant. It is NOT:
  * `DBUnrestricted` bypasses per-user/per-role RBAC but is STILL scoped to the acting session's
  * `businessId` (see `modifyFilterForAccessConstraint` injecting `{ businessId }` at
  * database.ts:1761-1763, reached via the `unrestricted: true` branch at database.ts:2137-2144).
@@ -42,7 +42,7 @@ const OTHER_TENANT_API_KEY = "ba745e25162bb95a795c5fa1af70df188d93c4d3aac9c48b34
  * A collision-proof unique role name (timestamped) is used so the test never touches real roles.
  */
 export const cascade_role_rename_cross_tenant_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("F-0053: cascade role rename cross-tenant regression")
+  log_header("cascade role rename cross-tenant regression")
 
   const stamp = Date.now()
   const ROLE_OLD = `XTenantRename_${stamp}`
@@ -55,7 +55,7 @@ export const cascade_role_rename_cross_tenant_tests = async ({ sdk } : { sdk: Se
   let rbapId: string | undefined
   // We create dedicated throwaway users in BOTH tenants and delete them in `finally`. We never
   // mutate any pre-existing user (an earlier version of this test clobbered the apiKey's own
-  // admin user via getSome+replaceObjectFields — see F-0053 finding notes). controlUser lives in
+  // admin user via getSome+replaceObjectFields). controlUser lives in
   // Tenant A and SHOULD be renamed by the same-tenant cascade; victimUser lives in Tenant B and
   // must be UNTOUCHED.
   let controlUserId: string | undefined
@@ -92,7 +92,7 @@ export const cascade_role_rename_cross_tenant_tests = async ({ sdk } : { sdk: Se
     assert(
       victimUser.businessId !== tenantABusinessId,
       `Victim user shares businessId with Tenant A (${victimUser.businessId}) — not a cross-tenant scenario`,
-      'F-0053 setup: tenants are distinct',
+      'setup: tenants are distinct',
     )
     const victimBefore = await sdkOther.api.users.getOne(victimUserId)
     const controlBefore = await sdk.api.users.getOne(controlUserId)
@@ -100,7 +100,7 @@ export const cascade_role_rename_cross_tenant_tests = async ({ sdk } : { sdk: Se
       JSON.stringify(victimBefore.roles) === JSON.stringify([ROLE_OLD])
         && JSON.stringify(controlBefore.roles) === JSON.stringify([ROLE_OLD]),
       `Setup failed: expected both users to hold [${ROLE_OLD}] (victim=${JSON.stringify(victimBefore.roles)}, control=${JSON.stringify(controlBefore.roles)})`,
-      'F-0053 setup: both users hold ROLE_OLD',
+      'setup: both users hold ROLE_OLD',
     )
 
     // 5. Tenant A renames the role. This triggers cascade_role_rename.
@@ -113,7 +113,7 @@ export const cascade_role_rename_cross_tenant_tests = async ({ sdk } : { sdk: Se
       JSON.stringify(victimAfter.roles) === JSON.stringify([ROLE_OLD]),
       `CROSS-TENANT LEAK: Tenant B victim roles changed to ${JSON.stringify(victimAfter.roles)} `
         + `after Tenant A renamed its role. Expected [${ROLE_OLD}].`,
-      'F-0053: Tenant B user roles unaffected by other-tenant role rename',
+      'Tenant B user roles unaffected by other-tenant role rename',
     )
 
     // 7. POSITIVE CONTROL — the Tenant A control user SHOULD be renamed (same-tenant cascade intact).
@@ -122,7 +122,7 @@ export const cascade_role_rename_cross_tenant_tests = async ({ sdk } : { sdk: Se
       JSON.stringify(controlAfter.roles) === JSON.stringify([ROLE_NEW]),
       `Same-tenant cascade broken: Tenant A control roles are ${JSON.stringify(controlAfter.roles)}, `
         + `expected [${ROLE_NEW}].`,
-      'F-0053: Tenant A user roles renamed by same-tenant cascade',
+      'Tenant A user roles renamed by same-tenant cascade',
     )
   } finally {
     // Cleanup: delete both throwaway users and the role doc. Never touches pre-existing users.
@@ -151,11 +151,11 @@ if (require.main === module) {
 
   runTests()
     .then(() => {
-      console.log("✅ F-0053 cascade role rename cross-tenant test suite completed successfully")
+      console.log("✅ cascade role rename cross-tenant test suite completed successfully")
       process.exit(0)
     })
     .catch((error) => {
-      console.error("❌ F-0053 cascade role rename cross-tenant test suite failed:", error)
+      console.error("❌ cascade role rename cross-tenant test suite failed:", error)
       process.exit(1)
     })
 }

package/src/tests/api_tests/security/{F-0001-data-sync-redaction-bypass.test.ts → data-sync-redaction-bypass.test.ts}

@@ -41,7 +41,7 @@ const collectViolations = (results: { modelName: string, recordId: string, data:
 }
 
 /**
- * Regression test for F-0001 (security-audit/findings/F-0001-data-sync-bypasses-applyRedactions.md).
+ * Regression test: `/v1/data-sync` redaction.
  *
  * The /v1/data-sync handler must apply the central applyRedactions() pipeline to
  * every non-deleted record. The original bug: redactions were gated behind
@@ -63,7 +63,7 @@ const collectViolations = (results: { modelName: string, recordId: string, data:
  * Post-fix: assertion passes.
  */
 export const data_sync_redaction_bypass_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("F-0001: /v1/data-sync field-redaction bypass regression")
+  log_header("/v1/data-sync field-redaction bypass regression")
 
   const roleName = `f0001-data-sync-bypass-${Date.now()}`
   let testEnduserId: string | undefined
@@ -124,13 +124,13 @@ export const data_sync_redaction_bypass_tests = async ({ sdk, sdkNonAdmin } : {
     // would pass vacuously — guard against that.
     const userRecordsInStream = sync.results.filter(r => r.modelName === 'users').length
     await async_test(
-      "F-0001 guard: /v1/data-sync sync stream contains at least one user record",
+      "guard: /v1/data-sync sync stream contains at least one user record",
       async () => ({ userRecords: userRecordsInStream, totalRecords: sync.results.length }),
       { onResult: r => r.userRecords >= 1 },
     )
 
     await async_test(
-      "F-0001: /v1/data-sync must NOT return hashedPass / hashedPassword / hashedInviteCode (see security-audit/findings/F-0001)",
+      "/v1/data-sync must NOT return hashedPass / hashedPassword / hashedInviteCode",
       async () => ({
         violationCount: violations.length,
         violations: violations.slice(0, 10),
@@ -143,7 +143,7 @@ export const data_sync_redaction_bypass_tests = async ({ sdk, sdkNonAdmin } : {
     // ========================================================================
     // Additional coverage for applyRedactions code paths reachable via /v1/data-sync.
     // Each of these is a distinct branch in applyRedactions (routing.ts:1165-1238)
-    // and could regress independently of the F-0001 fix.
+    // and could regress independently of this fix.
     // ========================================================================
 
     // Case A: schema-level `redactions: ['all']` must apply to ADMIN sessions too.
@@ -153,7 +153,7 @@ export const data_sync_redaction_bypass_tests = async ({ sdk, sdkNonAdmin } : {
     const adminSync = await sdk.sync({ from: new Date(0) })
     const adminViolations = collectViolations(adminSync.results)
     await async_test(
-      "F-0001 coverage A: admin /v1/data-sync also strips redactions:['all'] fields (hashedPass etc.)",
+      "coverage A: admin /v1/data-sync also strips redactions:['all'] fields (hashedPass etc.)",
       async () => ({
         violationCount: adminViolations.length,
         violations: adminViolations.slice(0, 10),
@@ -180,7 +180,7 @@ export const data_sync_redaction_bypass_tests = async ({ sdk, sdkNonAdmin } : {
       } catch {}
     }
     await async_test(
-      "F-0001 coverage B: /v1/data-sync strips linkedAccountAccess from other users' records",
+      "coverage B: /v1/data-sync strips linkedAccountAccess from other users' records",
       async () => ({
         otherUserRecords: otherUsersInStream.length,
         leakCount: linkedAccountLeaks.length,
@@ -226,11 +226,11 @@ if (require.main === module) {
 
   runTests()
     .then(() => {
-      console.log("✅ F-0001 data-sync redaction-bypass test suite completed successfully")
+      console.log("✅ data-sync redaction-bypass test suite completed successfully")
       process.exit(0)
     })
     .catch((error) => {
-      console.error("❌ F-0001 data-sync redaction-bypass test suite failed:", error)
+      console.error("❌ data-sync redaction-bypass test suite failed:", error)
       process.exit(1)
     })
 }