@tellescope/sdk 1.256.13 → 1.256.15

package/src/tests/api_tests/security/{F-0006-develop-health-benefit-verification-rbac.test.ts → develop-health-benefit-verification-rbac.test.ts}

@@ -14,8 +14,7 @@ const host = process.env.API_URL || 'http://localhost:8080' as const
 const [nonAdminEmail, nonAdminPassword] = [process.env.NON_ADMIN_EMAIL, process.env.NON_ADMIN_PASSWORD]
 
 /**
- * Regression test for F-0006 (security-audit/findings/F-0006-zoom-and-benefit-verification-bypass-rbac.md),
- * reopened 2026-08-17 for the `develop_health_run_benefit_verification` sub-item.
+ * Regression test: the `develop_health_run_benefit_verification` RBAC gate.
  *
  * `enduser_eligibility_results.develop_health_run_benefit_verification` is registered with
  * `noAccessPermissions: true` (packages/private/api/api/v1/api.ts, ~line 24606). Before the fix,
@@ -39,7 +38,7 @@ const [nonAdminEmail, nonAdminPassword] = [process.env.NON_ADMIN_EMAIL, process.
  * Post-fix: the handler throws 403 before touching `DB.endusers` at all. Test passes.
  */
 export const develop_health_benefit_verification_rbac_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("F-0006: develop_health benefit verification RBAC regression")
+  log_header("develop_health benefit verification RBAC regression")
 
   const roleName = `f0006-develop-health-no-access-${Date.now()}`
   let rbapId: string | undefined
@@ -74,7 +73,7 @@ export const develop_health_benefit_verification_rbac_tests = async ({ sdk, sdkN
     //    Pre-fix: proceeds to DB.endusers.findById and either 400s on validation (fake id) or
     //    succeeds and forwards PHI to Develop Health (real id) — never a 403.
     await async_test(
-      "F-0006: enduser_eligibility_results.develop_health_run_benefit_verification must throw 403 when role denies endusers/enduser_eligibility_results",
+      "enduser_eligibility_results.develop_health_run_benefit_verification must throw 403 when role denies endusers/enduser_eligibility_results",
       () => sdkNonAdmin.api.enduser_eligibility_results.develop_health_run_benefit_verification({
         enduserId: new ObjectId().toHexString(),       // fake id — access check should fire first
         providerUserId: new ObjectId().toHexString(),  // fake id — access check should fire first
@@ -122,7 +121,7 @@ export const develop_health_benefit_verification_rbac_tests = async ({ sdk, sdkN
       await sdkNonAdmin.authenticate(nonAdminEmail!, nonAdminPassword!)
 
       await async_test(
-        "F-0006: a provider role with enduser access passes the gate (reaches 'Integration not found', not 403)",
+        "a provider role with enduser access passes the gate (reaches 'Integration not found', not 403)",
         () => sdkNonAdmin.api.enduser_eligibility_results.develop_health_run_benefit_verification({
           enduserId: new ObjectId().toHexString(),
           providerUserId: new ObjectId().toHexString(),
@@ -159,7 +158,7 @@ export const develop_health_benefit_verification_rbac_tests = async ({ sdk, sdkN
     // the handler throws "Integration not found" BEFORE reaching the (now read-scoped) enduser load,
     // and the enduser load is what the create>read fix governs. Exercising it would need either a real
     // Develop Health integration or reordering the handler purely for the test. It is covered by code
-    // review + F-0166 (systemic follow-up). If a Develop Health sandbox integration is ever available
+    // review + the systemic follow-up. If a Develop Health sandbox integration is ever available
     // in the test org, add: role { endusers: create 'All', read 'Assigned' } → call with a real
     // enduser NOT assigned to the caller → expect the enduser-not-found path, not a successful forward.
   } finally {
@@ -194,11 +193,11 @@ if (require.main === module) {
 
   runTests()
     .then(() => {
-      console.log("✅ F-0006 develop_health_run_benefit_verification RBAC test suite completed successfully")
+      console.log("✅ develop_health_run_benefit_verification RBAC test suite completed successfully")
       process.exit(0)
     })
     .catch((error) => {
-      console.error("❌ F-0006 develop_health_run_benefit_verification RBAC test suite failed:", error)
+      console.error("❌ develop_health_run_benefit_verification RBAC test suite failed:", error)
       process.exit(1)
     })
 }

package/src/tests/api_tests/security/{F-0116-F-0119-enduser-cross-create.test.ts → enduser-cross-create.test.ts}

@@ -16,10 +16,10 @@ const CROSS_ENDUSER_MESSAGE = "enduserId does not match creator id for enduser s
 
 /**
  * Regression test for the enduser cross-enduser CREATE gating gaps:
- *   F-0116 enduser_observations  (security-audit/findings/F-0116-*.md)
- *   F-0117 enduser_orders        (security-audit/findings/F-0117-*.md)
- *   F-0119 managed_content_records (security-audit/findings/F-0119-*.md)
- *   F-0118 chat_rooms (enduserIds-only gate; staff userIds targeting is by-design)
+ *   enduser_observations
+ *   enduser_orders
+ *   managed_content_records
+ *   chat_rooms (enduserIds-only gate; staff userIds targeting is by-design)
  *
  * Each model exposed enduserActions.create with an `enduserId`/`enduserIds` field that
  * lacked a write-side gate, letting an authenticated enduser create records bound to a
@@ -30,7 +30,7 @@ const CROSS_ENDUSER_MESSAGE = "enduserId does not match creator id for enduser s
  * legitimate path (self-create + staff-create) still works.
  */
 export const enduser_cross_create_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("F-0116/F-0117/F-0118/F-0119: enduser cross-enduser create gates")
+  log_header("enduser cross-enduser create gates")
 
   let attackerId: string | undefined
   let victimId: string | undefined
@@ -53,10 +53,10 @@ export const enduser_cross_create_tests = async ({ sdk } : { sdk: Session, sdkNo
     await attackerSDK.authenticate(attackerEmail, ENDUSER_PASSWORD)
 
     // ============================================================
-    // F-0116 — enduser_observations
+    // enduser_observations
     // ============================================================
     await async_test(
-      `F-0116: enduser cannot create observation on another enduser (createOne)`,
+      `enduser cannot create observation on another enduser (createOne)`,
       () => attackerSDK.api.enduser_observations.createOne({
         enduserId: victimId!, category: 'vital-signs', status: 'final',
         measurement: { unit: 'mmHg', value: 220 },
@@ -64,7 +64,7 @@ export const enduser_cross_create_tests = async ({ sdk } : { sdk: Session, sdkNo
       { shouldError: true, onError: e => e.message === CROSS_ENDUSER_MESSAGE },
     )
     await async_test(
-      `F-0116: enduser cannot create observation on another enduser (createMany)`,
+      `enduser cannot create observation on another enduser (createMany)`,
       () => attackerSDK.api.enduser_observations.createSome([{
         enduserId: victimId!, category: 'vital-signs', status: 'final',
         measurement: { unit: 'mmHg', value: 220 },
@@ -74,7 +74,7 @@ export const enduser_cross_create_tests = async ({ sdk } : { sdk: Session, sdkNo
 
     // Positive control: enduser CAN create an observation on their OWN record
     await async_test(
-      `F-0116: enduser can still create observation on own record`,
+      `enduser can still create observation on own record`,
       () => attackerSDK.api.enduser_observations.createOne({
         enduserId: attackerId!, category: 'vital-signs', status: 'final',
         measurement: { unit: 'mmHg', value: 120 },
@@ -83,7 +83,7 @@ export const enduser_cross_create_tests = async ({ sdk } : { sdk: Session, sdkNo
     )
     // Positive control: staff CAN create an observation on any tenant enduser
     await async_test(
-      `F-0116: staff can still create observation on any enduser`,
+      `staff can still create observation on any enduser`,
       () => sdk.api.enduser_observations.createOne({
         enduserId: victimId!, category: 'vital-signs', status: 'final',
         measurement: { unit: 'mmHg', value: 118 },
@@ -92,61 +92,61 @@ export const enduser_cross_create_tests = async ({ sdk } : { sdk: Session, sdkNo
     )
 
     // ============================================================
-    // F-0117 — enduser_orders
+    // enduser_orders
     // ============================================================
     const orderPayload = (enduserId: string) => ({
       enduserId, externalId: `f0117-${Date.now()}`, source: 'f0117-source',
       title: 'f0117 order', status: 'pending',
     })
     await async_test(
-      `F-0117: enduser cannot create order on another enduser`,
+      `enduser cannot create order on another enduser`,
       () => attackerSDK.api.enduser_orders.createOne(orderPayload(victimId!) as any),
       { shouldError: true, onError: e => e.message === CROSS_ENDUSER_MESSAGE },
     )
     await async_test(
-      `F-0117: enduser can still create order on own record`,
+      `enduser can still create order on own record`,
       () => attackerSDK.api.enduser_orders.createOne(orderPayload(attackerId!) as any),
       { onResult: (o: any) => { if (o?.id) createdOrderIds.push(o.id); return o?.enduserId === attackerId } },
     )
     await async_test(
-      `F-0117: staff can still create order on any enduser`,
+      `staff can still create order on any enduser`,
       () => sdk.api.enduser_orders.createOne(orderPayload(victimId!) as any),
       { onResult: (o: any) => { if (o?.id) createdOrderIds.push(o.id); return o?.enduserId === victimId } },
     )
 
     // ============================================================
-    // F-0119 — managed_content_records
+    // managed_content_records
     // ============================================================
     await async_test(
-      `F-0119: enduser cannot create content with allowUnauthenticatedAccess`,
+      `enduser cannot create content with allowUnauthenticatedAccess`,
       () => attackerSDK.api.managed_content_records.createOne({
         title: 'f0119 phishing', textContent: 'x', allowUnauthenticatedAccess: true,
       } as any),
       { shouldError: true, onError: e => e.message === "allowUnauthenticatedAccess cannot be set by endusers" },
     )
     await async_test(
-      `F-0119: enduser cannot create content with publicRead`,
+      `enduser cannot create content with publicRead`,
       () => attackerSDK.api.managed_content_records.createOne({
         title: 'f0119 broadcast', textContent: 'x', publicRead: true,
       } as any),
       { shouldError: true, onError: e => e.message === "publicRead cannot be set by endusers" },
     )
     await async_test(
-      `F-0119: enduser cannot create content bound to another enduser`,
+      `enduser cannot create content bound to another enduser`,
       () => attackerSDK.api.managed_content_records.createOne({
         title: 'f0119 cross', textContent: 'x', enduserId: victimId!,
       } as any),
       { shouldError: true, onError: e => e.message === CROSS_ENDUSER_MESSAGE },
     )
     await async_test(
-      `F-0119: enduser can still create ordinary content`,
+      `enduser can still create ordinary content`,
       () => attackerSDK.api.managed_content_records.createOne({
         title: 'f0119 ok', textContent: 'hello',
       } as any),
       { onResult: (o: any) => { if (o?.id) createdContentIds.push(o.id); return !o?.publicRead && !o?.allowUnauthenticatedAccess } },
     )
     await async_test(
-      `F-0119: staff can still create public content`,
+      `staff can still create public content`,
       () => sdk.api.managed_content_records.createOne({
         title: 'f0119 staff public', textContent: 'x', publicRead: true,
       } as any),
@@ -154,11 +154,11 @@ export const enduser_cross_create_tests = async ({ sdk } : { sdk: Session, sdkNo
     )
 
     // ============================================================
-    // F-0118 — chat_rooms (enduserIds-only gate; staff userIds targeting is by-design)
+    // chat_rooms (enduserIds-only gate; staff userIds targeting is by-design)
     // ============================================================
     const staffId = sdk.userInfo.id
     await async_test(
-      `F-0118: enduser cannot add another patient to a chat room (enduserIds)`,
+      `enduser cannot add another patient to a chat room (enduserIds)`,
       () => attackerSDK.api.chat_rooms.createOne({
         type: 'internal', enduserIds: [attackerId!, victimId!], userIds: [staffId],
       } as any),
@@ -166,7 +166,7 @@ export const enduser_cross_create_tests = async ({ sdk } : { sdk: Session, sdkNo
     )
     // Positive control: patient CAN create a room with care-team staff + self (intended feature)
     await async_test(
-      `F-0118: enduser can still create a room with staff + self`,
+      `enduser can still create a room with staff + self`,
       () => attackerSDK.api.chat_rooms.createOne({
         type: 'internal', enduserIds: [attackerId!], userIds: [staffId],
       } as any),
@@ -174,7 +174,7 @@ export const enduser_cross_create_tests = async ({ sdk } : { sdk: Session, sdkNo
     )
     // Positive control: staff can still create multi-patient rooms
     await async_test(
-      `F-0118: staff can still create a room with multiple endusers`,
+      `staff can still create a room with multiple endusers`,
       () => sdk.api.chat_rooms.createOne({
         type: 'internal', enduserIds: [attackerId!, victimId!], userIds: [staffId],
       } as any),
@@ -211,7 +211,7 @@ if (require.main === module) {
 
   runTests()
     .then(() => {
-      console.log("✅ F-0116/F-0117/F-0118/F-0119 enduser cross-create test suite completed successfully")
+      console.log("✅ enduser cross-create test suite completed successfully")
       process.exit(0)
     })
     .catch((error) => {

package/src/tests/api_tests/security/{F-0106-F-0110-enduser-write-restrictions.test.ts → enduser-write-restrictions.test.ts}

@@ -71,9 +71,7 @@ const restrictedFormResponseUpdates = (staffId: string, otherEnduserId: string):
 })
 
 /**
- * Regression test for F-0106 and F-0110
- * (security-audit/findings/F-0106-enduser-self-update-admin-only-fields.md,
- *  security-audit/findings/F-0110-form-responses-enduser-update-admin-only-fields.md).
+ * Regression test: enduser self-updates must not write staff-only fields on `endusers` or `form_responses`.
  *
  * Endusers could PATCH admin-only / access-bearing / attribution-bearing fields on
  * their own endusers record (assignedTo, tags, references, ...) and their own
@@ -88,7 +86,7 @@ const restrictedFormResponseUpdates = (staffId: string, otherEnduserId: string):
  *   - staff sessions can still update the restricted fields
  */
 export const enduser_write_restrictions_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("F-0106/F-0110: enduser write restrictions (enduserUpdatesDisabled)")
+  log_header("enduser write restrictions (enduserUpdatesDisabled)")
 
   let enduserId: string | undefined
   let otherEnduserId: string | undefined
@@ -111,7 +109,7 @@ export const enduser_write_restrictions_tests = async ({ sdk } : { sdk: Session,
     const enduserSDK = new EnduserSession({ host, businessId })
     await enduserSDK.authenticate(enduserEmail, ENDUSER_PASSWORD)
 
-    const form = await sdk.api.forms.createOne({ title: 'F-0106/F-0110 Write Restriction Test Form' })
+    const form = await sdk.api.forms.createOne({ title: 'Write Restriction Test Form' })
     formId = form.id
     const { response: formResponse } = await sdk.api.form_responses.prepare_form_response({
       formId: form.id,
@@ -119,34 +117,34 @@ export const enduser_write_restrictions_tests = async ({ sdk } : { sdk: Session,
     })
     formResponseId = formResponse.id
 
-    // ---- F-0106: enduser self-update of restricted endusers fields must 400 ----
+    // ---- enduser self-update of restricted endusers fields must 400 ----
     for (const [field, value] of Object.entries(restrictedEnduserUpdates(sdk.userInfo.id, enduser.id))) {
       await async_test(
-        `F-0106: enduser cannot self-update endusers.${field}`,
+        `enduser cannot self-update endusers.${field}`,
         () => enduserSDK.api.endusers.updateOne(enduser.id, { [field]: value } as any),
         { shouldError: true, onError: e => e.message === `${field} cannot be updated by endusers` },
       )
     }
 
-    // F-0106 Variant A persistence check: the rejected assignedTo write must not
+    // Variant A persistence check: the rejected assignedTo write must not
     // have granted the staff read-filter match.
     await async_test(
-      'F-0106: rejected assignedTo write did not persist',
+      'rejected assignedTo write did not persist',
       () => sdk.api.endusers.getOne(enduser.id),
       { onResult: e => !e.assignedTo?.length && !e.tags?.length && e.externalId === undefined },
     )
 
-    // ---- F-0110: enduser self-update of restricted form_responses fields must 400 ----
+    // ---- enduser self-update of restricted form_responses fields must 400 ----
     for (const [field, value] of Object.entries(restrictedFormResponseUpdates(sdk.userInfo.id, otherEnduser.id))) {
       await async_test(
-        `F-0110: enduser cannot self-update form_responses.${field}`,
+        `enduser cannot self-update form_responses.${field}`,
         () => enduserSDK.api.form_responses.updateOne(formResponse.id, { [field]: value } as any),
         { shouldError: true, onError: e => e.message === `${field} cannot be updated by endusers` },
       )
     }
 
     await async_test(
-      'F-0110: rejected writes did not persist (markedAsSubmitted, procedureCodes, submittedBy, enduserId)',
+      'rejected writes did not persist (markedAsSubmitted, procedureCodes, submittedBy, enduserId)',
       () => sdk.api.form_responses.getOne(formResponse.id),
       { onResult: fr => (
         !fr.markedAsSubmitted && !fr.procedureCodes?.length && fr.submittedBy === undefined
@@ -238,11 +236,11 @@ if (require.main === module) {
 
   runTests()
     .then(() => {
-      console.log("✅ F-0106/F-0110 enduser write-restriction test suite completed successfully")
+      console.log("✅ enduser write-restriction test suite completed successfully")
       process.exit(0)
     })
     .catch((error) => {
-      console.error("❌ F-0106/F-0110 enduser write-restriction test suite failed:", error)
+      console.error("❌ enduser write-restriction test suite failed:", error)
       process.exit(1)
     })
 }

package/src/tests/api_tests/security/form-logic-js-execution.test.ts

@@ -0,0 +1,183 @@
+require('source-map-support').install();
+
+import {
+  assert_checks,
+  Check,
+  setup_isolated_tenant,
+} from "../../setup_isolated"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
+/**
+ * Regression test: `$JS(...)` must be rejected in stored conditional logic.
+ *
+ * `responses_satisfy_conditions` (utilities/src/utils.ts) compiled a stored condition value of the
+ * form `$JS(...)` with `new Function()` and executed it — in every form-filler's browser, including
+ * anonymous visitors on public intake pages, AND inside the API process (automation_triggers.ts
+ * trigger matching on every form submission, ai_agent/form_filling.ts voice-agent navigation). The
+ * API process holds every tenant's database handle, so a condition authored by staff in one tenant
+ * reached all of them. Any staff user or API key with form_fields write access could plant one by
+ * typing into the free-text $gt/$lt box — no API call required.
+ *
+ * The sink is removed. This asserts the second half of the fix: `compoundFilterValidator` rejects the
+ * syntax at write time on every field that feeds that evaluator, so it cannot be reintroduced through
+ * stored configuration. The runtime half — that a `$JS` value is never evaluated — is covered by the
+ * pure-function cases in `form_conditional_logic_tests` in tests.ts.
+ *
+ * The five condition locations were established by enumerating every `responses_satisfy_conditions`
+ * call site, and all five are covered here. That completeness matters: the first run of this test
+ * caught a half fix. `event.conditions` is wrapped in an `orValidator`, which returns the first arm
+ * that does not throw, and its permissive `optional: optionalAnyObjectValidator` arm was declared
+ * before the guarded one — so the payload was accepted and stored even though the validator had been
+ * swapped. Pointing a field at the guard is not the same as the guard being reachable, which is why
+ * every location gets an assertion rather than an argument.
+ *
+ * Each rejection is paired with a positive control using the same shape without `$JS(`, so a passing
+ * test cannot be explained by the write failing for an unrelated reason.
+ */
+export const form_logic_js_execution_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  const JS_PAYLOAD = '$JS(return 0)'
+  const SAFE_VALUE = '18'
+
+  const condition = (value: string) => ({ $and: [{ condition: { 'someFieldId': { $gt: value } } }] })
+  const previousFields = (value: string) => ([{
+    type: 'compoundLogic',
+    info: { fieldId: '000000000000000000000000', priority: 5, label: '', condition: condition(value) },
+  }])
+
+  const attempt = async (fn: () => Promise<any>) => (
+    fn().then(() => ({ accepted: true,  detail: 'accepted' }))
+        .catch((e: any) => ({ accepted: false, detail: `rejected: ${e?.message || e}` }))
+  )
+
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+
+  try {
+    tenant = await setup_isolated_tenant({ name: `F0200 ${RAND()}`, users: [{ isAdmin: true }], apiKeys: 0 })
+    const sdk = tenant.sdk
+
+    const form = await sdk.api.forms.createOne({ title: `${RAND()}` })
+    const field = await sdk.api.form_fields.createOne({
+      formId: form.id, title: 'anchor', type: 'string', previousFields: [{ type: 'root', info: {} }],
+    })
+
+    /* ===== 1. previousFields[].info.condition — the field the finding was reported against ===== */
+
+    const controlCreate = await attempt(() => sdk.api.form_fields.createOne({
+      formId: form.id, title: 'control', type: 'string',
+      previousFields: previousFields(SAFE_VALUE) as any,
+    }))
+    record(
+      'control: form_fields.createOne accepts a normal $gt condition',
+      controlCreate.accepted, controlCreate.detail,
+    )
+
+    const payloadCreate = await attempt(() => sdk.api.form_fields.createOne({
+      formId: form.id, title: 'payload', type: 'string',
+      previousFields: previousFields(JS_PAYLOAD) as any,
+    }))
+    record(
+      '1a: form_fields.createOne rejects $JS( in previousFields condition',
+      !payloadCreate.accepted, payloadCreate.detail,
+    )
+
+    const payloadUpdate = await attempt(() => sdk.api.form_fields.updateOne(field.id, {
+      previousFields: previousFields(JS_PAYLOAD) as any,
+    }))
+    record(
+      '1b: form_fields.updateOne rejects $JS( in previousFields condition',
+      !payloadUpdate.accepted, payloadUpdate.detail,
+    )
+
+    /* ===== 2. groupShowCondition ===== */
+
+    const groupControl = await attempt(() => sdk.api.form_fields.updateOne(field.id, {
+      groupShowCondition: condition(SAFE_VALUE) as any,
+    }))
+    record('control: groupShowCondition accepts a normal condition', groupControl.accepted, groupControl.detail)
+
+    const groupPayload = await attempt(() => sdk.api.form_fields.updateOne(field.id, {
+      groupShowCondition: condition(JS_PAYLOAD) as any,
+    }))
+    record('2: form_fields.updateOne rejects $JS( in groupShowCondition', !groupPayload.accepted, groupPayload.detail)
+
+    /* ===== 3. options.optionDetails[].showCondition ===== */
+
+    const optionControl = await attempt(() => sdk.api.form_fields.updateOne(field.id, {
+      options: { optionDetails: [{ option: 'A', showCondition: condition(SAFE_VALUE) }] } as any,
+    }))
+    record('control: optionDetails showCondition accepts a normal condition', optionControl.accepted, optionControl.detail)
+
+    const optionPayload = await attempt(() => sdk.api.form_fields.updateOne(field.id, {
+      options: { optionDetails: [{ option: 'A', showCondition: condition(JS_PAYLOAD) }] } as any,
+    }))
+    record('3: form_fields.updateOne rejects $JS( in optionDetails showCondition', !optionPayload.accepted, optionPayload.detail)
+
+    /* ===== 4. options.productConditions[].showCondition ===== */
+
+    const productControl = await attempt(() => sdk.api.form_fields.updateOne(field.id, {
+      options: { productConditions: [{ productId: '000000000000000000000000', showCondition: condition(SAFE_VALUE) }] } as any,
+    }))
+    record('control: productConditions showCondition accepts a normal condition', productControl.accepted, productControl.detail)
+
+    const productPayload = await attempt(() => sdk.api.form_fields.updateOne(field.id, {
+      options: { productConditions: [{ productId: '000000000000000000000000', showCondition: condition(JS_PAYLOAD) }] } as any,
+    }))
+    record('4: form_fields.updateOne rejects $JS( in productConditions showCondition', !productPayload.accepted, productPayload.detail)
+
+    /* ===== 5. automation_triggers — the server-side evaluation path ===== */
+
+    const trigger = (conditions: object, extraInfo: object = {}) => ({
+      title: `${RAND()}`,
+      status: 'Inactive',
+      event: { type: 'Form Submitted', info: { formId: form.id, ...extraInfo }, ...conditions },
+      action: { type: 'Add Tags', info: { tags: ['security-regression'] } },
+    } as any)
+
+    const triggerControl = await attempt(() => sdk.api.automation_triggers.createOne(
+      trigger({ conditions: condition(SAFE_VALUE) })
+    ))
+    record('control: automation_triggers accepts normal event conditions', triggerControl.accepted, triggerControl.detail)
+
+    // NOTE: this is the case that caught the half fix — the orValidator's permissive arm accepted it.
+    const triggerPayload = await attempt(() => sdk.api.automation_triggers.createOne(
+      trigger({ conditions: condition(JS_PAYLOAD) })
+    ))
+    record('5a: automation_triggers rejects $JS( in event.conditions', !triggerPayload.accepted, triggerPayload.detail)
+
+    const byFormIdPayload = await attempt(() => sdk.api.automation_triggers.createOne(
+      trigger({}, { conditionsByFormId: { [form.id]: condition(JS_PAYLOAD) } })
+    ))
+    record('5b: automation_triggers rejects $JS( in event.info.conditionsByFormId', !byFormIdPayload.accepted, byFormIdPayload.detail)
+  } finally {
+    // Teardown BEFORE anything asserts — assert calls process.exit, which skips pending finallys and
+    // would strand the provisioned tenant permanently.
+    if (tenant) { try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) } }
+  }
+
+  return checks
+}
+
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+export const form_logic_js_execution_tests = async () => {
+  assert_checks('$JS in stored conditional logic', await form_logic_js_execution_checks())
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  form_logic_js_execution_tests()
+    .then(() => {
+      console.log("✅ form logic JS execution test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ form logic JS execution test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/security/{F-0145-globalunique-leak.test.ts → globalunique-conflict-redaction.test.ts}

@@ -10,8 +10,7 @@ import { setup_tests } from "../../setup"
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
 /**
- * Regression test for F-0145
- * (security-audit/findings/F-0145-globalunique-conflict-leaks-cross-tenant-record.md).
+ * Regression test: a globalUnique conflict response must not echo the matched record.
  *
  * The create endpoint generator's unconditional globalUnique-enforcement block
  * (routing.ts, "globalUnique should be enforced even if _overrideUnique is true")
@@ -24,7 +23,7 @@ const host = process.env.API_URL || 'http://localhost:8080' as const
  * 409 body's existingRecord exposes nothing beyond _id + businessId.
  */
 export const globalunique_leak_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("F-0145: globalUnique conflict response redaction")
+  log_header("globalUnique conflict response redaction")
 
   let userId: string | undefined
   try {
@@ -33,7 +32,7 @@ export const globalunique_leak_tests = async ({ sdk } : { sdk: Session, sdkNonAd
     userId = user.id
 
     await async_test(
-      'F-0145: globalUnique 409 existingRecord exposes only _id + businessId (no email/hashedPass)',
+      'globalUnique 409 existingRecord exposes only _id + businessId (no email/hashedPass)',
       () => sdk.api.users.createOne({ email, _overrideUnique: true } as any),
       {
         shouldError: true,
@@ -68,11 +67,11 @@ if (require.main === module) {
 
   runTests()
     .then(() => {
-      console.log("✅ F-0145 globalUnique leak test suite completed successfully")
+      console.log("✅ globalUnique leak test suite completed successfully")
       process.exit(0)
     })
     .catch((error) => {
-      console.error("❌ F-0145 globalUnique leak test suite failed:", error)
+      console.error("❌ globalUnique leak test suite failed:", error)
       process.exit(1)
     })
 }

package/src/tests/api_tests/security/{F-0008-handle-incoming-communication-cross-tenant.test.ts → handle-incoming-communication-cross-tenant.test.ts}

@@ -27,7 +27,7 @@ const post = async (path: string, body: any, headers: Record<string, string> = {
 }
 
 /**
- * Regression test for F-0008 (security-audit/findings/F-0008-handle-incoming-communication-cross-tenant-enduser-lookup.md).
+ * Regression test: `handle_incoming_communication` tenant scoping.
  *
  * `journeys.handle_incoming_communication` previously used `buildAllQueries({ unrestricted: true, organizationIds: [] }).endusers.findById(enduserId)`,
  * permitting cross-tenant lookup of any enduser by id. The handler then called `handleIncomingCommunication(...)`
@@ -45,7 +45,7 @@ const post = async (path: string, body: any, headers: Record<string, string> = {
  * enduser — the post-fix code returns 404 before any side effects fire, and the assertion confirms that.
  */
 export const handle_incoming_communication_cross_tenant_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("F-0008: handle_incoming_communication cross-tenant rejection")
+  log_header("handle_incoming_communication cross-tenant rejection")
 
   // ====================================================================
   // Assertion 1: nonexistent enduserId returns 404 (baseline; regression
@@ -58,19 +58,19 @@ export const handle_incoming_communication_cross_tenant_tests = async ({ sdk, sd
     { Authorization: `Bearer ${sdk.authToken}` },
   )
   await async_test(
-    "F-0008: handle_incoming_communication with nonexistent enduserId returns 404",
+    "handle_incoming_communication with nonexistent enduserId returns 404",
     async () => ({ status: nonexistentRes.status }),
     { onResult: r => r.status === 404 },
   )
 
   // ====================================================================
-  // Assertion 2: cross-tenant enduserId returns 404 (the actual F-0008 fix).
+  // Assertion 2: cross-tenant enduserId returns 404 (the actual fix).
   // Env-gated; skipped when cross-org infra isn't configured.
   // Safe to run post-fix because the tenant-scoped DB returns null for
   // cross-tenant lookups — no handleIncomingCommunication side effect fires.
   // ====================================================================
   if (!(CROSS_ORG_API_KEY && CROSS_ORG_TARGET_BUSINESS_ID)) {
-    console.log("  [F-0008] Skipping cross-tenant rejection assertion — CROSS_ORG_* env vars not set")
+    console.log("  Skipping cross-tenant rejection assertion — CROSS_ORG_* env vars not set")
     return
   }
 
@@ -96,7 +96,7 @@ export const handle_incoming_communication_cross_tenant_tests = async ({ sdk, sd
     )
 
     await async_test(
-      "F-0008: handle_incoming_communication with cross-tenant enduserId returns 404 (no side effect)",
+      "handle_incoming_communication with cross-tenant enduserId returns 404 (no side effect)",
       async () => ({
         status: crossRes.status,
         message: crossRes.data?.message ?? null,
@@ -120,11 +120,11 @@ if (require.main === module) {
 
   runTests()
     .then(() => {
-      console.log("✅ F-0008 handle_incoming_communication cross-tenant test suite completed successfully")
+      console.log("✅ handle_incoming_communication cross-tenant test suite completed successfully")
       process.exit(0)
     })
     .catch((error) => {
-      console.error("❌ F-0008 handle_incoming_communication cross-tenant test suite failed:", error)
+      console.error("❌ handle_incoming_communication cross-tenant test suite failed:", error)
       process.exit(1)
     })
 }