@tellescope/sdk 1.256.13 → 1.256.15

package/src/tests/api_tests/security/{F-0076-self-admin-role-assignment.test.ts → self-admin-role-assignment.test.ts}

@@ -11,10 +11,10 @@ import { setup_tests } from "../../setup"
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
 /**
- * Self-role privilege-escalation guard (relates to security-audit finding F-0076, which was
+ * Self-role privilege-escalation guard (relates to a prior internal review, which was
  * investigated and closed as a FALSE POSITIVE — see that file for the full code trace).
  *
- * F-0076 hypothesized that a non-admin staff user could `PATCH /v1/users/{their-own-id}` with
+ * An earlier review hypothesized that a non-admin staff user could `PATCH /v1/users/{their-own-id}` with
  * `{ roles: ['Admin'] }` and self-promote to Admin, because the FIRST `users` relationship
  * constraint ("Only admin users can set the admin role",
  * [schema.ts:3446](packages/public/schema/src/schema.ts#L3446)) has a self-exception
@@ -43,7 +43,7 @@ const host = process.env.API_URL || 'http://localhost:8080' as const
  * path role-writable by non-admins would flip the step-3/step-4 assertions to red.
  */
 export const self_admin_role_assignment_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("F-0076: self-admin role assignment privilege-escalation regression")
+  log_header("self-admin role assignment privilege-escalation regression")
 
   const stamp = Date.now()
   const NON_ADMIN_ROLE = 'Provider'
@@ -84,7 +84,7 @@ export const self_admin_role_assignment_tests = async ({ sdk } : { sdk: Session,
     assert(
       JSON.stringify(attackerBefore.roles) === JSON.stringify([NON_ADMIN_ROLE]),
       `Setup failed: expected attacker to hold [${NON_ADMIN_ROLE}], got ${JSON.stringify(attackerBefore.roles)}`,
-      'F-0076 setup: attacker holds a non-admin role',
+      'setup: attacker holds a non-admin role',
     )
 
     // 2. Authenticate AS the attacker (no password needed — admin mints an auth token).
@@ -96,25 +96,25 @@ export const self_admin_role_assignment_tests = async ({ sdk } : { sdk: Session,
     assert(
       sdkAttacker.userInfo.id === attackerId && !(sdkAttacker.userInfo.roles ?? []).includes('Admin'),
       `Setup failed: attacker session is not the expected non-admin user`,
-      'F-0076 setup: authenticated as the non-admin attacker',
+      'setup: authenticated as the non-admin attacker',
     )
 
     // 3. SECURITY ASSERTIONS — every self-role mutation by the non-admin must be blocked.
     await expect_blocked(
       () => sdkAttacker.api.users.updateOne(attackerId!, { roles: ['Admin'] }, { replaceObjectFields: true }),
-      'F-0076: non-admin self-update to [Admin] is blocked',
+      'non-admin self-update to [Admin] is blocked',
     )
     await expect_blocked(
       () => sdkAttacker.api.users.updateOne(attackerId!, { roles: [NON_ADMIN_ROLE, 'Admin'] }, { replaceObjectFields: true }),
-      'F-0076: non-admin self-update to [Provider, Admin] is blocked',
+      'non-admin self-update to [Provider, Admin] is blocked',
     )
     await expect_blocked(
       () => sdkAttacker.api.users.updateOne(attackerId!, { roles: [`Arbitrary_${stamp}`] }, { replaceObjectFields: true }),
-      'F-0076: non-admin self-update to an arbitrary role is blocked',
+      'non-admin self-update to an arbitrary role is blocked',
     )
     await expect_blocked(
       () => sdkAttacker.api.users.updateOne(attackerId!, { roles: [] }, { replaceObjectFields: true }),
-      'F-0076: non-admin self-update to [] (would grant defaults) is blocked',
+      'non-admin self-update to [] (would grant defaults) is blocked',
     )
 
     // 4. STATE ASSERTION — nothing slipped through; roles are still the original non-admin role.
@@ -123,7 +123,7 @@ export const self_admin_role_assignment_tests = async ({ sdk } : { sdk: Session,
       JSON.stringify(attackerAfter.roles) === JSON.stringify([NON_ADMIN_ROLE]),
       `ESCALATION LEAK: attacker roles changed to ${JSON.stringify(attackerAfter.roles)} `
         + `after self-update attempts. Expected [${NON_ADMIN_ROLE}].`,
-      'F-0076: attacker roles unchanged after all self-escalation attempts',
+      'attacker roles unchanged after all self-escalation attempts',
     )
 
     // 5. POSITIVE CONTROL — an Admin CAN update the user's roles (mechanism is not over-restricted).
@@ -132,7 +132,7 @@ export const self_admin_role_assignment_tests = async ({ sdk } : { sdk: Session,
     assert(
       JSON.stringify(afterAdminUpdate.roles) === JSON.stringify([NON_ADMIN_ROLE]),
       `Admin role update failed: roles are ${JSON.stringify(afterAdminUpdate.roles)}, expected [${NON_ADMIN_ROLE}]`,
-      'F-0076: admin can manage user roles (positive control)',
+      'admin can manage user roles (positive control)',
     )
   } finally {
     // Cleanup: delete the throwaway attacker. Never touches pre-existing users.
@@ -155,11 +155,11 @@ if (require.main === module) {
 
   runTests()
     .then(() => {
-      console.log("✅ F-0076 self-admin role assignment test suite completed successfully")
+      console.log("✅ self-admin role assignment test suite completed successfully")
       process.exit(0)
     })
     .catch((error) => {
-      console.error("❌ F-0076 self-admin role assignment test suite failed:", error)
+      console.error("❌ self-admin role assignment test suite failed:", error)
       process.exit(1)
     })
 }

package/src/tests/api_tests/security/startlinktoken-enduser-staff-escalation.test.ts

@@ -0,0 +1,162 @@
+require('source-map-support').install();
+
+import { Session, EnduserSession } from "../../../sdk"
+import { assert, log_header } from "@tellescope/testing"
+import { setup_tests, authenticate_enduser_via_token } from "../../setup"
+import { PROVIDER_PERMISSIONS } from "@tellescope/constants"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+/**
+ * Regression test — `calendar_events.startLinkToken` privilege escalation.
+ *
+ * startLinkToken is a DOCUMENTED feature ("Video Call Start Links"): a tenant's staff / API-key
+ * integration PATCHes a CalendarEvent to set a random token, then sends the host user the
+ * `/video/startlink?token=...` link, which `session_for_start_link` exchanges for a scope-limited
+ * User (staff) authToken for the first `type:'user'` attendee, MFA bypassed. Nothing in the codebase
+ * reads the token value back (the redeem matches server-side; the integration holds its own copy), so
+ * the field is write-only-by-design.
+ *
+ * TWO escalation vectors let a patient (or a low-privilege staff user) obtain the host's session:
+ *   WRITE — `enduserActions.update` + no `enduserUpdatesDisabled` let an enduser attendee PATCH
+ *           `startLinkToken` to a value they choose, then redeem it.
+ *   READ  — no `redactions` let an enduser attendee (or a non-admin staff user with calendar read)
+ *           read a LEGITIMATELY staff-set token and redeem it, with no write.
+ *
+ * Complete fix = TWO flags on schema.ts `startLinkToken`:
+ *   enduserUpdatesDisabled: true   (closes WRITE; preserves the staff/API-key write the feature needs)
+ *   redactions: ['all']            (closes READ for endusers AND non-admin users; safe — nothing reads
+ *                                   the value back). NOT `readonly` (would break the staff write — A2).
+ *
+ * Checks (collected, then asserted, so a RED run shows every failing vector):
+ *   A1  enduser attendee PATCH of startLinkToken is REJECTED                (WRITE gate)
+ *   A2  a staff-set token still redeems for the host's session             (feature preserved)
+ *   A3  an enduser-set token (if the write lands) does NOT redeem          (defence-in-depth)
+ *   A4  an enduser attendee does NOT receive startLinkToken on read        (READ gate, endusers)
+ *   A5  a non-admin staff user does NOT receive startLinkToken on read     (READ gate, users)
+ *
+ * No vendor, no Bedrock; the "host" is a throwaway user. Cleans up every created record.
+ */
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
+export const startlinktoken_escalation_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("startLinkToken enduser-writable / readable → staff session escalation")
+
+  const businessId = sdk.userInfo.businessId
+  const userIds: string[] = []
+  const enduserIds: string[] = []
+  const eventIds: string[] = []
+  const roleIds: string[] = []
+
+  const checks: { label: string, pass: boolean, detail: string }[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  try {
+    // Throwaway host staff user — the account an attacker would escalate INTO.
+    const host_user = await sdk.api.users.createOne({
+      email: `f0185-host-${RAND()}@tellescope.example`, fname: 'F0185', lname: 'Host',
+      verifiedEmail: true, notificationEmailsDisabled: true,
+    } as any)
+    userIds.push(host_user.id)
+
+    // The attacking patient, an attendee of the host's appointment.
+    const patient = await sdk.api.endusers.createOne({
+      email: `f0185-patient-${RAND()}@tellescope.example`, fname: 'F0185', lname: 'Patient',
+    })
+    enduserIds.push(patient.id)
+
+    const event = await sdk.api.calendar_events.createOne({
+      title: 'appointment', durationInMinutes: 30, startTimeInMS: Date.now() + 3600_000,
+      attendees: [{ type: 'user', id: host_user.id }, { type: 'enduser', id: patient.id }],
+    } as any)
+    eventIds.push(event.id)
+
+    const patientSDK = new EnduserSession({ host, businessId })
+    await authenticate_enduser_via_token(sdk, patientSDK, { id: patient.id })
+
+    // ---- A1: WRITE gate — enduser attendee cannot PATCH startLinkToken ----
+    const attackerToken = `f0185-attacker-${RAND()}${RAND()}`
+    let wrote = false, writeErr = ''
+    try {
+      await patientSDK.api.calendar_events.updateOne(event.id, { startLinkToken: attackerToken } as any)
+      wrote = true
+    } catch (err: any) { writeErr = err?.message ?? String(err) }
+    record('A1: enduser cannot write startLinkToken', !wrote,
+      wrote ? 'PATCH ACCEPTED — patient set a staff start-link token' : `rejected (${writeErr})`)
+
+    // ---- A3: defence-in-depth — an enduser-set token must not redeem ----
+    // Only lands when A1 failed (pre-fix). Read back as admin to see if the value stuck.
+    const adminView = await sdk.api.calendar_events.getOne(event.id)
+    if ((adminView as any).startLinkToken === attackerToken) {
+      let redeemed: any = null
+      try { redeemed = await new Session({ host }).api.calendar_events.session_for_start_link({ token: attackerToken }) } catch {}
+      record('A3: enduser-set token does not mint a staff session', !redeemed?.authToken,
+        redeemed?.authToken ? `minted a STAFF authToken for host ${host_user.id}` : 'not redeemable')
+    } else {
+      record('A3: enduser-set token does not mint a staff session', true, '(n/a — write blocked, value never landed)')
+    }
+
+    // ---- A2: feature pin — a STAFF-set token still redeems (write + redeem must both survive the fix) ----
+    const staffToken = `f0185-staff-${RAND()}${RAND()}`
+    let staffWriteErr = ''
+    try { await sdk.api.calendar_events.updateOne(event.id, { startLinkToken: staffToken } as any) }
+    catch (e: any) { staffWriteErr = e?.message ?? String(e) }
+    let legit: any = null
+    try { legit = await new Session({ host }).api.calendar_events.session_for_start_link({ token: staffToken }) }
+    catch (e: any) { legit = { error: e?.message ?? String(e) } }
+    record('A2: staff-set start link still works', !!legit?.authToken && legit.eventId === event.id,
+      `staffWrite=${staffWriteErr ? 'REJECTED(' + staffWriteErr + ')' : 'ok'} authToken=${!!legit?.authToken} eventId=${legit?.eventId} ${legit?.error ? '(' + legit.error + ')' : ''}`)
+
+    // ---- A4: READ gate (endusers) — patient attendee must not receive the token ----
+    let enduserRead: any = null
+    try { enduserRead = await patientSDK.api.calendar_events.getOne(event.id) } catch {}
+    record('A4: startLinkToken redacted from enduser reads',
+      !enduserRead || (enduserRead as any).startLinkToken === undefined,
+      `enduser read startLinkToken=${(enduserRead as any)?.startLinkToken ?? '(absent)'} — could redeem a staff-set token`)
+
+    // ---- A5: READ gate (non-admin users) — low-priv staff must not receive the token ----
+    const rbap = await sdk.api.role_based_access_permissions.createOne({
+      role: `F0185NonAdmin-${RAND()}`,
+      // Non-admin (non-Admin-role) staff with tenant-wide calendar READ — enough to load the event,
+      // so the assertion isolates redaction (not access). Spread a valid full permissions shape.
+      permissions: { ...PROVIDER_PERMISSIONS, calendar_events: { ...(PROVIDER_PERMISSIONS as any).calendar_events, read: 'All', readMany: 'All' } },
+    } as any).catch((e: any) => { console.warn('A5 role create failed:', e?.message ?? e); return null })
+    if (rbap) {
+      roleIds.push(rbap.id)
+      const nonAdmin = await sdk.api.users.createOne({
+        email: `f0185-nonadmin-${RAND()}@tellescope.example`, fname: 'F0185', lname: 'NonAdmin',
+        verifiedEmail: true, notificationEmailsDisabled: true, roles: [rbap.role],
+      } as any)
+      userIds.push(nonAdmin.id)
+      const { authToken } = await sdk.api.users.generate_auth_token({ id: nonAdmin.id })
+      const nonAdminSDK = new Session({ host, authToken })
+      let staffRead: any = null
+      try { staffRead = await nonAdminSDK.api.calendar_events.getOne(event.id) } catch {}
+      record('A5: startLinkToken redacted from non-admin user reads',
+        !staffRead || (staffRead as any).startLinkToken === undefined,
+        `non-admin user read startLinkToken=${(staffRead as any)?.startLinkToken ?? '(absent)'} — staff→host escalation via read`)
+    } else {
+      record('A5: startLinkToken redacted from non-admin user reads', true, '(n/a — could not create a non-admin role in this env)')
+    }
+
+    // Report the full table before asserting (the harness exits on the first failed assert).
+    console.log('\n  check summary:')
+    for (const c of checks) console.log(`    ${c.pass ? 'PASS' : 'FAIL'}  ${c.label}  —  ${c.detail}`)
+    console.log('')
+    for (const c of checks) assert(c.pass, `${c.label} — ${c.detail}`, c.label)
+  } finally {
+    for (const id of eventIds) { try { await sdk.api.calendar_events.deleteOne(id) } catch {} }
+    for (const id of enduserIds) { try { await sdk.api.endusers.deleteOne(id) } catch {} }
+    for (const id of userIds) { try { await sdk.api.users.deleteOne(id) } catch {} }
+    for (const id of roleIds) { try { await sdk.api.role_based_access_permissions.deleteOne(id) } catch {} }
+  }
+}
+
+if (require.main === module) {
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+  setup_tests(sdk, sdkNonAdmin)
+    .then(() => startlinktoken_escalation_tests({ sdk, sdkNonAdmin }))
+    .then(() => { console.log("✅ startLinkToken escalation test suite completed successfully"); process.exit(0) })
+    .catch((error) => { console.error("❌ startLinkToken escalation test suite failed:", error); process.exit(1) })
+}

package/src/tests/api_tests/security/{F-0015-webhook-outbound-ssrf.test.ts → webhook-outbound-ssrf.test.ts}

@@ -51,7 +51,7 @@ const assert_local_api = () => {
   const hostname = new URL(host).hostname
   if (!LOCAL_HOSTNAMES.includes(hostname)) {
     throw new Error(
-      `F-0015 SSRF tests must run against a local API (got ${host}). `
+      `SSRF tests must run against a local API (got ${host}). `
       + `127.0.0.1 would resolve to the API server rather than this machine, and this test configures a webhook.`
     )
   }
@@ -76,8 +76,7 @@ const wait_until = async (predicate: () => boolean, ms: number) => {
 }
 
 /**
- * Regression tests for F-0015
- * (security-audit/findings/F-0015-webhook-outbound-ssrf.md).
+ * Regression tests: outbound webhook delivery must refuse internal destinations.
  *
  * Outbound webhooks request customer-configured URLs that are validated only for SYNTAX
  * (urlValidator -> validator.isURL, which happily accepts http://10.0.0.1/). Four call sites are
@@ -99,7 +98,7 @@ const wait_until = async (predicate: () => boolean, ms: number) => {
  * subscription. So each is paired with a positive control that proves the attempt really was made.
  */
 export const webhook_outbound_ssrf_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("F-0015: outbound webhook SSRF")
+  log_header("outbound webhook SSRF")
   assert_local_api()
 
   const SENTINEL = `f0015-sentinel-${Date.now()}-${Math.random().toString(36).slice(2)}`
@@ -110,9 +109,9 @@ export const webhook_outbound_ssrf_tests = async ({ sdk } : { sdk: Session, sdkN
     // guard refuses in every environment, and loopback does not qualify (see the note above).
     assert(
       false,
-      'F-0015 SKIPPED: no non-loopback RFC1918 interface on this host, so the SSRF sentinel cannot be '
+      'SKIPPED: no non-loopback RFC1918 interface on this host, so the SSRF sentinel cannot be '
       + 'bound anywhere the guard refuses. Run on a host with a private network interface.',
-      'F-0015 outbound SSRF',
+      'outbound SSRF',
     )
     return
   }
@@ -179,21 +178,21 @@ export const webhook_outbound_ssrf_tests = async ({ sdk } : { sdk: Session, sdkN
     // webhook, every "sentinel not contacted" assertion below is meaningless.
     // ---------------------------------------------------------------------------------------------
     await async_test(
-      'F-0015: automation webhook to a permitted target still delivers (regression baseline)',
+      'automation webhook to a permitted target still delivers (regression baseline)',
       () => send_automation_webhook_to(okURL),
       { onResult: (r: any) => r.okHits === 1 && r.sentinelHits === 0 },
     )
 
     // T3 — direct non-allowlisted private destination.
     await async_test(
-      'F-0015: automation webhook does not reach a private destination',
+      'automation webhook does not reach a private destination',
       () => send_automation_webhook_to(sentinelURL),
       { onResult: (r: any) => r.sentinelHits === 0 },
     )
 
     // T4 — the redirect bypass. THE test that justifies a connect-time guard over a pre-flight check.
     await async_test(
-      'F-0015: automation webhook does not follow a redirect from a permitted host into a private one',
+      'automation webhook does not follow a redirect from a permitted host into a private one',
       () => send_automation_webhook_to(redirectURL),
       {
         // redirectHits === 1 is the positive control: hop 1 was allowlisted and really was reached, so
@@ -212,7 +211,7 @@ export const webhook_outbound_ssrf_tests = async ({ sdk } : { sdk: Session, sdkN
     templateEnduserId = templateEnduser.id
 
     await async_test(
-      'F-0015: automation webhook validates the URL after template interpolation, not before',
+      'automation webhook validates the URL after template interpolation, not before',
       () => send_automation_webhook_to('http://{{enduser.ssrfTarget}}/ssrf-sentinel', templateEnduser.id),
       { onResult: (r: any) => r.sentinelHits === 0 },
     )
@@ -229,7 +228,7 @@ export const webhook_outbound_ssrf_tests = async ({ sdk } : { sdk: Session, sdkN
     configuredWebhook = true
 
     await async_test(
-      'F-0015: configured webhook to a permitted target still delivers (positive control)',
+      'configured webhook to a permitted target still delivers (positive control)',
       async () => {
         sentinelHits = 0; okHits = 0
         const e = await sdk.api.endusers.createOne({ email: `f0015-ok-${Date.now()}@example.com` })
@@ -244,7 +243,7 @@ export const webhook_outbound_ssrf_tests = async ({ sdk } : { sdk: Session, sdkN
     await sdk.api.webhooks.update({ url: sentinelURL })
 
     await async_test(
-      'F-0015: configured webhook does not deliver to a private destination',
+      'configured webhook does not deliver to a private destination',
       async () => {
         sentinelHits = 0; okHits = 0
         const e = await sdk.api.endusers.createOne({ email: `f0015-blocked-${Date.now()}@example.com` })
@@ -282,11 +281,11 @@ if (require.main === module) {
 
   runTests()
     .then(() => {
-      console.log("✅ F-0015 outbound webhook SSRF test suite completed successfully")
+      console.log("✅ outbound webhook SSRF test suite completed successfully")
       process.exit(0)
     })
     .catch((error) => {
-      console.error("❌ F-0015 outbound webhook SSRF test suite failed:", error)
+      console.error("❌ outbound webhook SSRF test suite failed:", error)
       process.exit(1)
     })
 }

package/src/tests/api_tests/security/{F-0155-webhook-timeout.test.ts → webhook-timeout.test.ts}

@@ -10,12 +10,11 @@ import { setup_tests } from "../../setup"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
-// The server-side axios timeout is 15s (F-0155 fix). We bound our own wait above that.
+// The server-side axios timeout is 15s (the fix under test). We bound our own wait above that.
 const CLIENT_WAIT_MS = 20_000
 
 /**
- * Regression test for F-0155
- * (security-audit/findings/F-0155-outbound-webhook-no-timeout-slow-loris.md).
+ * Regression test: outbound webhook delivery must time out rather than hang.
  *
  * Outbound webhook delivery used axios.post(url, ...) with no `timeout` (axios default = infinite).
  * A tenant-controlled receiver that accepts the connection and never responds hangs the awaited
@@ -28,7 +27,7 @@ const CLIENT_WAIT_MS = 20_000
  *   - red  (unfixed): the call is still pending at 20s → client timer wins
  */
 export const webhook_timeout_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("F-0155: outbound webhook timeout")
+  log_header("outbound webhook timeout")
 
   let enduserId: string | undefined
   const slowServer = http.createServer(() => { /* accept connection, never respond */ })
@@ -42,7 +41,7 @@ export const webhook_timeout_tests = async ({ sdk } : { sdk: Session, sdkNonAdmi
     enduserId = enduser.id
 
     await async_test(
-      'F-0155: outbound webhook to a non-responding receiver times out server-side (does not hang)',
+      'outbound webhook to a non-responding receiver times out server-side (does not hang)',
       async () => {
         const start = Date.now()
         const outcome = await Promise.race([
@@ -75,11 +74,11 @@ if (require.main === module) {
 
   runTests()
     .then(() => {
-      console.log("✅ F-0155 webhook timeout test suite completed successfully")
+      console.log("✅ webhook timeout test suite completed successfully")
       process.exit(0)
     })
     .catch((error) => {
-      console.error("❌ F-0155 webhook timeout test suite failed:", error)
+      console.error("❌ webhook timeout test suite failed:", error)
       process.exit(1)
     })
 }