@tellescope/sdk 1.256.13 → 1.256.15

package/src/tests/api_tests/tickets_bulk_assign_from_queue.test.ts

@@ -0,0 +1,279 @@
+require('source-map-support').install();
+
+import { Session } from "../../sdk"
+import {
+  assert_checks,
+  Check,
+  setup_isolated_tenant,
+} from "../setup_isolated"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
+/**
+ * Coverage for `tickets.bulk_assign` when a `queueId` is supplied — the bulk equivalent of
+ * `tickets.assign_from_queue`, added so a Ticket Queue's tickets can be checkbox-selected and handed
+ * to one user in a single call instead of one `assign_from_queue` round trip per ticket.
+ *
+ * Without `queueId` the endpoint only does `$set: { owner }`. That is insufficient for a QUEUED
+ * ticket: it would stay in the queue (still pullable by someone else), carry no dequeue provenance,
+ * and leave `ticket_queues.count` drifting upward forever. The queue branch therefore also unsets
+ * `queueId`, sets `dequeuedAt`/`dequeuedFrom`, and decrements the queue's count — the same
+ * bookkeeping `assign_from_queue` does for a single ticket. A/B/C below pin each of those.
+ *
+ * D is the check that actually justifies the handler's shape. The tickets model declares
+ * `constraints.access: [{ type: 'filter', field: 'owner' }]`, which the DB layer turns into
+ * `owner === self OR creator === self` for any non-`All` access. A queued ticket has no owner, and
+ * was typically created by someone else, so a non-admin queue manager's `DB.tickets.updateMany`
+ * matches NOTHING — the call would return 200 having assigned zero tickets, silently. The handler
+ * uses `buildOrganizationWideQueries` to get past that, exactly as `assign_from_queue` does, and
+ * re-adds the queue-membership check that those queries bypass. D1 proves the escape hatch works for
+ * a legitimate queue member; D2 proves it is still gated, and is the check that fails if someone
+ * later drops the membership check while keeping the organization-wide queries.
+ *
+ * A provisioned non-admin gets `tickets: ASSIGNED_AND_DEFAULT_ACCESS` (read/update = 'Assigned'),
+ * which is what makes D meaningful. The D tickets deliberately have NO enduserId, so the 'Assigned'
+ * role filter's other branch (enduserId in assignedEnduserIds) cannot match either — the ONLY way
+ * they can be assigned is through the organization-wide path.
+ *
+ * E is the regression guard on the pre-existing no-`queueId` behavior, which must be unchanged.
+ *
+ * Cross-tenant (F) is covered because `buildOrganizationWideQueries` is bound to the caller's
+ * businessId: another tenant's queue is invisible even to an admin, who skips the membership check.
+ *
+ * `ticket_queues.count` is maintained by asynchronous side effects (increment on ticket create) and
+ * the decrement here is deliberately fire-and-forget, so every count read polls.
+ */
+
+// count is maintained by async side effects; give it a moment to settle before reading
+const poll_for = async <T,>(get: () => Promise<T>, done: (v: T) => boolean, attempts=20): Promise<T> => {
+  let value = await get()
+  for (let i = 0; i < attempts && !done(value); i++) {
+    await new Promise(resolve => setTimeout(resolve, 250))
+    value = await get()
+  }
+  return value
+}
+
+export const tickets_bulk_assign_from_queue_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+  let otherTenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+
+  try {
+    /* ================= fixtures ================= */
+
+    // users[1] joins the queue, users[2] deliberately does not (D2)
+    ;[tenant, otherTenant] = await Promise.all([
+      setup_isolated_tenant({
+        name: `BulkAssignQueue ${RAND()}`,
+        users: [{ isAdmin: true }, { roles: ['Non-Admin'] }, { roles: ['Non-Admin'] }],
+        apiKeys: 0,
+      }),
+      setup_isolated_tenant({
+        name: `BulkAssignQueue other ${RAND()}`,
+        users: [{ isAdmin: true }],
+        apiKeys: 0,
+      }),
+    ])
+
+    const { sdk, sdkNonAdmin } = tenant
+    const queueMember = tenant.users[1]
+    const outsider = tenant.users[2]
+
+    // a session for users[2] — setup_isolated_tenant only builds sessions for users[0] and users[1]
+    const sdkOutsider = new Session({ host, authToken: outsider.authToken })
+    await sdkOutsider.refresh_session()
+
+    const owner = await sdk.api.users.createOne({
+      email: `dontsend-bulk-assign-queue-${RAND()}@tellescope.com`,
+      fname: 'BulkAssign', lname: 'QueueOwner',
+      verifiedEmail: true,
+    })
+
+    const queue = await sdk.api.ticket_queues.createOne({
+      title: `Bulk Assign Queue ${RAND()}`,
+      userIds: [owner.id, queueMember.id], // outsider is NOT a member
+    })
+
+    const enduser = await sdk.api.endusers.createOne({ fname: 'BulkAssign', lname: 'QueuePatient' })
+
+    // A/B/C fixtures — one carries an enduser so care team behavior is exercised alongside dequeue
+    const queued1 = await sdk.api.tickets.createOne({ title: 'BAQ 1', enduserId: enduser.id, queueId: queue.id })
+    const queued2 = await sdk.api.tickets.createOne({ title: 'BAQ 2', queueId: queue.id })
+
+    const countBefore = await poll_for(
+      () => sdk.api.ticket_queues.getOne(queue.id).then(q => q.count ?? 0),
+      c => c === 2,
+    )
+    record(
+      'setup: queue count reflects both queued tickets',
+      countBefore === 2,
+      `count=${countBefore} (want 2); queue=${queue.id}`,
+    )
+
+    /* ===== A: the dequeue bookkeeping ===== */
+
+    const assignResult = await sdk.api.tickets.bulk_assign({
+      ids: [queued1.id, queued2.id], userId: owner.id, queueId: queue.id, addToCareTeam: true,
+    })
+    record(
+      'A1: reports both tickets assigned and none skipped',
+      assignResult.assigned === 2 && assignResult.skipped === 0,
+      `assigned=${assignResult.assigned} skipped=${assignResult.skipped} (want 2 / 0)`,
+    )
+
+    const after1 = await sdk.api.tickets.getOne(queued1.id)
+    record(
+      'A2: ticket left the queue with owner and dequeue provenance set',
+      !after1.queueId && after1.owner === owner.id && !!after1.dequeuedAt && after1.dequeuedFrom === queue.id,
+      `queueId=${JSON.stringify(after1.queueId)} owner=${after1.owner} dequeuedAt=${JSON.stringify(after1.dequeuedAt)} dequeuedFrom=${after1.dequeuedFrom}`,
+    )
+
+    const countAfter = await poll_for(
+      () => sdk.api.ticket_queues.getOne(queue.id).then(q => q.count ?? 0),
+      c => c === 0,
+    )
+    record(
+      'A3: queue count decremented by the number assigned',
+      countAfter === 0,
+      `count=${countAfter} (want 0, was ${countBefore})`,
+    )
+
+    record(
+      'A4: addToCareTeam adds the new owner to the ticket enduser\'s care team',
+      !!(await sdk.api.endusers.getOne(enduser.id)).assignedTo?.includes(owner.id),
+      `assignedTo must contain ${owner.id}`,
+    )
+
+    /* ===== B: ids no longer in the queue are skipped, not re-assigned ===== */
+
+    const replayResult = await sdk.api.tickets.bulk_assign({
+      ids: [queued1.id, queued2.id], userId: owner.id, queueId: queue.id,
+    })
+    record(
+      'B1: already-dequeued ids are reported as skipped',
+      replayResult.assigned === 0 && replayResult.skipped === 2,
+      `assigned=${replayResult.assigned} skipped=${replayResult.skipped} (want 0 / 2)`,
+    )
+
+    const countAfterReplay = await sdk.api.ticket_queues.getOne(queue.id).then(q => q.count ?? 0)
+    record(
+      'B2: queue count is not decremented again when nothing was assigned',
+      countAfterReplay === 0,
+      `count=${countAfterReplay} (want 0 — a decrement here would drive it negative)`,
+    )
+
+    /* ===== C: the queue scope is honored ===== */
+
+    const otherQueue = await sdk.api.ticket_queues.createOne({
+      title: `Bulk Assign Other Queue ${RAND()}`,
+      userIds: [owner.id],
+    })
+    const inOtherQueue = await sdk.api.tickets.createOne({ title: 'BAQ other queue', queueId: otherQueue.id })
+
+    const wrongQueueResult = await sdk.api.tickets.bulk_assign({
+      ids: [inOtherQueue.id], userId: owner.id, queueId: queue.id,
+    })
+    const stillInOther = await sdk.api.tickets.getOne(inOtherQueue.id)
+    record(
+      'C1: a ticket in a different queue is not assigned when the wrong queueId is passed',
+      wrongQueueResult.assigned === 0 && stillInOther.queueId === otherQueue.id && !stillInOther.owner,
+      `assigned=${wrongQueueResult.assigned} (want 0); ticket queueId=${stillInOther.queueId} owner=${JSON.stringify(stillInOther.owner)}`,
+    )
+
+    /* ===== D: the organization-wide path, and its gate ===== */
+
+    // NO enduserId: the 'Assigned' role filter cannot match these by owner, creator, or enduser,
+    // so they are assignable only through the organization-wide queries
+    const forMember1 = await sdk.api.tickets.createOne({ title: 'BAQ member 1', queueId: queue.id })
+    const forMember2 = await sdk.api.tickets.createOne({ title: 'BAQ member 2', queueId: queue.id })
+
+    const memberResult = await sdkNonAdmin.api.tickets.bulk_assign({
+      ids: [forMember1.id, forMember2.id], userId: owner.id, queueId: queue.id,
+    }).then(r => r).catch((e: any) => ({ error: e?.message || String(e) } as any))
+
+    const memberAfter = await sdk.api.tickets.getOne(forMember1.id)
+    record(
+      'D1: a non-admin queue member can bulk assign queued tickets they do not own',
+      memberResult?.assigned === 2 && !memberAfter.queueId && memberAfter.owner === owner.id,
+      `result=${JSON.stringify(memberResult)}; ticket queueId=${JSON.stringify(memberAfter.queueId)} owner=${memberAfter.owner}`
+      + ` — 0 assigned here means the handler fell back to the owner-filtered DB`,
+    )
+
+    const forOutsider = await sdk.api.tickets.createOne({ title: 'BAQ outsider', queueId: queue.id })
+    const outsiderResult = await sdkOutsider.api.tickets.bulk_assign({
+      ids: [forOutsider.id], userId: outsider.id, queueId: queue.id,
+    }).then((r: any) => ({ resolved: r })).catch((e: any) => ({ rejected: e?.message || String(e) }))
+
+    const outsiderAfter = await sdk.api.tickets.getOne(forOutsider.id)
+    record(
+      'D2: a non-admin who is not a member of the queue is rejected',
+      !!(outsiderResult as any).rejected && outsiderAfter.queueId === queue.id && !outsiderAfter.owner,
+      `result=${JSON.stringify(outsiderResult)}; ticket queueId=${outsiderAfter.queueId} owner=${JSON.stringify(outsiderAfter.owner)}`,
+    )
+
+    /* ===== E: regression guard — the no-queueId path is unchanged ===== */
+
+    const stayQueued = await sdk.api.tickets.createOne({ title: 'BAQ not dequeued', queueId: queue.id })
+    const legacyResult = await sdk.api.tickets.bulk_assign({ ids: [stayQueued.id], userId: owner.id })
+    const stayedAfter = await sdk.api.tickets.getOne(stayQueued.id)
+    record(
+      'E1: without queueId the ticket is assigned but NOT dequeued',
+      legacyResult.assigned === 1 && stayedAfter.owner === owner.id
+        && stayedAfter.queueId === queue.id && !stayedAfter.dequeuedAt,
+      `assigned=${legacyResult.assigned}; owner=${stayedAfter.owner} queueId=${stayedAfter.queueId} dequeuedAt=${JSON.stringify(stayedAfter.dequeuedAt)}`,
+    )
+
+    // a ticket already owned by the target user is still "assigned", not counted as skipped
+    const repeatResult = await sdk.api.tickets.bulk_assign({ ids: [stayQueued.id], userId: owner.id })
+    record(
+      'E2: re-assigning to the same owner is not reported as skipped',
+      repeatResult.assigned === 1 && repeatResult.skipped === 0,
+      `assigned=${repeatResult.assigned} skipped=${repeatResult.skipped} (want 1 / 0 — matchedCount, not modifiedCount)`,
+    )
+
+    /* ===== F: another tenant's queue is invisible, even to an admin ===== */
+
+    const foreignResult = await otherTenant.sdk.api.tickets.bulk_assign({
+      ids: [forOutsider.id], userId: otherTenant.users[0].id, queueId: queue.id,
+    }).then((r: any) => ({ resolved: r })).catch((e: any) => ({ rejected: e?.message || String(e) }))
+
+    const foreignAfter = await sdk.api.tickets.getOne(forOutsider.id)
+    record(
+      'F1: another tenant cannot assign tickets out of this tenant\'s queue',
+      (foreignAfter.queueId === queue.id && !foreignAfter.owner)
+        && ((foreignResult as any).rejected || (foreignResult as any).resolved?.assigned === 0),
+      `result=${JSON.stringify(foreignResult)}; ticket queueId=${foreignAfter.queueId} owner=${JSON.stringify(foreignAfter.owner)}`,
+    )
+  } finally {
+    // Teardown BEFORE anything asserts — assert calls process.exit, which would strand these tenants.
+    for (const t of [tenant, otherTenant]) {
+      if (t) { try { await t.teardown() } catch (e) { console.error('teardown failed', e) } }
+    }
+  }
+
+  return checks
+}
+
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+export const tickets_bulk_assign_from_queue_tests = async () => {
+  assert_checks('Tickets bulk assign from queue', await tickets_bulk_assign_from_queue_checks())
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  tickets_bulk_assign_from_queue_tests()
+    .then(() => {
+      console.log("✅ Tickets bulk assign from queue test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Tickets bulk assign from queue test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/webhook_error_handling.test.ts

@@ -133,7 +133,7 @@ export const webhook_error_handling_tests = async ({ sdk, sdkNonAdmin } : { sdk:
 
     // Scenario 3 (timeout): skipped — WEBHOOK_TIMEOUT_MS is a constant (15s), not env-overridable,
     // and a 15s+ non-responding receiver would make this suite unacceptably slow.
-    // Covered by security/F-0155-webhook-timeout.test.ts via send_automation_webhook.
+    // Covered by security/webhook-timeout.test.ts via send_automation_webhook.
 
     // Scenario 4: success path unchanged — 200 logged, counter untouched
     await sdk.api.webhooks.update({ url: `${receiverBase}/success` })

package/src/tests/setup_isolated.ts

@@ -0,0 +1,170 @@
+import axios from "axios"
+
+import { assert, log_header } from "@tellescope/testing"
+
+import { Session } from "../sdk"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+/**
+ * Provisions a throwaway tenant for a test, via the API's /test-support endpoints.
+ *
+ * Why this exists alongside setup.ts: setup_tests authenticates two hand-seeded users named by
+ * TEST_EMAIL / NON_ADMIN_EMAIL against a hardcoded businessId, so running the suite requires a copy
+ * of someone's local database, and every test shares one tenant. This helper needs **no environment
+ * configuration at all** against a local API — clone, empty Mongo, run.
+ *
+ * setup.ts is deliberately untouched; existing tests keep the shared org. Use this for new tests.
+ *
+ * Isolated tests must NOT call sdk.reset_db(): it clears six global throttle namespaces, so it
+ * disturbs the rate-limit state of any concurrently running suite even though record data is
+ * tenant-scoped.
+ */
+
+const TEST_SUPPORT_HEADER = 'x-tellescope-test-support'
+
+export type IsolatedUser = {
+  id: string,
+  email: string,
+  password: string,
+  authToken: string,
+  roles: string[],
+}
+
+export type IsolatedTenant = {
+  businessId: string,
+  subdomain: string,
+  users: IsolatedUser[],
+  apiKeys: string[],
+  roles: string[],
+  /** Admin session (users[0]) */
+  sdk: Session,
+  /** Non-admin session (users[1]), when the spec provisioned one */
+  sdkNonAdmin: Session,
+  teardown: () => Promise<void>,
+}
+
+export type IsolatedTenantSpec = {
+  name?: string,
+  users?: { roles?: string[], isAdmin?: boolean }[],
+  apiKeys?: number,
+  roles?: { role: string, permissions?: any }[],
+}
+
+const post = async (path: string, body: object) => {
+  const r = await axios.request({
+    method: 'post',
+    url: `${host}/test-support${path}`,
+    // forwarded only if present — required on staging, unnecessary (and unset) locally
+    data: { ...body, ...(process.env.SERVICES_SECRET ? { servicesSecret: process.env.SERVICES_SECRET } : {}) },
+    headers: { [TEST_SUPPORT_HEADER]: '1' },
+    validateStatus: () => true,
+  })
+
+  if (r.status !== 200) {
+    // Surface the server's reason. setup.ts's bare process.exit() on missing credentials turns a
+    // misconfiguration into a silent green pass; a provisioning failure must be loud.
+    throw new Error(
+      `test-support ${path} failed (${r.status}): ${JSON.stringify(r.data)}`
+      + (r.status === 404
+        ? `\nThe route is not mounted — LOCAL is probably not "true" in the API's environment.`
+        : '')
+    )
+  }
+  return r.data
+}
+
+export const setup_isolated_tenant = async (spec: IsolatedTenantSpec = {}): Promise<IsolatedTenant> => {
+  const tenant = await post('/provision-tenant', spec)
+
+  const sessionFor = async (user?: IsolatedUser) => {
+    if (!user) return new Session({ host })
+    const session = new Session({ host, authToken: user.authToken })
+    await session.refresh_session()
+    return session
+  }
+
+  const [sdk, sdkNonAdmin] = await Promise.all([
+    sessionFor(tenant.users[0]),
+    sessionFor(tenant.users[1]),
+  ])
+
+  return {
+    ...tenant,
+    sdk,
+    sdkNonAdmin,
+    teardown: async () => { await post('/teardown-tenant', { businessId: tenant.businessId }) },
+  }
+}
+
+/** Sets the pending email-verification code for an unverified user, so a test can drive the real
+ *  submit_email_verification endpoint. The address must be a `dontsend...@tellescope.com` one. */
+export const set_email_verification_code = async (email: string, code: string) => (
+  post('/set-email-verification-code', { email, code })
+)
+
+/** Raw access, for tests that need to assert on the response of a rejected call. */
+export const test_support_request = async (path: string, body: object) => {
+  const r = await axios.request({
+    method: 'post',
+    url: `${host}/test-support${path}`,
+    data: { ...body, ...(process.env.SERVICES_SECRET ? { servicesSecret: process.env.SERVICES_SECRET } : {}) },
+    headers: { [TEST_SUPPORT_HEADER]: '1' },
+    validateStatus: () => true,
+  })
+  return { status: r.status, body: r.data }
+}
+
+/* ============================ isolated-test result plumbing ============================ */
+
+export type Check = { label: string, pass: boolean, detail: string }
+
+/** Prints a suite's evidence table, then asserts. Split out so the assert phase can be deferred until
+ *  after every concurrent suite has torn down — see run_isolated_in_parallel. */
+export const assert_checks = (name: string, checks: Check[]) => {
+  console.log(`\n  ${name} check summary:`)
+  for (const c of checks) {
+    console.log(`    ${c.pass ? 'PASS' : 'FAIL'}  ${c.label}  —  ${c.detail}`)
+  }
+  console.log('')
+
+  for (const c of checks) {
+    assert(c.pass, `${c.label} — ${c.detail}`, c.label)
+  }
+}
+
+/**
+ * Runs isolated test bodies CONCURRENTLY.
+ *
+ * Why this exists rather than a bare Promise.all: the harness's `assert` calls process.exit(1) on
+ * failure, and process.exit does not run pending `finally` blocks. So if one suite asserted while
+ * another was still in flight, the other's teardown would never run and its provisioned tenants would
+ * be stranded permanently (nothing in the system can delete an organization record). `assert` also
+ * exits rather than throwing, so Promise.allSettled cannot recover it either.
+ *
+ * The contract that makes concurrency safe: each `run` collects Check[] and tears down its OWN tenants
+ * in a finally, and never asserts. Nothing here asserts until every suite has settled.
+ *
+ * Each suite's table prints as one non-yielding burst, so concurrent output stays readable.
+ */
+export const run_isolated_in_parallel = async (
+  suites: { name: string, run: () => Promise<Check[]> }[],
+) => {
+  log_header(`Isolated (parallel): ${suites.map(s => s.name).join(' | ')}`)
+
+  const settled = await Promise.allSettled(suites.map(s => s.run()))
+
+  // Surface an infrastructure failure (a throw, not a failed check) before asserting anything, so the
+  // reason isn't buried under another suite's table.
+  const rejected = settled.flatMap((r, i) => r.status === 'rejected' ? [{ name: suites[i].name, reason: r.reason }] : [])
+  for (const { name, reason } of rejected) {
+    console.error(`  ${name} threw before producing checks:`, reason)
+  }
+  if (rejected.length) throw rejected[0].reason
+
+  for (let i = 0; i < settled.length; i++) {
+    const r = settled[i]
+    if (r.status !== 'fulfilled') continue
+    assert_checks(suites[i].name, r.value)
+  }
+}

package/src/tests/tests.ts

@@ -112,29 +112,34 @@ import { nutrition_tracking_tests } from "./api_tests/nutrition_tracking.test";
 import { no_access_permission_checks_tests } from "./api_tests/no_access_permission_checks.test";
 import { resource_access_tags_tests } from "./api_tests/resource_access_tags.test";
 import { field_redaction_tests } from "./api_tests/field_redaction.test";
-import { data_sync_redaction_bypass_tests } from "./api_tests/security/F-0001-data-sync-redaction-bypass.test";
-import { enduser_write_restrictions_tests } from "./api_tests/security/F-0106-F-0110-enduser-write-restrictions.test";
-import { ai_conversations_rbac_tests } from "./api_tests/security/F-0005-ai-conversations-rbac.test";
-import { develop_health_benefit_verification_rbac_tests } from "./api_tests/security/F-0006-develop-health-benefit-verification-rbac.test";
-import { cascade_role_rename_cross_tenant_tests } from "./api_tests/security/F-0053-cascade-role-rename-cross-tenant.test";
-import { self_admin_role_assignment_tests } from "./api_tests/security/F-0076-self-admin-role-assignment.test";
-import { invite_user_enumeration_tests } from "./api_tests/security/F-0007-invite-user-enumeration.test";
+import { data_sync_redaction_bypass_tests } from "./api_tests/security/data-sync-redaction-bypass.test";
+import { enduser_write_restrictions_tests } from "./api_tests/security/enduser-write-restrictions.test";
+import { ai_conversations_rbac_tests } from "./api_tests/security/ai-conversations-rbac.test";
+import { develop_health_benefit_verification_rbac_tests } from "./api_tests/security/develop-health-benefit-verification-rbac.test";
+import { cascade_role_rename_cross_tenant_tests } from "./api_tests/security/cascade-role-rename-cross-tenant.test";
+import { self_admin_role_assignment_tests } from "./api_tests/security/self-admin-role-assignment.test";
+import { invite_user_enumeration_tests } from "./api_tests/security/invite-user-enumeration.test";
 import { register_business_id_injection_tests } from "./api_tests/security/register_business_id_injection.test";
-import { handle_incoming_communication_cross_tenant_tests } from "./api_tests/security/F-0008-handle-incoming-communication-cross-tenant.test";
-import { sanitize_user_html_xss_tests } from "./api_tests/security/F-0013-sanitize-user-html.test";
-import { sanitize_user_html_with_iframes_tests } from "./api_tests/security/F-0013-sanitize-user-html-with-iframes.test";
-import { prototype_pollution_tests } from "./api_tests/security/F-0016-prototype-pollution.test";
-import { enduser_cross_create_tests } from "./api_tests/security/F-0116-F-0119-enduser-cross-create.test";
-import { globalunique_leak_tests } from "./api_tests/security/F-0145-globalunique-leak.test";
-import { load_inbox_redaction_tests } from "./api_tests/security/F-0151-load-inbox-redaction.test";
+import { handle_incoming_communication_cross_tenant_tests } from "./api_tests/security/handle-incoming-communication-cross-tenant.test";
+import { sanitize_user_html_xss_tests } from "./api_tests/security/sanitize-user-html.test";
+import { sanitize_user_html_with_iframes_tests } from "./api_tests/security/sanitize-user-html-with-iframes.test";
+import { prototype_pollution_tests } from "./api_tests/security/prototype-pollution.test";
+import { enduser_cross_create_tests } from "./api_tests/security/enduser-cross-create.test";
+import { globalunique_leak_tests } from "./api_tests/security/globalunique-conflict-redaction.test";
+import { load_inbox_redaction_tests } from "./api_tests/security/load-inbox-redaction.test";
 import { suggested_reply_redaction_tests } from "./api_tests/security/suggested-reply-redaction.test";
-import { webhook_timeout_tests } from "./api_tests/security/F-0155-webhook-timeout.test";
+import { webhook_timeout_tests } from "./api_tests/security/webhook-timeout.test";
 import { enduser_ai_summary_trust_gate_tests } from "./api_tests/security/enduser-ai-summary-trust-gate.test";
-import { allowed_paths_confinement_tests } from "./api_tests/security/F-0166-allowed-paths-wildcard-bypass.test";
-import { proxy_image_ssrf_tests } from "./api_tests/security/F-0025-proxy-image-unauth-ssrf.test";
-import { webhook_outbound_ssrf_tests } from "./api_tests/security/F-0015-webhook-outbound-ssrf.test";
+import { allowed_paths_confinement_tests } from "./api_tests/security/allowed-paths-confinement.test";
+import { proxy_image_ssrf_tests } from "./api_tests/security/proxy-image-unauth-ssrf.test";
+import { webhook_outbound_ssrf_tests } from "./api_tests/security/webhook-outbound-ssrf.test";
 import { public_endpoint_auth_field_lock_tests } from "./api_tests/security/public_endpoint_auth_field_lock.test";
 import { formsort_webhook_auth_field_lock_tests } from "./api_tests/security/formsort_webhook_auth_field_lock.test";
+import { booking_info_idor_tests } from "./api_tests/security/booking-info-idor-token-mint.test";
+import { automated_actions_process_gate_tests } from "./api_tests/security/automated-actions-process-gate.test";
+import { schema_adminonly_enforcement_tests } from "./api_tests/security/schema-adminonly-enforcement.test";
+import { startlinktoken_escalation_tests } from "./api_tests/security/startlinktoken-enduser-staff-escalation.test";
+import { form_logic_js_execution_checks } from "./api_tests/security/form-logic-js-execution.test";
 import { bulk_assignment_tests } from "./api_tests/bulk_assignment.test";
 import { tickets_bulk_assign_care_team_tests } from "./api_tests/tickets_bulk_assign_care_team.test";
 import { managed_content_enduser_access_tests } from "./api_tests/managed_content_enduser_access.test";
@@ -152,6 +157,13 @@ import { dont_sync_to_elation_form_submission_tests } from "./api_tests/dont_syn
 import { medication_added_trigger_tests } from "./api_tests/medication_added_trigger.test";
 import { conditional_logic_medication_unit_tests } from "./unit_tests/conditional_logic_medication.test";
 import { phone_validation_unit_tests } from "./unit_tests/phone_validation.test";
+import { openapi_spec_freshness_unit_tests } from "./unit_tests/openapi_spec_freshness.test";
+import { do_not_send_address_unit_tests } from "./unit_tests/do_not_send_address.test";
+import { organization_signup_checks } from "./api_tests/organization_signup.test";
+import { add_to_journey_foreign_enduserid_checks } from "./api_tests/security/add-to-journey-foreign-enduserid.test";
+import { tickets_bulk_assign_from_queue_checks } from "./api_tests/tickets_bulk_assign_from_queue.test";
+import { enduser_observations_auto_review_checks } from "./api_tests/enduser_observations_auto_review.test";
+import { run_isolated_in_parallel } from "./setup_isolated";
 import { elation_user_id_tests } from "./api_tests/elation_user_id.test";
 import { organization_settings_duplicates_tests } from "./api_tests/organization_settings_duplicates.test";
 import { stedi_approval_tests } from "./api_tests/stedi_approval.test";
@@ -10893,6 +10905,19 @@ export const form_conditional_logic_tests = async () => {
   run_conditional_form_test({ $and: [{ condition: { [FORM_LOGIC_CALCULATED_FIELDS[0]]: { $exists: true } } }] }, true)
   run_conditional_form_test({ $and: [{ condition: { [FORM_LOGIC_CALCULATED_FIELDS[0]]: { $gt: 25 } } }] }, true)
   run_conditional_form_test({ $and: [{ condition: { [FORM_LOGIC_CALCULATED_FIELDS[0]]: { $lt: 25 } } }] }, false)
+
+  // A $JS(...) condition value was previously compiled and executed with new Function().
+  // These must evaluate to false (parseInt -> NaN -> no match), and must never be executed.
+  // The values are typed `number` on BasicFilter but are strings in stored data, hence the casts.
+  delete (globalThis as any).__F0200
+  run_conditional_form_test({ $and: [{ condition: { '3': { $gt: '$JS(return 0)' as any } } }] }, false, '$gt $JS not evaluated')
+  run_conditional_form_test({ $and: [{ condition: { '3': { $lt: '$JS(return 99999)' as any } } }] }, false, '$lt $JS not evaluated')
+  run_conditional_form_test({ $and: [{ condition: { '3': { $gt: '$JS(globalThis.__F0200 = 1; return 0)' as any } } }] }, false, '$JS side effect not evaluated')
+  assert(
+    (globalThis as any).__F0200 === undefined,
+    'a $JS(...) condition value was executed',
+    '$JS payload never executed',
+  )
 }
 
 export const enduser_conditional_logic_tests = async () => {
@@ -15363,11 +15388,24 @@ const ip_address_form_tests = async () => {
     await enduser_conditional_logic_tests()
     await conditional_logic_medication_unit_tests()
     await phone_validation_unit_tests()
+    await openapi_spec_freshness_unit_tests()
+    await do_not_send_address_unit_tests()
     await replace_enduser_template_values_tests()
     await safe_json_parse_template_tests()
     await replace_form_field_template_values_tests()
     await mfa_tests()
     await setup_tests(sdk, sdkNonAdmin)
+    // Isolated, tenant-provisioned suites run first and CONCURRENTLY: each provisions its own
+    // throwaway tenant via /test-support, so they cannot collide with each other or with the
+    // shared fixture. Both collect Check[] and tear down before anything asserts — assert calls
+    // process.exit, which would otherwise strand the other suite's tenants.
+    await run_isolated_in_parallel([
+      { name: 'Organization signup', run: organization_signup_checks },
+      { name: 'add_to_journey foreign enduserId', run: add_to_journey_foreign_enduserid_checks },
+      { name: 'Tickets bulk assign from queue', run: tickets_bulk_assign_from_queue_checks },
+      { name: 'Vital auto-review on create', run: enduser_observations_auto_review_checks },
+      { name: '$JS in stored conditional logic', run: form_logic_js_execution_checks },
+    ])
     await embeddables_auth_token_tests({ sdk, sdkNonAdmin })
     await proxy_image_ssrf_tests({ sdk, sdkNonAdmin })
     await webhook_outbound_ssrf_tests({ sdk, sdkNonAdmin })
@@ -15387,6 +15425,10 @@ const ip_address_form_tests = async () => {
     await enduser_write_restrictions_tests({ sdk, sdkNonAdmin })
     await enduser_ai_summary_trust_gate_tests({ sdk, sdkNonAdmin })
     await enduser_cross_create_tests({ sdk, sdkNonAdmin })
+    await booking_info_idor_tests({ sdk, sdkNonAdmin })
+    await automated_actions_process_gate_tests({ sdk, sdkNonAdmin })
+    await schema_adminonly_enforcement_tests({ sdk, sdkNonAdmin })
+    await startlinktoken_escalation_tests({ sdk, sdkNonAdmin })
     await globalunique_leak_tests({ sdk, sdkNonAdmin })
     await load_inbox_redaction_tests({ sdk, sdkNonAdmin })
     await suggested_reply_redaction_tests({ sdk, sdkNonAdmin })

package/src/tests/unit_tests/do_not_send_address.test.ts

@@ -0,0 +1,60 @@
+require('source-map-support').install();
+
+import {
+  assert,
+  log_header,
+} from "@tellescope/testing"
+
+/**
+ * The email-suppression predicate from packages/private/api/api/modules/sqs.ts.
+ *
+ * Mirrored here rather than imported: the API is a private package the SDK does not depend on. The
+ * point of the test is to pin the CONTRACT — prefix AND domain both required — because the guard is
+ * otherwise unobservable from a test (a suppressed message simply never reaches SQS), and because
+ * loosening it in either direction would start suppressing real mail or start sending test mail.
+ *
+ * If this drifts from sqs.ts, that is the signal to look at why.
+ */
+const is_do_not_send_address = (emailAddress?: string) => (
+  !!emailAddress && emailAddress.endsWith('@tellescope.com') && emailAddress.startsWith('dontsend')
+)
+
+export const do_not_send_address_unit_tests = async () => {
+  log_header("Do-not-send address predicate")
+
+  const cases: [string | undefined, boolean, string][] = [
+    ['dontsend@tellescope.com', true, 'exact prefix and domain'],
+    ['dontsend-signup-ab12@tellescope.com', true, 'suffixed local part (what provisioning generates)'],
+    ['dontsend3@tellescope.com', true, 'numbered variant already used by the suite'],
+
+    // near misses — both halves are load-bearing
+    ['dontsend@example.com', false, 'right prefix, wrong domain: must NOT suppress'],
+    ['realuser@tellescope.com', false, 'right domain, wrong prefix: must NOT suppress'],
+    ['notdontsend@tellescope.com', false, 'prefix must be at the START, not anywhere'],
+    ['dontsend@tellescope.com.evil.com', false, 'domain must be a suffix, not a substring'],
+
+    [undefined, false, 'undefined is not suppressed (and must not throw)'],
+    ['', false, 'empty string is not suppressed'],
+  ]
+
+  for (const [input, expected, why] of cases) {
+    assert(
+      is_do_not_send_address(input) === expected,
+      `${JSON.stringify(input)} should be ${expected ? 'suppressed' : 'sent'} — ${why}`,
+      `${JSON.stringify(input)} -> ${expected ? 'suppressed' : 'sent'} (${why})`,
+    )
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  do_not_send_address_unit_tests()
+    .then(() => {
+      console.log("✅ Do-not-send address predicate tests completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Do-not-send address predicate tests failed:", error)
+      process.exit(1)
+    })
+}