@tellescope/sdk 1.256.14 → 1.256.15

package/src/tests/api_tests/purchase_made_trigger.test.ts

@@ -1,5 +1,5 @@
 import { Session } from "../../sdk"
-import { log_header, wait, async_test } from "@tellescope/testing"
+import { log_header, async_test, poll_for_results } from "@tellescope/testing"
 import { Enduser } from "@tellescope/types-client"
 import { setup_tests } from "../setup"
 
@@ -8,6 +8,14 @@ const host = process.env.API_URL || "http://localhost:8080"
 export const purchase_made_trigger_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
   log_header("Automation Trigger Tests (Purchase Made)")
 
+  // Trigger handling is fire-and-forget, and triggers apply newest-first, so the oldest matching
+  // trigger's tag lands last — a fixed sleep races it. Same approach as poll_for_tag in
+  // stripe_webhook_triggers.test.ts.
+  const enduser_with_tags = (enduserId: string, tags: string[]) => poll_for_results(
+    () => sdk.api.endusers.getOne(enduserId),
+    e => tags.every(t => e.tags?.includes(t)),
+  )
+
   // Create products for testing
   const product1 = await sdk.api.products.createOne({
     title: 'Premium Course Package',
@@ -150,10 +158,9 @@ export const purchase_made_trigger_tests = async ({ sdk, sdkNonAdmin } : { sdk:
     cost: { amount: 9999, currency: 'USD' },
     processor: 'Stripe'
   })
-  await wait(undefined, 500) // Brief wait for trigger processing
   await async_test(
     "Purchase Made - Any Purchase",
-    () => sdk.api.endusers.getOne(enduser1.id),
+    () => enduser_with_tags(enduser1.id, ['Purchase-Any']),
     { onResult: (e: Enduser) => !!e.tags?.includes('Purchase-Any') }
   )
 
@@ -165,10 +172,9 @@ export const purchase_made_trigger_tests = async ({ sdk, sdkNonAdmin } : { sdk:
     cost: { amount: 9999, currency: 'USD' },
     processor: 'Stripe'
   })
-  await wait(undefined, 500)
   await async_test(
     "Purchase Made - Exact Title Match",
-    () => sdk.api.endusers.getOne(enduser2.id),
+    () => enduser_with_tags(enduser2.id, ['Purchase-Exact-Title']),
     { onResult: (e: Enduser) => !!e.tags?.includes('Purchase-Exact-Title') }
   )
 
@@ -180,10 +186,9 @@ export const purchase_made_trigger_tests = async ({ sdk, sdkNonAdmin } : { sdk:
     cost: { amount: 4999, currency: 'USD' },
     processor: 'Stripe'
   })
-  await wait(undefined, 500)
   await async_test(
     "Purchase Made - Product ID Match",
-    () => sdk.api.endusers.getOne(enduser3.id),
+    () => enduser_with_tags(enduser3.id, ['Purchase-Product-ID']),
     { onResult: (e: Enduser) => !!e.tags?.includes('Purchase-Product-ID') }
   )
 
@@ -195,10 +200,9 @@ export const purchase_made_trigger_tests = async ({ sdk, sdkNonAdmin } : { sdk:
     cost: { amount: 9999, currency: 'USD' },
     processor: 'Stripe'
   })
-  await wait(undefined, 500)
   await async_test(
     "Purchase Made - Partial Title Match (case insensitive 'course')",
-    () => sdk.api.endusers.getOne(enduser4.id),
+    () => enduser_with_tags(enduser4.id, ['Purchase-Partial-Course']),
     { onResult: (e: Enduser) => !!e.tags?.includes('Purchase-Partial-Course') }
   )
 
@@ -210,10 +214,9 @@ export const purchase_made_trigger_tests = async ({ sdk, sdkNonAdmin } : { sdk:
     cost: { amount: 14999, currency: 'USD' },
     processor: 'Stripe'
   })
-  await wait(undefined, 500)
   await async_test(
     "Purchase Made - Partial Title Match (case insensitive 'ANALYTICS')",
-    () => sdk.api.endusers.getOne(enduser5.id),
+    () => enduser_with_tags(enduser5.id, ['Purchase-Partial-Analytics']),
     { onResult: (e: Enduser) => !!e.tags?.includes('Purchase-Partial-Analytics') }
   )
 
@@ -225,10 +228,9 @@ export const purchase_made_trigger_tests = async ({ sdk, sdkNonAdmin } : { sdk:
     cost: { amount: 4999, currency: 'USD' },
     processor: 'Stripe'
   })
-  await wait(undefined, 500)
   await async_test(
     "Purchase Made - No Partial Title Match",
-    () => sdk.api.endusers.getOne(enduser6.id),
+    () => enduser_with_tags(enduser6.id, ['Purchase-Any']),
     { onResult: (e: Enduser) => !!e.tags?.includes('Purchase-Any') && !e.tags?.includes('Purchase-Partial-Course') && !e.tags?.includes('Purchase-Partial-Analytics') }
   )
 
@@ -240,10 +242,9 @@ export const purchase_made_trigger_tests = async ({ sdk, sdkNonAdmin } : { sdk:
     cost: { amount: 9999, currency: 'USD' },
     processor: 'Stripe'
   })
-  await wait(undefined, 500)
   await async_test(
     "Purchase Made - Mixed Case Partial Title Match",
-    () => sdk.api.endusers.getOne(enduser7.id),
+    () => enduser_with_tags(enduser7.id, ['Purchase-Partial-Course']),
     { onResult: (e: Enduser) => !!e.tags?.includes('Purchase-Partial-Course') }
   )
 
@@ -255,10 +256,9 @@ export const purchase_made_trigger_tests = async ({ sdk, sdkNonAdmin } : { sdk:
     cost: { amount: 9999, currency: 'USD' },
     processor: 'Stripe'
   })
-  await wait(undefined, 500)
   await async_test(
     "Purchase Made - Multiple Partial Matches (matches 'premium')",
-    () => sdk.api.endusers.getOne(enduser8.id),
+    () => enduser_with_tags(enduser8.id, ['Purchase-Multiple-Partial']),
     { onResult: (e: Enduser) => !!e.tags?.includes('Purchase-Multiple-Partial') }
   )
 
@@ -270,10 +270,9 @@ export const purchase_made_trigger_tests = async ({ sdk, sdkNonAdmin } : { sdk:
     cost: { amount: 14999, currency: 'USD' },
     processor: 'Stripe'
   })
-  await wait(undefined, 500)
   await async_test(
     "Purchase Made - Multiple Partial Matches (matches 'advanced')",
-    () => sdk.api.endusers.getOne(enduser9.id),
+    () => enduser_with_tags(enduser9.id, ['Purchase-Multiple-Partial']),
     { onResult: (e: Enduser) => !!e.tags?.includes('Purchase-Multiple-Partial') }
   )
 
@@ -285,10 +284,9 @@ export const purchase_made_trigger_tests = async ({ sdk, sdkNonAdmin } : { sdk:
     cost: { amount: 9999, currency: 'USD' },
     processor: 'Stripe'
   })
-  await wait(undefined, 500)
   await async_test(
     "Purchase Made - Case Insensitive (lowercase filter 'mixed' matches 'MIXED')",
-    () => sdk.api.endusers.getOne(enduser10.id),
+    () => enduser_with_tags(enduser10.id, ['Purchase-Case-Test']),
     { onResult: (e: Enduser) => !!e.tags?.includes('Purchase-Case-Test') }
   )
 
@@ -300,10 +298,9 @@ export const purchase_made_trigger_tests = async ({ sdk, sdkNonAdmin } : { sdk:
     cost: { amount: 4999, currency: 'USD' },
     processor: 'Stripe'
   })
-  await wait(undefined, 500)
   await async_test(
     "Purchase Made - Case Insensitive (uppercase filter 'UPPER' matches 'upper')",
-    () => sdk.api.endusers.getOne(enduser11.id),
+    () => enduser_with_tags(enduser11.id, ['Purchase-Case-Test']),
     { onResult: (e: Enduser) => !!e.tags?.includes('Purchase-Case-Test') }
   )
 
@@ -315,10 +312,9 @@ export const purchase_made_trigger_tests = async ({ sdk, sdkNonAdmin } : { sdk:
     cost: { amount: 14999, currency: 'USD' },
     processor: 'Stripe'
   })
-  await wait(undefined, 500)
   await async_test(
     "Purchase Made - Case Insensitive (mixed case filter 'MiXeD' matches 'MiXeD')",
-    () => sdk.api.endusers.getOne(enduser12.id),
+    () => enduser_with_tags(enduser12.id, ['Purchase-Case-Test']),
     { onResult: (e: Enduser) => !!e.tags?.includes('Purchase-Case-Test') }
   )
 
@@ -330,10 +326,9 @@ export const purchase_made_trigger_tests = async ({ sdk, sdkNonAdmin } : { sdk:
     cost: { amount: 9999, currency: 'USD' },
     processor: 'Stripe'
   })
-  await wait(undefined, 500)
   await async_test(
     "Purchase Made - Empty titlePartialMatches Array (should trigger like any purchase)",
-    () => sdk.api.endusers.getOne(enduser13.id),
+    () => enduser_with_tags(enduser13.id, ['Purchase-Empty-Array', 'Purchase-Any']),
     { onResult: (e: Enduser) => !!e.tags?.includes('Purchase-Empty-Array') && !!e.tags?.includes('Purchase-Any') }
   )
 
@@ -345,10 +340,9 @@ export const purchase_made_trigger_tests = async ({ sdk, sdkNonAdmin } : { sdk:
     cost: { amount: 4999, currency: 'USD' },
     processor: 'Stripe'
   })
-  await wait(undefined, 500)
   await async_test(
     "Purchase Made - Empty Title (should not trigger partial match filters)",
-    () => sdk.api.endusers.getOne(enduser14.id),
+    () => enduser_with_tags(enduser14.id, ['Purchase-Any']),
     { onResult: (e: Enduser) => !!e.tags?.includes('Purchase-Any') && !e.tags?.includes('Purchase-No-Title-Test') }
   )
 
@@ -360,10 +354,9 @@ export const purchase_made_trigger_tests = async ({ sdk, sdkNonAdmin } : { sdk:
     processor: 'Stripe',
     couponCodes: ['SUMMER20'],
   })
-  await wait(undefined, 500)
   await async_test(
     "Purchase Made - Coupon Code Match (exact)",
-    () => sdk.api.endusers.getOne(enduser15.id),
+    () => enduser_with_tags(enduser15.id, ['Purchase-Coupon-Summer20', 'Purchase-Coupon-Empty']),
     { onResult: (e: Enduser) => !!e.tags?.includes('Purchase-Coupon-Summer20') && !!e.tags?.includes('Purchase-Coupon-Empty') }
   )
 
@@ -376,10 +369,9 @@ export const purchase_made_trigger_tests = async ({ sdk, sdkNonAdmin } : { sdk:
     processor: 'Stripe',
     couponCodes: ['summer20'],
   })
-  await wait(undefined, 500)
   await async_test(
     "Purchase Made - Coupon Code Case Mismatch (case sensitive, 'summer20' vs 'SUMMER20')",
-    () => sdk.api.endusers.getOne(enduser16.id),
+    () => enduser_with_tags(enduser16.id, ['Purchase-Any']),
     { onResult: (e: Enduser) => !!e.tags?.includes('Purchase-Any') && !e.tags?.includes('Purchase-Coupon-Summer20') }
   )
 
@@ -391,10 +383,9 @@ export const purchase_made_trigger_tests = async ({ sdk, sdkNonAdmin } : { sdk:
     processor: 'Stripe',
     couponCodes: ['WINTER10'],
   })
-  await wait(undefined, 500)
   await async_test(
     "Purchase Made - Non-matching Coupon Code",
-    () => sdk.api.endusers.getOne(enduser17.id),
+    () => enduser_with_tags(enduser17.id, ['Purchase-Any']),
     { onResult: (e: Enduser) => !!e.tags?.includes('Purchase-Any') && !e.tags?.includes('Purchase-Coupon-Summer20') }
   )
 
@@ -406,10 +397,9 @@ export const purchase_made_trigger_tests = async ({ sdk, sdkNonAdmin } : { sdk:
     cost: { amount: 9999, currency: 'USD' },
     processor: 'Stripe',
   })
-  await wait(undefined, 500)
   await async_test(
     "Purchase Made - No Coupon Data (backward compat)",
-    () => sdk.api.endusers.getOne(enduser18.id),
+    () => enduser_with_tags(enduser18.id, ['Purchase-Any', 'Purchase-Coupon-Empty']),
     { onResult: (e: Enduser) => !!e.tags?.includes('Purchase-Any') && !!e.tags?.includes('Purchase-Coupon-Empty') && !e.tags?.includes('Purchase-Coupon-Summer20') }
   )
 
@@ -421,10 +411,9 @@ export const purchase_made_trigger_tests = async ({ sdk, sdkNonAdmin } : { sdk:
     processor: 'Stripe',
     couponCodes: ['SUMMER20'],
   })
-  await wait(undefined, 500)
   await async_test(
     "Purchase Made - Title AND Coupon Match",
-    () => sdk.api.endusers.getOne(enduser19.id),
+    () => enduser_with_tags(enduser19.id, ['Purchase-Title-And-Coupon']),
     { onResult: (e: Enduser) => !!e.tags?.includes('Purchase-Title-And-Coupon') }
   )
 
@@ -435,10 +424,9 @@ export const purchase_made_trigger_tests = async ({ sdk, sdkNonAdmin } : { sdk:
     cost: { amount: 9999, currency: 'USD' },
     processor: 'Stripe',
   })
-  await wait(undefined, 500)
   await async_test(
     "Purchase Made - Title Matches But Coupon Missing (AND semantics)",
-    () => sdk.api.endusers.getOne(enduser20.id),
+    () => enduser_with_tags(enduser20.id, ['Purchase-Exact-Title']),
     { onResult: (e: Enduser) => !!e.tags?.includes('Purchase-Exact-Title') && !e.tags?.includes('Purchase-Title-And-Coupon') }
   )
 

package/src/tests/api_tests/security/{F-0196-add-to-journey-foreign-enduserid.test.ts → add-to-journey-foreign-enduserid.test.ts}

@@ -14,8 +14,7 @@ const RAND = () => Math.random().toString(36).slice(2, 10)
 const FUTURE_START = () => new Date(Date.now() + 60 * 60 * 1000)
 
 /**
- * Regression test for F-0196
- * (security-audit/findings/F-0196-add-to-journey-plants-foreign-enduserid.md).
+ * Regression test: `endusers.add_to_journey` must not enroll another tenant's enduser.
  *
  * `endusers.add_to_journey` inserted an `automated_actions` row for EACH caller-supplied `enduserId`
  * with only mongoId-shape validation and no tenant-membership check. The preceding
@@ -25,10 +24,10 @@ const FUTURE_START = () => new Date(Date.now() + 60 * 60 * 1000)
  * `businessId: <caller's tenant>` while carrying `enduserId: <a victim in another tenant>`.
  *
  * The worker then dereferences that enduser with the raw driver and no `businessId`
- * (worker/modules/automations.ts, the F-0074/F-0111/F-0159 family), so the victim's record loads
+ * (worker/modules/automations.ts, the worker's unscoped raw-driver lookup family), so the victim's record loads
  * under the attacker's automation: `pushFormsToPortal` copies the victim's PHI into the attacker's
  * `form_responses` (readable by their staff) and `iterableCustomEvent` writes an attacker-authored
- * note into the victim's chart. F-0196 is the reachability that made those three exploitable.
+ * note into the victim's chart. This plant is the reachability that made those three exploitable.
  *
  * There are TWO independent plant sites and a fix to only one is a half fix:
  *   - inline branch, taken when `automationStepId` is supplied (api.ts add_to_journey handler)
@@ -190,7 +189,7 @@ export const add_to_journey_foreign_enduserid_checks = async (): Promise<Check[]
 
 /** Asserting wrapper, for standalone runs and for sequential use in the suite. */
 export const add_to_journey_foreign_enduserid_tests = async () => {
-  assert_checks('F-0196 add_to_journey foreign enduserId', await add_to_journey_foreign_enduserid_checks())
+  assert_checks('add_to_journey foreign enduserId', await add_to_journey_foreign_enduserid_checks())
 }
 
 // Allow running this test file independently
@@ -198,11 +197,11 @@ if (require.main === module) {
   console.log(`🌐 Using API URL: ${host}`)
   add_to_journey_foreign_enduserid_tests()
     .then(() => {
-      console.log("✅ F-0196 add_to_journey foreign enduserId test suite completed successfully")
+      console.log("✅ add_to_journey foreign enduserId test suite completed successfully")
       process.exit(0)
     })
     .catch((error) => {
-      console.error("❌ F-0196 add_to_journey foreign enduserId test suite failed:", error)
+      console.error("❌ add_to_journey foreign enduserId test suite failed:", error)
       process.exit(1)
     })
 }

package/src/tests/api_tests/security/{F-0005-ai-conversations-rbac.test.ts → ai-conversations-rbac.test.ts}

@@ -14,7 +14,7 @@ const host = process.env.API_URL || 'http://localhost:8080' as const
 const [nonAdminEmail, nonAdminPassword] = [process.env.NON_ADMIN_EMAIL, process.env.NON_ADMIN_PASSWORD]
 
 /**
- * Regression test for F-0005 (security-audit/findings/F-0005-ai-conversations-bypass-rbac.md).
+ * Regression test: `ai_conversations` RBAC.
  *
  * Both `ai_conversations.send_message` and `ai_conversations.generate_ai_decision` are
  * registered with `noAccessPermissions: true` ([api.ts:22699, 22721](packages/private/api/api/v1/api.ts)).
@@ -46,7 +46,7 @@ const [nonAdminEmail, nonAdminPassword] = [process.env.NON_ADMIN_EMAIL, process.
  * Post-fix: both endpoints throw 403 before any work happens. Test passes.
  */
 export const ai_conversations_rbac_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("F-0005: ai_conversations RBAC bypass regression")
+  log_header("ai_conversations RBAC bypass regression")
 
   const roleName = `f0005-ai-conversations-no-access-${Date.now()}`
   const grantRoleName = `f0005-ai-conversations-create-granted-${Date.now()}`
@@ -83,9 +83,9 @@ export const ai_conversations_rbac_tests = async ({ sdk, sdkNonAdmin } : { sdk:
     // 3a. send_message must throw 403 (or equivalent access error). Pre-fix: succeeds (or
     //     fails downstream in Bedrock without 403). Post-fix: throws before any work.
     await async_test(
-      "F-0005: ai_conversations.send_message must throw 403 when role denies ai_conversations",
+      "ai_conversations.send_message must throw 403 when role denies ai_conversations",
       () => sdkNonAdmin.api.ai_conversations.send_message({
-        message: 'F-0005 regression test',
+        message: 'regression test',
         type: 'Test',
       } as any),
       {
@@ -105,12 +105,12 @@ export const ai_conversations_rbac_tests = async ({ sdk, sdkNonAdmin } : { sdk:
     //     Pre-fix: handler responds 200 with {} immediately and processes in background.
     //     Post-fix: handler throws 403 before res.json({}).
     await async_test(
-      "F-0005: ai_conversations.generate_ai_decision must throw 403 when role denies endusers/ai_conversations",
+      "ai_conversations.generate_ai_decision must throw 403 when role denies endusers/ai_conversations",
       () => sdkNonAdmin.api.ai_conversations.generate_ai_decision({
         enduserId: new ObjectId().toHexString(),        // fake id — access check should fire first
         automationStepId: new ObjectId().toHexString(),  // fake id — access check should fire first
         outcomes: ['yes', 'no'],
-        prompt: 'F-0005 regression test',
+        prompt: 'regression test',
         sources: [{ type: 'SMS', limit: 1 }],            // non-empty so the validator passes; access check then fires
       } as any),
       {
@@ -145,9 +145,9 @@ export const ai_conversations_rbac_tests = async ({ sdk, sdkNonAdmin } : { sdk:
     await sdkNonAdmin.authenticate(nonAdminEmail!, nonAdminPassword!)
 
     await async_test(
-      "F-0005: ai_conversations.send_message must NOT be access-denied when role grants create",
+      "ai_conversations.send_message must NOT be access-denied when role grants create",
       () => sdkNonAdmin.api.ai_conversations.send_message({
-        message: 'F-0005 positive-case test',
+        message: 'positive-case test',
         type: 'Test',
         maxTokens: 1,
       } as any)
@@ -168,9 +168,9 @@ export const ai_conversations_rbac_tests = async ({ sdk, sdkNonAdmin } : { sdk:
     //    existing conversation — send_message with conversationId returns the full stored history
     //    and appends to it. Fake id is fine: the access check must fire before any lookup.
     await async_test(
-      "F-0005: ai_conversations.send_message with conversationId must 403 when role denies read/update",
+      "ai_conversations.send_message with conversationId must 403 when role denies read/update",
       () => sdkNonAdmin.api.ai_conversations.send_message({
-        message: 'F-0005 conversationId bypass test',
+        message: 'conversationId bypass test',
         type: 'Test',
         maxTokens: 1,
         conversationId: new ObjectId().toHexString(),
@@ -205,9 +205,9 @@ export const ai_conversations_rbac_tests = async ({ sdk, sdkNonAdmin } : { sdk:
     await sdkNonAdmin.authenticate(nonAdminEmail!, nonAdminPassword!)
 
     await async_test(
-      "F-0005: ai_conversations.send_message must not 500 for Assigned-access (default provider) role",
+      "ai_conversations.send_message must not 500 for Assigned-access (default provider) role",
       () => sdkNonAdmin.api.ai_conversations.send_message({
-        message: 'F-0005 assigned-access regression test',
+        message: 'assigned-access regression test',
         type: 'Test',
         maxTokens: 1,
       } as any)
@@ -267,11 +267,11 @@ if (require.main === module) {
 
   runTests()
     .then(() => {
-      console.log("✅ F-0005 ai_conversations RBAC test suite completed successfully")
+      console.log("✅ ai_conversations RBAC test suite completed successfully")
       process.exit(0)
     })
     .catch((error) => {
-      console.error("❌ F-0005 ai_conversations RBAC test suite failed:", error)
+      console.error("❌ ai_conversations RBAC test suite failed:", error)
       process.exit(1)
     })
 }

package/src/tests/api_tests/security/{F-0166-allowed-paths-wildcard-bypass.test.ts → allowed-paths-confinement.test.ts}

@@ -12,7 +12,7 @@ import { setup_tests } from "../../setup"
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
 /**
- * Regression test for F-0166 — allowedPaths wildcard disables path confinement entirely.
+ * Regression test — allowedPaths wildcard disables path confinement entirely.
  *
  * Several public, unauthenticated endpoints mint a JWT confined to a small set of API paths via an
  * `allowedPaths` claim. The enforcement predicate (api/modules/authentication.ts checkAccess)
@@ -69,7 +69,7 @@ type Probe = {
 }
 
 export const allowed_paths_confinement_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("F-0166: allowedPaths wildcard bypasses session path confinement")
+  log_header("allowedPaths wildcard bypasses session path confinement")
 
   const probes: Probe[] = []
 
@@ -157,7 +157,7 @@ export const allowed_paths_confinement_tests = async ({ sdk } : { sdk: Session,
 
     // -- public form (no wildcard in its allowedPaths)
     const form = await sdk.api.forms.createOne({
-      title: `F-0166 path confinement ${RAND()}`,
+      title: `path confinement ${RAND()}`,
       allowPublicURL: true,
     })
     formId = form.id
@@ -179,7 +179,7 @@ export const allowed_paths_confinement_tests = async ({ sdk } : { sdk: Session,
       })
 
     const product = await sdk.api.products.createOne({
-      title: `F-0166 product ${RAND()}`,
+      title: `product ${RAND()}`,
       cost: { amount: 500, currency: 'USD' },
       processor: 'Stripe',
     } as any)
@@ -193,13 +193,13 @@ export const allowed_paths_confinement_tests = async ({ sdk } : { sdk: Session,
 
     const joinLinkToken = `f0166-join-${RAND()}${RAND()}`
     const joinEvent = await sdk.api.calendar_events.createOne({
-      title: 'F-0166 join', durationInMinutes: 30, startTimeInMS: Date.now() + 3600_000,
+      title: 'join', durationInMinutes: 30, startTimeInMS: Date.now() + 3600_000,
       attendees: [{ type: 'enduser', id: joinEnduser.id, joinLinkToken }],
     } as any)
     eventIds.push(joinEvent.id)
 
     const unrelatedEvent = await sdk.api.calendar_events.createOne({
-      title: 'F-0166 unrelated', durationInMinutes: 30, startTimeInMS: Date.now() + 3600_000,
+      title: 'unrelated', durationInMinutes: 30, startTimeInMS: Date.now() + 3600_000,
       attendees: [{ type: 'enduser', id: joinEnduser.id }],
     } as any)
     eventIds.push(unrelatedEvent.id)
@@ -219,7 +219,7 @@ export const allowed_paths_confinement_tests = async ({ sdk } : { sdk: Session,
 
     const startLinkToken = `f0166-start-${RAND()}${RAND()}`
     const startEvent = await sdk.api.calendar_events.createOne({
-      title: 'F-0166 start', durationInMinutes: 30, startTimeInMS: Date.now() + 3600_000,
+      title: 'start', durationInMinutes: 30, startTimeInMS: Date.now() + 3600_000,
       attendees: [{ type: 'user', id: hostUser.id }, { type: 'enduser', id: joinEnduser.id }],
       startLinkToken,
     } as any)
@@ -553,7 +553,7 @@ export const allowed_paths_confinement_tests = async ({ sdk } : { sdk: Session,
     const S7 = 'S7 appointment-booking'
 
     const bookingTemplate = await sdk.api.calendar_event_templates.createOne({
-      title: `F-0166 booking ${RAND()}`, durationInMinutes: 30,
+      title: `booking ${RAND()}`, durationInMinutes: 30,
     })
     templateId = bookingTemplate.id
 
@@ -656,7 +656,7 @@ export const allowed_paths_confinement_tests = async ({ sdk } : { sdk: Session,
     const failures = probes.filter(p => !p.pass)
 
     console.log('')
-    console.log('  F-0166 — full probe table')
+    console.log('  full probe table')
     console.log('  ' + '-'.repeat(112))
     const scenarios = probes.map(p => p.scenario).filter((s, i, all) => all.indexOf(s) === i)
     for (const scenario of scenarios) {
@@ -711,11 +711,11 @@ if (require.main === module) {
 
   runTests()
   .then(() => {
-    console.log("✅ F-0166 allowedPaths confinement test suite completed successfully")
+    console.log("✅ allowedPaths confinement test suite completed successfully")
     process.exit(0)
   })
   .catch((error) => {
-    console.error("❌ F-0166 allowedPaths confinement test suite failed:", error)
+    console.error("❌ allowedPaths confinement test suite failed:", error)
     process.exit(1)
   })
 }

package/src/tests/api_tests/security/{F-0192-automated-actions-process-gate.test.ts → automated-actions-process-gate.test.ts}

@@ -29,8 +29,7 @@ type Check = {
 }
 
 /**
- * Regression test for F-0192
- * (security-audit/findings/F-0192-automated-actions-process-fire-replay.md).
+ * Regression test: `automated_actions.process` must be admin-gated, single-fire and audited.
  *
  * `automated_actions.process` (api.ts:3902) is the WORKER's action runner — its schema description
  * reads "Used by worker for new action types". It was registered with only
@@ -46,7 +45,7 @@ type Check = {
  *
  * The fix has three parts:
  *   1. `adminOnly: true` on the api.ts registration (routing.ts:944 reads the flag from that
- *      options object — a schema-only flag is inert, which is the separate finding F-0191).
+ *      options object — a schema-only flag is inert, which is a separate issue).
  *   2. A single-fire claim for human callers: an atomic findOneAndUpdate with `status: 'active'` in
  *      the filter, stamping `finished` + `processedAt` before the vendor dispatch. The worker
  *      (`wasAutomated`) is exempt because its own claim in
@@ -66,7 +65,7 @@ type Check = {
  * GREEN (post-fix): all five checks pass.
  */
 export const automated_actions_process_gate_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("F-0192: automated_actions.process must be admin-only and single-fire")
+  log_header("automated_actions.process must be admin-only and single-fire")
 
   const checks: Check[] = []
   const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
@@ -196,7 +195,7 @@ export const automated_actions_process_gate_tests = async ({ sdk } : { sdk: Sess
     )
 
     /* ===== report: print full table first, then assert (harness exits on first failure) ===== */
-    console.log('\n  F-0192 check summary:')
+    console.log('\n  check summary:')
     for (const c of checks) {
       console.log(`    ${c.pass ? 'PASS' : 'FAIL'}  ${c.label}  —  ${c.detail}`)
     }
@@ -228,11 +227,11 @@ if (require.main === module) {
 
   runTests()
     .then(() => {
-      console.log("✅ F-0192 automated_actions.process gate test suite completed successfully")
+      console.log("✅ automated_actions.process gate test suite completed successfully")
       process.exit(0)
     })
     .catch((error) => {
-      console.error("❌ F-0192 automated_actions.process gate test suite failed:", error)
+      console.error("❌ automated_actions.process gate test suite failed:", error)
       process.exit(1)
     })
 }

package/src/tests/api_tests/security/{F-0179-booking-info-idor-token-mint.test.ts → booking-info-idor-token-mint.test.ts}

@@ -22,8 +22,7 @@ type Check = {
 }
 
 /**
- * Regression test for F-0179
- * (security-audit/findings/F-0179-booking-info-idor-token-mint.md).
+ * Regression test: `form_fields.booking_info` must not mint a booking token for another patient.
  *
  * `form_fields.booking_info` resolved its target patient as
  * `DB.endusers.findById(enduserId || req.session.id)` with no ownership check for enduser
@@ -46,7 +45,7 @@ type Check = {
  * before `finally` cleanup.
  */
 export const booking_info_idor_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("F-0179: booking_info must not mint an appointment-booking token for another enduser")
+  log_header("booking_info must not mint an appointment-booking token for another enduser")
 
   const checks: Check[] = []
   const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
@@ -186,7 +185,7 @@ export const booking_info_idor_tests = async ({ sdk } : { sdk: Session, sdkNonAd
     record('C2: staff test-contact preview branch still works', c2Pass, c2Detail)
 
     /* ===== report: print full table first, then assert (harness exits on first failure) ===== */
-    console.log('\n  F-0179 check summary:')
+    console.log('\n  check summary:')
     for (const c of checks) {
       console.log(`    ${c.pass ? 'PASS' : 'FAIL'}  ${c.label}  —  ${c.detail}`)
     }
@@ -215,11 +214,11 @@ if (require.main === module) {
 
   runTests()
     .then(() => {
-      console.log("✅ F-0179 booking_info IDOR test suite completed successfully")
+      console.log("✅ booking_info IDOR test suite completed successfully")
       process.exit(0)
     })
     .catch((error) => {
-      console.error("❌ F-0179 booking_info IDOR test suite failed:", error)
+      console.error("❌ booking_info IDOR test suite failed:", error)
       process.exit(1)
     })
 }