@tellescope/sdk 1.256.14 → 1.256.15

package/src/tests/api_tests/security/form-logic-js-execution.test.ts

@@ -0,0 +1,183 @@
+require('source-map-support').install();
+
+import {
+  assert_checks,
+  Check,
+  setup_isolated_tenant,
+} from "../../setup_isolated"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
+/**
+ * Regression test: `$JS(...)` must be rejected in stored conditional logic.
+ *
+ * `responses_satisfy_conditions` (utilities/src/utils.ts) compiled a stored condition value of the
+ * form `$JS(...)` with `new Function()` and executed it — in every form-filler's browser, including
+ * anonymous visitors on public intake pages, AND inside the API process (automation_triggers.ts
+ * trigger matching on every form submission, ai_agent/form_filling.ts voice-agent navigation). The
+ * API process holds every tenant's database handle, so a condition authored by staff in one tenant
+ * reached all of them. Any staff user or API key with form_fields write access could plant one by
+ * typing into the free-text $gt/$lt box — no API call required.
+ *
+ * The sink is removed. This asserts the second half of the fix: `compoundFilterValidator` rejects the
+ * syntax at write time on every field that feeds that evaluator, so it cannot be reintroduced through
+ * stored configuration. The runtime half — that a `$JS` value is never evaluated — is covered by the
+ * pure-function cases in `form_conditional_logic_tests` in tests.ts.
+ *
+ * The five condition locations were established by enumerating every `responses_satisfy_conditions`
+ * call site, and all five are covered here. That completeness matters: the first run of this test
+ * caught a half fix. `event.conditions` is wrapped in an `orValidator`, which returns the first arm
+ * that does not throw, and its permissive `optional: optionalAnyObjectValidator` arm was declared
+ * before the guarded one — so the payload was accepted and stored even though the validator had been
+ * swapped. Pointing a field at the guard is not the same as the guard being reachable, which is why
+ * every location gets an assertion rather than an argument.
+ *
+ * Each rejection is paired with a positive control using the same shape without `$JS(`, so a passing
+ * test cannot be explained by the write failing for an unrelated reason.
+ */
+export const form_logic_js_execution_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  const JS_PAYLOAD = '$JS(return 0)'
+  const SAFE_VALUE = '18'
+
+  const condition = (value: string) => ({ $and: [{ condition: { 'someFieldId': { $gt: value } } }] })
+  const previousFields = (value: string) => ([{
+    type: 'compoundLogic',
+    info: { fieldId: '000000000000000000000000', priority: 5, label: '', condition: condition(value) },
+  }])
+
+  const attempt = async (fn: () => Promise<any>) => (
+    fn().then(() => ({ accepted: true,  detail: 'accepted' }))
+        .catch((e: any) => ({ accepted: false, detail: `rejected: ${e?.message || e}` }))
+  )
+
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+
+  try {
+    tenant = await setup_isolated_tenant({ name: `F0200 ${RAND()}`, users: [{ isAdmin: true }], apiKeys: 0 })
+    const sdk = tenant.sdk
+
+    const form = await sdk.api.forms.createOne({ title: `${RAND()}` })
+    const field = await sdk.api.form_fields.createOne({
+      formId: form.id, title: 'anchor', type: 'string', previousFields: [{ type: 'root', info: {} }],
+    })
+
+    /* ===== 1. previousFields[].info.condition — the field the finding was reported against ===== */
+
+    const controlCreate = await attempt(() => sdk.api.form_fields.createOne({
+      formId: form.id, title: 'control', type: 'string',
+      previousFields: previousFields(SAFE_VALUE) as any,
+    }))
+    record(
+      'control: form_fields.createOne accepts a normal $gt condition',
+      controlCreate.accepted, controlCreate.detail,
+    )
+
+    const payloadCreate = await attempt(() => sdk.api.form_fields.createOne({
+      formId: form.id, title: 'payload', type: 'string',
+      previousFields: previousFields(JS_PAYLOAD) as any,
+    }))
+    record(
+      '1a: form_fields.createOne rejects $JS( in previousFields condition',
+      !payloadCreate.accepted, payloadCreate.detail,
+    )
+
+    const payloadUpdate = await attempt(() => sdk.api.form_fields.updateOne(field.id, {
+      previousFields: previousFields(JS_PAYLOAD) as any,
+    }))
+    record(
+      '1b: form_fields.updateOne rejects $JS( in previousFields condition',
+      !payloadUpdate.accepted, payloadUpdate.detail,
+    )
+
+    /* ===== 2. groupShowCondition ===== */
+
+    const groupControl = await attempt(() => sdk.api.form_fields.updateOne(field.id, {
+      groupShowCondition: condition(SAFE_VALUE) as any,
+    }))
+    record('control: groupShowCondition accepts a normal condition', groupControl.accepted, groupControl.detail)
+
+    const groupPayload = await attempt(() => sdk.api.form_fields.updateOne(field.id, {
+      groupShowCondition: condition(JS_PAYLOAD) as any,
+    }))
+    record('2: form_fields.updateOne rejects $JS( in groupShowCondition', !groupPayload.accepted, groupPayload.detail)
+
+    /* ===== 3. options.optionDetails[].showCondition ===== */
+
+    const optionControl = await attempt(() => sdk.api.form_fields.updateOne(field.id, {
+      options: { optionDetails: [{ option: 'A', showCondition: condition(SAFE_VALUE) }] } as any,
+    }))
+    record('control: optionDetails showCondition accepts a normal condition', optionControl.accepted, optionControl.detail)
+
+    const optionPayload = await attempt(() => sdk.api.form_fields.updateOne(field.id, {
+      options: { optionDetails: [{ option: 'A', showCondition: condition(JS_PAYLOAD) }] } as any,
+    }))
+    record('3: form_fields.updateOne rejects $JS( in optionDetails showCondition', !optionPayload.accepted, optionPayload.detail)
+
+    /* ===== 4. options.productConditions[].showCondition ===== */
+
+    const productControl = await attempt(() => sdk.api.form_fields.updateOne(field.id, {
+      options: { productConditions: [{ productId: '000000000000000000000000', showCondition: condition(SAFE_VALUE) }] } as any,
+    }))
+    record('control: productConditions showCondition accepts a normal condition', productControl.accepted, productControl.detail)
+
+    const productPayload = await attempt(() => sdk.api.form_fields.updateOne(field.id, {
+      options: { productConditions: [{ productId: '000000000000000000000000', showCondition: condition(JS_PAYLOAD) }] } as any,
+    }))
+    record('4: form_fields.updateOne rejects $JS( in productConditions showCondition', !productPayload.accepted, productPayload.detail)
+
+    /* ===== 5. automation_triggers — the server-side evaluation path ===== */
+
+    const trigger = (conditions: object, extraInfo: object = {}) => ({
+      title: `${RAND()}`,
+      status: 'Inactive',
+      event: { type: 'Form Submitted', info: { formId: form.id, ...extraInfo }, ...conditions },
+      action: { type: 'Add Tags', info: { tags: ['security-regression'] } },
+    } as any)
+
+    const triggerControl = await attempt(() => sdk.api.automation_triggers.createOne(
+      trigger({ conditions: condition(SAFE_VALUE) })
+    ))
+    record('control: automation_triggers accepts normal event conditions', triggerControl.accepted, triggerControl.detail)
+
+    // NOTE: this is the case that caught the half fix — the orValidator's permissive arm accepted it.
+    const triggerPayload = await attempt(() => sdk.api.automation_triggers.createOne(
+      trigger({ conditions: condition(JS_PAYLOAD) })
+    ))
+    record('5a: automation_triggers rejects $JS( in event.conditions', !triggerPayload.accepted, triggerPayload.detail)
+
+    const byFormIdPayload = await attempt(() => sdk.api.automation_triggers.createOne(
+      trigger({}, { conditionsByFormId: { [form.id]: condition(JS_PAYLOAD) } })
+    ))
+    record('5b: automation_triggers rejects $JS( in event.info.conditionsByFormId', !byFormIdPayload.accepted, byFormIdPayload.detail)
+  } finally {
+    // Teardown BEFORE anything asserts — assert calls process.exit, which skips pending finallys and
+    // would strand the provisioned tenant permanently.
+    if (tenant) { try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) } }
+  }
+
+  return checks
+}
+
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+export const form_logic_js_execution_tests = async () => {
+  assert_checks('$JS in stored conditional logic', await form_logic_js_execution_checks())
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  form_logic_js_execution_tests()
+    .then(() => {
+      console.log("✅ form logic JS execution test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ form logic JS execution test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/security/{F-0145-globalunique-leak.test.ts → globalunique-conflict-redaction.test.ts}

@@ -10,8 +10,7 @@ import { setup_tests } from "../../setup"
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
 /**
- * Regression test for F-0145
- * (security-audit/findings/F-0145-globalunique-conflict-leaks-cross-tenant-record.md).
+ * Regression test: a globalUnique conflict response must not echo the matched record.
  *
  * The create endpoint generator's unconditional globalUnique-enforcement block
  * (routing.ts, "globalUnique should be enforced even if _overrideUnique is true")
@@ -24,7 +23,7 @@ const host = process.env.API_URL || 'http://localhost:8080' as const
  * 409 body's existingRecord exposes nothing beyond _id + businessId.
  */
 export const globalunique_leak_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("F-0145: globalUnique conflict response redaction")
+  log_header("globalUnique conflict response redaction")
 
   let userId: string | undefined
   try {
@@ -33,7 +32,7 @@ export const globalunique_leak_tests = async ({ sdk } : { sdk: Session, sdkNonAd
     userId = user.id
 
     await async_test(
-      'F-0145: globalUnique 409 existingRecord exposes only _id + businessId (no email/hashedPass)',
+      'globalUnique 409 existingRecord exposes only _id + businessId (no email/hashedPass)',
       () => sdk.api.users.createOne({ email, _overrideUnique: true } as any),
       {
         shouldError: true,
@@ -68,11 +67,11 @@ if (require.main === module) {
 
   runTests()
     .then(() => {
-      console.log("✅ F-0145 globalUnique leak test suite completed successfully")
+      console.log("✅ globalUnique leak test suite completed successfully")
       process.exit(0)
     })
     .catch((error) => {
-      console.error("❌ F-0145 globalUnique leak test suite failed:", error)
+      console.error("❌ globalUnique leak test suite failed:", error)
       process.exit(1)
     })
 }

package/src/tests/api_tests/security/{F-0008-handle-incoming-communication-cross-tenant.test.ts → handle-incoming-communication-cross-tenant.test.ts}

@@ -27,7 +27,7 @@ const post = async (path: string, body: any, headers: Record<string, string> = {
 }
 
 /**
- * Regression test for F-0008 (security-audit/findings/F-0008-handle-incoming-communication-cross-tenant-enduser-lookup.md).
+ * Regression test: `handle_incoming_communication` tenant scoping.
  *
  * `journeys.handle_incoming_communication` previously used `buildAllQueries({ unrestricted: true, organizationIds: [] }).endusers.findById(enduserId)`,
  * permitting cross-tenant lookup of any enduser by id. The handler then called `handleIncomingCommunication(...)`
@@ -45,7 +45,7 @@ const post = async (path: string, body: any, headers: Record<string, string> = {
  * enduser — the post-fix code returns 404 before any side effects fire, and the assertion confirms that.
  */
 export const handle_incoming_communication_cross_tenant_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("F-0008: handle_incoming_communication cross-tenant rejection")
+  log_header("handle_incoming_communication cross-tenant rejection")
 
   // ====================================================================
   // Assertion 1: nonexistent enduserId returns 404 (baseline; regression
@@ -58,19 +58,19 @@ export const handle_incoming_communication_cross_tenant_tests = async ({ sdk, sd
     { Authorization: `Bearer ${sdk.authToken}` },
   )
   await async_test(
-    "F-0008: handle_incoming_communication with nonexistent enduserId returns 404",
+    "handle_incoming_communication with nonexistent enduserId returns 404",
     async () => ({ status: nonexistentRes.status }),
     { onResult: r => r.status === 404 },
   )
 
   // ====================================================================
-  // Assertion 2: cross-tenant enduserId returns 404 (the actual F-0008 fix).
+  // Assertion 2: cross-tenant enduserId returns 404 (the actual fix).
   // Env-gated; skipped when cross-org infra isn't configured.
   // Safe to run post-fix because the tenant-scoped DB returns null for
   // cross-tenant lookups — no handleIncomingCommunication side effect fires.
   // ====================================================================
   if (!(CROSS_ORG_API_KEY && CROSS_ORG_TARGET_BUSINESS_ID)) {
-    console.log("  [F-0008] Skipping cross-tenant rejection assertion — CROSS_ORG_* env vars not set")
+    console.log("  Skipping cross-tenant rejection assertion — CROSS_ORG_* env vars not set")
     return
   }
 
@@ -96,7 +96,7 @@ export const handle_incoming_communication_cross_tenant_tests = async ({ sdk, sd
     )
 
     await async_test(
-      "F-0008: handle_incoming_communication with cross-tenant enduserId returns 404 (no side effect)",
+      "handle_incoming_communication with cross-tenant enduserId returns 404 (no side effect)",
       async () => ({
         status: crossRes.status,
         message: crossRes.data?.message ?? null,
@@ -120,11 +120,11 @@ if (require.main === module) {
 
   runTests()
     .then(() => {
-      console.log("✅ F-0008 handle_incoming_communication cross-tenant test suite completed successfully")
+      console.log("✅ handle_incoming_communication cross-tenant test suite completed successfully")
       process.exit(0)
     })
     .catch((error) => {
-      console.error("❌ F-0008 handle_incoming_communication cross-tenant test suite failed:", error)
+      console.error("❌ handle_incoming_communication cross-tenant test suite failed:", error)
       process.exit(1)
     })
 }

package/src/tests/api_tests/security/{F-0007-invite-user-enumeration.test.ts → invite-user-enumeration.test.ts}

@@ -27,7 +27,7 @@ const post = async (path: string, body: any, headers: Record<string, string> = {
 }
 
 /**
- * Regression test for F-0007 (security-audit/findings/F-0007-invite-user-cross-tenant-email-enumeration.md).
+ * Regression test: `invite_user` cross-tenant enumeration.
  *
  * `users.invite_user` previously used `buildAllQueries({ unrestricted: true, organizationIds: [] }).users.findOne({ email })`
  * to enforce platform-wide email uniqueness and threw the distinctive `"A user with this email already exists"`
@@ -50,7 +50,7 @@ const post = async (path: string, body: any, headers: Record<string, string> = {
  *      env vars are not set, mirroring cross_org_api_key.test.ts convention.
  */
 export const invite_user_enumeration_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("F-0007: users.invite_user cross-tenant enumeration regression")
+  log_header("users.invite_user cross-tenant enumeration regression")
 
   // Reset state so prior tests' rate-limit accounting doesn't leak in.
   await sdk.reset_db()
@@ -85,7 +85,7 @@ export const invite_user_enumeration_tests = async ({ sdk, sdkNonAdmin } : { sdk
   }
 
   await async_test(
-    "F-0007: invite_user rate-limits within ~12 rapid requests (defense-in-depth; no invites sent)",
+    "invite_user rate-limits within ~12 rapid requests (defense-in-depth; no invites sent)",
     async () => ({ rateLimitedAt }),
     { onResult: r => r.rateLimitedAt >= 0 && r.rateLimitedAt <= 12 },
   )
@@ -111,7 +111,7 @@ export const invite_user_enumeration_tests = async ({ sdk, sdkNonAdmin } : { sdk
   )
 
   await async_test(
-    "F-0007: invite_user same-tenant duplicate returns 400 'already exists' (unchanged)",
+    "invite_user same-tenant duplicate returns 400 'already exists' (unchanged)",
     async () => ({
       status: sameTenantRes.status,
       message: sameTenantRes.data?.message ?? '',
@@ -124,7 +124,7 @@ export const invite_user_enumeration_tests = async ({ sdk, sdkNonAdmin } : { sdk
   // Env-gated; skipped when cross-org infra not configured.
   // ====================================================================
   if (!(CROSS_ORG_API_KEY && CROSS_ORG_TARGET_BUSINESS_ID)) {
-    console.log("  [F-0007] Skipping cross-tenant silent no-op assertion — CROSS_ORG_* env vars not set")
+    console.log("  Skipping cross-tenant silent no-op assertion — CROSS_ORG_* env vars not set")
     return
   }
 
@@ -160,7 +160,7 @@ export const invite_user_enumeration_tests = async ({ sdk, sdkNonAdmin } : { sdk
   )
 
   await async_test(
-    "F-0007: cross-tenant invite of existing email must NOT return 'already exists' (no enumeration)",
+    "cross-tenant invite of existing email must NOT return 'already exists' (no enumeration)",
     async () => ({
       status: crossRes.status,
       message: crossRes.data?.message ?? '',
@@ -188,11 +188,11 @@ if (require.main === module) {
 
   runTests()
     .then(() => {
-      console.log("✅ F-0007 invite_user enumeration test suite completed successfully")
+      console.log("✅ invite_user enumeration test suite completed successfully")
       process.exit(0)
     })
     .catch((error) => {
-      console.error("❌ F-0007 invite_user enumeration test suite failed:", error)
+      console.error("❌ invite_user enumeration test suite failed:", error)
       process.exit(1)
     })
 }

package/src/tests/api_tests/security/{F-0151-load-inbox-redaction.test.ts → load-inbox-redaction.test.ts}

@@ -12,8 +12,7 @@ const host = process.env.API_URL || 'http://localhost:8080' as const
 const ENDUSER_PASSWORD = 'F0151TestPassword!123'
 
 /**
- * Regression test for F-0151
- * (security-audit/findings/F-0151-load-inbox-data-endusers-unredacted.md).
+ * Regression test: `load_inbox_data` must apply enduser field redactions.
  *
  * load_inbox_data serialized $lookup'ed endusers via convert_id_name only (NOT applyRedactions),
  * so endusers.hashedPassword (redactions:['all']) leaked to staff sessions — while the sibling
@@ -24,7 +23,7 @@ const ENDUSER_PASSWORD = 'F0151TestPassword!123'
  * assert the returned enduser entry has NO hashedPassword.
  */
 export const load_inbox_redaction_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("F-0151: load_inbox_data enduser redaction")
+  log_header("load_inbox_data enduser redaction")
 
   let enduserId: string | undefined
   let emailId: string | undefined
@@ -42,7 +41,7 @@ export const load_inbox_redaction_tests = async ({ sdk } : { sdk: Session, sdkNo
     emailId = seeded.id
 
     await async_test(
-      'F-0151: load_inbox_data does not leak enduser.hashedPassword to staff',
+      'load_inbox_data does not leak enduser.hashedPassword to staff',
       () => sdk.api.endusers.load_inbox_data({ enduserIds: [enduser.id] } as any),
       {
         onResult: (r: any) => {
@@ -71,11 +70,11 @@ if (require.main === module) {
 
   runTests()
     .then(() => {
-      console.log("✅ F-0151 load_inbox_data redaction test suite completed successfully")
+      console.log("✅ load_inbox_data redaction test suite completed successfully")
       process.exit(0)
     })
     .catch((error) => {
-      console.error("❌ F-0151 load_inbox_data redaction test suite failed:", error)
+      console.error("❌ load_inbox_data redaction test suite failed:", error)
       process.exit(1)
     })
 }

package/src/tests/api_tests/security/{F-0016-prototype-pollution.test.ts → prototype-pollution.test.ts}

@@ -1,16 +1,16 @@
 import { add_value_for_dotted_key } from "@tellescope/utilities"
 
-// Regression test for F-0016 (pattern 17 — prototype pollution).
+// Regression test: prototype pollution via dotted-key assignment.
 // add_value_for_dotted_key must NOT write through __proto__/constructor/prototype path segments
 // (which would pollute Object.prototype process-wide), while still performing legitimate dotted assignment.
 //
 // Pure-function test — no Session needed. Runs in the main suite and standalone:
-//   ./build_cjs.sh && cd packages/public/sdk && node -r dotenv/config lib/cjs/tests/api_tests/security/F-0016-prototype-pollution.test.js
+//   ./build_cjs.sh && cd packages/public/sdk && node -r dotenv/config lib/cjs/tests/api_tests/security/prototype-pollution.test.js
 
 const fail = (msg: string) => { throw new Error(msg) }
 
 export const prototype_pollution_tests = async () => {
-  console.log("Running F-0016 prototype-pollution regression tests")
+  console.log("Running prototype-pollution regression tests")
 
   // 1. __proto__ path must not pollute Object.prototype
   add_value_for_dotted_key({ insurance: {} } as any, 'insurance.__proto__.__pp_a__', 'polluted')
@@ -40,7 +40,7 @@ export const prototype_pollution_tests = async () => {
   add_value_for_dotted_key(flat, 'name', 'ok')
   if (flat.name !== 'ok') fail('single-key assignment broke')
 
-  console.log("✅ F-0016 prototype-pollution regression tests passed")
+  console.log("✅ prototype-pollution regression tests passed")
 }
 
 if (require.main === module) {

package/src/tests/api_tests/security/{F-0025-proxy-image-unauth-ssrf.test.ts → proxy-image-unauth-ssrf.test.ts}

@@ -22,15 +22,14 @@ const assert_local_api = () => {
   const hostname = new URL(host).hostname
   if (!LOCAL_HOSTNAMES.includes(hostname)) {
     throw new Error(
-      `F-0025 SSRF tests must run against a local API (got ${host}). `
+      `SSRF tests must run against a local API (got ${host}). `
       + `127.0.0.1 would resolve to the API server rather than this machine, so the tests would be meaningless.`
     )
   }
 }
 
 /**
- * Regression tests for F-0025
- * (security-audit/findings/F-0025-proxy-image-unauth-ssrf.md).
+ * Regression tests: `/v1/proxy-image` must refuse internal and non-image destinations.
  *
  * GET /v1/proxy-image accepted an arbitrary ?url= and streamed the upstream response body straight
  * back with Access-Control-Allow-Origin: *, with no authentication, no destination validation and no
@@ -58,7 +57,7 @@ const assert_local_api = () => {
  * the vulnerability proof.
  */
 export const proxy_image_ssrf_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("F-0025: proxy-image unauthenticated SSRF")
+  log_header("proxy-image unauthenticated SSRF")
   assert_local_api()
 
   const SENTINEL = `f0025-sentinel-${Date.now()}-${Math.random().toString(36).slice(2)}`
@@ -95,7 +94,7 @@ export const proxy_image_ssrf_tests = async ({ sdk } : { sdk: Session, sdkNonAdm
 
     // T1 — the core SSRF: an unauthenticated caller must not be able to read an internal resource.
     await async_test(
-      'F-0025: proxy-image does not stream an internal non-image resource to an unauthenticated caller',
+      'proxy-image does not stream an internal non-image resource to an unauthenticated caller',
       call_unauthenticated,
       {
         // Positive control: a numeric status proves we actually reached our API rather than failing to
@@ -111,7 +110,7 @@ export const proxy_image_ssrf_tests = async ({ sdk } : { sdk: Session, sdkNonAdm
     // T2 — the unauthenticated surface itself: the request must be refused outright, and the
     // destination must never be contacted (no SSRF-as-a-side-effect even when the body is withheld).
     await async_test(
-      'F-0025: proxy-image refuses an unauthenticated request without contacting the destination',
+      'proxy-image refuses an unauthenticated request without contacting the destination',
       call_unauthenticated,
       { onResult: (r: any) => r.status >= 400 && r.status < 500 && r.sentinelHits === 0 },
     )
@@ -129,26 +128,26 @@ export const proxy_image_ssrf_tests = async ({ sdk } : { sdk: Session, sdkNonAdm
     }
 
     await async_test(
-      'F-0025: proxy-image refuses a private destination even for an authenticated staff session',
+      'proxy-image refuses a private destination even for an authenticated staff session',
       () => call_authenticated(sentinelURL),
       { onResult: (r: any) => r.status === 400 && r.sentinelHits === 0 },
     )
 
     await async_test(
-      'F-0025: proxy-image refuses cloud metadata for an authenticated staff session',
+      'proxy-image refuses cloud metadata for an authenticated staff session',
       () => call_authenticated('https://169.254.169.254/latest/meta-data/'),
       { onResult: (r: any) => r.status === 400 },
     )
 
     // Scheme and port are pinned: only https on 443, which is all the PDF export ever needs.
     await async_test(
-      'F-0025: proxy-image refuses a plain http destination',
+      'proxy-image refuses a plain http destination',
       () => call_authenticated('http://example.com/logo.png'),
       { onResult: (r: any) => r.status === 400 },
     )
 
     await async_test(
-      'F-0025: proxy-image refuses a non-443 port',
+      'proxy-image refuses a non-443 port',
       () => call_authenticated('https://example.com:8443/logo.png'),
       { onResult: (r: any) => r.status === 400 },
     )
@@ -169,11 +168,11 @@ if (require.main === module) {
 
   runTests()
     .then(() => {
-      console.log("✅ F-0025 proxy-image SSRF test suite completed successfully")
+      console.log("✅ proxy-image SSRF test suite completed successfully")
       process.exit(0)
     })
     .catch((error) => {
-      console.error("❌ F-0025 proxy-image SSRF test suite failed:", error)
+      console.error("❌ proxy-image SSRF test suite failed:", error)
       process.exit(1)
     })
 }

package/src/tests/api_tests/security/{F-0013-sanitize-user-html-with-iframes.test.ts → sanitize-user-html-with-iframes.test.ts}

@@ -1,22 +1,22 @@
 import { DEFAULT_IFRAME_SANDBOX, replace_form_field_template_values, sanitize_user_html, sanitize_user_html_with_iframes } from "@tellescope/utilities"
 
-// Companion to F-0013-sanitize-user-html.test.ts (pattern 06 — XSS via dangerouslySetInnerHTML).
+// Companion to sanitize-user-html.test.ts (pattern 06 — XSS via dangerouslySetInnerHTML).
 //
 // sanitize_user_html_with_iframes is the variant used by the live form's field description, so
 // admins can embed video / scheduling widgets. It permits <iframe> and NOTHING else beyond what
 // sanitize_user_html allows. This asserts:
-//   1. permitting iframe did not reopen any of the F-0013 vectors (the full payload list is re-run)
+//   1. permitting iframe did not reopen any of the base vectors (the full payload list is re-run)
 //   2. only absolute https iframes survive — relative, protocol-relative, http, javascript:, data:
 //      and srcdoc frames are dropped, along with their fallback content
 //   3. the restrictive sandbox is forced, but an author-supplied sandbox is honored
 //   4. sanitize_user_html itself still strips iframes (the boundary between the two functions)
 //
 // Pure-function test — no Session needed. Runs as part of the main suite and standalone:
-//   ./build_cjs.sh && cd packages/public/sdk && node -r dotenv/config lib/cjs/tests/api_tests/security/F-0013-sanitize-user-html-with-iframes.test.js
+//   ./build_cjs.sh && cd packages/public/sdk && node -r dotenv/config lib/cjs/tests/api_tests/security/sanitize-user-html-with-iframes.test.js
 
 const fail = (msg: string) => { throw new Error(msg) }
 
-// Same as has_no_executable_vector in the F-0013 test, minus the '<iframe' clause (iframes are
+// Same as has_no_executable_vector in the base sanitizer test, minus the '<iframe' clause (iframes are
 // expected in this function's output). Everything else must still be neutralized.
 const has_no_executable_vector_allowing_iframe = (out: string) => {
   const o = out.toLowerCase()
@@ -49,7 +49,7 @@ export const sanitize_user_html_with_iframes_tests = async () => {
   console.log("Running sanitize_user_html_with_iframes XSS regression tests")
 
   // ---------------------------------------------------------------------------------------------
-  // 1. Re-run the full F-0013 payload set — permitting iframe must not be a general regression
+  // 1. Re-run the full base payload set — permitting iframe must not be a general regression
   // ---------------------------------------------------------------------------------------------
   const xssPayloads: [string, string][] = [
     ['img onerror', `<img src=x onerror="alert(document.domain)">`],

package/src/tests/api_tests/security/{F-0013-sanitize-user-html.test.ts → sanitize-user-html.test.ts}

@@ -1,13 +1,13 @@
 import { sanitize_user_html } from "@tellescope/utilities"
 
-// Regression test for F-0013 / F-0014 (pattern 06 — XSS via dangerouslySetInnerHTML).
+// Regression test: XSS via dangerouslySetInnerHTML.
 // sanitize_user_html is the canonical render-time sanitizer that replaced remove_script_tags
 // at every dangerouslySetInnerHTML sink. This asserts it neutralizes XSS vectors (incl. encoded /
 // whitespace / mixed-case / iframe-srcdoc bypass variants) while preserving legitimate
 // customization HTML (tables, headings, lists, links, images, inline styles).
 //
 // Pure-function test — no Session needed. Runs as part of the main suite and standalone:
-//   ./build_cjs.sh && cd packages/public/sdk && node -r dotenv/config lib/cjs/tests/api_tests/security/F-0013-sanitize-user-html.test.js
+//   ./build_cjs.sh && cd packages/public/sdk && node -r dotenv/config lib/cjs/tests/api_tests/security/sanitize-user-html.test.js
 
 const fail = (msg: string) => { throw new Error(msg) }
 
@@ -31,7 +31,7 @@ const has_no_executable_vector = (out: string) => {
 }
 
 export const sanitize_user_html_xss_tests = async () => {
-  console.log("Running F-0013/F-0014 sanitize_user_html XSS regression tests")
+  console.log("Running sanitize_user_html XSS regression tests")
 
   const xssPayloads: [string, string][] = [
     ['img onerror', `<img src=x onerror="alert(document.domain)">`],
@@ -99,7 +99,7 @@ export const sanitize_user_html_xss_tests = async () => {
   const mixed = sanitize_user_html(`<p>Hello <b>name</b></p><img src=x onerror="steal()">`)
   if (!(mixed.includes('<b>name</b>') && !/\son[a-z]+\s*=/.test(mixed.toLowerCase()))) fail(`mixed content not handled: ${mixed}`)
 
-  console.log("✅ F-0013/F-0014 sanitize_user_html XSS regression tests passed")
+  console.log("✅ sanitize_user_html XSS regression tests passed")
 }
 
 if (require.main === module) {

package/src/tests/api_tests/security/{F-0191-schema-adminonly-enforcement.test.ts → schema-adminonly-enforcement.test.ts}

@@ -24,8 +24,7 @@ type Check = {
 }
 
 /**
- * Regression test for F-0191
- * (security-audit/findings/F-0191-schema-adminonly-not-enforced.md).
+ * Regression test: `adminOnly` custom actions must be enforced at runtime, not merely declared.
  *
  * `adminOnly: true` on a CUSTOM action in schema.ts was documentation-only. The runtime gate
  * (routing.ts:944) reads the flag off the options object built by getCustomEndpointFields, and
@@ -64,7 +63,7 @@ type Check = {
  * GREEN (post-fix): all six return 401 "Admin access only"; the group-A controls are unchanged.
  */
 export const schema_adminonly_enforcement_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("F-0191: schema-declared adminOnly must be enforced on custom actions")
+  log_header("schema-declared adminOnly must be enforced on custom actions")
 
   const checks: Check[] = []
   const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
@@ -225,7 +224,7 @@ export const schema_adminonly_enforcement_tests = async ({ sdk } : { sdk: Sessio
       {
         label: 'organizations.sync_note_to_canvas',
         method: 'post', path: '/organizations/sync-note-to-canvas',
-        data: { enduserId: ABSENT_ID, note: 'F-0191 control' }, // 404 Enduser not found
+        data: { enduserId: ABSENT_ID, note: 'control' }, // 404 Enduser not found
       },
       {
         label: 'background_errors.mark_read',
@@ -249,7 +248,7 @@ export const schema_adminonly_enforcement_tests = async ({ sdk } : { sdk: Sessio
     }
 
     /* ===== report: print full table first, then assert (harness exits on first failure) ===== */
-    console.log('\n  F-0191 check summary:')
+    console.log('\n  check summary:')
     for (const c of checks) {
       console.log(`    ${c.pass ? 'PASS' : 'FAIL'}  ${c.label}  —  ${c.detail}`)
     }
@@ -278,11 +277,11 @@ if (require.main === module) {
 
   runTests()
     .then(() => {
-      console.log("✅ F-0191 schema adminOnly enforcement test suite completed successfully")
+      console.log("✅ schema adminOnly enforcement test suite completed successfully")
       process.exit(0)
     })
     .catch((error) => {
-      console.error("❌ F-0191 schema adminOnly enforcement test suite failed:", error)
+      console.error("❌ schema adminOnly enforcement test suite failed:", error)
       process.exit(1)
     })
 }