@tellescope/sdk 1.256.14 → 1.256.15

package/src/tests/api_tests/security/readonly-enduser-preview.test.ts

@@ -1,301 +0,0 @@
-require('source-map-support').install();
-
-import axios from "axios"
-
-import { Session, EnduserSession } from "../../../sdk"
-import {
-  assert,
-  log_header,
-} from "@tellescope/testing"
-import { PROVIDER_PERMISSIONS, NO_ACCESS } from "@tellescope/constants"
-import { setup_tests } from "../../setup"
-
-const host = process.env.API_URL || 'http://localhost:8080' as const
-
-const RAND = () => Math.random().toString(36).slice(2, 10)
-
-const ALL = 'All' as const
-const READ_ONLY = { create: NO_ACCESS, read: ALL, update: NO_ACCESS, delete: NO_ACCESS }
-const FULL_ACCESS = { create: ALL, read: ALL, update: ALL, delete: ALL }
-const ASSIGNED_UPDATE = { create: NO_ACCESS, read: ALL, update: 'Assigned' as const, delete: NO_ACCESS }
-
-const PORTAL_PREVIEW_SCOPE = 'portal-preview'
-
-type ProbeMethod = 'get' | 'post' | 'patch' | 'put' | 'delete'
-
-// A single collected check. Everything is gathered first and asserted at the end, because the
-// testing harness exits the process on the first failed assert — collecting first means a RED run
-// prints the full evidence table before the first vulnerability assert trips the exit.
-type Check = {
-  label: string,
-  pass: boolean,
-  detail: string,
-}
-
-/**
- * Regression test for F-0138
- * (security-audit/findings/F-0138-endusers-generate-auth-token-no-admin-gate.md).
- *
- * `endusers.generate_auth_token` (the "View portal as patient" preview flow) requires only
- * `endusers.read`, yet mints a FULLY-PRIVILEGED enduser session. A staff user who cannot update a
- * patient can therefore act AS that patient: edit the record, submit forms, send chats, book
- * appointments, even set the portal password.
- *
- * The fix mints the preview token with `sessionScopes: ['portal-preview']` whenever the calling
- * staff user lacks update access to that specific enduser (record-level, honoring `Assigned`
- * scoping). The scope's allowlist (api/modules/session_scopes.ts) grants exactly the portal's read
- * surface plus session maintenance; every write path 403s via existing path confinement.
- *
- * RED (pre-fix): section A fails — the response carries no sessionScopes and every write in A2
- * SUCCEEDS. Sections D/E (controls) pass pre-fix. GREEN (post-fix): all sections pass.
- *
- * Probes use raw axios rather than the SDK: parseError (sdk/src/session.ts) discards the status
- * code, and a path-confinement denial (403 "Inaccessible") is byte-identical in message to a
- * permissions denial. Write/blocked-read probes additionally confirm an UNCONFINED enduser token
- * gets a non-403 on the same path in the same run, so a 403 can only be confinement, never bad
- * permissions or a bad body.
- */
-export const readonly_enduser_preview_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("F-0138: portal-preview scope for read-only staff generate_auth_token")
-
-  const checks: Check[] = []
-  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
-
-  const request = async (token: string, method: ProbeMethod, path: string, data?: any) => {
-    const r = await axios.request({
-      method,
-      url: `${host}/v1${path}`,
-      ...method === 'get' ? { params: data } : { data },
-      headers: { Authorization: `Bearer ${token}` },
-      validateStatus: () => true,
-    })
-    return { status: r.status, body: r.data }
-  }
-
-  const isPathDenial = (r: { status: number, body: any }) => (
-    r.status === 403 && r.body?.message === 'Inaccessible'
-  )
-
-  // The confined token must be denied `path` by confinement, while an unconfined baseline is not.
-  const expectDenied = async (
-    label: string, confinedToken: string, baselineToken: string,
-    method: ProbeMethod, path: string, data?: any,
-  ) => {
-    const baseline = await request(baselineToken, method, path, data)
-    const confined = await request(confinedToken, method, path, data)
-    const badProbe = baseline.status === 403
-    record(
-      label,
-      !badProbe && isPathDenial(confined),
-      `${method}:${path} confined=${confined.status} baseline=${baseline.status}` + (badProbe ? ' BAD PROBE: baseline also 403' : ''),
-    )
-  }
-
-  // The path must not be blocked by confinement (neither 403 nor 401).
-  const expectAllowed = async (
-    label: string, token: string, method: ProbeMethod, path: string, data?: any,
-  ) => {
-    const r = await request(token, method, path, data)
-    record(label, r.status !== 403 && r.status !== 401, `${method}:${path} status=${r.status}`)
-  }
-
-  const hasScope = (enduser: any) => !!enduser?.sessionScopes?.includes?.(PORTAL_PREVIEW_SCOPE)
-
-  const readonlyRole = `f0138-readonly-${RAND()}`
-  const fullUpdateRole = `f0138-full-${RAND()}`
-  const assignedUpdateRole = `f0138-assigned-${RAND()}`
-  const roleIds: string[] = []
-  const userIds: string[] = []
-  const enduserIds: string[] = []
-
-  try {
-    /* ================= fixtures ================= */
-
-    for (const [role, endusersPerm] of [
-      [readonlyRole, READ_ONLY],
-      [fullUpdateRole, FULL_ACCESS],
-      [assignedUpdateRole, ASSIGNED_UPDATE],
-    ] as const) {
-      const rbap = await sdk.api.role_based_access_permissions.createOne({
-        role,
-        permissions: { ...PROVIDER_PERMISSIONS, endusers: endusersPerm },
-      } as any)
-      roleIds.push(rbap.id)
-    }
-
-    // Throwaway staff users. verifiedEmail must be set at create (rejected on update).
-    const mkUser = async (role: string) => {
-      const u = await sdk.api.users.createOne({
-        email: `f0138-${role}-${RAND()}@tellescope.example`,
-        fname: 'F0138', lname: 'Staff',
-        verifiedEmail: true,
-        notificationEmailsDisabled: true,
-        roles: [role],
-      } as any)
-      userIds.push(u.id)
-      return u
-    }
-    const readonlyUser = await mkUser(readonlyRole)
-    const fullUpdateUser = await mkUser(fullUpdateRole)
-    const assignedUpdateUser = await mkUser(assignedUpdateRole)
-
-    // Staff sessions from admin-minted tokens (avoids the password / login-rate-limit dance).
-    const staffSession = async (userId: string) => {
-      const { authToken } = await sdk.api.users.generate_auth_token({ id: userId })
-      return new Session({ host, authToken })
-    }
-    const readonlyStaff = await staffSession(readonlyUser.id)
-    const fullUpdateStaff = await staffSession(fullUpdateUser.id)
-    const assignedUpdateStaff = await staffSession(assignedUpdateUser.id)
-
-    // Endusers: unassigned patient, a bystander, and one assigned to the assigned-update user.
-    const enduser = await sdk.api.endusers.createOne({
-      email: `f0138-patient-${RAND()}@tellescope.example`, fname: 'F0138', lname: 'Patient',
-    })
-    enduserIds.push(enduser.id)
-    const assignedEnduser = await sdk.api.endusers.createOne({
-      email: `f0138-assigned-${RAND()}@tellescope.example`, fname: 'F0138', lname: 'Assigned',
-      assignedTo: [assignedUpdateUser.id],
-    } as any)
-    enduserIds.push(assignedEnduser.id)
-
-    // A form_response the patient owns, for the submit-form-response write probe.
-    const form = await sdk.api.forms.createOne({ title: `F-0138 preview form ${RAND()}` })
-    const { response: formResponse } = await sdk.api.form_responses.prepare_form_response({
-      formId: form.id, enduserId: enduser.id,
-    })
-
-    /* ===== A1: read-only staff mints a scoped preview token ===== */
-
-    const previewMint = await readonlyStaff.api.endusers.generate_auth_token({ id: enduser.id })
-    const previewToken = previewMint.authToken
-    record('A1: read-only staff receives an authToken', !!previewToken, `authToken present=${!!previewToken}`)
-    record(
-      'A1: read-only staff mint is scoped to portal-preview',
-      hasScope(previewMint.enduser),
-      `sessionScopes=${JSON.stringify((previewMint.enduser as any)?.sessionScopes)} (F-0138 vuln if absent)`,
-    )
-    record(
-      'A1(E): scoped preview token carries denySocket',
-      (previewMint.enduser as any)?.denySocket === true,
-      `denySocket=${(previewMint.enduser as any)?.denySocket}`,
-    )
-
-    // Unconfined enduser baseline (admin-minted) — proves the scoped token's 403s are confinement.
-    const { authToken: baselineEnduserToken } = await sdk.api.endusers.generate_auth_token({ id: enduser.id })
-
-    /* ===== A2: writes blocked for the scoped session ===== */
-
-    await expectDenied('A2: cannot self-update the patient record', previewToken, baselineEnduserToken,
-      'patch', `/enduser/${enduser.id}`, { updates: { fname: 'Hacked' } })
-    await expectDenied('A2: cannot set the patient portal password', previewToken, baselineEnduserToken,
-      'post', '/set-enduser-password', { id: enduser.id, password: `F0138Pw!${RAND()}` })
-    await expectDenied('A2: cannot send a chat as the patient', previewToken, baselineEnduserToken,
-      'post', '/chat', { message: 'hi from preview' })
-    await expectDenied('A2: cannot submit a form as the patient', previewToken, baselineEnduserToken,
-      'patch', '/submit-form-response', { id: formResponse.id, responses: [] })
-    await expectDenied('A2: cannot book an appointment as the patient', previewToken, baselineEnduserToken,
-      'post', '/book-appointment', {})
-    await expectDenied('A2: cannot start a file upload as the patient', previewToken, baselineEnduserToken,
-      'post', '/prepare-file-upload', { name: 'x.pdf', type: 'application/pdf', enduserId: enduser.id })
-
-    /* ===== B: no laundering via refresh ===== */
-
-    const refreshed = await request(previewToken, 'post', '/refresh-enduser-session', {})
-    const refreshedToken = refreshed.body?.authToken as string | undefined
-    record('B: refresh succeeds', refreshed.status === 200 && !!refreshedToken, `status=${refreshed.status} token=${!!refreshedToken}`)
-    record(
-      'B: refreshed session still carries portal-preview scope',
-      hasScope(refreshed.body?.enduser),
-      `sessionScopes=${JSON.stringify(refreshed.body?.enduser?.sessionScopes)} (laundering if absent)`,
-    )
-    if (refreshedToken) {
-      await expectDenied('B: refreshed token still cannot write', refreshedToken, baselineEnduserToken,
-        'patch', `/enduser/${enduser.id}`, { updates: { fname: 'HackedAfterRefresh' } })
-    }
-    await expectAllowed('B: logout allowed', previewToken, 'post', '/logout-enduser')
-
-    /* ===== C: ungranted mutating "reads" blocked ===== */
-
-    // Re-mint (the previous token was just logged out).
-    const cMint = await readonlyStaff.api.endusers.generate_auth_token({ id: enduser.id })
-    const cToken = cMint.authToken
-    await expectDenied('C: proxy_read blocked', cToken, baselineEnduserToken,
-      'get', '/integrations/proxy-read', { integration: 'Stripe', type: 'subscriptions' })
-    await expectDenied('C: booking_info (mints a token) blocked', cToken, baselineEnduserToken,
-      'get', '/form-fields/booking-info', { bookingPageId: 'x' })
-    await expectDenied('C: form_responses stripe_details blocked', cToken, baselineEnduserToken,
-      'get', '/form-responses/stripe-details', {})
-    await expectDenied('C: products stripe-portal-session blocked', cToken, baselineEnduserToken,
-      'get', '/products/stripe-portal-session', {})
-
-    /* ===== D: granted portal reads still work ===== */
-
-    await expectAllowed('D: portal-customizations', cToken, 'get', '/portal-customizations')
-    await expectAllowed('D: calendar-events', cToken, 'get', '/calendar-events')
-    await expectAllowed('D: my-meetings', cToken, 'get', '/my-meetings')
-    await expectAllowed('D: chat-rooms', cToken, 'get', '/chat-rooms')
-    await expectAllowed('D: care-plans', cToken, 'get', '/care-plans')
-    await expectAllowed('D: form-responses', cToken, 'get', '/form-responses')
-    await expectAllowed('D: self enduser read', cToken, 'get', `/enduser/${enduser.id}`)
-    await expectAllowed('D: file-download-URL', cToken, 'get', '/file-download-URL', { secureName: 'nonexistent' })
-    await expectAllowed('D: enduser-session-info', cToken, 'get', '/enduser-session-info')
-
-    /* ===== E: zero behavior change controls ===== */
-
-    const adminMint = await sdk.api.endusers.generate_auth_token({ id: enduser.id })
-    record('E: admin-minted token is NOT scoped', !hasScope(adminMint.enduser),
-      `sessionScopes=${JSON.stringify((adminMint.enduser as any)?.sessionScopes)}`)
-    await expectAllowed('E: admin-minted token can write', adminMint.authToken, 'patch',
-      `/enduser/${enduser.id}`, { updates: { fname: 'AdminEditOk' } })
-
-    const fullMint = await fullUpdateStaff.api.endusers.generate_auth_token({ id: enduser.id })
-    record('E: update:All staff mints an UNSCOPED token', !hasScope(fullMint.enduser),
-      `sessionScopes=${JSON.stringify((fullMint.enduser as any)?.sessionScopes)}`)
-
-    const assignedMint = await assignedUpdateStaff.api.endusers.generate_auth_token({ id: assignedEnduser.id })
-    record('E: assigned-update staff UNSCOPED for an assigned patient', !hasScope(assignedMint.enduser),
-      `sessionScopes=${JSON.stringify((assignedMint.enduser as any)?.sessionScopes)}`)
-
-    const assignedMintUnassigned = await assignedUpdateStaff.api.endusers.generate_auth_token({ id: enduser.id })
-    record('E: assigned-update staff SCOPED for an unassigned patient', hasScope(assignedMintUnassigned.enduser),
-      `sessionScopes=${JSON.stringify((assignedMintUnassigned.enduser as any)?.sessionScopes)}`)
-
-    /* ===== report: print full table first, then assert (harness exits on first failure) ===== */
-    console.log('\n  F-0138 check summary:')
-    for (const c of checks) {
-      console.log(`    ${c.pass ? 'PASS' : 'FAIL'}  ${c.label}  —  ${c.detail}`)
-    }
-    console.log('')
-
-    for (const c of checks) {
-      assert(c.pass, `${c.label} — ${c.detail}`, c.label)
-    }
-  } finally {
-    for (const id of enduserIds) { try { await sdk.api.endusers.deleteOne(id) } catch {} }
-    for (const id of userIds) { try { await sdk.api.users.deleteOne(id) } catch {} }
-    for (const id of roleIds) { try { await sdk.api.role_based_access_permissions.deleteOne(id) } catch {} }
-  }
-}
-
-// Allow running this test file independently
-if (require.main === module) {
-  console.log(`🌐 Using API URL: ${host}`)
-  const sdk = new Session({ host })
-  const sdkNonAdmin = new Session({ host })
-
-  const runTests = async () => {
-    await setup_tests(sdk, sdkNonAdmin)
-    await readonly_enduser_preview_tests({ sdk, sdkNonAdmin })
-  }
-
-  runTests()
-    .then(() => {
-      console.log("✅ F-0138 portal-preview scope test suite completed successfully")
-      process.exit(0)
-    })
-    .catch((error) => {
-      console.error("❌ F-0138 portal-preview scope test suite failed:", error)
-      process.exit(1)
-    })
-}