@tellescope/sdk 1.256.14 → 1.256.16

package/lib/cjs/tests/api_tests/security/develop-health-benefit-verification-rbac.test.js

@@ -0,0 +1,314 @@
+"use strict";
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.develop_health_benefit_verification_rbac_tests = void 0;
+require('source-map-support').install();
+var bson_1 = require("bson");
+var sdk_1 = require("../../../sdk");
+var testing_1 = require("@tellescope/testing");
+var setup_1 = require("../../setup");
+var constants_1 = require("@tellescope/constants");
+var host = process.env.API_URL || 'http://localhost:8080';
+var _a = [process.env.NON_ADMIN_EMAIL, process.env.NON_ADMIN_PASSWORD], nonAdminEmail = _a[0], nonAdminPassword = _a[1];
+/**
+ * Regression test: the `develop_health_run_benefit_verification` RBAC gate.
+ *
+ * `enduser_eligibility_results.develop_health_run_benefit_verification` is registered with
+ * `noAccessPermissions: true` (packages/private/api/api/v1/api.ts, ~line 24606). Before the fix,
+ * it had no in-handler check on `session.access?.endusers?.read` /
+ * `session.access?.enduser_eligibility_results?.create`, so it loaded the caller-supplied
+ * enduser's PHI via `DB.endusers.findById` and forwarded it to the Develop Health integration
+ * regardless of the caller's role. It also let a zero-access caller fingerprint an enduser's
+ * profile completeness via the distinct validation error messages returned for missing fields.
+ *
+ * This test:
+ *   1. Creates a role with explicit NO_ACCESS for `endusers` and `enduser_eligibility_results`.
+ *   2. Assigns the role to the non-admin user and re-authenticates.
+ *   3. Calls the endpoint with a fake enduserId — asserts a 403-equivalent access error, not the
+ *      validation-error / integration-not-found path that would run pre-fix.
+ *
+ * Pre-fix: the handler proceeds past `DB.endusers.findById` and either 400s with a
+ * `validate_enduser_for_develop_health` message (enduser not found — since the id is fake) or,
+ * for a real target id, would load PHI and forward it to Develop Health. Either way, the access
+ * check never fires. Test fails (no access-denial signal).
+ *
+ * Post-fix: the handler throws 403 before touching `DB.endusers` at all. Test passes.
+ */
+var develop_health_benefit_verification_rbac_tests = function (_a) {
+    var sdk = _a.sdk, sdkNonAdmin = _a.sdkNonAdmin;
+    return __awaiter(void 0, void 0, void 0, function () {
+        var roleName, rbapId, originalRoles, rbap, providerRoleName, providerRbapId, providerRbap, _b, _c, _d, _e, _f, _g;
+        return __generator(this, function (_h) {
+            switch (_h.label) {
+                case 0:
+                    (0, testing_1.log_header)("develop_health benefit verification RBAC regression");
+                    roleName = "f0006-develop-health-no-access-".concat(Date.now());
+                    originalRoles = sdkNonAdmin.userInfo.roles;
+                    _h.label = 1;
+                case 1:
+                    _h.trys.push([1, , 27, 40]);
+                    return [4 /*yield*/, sdk.api.role_based_access_permissions.createOne({
+                            role: roleName,
+                            permissions: __assign(__assign({}, constants_1.PROVIDER_PERMISSIONS), { endusers: { create: null, read: null, update: null, delete: null }, enduser_eligibility_results: { create: null, read: null, update: null, delete: null } }),
+                        })];
+                case 2:
+                    rbap = _h.sent();
+                    rbapId = rbap.id;
+                    // 2. Assign the role to the non-admin user and re-authenticate so the new
+                    //    session reflects the role's denied permissions.
+                    return [4 /*yield*/, sdk.api.users.updateOne(sdkNonAdmin.userInfo.id, { roles: [roleName] }, { replaceObjectFields: true })];
+                case 3:
+                    // 2. Assign the role to the non-admin user and re-authenticate so the new
+                    //    session reflects the role's denied permissions.
+                    _h.sent();
+                    return [4 /*yield*/, (0, testing_1.wait)(undefined, 1500)];
+                case 4:
+                    _h.sent();
+                    return [4 /*yield*/, sdkNonAdmin.authenticate(nonAdminEmail, nonAdminPassword)
+                        // 3. develop_health_run_benefit_verification must throw 403 BEFORE any enduser lookup.
+                        //    Pre-fix: proceeds to DB.endusers.findById and either 400s on validation (fake id) or
+                        //    succeeds and forwards PHI to Develop Health (real id) — never a 403.
+                    ];
+                case 5:
+                    _h.sent();
+                    // 3. develop_health_run_benefit_verification must throw 403 BEFORE any enduser lookup.
+                    //    Pre-fix: proceeds to DB.endusers.findById and either 400s on validation (fake id) or
+                    //    succeeds and forwards PHI to Develop Health (real id) — never a 403.
+                    return [4 /*yield*/, (0, testing_1.async_test)("enduser_eligibility_results.develop_health_run_benefit_verification must throw 403 when role denies endusers/enduser_eligibility_results", function () { return sdkNonAdmin.api.enduser_eligibility_results.develop_health_run_benefit_verification({
+                            enduserId: new bson_1.ObjectId().toHexString(),
+                            providerUserId: new bson_1.ObjectId().toHexString(),
+                            insuranceType: 'primary',
+                            diagnoses: [],
+                            // drugs uses a plain (non-empty-ok) list validator, so a real-shaped entry is required
+                            // to pass request validation and actually reach the handler's access check.
+                            drugs: [{ name: 'Test Drug', dosage: '10mg', quantity: 1 }],
+                            drug_history: { currently_taking_drugs: [], previously_taken_drugs: [] },
+                        }); }, {
+                            shouldError: true,
+                            onError: function (e) {
+                                var _a;
+                                // Match the gate's exact message. The SDK error surfaces { message, info } (no top-level
+                                // status/code), so we key on the message rather than the HTTP status. This is deliberately
+                                // specific: a lapsed subscription ("Your subscription has expired") or an expired token
+                                // ("Unauthenticated") also errors BEFORE the handler runs, but neither contains this string,
+                                // so the test can't false-pass without the gate executing. Also reject the pre-fix
+                                // downstream messages, which would indicate the access check never fired.
+                                var msg = ((_a = e === null || e === void 0 ? void 0 : e.message) !== null && _a !== void 0 ? _a : '').toLowerCase();
+                                if (msg.includes('integration not found') || msg.includes('enduser is required')
+                                    || msg.includes('organization') || msg.includes('provider')) {
+                                    return false; // reached past the access gate — regression
+                                }
+                                return msg.includes('access to this resource');
+                            },
+                        })
+                        // 4. POSITIVE case: a provider role WITH enduser access must PASS the gate and reach the
+                        //    integration stage (this test org has no Develop Health integration, so it 400s with
+                        //    "Integration not found"). This guards against the gate over-blocking legitimate users —
+                        //    the failure mode a future tightening (e.g. gating on 'All') would introduce.
+                    ];
+                case 6:
+                    // 3. develop_health_run_benefit_verification must throw 403 BEFORE any enduser lookup.
+                    //    Pre-fix: proceeds to DB.endusers.findById and either 400s on validation (fake id) or
+                    //    succeeds and forwards PHI to Develop Health (real id) — never a 403.
+                    _h.sent();
+                    providerRoleName = "f0006-develop-health-provider-".concat(Date.now());
+                    providerRbapId = void 0;
+                    _h.label = 7;
+                case 7:
+                    _h.trys.push([7, , 13, 26]);
+                    return [4 /*yield*/, sdk.api.role_based_access_permissions.createOne({
+                            role: providerRoleName,
+                            permissions: __assign({}, constants_1.PROVIDER_PERMISSIONS), // endusers read/create non-null, eligibility create non-null
+                        })];
+                case 8:
+                    providerRbap = _h.sent();
+                    providerRbapId = providerRbap.id;
+                    return [4 /*yield*/, sdk.api.users.updateOne(sdkNonAdmin.userInfo.id, { roles: [providerRoleName] }, { replaceObjectFields: true })];
+                case 9:
+                    _h.sent();
+                    return [4 /*yield*/, (0, testing_1.wait)(undefined, 1500)];
+                case 10:
+                    _h.sent();
+                    return [4 /*yield*/, sdkNonAdmin.authenticate(nonAdminEmail, nonAdminPassword)];
+                case 11:
+                    _h.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)("a provider role with enduser access passes the gate (reaches 'Integration not found', not 403)", function () { return sdkNonAdmin.api.enduser_eligibility_results.develop_health_run_benefit_verification({
+                            enduserId: new bson_1.ObjectId().toHexString(),
+                            providerUserId: new bson_1.ObjectId().toHexString(),
+                            insuranceType: 'primary',
+                            diagnoses: [],
+                            drugs: [{ name: 'Test Drug', dosage: '10mg', quantity: 1 }],
+                            drug_history: { currently_taking_drugs: [], previously_taken_drugs: [] },
+                        }); }, {
+                            shouldError: true,
+                            onError: function (e) {
+                                var _a;
+                                var msg = ((_a = e === null || e === void 0 ? void 0 : e.message) !== null && _a !== void 0 ? _a : '').toLowerCase();
+                                // Must NOT be the access-denial message (that would mean the gate wrongly blocked a
+                                // provider). Reaching "Integration not found" (or org/provider validation) proves the
+                                // gate passed and the read-scoped enduser load did not over-restrict a legitimate role.
+                                if (msg.includes('access to this resource'))
+                                    return false;
+                                return msg.includes('integration not found') || msg.includes('organization') || msg.includes('provider');
+                            },
+                        })];
+                case 12:
+                    _h.sent();
+                    return [3 /*break*/, 26];
+                case 13:
+                    if (!providerRbapId) return [3 /*break*/, 25];
+                    _h.label = 14;
+                case 14:
+                    _h.trys.push([14, 16, , 17]);
+                    return [4 /*yield*/, sdk.api.users.updateOne(sdkNonAdmin.userInfo.id, { roles: originalRoles !== null && originalRoles !== void 0 ? originalRoles : [] }, { replaceObjectFields: true })];
+                case 15:
+                    _h.sent();
+                    return [3 /*break*/, 17];
+                case 16:
+                    _b = _h.sent();
+                    return [3 /*break*/, 17];
+                case 17:
+                    _h.trys.push([17, 19, , 20]);
+                    return [4 /*yield*/, sdk.api.role_based_access_permissions.deleteOne(providerRbapId)];
+                case 18:
+                    _h.sent();
+                    return [3 /*break*/, 20];
+                case 19:
+                    _c = _h.sent();
+                    return [3 /*break*/, 20];
+                case 20: return [4 /*yield*/, (0, testing_1.wait)(undefined, 1500)];
+                case 21:
+                    _h.sent();
+                    _h.label = 22;
+                case 22:
+                    _h.trys.push([22, 24, , 25]);
+                    return [4 /*yield*/, sdkNonAdmin.authenticate(nonAdminEmail, nonAdminPassword)];
+                case 23:
+                    _h.sent();
+                    return [3 /*break*/, 25];
+                case 24:
+                    _d = _h.sent();
+                    return [3 /*break*/, 25];
+                case 25: return [7 /*endfinally*/];
+                case 26: return [3 /*break*/, 40];
+                case 27:
+                    _h.trys.push([27, 29, , 30]);
+                    return [4 /*yield*/, sdk.api.users.updateOne(sdkNonAdmin.userInfo.id, { roles: originalRoles !== null && originalRoles !== void 0 ? originalRoles : [] }, { replaceObjectFields: true })];
+                case 28:
+                    _h.sent();
+                    return [3 /*break*/, 30];
+                case 29:
+                    _e = _h.sent();
+                    return [3 /*break*/, 30];
+                case 30:
+                    if (!rbapId) return [3 /*break*/, 34];
+                    _h.label = 31;
+                case 31:
+                    _h.trys.push([31, 33, , 34]);
+                    return [4 /*yield*/, sdk.api.role_based_access_permissions.deleteOne(rbapId)];
+                case 32:
+                    _h.sent();
+                    return [3 /*break*/, 34];
+                case 33:
+                    _f = _h.sent();
+                    return [3 /*break*/, 34];
+                case 34: 
+                // Re-authenticate the non-admin to drop the no-access role from their JWT
+                // before subsequent tests run.
+                return [4 /*yield*/, (0, testing_1.wait)(undefined, 1500)];
+                case 35:
+                    // Re-authenticate the non-admin to drop the no-access role from their JWT
+                    // before subsequent tests run.
+                    _h.sent();
+                    _h.label = 36;
+                case 36:
+                    _h.trys.push([36, 38, , 39]);
+                    return [4 /*yield*/, sdkNonAdmin.authenticate(nonAdminEmail, nonAdminPassword)];
+                case 37:
+                    _h.sent();
+                    return [3 /*break*/, 39];
+                case 38:
+                    _g = _h.sent();
+                    return [3 /*break*/, 39];
+                case 39: return [7 /*endfinally*/];
+                case 40: return [2 /*return*/];
+            }
+        });
+    });
+};
+exports.develop_health_benefit_verification_rbac_tests = develop_health_benefit_verification_rbac_tests;
+// Allow running this test file independently
+if (require.main === module) {
+    console.log("\uD83C\uDF10 Using API URL: ".concat(host));
+    var sdk_2 = new sdk_1.Session({ host: host });
+    var sdkNonAdmin_1 = new sdk_1.Session({ host: host });
+    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, (0, setup_1.setup_tests)(sdk_2, sdkNonAdmin_1)];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, (0, exports.develop_health_benefit_verification_rbac_tests)({ sdk: sdk_2, sdkNonAdmin: sdkNonAdmin_1 })];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); };
+    runTests()
+        .then(function () {
+        console.log("✅ develop_health_run_benefit_verification RBAC test suite completed successfully");
+        process.exit(0);
+    })
+        .catch(function (error) {
+        console.error("❌ develop_health_run_benefit_verification RBAC test suite failed:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=develop-health-benefit-verification-rbac.test.js.map

package/lib/cjs/tests/api_tests/security/develop-health-benefit-verification-rbac.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"develop-health-benefit-verification-rbac.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/develop-health-benefit-verification-rbac.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,6BAA+B;AAC/B,oCAAsC;AACtC,+CAI4B;AAC5B,qCAAyC;AACzC,mDAA4D;AAE5D,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAC9D,IAAA,KAAoC,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAhG,aAAa,QAAA,EAAE,gBAAgB,QAAiE,CAAA;AAEvG;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACI,IAAM,8CAA8C,GAAG,UAAO,EAA6D;QAA3D,GAAG,SAAA,EAAE,WAAW,iBAAA;;;;;;oBACrF,IAAA,oBAAU,EAAC,qDAAqD,CAAC,CAAA;oBAE3D,QAAQ,GAAG,yCAAkC,IAAI,CAAC,GAAG,EAAE,CAAE,CAAA;oBAEzD,aAAa,GAAG,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAA;;;;oBAOjC,qBAAM,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,SAAS,CAAC;4BACjE,IAAI,EAAE,QAAQ;4BACd,WAAW,wBACN,gCAAoB,KACvB,QAAQ,EAAuB,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EACvF,2BAA2B,EAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GACxF;yBACF,CAAC,EAAA;;oBAPI,IAAI,GAAG,SAOX;oBACF,MAAM,GAAG,IAAI,CAAC,EAAE,CAAA;oBAEhB,0EAA0E;oBAC1E,qDAAqD;oBACrD,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAC3B,WAAW,CAAC,QAAQ,CAAC,EAAE,EACvB,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,EACrB,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAC9B,EAAA;;oBAND,0EAA0E;oBAC1E,qDAAqD;oBACrD,SAIC,CAAA;oBACD,qBAAM,IAAA,cAAI,EAAC,SAAS,EAAE,IAAI,CAAC,EAAA;;oBAA3B,SAA2B,CAAA;oBAC3B,qBAAM,WAAW,CAAC,YAAY,CAAC,aAAc,EAAE,gBAAiB,CAAC;wBAEjE,uFAAuF;wBACvF,0FAA0F;wBAC1F,0EAA0E;sBAJT;;oBAAjE,SAAiE,CAAA;oBAEjE,uFAAuF;oBACvF,0FAA0F;oBAC1F,0EAA0E;oBAC1E,qBAAM,IAAA,oBAAU,EACd,0IAA0I,EAC1I,cAAM,OAAA,WAAW,CAAC,GAAG,CAAC,2BAA2B,CAAC,uCAAuC,CAAC;4BACxF,SAAS,EAAE,IAAI,eAAQ,EAAE,CAAC,WAAW,EAAE;4BACvC,cAAc,EAAE,IAAI,eAAQ,EAAE,CAAC,WAAW,EAAE;4BAC5C,aAAa,EAAE,SAAS;4BACxB,SAAS,EAAE,EAAE;4BACb,uFAAuF;4BACvF,4EAA4E;4BAC5E,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;4BAC3D,YAAY,EAAE,EAAE,sBAAsB,EAAE,EAAE,EAAE,sBAAsB,EAAE,EAAE,EAAE;yBAClE,CAAC,EATH,CASG,EACT;4BACE,WAAW,EAAE,IAAI;4BACjB,OAAO,EAAE,UAAC,CAAM;;gCACd,yFAAyF;gCACzF,2FAA2F;gCAC3F,wFAAwF;gCACxF,6FAA6F;gCAC7F,mFAAmF;gCACnF,0EAA0E;gCAC1E,IAAM,GAAG,GAAG,CAAC,MAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,mCAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;gCAC5C,IAAI,GAAG,CAAC,QAAQ,CAAC,uBAAuB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,qBAAqB,CAAC;uCAC3E,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE;oCAC7D,OAAO,KAAK,CAAA,CAAC,4CAA4C;iCAC1D;gCACD,OAAO,GAAG,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAA;4BAChD,CAAC;yBACF,CACF;wBAED,yFAAyF;wBACzF,yFAAyF;wBACzF,6FAA6F;wBAC7F,kFAAkF;sBALjF;;oBAhCD,uFAAuF;oBACvF,0FAA0F;oBAC1F,0EAA0E;oBAC1E,SA6BC,CAAA;oBAMK,gBAAgB,GAAG,wCAAiC,IAAI,CAAC,GAAG,EAAE,CAAE,CAAA;oBAClE,cAAc,SAAoB,CAAA;;;;oBAEf,qBAAM,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,SAAS,CAAC;4BACzE,IAAI,EAAE,gBAAgB;4BACtB,WAAW,eAAO,gCAAoB,CAAE,EAAE,6DAA6D;yBACxG,CAAC,EAAA;;oBAHI,YAAY,GAAG,SAGnB;oBACF,cAAc,GAAG,YAAY,CAAC,EAAE,CAAA;oBAEhC,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,EAAA;;oBAApH,SAAoH,CAAA;oBACpH,qBAAM,IAAA,cAAI,EAAC,SAAS,EAAE,IAAI,CAAC,EAAA;;oBAA3B,SAA2B,CAAA;oBAC3B,qBAAM,WAAW,CAAC,YAAY,CAAC,aAAc,EAAE,gBAAiB,CAAC,EAAA;;oBAAjE,SAAiE,CAAA;oBAEjE,qBAAM,IAAA,oBAAU,EACd,gGAAgG,EAChG,cAAM,OAAA,WAAW,CAAC,GAAG,CAAC,2BAA2B,CAAC,uCAAuC,CAAC;4BACxF,SAAS,EAAE,IAAI,eAAQ,EAAE,CAAC,WAAW,EAAE;4BACvC,cAAc,EAAE,IAAI,eAAQ,EAAE,CAAC,WAAW,EAAE;4BAC5C,aAAa,EAAE,SAAS;4BACxB,SAAS,EAAE,EAAE;4BACb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;4BAC3D,YAAY,EAAE,EAAE,sBAAsB,EAAE,EAAE,EAAE,sBAAsB,EAAE,EAAE,EAAE;yBAClE,CAAC,EAPH,CAOG,EACT;4BACE,WAAW,EAAE,IAAI;4BACjB,OAAO,EAAE,UAAC,CAAM;;gCACd,IAAM,GAAG,GAAG,CAAC,MAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,mCAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;gCAC5C,oFAAoF;gCACpF,sFAAsF;gCACtF,wFAAwF;gCACxF,IAAI,GAAG,CAAC,QAAQ,CAAC,yBAAyB,CAAC;oCAAE,OAAO,KAAK,CAAA;gCACzD,OAAO,GAAG,CAAC,QAAQ,CAAC,uBAAuB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;4BAC1G,CAAC;yBACF,CACF,EAAA;;oBArBD,SAqBC,CAAA;;;yBAEG,cAAc,EAAd,yBAAc;;;;oBAEd,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,EAAE,EAAE,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,EAAA;;oBAArH,SAAqH,CAAA;;;;;;;oBAEjH,qBAAM,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,SAAS,CAAC,cAAc,CAAC,EAAA;;oBAArE,SAAqE,CAAA;;;;;yBAC3E,qBAAM,IAAA,cAAI,EAAC,SAAS,EAAE,IAAI,CAAC,EAAA;;oBAA3B,SAA2B,CAAA;;;;oBACrB,qBAAM,WAAW,CAAC,YAAY,CAAC,aAAc,EAAE,gBAAiB,CAAC,EAAA;;oBAAjE,SAAiE,CAAA;;;;;;;;;oBAezE,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAC3B,WAAW,CAAC,QAAQ,CAAC,EAAE,EACvB,EAAE,KAAK,EAAE,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,EAAE,EAAE,EAC9B,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAC9B,EAAA;;oBAJD,SAIC,CAAA;;;;;;yBAEC,MAAM,EAAN,yBAAM;;;;oBACF,qBAAM,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,SAAS,CAAC,MAAM,CAAC,EAAA;;oBAA7D,SAA6D,CAAA;;;;;;gBAErE,0EAA0E;gBAC1E,+BAA+B;gBAC/B,qBAAM,IAAA,cAAI,EAAC,SAAS,EAAE,IAAI,CAAC,EAAA;;oBAF3B,0EAA0E;oBAC1E,+BAA+B;oBAC/B,SAA2B,CAAA;;;;oBACrB,qBAAM,WAAW,CAAC,YAAY,CAAC,aAAc,EAAE,gBAAiB,CAAC,EAAA;;oBAAjE,SAAiE,CAAA;;;;;;;;;;CAE1E,CAAA;AA7IY,QAAA,8CAA8C,kDA6I1D;AAED,6CAA6C;AAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAM,KAAG,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACjC,IAAM,aAAW,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IAEzC,IAAM,QAAQ,GAAG;;;wBACf,qBAAM,IAAA,mBAAW,EAAC,KAAG,EAAE,aAAW,CAAC,EAAA;;oBAAnC,SAAmC,CAAA;oBACnC,qBAAM,IAAA,sDAA8C,EAAC,EAAE,GAAG,OAAA,EAAE,WAAW,eAAA,EAAE,CAAC,EAAA;;oBAA1E,SAA0E,CAAA;;;;SAC3E,CAAA;IAED,QAAQ,EAAE;SACP,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAAA;QAC/F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,mEAAmE,EAAE,KAAK,CAAC,CAAA;QACzF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}

package/lib/cjs/tests/api_tests/security/enduser-cross-create.test.d.ts

@@ -0,0 +1,21 @@
+import { Session } from "../../../sdk";
+/**
+ * Regression test for the enduser cross-enduser CREATE gating gaps:
+ *   enduser_observations
+ *   enduser_orders
+ *   managed_content_records
+ *   chat_rooms (enduserIds-only gate; staff userIds targeting is by-design)
+ *
+ * Each model exposed enduserActions.create with an `enduserId`/`enduserIds` field that
+ * lacked a write-side gate, letting an authenticated enduser create records bound to a
+ * DIFFERENT enduser in the same tenant. The fix adds a `constraints.relationship`
+ * evaluator mirroring the canonical `tickets` pattern (schema.ts).
+ *
+ * Methodology: each section asserts BOTH the exploit-is-blocked case AND that the
+ * legitimate path (self-create + staff-create) still works.
+ */
+export declare const enduser_cross_create_tests: ({ sdk }: {
+    sdk: Session;
+    sdkNonAdmin: Session;
+}) => Promise<void>;
+//# sourceMappingURL=enduser-cross-create.test.d.ts.map

package/lib/cjs/tests/api_tests/security/enduser-cross-create.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enduser-cross-create.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/enduser-cross-create.test.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAkB,MAAM,cAAc,CAAA;AActD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,0BAA0B;SAA2B,OAAO;iBAAe,OAAO;mBAuK9F,CAAA"}