@tellescope/sdk 1.256.14 → 1.256.16

package/lib/esm/tests/api_tests/security/file-link-session-confinement.test.js

@@ -0,0 +1,349 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+require('source-map-support').install();
+import axios from "axios";
+import { assert_checks, setup_isolated_tenant, } from "../../setup_isolated";
+var host = process.env.API_URL || 'http://localhost:8080';
+var RAND = function () { return Math.random().toString(36).slice(2, 10); };
+var probe = function (method, path, o) {
+    if (o === void 0) { o = {}; }
+    return __awaiter(void 0, void 0, void 0, function () {
+        var r;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, axios.request({
+                        method: method,
+                        url: "".concat(host, "/v1").concat(path),
+                        params: o.params,
+                        data: o.data,
+                        headers: o.token ? { Authorization: "Bearer ".concat(o.token) } : undefined,
+                        validateStatus: function () { return true; },
+                    })];
+                case 1:
+                    r = _a.sent();
+                    return [2 /*return*/, { status: r.status, body: r.data }];
+            }
+        });
+    });
+};
+export var file_link_session_confinement_checks = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var checks, record, tenant, sdk_1, enduser_1, newFile, fileA_1, fileB_1, mint, adminFiles, confinement_probes, plain, shared, methods, send, verify, _a, header, payload, decoded, forged, forgedSend, send, e_1;
+    return __generator(this, function (_b) {
+        switch (_b.label) {
+            case 0:
+                checks = [];
+                record = function (label, pass, detail) { return checks.push({ label: label, pass: pass, detail: detail }); };
+                _b.label = 1;
+            case 1:
+                _b.trys.push([1, , 22, 27]);
+                return [4 /*yield*/, setup_isolated_tenant({
+                        name: "FileLink ".concat(RAND()), users: [{ isAdmin: true }], apiKeys: 0,
+                    })];
+            case 2:
+                tenant = _b.sent();
+                sdk_1 = tenant.sdk;
+                return [4 /*yield*/, sdk_1.api.endusers.createOne({
+                        fname: 'FileLink', lname: 'Recipient',
+                        email: "dontsend-filelink-".concat(RAND(), "@tellescope.com"),
+                        phone: '+15555550100',
+                        dateOfBirth: '01-01-1990',
+                    })
+                    // No S3 upload needed: prepare_file_upload inserts the files record with its secureName
+                    // immediately, and file_download_URL only SIGNS a GET url — it never checks the object exists.
+                ];
+            case 3:
+                enduser_1 = _b.sent();
+                newFile = function (name) { return __awaiter(void 0, void 0, void 0, function () {
+                    return __generator(this, function (_a) {
+                        switch (_a.label) {
+                            case 0: return [4 /*yield*/, sdk_1.api.files.prepare_file_upload({
+                                    name: name,
+                                    type: 'application/pdf', size: 1000, enduserId: enduser_1.id,
+                                })];
+                            case 1: return [2 /*return*/, ((_a.sent()).file)];
+                        }
+                    });
+                }); };
+                return [4 /*yield*/, newFile("shared-".concat(RAND(), ".pdf"))]; // the one that gets shared
+            case 4:
+                fileA_1 = _b.sent() // the one that gets shared
+                ;
+                return [4 /*yield*/, newFile("private-".concat(RAND(), ".pdf"))
+                    /**
+                     * Mints a token exactly the way a real send does — get_templated_message is the endpoint the
+                     * worker calls (worker/app.js handleOutgoingEmail).
+                     *
+                     * replaceLinks always rewrites the resolved link into a tracking redirect, so `plaintext` holds
+                     * `doc (${API_URL}/r/<redirectToken>)` rather than the portal URL. Follow the 302 to recover it.
+                     */
+                ]; // the rest of the patient's chart
+            case 5:
+                fileB_1 = _b.sent() // the rest of the patient's chart
+                ;
+                mint = function (verb) { return __awaiter(void 0, void 0, void 0, function () {
+                    var plaintext, redirectURL, r, location, token;
+                    var _a, _b;
+                    return __generator(this, function (_c) {
+                        switch (_c.label) {
+                            case 0: return [4 /*yield*/, sdk_1.api.templates.get_templated_message({
+                                    channel: 'Email',
+                                    userId: tenant.users[0].id,
+                                    enduserId: enduser_1.id,
+                                    message: "{{files.".concat(fileA_1.id, ".").concat(verb, ":doc}}"),
+                                })];
+                            case 1:
+                                plaintext = (_c.sent()).plaintext;
+                                redirectURL = (_a = plaintext.match(/\((https?:\/\/[^)\s]+)\)/)) === null || _a === void 0 ? void 0 : _a[1];
+                                if (!redirectURL)
+                                    return [2 /*return*/, { token: undefined, detail: "no link resolved from: ".concat(plaintext) }];
+                                return [4 /*yield*/, axios.get(redirectURL, { maxRedirects: 0, validateStatus: function () { return true; } })];
+                            case 2:
+                                r = _c.sent();
+                                location = r.headers['location'];
+                                if (!location)
+                                    return [2 /*return*/, { token: undefined, detail: "redirect did not 302 (".concat(r.status, ")") }];
+                                token = (_b = new URL(location).searchParams.get('token')) !== null && _b !== void 0 ? _b : undefined;
+                                return [2 /*return*/, { token: token, detail: token ? 'minted' : "no token in ".concat(location) }];
+                        }
+                    });
+                }); };
+                return [4 /*yield*/, probe('get', '/files', { token: tenant.users[0].authToken })];
+            case 6:
+                adminFiles = _b.sent();
+                record('control: admin session lists files', adminFiles.status === 200, "status ".concat(adminFiles.status));
+                confinement_probes = function (variant, token) { return __awaiter(void 0, void 0, void 0, function () {
+                    var p, _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, refreshed, leaked, refreshedToken, _s, _t, _u, _v;
+                    var _w;
+                    return __generator(this, function (_x) {
+                        switch (_x.label) {
+                            case 0:
+                                p = function (label, expected, r) { return record("".concat(variant, " \u2014 ").concat(label), r.status === expected, "status ".concat(r.status, " (expected ").concat(expected, ")")); };
+                                _a = p;
+                                _b = ['1: downloads the shared file', 200];
+                                return [4 /*yield*/, probe('get', '/file-download-URL', { token: token, params: { secureName: fileA_1.secureName } })];
+                            case 1:
+                                _a.apply(void 0, _b.concat([_x.sent()]));
+                                _c = p;
+                                _d = ['2: cannot download another file on the same patient', 403];
+                                return [4 /*yield*/, probe('get', '/file-download-URL', { token: token, params: { secureName: fileB_1.secureName } })];
+                            case 2:
+                                _c.apply(void 0, _d.concat([_x.sent()]));
+                                // validateInput merges query, then body, then params — body wins over query, so a pin checked
+                                // against req.query rather than req.validated would be sidesteppable exactly like this.
+                                _e = p;
+                                _f = ['3: cannot smuggle another secureName through the body', 403];
+                                return [4 /*yield*/, probe('get', '/file-download-URL', {
+                                        token: token,
+                                        params: { secureName: fileA_1.secureName }, data: { secureName: fileB_1.secureName },
+                                    })];
+                            case 3:
+                                // validateInput merges query, then body, then params — body wins over query, so a pin checked
+                                // against req.query rather than req.validated would be sidesteppable exactly like this.
+                                _e.apply(void 0, _f.concat([_x.sent()]));
+                                // a listing would turn the pin into a directory of the patient's chart
+                                _g = p;
+                                _h = ['4: cannot list files', 403];
+                                return [4 /*yield*/, probe('get', '/files', { token: token })];
+                            case 4:
+                                // a listing would turn the pin into a directory of the patient's chart
+                                _g.apply(void 0, _h.concat([_x.sent()]));
+                                _j = p;
+                                _k = ['5a: cannot read chats', 403];
+                                return [4 /*yield*/, probe('get', '/chats', { token: token })];
+                            case 5:
+                                _j.apply(void 0, _k.concat([_x.sent()]));
+                                _l = p;
+                                _m = ['5b: cannot read form responses', 403];
+                                return [4 /*yield*/, probe('get', '/form-responses', { token: token })];
+                            case 6:
+                                _l.apply(void 0, _m.concat([_x.sent()]));
+                                _o = p;
+                                _p = ['5c: cannot read observations', 403];
+                                return [4 /*yield*/, probe('get', '/enduser-observations', { token: token })];
+                            case 7:
+                                _o.apply(void 0, _p.concat([_x.sent()]));
+                                _q = p;
+                                _r = ['6: cannot update the patient', 403];
+                                return [4 /*yield*/, probe('patch', "/enduser/".concat(enduser_1.id), { token: token, data: { updates: { fname: 'Overwritten' } } })];
+                            case 8:
+                                _q.apply(void 0, _r.concat([_x.sent()]));
+                                return [4 /*yield*/, probe('post', '/refresh-enduser-session', { token: token })];
+                            case 9:
+                                refreshed = _x.sent();
+                                p('7: can refresh its own session', 200, refreshed);
+                                leaked = ['dateOfBirth', 'email', 'phone', 'fields', 'insurance', 'lname']
+                                    .filter(function (f) { var _a, _b; return ((_b = (_a = refreshed.body) === null || _a === void 0 ? void 0 : _a.enduser) !== null && _b !== void 0 ? _b : {})[f] !== undefined; });
+                                record("".concat(variant, " \u2014 7b: refresh response withholds patient fields"), refreshed.status === 200 && leaked.length === 0, leaked.length ? "leaked: ".concat(leaked.join(', ')) : 'no patient fields in payload');
+                                refreshedToken = (_w = refreshed.body) === null || _w === void 0 ? void 0 : _w.authToken;
+                                if (!(typeof refreshedToken === 'string' && refreshedToken)) return [3 /*break*/, 12];
+                                _s = p;
+                                _t = ['8a: refreshed token still cannot download another file', 403];
+                                return [4 /*yield*/, probe('get', '/file-download-URL', {
+                                        token: refreshedToken, params: { secureName: fileB_1.secureName },
+                                    })];
+                            case 10:
+                                _s.apply(void 0, _t.concat([_x.sent()]));
+                                _u = p;
+                                _v = ['8b: refreshed token still cannot update the patient', 403];
+                                return [4 /*yield*/, probe('patch', "/enduser/".concat(enduser_1.id), {
+                                        token: refreshedToken, data: { updates: { fname: 'Overwritten' } },
+                                    })];
+                            case 11:
+                                _u.apply(void 0, _v.concat([_x.sent()]));
+                                return [3 /*break*/, 13];
+                            case 12:
+                                record("".concat(variant, " \u2014 8: refreshed token available"), false, 'refresh returned no authToken');
+                                _x.label = 13;
+                            case 13: return [2 /*return*/];
+                        }
+                    });
+                }); };
+                return [4 /*yield*/, mint('link')];
+            case 7:
+                plain = _b.sent();
+                if (!plain.token) return [3 /*break*/, 9];
+                return [4 /*yield*/, confinement_probes('link', plain.token)];
+            case 8:
+                _b.sent();
+                return [3 /*break*/, 10];
+            case 9:
+                record('link — minted', false, plain.detail);
+                _b.label = 10;
+            case 10: return [4 /*yield*/, mint('shared-link')];
+            case 11:
+                shared = _b.sent();
+                if (!shared.token) return [3 /*break*/, 13];
+                return [4 /*yield*/, confinement_probes('shared-link', shared.token)];
+            case 12:
+                _b.sent();
+                return [3 /*break*/, 14];
+            case 13:
+                // Before the shared-link verb exists the merge field does not resolve. Record it and skip the
+                // shared probes rather than throwing, so the first run reports the whole picture at once.
+                record('shared-link — minted', false, shared.detail);
+                _b.label = 14;
+            case 14:
+                if (!shared.token) return [3 /*break*/, 19];
+                return [4 /*yield*/, probe('get', '/endusers/otp-methods', { params: { token: shared.token } })];
+            case 15:
+                methods = _b.sent();
+                record('shared-link — 9: OTP methods are not offered', methods.status === 403, "status ".concat(methods.status, " (expected 403)"));
+                return [4 /*yield*/, probe('post', '/endusers/send-otp-code', {
+                        data: { token: shared.token, method: 'email' },
+                    })];
+            case 16:
+                send = _b.sent();
+                record('shared-link — 10: cannot make us send the patient a login code', send.status === 403, "status ".concat(send.status, " (expected 403)"));
+                return [4 /*yield*/, probe('post', '/endusers/verify-otp-code', {
+                        data: { token: shared.token, code: '000000' },
+                    })];
+            case 17:
+                verify = _b.sent();
+                record('shared-link — 11: OTP verification refuses the scope before checking the code', verify.status === 403, "status ".concat(verify.status, " (expected 403, 400 = reached the code check)"));
+                _a = shared.token.split('.'), header = _a[0], payload = _a[1];
+                decoded = JSON.parse(Buffer.from(payload, 'base64url').toString());
+                delete decoded.sessionScopes;
+                delete decoded.scopeContext;
+                forged = [
+                    header,
+                    Buffer.from(JSON.stringify(decoded)).toString('base64url'),
+                    'not-a-real-signature',
+                ].join('.');
+                return [4 /*yield*/, probe('post', '/endusers/send-otp-code', {
+                        data: { token: forged, method: 'email' },
+                    })];
+            case 18:
+                forgedSend = _b.sent();
+                record('shared-link — 12: a forged token cannot strip the scope to unlock OTP', forgedSend.status === 403 || forgedSend.status === 401 || forgedSend.status === 404, "status ".concat(forgedSend.status, " (expected 401/403/404; 204 = signature never verified)"));
+                _b.label = 19;
+            case 19:
+                if (!plain.token) return [3 /*break*/, 21];
+                return [4 /*yield*/, probe('post', '/endusers/send-otp-code', {
+                        data: { token: plain.token, method: 'email' },
+                    })];
+            case 20:
+                send = _b.sent();
+                record('link — 13: patient OTP recovery still works', send.status === 204, "status ".concat(send.status, " (expected 204)"));
+                _b.label = 21;
+            case 21: return [3 /*break*/, 27];
+            case 22:
+                if (!tenant) return [3 /*break*/, 26];
+                _b.label = 23;
+            case 23:
+                _b.trys.push([23, 25, , 26]);
+                return [4 /*yield*/, tenant.teardown()];
+            case 24:
+                _b.sent();
+                return [3 /*break*/, 26];
+            case 25:
+                e_1 = _b.sent();
+                console.error('teardown failed', e_1);
+                return [3 /*break*/, 26];
+            case 26: return [7 /*endfinally*/];
+            case 27: return [2 /*return*/, checks];
+        }
+    });
+}); };
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+export var file_link_session_confinement_tests = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var _a, _b;
+    return __generator(this, function (_c) {
+        switch (_c.label) {
+            case 0:
+                _a = assert_checks;
+                _b = ['Shared file link session confinement'];
+                return [4 /*yield*/, file_link_session_confinement_checks()];
+            case 1:
+                _a.apply(void 0, _b.concat([_c.sent()]));
+                return [2 /*return*/];
+        }
+    });
+}); };
+// Allow running this test file independently
+if (require.main === module) {
+    console.log("\uD83C\uDF10 Using API URL: ".concat(host));
+    file_link_session_confinement_tests()
+        .then(function () {
+        console.log("✅ file link session confinement test suite completed successfully");
+        process.exit(0);
+    })
+        .catch(function (error) {
+        console.error("❌ file link session confinement test suite failed:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=file-link-session-confinement.test.js.map

package/lib/esm/tests/api_tests/security/file-link-session-confinement.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-link-session-confinement.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/file-link-session-confinement.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,EACL,aAAa,EAEb,qBAAqB,GACtB,MAAM,sBAAsB,CAAA;AAE7B,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE,IAAM,IAAI,GAAG,cAAM,OAAA,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAvC,CAAuC,CAAA;AAuC1D,IAAM,KAAK,GAAG,UACZ,MAAgC,EAChC,IAAY,EACZ,CAA0D;IAA1D,kBAAA,EAAA,MAA0D;;;;;wBAEhD,qBAAM,KAAK,CAAC,OAAO,CAAC;wBAC5B,MAAM,QAAA;wBACN,GAAG,EAAE,UAAG,IAAI,gBAAM,IAAI,CAAE;wBACxB,MAAM,EAAE,CAAC,CAAC,MAAM;wBAChB,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,iBAAU,CAAC,CAAC,KAAK,CAAE,EAAE,CAAC,CAAC,CAAC,SAAS;wBACrE,cAAc,EAAE,cAAM,OAAA,IAAI,EAAJ,CAAI;qBAC3B,CAAC,EAAA;;oBAPI,CAAC,GAAG,SAOR;oBACF,sBAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAA;;;;CAC1C,CAAA;AAED,MAAM,CAAC,IAAM,oCAAoC,GAAG;;;;;gBAC5C,MAAM,GAAY,EAAE,CAAA;gBACpB,MAAM,GAAG,UAAC,KAAa,EAAE,IAAa,EAAE,MAAc,IAAK,OAAA,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,OAAA,EAAE,IAAI,MAAA,EAAE,MAAM,QAAA,EAAE,CAAC,EAApC,CAAoC,CAAA;;;;gBAK1F,qBAAM,qBAAqB,CAAC;wBACnC,IAAI,EAAE,mBAAY,IAAI,EAAE,CAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;qBACnE,CAAC,EAAA;;gBAFF,MAAM,GAAG,SAEP,CAAA;gBACI,QAAM,MAAM,CAAC,GAAG,CAAA;gBAGN,qBAAM,KAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;wBAC/C,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW;wBACrC,KAAK,EAAE,4BAAqB,IAAI,EAAE,oBAAiB;wBACnD,KAAK,EAAE,cAAc;wBACrB,WAAW,EAAE,YAAY;qBAC1B,CAAC;oBAEF,wFAAwF;oBACxF,+FAA+F;kBAH7F;;gBALI,YAAU,SAKd;gBAII,OAAO,GAAG,UAAO,IAAY;;;oCAChC,qBAAM,KAAG,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC;oCACvC,IAAI,MAAA;oCAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAO,CAAC,EAAE;iCACjE,CAAC,EAAA;oCAHoC,sBAAA,CACtC,CAAC,SAEC,CAAC,CAAC,IAAI,CACT,EAAA;;;qBAAA,CAAA;gBACa,qBAAM,OAAO,CAAC,iBAAU,IAAI,EAAE,SAAM,CAAC,EAAA,CAAG,2BAA2B;;gBAA3E,UAAQ,SAAqC,CAAG,2BAA2B;gBAA9B;gBACrC,qBAAM,OAAO,CAAC,kBAAW,IAAI,EAAE,SAAM,CAAC;oBAEpD;;;;;;uBAMG;kBARiD,CAAE,kCAAkC;;gBAAlF,UAAQ,SAAsC,CAAE,kCAAkC;gBAApC;gBAS9C,IAAI,GAAG,UAAO,IAA4B;;;;;oCACxB,qBAAM,KAAG,CAAC,GAAG,CAAC,SAAS,CAAC,qBAAqB,CAAC;oCAClE,OAAO,EAAE,OAAO;oCAChB,MAAM,EAAE,MAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE;oCAC3B,SAAS,EAAE,SAAO,CAAC,EAAE;oCACrB,OAAO,EAAE,kBAAW,OAAK,CAAC,EAAE,cAAI,IAAI,WAAQ;iCAC7C,CAAC,EAAA;;gCALM,SAAS,GAAK,CAAA,SAKpB,CAAA,UALe;gCAOX,WAAW,GAAG,MAAA,SAAS,CAAC,KAAK,CAAC,0BAA0B,CAAC,0CAAG,CAAC,CAAC,CAAA;gCACpE,IAAI,CAAC,WAAW;oCAAE,sBAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,iCAA0B,SAAS,CAAE,EAAE,EAAA;gCAElF,qBAAM,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,cAAc,EAAE,cAAM,OAAA,IAAI,EAAJ,CAAI,EAAE,CAAC,EAAA;;gCAAjF,CAAC,GAAG,SAA6E;gCACjF,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;gCACtC,IAAI,CAAC,QAAQ;oCAAE,sBAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,gCAAyB,CAAC,CAAC,MAAM,MAAG,EAAE,EAAA;gCAElF,KAAK,GAAG,MAAA,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,mCAAI,SAAS,CAAA;gCACtE,sBAAO,EAAE,KAAK,OAAA,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,sBAAe,QAAQ,CAAE,EAAE,EAAA;;;qBACvE,CAAA;gBAKkB,qBAAM,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,EAAA;;gBAA/E,UAAU,GAAG,SAAkE;gBACrF,MAAM,CACJ,oCAAoC,EACpC,UAAU,CAAC,MAAM,KAAK,GAAG,EAAE,iBAAU,UAAU,CAAC,MAAM,CAAE,CACzD,CAAA;gBAEK,kBAAkB,GAAG,UAAO,OAA+B,EAAE,KAAa;;;;;;gCACxE,CAAC,GAAG,UAAC,KAAa,EAAE,QAAgB,EAAE,CAAQ,IAAK,OAAA,MAAM,CAC7D,UAAG,OAAO,qBAAM,KAAK,CAAE,EAAE,CAAC,CAAC,MAAM,KAAK,QAAQ,EAAE,iBAAU,CAAC,CAAC,MAAM,wBAAc,QAAQ,MAAG,CAC5F,EAFwD,CAExD,CAAA;gCAED,KAAA,CAAC,CAAA;sCAAC,8BAA8B,EAAE,GAAG;gCACnC,qBAAM,KAAK,CAAC,KAAK,EAAE,oBAAoB,EAAE,EAAE,KAAK,OAAA,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,OAAK,CAAC,UAAU,EAAE,EAAE,CAAC,EAAA;;gCAD/F,4BACE,SAA6F,GAAC,CAAA;gCAEhG,KAAA,CAAC,CAAA;sCAAC,qDAAqD,EAAE,GAAG;gCAC1D,qBAAM,KAAK,CAAC,KAAK,EAAE,oBAAoB,EAAE,EAAE,KAAK,OAAA,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,OAAK,CAAC,UAAU,EAAE,EAAE,CAAC,EAAA;;gCAD/F,4BACE,SAA6F,GAAC,CAAA;gCAEhG,8FAA8F;gCAC9F,wFAAwF;gCACxF,KAAA,CAAC,CAAA;sCAAC,uDAAuD,EAAE,GAAG;gCAC5D,qBAAM,KAAK,CAAC,KAAK,EAAE,oBAAoB,EAAE;wCACvC,KAAK,OAAA;wCAAE,MAAM,EAAE,EAAE,UAAU,EAAE,OAAK,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,OAAK,CAAC,UAAU,EAAE;qCACxF,CAAC,EAAA;;gCALJ,8FAA8F;gCAC9F,wFAAwF;gCACxF,4BACE,SAEE,GAAC,CAAA;gCAEL,uEAAuE;gCACvE,KAAA,CAAC,CAAA;sCAAC,sBAAsB,EAAE,GAAG;gCAAE,qBAAM,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;;gCADtE,uEAAuE;gCACvE,4BAA+B,SAAuC,GAAC,CAAA;gCAEvE,KAAA,CAAC,CAAA;sCAAC,uBAAuB,EAAE,GAAG;gCAAE,qBAAM,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;;gCAAvE,4BAAgC,SAAuC,GAAC,CAAA;gCACxE,KAAA,CAAC,CAAA;sCAAC,gCAAgC,EAAE,GAAG;gCAAE,qBAAM,KAAK,CAAC,KAAK,EAAE,iBAAiB,EAAE,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;;gCAAzF,4BAAyC,SAAgD,GAAC,CAAA;gCAC1F,KAAA,CAAC,CAAA;sCAAC,8BAA8B,EAAE,GAAG;gCAAE,qBAAM,KAAK,CAAC,KAAK,EAAE,uBAAuB,EAAE,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;;gCAA7F,4BAAuC,SAAsD,GAAC,CAAA;gCAE9F,KAAA,CAAC,CAAA;sCAAC,8BAA8B,EAAE,GAAG;gCACnC,qBAAM,KAAK,CAAC,OAAO,EAAE,mBAAY,SAAO,CAAC,EAAE,CAAE,EAAE,EAAE,KAAK,OAAA,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,EAAA;;gCADxG,4BACE,SAAsG,GAAC,CAAA;gCAEvF,qBAAM,KAAK,CAAC,MAAM,EAAE,0BAA0B,EAAE,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;;gCAAtE,SAAS,GAAG,SAA0D;gCAC5E,CAAC,CAAC,gCAAgC,EAAE,GAAG,EAAE,SAAS,CAAC,CAAA;gCAG7C,MAAM,GAAG,CAAC,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC;qCAC7E,MAAM,CAAC,UAAA,CAAC,gBAAI,OAAA,CAAC,MAAA,MAAA,SAAS,CAAC,IAAI,0CAAE,OAAO,mCAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAA,EAAA,CAAC,CAAA;gCAChE,MAAM,CACJ,UAAG,OAAO,0DAAkD,EAC5D,SAAS,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAC/C,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAW,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAE,CAAC,CAAC,CAAC,8BAA8B,CAChF,CAAA;gCAGK,cAAc,GAAG,MAAA,SAAS,CAAC,IAAI,0CAAE,SAAS,CAAA;qCAC5C,CAAA,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,CAAA,EAApD,yBAAoD;gCACtD,KAAA,CAAC,CAAA;sCAAC,wDAAwD,EAAE,GAAG;gCAC7D,qBAAM,KAAK,CAAC,KAAK,EAAE,oBAAoB,EAAE;wCACvC,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,OAAK,CAAC,UAAU,EAAE;qCAChE,CAAC,EAAA;;gCAHJ,4BACE,SAEE,GAAC,CAAA;gCACL,KAAA,CAAC,CAAA;sCAAC,qDAAqD,EAAE,GAAG;gCAC1D,qBAAM,KAAK,CAAC,OAAO,EAAE,mBAAY,SAAO,CAAC,EAAE,CAAE,EAAE;wCAC7C,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE;qCACnE,CAAC,EAAA;;gCAHJ,4BACE,SAEE,GAAC,CAAA;;;gCAEL,MAAM,CAAC,UAAG,OAAO,yCAAiC,EAAE,KAAK,EAAE,+BAA+B,CAAC,CAAA;;;;;qBAE9F,CAAA;gBAEa,qBAAM,IAAI,CAAC,MAAM,CAAC,EAAA;;gBAA1B,KAAK,GAAG,SAAkB;qBAC5B,KAAK,CAAC,KAAK,EAAX,wBAAW;gBACb,qBAAM,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,EAAA;;gBAA7C,SAA6C,CAAA;;;gBAE7C,MAAM,CAAC,eAAe,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;;qBAG/B,qBAAM,IAAI,CAAC,aAAa,CAAC,EAAA;;gBAAlC,MAAM,GAAG,SAAyB;qBACpC,MAAM,CAAC,KAAK,EAAZ,yBAAY;gBACd,qBAAM,kBAAkB,CAAC,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,EAAA;;gBAArD,SAAqD,CAAA;;;gBAErD,8FAA8F;gBAC9F,0FAA0F;gBAC1F,MAAM,CAAC,sBAAsB,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;;;qBAKlD,MAAM,CAAC,KAAK,EAAZ,yBAAY;gBACE,qBAAM,KAAK,CAAC,KAAK,EAAE,uBAAuB,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,EAAA;;gBAA1F,OAAO,GAAG,SAAgF;gBAChG,MAAM,CACJ,8CAA8C,EAC9C,OAAO,CAAC,MAAM,KAAK,GAAG,EAAE,iBAAU,OAAO,CAAC,MAAM,oBAAiB,CAClE,CAAA;gBAEY,qBAAM,KAAK,CAAC,MAAM,EAAE,yBAAyB,EAAE;wBAC1D,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE;qBAC/C,CAAC,EAAA;;gBAFI,IAAI,GAAG,SAEX;gBACF,MAAM,CACJ,gEAAgE,EAChE,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,iBAAU,IAAI,CAAC,MAAM,oBAAiB,CAC5D,CAAA;gBAGc,qBAAM,KAAK,CAAC,MAAM,EAAE,2BAA2B,EAAE;wBAC9D,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE;qBAC9C,CAAC,EAAA;;gBAFI,MAAM,GAAG,SAEb;gBACF,MAAM,CACJ,+EAA+E,EAC/E,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,iBAAU,MAAM,CAAC,MAAM,kDAA+C,CAC9F,CAAA;gBAKK,KAAoB,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAA1C,MAAM,QAAA,EAAE,OAAO,QAAA,CAA2B;gBAC3C,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;gBACxE,OAAO,OAAO,CAAC,aAAa,CAAA;gBAC5B,OAAO,OAAO,CAAC,YAAY,CAAA;gBACrB,MAAM,GAAG;oBACb,MAAM;oBACN,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;oBAC1D,sBAAsB;iBACvB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBAEQ,qBAAM,KAAK,CAAC,MAAM,EAAE,yBAAyB,EAAE;wBAChE,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;qBACzC,CAAC,EAAA;;gBAFI,UAAU,GAAG,SAEjB;gBACF,MAAM,CACJ,uEAAuE,EACvE,UAAU,CAAC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,KAAK,GAAG,EACnF,iBAAU,UAAU,CAAC,MAAM,4DAAyD,CACrF,CAAA;;;qBAGC,KAAK,CAAC,KAAK,EAAX,yBAAW;gBAGA,qBAAM,KAAK,CAAC,MAAM,EAAE,yBAAyB,EAAE;wBAC1D,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE;qBAC9C,CAAC,EAAA;;gBAFI,IAAI,GAAG,SAEX;gBACF,MAAM,CACJ,6CAA6C,EAC7C,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,iBAAU,IAAI,CAAC,MAAM,oBAAiB,CAC5D,CAAA;;;;qBAKC,MAAM,EAAN,yBAAM;;;;gBAAU,qBAAM,MAAM,CAAC,QAAQ,EAAE,EAAA;;gBAAvB,SAAuB,CAAA;;;;gBAAe,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,GAAC,CAAC,CAAA;;;qBAG/F,sBAAO,MAAM,EAAA;;;KACd,CAAA;AAED,kFAAkF;AAClF,MAAM,CAAC,IAAM,mCAAmC,GAAG;;;;;gBACjD,KAAA,aAAa,CAAA;sBAAC,sCAAsC;gBAAE,qBAAM,oCAAoC,EAAE,EAAA;;gBAAlG,4BAAsD,SAA4C,GAAC,CAAA;;;;KACpG,CAAA;AAED,6CAA6C;AAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,mCAAmC,EAAE;SAClC,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAA;QAChF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,oDAAoD,EAAE,KAAK,CAAC,CAAA;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}

package/lib/esm/tests/api_tests/security/form-logic-js-execution.test.d.ts

@@ -0,0 +1,32 @@
+import { Check } from "../../setup_isolated";
+/**
+ * Regression test: `$JS(...)` must be rejected in stored conditional logic.
+ *
+ * `responses_satisfy_conditions` (utilities/src/utils.ts) compiled a stored condition value of the
+ * form `$JS(...)` with `new Function()` and executed it — in every form-filler's browser, including
+ * anonymous visitors on public intake pages, AND inside the API process (automation_triggers.ts
+ * trigger matching on every form submission, ai_agent/form_filling.ts voice-agent navigation). The
+ * API process holds every tenant's database handle, so a condition authored by staff in one tenant
+ * reached all of them. Any staff user or API key with form_fields write access could plant one by
+ * typing into the free-text $gt/$lt box — no API call required.
+ *
+ * The sink is removed. This asserts the second half of the fix: `compoundFilterValidator` rejects the
+ * syntax at write time on every field that feeds that evaluator, so it cannot be reintroduced through
+ * stored configuration. The runtime half — that a `$JS` value is never evaluated — is covered by the
+ * pure-function cases in `form_conditional_logic_tests` in tests.ts.
+ *
+ * The five condition locations were established by enumerating every `responses_satisfy_conditions`
+ * call site, and all five are covered here. That completeness matters: the first run of this test
+ * caught a half fix. `event.conditions` is wrapped in an `orValidator`, which returns the first arm
+ * that does not throw, and its permissive `optional: optionalAnyObjectValidator` arm was declared
+ * before the guarded one — so the payload was accepted and stored even though the validator had been
+ * swapped. Pointing a field at the guard is not the same as the guard being reachable, which is why
+ * every location gets an assertion rather than an argument.
+ *
+ * Each rejection is paired with a positive control using the same shape without `$JS(`, so a passing
+ * test cannot be explained by the write failing for an unrelated reason.
+ */
+export declare const form_logic_js_execution_checks: () => Promise<Check[]>;
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+export declare const form_logic_js_execution_tests: () => Promise<void>;
+//# sourceMappingURL=form-logic-js-execution.test.d.ts.map

package/lib/esm/tests/api_tests/security/form-logic-js-execution.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"form-logic-js-execution.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/form-logic-js-execution.test.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,EAEN,MAAM,sBAAsB,CAAA;AAM7B;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,8BAA8B,QAAa,QAAQ,KAAK,EAAE,CA4HtE,CAAA;AAED,kFAAkF;AAClF,eAAO,MAAM,6BAA6B,qBAEzC,CAAA"}