@tellescope/sdk 1.256.14 → 1.256.16

package/lib/esm/tests/api_tests/security/self-admin-role-assignment.test.js

@@ -0,0 +1,218 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+require('source-map-support').install();
+import { Session } from "../../../sdk";
+import { assert, log_header, wait, } from "@tellescope/testing";
+import { setup_tests } from "../../setup";
+var host = process.env.API_URL || 'http://localhost:8080';
+/**
+ * Self-role privilege-escalation guard (relates to a prior internal review, which was
+ * investigated and closed as a FALSE POSITIVE — see that file for the full code trace).
+ *
+ * An earlier review hypothesized that a non-admin staff user could `PATCH /v1/users/{their-own-id}` with
+ * `{ roles: ['Admin'] }` and self-promote to Admin, because the FIRST `users` relationship
+ * constraint ("Only admin users can set the admin role",
+ * [schema.ts:3446](packages/public/schema/src/schema.ts#L3446)) has a self-exception
+ * (`if (_id === session.id) return`).
+ *
+ * That analysis missed the SECOND constraint, "Only admin users can update user roles"
+ * ([schema.ts:3486](packages/public/schema/src/schema.ts#L3486)), which has NO self-exception.
+ * Relationship constraints are AND-evaluated — `validateRelationshipConstraints`
+ * ([routing.ts:1240-1252](packages/private/api/api/modules/routing.ts#L1240)) loops the whole
+ * array and throws 400 on the FIRST evaluator that returns a string. So a non-admin self-update
+ * that includes `roles` passes constraint #1 (self-exception) but is rejected by constraint #2.
+ * The self-promotion is blocked.
+ *
+ * This test locks that boundary in place so a future refactor of the role constraints can't
+ * silently reintroduce the escalation. A dedicated throwaway non-admin user is used as the
+ * "attacker" (we never mutate the shared sdkNonAdmin's roles):
+ *   1. Admin creates a throwaway user and assigns it a non-admin role (`['Provider']`).
+ *   2. Authenticate AS that user via a freshly-minted auth token.
+ *   3. As the attacker, attempt four self-role mutations — ['Admin'], ['Provider','Admin'],
+ *      an arbitrary role, and [] — and assert EACH is blocked.       <-- the security assertions
+ *   4. Confirm (as admin) the attacker's roles are still ['Provider'] — nothing slipped through.
+ *   5. Positive control: admin CAN update the throwaway user's roles. <-- guards against an
+ *      over-restrictive regression that would block legitimate admin role management.
+ *
+ * Expected on current (correct) code: all assertions pass. A regression that made the self-update
+ * path role-writable by non-admins would flip the step-3/step-4 assertions to red.
+ */
+export var self_admin_role_assignment_tests = function (_a) {
+    var sdk = _a.sdk;
+    return __awaiter(void 0, void 0, void 0, function () {
+        var stamp, NON_ADMIN_ROLE, expect_blocked, attackerId, attacker, attackerBefore, sdkAttacker_1, _b, attackerAfter, afterAdminUpdate, _c;
+        var _d;
+        var _e;
+        return __generator(this, function (_f) {
+            switch (_f.label) {
+                case 0:
+                    log_header("self-admin role assignment privilege-escalation regression");
+                    stamp = Date.now();
+                    NON_ADMIN_ROLE = 'Provider';
+                    expect_blocked = function (fn, description) { return __awaiter(void 0, void 0, void 0, function () {
+                        var e_1;
+                        return __generator(this, function (_a) {
+                            switch (_a.label) {
+                                case 0:
+                                    _a.trys.push([0, 2, , 3]);
+                                    return [4 /*yield*/, fn()];
+                                case 1:
+                                    _a.sent();
+                                    assert(false, "".concat(description, " - SELF-ROLE ESCALATION SUCCEEDED (expected it to be blocked)"));
+                                    return [3 /*break*/, 3];
+                                case 2:
+                                    e_1 = _a.sent();
+                                    // CRUD relationship-constraint failures surface as 400 { message, info } via SDK parseError.
+                                    assert((e_1 === null || e_1 === void 0 ? void 0 : e_1.code) === 400 || (e_1 === null || e_1 === void 0 ? void 0 : e_1.statusCode) === 400 || typeof (e_1 === null || e_1 === void 0 ? void 0 : e_1.message) === 'string', "".concat(description, " - expected a block error, got: ").concat(JSON.stringify(e_1)), description);
+                                    return [3 /*break*/, 3];
+                                case 3: return [2 /*return*/];
+                            }
+                        });
+                    }); };
+                    _f.label = 1;
+                case 1:
+                    _f.trys.push([1, , 15, 20]);
+                    return [4 /*yield*/, sdk.api.users.createOne({
+                            email: "f0076-attacker-".concat(stamp, "@example.com"),
+                            notificationEmailsDisabled: true,
+                            verifiedEmail: true,
+                        })];
+                case 2:
+                    attacker = _f.sent();
+                    attackerId = attacker.id;
+                    return [4 /*yield*/, sdk.api.users.updateOne(attackerId, { roles: [NON_ADMIN_ROLE] }, { replaceObjectFields: true })];
+                case 3:
+                    _f.sent();
+                    return [4 /*yield*/, wait(undefined, 2000)
+                        // Setup sanity: the attacker holds exactly the non-admin role and is NOT an admin.
+                    ]; // role change triggers a logout; let it propagate before minting a token
+                case 4:
+                    _f.sent(); // role change triggers a logout; let it propagate before minting a token
+                    return [4 /*yield*/, sdk.api.users.getOne(attackerId)];
+                case 5:
+                    attackerBefore = _f.sent();
+                    assert(JSON.stringify(attackerBefore.roles) === JSON.stringify([NON_ADMIN_ROLE]), "Setup failed: expected attacker to hold [".concat(NON_ADMIN_ROLE, "], got ").concat(JSON.stringify(attackerBefore.roles)), 'setup: attacker holds a non-admin role');
+                    _b = Session.bind;
+                    _d = {
+                        host: host
+                    };
+                    return [4 /*yield*/, sdk.api.users.generate_auth_token({ id: attackerId })];
+                case 6:
+                    sdkAttacker_1 = new (_b.apply(Session, [void 0, (_d.authToken = (_f.sent()).authToken,
+                            _d)]))();
+                    return [4 /*yield*/, sdkAttacker_1.refresh_session()]; // populate userInfo from the freshly-minted token
+                case 7:
+                    _f.sent(); // populate userInfo from the freshly-minted token
+                    assert(sdkAttacker_1.userInfo.id === attackerId && !((_e = sdkAttacker_1.userInfo.roles) !== null && _e !== void 0 ? _e : []).includes('Admin'), "Setup failed: attacker session is not the expected non-admin user", 'setup: authenticated as the non-admin attacker');
+                    // 3. SECURITY ASSERTIONS — every self-role mutation by the non-admin must be blocked.
+                    return [4 /*yield*/, expect_blocked(function () { return sdkAttacker_1.api.users.updateOne(attackerId, { roles: ['Admin'] }, { replaceObjectFields: true }); }, 'non-admin self-update to [Admin] is blocked')];
+                case 8:
+                    // 3. SECURITY ASSERTIONS — every self-role mutation by the non-admin must be blocked.
+                    _f.sent();
+                    return [4 /*yield*/, expect_blocked(function () { return sdkAttacker_1.api.users.updateOne(attackerId, { roles: [NON_ADMIN_ROLE, 'Admin'] }, { replaceObjectFields: true }); }, 'non-admin self-update to [Provider, Admin] is blocked')];
+                case 9:
+                    _f.sent();
+                    return [4 /*yield*/, expect_blocked(function () { return sdkAttacker_1.api.users.updateOne(attackerId, { roles: ["Arbitrary_".concat(stamp)] }, { replaceObjectFields: true }); }, 'non-admin self-update to an arbitrary role is blocked')];
+                case 10:
+                    _f.sent();
+                    return [4 /*yield*/, expect_blocked(function () { return sdkAttacker_1.api.users.updateOne(attackerId, { roles: [] }, { replaceObjectFields: true }); }, 'non-admin self-update to [] (would grant defaults) is blocked')
+                        // 4. STATE ASSERTION — nothing slipped through; roles are still the original non-admin role.
+                    ];
+                case 11:
+                    _f.sent();
+                    return [4 /*yield*/, sdk.api.users.getOne(attackerId)];
+                case 12:
+                    attackerAfter = _f.sent();
+                    assert(JSON.stringify(attackerAfter.roles) === JSON.stringify([NON_ADMIN_ROLE]), "ESCALATION LEAK: attacker roles changed to ".concat(JSON.stringify(attackerAfter.roles), " ")
+                        + "after self-update attempts. Expected [".concat(NON_ADMIN_ROLE, "]."), 'attacker roles unchanged after all self-escalation attempts');
+                    // 5. POSITIVE CONTROL — an Admin CAN update the user's roles (mechanism is not over-restricted).
+                    return [4 /*yield*/, sdk.api.users.updateOne(attackerId, { roles: [NON_ADMIN_ROLE] }, { replaceObjectFields: true })];
+                case 13:
+                    // 5. POSITIVE CONTROL — an Admin CAN update the user's roles (mechanism is not over-restricted).
+                    _f.sent();
+                    return [4 /*yield*/, sdk.api.users.getOne(attackerId)];
+                case 14:
+                    afterAdminUpdate = _f.sent();
+                    assert(JSON.stringify(afterAdminUpdate.roles) === JSON.stringify([NON_ADMIN_ROLE]), "Admin role update failed: roles are ".concat(JSON.stringify(afterAdminUpdate.roles), ", expected [").concat(NON_ADMIN_ROLE, "]"), 'admin can manage user roles (positive control)');
+                    return [3 /*break*/, 20];
+                case 15:
+                    if (!attackerId) return [3 /*break*/, 19];
+                    _f.label = 16;
+                case 16:
+                    _f.trys.push([16, 18, , 19]);
+                    return [4 /*yield*/, sdk.api.users.deleteOne(attackerId)];
+                case 17:
+                    _f.sent();
+                    return [3 /*break*/, 19];
+                case 18:
+                    _c = _f.sent();
+                    return [3 /*break*/, 19];
+                case 19: return [7 /*endfinally*/];
+                case 20: return [2 /*return*/];
+            }
+        });
+    });
+};
+// Allow running this test file independently
+if (require.main === module) {
+    console.log("\uD83C\uDF10 Using API URL: ".concat(host));
+    var sdk_1 = new Session({ host: host });
+    var sdkNonAdmin_1 = new Session({ host: host });
+    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, setup_tests(sdk_1, sdkNonAdmin_1)];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, self_admin_role_assignment_tests({ sdk: sdk_1, sdkNonAdmin: sdkNonAdmin_1 })];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); };
+    runTests()
+        .then(function () {
+        console.log("✅ self-admin role assignment test suite completed successfully");
+        process.exit(0);
+    })
+        .catch(function (error) {
+        console.error("❌ self-admin role assignment test suite failed:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=self-admin-role-assignment.test.js.map

package/lib/esm/tests/api_tests/security/self-admin-role-assignment.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-admin-role-assignment.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/self-admin-role-assignment.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EACL,MAAM,EACN,UAAU,EACV,IAAI,GACL,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEzC,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,IAAM,gCAAgC,GAAG,UAAO,EAAgD;QAA9C,GAAG,SAAA;;;;;;;;oBAC1D,UAAU,CAAC,4DAA4D,CAAC,CAAA;oBAElE,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;oBAClB,cAAc,GAAG,UAAU,CAAA;oBAG3B,cAAc,GAAG,UAAO,EAAsB,EAAE,WAAmB;;;;;;oCAErE,qBAAM,EAAE,EAAE,EAAA;;oCAAV,SAAU,CAAA;oCACV,MAAM,CAAC,KAAK,EAAE,UAAG,WAAW,kEAA+D,CAAC,CAAA;;;;oCAE5F,6FAA6F;oCAC7F,MAAM,CACJ,CAAA,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,IAAI,MAAK,GAAG,IAAI,CAAA,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,UAAU,MAAK,GAAG,IAAI,OAAO,CAAA,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,OAAO,CAAA,KAAK,QAAQ,EAC1E,UAAG,WAAW,6CAAmC,IAAI,CAAC,SAAS,CAAC,GAAC,CAAC,CAAE,EACpE,WAAW,CACZ,CAAA;;;;;yBAEJ,CAAA;;;;oBASkB,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;4BAC7C,KAAK,EAAE,yBAAkB,KAAK,iBAAc;4BAC5C,0BAA0B,EAAE,IAAI;4BAChC,aAAa,EAAE,IAAI;yBACb,CAAC,EAAA;;oBAJH,QAAQ,GAAG,SAIR;oBACT,UAAU,GAAG,QAAQ,CAAC,EAAE,CAAA;oBACxB,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,EAAA;;oBAArG,SAAqG,CAAA;oBACrG,qBAAM,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC;wBAE3B,mFAAmF;sBAFxD,CAAC,yEAAyE;;oBAArG,SAA2B,CAAA,CAAC,yEAAyE;oBAG9E,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,EAAA;;oBAAvD,cAAc,GAAG,SAAsC;oBAC7D,MAAM,CACJ,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,cAAc,CAAC,CAAC,EACzE,mDAA4C,cAAc,oBAAU,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,KAAK,CAAC,CAAE,EAC1G,wCAAwC,CACzC,CAAA;yBAGuB,OAAO;;wBAC7B,IAAI,MAAA;;oBACQ,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAA;;oBAFnE,gBAAc,cAAI,OAAO,YAE7B,YAAS,GAAE,CAAC,SAA2D,CAAC,CAAC,SAAS;oCAClF;oBACF,qBAAM,aAAW,CAAC,eAAe,EAAE,EAAA,CAAC,kDAAkD;;oBAAtF,SAAmC,CAAA,CAAC,kDAAkD;oBACtF,MAAM,CACJ,aAAW,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,IAAI,CAAC,CAAC,MAAA,aAAW,CAAC,QAAQ,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAC/F,mEAAmE,EACnE,gDAAgD,CACjD,CAAA;oBAED,sFAAsF;oBACtF,qBAAM,cAAc,CAClB,cAAM,OAAA,aAAW,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,UAAW,EAAE,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,EAAjG,CAAiG,EACvG,6CAA6C,CAC9C,EAAA;;oBAJD,sFAAsF;oBACtF,SAGC,CAAA;oBACD,qBAAM,cAAc,CAClB,cAAM,OAAA,aAAW,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,UAAW,EAAE,EAAE,KAAK,EAAE,CAAC,cAAc,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,EAAjH,CAAiH,EACvH,uDAAuD,CACxD,EAAA;;oBAHD,SAGC,CAAA;oBACD,qBAAM,cAAc,CAClB,cAAM,OAAA,aAAW,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,UAAW,EAAE,EAAE,KAAK,EAAE,CAAC,oBAAa,KAAK,CAAE,CAAC,EAAE,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,EAA9G,CAA8G,EACpH,uDAAuD,CACxD,EAAA;;oBAHD,SAGC,CAAA;oBACD,qBAAM,cAAc,CAClB,cAAM,OAAA,aAAW,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,UAAW,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,EAA1F,CAA0F,EAChG,+DAA+D,CAChE;wBAED,6FAA6F;sBAF5F;;oBAHD,SAGC,CAAA;oBAGqB,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,EAAA;;oBAAtD,aAAa,GAAG,SAAsC;oBAC5D,MAAM,CACJ,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,cAAc,CAAC,CAAC,EACxE,qDAA8C,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,MAAG;0BAChF,gDAAyC,cAAc,OAAI,EAC/D,6DAA6D,CAC9D,CAAA;oBAED,iGAAiG;oBACjG,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,EAAA;;oBADrG,iGAAiG;oBACjG,SAAqG,CAAA;oBAC5E,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,EAAA;;oBAAzD,gBAAgB,GAAG,SAAsC;oBAC/D,MAAM,CACJ,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,cAAc,CAAC,CAAC,EAC3E,8CAAuC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,KAAK,CAAC,yBAAe,cAAc,MAAG,EAC7G,gDAAgD,CACjD,CAAA;;;yBAGG,UAAU,EAAV,yBAAU;;;;oBACN,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,EAAA;;oBAAzC,SAAyC,CAAA;;;;;;;;;;CAGpD,CAAA;AAED,6CAA6C;AAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAM,KAAG,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACjC,IAAM,aAAW,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IAEzC,IAAM,QAAQ,GAAG;;;wBACf,qBAAM,WAAW,CAAC,KAAG,EAAE,aAAW,CAAC,EAAA;;oBAAnC,SAAmC,CAAA;oBACnC,qBAAM,gCAAgC,CAAC,EAAE,GAAG,OAAA,EAAE,WAAW,eAAA,EAAE,CAAC,EAAA;;oBAA5D,SAA4D,CAAA;;;;SAC7D,CAAA;IAED,QAAQ,EAAE;SACP,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAA;QAC7E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,iDAAiD,EAAE,KAAK,CAAC,CAAA;QACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}

package/lib/esm/tests/api_tests/security/startlinktoken-enduser-staff-escalation.test.d.ts

@@ -0,0 +1,6 @@
+import { Session } from "../../../sdk";
+export declare const startlinktoken_escalation_tests: ({ sdk }: {
+    sdk: Session;
+    sdkNonAdmin: Session;
+}) => Promise<void>;
+//# sourceMappingURL=startlinktoken-enduser-staff-escalation.test.d.ts.map

package/lib/esm/tests/api_tests/security/startlinktoken-enduser-staff-escalation.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"startlinktoken-enduser-staff-escalation.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/startlinktoken-enduser-staff-escalation.test.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAkB,MAAM,cAAc,CAAA;AAuCtD,eAAO,MAAM,+BAA+B;SAA2B,OAAO;iBAAe,OAAO;mBA+GnG,CAAA"}

package/lib/esm/tests/api_tests/security/startlinktoken-enduser-staff-escalation.test.js

@@ -0,0 +1,350 @@
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+require('source-map-support').install();
+import { Session, EnduserSession } from "../../../sdk";
+import { assert, log_header } from "@tellescope/testing";
+import { setup_tests, authenticate_enduser_via_token } from "../../setup";
+import { PROVIDER_PERMISSIONS } from "@tellescope/constants";
+var host = process.env.API_URL || 'http://localhost:8080';
+/**
+ * Regression test — `calendar_events.startLinkToken` privilege escalation.
+ *
+ * startLinkToken is a DOCUMENTED feature ("Video Call Start Links"): a tenant's staff / API-key
+ * integration PATCHes a CalendarEvent to set a random token, then sends the host user the
+ * `/video/startlink?token=...` link, which `session_for_start_link` exchanges for a scope-limited
+ * User (staff) authToken for the first `type:'user'` attendee, MFA bypassed. Nothing in the codebase
+ * reads the token value back (the redeem matches server-side; the integration holds its own copy), so
+ * the field is write-only-by-design.
+ *
+ * TWO escalation vectors let a patient (or a low-privilege staff user) obtain the host's session:
+ *   WRITE — `enduserActions.update` + no `enduserUpdatesDisabled` let an enduser attendee PATCH
+ *           `startLinkToken` to a value they choose, then redeem it.
+ *   READ  — no `redactions` let an enduser attendee (or a non-admin staff user with calendar read)
+ *           read a LEGITIMATELY staff-set token and redeem it, with no write.
+ *
+ * Complete fix = TWO flags on schema.ts `startLinkToken`:
+ *   enduserUpdatesDisabled: true   (closes WRITE; preserves the staff/API-key write the feature needs)
+ *   redactions: ['all']            (closes READ for endusers AND non-admin users; safe — nothing reads
+ *                                   the value back). NOT `readonly` (would break the staff write — A2).
+ *
+ * Checks (collected, then asserted, so a RED run shows every failing vector):
+ *   A1  enduser attendee PATCH of startLinkToken is REJECTED                (WRITE gate)
+ *   A2  a staff-set token still redeems for the host's session             (feature preserved)
+ *   A3  an enduser-set token (if the write lands) does NOT redeem          (defence-in-depth)
+ *   A4  an enduser attendee does NOT receive startLinkToken on read        (READ gate, endusers)
+ *   A5  a non-admin staff user does NOT receive startLinkToken on read     (READ gate, users)
+ *
+ * No vendor, no Bedrock; the "host" is a throwaway user. Cleans up every created record.
+ */
+var RAND = function () { return Math.random().toString(36).slice(2, 10); };
+export var startlinktoken_escalation_tests = function (_a) {
+    var sdk = _a.sdk;
+    return __awaiter(void 0, void 0, void 0, function () {
+        var businessId, userIds, enduserIds, eventIds, roleIds, checks, record, host_user, patient, event_1, patientSDK, attackerToken, wrote, writeErr, err_1, adminView, redeemed, _b, staffToken, staffWriteErr, e_1, legit, e_2, enduserRead, _c, rbap, nonAdmin, authToken, nonAdminSDK, staffRead, _d, _i, checks_1, c, _e, checks_2, c, _f, eventIds_1, id, _g, _h, enduserIds_1, id, _j, _k, userIds_1, id, _l, _m, roleIds_1, id, _o;
+        var _p, _q, _r, _s, _t;
+        return __generator(this, function (_u) {
+            switch (_u.label) {
+                case 0:
+                    log_header("startLinkToken enduser-writable / readable → staff session escalation");
+                    businessId = sdk.userInfo.businessId;
+                    userIds = [];
+                    enduserIds = [];
+                    eventIds = [];
+                    roleIds = [];
+                    checks = [];
+                    record = function (label, pass, detail) { return checks.push({ label: label, pass: pass, detail: detail }); };
+                    _u.label = 1;
+                case 1:
+                    _u.trys.push([1, , 38, 63]);
+                    return [4 /*yield*/, sdk.api.users.createOne({
+                            email: "f0185-host-".concat(RAND(), "@tellescope.example"), fname: 'F0185', lname: 'Host',
+                            verifiedEmail: true, notificationEmailsDisabled: true,
+                        })];
+                case 2:
+                    host_user = _u.sent();
+                    userIds.push(host_user.id);
+                    return [4 /*yield*/, sdk.api.endusers.createOne({
+                            email: "f0185-patient-".concat(RAND(), "@tellescope.example"), fname: 'F0185', lname: 'Patient',
+                        })];
+                case 3:
+                    patient = _u.sent();
+                    enduserIds.push(patient.id);
+                    return [4 /*yield*/, sdk.api.calendar_events.createOne({
+                            title: 'appointment', durationInMinutes: 30, startTimeInMS: Date.now() + 3600000,
+                            attendees: [{ type: 'user', id: host_user.id }, { type: 'enduser', id: patient.id }],
+                        })];
+                case 4:
+                    event_1 = _u.sent();
+                    eventIds.push(event_1.id);
+                    patientSDK = new EnduserSession({ host: host, businessId: businessId });
+                    return [4 /*yield*/, authenticate_enduser_via_token(sdk, patientSDK, { id: patient.id })
+                        // ---- A1: WRITE gate — enduser attendee cannot PATCH startLinkToken ----
+                    ];
+                case 5:
+                    _u.sent();
+                    attackerToken = "f0185-attacker-".concat(RAND()).concat(RAND());
+                    wrote = false, writeErr = '';
+                    _u.label = 6;
+                case 6:
+                    _u.trys.push([6, 8, , 9]);
+                    return [4 /*yield*/, patientSDK.api.calendar_events.updateOne(event_1.id, { startLinkToken: attackerToken })];
+                case 7:
+                    _u.sent();
+                    wrote = true;
+                    return [3 /*break*/, 9];
+                case 8:
+                    err_1 = _u.sent();
+                    writeErr = (_p = err_1 === null || err_1 === void 0 ? void 0 : err_1.message) !== null && _p !== void 0 ? _p : String(err_1);
+                    return [3 /*break*/, 9];
+                case 9:
+                    record('A1: enduser cannot write startLinkToken', !wrote, wrote ? 'PATCH ACCEPTED — patient set a staff start-link token' : "rejected (".concat(writeErr, ")"));
+                    return [4 /*yield*/, sdk.api.calendar_events.getOne(event_1.id)];
+                case 10:
+                    adminView = _u.sent();
+                    if (!(adminView.startLinkToken === attackerToken)) return [3 /*break*/, 15];
+                    redeemed = null;
+                    _u.label = 11;
+                case 11:
+                    _u.trys.push([11, 13, , 14]);
+                    return [4 /*yield*/, new Session({ host: host }).api.calendar_events.session_for_start_link({ token: attackerToken })];
+                case 12:
+                    redeemed = _u.sent();
+                    return [3 /*break*/, 14];
+                case 13:
+                    _b = _u.sent();
+                    return [3 /*break*/, 14];
+                case 14:
+                    record('A3: enduser-set token does not mint a staff session', !(redeemed === null || redeemed === void 0 ? void 0 : redeemed.authToken), (redeemed === null || redeemed === void 0 ? void 0 : redeemed.authToken) ? "minted a STAFF authToken for host ".concat(host_user.id) : 'not redeemable');
+                    return [3 /*break*/, 16];
+                case 15:
+                    record('A3: enduser-set token does not mint a staff session', true, '(n/a — write blocked, value never landed)');
+                    _u.label = 16;
+                case 16:
+                    staffToken = "f0185-staff-".concat(RAND()).concat(RAND());
+                    staffWriteErr = '';
+                    _u.label = 17;
+                case 17:
+                    _u.trys.push([17, 19, , 20]);
+                    return [4 /*yield*/, sdk.api.calendar_events.updateOne(event_1.id, { startLinkToken: staffToken })];
+                case 18:
+                    _u.sent();
+                    return [3 /*break*/, 20];
+                case 19:
+                    e_1 = _u.sent();
+                    staffWriteErr = (_q = e_1 === null || e_1 === void 0 ? void 0 : e_1.message) !== null && _q !== void 0 ? _q : String(e_1);
+                    return [3 /*break*/, 20];
+                case 20:
+                    legit = null;
+                    _u.label = 21;
+                case 21:
+                    _u.trys.push([21, 23, , 24]);
+                    return [4 /*yield*/, new Session({ host: host }).api.calendar_events.session_for_start_link({ token: staffToken })];
+                case 22:
+                    legit = _u.sent();
+                    return [3 /*break*/, 24];
+                case 23:
+                    e_2 = _u.sent();
+                    legit = { error: (_r = e_2 === null || e_2 === void 0 ? void 0 : e_2.message) !== null && _r !== void 0 ? _r : String(e_2) };
+                    return [3 /*break*/, 24];
+                case 24:
+                    record('A2: staff-set start link still works', !!(legit === null || legit === void 0 ? void 0 : legit.authToken) && legit.eventId === event_1.id, "staffWrite=".concat(staffWriteErr ? 'REJECTED(' + staffWriteErr + ')' : 'ok', " authToken=").concat(!!(legit === null || legit === void 0 ? void 0 : legit.authToken), " eventId=").concat(legit === null || legit === void 0 ? void 0 : legit.eventId, " ").concat((legit === null || legit === void 0 ? void 0 : legit.error) ? '(' + legit.error + ')' : ''));
+                    enduserRead = null;
+                    _u.label = 25;
+                case 25:
+                    _u.trys.push([25, 27, , 28]);
+                    return [4 /*yield*/, patientSDK.api.calendar_events.getOne(event_1.id)];
+                case 26:
+                    enduserRead = _u.sent();
+                    return [3 /*break*/, 28];
+                case 27:
+                    _c = _u.sent();
+                    return [3 /*break*/, 28];
+                case 28:
+                    record('A4: startLinkToken redacted from enduser reads', !enduserRead || enduserRead.startLinkToken === undefined, "enduser read startLinkToken=".concat((_s = enduserRead === null || enduserRead === void 0 ? void 0 : enduserRead.startLinkToken) !== null && _s !== void 0 ? _s : '(absent)', " \u2014 could redeem a staff-set token"));
+                    return [4 /*yield*/, sdk.api.role_based_access_permissions.createOne({
+                            role: "F0185NonAdmin-".concat(RAND()),
+                            // Non-admin (non-Admin-role) staff with tenant-wide calendar READ — enough to load the event,
+                            // so the assertion isolates redaction (not access). Spread a valid full permissions shape.
+                            permissions: __assign(__assign({}, PROVIDER_PERMISSIONS), { calendar_events: __assign(__assign({}, PROVIDER_PERMISSIONS.calendar_events), { read: 'All', readMany: 'All' }) }),
+                        }).catch(function (e) { var _a; console.warn('A5 role create failed:', (_a = e === null || e === void 0 ? void 0 : e.message) !== null && _a !== void 0 ? _a : e); return null; })];
+                case 29:
+                    rbap = _u.sent();
+                    if (!rbap) return [3 /*break*/, 36];
+                    roleIds.push(rbap.id);
+                    return [4 /*yield*/, sdk.api.users.createOne({
+                            email: "f0185-nonadmin-".concat(RAND(), "@tellescope.example"), fname: 'F0185', lname: 'NonAdmin',
+                            verifiedEmail: true, notificationEmailsDisabled: true, roles: [rbap.role],
+                        })];
+                case 30:
+                    nonAdmin = _u.sent();
+                    userIds.push(nonAdmin.id);
+                    return [4 /*yield*/, sdk.api.users.generate_auth_token({ id: nonAdmin.id })];
+                case 31:
+                    authToken = (_u.sent()).authToken;
+                    nonAdminSDK = new Session({ host: host, authToken: authToken });
+                    staffRead = null;
+                    _u.label = 32;
+                case 32:
+                    _u.trys.push([32, 34, , 35]);
+                    return [4 /*yield*/, nonAdminSDK.api.calendar_events.getOne(event_1.id)];
+                case 33:
+                    staffRead = _u.sent();
+                    return [3 /*break*/, 35];
+                case 34:
+                    _d = _u.sent();
+                    return [3 /*break*/, 35];
+                case 35:
+                    record('A5: startLinkToken redacted from non-admin user reads', !staffRead || staffRead.startLinkToken === undefined, "non-admin user read startLinkToken=".concat((_t = staffRead === null || staffRead === void 0 ? void 0 : staffRead.startLinkToken) !== null && _t !== void 0 ? _t : '(absent)', " \u2014 staff\u2192host escalation via read"));
+                    return [3 /*break*/, 37];
+                case 36:
+                    record('A5: startLinkToken redacted from non-admin user reads', true, '(n/a — could not create a non-admin role in this env)');
+                    _u.label = 37;
+                case 37:
+                    // Report the full table before asserting (the harness exits on the first failed assert).
+                    console.log('\n  check summary:');
+                    for (_i = 0, checks_1 = checks; _i < checks_1.length; _i++) {
+                        c = checks_1[_i];
+                        console.log("    ".concat(c.pass ? 'PASS' : 'FAIL', "  ").concat(c.label, "  \u2014  ").concat(c.detail));
+                    }
+                    console.log('');
+                    for (_e = 0, checks_2 = checks; _e < checks_2.length; _e++) {
+                        c = checks_2[_e];
+                        assert(c.pass, "".concat(c.label, " \u2014 ").concat(c.detail), c.label);
+                    }
+                    return [3 /*break*/, 63];
+                case 38:
+                    _f = 0, eventIds_1 = eventIds;
+                    _u.label = 39;
+                case 39:
+                    if (!(_f < eventIds_1.length)) return [3 /*break*/, 44];
+                    id = eventIds_1[_f];
+                    _u.label = 40;
+                case 40:
+                    _u.trys.push([40, 42, , 43]);
+                    return [4 /*yield*/, sdk.api.calendar_events.deleteOne(id)];
+                case 41:
+                    _u.sent();
+                    return [3 /*break*/, 43];
+                case 42:
+                    _g = _u.sent();
+                    return [3 /*break*/, 43];
+                case 43:
+                    _f++;
+                    return [3 /*break*/, 39];
+                case 44:
+                    _h = 0, enduserIds_1 = enduserIds;
+                    _u.label = 45;
+                case 45:
+                    if (!(_h < enduserIds_1.length)) return [3 /*break*/, 50];
+                    id = enduserIds_1[_h];
+                    _u.label = 46;
+                case 46:
+                    _u.trys.push([46, 48, , 49]);
+                    return [4 /*yield*/, sdk.api.endusers.deleteOne(id)];
+                case 47:
+                    _u.sent();
+                    return [3 /*break*/, 49];
+                case 48:
+                    _j = _u.sent();
+                    return [3 /*break*/, 49];
+                case 49:
+                    _h++;
+                    return [3 /*break*/, 45];
+                case 50:
+                    _k = 0, userIds_1 = userIds;
+                    _u.label = 51;
+                case 51:
+                    if (!(_k < userIds_1.length)) return [3 /*break*/, 56];
+                    id = userIds_1[_k];
+                    _u.label = 52;
+                case 52:
+                    _u.trys.push([52, 54, , 55]);
+                    return [4 /*yield*/, sdk.api.users.deleteOne(id)];
+                case 53:
+                    _u.sent();
+                    return [3 /*break*/, 55];
+                case 54:
+                    _l = _u.sent();
+                    return [3 /*break*/, 55];
+                case 55:
+                    _k++;
+                    return [3 /*break*/, 51];
+                case 56:
+                    _m = 0, roleIds_1 = roleIds;
+                    _u.label = 57;
+                case 57:
+                    if (!(_m < roleIds_1.length)) return [3 /*break*/, 62];
+                    id = roleIds_1[_m];
+                    _u.label = 58;
+                case 58:
+                    _u.trys.push([58, 60, , 61]);
+                    return [4 /*yield*/, sdk.api.role_based_access_permissions.deleteOne(id)];
+                case 59:
+                    _u.sent();
+                    return [3 /*break*/, 61];
+                case 60:
+                    _o = _u.sent();
+                    return [3 /*break*/, 61];
+                case 61:
+                    _m++;
+                    return [3 /*break*/, 57];
+                case 62: return [7 /*endfinally*/];
+                case 63: return [2 /*return*/];
+            }
+        });
+    });
+};
+if (require.main === module) {
+    var sdk_1 = new Session({ host: host });
+    var sdkNonAdmin_1 = new Session({ host: host });
+    setup_tests(sdk_1, sdkNonAdmin_1)
+        .then(function () { return startlinktoken_escalation_tests({ sdk: sdk_1, sdkNonAdmin: sdkNonAdmin_1 }); })
+        .then(function () { console.log("✅ startLinkToken escalation test suite completed successfully"); process.exit(0); })
+        .catch(function (error) { console.error("❌ startLinkToken escalation test suite failed:", error); process.exit(1); });
+}
+//# sourceMappingURL=startlinktoken-enduser-staff-escalation.test.js.map

package/lib/esm/tests/api_tests/security/startlinktoken-enduser-staff-escalation.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"startlinktoken-enduser-staff-escalation.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/startlinktoken-enduser-staff-escalation.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AACtD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AACxD,OAAO,EAAE,WAAW,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAA;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AAE5D,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,IAAM,IAAI,GAAG,cAAM,OAAA,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAvC,CAAuC,CAAA;AAE1D,MAAM,CAAC,IAAM,+BAA+B,GAAG,UAAO,EAAgD;QAA9C,GAAG,SAAA;;;;;;;oBACzD,UAAU,CAAC,uEAAuE,CAAC,CAAA;oBAE7E,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAA;oBACpC,OAAO,GAAa,EAAE,CAAA;oBACtB,UAAU,GAAa,EAAE,CAAA;oBACzB,QAAQ,GAAa,EAAE,CAAA;oBACvB,OAAO,GAAa,EAAE,CAAA;oBAEtB,MAAM,GAAuD,EAAE,CAAA;oBAC/D,MAAM,GAAG,UAAC,KAAa,EAAE,IAAa,EAAE,MAAc,IAAK,OAAA,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,OAAA,EAAE,IAAI,MAAA,EAAE,MAAM,QAAA,EAAE,CAAC,EAApC,CAAoC,CAAA;;;;oBAIjF,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;4BAC9C,KAAK,EAAE,qBAAc,IAAI,EAAE,wBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM;4BAC/E,aAAa,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI;yBAC/C,CAAC,EAAA;;oBAHH,SAAS,GAAG,SAGT;oBACT,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;oBAGV,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;4BAC/C,KAAK,EAAE,wBAAiB,IAAI,EAAE,wBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;yBACtF,CAAC,EAAA;;oBAFI,OAAO,GAAG,SAEd;oBACF,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;oBAEb,qBAAM,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC;4BACpD,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAQ;4BACjF,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;yBAC9E,CAAC,EAAA;;oBAHH,UAAQ,SAGL;oBACT,QAAQ,CAAC,IAAI,CAAC,OAAK,CAAC,EAAE,CAAC,CAAA;oBAEjB,UAAU,GAAG,IAAI,cAAc,CAAC,EAAE,IAAI,MAAA,EAAE,UAAU,YAAA,EAAE,CAAC,CAAA;oBAC3D,qBAAM,8BAA8B,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;wBAEzE,0EAA0E;sBAFD;;oBAAzE,SAAyE,CAAA;oBAGnE,aAAa,GAAG,yBAAkB,IAAI,EAAE,SAAG,IAAI,EAAE,CAAE,CAAA;oBACrD,KAAK,GAAG,KAAK,EAAE,QAAQ,GAAG,EAAE,CAAA;;;;oBAE9B,qBAAM,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC,OAAK,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,aAAa,EAAS,CAAC,EAAA;;oBAAlG,SAAkG,CAAA;oBAClG,KAAK,GAAG,IAAI,CAAA;;;;oBACO,QAAQ,GAAG,MAAA,KAAG,aAAH,KAAG,uBAAH,KAAG,CAAE,OAAO,mCAAI,MAAM,CAAC,KAAG,CAAC,CAAA;;;oBAC3D,MAAM,CAAC,yCAAyC,EAAE,CAAC,KAAK,EACtD,KAAK,CAAC,CAAC,CAAC,uDAAuD,CAAC,CAAC,CAAC,oBAAa,QAAQ,MAAG,CAAC,CAAA;oBAI3E,qBAAM,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,OAAK,CAAC,EAAE,CAAC,EAAA;;oBAA1D,SAAS,GAAG,SAA8C;yBAC5D,CAAC,SAAiB,CAAC,cAAc,KAAK,aAAa,CAAA,EAAnD,yBAAmD;oBACjD,QAAQ,GAAQ,IAAI,CAAA;;;;oBACP,qBAAM,IAAI,OAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,sBAAsB,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,EAAA;;oBAA3G,QAAQ,GAAG,SAAgG,CAAA;;;;;;oBACjH,MAAM,CAAC,qDAAqD,EAAE,CAAC,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,SAAS,CAAA,EAChF,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,SAAS,EAAC,CAAC,CAAC,4CAAqC,SAAS,CAAC,EAAE,CAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAA;;;oBAE/F,MAAM,CAAC,qDAAqD,EAAE,IAAI,EAAE,2CAA2C,CAAC,CAAA;;;oBAI5G,UAAU,GAAG,sBAAe,IAAI,EAAE,SAAG,IAAI,EAAE,CAAE,CAAA;oBAC/C,aAAa,GAAG,EAAE,CAAA;;;;oBAChB,qBAAM,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC,OAAK,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,UAAU,EAAS,CAAC,EAAA;;oBAAxF,SAAwF,CAAA;;;;oBAC7E,aAAa,GAAG,MAAA,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,OAAO,mCAAI,MAAM,CAAC,GAAC,CAAC,CAAA;;;oBACpD,KAAK,GAAQ,IAAI,CAAA;;;;oBACP,qBAAM,IAAI,OAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,sBAAsB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAA;;oBAArG,KAAK,GAAG,SAA6F,CAAA;;;;oBAC1F,KAAK,GAAG,EAAE,KAAK,EAAE,MAAA,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,OAAO,mCAAI,MAAM,CAAC,GAAC,CAAC,EAAE,CAAA;;;oBAC3D,MAAM,CAAC,sCAAsC,EAAE,CAAC,CAAC,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,SAAS,CAAA,IAAI,KAAK,CAAC,OAAO,KAAK,OAAK,CAAC,EAAE,EAC7F,qBAAc,aAAa,CAAC,CAAC,CAAC,WAAW,GAAG,aAAa,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,wBAAc,CAAC,CAAC,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,SAAS,CAAA,sBAAY,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,OAAO,cAAI,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,KAAK,EAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAE,CAAC,CAAA;oBAGhL,WAAW,GAAQ,IAAI,CAAA;;;;oBACP,qBAAM,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,OAAK,CAAC,EAAE,CAAC,EAAA;;oBAAnE,WAAW,GAAG,SAAqD,CAAA;;;;;;oBACzE,MAAM,CAAC,gDAAgD,EACrD,CAAC,WAAW,IAAK,WAAmB,CAAC,cAAc,KAAK,SAAS,EACjE,sCAA+B,MAAC,WAAmB,aAAnB,WAAW,uBAAX,WAAW,CAAU,cAAc,mCAAI,UAAU,2CAAmC,CAAC,CAAA;oBAG1G,qBAAM,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,SAAS,CAAC;4BACjE,IAAI,EAAE,wBAAiB,IAAI,EAAE,CAAE;4BAC/B,8FAA8F;4BAC9F,2FAA2F;4BAC3F,WAAW,wBAAO,oBAAoB,KAAE,eAAe,wBAAQ,oBAA4B,CAAC,eAAe,KAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,MAAI;yBACvI,CAAC,CAAC,KAAK,CAAC,UAAC,CAAM,YAAO,OAAO,CAAC,IAAI,CAAC,wBAAwB,EAAE,MAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,mCAAI,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAA,CAAC,CAAC,CAAC,EAAA;;oBAL/F,IAAI,GAAG,SAKwF;yBACjG,IAAI,EAAJ,yBAAI;oBACN,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;oBACJ,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;4BAC7C,KAAK,EAAE,yBAAkB,IAAI,EAAE,wBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU;4BACvF,aAAa,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;yBACnE,CAAC,EAAA;;oBAHH,QAAQ,GAAG,SAGR;oBACT,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;oBACH,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,EAAA;;oBAA1E,SAAS,GAAK,CAAA,SAA4D,CAAA,UAAjE;oBACX,WAAW,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,MAAA,EAAE,SAAS,WAAA,EAAE,CAAC,CAAA;oBAChD,SAAS,GAAQ,IAAI,CAAA;;;;oBACP,qBAAM,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,OAAK,CAAC,EAAE,CAAC,EAAA;;oBAAlE,SAAS,GAAG,SAAsD,CAAA;;;;;;oBACxE,MAAM,CAAC,uDAAuD,EAC5D,CAAC,SAAS,IAAK,SAAiB,CAAC,cAAc,KAAK,SAAS,EAC7D,6CAAsC,MAAC,SAAiB,aAAjB,SAAS,uBAAT,SAAS,CAAU,cAAc,mCAAI,UAAU,gDAAmC,CAAC,CAAA;;;oBAE5H,MAAM,CAAC,uDAAuD,EAAE,IAAI,EAAE,uDAAuD,CAAC,CAAA;;;oBAGhI,yFAAyF;oBACzF,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;oBACjC,WAAsB,EAAN,iBAAM,EAAN,oBAAM,EAAN,IAAM;wBAAX,CAAC;wBAAY,OAAO,CAAC,GAAG,CAAC,cAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,eAAK,CAAC,CAAC,KAAK,uBAAQ,CAAC,CAAC,MAAM,CAAE,CAAC,CAAA;qBAAA;oBAClG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;oBACf,WAAsB,EAAN,iBAAM,EAAN,oBAAM,EAAN,IAAM;wBAAX,CAAC;wBAAY,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,UAAG,CAAC,CAAC,KAAK,qBAAM,CAAC,CAAC,MAAM,CAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAA;qBAAA;;;0BAElD,EAAR,qBAAQ;;;yBAAR,CAAA,sBAAQ,CAAA;oBAAd,EAAE;;;;oBAAsB,qBAAM,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC,EAAA;;oBAA3C,SAA2C,CAAA;;;;;;oBAA7D,IAAQ,CAAA;;;0BACE,EAAV,yBAAU;;;yBAAV,CAAA,wBAAU,CAAA;oBAAhB,EAAE;;;;oBAAwB,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,EAAA;;oBAApC,SAAoC,CAAA;;;;;;oBAAxD,IAAU,CAAA;;;0BACH,EAAP,mBAAO;;;yBAAP,CAAA,qBAAO,CAAA;oBAAb,EAAE;;;;oBAAqB,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,EAAA;;oBAAjC,SAAiC,CAAA;;;;;;oBAAlD,IAAO,CAAA;;;0BACA,EAAP,mBAAO;;;yBAAP,CAAA,qBAAO,CAAA;oBAAb,EAAE;;;;oBAAqB,qBAAM,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,SAAS,CAAC,EAAE,CAAC,EAAA;;oBAAzD,SAAyD,CAAA;;;;;;oBAA1E,IAAO,CAAA;;;;;;;CAE3B,CAAA;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,IAAM,KAAG,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACjC,IAAM,aAAW,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACzC,WAAW,CAAC,KAAG,EAAE,aAAW,CAAC;SAC1B,IAAI,CAAC,cAAM,OAAA,+BAA+B,CAAC,EAAE,GAAG,OAAA,EAAE,WAAW,eAAA,EAAE,CAAC,EAArD,CAAqD,CAAC;SACjE,IAAI,CAAC,cAAQ,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC;SAC7G,KAAK,CAAC,UAAC,KAAK,IAAO,OAAO,CAAC,KAAK,CAAC,gDAAgD,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;CACjH"}

package/lib/esm/tests/api_tests/security/webhook-outbound-ssrf.test.d.ts

@@ -0,0 +1,28 @@
+import { Session } from "../../../sdk";
+/**
+ * Regression tests: outbound webhook delivery must refuse internal destinations.
+ *
+ * Outbound webhooks request customer-configured URLs that are validated only for SYNTAX
+ * (urlValidator -> validator.isURL, which happily accepts http://10.0.0.1/). Four call sites are
+ * affected: api/modules/webhooks.ts:145, :214, :270, and the five-method block at api/v1/api.ts:9723.
+ *
+ * Two properties make this worse than a blind SSRF:
+ *  - A non-2xx response body is stored in log.response, and webhook_logs is surfaced to customers for
+ *    debugging — so an internal endpoint's error body is readable by the tenant that configured it.
+ *  - The automation send-webhook action builds its URL at runtime through five nested template
+ *    replacers over action.info.url, so patient-controlled field values can reach the destination.
+ *
+ * And critically: axios@0.30.2 follows redirects by default (maxRedirects: 5). A pre-flight check on
+ * the configured URL is therefore NOT sufficient — a receiver can simply 302 to an internal address
+ * after validation has already passed. T4 exists to prove exactly that, which is why the fix has to
+ * validate at connect time (a guarded agent) rather than as a string check.
+ *
+ * Each test below asserts ABSENCE ("the sentinel was never contacted"), which passes trivially if the
+ * request never happened at all — a missing allowlist entry, a webhook that never fired, a broken
+ * subscription. So each is paired with a positive control that proves the attempt really was made.
+ */
+export declare const webhook_outbound_ssrf_tests: ({ sdk }: {
+    sdk: Session;
+    sdkNonAdmin: Session;
+}) => Promise<void>;
+//# sourceMappingURL=webhook-outbound-ssrf.test.d.ts.map

package/lib/esm/tests/api_tests/security/webhook-outbound-ssrf.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-outbound-ssrf.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/webhook-outbound-ssrf.test.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAyEtC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,2BAA2B;SAA2B,OAAO;iBAAe,OAAO;mBA0K/F,CAAA"}