@tellescope/sdk 1.256.14 → 1.256.16

package/src/tests/api_tests/security/{F-0053-cascade-role-rename-cross-tenant.test.ts → cascade-role-rename-cross-tenant.test.ts}

@@ -16,14 +16,14 @@ const host = process.env.API_URL || 'http://localhost:8080' as const
 const OTHER_TENANT_API_KEY = "ba745e25162bb95a795c5fa1af70df188d93c4d3aac9c48b34a5c8c9dd7b80f7"
 
 /**
- * Tenant-boundary guard for cascade_role_rename (relates to security-audit finding F-0053,
+ * Tenant-boundary guard for cascade_role_rename (relates to a prior internal review,
  * which was investigated and closed as a FALSE POSITIVE — see that file for the code trace).
  *
  * The `cascade_role_rename` side-effect handler
  * ([event_handlers_v2/role_based_access_permissions.ts](packages/private/api/api/v1/event_handlers_v2/role_based_access_permissions.ts))
  * runs when a `role_based_access_permissions` doc's `role` field changes. It finds every user
  * with the old role name (via `DBUnrestricted.users`) and rewrites their `roles` array, then
- * deauthenticates them. F-0053 hypothesized this query was globally cross-tenant. It is NOT:
+ * deauthenticates them. An earlier review hypothesized this query was globally cross-tenant. It is NOT:
  * `DBUnrestricted` bypasses per-user/per-role RBAC but is STILL scoped to the acting session's
  * `businessId` (see `modifyFilterForAccessConstraint` injecting `{ businessId }` at
  * database.ts:1761-1763, reached via the `unrestricted: true` branch at database.ts:2137-2144).
@@ -42,7 +42,7 @@ const OTHER_TENANT_API_KEY = "ba745e25162bb95a795c5fa1af70df188d93c4d3aac9c48b34
  * A collision-proof unique role name (timestamped) is used so the test never touches real roles.
  */
 export const cascade_role_rename_cross_tenant_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("F-0053: cascade role rename cross-tenant regression")
+  log_header("cascade role rename cross-tenant regression")
 
   const stamp = Date.now()
   const ROLE_OLD = `XTenantRename_${stamp}`
@@ -55,7 +55,7 @@ export const cascade_role_rename_cross_tenant_tests = async ({ sdk } : { sdk: Se
   let rbapId: string | undefined
   // We create dedicated throwaway users in BOTH tenants and delete them in `finally`. We never
   // mutate any pre-existing user (an earlier version of this test clobbered the apiKey's own
-  // admin user via getSome+replaceObjectFields — see F-0053 finding notes). controlUser lives in
+  // admin user via getSome+replaceObjectFields). controlUser lives in
   // Tenant A and SHOULD be renamed by the same-tenant cascade; victimUser lives in Tenant B and
   // must be UNTOUCHED.
   let controlUserId: string | undefined
@@ -92,7 +92,7 @@ export const cascade_role_rename_cross_tenant_tests = async ({ sdk } : { sdk: Se
     assert(
       victimUser.businessId !== tenantABusinessId,
       `Victim user shares businessId with Tenant A (${victimUser.businessId}) — not a cross-tenant scenario`,
-      'F-0053 setup: tenants are distinct',
+      'setup: tenants are distinct',
     )
     const victimBefore = await sdkOther.api.users.getOne(victimUserId)
     const controlBefore = await sdk.api.users.getOne(controlUserId)
@@ -100,7 +100,7 @@ export const cascade_role_rename_cross_tenant_tests = async ({ sdk } : { sdk: Se
       JSON.stringify(victimBefore.roles) === JSON.stringify([ROLE_OLD])
         && JSON.stringify(controlBefore.roles) === JSON.stringify([ROLE_OLD]),
       `Setup failed: expected both users to hold [${ROLE_OLD}] (victim=${JSON.stringify(victimBefore.roles)}, control=${JSON.stringify(controlBefore.roles)})`,
-      'F-0053 setup: both users hold ROLE_OLD',
+      'setup: both users hold ROLE_OLD',
     )
 
     // 5. Tenant A renames the role. This triggers cascade_role_rename.
@@ -113,7 +113,7 @@ export const cascade_role_rename_cross_tenant_tests = async ({ sdk } : { sdk: Se
       JSON.stringify(victimAfter.roles) === JSON.stringify([ROLE_OLD]),
       `CROSS-TENANT LEAK: Tenant B victim roles changed to ${JSON.stringify(victimAfter.roles)} `
         + `after Tenant A renamed its role. Expected [${ROLE_OLD}].`,
-      'F-0053: Tenant B user roles unaffected by other-tenant role rename',
+      'Tenant B user roles unaffected by other-tenant role rename',
     )
 
     // 7. POSITIVE CONTROL — the Tenant A control user SHOULD be renamed (same-tenant cascade intact).
@@ -122,7 +122,7 @@ export const cascade_role_rename_cross_tenant_tests = async ({ sdk } : { sdk: Se
       JSON.stringify(controlAfter.roles) === JSON.stringify([ROLE_NEW]),
       `Same-tenant cascade broken: Tenant A control roles are ${JSON.stringify(controlAfter.roles)}, `
         + `expected [${ROLE_NEW}].`,
-      'F-0053: Tenant A user roles renamed by same-tenant cascade',
+      'Tenant A user roles renamed by same-tenant cascade',
     )
   } finally {
     // Cleanup: delete both throwaway users and the role doc. Never touches pre-existing users.
@@ -151,11 +151,11 @@ if (require.main === module) {
 
   runTests()
     .then(() => {
-      console.log("✅ F-0053 cascade role rename cross-tenant test suite completed successfully")
+      console.log("✅ cascade role rename cross-tenant test suite completed successfully")
       process.exit(0)
     })
     .catch((error) => {
-      console.error("❌ F-0053 cascade role rename cross-tenant test suite failed:", error)
+      console.error("❌ cascade role rename cross-tenant test suite failed:", error)
       process.exit(1)
     })
 }

package/src/tests/api_tests/security/{F-0001-data-sync-redaction-bypass.test.ts → data-sync-redaction-bypass.test.ts}

@@ -41,7 +41,7 @@ const collectViolations = (results: { modelName: string, recordId: string, data:
 }
 
 /**
- * Regression test for F-0001 (security-audit/findings/F-0001-data-sync-bypasses-applyRedactions.md).
+ * Regression test: `/v1/data-sync` redaction.
  *
  * The /v1/data-sync handler must apply the central applyRedactions() pipeline to
  * every non-deleted record. The original bug: redactions were gated behind
@@ -63,7 +63,7 @@ const collectViolations = (results: { modelName: string, recordId: string, data:
  * Post-fix: assertion passes.
  */
 export const data_sync_redaction_bypass_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("F-0001: /v1/data-sync field-redaction bypass regression")
+  log_header("/v1/data-sync field-redaction bypass regression")
 
   const roleName = `f0001-data-sync-bypass-${Date.now()}`
   let testEnduserId: string | undefined
@@ -124,13 +124,13 @@ export const data_sync_redaction_bypass_tests = async ({ sdk, sdkNonAdmin } : {
     // would pass vacuously — guard against that.
     const userRecordsInStream = sync.results.filter(r => r.modelName === 'users').length
     await async_test(
-      "F-0001 guard: /v1/data-sync sync stream contains at least one user record",
+      "guard: /v1/data-sync sync stream contains at least one user record",
       async () => ({ userRecords: userRecordsInStream, totalRecords: sync.results.length }),
       { onResult: r => r.userRecords >= 1 },
     )
 
     await async_test(
-      "F-0001: /v1/data-sync must NOT return hashedPass / hashedPassword / hashedInviteCode (see security-audit/findings/F-0001)",
+      "/v1/data-sync must NOT return hashedPass / hashedPassword / hashedInviteCode",
       async () => ({
         violationCount: violations.length,
         violations: violations.slice(0, 10),
@@ -143,7 +143,7 @@ export const data_sync_redaction_bypass_tests = async ({ sdk, sdkNonAdmin } : {
     // ========================================================================
     // Additional coverage for applyRedactions code paths reachable via /v1/data-sync.
     // Each of these is a distinct branch in applyRedactions (routing.ts:1165-1238)
-    // and could regress independently of the F-0001 fix.
+    // and could regress independently of this fix.
     // ========================================================================
 
     // Case A: schema-level `redactions: ['all']` must apply to ADMIN sessions too.
@@ -153,7 +153,7 @@ export const data_sync_redaction_bypass_tests = async ({ sdk, sdkNonAdmin } : {
     const adminSync = await sdk.sync({ from: new Date(0) })
     const adminViolations = collectViolations(adminSync.results)
     await async_test(
-      "F-0001 coverage A: admin /v1/data-sync also strips redactions:['all'] fields (hashedPass etc.)",
+      "coverage A: admin /v1/data-sync also strips redactions:['all'] fields (hashedPass etc.)",
       async () => ({
         violationCount: adminViolations.length,
         violations: adminViolations.slice(0, 10),
@@ -180,7 +180,7 @@ export const data_sync_redaction_bypass_tests = async ({ sdk, sdkNonAdmin } : {
       } catch {}
     }
     await async_test(
-      "F-0001 coverage B: /v1/data-sync strips linkedAccountAccess from other users' records",
+      "coverage B: /v1/data-sync strips linkedAccountAccess from other users' records",
       async () => ({
         otherUserRecords: otherUsersInStream.length,
         leakCount: linkedAccountLeaks.length,
@@ -226,11 +226,11 @@ if (require.main === module) {
 
   runTests()
     .then(() => {
-      console.log("✅ F-0001 data-sync redaction-bypass test suite completed successfully")
+      console.log("✅ data-sync redaction-bypass test suite completed successfully")
       process.exit(0)
     })
     .catch((error) => {
-      console.error("❌ F-0001 data-sync redaction-bypass test suite failed:", error)
+      console.error("❌ data-sync redaction-bypass test suite failed:", error)
       process.exit(1)
     })
 }

package/src/tests/api_tests/security/{F-0006-develop-health-benefit-verification-rbac.test.ts → develop-health-benefit-verification-rbac.test.ts}

@@ -14,8 +14,7 @@ const host = process.env.API_URL || 'http://localhost:8080' as const
 const [nonAdminEmail, nonAdminPassword] = [process.env.NON_ADMIN_EMAIL, process.env.NON_ADMIN_PASSWORD]
 
 /**
- * Regression test for F-0006 (security-audit/findings/F-0006-zoom-and-benefit-verification-bypass-rbac.md),
- * reopened 2026-08-17 for the `develop_health_run_benefit_verification` sub-item.
+ * Regression test: the `develop_health_run_benefit_verification` RBAC gate.
  *
  * `enduser_eligibility_results.develop_health_run_benefit_verification` is registered with
  * `noAccessPermissions: true` (packages/private/api/api/v1/api.ts, ~line 24606). Before the fix,
@@ -39,7 +38,7 @@ const [nonAdminEmail, nonAdminPassword] = [process.env.NON_ADMIN_EMAIL, process.
  * Post-fix: the handler throws 403 before touching `DB.endusers` at all. Test passes.
  */
 export const develop_health_benefit_verification_rbac_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("F-0006: develop_health benefit verification RBAC regression")
+  log_header("develop_health benefit verification RBAC regression")
 
   const roleName = `f0006-develop-health-no-access-${Date.now()}`
   let rbapId: string | undefined
@@ -74,7 +73,7 @@ export const develop_health_benefit_verification_rbac_tests = async ({ sdk, sdkN
     //    Pre-fix: proceeds to DB.endusers.findById and either 400s on validation (fake id) or
     //    succeeds and forwards PHI to Develop Health (real id) — never a 403.
     await async_test(
-      "F-0006: enduser_eligibility_results.develop_health_run_benefit_verification must throw 403 when role denies endusers/enduser_eligibility_results",
+      "enduser_eligibility_results.develop_health_run_benefit_verification must throw 403 when role denies endusers/enduser_eligibility_results",
       () => sdkNonAdmin.api.enduser_eligibility_results.develop_health_run_benefit_verification({
         enduserId: new ObjectId().toHexString(),       // fake id — access check should fire first
         providerUserId: new ObjectId().toHexString(),  // fake id — access check should fire first
@@ -122,7 +121,7 @@ export const develop_health_benefit_verification_rbac_tests = async ({ sdk, sdkN
       await sdkNonAdmin.authenticate(nonAdminEmail!, nonAdminPassword!)
 
       await async_test(
-        "F-0006: a provider role with enduser access passes the gate (reaches 'Integration not found', not 403)",
+        "a provider role with enduser access passes the gate (reaches 'Integration not found', not 403)",
         () => sdkNonAdmin.api.enduser_eligibility_results.develop_health_run_benefit_verification({
           enduserId: new ObjectId().toHexString(),
           providerUserId: new ObjectId().toHexString(),
@@ -159,7 +158,7 @@ export const develop_health_benefit_verification_rbac_tests = async ({ sdk, sdkN
     // the handler throws "Integration not found" BEFORE reaching the (now read-scoped) enduser load,
     // and the enduser load is what the create>read fix governs. Exercising it would need either a real
     // Develop Health integration or reordering the handler purely for the test. It is covered by code
-    // review + F-0166 (systemic follow-up). If a Develop Health sandbox integration is ever available
+    // review + the systemic follow-up. If a Develop Health sandbox integration is ever available
     // in the test org, add: role { endusers: create 'All', read 'Assigned' } → call with a real
     // enduser NOT assigned to the caller → expect the enduser-not-found path, not a successful forward.
   } finally {
@@ -194,11 +193,11 @@ if (require.main === module) {
 
   runTests()
     .then(() => {
-      console.log("✅ F-0006 develop_health_run_benefit_verification RBAC test suite completed successfully")
+      console.log("✅ develop_health_run_benefit_verification RBAC test suite completed successfully")
       process.exit(0)
     })
     .catch((error) => {
-      console.error("❌ F-0006 develop_health_run_benefit_verification RBAC test suite failed:", error)
+      console.error("❌ develop_health_run_benefit_verification RBAC test suite failed:", error)
       process.exit(1)
     })
 }

package/src/tests/api_tests/security/{F-0116-F-0119-enduser-cross-create.test.ts → enduser-cross-create.test.ts}

@@ -16,10 +16,10 @@ const CROSS_ENDUSER_MESSAGE = "enduserId does not match creator id for enduser s
 
 /**
  * Regression test for the enduser cross-enduser CREATE gating gaps:
- *   F-0116 enduser_observations  (security-audit/findings/F-0116-*.md)
- *   F-0117 enduser_orders        (security-audit/findings/F-0117-*.md)
- *   F-0119 managed_content_records (security-audit/findings/F-0119-*.md)
- *   F-0118 chat_rooms (enduserIds-only gate; staff userIds targeting is by-design)
+ *   enduser_observations
+ *   enduser_orders
+ *   managed_content_records
+ *   chat_rooms (enduserIds-only gate; staff userIds targeting is by-design)
  *
  * Each model exposed enduserActions.create with an `enduserId`/`enduserIds` field that
  * lacked a write-side gate, letting an authenticated enduser create records bound to a
@@ -30,7 +30,7 @@ const CROSS_ENDUSER_MESSAGE = "enduserId does not match creator id for enduser s
  * legitimate path (self-create + staff-create) still works.
  */
 export const enduser_cross_create_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("F-0116/F-0117/F-0118/F-0119: enduser cross-enduser create gates")
+  log_header("enduser cross-enduser create gates")
 
   let attackerId: string | undefined
   let victimId: string | undefined
@@ -53,10 +53,10 @@ export const enduser_cross_create_tests = async ({ sdk } : { sdk: Session, sdkNo
     await attackerSDK.authenticate(attackerEmail, ENDUSER_PASSWORD)
 
     // ============================================================
-    // F-0116 — enduser_observations
+    // enduser_observations
     // ============================================================
     await async_test(
-      `F-0116: enduser cannot create observation on another enduser (createOne)`,
+      `enduser cannot create observation on another enduser (createOne)`,
       () => attackerSDK.api.enduser_observations.createOne({
         enduserId: victimId!, category: 'vital-signs', status: 'final',
         measurement: { unit: 'mmHg', value: 220 },
@@ -64,7 +64,7 @@ export const enduser_cross_create_tests = async ({ sdk } : { sdk: Session, sdkNo
       { shouldError: true, onError: e => e.message === CROSS_ENDUSER_MESSAGE },
     )
     await async_test(
-      `F-0116: enduser cannot create observation on another enduser (createMany)`,
+      `enduser cannot create observation on another enduser (createMany)`,
       () => attackerSDK.api.enduser_observations.createSome([{
         enduserId: victimId!, category: 'vital-signs', status: 'final',
         measurement: { unit: 'mmHg', value: 220 },
@@ -74,7 +74,7 @@ export const enduser_cross_create_tests = async ({ sdk } : { sdk: Session, sdkNo
 
     // Positive control: enduser CAN create an observation on their OWN record
     await async_test(
-      `F-0116: enduser can still create observation on own record`,
+      `enduser can still create observation on own record`,
       () => attackerSDK.api.enduser_observations.createOne({
         enduserId: attackerId!, category: 'vital-signs', status: 'final',
         measurement: { unit: 'mmHg', value: 120 },
@@ -83,7 +83,7 @@ export const enduser_cross_create_tests = async ({ sdk } : { sdk: Session, sdkNo
     )
     // Positive control: staff CAN create an observation on any tenant enduser
     await async_test(
-      `F-0116: staff can still create observation on any enduser`,
+      `staff can still create observation on any enduser`,
       () => sdk.api.enduser_observations.createOne({
         enduserId: victimId!, category: 'vital-signs', status: 'final',
         measurement: { unit: 'mmHg', value: 118 },
@@ -92,61 +92,61 @@ export const enduser_cross_create_tests = async ({ sdk } : { sdk: Session, sdkNo
     )
 
     // ============================================================
-    // F-0117 — enduser_orders
+    // enduser_orders
     // ============================================================
     const orderPayload = (enduserId: string) => ({
       enduserId, externalId: `f0117-${Date.now()}`, source: 'f0117-source',
       title: 'f0117 order', status: 'pending',
     })
     await async_test(
-      `F-0117: enduser cannot create order on another enduser`,
+      `enduser cannot create order on another enduser`,
       () => attackerSDK.api.enduser_orders.createOne(orderPayload(victimId!) as any),
       { shouldError: true, onError: e => e.message === CROSS_ENDUSER_MESSAGE },
     )
     await async_test(
-      `F-0117: enduser can still create order on own record`,
+      `enduser can still create order on own record`,
       () => attackerSDK.api.enduser_orders.createOne(orderPayload(attackerId!) as any),
       { onResult: (o: any) => { if (o?.id) createdOrderIds.push(o.id); return o?.enduserId === attackerId } },
     )
     await async_test(
-      `F-0117: staff can still create order on any enduser`,
+      `staff can still create order on any enduser`,
       () => sdk.api.enduser_orders.createOne(orderPayload(victimId!) as any),
       { onResult: (o: any) => { if (o?.id) createdOrderIds.push(o.id); return o?.enduserId === victimId } },
     )
 
     // ============================================================
-    // F-0119 — managed_content_records
+    // managed_content_records
     // ============================================================
     await async_test(
-      `F-0119: enduser cannot create content with allowUnauthenticatedAccess`,
+      `enduser cannot create content with allowUnauthenticatedAccess`,
       () => attackerSDK.api.managed_content_records.createOne({
         title: 'f0119 phishing', textContent: 'x', allowUnauthenticatedAccess: true,
       } as any),
       { shouldError: true, onError: e => e.message === "allowUnauthenticatedAccess cannot be set by endusers" },
     )
     await async_test(
-      `F-0119: enduser cannot create content with publicRead`,
+      `enduser cannot create content with publicRead`,
       () => attackerSDK.api.managed_content_records.createOne({
         title: 'f0119 broadcast', textContent: 'x', publicRead: true,
       } as any),
       { shouldError: true, onError: e => e.message === "publicRead cannot be set by endusers" },
     )
     await async_test(
-      `F-0119: enduser cannot create content bound to another enduser`,
+      `enduser cannot create content bound to another enduser`,
       () => attackerSDK.api.managed_content_records.createOne({
         title: 'f0119 cross', textContent: 'x', enduserId: victimId!,
       } as any),
       { shouldError: true, onError: e => e.message === CROSS_ENDUSER_MESSAGE },
     )
     await async_test(
-      `F-0119: enduser can still create ordinary content`,
+      `enduser can still create ordinary content`,
       () => attackerSDK.api.managed_content_records.createOne({
         title: 'f0119 ok', textContent: 'hello',
       } as any),
       { onResult: (o: any) => { if (o?.id) createdContentIds.push(o.id); return !o?.publicRead && !o?.allowUnauthenticatedAccess } },
     )
     await async_test(
-      `F-0119: staff can still create public content`,
+      `staff can still create public content`,
       () => sdk.api.managed_content_records.createOne({
         title: 'f0119 staff public', textContent: 'x', publicRead: true,
       } as any),
@@ -154,11 +154,11 @@ export const enduser_cross_create_tests = async ({ sdk } : { sdk: Session, sdkNo
     )
 
     // ============================================================
-    // F-0118 — chat_rooms (enduserIds-only gate; staff userIds targeting is by-design)
+    // chat_rooms (enduserIds-only gate; staff userIds targeting is by-design)
     // ============================================================
     const staffId = sdk.userInfo.id
     await async_test(
-      `F-0118: enduser cannot add another patient to a chat room (enduserIds)`,
+      `enduser cannot add another patient to a chat room (enduserIds)`,
       () => attackerSDK.api.chat_rooms.createOne({
         type: 'internal', enduserIds: [attackerId!, victimId!], userIds: [staffId],
       } as any),
@@ -166,7 +166,7 @@ export const enduser_cross_create_tests = async ({ sdk } : { sdk: Session, sdkNo
     )
     // Positive control: patient CAN create a room with care-team staff + self (intended feature)
     await async_test(
-      `F-0118: enduser can still create a room with staff + self`,
+      `enduser can still create a room with staff + self`,
       () => attackerSDK.api.chat_rooms.createOne({
         type: 'internal', enduserIds: [attackerId!], userIds: [staffId],
       } as any),
@@ -174,7 +174,7 @@ export const enduser_cross_create_tests = async ({ sdk } : { sdk: Session, sdkNo
     )
     // Positive control: staff can still create multi-patient rooms
     await async_test(
-      `F-0118: staff can still create a room with multiple endusers`,
+      `staff can still create a room with multiple endusers`,
       () => sdk.api.chat_rooms.createOne({
         type: 'internal', enduserIds: [attackerId!, victimId!], userIds: [staffId],
       } as any),
@@ -211,7 +211,7 @@ if (require.main === module) {
 
   runTests()
     .then(() => {
-      console.log("✅ F-0116/F-0117/F-0118/F-0119 enduser cross-create test suite completed successfully")
+      console.log("✅ enduser cross-create test suite completed successfully")
       process.exit(0)
     })
     .catch((error) => {

package/src/tests/api_tests/security/{F-0106-F-0110-enduser-write-restrictions.test.ts → enduser-write-restrictions.test.ts}

@@ -71,9 +71,7 @@ const restrictedFormResponseUpdates = (staffId: string, otherEnduserId: string):
 })
 
 /**
- * Regression test for F-0106 and F-0110
- * (security-audit/findings/F-0106-enduser-self-update-admin-only-fields.md,
- *  security-audit/findings/F-0110-form-responses-enduser-update-admin-only-fields.md).
+ * Regression test: enduser self-updates must not write staff-only fields on `endusers` or `form_responses`.
  *
  * Endusers could PATCH admin-only / access-bearing / attribution-bearing fields on
  * their own endusers record (assignedTo, tags, references, ...) and their own
@@ -88,7 +86,7 @@ const restrictedFormResponseUpdates = (staffId: string, otherEnduserId: string):
  *   - staff sessions can still update the restricted fields
  */
 export const enduser_write_restrictions_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("F-0106/F-0110: enduser write restrictions (enduserUpdatesDisabled)")
+  log_header("enduser write restrictions (enduserUpdatesDisabled)")
 
   let enduserId: string | undefined
   let otherEnduserId: string | undefined
@@ -111,7 +109,7 @@ export const enduser_write_restrictions_tests = async ({ sdk } : { sdk: Session,
     const enduserSDK = new EnduserSession({ host, businessId })
     await enduserSDK.authenticate(enduserEmail, ENDUSER_PASSWORD)
 
-    const form = await sdk.api.forms.createOne({ title: 'F-0106/F-0110 Write Restriction Test Form' })
+    const form = await sdk.api.forms.createOne({ title: 'Write Restriction Test Form' })
     formId = form.id
     const { response: formResponse } = await sdk.api.form_responses.prepare_form_response({
       formId: form.id,
@@ -119,34 +117,34 @@ export const enduser_write_restrictions_tests = async ({ sdk } : { sdk: Session,
     })
     formResponseId = formResponse.id
 
-    // ---- F-0106: enduser self-update of restricted endusers fields must 400 ----
+    // ---- enduser self-update of restricted endusers fields must 400 ----
     for (const [field, value] of Object.entries(restrictedEnduserUpdates(sdk.userInfo.id, enduser.id))) {
       await async_test(
-        `F-0106: enduser cannot self-update endusers.${field}`,
+        `enduser cannot self-update endusers.${field}`,
         () => enduserSDK.api.endusers.updateOne(enduser.id, { [field]: value } as any),
         { shouldError: true, onError: e => e.message === `${field} cannot be updated by endusers` },
       )
     }
 
-    // F-0106 Variant A persistence check: the rejected assignedTo write must not
+    // Variant A persistence check: the rejected assignedTo write must not
     // have granted the staff read-filter match.
     await async_test(
-      'F-0106: rejected assignedTo write did not persist',
+      'rejected assignedTo write did not persist',
       () => sdk.api.endusers.getOne(enduser.id),
       { onResult: e => !e.assignedTo?.length && !e.tags?.length && e.externalId === undefined },
     )
 
-    // ---- F-0110: enduser self-update of restricted form_responses fields must 400 ----
+    // ---- enduser self-update of restricted form_responses fields must 400 ----
     for (const [field, value] of Object.entries(restrictedFormResponseUpdates(sdk.userInfo.id, otherEnduser.id))) {
       await async_test(
-        `F-0110: enduser cannot self-update form_responses.${field}`,
+        `enduser cannot self-update form_responses.${field}`,
         () => enduserSDK.api.form_responses.updateOne(formResponse.id, { [field]: value } as any),
         { shouldError: true, onError: e => e.message === `${field} cannot be updated by endusers` },
       )
     }
 
     await async_test(
-      'F-0110: rejected writes did not persist (markedAsSubmitted, procedureCodes, submittedBy, enduserId)',
+      'rejected writes did not persist (markedAsSubmitted, procedureCodes, submittedBy, enduserId)',
       () => sdk.api.form_responses.getOne(formResponse.id),
       { onResult: fr => (
         !fr.markedAsSubmitted && !fr.procedureCodes?.length && fr.submittedBy === undefined
@@ -238,11 +236,11 @@ if (require.main === module) {
 
   runTests()
     .then(() => {
-      console.log("✅ F-0106/F-0110 enduser write-restriction test suite completed successfully")
+      console.log("✅ enduser write-restriction test suite completed successfully")
       process.exit(0)
     })
     .catch((error) => {
-      console.error("❌ F-0106/F-0110 enduser write-restriction test suite failed:", error)
+      console.error("❌ enduser write-restriction test suite failed:", error)
       process.exit(1)
     })
 }