@tellescope/sdk 1.256.14 → 1.256.16

package/src/tests/api_tests/security/file-link-session-confinement.test.ts

@@ -0,0 +1,291 @@
+require('source-map-support').install();
+
+import axios from "axios"
+
+import {
+  assert_checks,
+  Check,
+  setup_isolated_tenant,
+} from "../../setup_isolated"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
+/**
+ * The `{{files.<id>.link}}` merge field must mint a session that can download ONE file, and nothing
+ * else.
+ *
+ * That merge field is how the webapp's "Generate PDF -> Save and Share -> Email" flow on the enduser
+ * timeline (DownloadFormResponse.tsx, ComposeSharePDFEmail) delivers a document to a hand-typed
+ * address — a referral contact, a caregiver, an outside provider. The link is resolved at send time
+ * by message_templating.ts, which called login_enduser with no confinement at all, so the recipient
+ * received a full 24-hour patient-portal session: chat history, every form response, every file,
+ * observations, medications, and every write route including PATCH /enduser/:id.
+ *
+ * Route access was not the only leak. Both portals call refresh-enduser-session during URL-token
+ * intake, and for a session not flagged `fromPublicSession` that handler returns the whole patient
+ * document (name, dateOfBirth, email, phone, insurance, fields, notes) — so the chart was handed
+ * over on page load, before a single route was touched. Probe 7b covers that.
+ *
+ * Two variants, because one bit — is the recipient the patient? — drives two behaviours the merge
+ * field previously could not express:
+ *
+ *   `link`         goes to the patient. Keeps the org's MFA policy, keeps OTP recovery.
+ *   `shared-link`  goes to someone who is NOT the patient. An OTP code is delivered to the PATIENT's
+ *                  own email or phone, so for this variant recovery is both unanswerable by the
+ *                  holder and a way to make the platform message the patient on demand. It is
+ *                  refused, and the token is minted bypassMFA so it never needs a challenge either.
+ *
+ * Probe 12 is the one that decides whether the OTP rule is real: the three OTP endpoints read their
+ * `token` argument with `jwtDecode`, which does not verify the signature. The file link puts a
+ * decodable JWT in the recipient's URL bar, so they know the enduser id, and a scope name in an
+ * unverified token is a suggestion rather than a claim. Without signature verification the rule is
+ * a paper wall.
+ *
+ * Every confinement probe is paired against the tenant's own admin session, so a red check means
+ * confinement rather than a broken fixture.
+ */
+
+type Probe = { status: number, body: any }
+
+const probe = async (
+  method: 'get' | 'post' | 'patch',
+  path: string,
+  o: { token?: string, params?: object, data?: object } = {},
+): Promise<Probe> => {
+  const r = await axios.request({
+    method,
+    url: `${host}/v1${path}`,
+    params: o.params,
+    data: o.data,
+    headers: o.token ? { Authorization: `Bearer ${o.token}` } : undefined,
+    validateStatus: () => true,
+  })
+  return { status: r.status, body: r.data }
+}
+
+export const file_link_session_confinement_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+
+  try {
+    tenant = await setup_isolated_tenant({
+      name: `FileLink ${RAND()}`, users: [{ isAdmin: true }], apiKeys: 0,
+    })
+    const sdk = tenant.sdk
+
+    // dontsend- so the OTP probes cannot deliver anything real, same convention the provisioner uses
+    const enduser = await sdk.api.endusers.createOne({
+      fname: 'FileLink', lname: 'Recipient',
+      email: `dontsend-filelink-${RAND()}@tellescope.com`,
+      phone: '+15555550100',
+      dateOfBirth: '01-01-1990',
+    })
+
+    // No S3 upload needed: prepare_file_upload inserts the files record with its secureName
+    // immediately, and file_download_URL only SIGNS a GET url — it never checks the object exists.
+    const newFile = async (name: string) => (
+      (await sdk.api.files.prepare_file_upload({
+        name, type: 'application/pdf', size: 1000, enduserId: enduser.id,
+      })).file
+    )
+    const fileA = await newFile(`shared-${RAND()}.pdf`)   // the one that gets shared
+    const fileB = await newFile(`private-${RAND()}.pdf`)  // the rest of the patient's chart
+
+    /**
+     * Mints a token exactly the way a real send does — get_templated_message is the endpoint the
+     * worker calls (worker/app.js handleOutgoingEmail).
+     *
+     * replaceLinks always rewrites the resolved link into a tracking redirect, so `plaintext` holds
+     * `doc (${API_URL}/r/<redirectToken>)` rather than the portal URL. Follow the 302 to recover it.
+     */
+    const mint = async (verb: 'link' | 'shared-link') => {
+      const { plaintext } = await sdk.api.templates.get_templated_message({
+        channel: 'Email',
+        userId: tenant!.users[0].id,
+        enduserId: enduser.id,
+        message: `{{files.${fileA.id}.${verb}:doc}}`,
+      })
+
+      const redirectURL = plaintext.match(/\((https?:\/\/[^)\s]+)\)/)?.[1]
+      if (!redirectURL) return { token: undefined, detail: `no link resolved from: ${plaintext}` }
+
+      const r = await axios.get(redirectURL, { maxRedirects: 0, validateStatus: () => true })
+      const location = r.headers['location']
+      if (!location) return { token: undefined, detail: `redirect did not 302 (${r.status})` }
+
+      const token = new URL(location).searchParams.get('token') ?? undefined
+      return { token, detail: token ? 'minted' : `no token in ${location}` }
+    }
+
+    /* ================================ confinement + the pin ================================ */
+
+    // Positive control first: the admin session reads both files fine, so a 403 below is confinement.
+    const adminFiles = await probe('get', '/files', { token: tenant.users[0].authToken })
+    record(
+      'control: admin session lists files',
+      adminFiles.status === 200, `status ${adminFiles.status}`,
+    )
+
+    const confinement_probes = async (variant: 'link' | 'shared-link', token: string) => {
+      const p = (label: string, expected: number, r: Probe) => record(
+        `${variant} — ${label}`, r.status === expected, `status ${r.status} (expected ${expected})`,
+      )
+
+      p('1: downloads the shared file', 200,
+        await probe('get', '/file-download-URL', { token, params: { secureName: fileA.secureName } }))
+
+      p('2: cannot download another file on the same patient', 403,
+        await probe('get', '/file-download-URL', { token, params: { secureName: fileB.secureName } }))
+
+      // validateInput merges query, then body, then params — body wins over query, so a pin checked
+      // against req.query rather than req.validated would be sidesteppable exactly like this.
+      p('3: cannot smuggle another secureName through the body', 403,
+        await probe('get', '/file-download-URL', {
+          token, params: { secureName: fileA.secureName }, data: { secureName: fileB.secureName },
+        }))
+
+      // a listing would turn the pin into a directory of the patient's chart
+      p('4: cannot list files', 403, await probe('get', '/files', { token }))
+
+      p('5a: cannot read chats', 403, await probe('get', '/chats', { token }))
+      p('5b: cannot read form responses', 403, await probe('get', '/form-responses', { token }))
+      p('5c: cannot read observations', 403, await probe('get', '/enduser-observations', { token }))
+
+      p('6: cannot update the patient', 403,
+        await probe('patch', `/enduser/${enduser.id}`, { token, data: { updates: { fname: 'Overwritten' } } }))
+
+      const refreshed = await probe('post', '/refresh-enduser-session', { token })
+      p('7: can refresh its own session', 200, refreshed)
+
+      // 7b — the refresh payload must be the fromPublicSession shape, not the whole chart
+      const leaked = ['dateOfBirth', 'email', 'phone', 'fields', 'insurance', 'lname']
+        .filter(f => (refreshed.body?.enduser ?? {})[f] !== undefined)
+      record(
+        `${variant} — 7b: refresh response withholds patient fields`,
+        refreshed.status === 200 && leaked.length === 0,
+        leaked.length ? `leaked: ${leaked.join(', ')}` : 'no patient fields in payload',
+      )
+
+      // 8 — confinement has to survive the re-mint, or one refresh launders it away
+      const refreshedToken = refreshed.body?.authToken
+      if (typeof refreshedToken === 'string' && refreshedToken) {
+        p('8a: refreshed token still cannot download another file', 403,
+          await probe('get', '/file-download-URL', {
+            token: refreshedToken, params: { secureName: fileB.secureName },
+          }))
+        p('8b: refreshed token still cannot update the patient', 403,
+          await probe('patch', `/enduser/${enduser.id}`, {
+            token: refreshedToken, data: { updates: { fname: 'Overwritten' } },
+          }))
+      } else {
+        record(`${variant} — 8: refreshed token available`, false, 'refresh returned no authToken')
+      }
+    }
+
+    const plain = await mint('link')
+    if (plain.token) {
+      await confinement_probes('link', plain.token)
+    } else {
+      record('link — minted', false, plain.detail)
+    }
+
+    const shared = await mint('shared-link')
+    if (shared.token) {
+      await confinement_probes('shared-link', shared.token)
+    } else {
+      // Before the shared-link verb exists the merge field does not resolve. Record it and skip the
+      // shared probes rather than throwing, so the first run reports the whole picture at once.
+      record('shared-link — minted', false, shared.detail)
+    }
+
+    /* ========================================= OTP ========================================= */
+
+    if (shared.token) {
+      const methods = await probe('get', '/endusers/otp-methods', { params: { token: shared.token } })
+      record(
+        'shared-link — 9: OTP methods are not offered',
+        methods.status === 403, `status ${methods.status} (expected 403)`,
+      )
+
+      const send = await probe('post', '/endusers/send-otp-code', {
+        data: { token: shared.token, method: 'email' },
+      })
+      record(
+        'shared-link — 10: cannot make us send the patient a login code',
+        send.status === 403, `status ${send.status} (expected 403)`,
+      )
+
+      // rejected on scope BEFORE the code lookup, so it is not an oracle on code validity
+      const verify = await probe('post', '/endusers/verify-otp-code', {
+        data: { token: shared.token, code: '000000' },
+      })
+      record(
+        'shared-link — 11: OTP verification refuses the scope before checking the code',
+        verify.status === 403, `status ${verify.status} (expected 403, 400 = reached the code check)`,
+      )
+
+      // 12 — the same call with the scope claim stripped and the signature broken. The OTP endpoints
+      // jwtDecode without verifying, so without signature verification this sails straight through
+      // and every check above is decorative.
+      const [header, payload] = shared.token.split('.')
+      const decoded = JSON.parse(Buffer.from(payload, 'base64url').toString())
+      delete decoded.sessionScopes
+      delete decoded.scopeContext
+      const forged = [
+        header,
+        Buffer.from(JSON.stringify(decoded)).toString('base64url'),
+        'not-a-real-signature',
+      ].join('.')
+
+      const forgedSend = await probe('post', '/endusers/send-otp-code', {
+        data: { token: forged, method: 'email' },
+      })
+      record(
+        'shared-link — 12: a forged token cannot strip the scope to unlock OTP',
+        forgedSend.status === 403 || forgedSend.status === 401 || forgedSend.status === 404,
+        `status ${forgedSend.status} (expected 401/403/404; 204 = signature never verified)`,
+      )
+    }
+
+    if (plain.token) {
+      // 13 — the patient-facing variant must keep its recovery path. Deliverable to a dontsend-
+      // address, so nothing leaves the system.
+      const send = await probe('post', '/endusers/send-otp-code', {
+        data: { token: plain.token, method: 'email' },
+      })
+      record(
+        'link — 13: patient OTP recovery still works',
+        send.status === 204, `status ${send.status} (expected 204)`,
+      )
+    }
+  } finally {
+    // Teardown BEFORE anything asserts — assert calls process.exit, which skips pending finallys and
+    // would strand the provisioned tenant permanently.
+    if (tenant) { try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) } }
+  }
+
+  return checks
+}
+
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+export const file_link_session_confinement_tests = async () => {
+  assert_checks('Shared file link session confinement', await file_link_session_confinement_checks())
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  file_link_session_confinement_tests()
+    .then(() => {
+      console.log("✅ file link session confinement test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ file link session confinement test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/security/form-logic-js-execution.test.ts

@@ -0,0 +1,183 @@
+require('source-map-support').install();
+
+import {
+  assert_checks,
+  Check,
+  setup_isolated_tenant,
+} from "../../setup_isolated"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
+/**
+ * Regression test: `$JS(...)` must be rejected in stored conditional logic.
+ *
+ * `responses_satisfy_conditions` (utilities/src/utils.ts) compiled a stored condition value of the
+ * form `$JS(...)` with `new Function()` and executed it — in every form-filler's browser, including
+ * anonymous visitors on public intake pages, AND inside the API process (automation_triggers.ts
+ * trigger matching on every form submission, ai_agent/form_filling.ts voice-agent navigation). The
+ * API process holds every tenant's database handle, so a condition authored by staff in one tenant
+ * reached all of them. Any staff user or API key with form_fields write access could plant one by
+ * typing into the free-text $gt/$lt box — no API call required.
+ *
+ * The sink is removed. This asserts the second half of the fix: `compoundFilterValidator` rejects the
+ * syntax at write time on every field that feeds that evaluator, so it cannot be reintroduced through
+ * stored configuration. The runtime half — that a `$JS` value is never evaluated — is covered by the
+ * pure-function cases in `form_conditional_logic_tests` in tests.ts.
+ *
+ * The five condition locations were established by enumerating every `responses_satisfy_conditions`
+ * call site, and all five are covered here. That completeness matters: the first run of this test
+ * caught a half fix. `event.conditions` is wrapped in an `orValidator`, which returns the first arm
+ * that does not throw, and its permissive `optional: optionalAnyObjectValidator` arm was declared
+ * before the guarded one — so the payload was accepted and stored even though the validator had been
+ * swapped. Pointing a field at the guard is not the same as the guard being reachable, which is why
+ * every location gets an assertion rather than an argument.
+ *
+ * Each rejection is paired with a positive control using the same shape without `$JS(`, so a passing
+ * test cannot be explained by the write failing for an unrelated reason.
+ */
+export const form_logic_js_execution_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  const JS_PAYLOAD = '$JS(return 0)'
+  const SAFE_VALUE = '18'
+
+  const condition = (value: string) => ({ $and: [{ condition: { 'someFieldId': { $gt: value } } }] })
+  const previousFields = (value: string) => ([{
+    type: 'compoundLogic',
+    info: { fieldId: '000000000000000000000000', priority: 5, label: '', condition: condition(value) },
+  }])
+
+  const attempt = async (fn: () => Promise<any>) => (
+    fn().then(() => ({ accepted: true,  detail: 'accepted' }))
+        .catch((e: any) => ({ accepted: false, detail: `rejected: ${e?.message || e}` }))
+  )
+
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+
+  try {
+    tenant = await setup_isolated_tenant({ name: `F0200 ${RAND()}`, users: [{ isAdmin: true }], apiKeys: 0 })
+    const sdk = tenant.sdk
+
+    const form = await sdk.api.forms.createOne({ title: `${RAND()}` })
+    const field = await sdk.api.form_fields.createOne({
+      formId: form.id, title: 'anchor', type: 'string', previousFields: [{ type: 'root', info: {} }],
+    })
+
+    /* ===== 1. previousFields[].info.condition — the field the finding was reported against ===== */
+
+    const controlCreate = await attempt(() => sdk.api.form_fields.createOne({
+      formId: form.id, title: 'control', type: 'string',
+      previousFields: previousFields(SAFE_VALUE) as any,
+    }))
+    record(
+      'control: form_fields.createOne accepts a normal $gt condition',
+      controlCreate.accepted, controlCreate.detail,
+    )
+
+    const payloadCreate = await attempt(() => sdk.api.form_fields.createOne({
+      formId: form.id, title: 'payload', type: 'string',
+      previousFields: previousFields(JS_PAYLOAD) as any,
+    }))
+    record(
+      '1a: form_fields.createOne rejects $JS( in previousFields condition',
+      !payloadCreate.accepted, payloadCreate.detail,
+    )
+
+    const payloadUpdate = await attempt(() => sdk.api.form_fields.updateOne(field.id, {
+      previousFields: previousFields(JS_PAYLOAD) as any,
+    }))
+    record(
+      '1b: form_fields.updateOne rejects $JS( in previousFields condition',
+      !payloadUpdate.accepted, payloadUpdate.detail,
+    )
+
+    /* ===== 2. groupShowCondition ===== */
+
+    const groupControl = await attempt(() => sdk.api.form_fields.updateOne(field.id, {
+      groupShowCondition: condition(SAFE_VALUE) as any,
+    }))
+    record('control: groupShowCondition accepts a normal condition', groupControl.accepted, groupControl.detail)
+
+    const groupPayload = await attempt(() => sdk.api.form_fields.updateOne(field.id, {
+      groupShowCondition: condition(JS_PAYLOAD) as any,
+    }))
+    record('2: form_fields.updateOne rejects $JS( in groupShowCondition', !groupPayload.accepted, groupPayload.detail)
+
+    /* ===== 3. options.optionDetails[].showCondition ===== */
+
+    const optionControl = await attempt(() => sdk.api.form_fields.updateOne(field.id, {
+      options: { optionDetails: [{ option: 'A', showCondition: condition(SAFE_VALUE) }] } as any,
+    }))
+    record('control: optionDetails showCondition accepts a normal condition', optionControl.accepted, optionControl.detail)
+
+    const optionPayload = await attempt(() => sdk.api.form_fields.updateOne(field.id, {
+      options: { optionDetails: [{ option: 'A', showCondition: condition(JS_PAYLOAD) }] } as any,
+    }))
+    record('3: form_fields.updateOne rejects $JS( in optionDetails showCondition', !optionPayload.accepted, optionPayload.detail)
+
+    /* ===== 4. options.productConditions[].showCondition ===== */
+
+    const productControl = await attempt(() => sdk.api.form_fields.updateOne(field.id, {
+      options: { productConditions: [{ productId: '000000000000000000000000', showCondition: condition(SAFE_VALUE) }] } as any,
+    }))
+    record('control: productConditions showCondition accepts a normal condition', productControl.accepted, productControl.detail)
+
+    const productPayload = await attempt(() => sdk.api.form_fields.updateOne(field.id, {
+      options: { productConditions: [{ productId: '000000000000000000000000', showCondition: condition(JS_PAYLOAD) }] } as any,
+    }))
+    record('4: form_fields.updateOne rejects $JS( in productConditions showCondition', !productPayload.accepted, productPayload.detail)
+
+    /* ===== 5. automation_triggers — the server-side evaluation path ===== */
+
+    const trigger = (conditions: object, extraInfo: object = {}) => ({
+      title: `${RAND()}`,
+      status: 'Inactive',
+      event: { type: 'Form Submitted', info: { formId: form.id, ...extraInfo }, ...conditions },
+      action: { type: 'Add Tags', info: { tags: ['security-regression'] } },
+    } as any)
+
+    const triggerControl = await attempt(() => sdk.api.automation_triggers.createOne(
+      trigger({ conditions: condition(SAFE_VALUE) })
+    ))
+    record('control: automation_triggers accepts normal event conditions', triggerControl.accepted, triggerControl.detail)
+
+    // NOTE: this is the case that caught the half fix — the orValidator's permissive arm accepted it.
+    const triggerPayload = await attempt(() => sdk.api.automation_triggers.createOne(
+      trigger({ conditions: condition(JS_PAYLOAD) })
+    ))
+    record('5a: automation_triggers rejects $JS( in event.conditions', !triggerPayload.accepted, triggerPayload.detail)
+
+    const byFormIdPayload = await attempt(() => sdk.api.automation_triggers.createOne(
+      trigger({}, { conditionsByFormId: { [form.id]: condition(JS_PAYLOAD) } })
+    ))
+    record('5b: automation_triggers rejects $JS( in event.info.conditionsByFormId', !byFormIdPayload.accepted, byFormIdPayload.detail)
+  } finally {
+    // Teardown BEFORE anything asserts — assert calls process.exit, which skips pending finallys and
+    // would strand the provisioned tenant permanently.
+    if (tenant) { try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) } }
+  }
+
+  return checks
+}
+
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+export const form_logic_js_execution_tests = async () => {
+  assert_checks('$JS in stored conditional logic', await form_logic_js_execution_checks())
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  form_logic_js_execution_tests()
+    .then(() => {
+      console.log("✅ form logic JS execution test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ form logic JS execution test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/security/{F-0145-globalunique-leak.test.ts → globalunique-conflict-redaction.test.ts}

@@ -10,8 +10,7 @@ import { setup_tests } from "../../setup"
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
 /**
- * Regression test for F-0145
- * (security-audit/findings/F-0145-globalunique-conflict-leaks-cross-tenant-record.md).
+ * Regression test: a globalUnique conflict response must not echo the matched record.
  *
  * The create endpoint generator's unconditional globalUnique-enforcement block
  * (routing.ts, "globalUnique should be enforced even if _overrideUnique is true")
@@ -24,7 +23,7 @@ const host = process.env.API_URL || 'http://localhost:8080' as const
  * 409 body's existingRecord exposes nothing beyond _id + businessId.
  */
 export const globalunique_leak_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("F-0145: globalUnique conflict response redaction")
+  log_header("globalUnique conflict response redaction")
 
   let userId: string | undefined
   try {
@@ -33,7 +32,7 @@ export const globalunique_leak_tests = async ({ sdk } : { sdk: Session, sdkNonAd
     userId = user.id
 
     await async_test(
-      'F-0145: globalUnique 409 existingRecord exposes only _id + businessId (no email/hashedPass)',
+      'globalUnique 409 existingRecord exposes only _id + businessId (no email/hashedPass)',
       () => sdk.api.users.createOne({ email, _overrideUnique: true } as any),
       {
         shouldError: true,
@@ -68,11 +67,11 @@ if (require.main === module) {
 
   runTests()
     .then(() => {
-      console.log("✅ F-0145 globalUnique leak test suite completed successfully")
+      console.log("✅ globalUnique leak test suite completed successfully")
       process.exit(0)
     })
     .catch((error) => {
-      console.error("❌ F-0145 globalUnique leak test suite failed:", error)
+      console.error("❌ globalUnique leak test suite failed:", error)
       process.exit(1)
     })
 }

package/src/tests/api_tests/security/{F-0008-handle-incoming-communication-cross-tenant.test.ts → handle-incoming-communication-cross-tenant.test.ts}

@@ -27,7 +27,7 @@ const post = async (path: string, body: any, headers: Record<string, string> = {
 }
 
 /**
- * Regression test for F-0008 (security-audit/findings/F-0008-handle-incoming-communication-cross-tenant-enduser-lookup.md).
+ * Regression test: `handle_incoming_communication` tenant scoping.
  *
  * `journeys.handle_incoming_communication` previously used `buildAllQueries({ unrestricted: true, organizationIds: [] }).endusers.findById(enduserId)`,
  * permitting cross-tenant lookup of any enduser by id. The handler then called `handleIncomingCommunication(...)`
@@ -45,7 +45,7 @@ const post = async (path: string, body: any, headers: Record<string, string> = {
  * enduser — the post-fix code returns 404 before any side effects fire, and the assertion confirms that.
  */
 export const handle_incoming_communication_cross_tenant_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("F-0008: handle_incoming_communication cross-tenant rejection")
+  log_header("handle_incoming_communication cross-tenant rejection")
 
   // ====================================================================
   // Assertion 1: nonexistent enduserId returns 404 (baseline; regression
@@ -58,19 +58,19 @@ export const handle_incoming_communication_cross_tenant_tests = async ({ sdk, sd
     { Authorization: `Bearer ${sdk.authToken}` },
   )
   await async_test(
-    "F-0008: handle_incoming_communication with nonexistent enduserId returns 404",
+    "handle_incoming_communication with nonexistent enduserId returns 404",
     async () => ({ status: nonexistentRes.status }),
     { onResult: r => r.status === 404 },
   )
 
   // ====================================================================
-  // Assertion 2: cross-tenant enduserId returns 404 (the actual F-0008 fix).
+  // Assertion 2: cross-tenant enduserId returns 404 (the actual fix).
   // Env-gated; skipped when cross-org infra isn't configured.
   // Safe to run post-fix because the tenant-scoped DB returns null for
   // cross-tenant lookups — no handleIncomingCommunication side effect fires.
   // ====================================================================
   if (!(CROSS_ORG_API_KEY && CROSS_ORG_TARGET_BUSINESS_ID)) {
-    console.log("  [F-0008] Skipping cross-tenant rejection assertion — CROSS_ORG_* env vars not set")
+    console.log("  Skipping cross-tenant rejection assertion — CROSS_ORG_* env vars not set")
     return
   }
 
@@ -96,7 +96,7 @@ export const handle_incoming_communication_cross_tenant_tests = async ({ sdk, sd
     )
 
     await async_test(
-      "F-0008: handle_incoming_communication with cross-tenant enduserId returns 404 (no side effect)",
+      "handle_incoming_communication with cross-tenant enduserId returns 404 (no side effect)",
       async () => ({
         status: crossRes.status,
         message: crossRes.data?.message ?? null,
@@ -120,11 +120,11 @@ if (require.main === module) {
 
   runTests()
     .then(() => {
-      console.log("✅ F-0008 handle_incoming_communication cross-tenant test suite completed successfully")
+      console.log("✅ handle_incoming_communication cross-tenant test suite completed successfully")
       process.exit(0)
     })
     .catch((error) => {
-      console.error("❌ F-0008 handle_incoming_communication cross-tenant test suite failed:", error)
+      console.error("❌ handle_incoming_communication cross-tenant test suite failed:", error)
       process.exit(1)
     })
 }

package/src/tests/api_tests/security/{F-0007-invite-user-enumeration.test.ts → invite-user-enumeration.test.ts}

@@ -27,7 +27,7 @@ const post = async (path: string, body: any, headers: Record<string, string> = {
 }
 
 /**
- * Regression test for F-0007 (security-audit/findings/F-0007-invite-user-cross-tenant-email-enumeration.md).
+ * Regression test: `invite_user` cross-tenant enumeration.
  *
  * `users.invite_user` previously used `buildAllQueries({ unrestricted: true, organizationIds: [] }).users.findOne({ email })`
  * to enforce platform-wide email uniqueness and threw the distinctive `"A user with this email already exists"`
@@ -50,7 +50,7 @@ const post = async (path: string, body: any, headers: Record<string, string> = {
  *      env vars are not set, mirroring cross_org_api_key.test.ts convention.
  */
 export const invite_user_enumeration_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("F-0007: users.invite_user cross-tenant enumeration regression")
+  log_header("users.invite_user cross-tenant enumeration regression")
 
   // Reset state so prior tests' rate-limit accounting doesn't leak in.
   await sdk.reset_db()
@@ -85,7 +85,7 @@ export const invite_user_enumeration_tests = async ({ sdk, sdkNonAdmin } : { sdk
   }
 
   await async_test(
-    "F-0007: invite_user rate-limits within ~12 rapid requests (defense-in-depth; no invites sent)",
+    "invite_user rate-limits within ~12 rapid requests (defense-in-depth; no invites sent)",
     async () => ({ rateLimitedAt }),
     { onResult: r => r.rateLimitedAt >= 0 && r.rateLimitedAt <= 12 },
   )
@@ -111,7 +111,7 @@ export const invite_user_enumeration_tests = async ({ sdk, sdkNonAdmin } : { sdk
   )
 
   await async_test(
-    "F-0007: invite_user same-tenant duplicate returns 400 'already exists' (unchanged)",
+    "invite_user same-tenant duplicate returns 400 'already exists' (unchanged)",
     async () => ({
       status: sameTenantRes.status,
       message: sameTenantRes.data?.message ?? '',
@@ -124,7 +124,7 @@ export const invite_user_enumeration_tests = async ({ sdk, sdkNonAdmin } : { sdk
   // Env-gated; skipped when cross-org infra not configured.
   // ====================================================================
   if (!(CROSS_ORG_API_KEY && CROSS_ORG_TARGET_BUSINESS_ID)) {
-    console.log("  [F-0007] Skipping cross-tenant silent no-op assertion — CROSS_ORG_* env vars not set")
+    console.log("  Skipping cross-tenant silent no-op assertion — CROSS_ORG_* env vars not set")
     return
   }
 
@@ -160,7 +160,7 @@ export const invite_user_enumeration_tests = async ({ sdk, sdkNonAdmin } : { sdk
   )
 
   await async_test(
-    "F-0007: cross-tenant invite of existing email must NOT return 'already exists' (no enumeration)",
+    "cross-tenant invite of existing email must NOT return 'already exists' (no enumeration)",
     async () => ({
       status: crossRes.status,
       message: crossRes.data?.message ?? '',
@@ -188,11 +188,11 @@ if (require.main === module) {
 
   runTests()
     .then(() => {
-      console.log("✅ F-0007 invite_user enumeration test suite completed successfully")
+      console.log("✅ invite_user enumeration test suite completed successfully")
       process.exit(0)
     })
     .catch((error) => {
-      console.error("❌ F-0007 invite_user enumeration test suite failed:", error)
+      console.error("❌ invite_user enumeration test suite failed:", error)
       process.exit(1)
     })
 }