@tellescope/sdk 1.256.14 → 1.256.16

package/src/tests/api_tests/security/{F-0151-load-inbox-redaction.test.ts → load-inbox-redaction.test.ts}

@@ -12,8 +12,7 @@ const host = process.env.API_URL || 'http://localhost:8080' as const
 const ENDUSER_PASSWORD = 'F0151TestPassword!123'
 
 /**
- * Regression test for F-0151
- * (security-audit/findings/F-0151-load-inbox-data-endusers-unredacted.md).
+ * Regression test: `load_inbox_data` must apply enduser field redactions.
  *
  * load_inbox_data serialized $lookup'ed endusers via convert_id_name only (NOT applyRedactions),
  * so endusers.hashedPassword (redactions:['all']) leaked to staff sessions — while the sibling
@@ -24,7 +23,7 @@ const ENDUSER_PASSWORD = 'F0151TestPassword!123'
  * assert the returned enduser entry has NO hashedPassword.
  */
 export const load_inbox_redaction_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("F-0151: load_inbox_data enduser redaction")
+  log_header("load_inbox_data enduser redaction")
 
   let enduserId: string | undefined
   let emailId: string | undefined
@@ -42,7 +41,7 @@ export const load_inbox_redaction_tests = async ({ sdk } : { sdk: Session, sdkNo
     emailId = seeded.id
 
     await async_test(
-      'F-0151: load_inbox_data does not leak enduser.hashedPassword to staff',
+      'load_inbox_data does not leak enduser.hashedPassword to staff',
       () => sdk.api.endusers.load_inbox_data({ enduserIds: [enduser.id] } as any),
       {
         onResult: (r: any) => {
@@ -71,11 +70,11 @@ if (require.main === module) {
 
   runTests()
     .then(() => {
-      console.log("✅ F-0151 load_inbox_data redaction test suite completed successfully")
+      console.log("✅ load_inbox_data redaction test suite completed successfully")
       process.exit(0)
     })
     .catch((error) => {
-      console.error("❌ F-0151 load_inbox_data redaction test suite failed:", error)
+      console.error("❌ load_inbox_data redaction test suite failed:", error)
       process.exit(1)
     })
 }

package/src/tests/api_tests/security/{F-0016-prototype-pollution.test.ts → prototype-pollution.test.ts}

@@ -1,16 +1,16 @@
 import { add_value_for_dotted_key } from "@tellescope/utilities"
 
-// Regression test for F-0016 (pattern 17 — prototype pollution).
+// Regression test: prototype pollution via dotted-key assignment.
 // add_value_for_dotted_key must NOT write through __proto__/constructor/prototype path segments
 // (which would pollute Object.prototype process-wide), while still performing legitimate dotted assignment.
 //
 // Pure-function test — no Session needed. Runs in the main suite and standalone:
-//   ./build_cjs.sh && cd packages/public/sdk && node -r dotenv/config lib/cjs/tests/api_tests/security/F-0016-prototype-pollution.test.js
+//   ./build_cjs.sh && cd packages/public/sdk && node -r dotenv/config lib/cjs/tests/api_tests/security/prototype-pollution.test.js
 
 const fail = (msg: string) => { throw new Error(msg) }
 
 export const prototype_pollution_tests = async () => {
-  console.log("Running F-0016 prototype-pollution regression tests")
+  console.log("Running prototype-pollution regression tests")
 
   // 1. __proto__ path must not pollute Object.prototype
   add_value_for_dotted_key({ insurance: {} } as any, 'insurance.__proto__.__pp_a__', 'polluted')
@@ -40,7 +40,7 @@ export const prototype_pollution_tests = async () => {
   add_value_for_dotted_key(flat, 'name', 'ok')
   if (flat.name !== 'ok') fail('single-key assignment broke')
 
-  console.log("✅ F-0016 prototype-pollution regression tests passed")
+  console.log("✅ prototype-pollution regression tests passed")
 }
 
 if (require.main === module) {

package/src/tests/api_tests/security/{F-0025-proxy-image-unauth-ssrf.test.ts → proxy-image-unauth-ssrf.test.ts}

@@ -22,15 +22,14 @@ const assert_local_api = () => {
   const hostname = new URL(host).hostname
   if (!LOCAL_HOSTNAMES.includes(hostname)) {
     throw new Error(
-      `F-0025 SSRF tests must run against a local API (got ${host}). `
+      `SSRF tests must run against a local API (got ${host}). `
       + `127.0.0.1 would resolve to the API server rather than this machine, so the tests would be meaningless.`
     )
   }
 }
 
 /**
- * Regression tests for F-0025
- * (security-audit/findings/F-0025-proxy-image-unauth-ssrf.md).
+ * Regression tests: `/v1/proxy-image` must refuse internal and non-image destinations.
  *
  * GET /v1/proxy-image accepted an arbitrary ?url= and streamed the upstream response body straight
  * back with Access-Control-Allow-Origin: *, with no authentication, no destination validation and no
@@ -58,7 +57,7 @@ const assert_local_api = () => {
  * the vulnerability proof.
  */
 export const proxy_image_ssrf_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("F-0025: proxy-image unauthenticated SSRF")
+  log_header("proxy-image unauthenticated SSRF")
   assert_local_api()
 
   const SENTINEL = `f0025-sentinel-${Date.now()}-${Math.random().toString(36).slice(2)}`
@@ -95,7 +94,7 @@ export const proxy_image_ssrf_tests = async ({ sdk } : { sdk: Session, sdkNonAdm
 
     // T1 — the core SSRF: an unauthenticated caller must not be able to read an internal resource.
     await async_test(
-      'F-0025: proxy-image does not stream an internal non-image resource to an unauthenticated caller',
+      'proxy-image does not stream an internal non-image resource to an unauthenticated caller',
       call_unauthenticated,
       {
         // Positive control: a numeric status proves we actually reached our API rather than failing to
@@ -111,7 +110,7 @@ export const proxy_image_ssrf_tests = async ({ sdk } : { sdk: Session, sdkNonAdm
     // T2 — the unauthenticated surface itself: the request must be refused outright, and the
     // destination must never be contacted (no SSRF-as-a-side-effect even when the body is withheld).
     await async_test(
-      'F-0025: proxy-image refuses an unauthenticated request without contacting the destination',
+      'proxy-image refuses an unauthenticated request without contacting the destination',
       call_unauthenticated,
       { onResult: (r: any) => r.status >= 400 && r.status < 500 && r.sentinelHits === 0 },
     )
@@ -129,26 +128,26 @@ export const proxy_image_ssrf_tests = async ({ sdk } : { sdk: Session, sdkNonAdm
     }
 
     await async_test(
-      'F-0025: proxy-image refuses a private destination even for an authenticated staff session',
+      'proxy-image refuses a private destination even for an authenticated staff session',
       () => call_authenticated(sentinelURL),
       { onResult: (r: any) => r.status === 400 && r.sentinelHits === 0 },
     )
 
     await async_test(
-      'F-0025: proxy-image refuses cloud metadata for an authenticated staff session',
+      'proxy-image refuses cloud metadata for an authenticated staff session',
       () => call_authenticated('https://169.254.169.254/latest/meta-data/'),
       { onResult: (r: any) => r.status === 400 },
     )
 
     // Scheme and port are pinned: only https on 443, which is all the PDF export ever needs.
     await async_test(
-      'F-0025: proxy-image refuses a plain http destination',
+      'proxy-image refuses a plain http destination',
       () => call_authenticated('http://example.com/logo.png'),
       { onResult: (r: any) => r.status === 400 },
     )
 
     await async_test(
-      'F-0025: proxy-image refuses a non-443 port',
+      'proxy-image refuses a non-443 port',
       () => call_authenticated('https://example.com:8443/logo.png'),
       { onResult: (r: any) => r.status === 400 },
     )
@@ -169,11 +168,11 @@ if (require.main === module) {
 
   runTests()
     .then(() => {
-      console.log("✅ F-0025 proxy-image SSRF test suite completed successfully")
+      console.log("✅ proxy-image SSRF test suite completed successfully")
       process.exit(0)
     })
     .catch((error) => {
-      console.error("❌ F-0025 proxy-image SSRF test suite failed:", error)
+      console.error("❌ proxy-image SSRF test suite failed:", error)
       process.exit(1)
     })
 }

package/src/tests/api_tests/security/{F-0013-sanitize-user-html-with-iframes.test.ts → sanitize-user-html-with-iframes.test.ts}

@@ -1,22 +1,22 @@
 import { DEFAULT_IFRAME_SANDBOX, replace_form_field_template_values, sanitize_user_html, sanitize_user_html_with_iframes } from "@tellescope/utilities"
 
-// Companion to F-0013-sanitize-user-html.test.ts (pattern 06 — XSS via dangerouslySetInnerHTML).
+// Companion to sanitize-user-html.test.ts (pattern 06 — XSS via dangerouslySetInnerHTML).
 //
 // sanitize_user_html_with_iframes is the variant used by the live form's field description, so
 // admins can embed video / scheduling widgets. It permits <iframe> and NOTHING else beyond what
 // sanitize_user_html allows. This asserts:
-//   1. permitting iframe did not reopen any of the F-0013 vectors (the full payload list is re-run)
+//   1. permitting iframe did not reopen any of the base vectors (the full payload list is re-run)
 //   2. only absolute https iframes survive — relative, protocol-relative, http, javascript:, data:
 //      and srcdoc frames are dropped, along with their fallback content
 //   3. the restrictive sandbox is forced, but an author-supplied sandbox is honored
 //   4. sanitize_user_html itself still strips iframes (the boundary between the two functions)
 //
 // Pure-function test — no Session needed. Runs as part of the main suite and standalone:
-//   ./build_cjs.sh && cd packages/public/sdk && node -r dotenv/config lib/cjs/tests/api_tests/security/F-0013-sanitize-user-html-with-iframes.test.js
+//   ./build_cjs.sh && cd packages/public/sdk && node -r dotenv/config lib/cjs/tests/api_tests/security/sanitize-user-html-with-iframes.test.js
 
 const fail = (msg: string) => { throw new Error(msg) }
 
-// Same as has_no_executable_vector in the F-0013 test, minus the '<iframe' clause (iframes are
+// Same as has_no_executable_vector in the base sanitizer test, minus the '<iframe' clause (iframes are
 // expected in this function's output). Everything else must still be neutralized.
 const has_no_executable_vector_allowing_iframe = (out: string) => {
   const o = out.toLowerCase()
@@ -49,7 +49,7 @@ export const sanitize_user_html_with_iframes_tests = async () => {
   console.log("Running sanitize_user_html_with_iframes XSS regression tests")
 
   // ---------------------------------------------------------------------------------------------
-  // 1. Re-run the full F-0013 payload set — permitting iframe must not be a general regression
+  // 1. Re-run the full base payload set — permitting iframe must not be a general regression
   // ---------------------------------------------------------------------------------------------
   const xssPayloads: [string, string][] = [
     ['img onerror', `<img src=x onerror="alert(document.domain)">`],

package/src/tests/api_tests/security/{F-0013-sanitize-user-html.test.ts → sanitize-user-html.test.ts}

@@ -1,13 +1,13 @@
 import { sanitize_user_html } from "@tellescope/utilities"
 
-// Regression test for F-0013 / F-0014 (pattern 06 — XSS via dangerouslySetInnerHTML).
+// Regression test: XSS via dangerouslySetInnerHTML.
 // sanitize_user_html is the canonical render-time sanitizer that replaced remove_script_tags
 // at every dangerouslySetInnerHTML sink. This asserts it neutralizes XSS vectors (incl. encoded /
 // whitespace / mixed-case / iframe-srcdoc bypass variants) while preserving legitimate
 // customization HTML (tables, headings, lists, links, images, inline styles).
 //
 // Pure-function test — no Session needed. Runs as part of the main suite and standalone:
-//   ./build_cjs.sh && cd packages/public/sdk && node -r dotenv/config lib/cjs/tests/api_tests/security/F-0013-sanitize-user-html.test.js
+//   ./build_cjs.sh && cd packages/public/sdk && node -r dotenv/config lib/cjs/tests/api_tests/security/sanitize-user-html.test.js
 
 const fail = (msg: string) => { throw new Error(msg) }
 
@@ -31,7 +31,7 @@ const has_no_executable_vector = (out: string) => {
 }
 
 export const sanitize_user_html_xss_tests = async () => {
-  console.log("Running F-0013/F-0014 sanitize_user_html XSS regression tests")
+  console.log("Running sanitize_user_html XSS regression tests")
 
   const xssPayloads: [string, string][] = [
     ['img onerror', `<img src=x onerror="alert(document.domain)">`],
@@ -99,7 +99,7 @@ export const sanitize_user_html_xss_tests = async () => {
   const mixed = sanitize_user_html(`<p>Hello <b>name</b></p><img src=x onerror="steal()">`)
   if (!(mixed.includes('<b>name</b>') && !/\son[a-z]+\s*=/.test(mixed.toLowerCase()))) fail(`mixed content not handled: ${mixed}`)
 
-  console.log("✅ F-0013/F-0014 sanitize_user_html XSS regression tests passed")
+  console.log("✅ sanitize_user_html XSS regression tests passed")
 }
 
 if (require.main === module) {

package/src/tests/api_tests/security/{F-0191-schema-adminonly-enforcement.test.ts → schema-adminonly-enforcement.test.ts}

@@ -24,8 +24,7 @@ type Check = {
 }
 
 /**
- * Regression test for F-0191
- * (security-audit/findings/F-0191-schema-adminonly-not-enforced.md).
+ * Regression test: `adminOnly` custom actions must be enforced at runtime, not merely declared.
  *
  * `adminOnly: true` on a CUSTOM action in schema.ts was documentation-only. The runtime gate
  * (routing.ts:944) reads the flag off the options object built by getCustomEndpointFields, and
@@ -64,7 +63,7 @@ type Check = {
  * GREEN (post-fix): all six return 401 "Admin access only"; the group-A controls are unchanged.
  */
 export const schema_adminonly_enforcement_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("F-0191: schema-declared adminOnly must be enforced on custom actions")
+  log_header("schema-declared adminOnly must be enforced on custom actions")
 
   const checks: Check[] = []
   const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
@@ -225,7 +224,7 @@ export const schema_adminonly_enforcement_tests = async ({ sdk } : { sdk: Sessio
       {
         label: 'organizations.sync_note_to_canvas',
         method: 'post', path: '/organizations/sync-note-to-canvas',
-        data: { enduserId: ABSENT_ID, note: 'F-0191 control' }, // 404 Enduser not found
+        data: { enduserId: ABSENT_ID, note: 'control' }, // 404 Enduser not found
       },
       {
         label: 'background_errors.mark_read',
@@ -249,7 +248,7 @@ export const schema_adminonly_enforcement_tests = async ({ sdk } : { sdk: Sessio
     }
 
     /* ===== report: print full table first, then assert (harness exits on first failure) ===== */
-    console.log('\n  F-0191 check summary:')
+    console.log('\n  check summary:')
     for (const c of checks) {
       console.log(`    ${c.pass ? 'PASS' : 'FAIL'}  ${c.label}  —  ${c.detail}`)
     }
@@ -278,11 +277,11 @@ if (require.main === module) {
 
   runTests()
     .then(() => {
-      console.log("✅ F-0191 schema adminOnly enforcement test suite completed successfully")
+      console.log("✅ schema adminOnly enforcement test suite completed successfully")
       process.exit(0)
     })
     .catch((error) => {
-      console.error("❌ F-0191 schema adminOnly enforcement test suite failed:", error)
+      console.error("❌ schema adminOnly enforcement test suite failed:", error)
       process.exit(1)
     })
 }

package/src/tests/api_tests/security/{F-0076-self-admin-role-assignment.test.ts → self-admin-role-assignment.test.ts}

@@ -11,10 +11,10 @@ import { setup_tests } from "../../setup"
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
 /**
- * Self-role privilege-escalation guard (relates to security-audit finding F-0076, which was
+ * Self-role privilege-escalation guard (relates to a prior internal review, which was
  * investigated and closed as a FALSE POSITIVE — see that file for the full code trace).
  *
- * F-0076 hypothesized that a non-admin staff user could `PATCH /v1/users/{their-own-id}` with
+ * An earlier review hypothesized that a non-admin staff user could `PATCH /v1/users/{their-own-id}` with
  * `{ roles: ['Admin'] }` and self-promote to Admin, because the FIRST `users` relationship
  * constraint ("Only admin users can set the admin role",
  * [schema.ts:3446](packages/public/schema/src/schema.ts#L3446)) has a self-exception
@@ -43,7 +43,7 @@ const host = process.env.API_URL || 'http://localhost:8080' as const
  * path role-writable by non-admins would flip the step-3/step-4 assertions to red.
  */
 export const self_admin_role_assignment_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("F-0076: self-admin role assignment privilege-escalation regression")
+  log_header("self-admin role assignment privilege-escalation regression")
 
   const stamp = Date.now()
   const NON_ADMIN_ROLE = 'Provider'
@@ -84,7 +84,7 @@ export const self_admin_role_assignment_tests = async ({ sdk } : { sdk: Session,
     assert(
       JSON.stringify(attackerBefore.roles) === JSON.stringify([NON_ADMIN_ROLE]),
       `Setup failed: expected attacker to hold [${NON_ADMIN_ROLE}], got ${JSON.stringify(attackerBefore.roles)}`,
-      'F-0076 setup: attacker holds a non-admin role',
+      'setup: attacker holds a non-admin role',
     )
 
     // 2. Authenticate AS the attacker (no password needed — admin mints an auth token).
@@ -96,25 +96,25 @@ export const self_admin_role_assignment_tests = async ({ sdk } : { sdk: Session,
     assert(
       sdkAttacker.userInfo.id === attackerId && !(sdkAttacker.userInfo.roles ?? []).includes('Admin'),
       `Setup failed: attacker session is not the expected non-admin user`,
-      'F-0076 setup: authenticated as the non-admin attacker',
+      'setup: authenticated as the non-admin attacker',
     )
 
     // 3. SECURITY ASSERTIONS — every self-role mutation by the non-admin must be blocked.
     await expect_blocked(
       () => sdkAttacker.api.users.updateOne(attackerId!, { roles: ['Admin'] }, { replaceObjectFields: true }),
-      'F-0076: non-admin self-update to [Admin] is blocked',
+      'non-admin self-update to [Admin] is blocked',
     )
     await expect_blocked(
       () => sdkAttacker.api.users.updateOne(attackerId!, { roles: [NON_ADMIN_ROLE, 'Admin'] }, { replaceObjectFields: true }),
-      'F-0076: non-admin self-update to [Provider, Admin] is blocked',
+      'non-admin self-update to [Provider, Admin] is blocked',
     )
     await expect_blocked(
       () => sdkAttacker.api.users.updateOne(attackerId!, { roles: [`Arbitrary_${stamp}`] }, { replaceObjectFields: true }),
-      'F-0076: non-admin self-update to an arbitrary role is blocked',
+      'non-admin self-update to an arbitrary role is blocked',
     )
     await expect_blocked(
       () => sdkAttacker.api.users.updateOne(attackerId!, { roles: [] }, { replaceObjectFields: true }),
-      'F-0076: non-admin self-update to [] (would grant defaults) is blocked',
+      'non-admin self-update to [] (would grant defaults) is blocked',
     )
 
     // 4. STATE ASSERTION — nothing slipped through; roles are still the original non-admin role.
@@ -123,7 +123,7 @@ export const self_admin_role_assignment_tests = async ({ sdk } : { sdk: Session,
       JSON.stringify(attackerAfter.roles) === JSON.stringify([NON_ADMIN_ROLE]),
       `ESCALATION LEAK: attacker roles changed to ${JSON.stringify(attackerAfter.roles)} `
         + `after self-update attempts. Expected [${NON_ADMIN_ROLE}].`,
-      'F-0076: attacker roles unchanged after all self-escalation attempts',
+      'attacker roles unchanged after all self-escalation attempts',
     )
 
     // 5. POSITIVE CONTROL — an Admin CAN update the user's roles (mechanism is not over-restricted).
@@ -132,7 +132,7 @@ export const self_admin_role_assignment_tests = async ({ sdk } : { sdk: Session,
     assert(
       JSON.stringify(afterAdminUpdate.roles) === JSON.stringify([NON_ADMIN_ROLE]),
       `Admin role update failed: roles are ${JSON.stringify(afterAdminUpdate.roles)}, expected [${NON_ADMIN_ROLE}]`,
-      'F-0076: admin can manage user roles (positive control)',
+      'admin can manage user roles (positive control)',
     )
   } finally {
     // Cleanup: delete the throwaway attacker. Never touches pre-existing users.
@@ -155,11 +155,11 @@ if (require.main === module) {
 
   runTests()
     .then(() => {
-      console.log("✅ F-0076 self-admin role assignment test suite completed successfully")
+      console.log("✅ self-admin role assignment test suite completed successfully")
       process.exit(0)
     })
     .catch((error) => {
-      console.error("❌ F-0076 self-admin role assignment test suite failed:", error)
+      console.error("❌ self-admin role assignment test suite failed:", error)
       process.exit(1)
     })
 }

package/src/tests/api_tests/security/{F-0185-startlinktoken-enduser-staff-escalation.test.ts → startlinktoken-enduser-staff-escalation.test.ts}

@@ -8,7 +8,7 @@ import { PROVIDER_PERMISSIONS } from "@tellescope/constants"
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
 /**
- * Regression test for F-0185 — `calendar_events.startLinkToken` privilege escalation.
+ * Regression test — `calendar_events.startLinkToken` privilege escalation.
  *
  * startLinkToken is a DOCUMENTED feature ("Video Call Start Links"): a tenant's staff / API-key
  * integration PATCHes a CalendarEvent to set a random token, then sends the host user the
@@ -40,7 +40,7 @@ const host = process.env.API_URL || 'http://localhost:8080' as const
 const RAND = () => Math.random().toString(36).slice(2, 10)
 
 export const startlinktoken_escalation_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("F-0185: startLinkToken enduser-writable / readable → staff session escalation")
+  log_header("startLinkToken enduser-writable / readable → staff session escalation")
 
   const businessId = sdk.userInfo.businessId
   const userIds: string[] = []
@@ -66,7 +66,7 @@ export const startlinktoken_escalation_tests = async ({ sdk } : { sdk: Session,
     enduserIds.push(patient.id)
 
     const event = await sdk.api.calendar_events.createOne({
-      title: 'F-0185 appointment', durationInMinutes: 30, startTimeInMS: Date.now() + 3600_000,
+      title: 'appointment', durationInMinutes: 30, startTimeInMS: Date.now() + 3600_000,
       attendees: [{ type: 'user', id: host_user.id }, { type: 'enduser', id: patient.id }],
     } as any)
     eventIds.push(event.id)
@@ -140,7 +140,7 @@ export const startlinktoken_escalation_tests = async ({ sdk } : { sdk: Session,
     }
 
     // Report the full table before asserting (the harness exits on the first failed assert).
-    console.log('\n  F-0185 check summary:')
+    console.log('\n  check summary:')
     for (const c of checks) console.log(`    ${c.pass ? 'PASS' : 'FAIL'}  ${c.label}  —  ${c.detail}`)
     console.log('')
     for (const c of checks) assert(c.pass, `${c.label} — ${c.detail}`, c.label)
@@ -157,6 +157,6 @@ if (require.main === module) {
   const sdkNonAdmin = new Session({ host })
   setup_tests(sdk, sdkNonAdmin)
     .then(() => startlinktoken_escalation_tests({ sdk, sdkNonAdmin }))
-    .then(() => { console.log("✅ F-0185 startLinkToken escalation test suite completed successfully"); process.exit(0) })
-    .catch((error) => { console.error("❌ F-0185 startLinkToken escalation test suite failed:", error); process.exit(1) })
+    .then(() => { console.log("✅ startLinkToken escalation test suite completed successfully"); process.exit(0) })
+    .catch((error) => { console.error("❌ startLinkToken escalation test suite failed:", error); process.exit(1) })
 }

package/src/tests/api_tests/security/{F-0015-webhook-outbound-ssrf.test.ts → webhook-outbound-ssrf.test.ts}

@@ -51,7 +51,7 @@ const assert_local_api = () => {
   const hostname = new URL(host).hostname
   if (!LOCAL_HOSTNAMES.includes(hostname)) {
     throw new Error(
-      `F-0015 SSRF tests must run against a local API (got ${host}). `
+      `SSRF tests must run against a local API (got ${host}). `
       + `127.0.0.1 would resolve to the API server rather than this machine, and this test configures a webhook.`
     )
   }
@@ -76,8 +76,7 @@ const wait_until = async (predicate: () => boolean, ms: number) => {
 }
 
 /**
- * Regression tests for F-0015
- * (security-audit/findings/F-0015-webhook-outbound-ssrf.md).
+ * Regression tests: outbound webhook delivery must refuse internal destinations.
  *
  * Outbound webhooks request customer-configured URLs that are validated only for SYNTAX
  * (urlValidator -> validator.isURL, which happily accepts http://10.0.0.1/). Four call sites are
@@ -99,7 +98,7 @@ const wait_until = async (predicate: () => boolean, ms: number) => {
  * subscription. So each is paired with a positive control that proves the attempt really was made.
  */
 export const webhook_outbound_ssrf_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("F-0015: outbound webhook SSRF")
+  log_header("outbound webhook SSRF")
   assert_local_api()
 
   const SENTINEL = `f0015-sentinel-${Date.now()}-${Math.random().toString(36).slice(2)}`
@@ -110,9 +109,9 @@ export const webhook_outbound_ssrf_tests = async ({ sdk } : { sdk: Session, sdkN
     // guard refuses in every environment, and loopback does not qualify (see the note above).
     assert(
       false,
-      'F-0015 SKIPPED: no non-loopback RFC1918 interface on this host, so the SSRF sentinel cannot be '
+      'SKIPPED: no non-loopback RFC1918 interface on this host, so the SSRF sentinel cannot be '
       + 'bound anywhere the guard refuses. Run on a host with a private network interface.',
-      'F-0015 outbound SSRF',
+      'outbound SSRF',
     )
     return
   }
@@ -179,21 +178,21 @@ export const webhook_outbound_ssrf_tests = async ({ sdk } : { sdk: Session, sdkN
     // webhook, every "sentinel not contacted" assertion below is meaningless.
     // ---------------------------------------------------------------------------------------------
     await async_test(
-      'F-0015: automation webhook to a permitted target still delivers (regression baseline)',
+      'automation webhook to a permitted target still delivers (regression baseline)',
       () => send_automation_webhook_to(okURL),
       { onResult: (r: any) => r.okHits === 1 && r.sentinelHits === 0 },
     )
 
     // T3 — direct non-allowlisted private destination.
     await async_test(
-      'F-0015: automation webhook does not reach a private destination',
+      'automation webhook does not reach a private destination',
       () => send_automation_webhook_to(sentinelURL),
       { onResult: (r: any) => r.sentinelHits === 0 },
     )
 
     // T4 — the redirect bypass. THE test that justifies a connect-time guard over a pre-flight check.
     await async_test(
-      'F-0015: automation webhook does not follow a redirect from a permitted host into a private one',
+      'automation webhook does not follow a redirect from a permitted host into a private one',
       () => send_automation_webhook_to(redirectURL),
       {
         // redirectHits === 1 is the positive control: hop 1 was allowlisted and really was reached, so
@@ -212,7 +211,7 @@ export const webhook_outbound_ssrf_tests = async ({ sdk } : { sdk: Session, sdkN
     templateEnduserId = templateEnduser.id
 
     await async_test(
-      'F-0015: automation webhook validates the URL after template interpolation, not before',
+      'automation webhook validates the URL after template interpolation, not before',
       () => send_automation_webhook_to('http://{{enduser.ssrfTarget}}/ssrf-sentinel', templateEnduser.id),
       { onResult: (r: any) => r.sentinelHits === 0 },
     )
@@ -229,7 +228,7 @@ export const webhook_outbound_ssrf_tests = async ({ sdk } : { sdk: Session, sdkN
     configuredWebhook = true
 
     await async_test(
-      'F-0015: configured webhook to a permitted target still delivers (positive control)',
+      'configured webhook to a permitted target still delivers (positive control)',
       async () => {
         sentinelHits = 0; okHits = 0
         const e = await sdk.api.endusers.createOne({ email: `f0015-ok-${Date.now()}@example.com` })
@@ -244,7 +243,7 @@ export const webhook_outbound_ssrf_tests = async ({ sdk } : { sdk: Session, sdkN
     await sdk.api.webhooks.update({ url: sentinelURL })
 
     await async_test(
-      'F-0015: configured webhook does not deliver to a private destination',
+      'configured webhook does not deliver to a private destination',
       async () => {
         sentinelHits = 0; okHits = 0
         const e = await sdk.api.endusers.createOne({ email: `f0015-blocked-${Date.now()}@example.com` })
@@ -282,11 +281,11 @@ if (require.main === module) {
 
   runTests()
     .then(() => {
-      console.log("✅ F-0015 outbound webhook SSRF test suite completed successfully")
+      console.log("✅ outbound webhook SSRF test suite completed successfully")
       process.exit(0)
     })
     .catch((error) => {
-      console.error("❌ F-0015 outbound webhook SSRF test suite failed:", error)
+      console.error("❌ outbound webhook SSRF test suite failed:", error)
       process.exit(1)
     })
 }

package/src/tests/api_tests/security/{F-0155-webhook-timeout.test.ts → webhook-timeout.test.ts}

@@ -10,12 +10,11 @@ import { setup_tests } from "../../setup"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
-// The server-side axios timeout is 15s (F-0155 fix). We bound our own wait above that.
+// The server-side axios timeout is 15s (the fix under test). We bound our own wait above that.
 const CLIENT_WAIT_MS = 20_000
 
 /**
- * Regression test for F-0155
- * (security-audit/findings/F-0155-outbound-webhook-no-timeout-slow-loris.md).
+ * Regression test: outbound webhook delivery must time out rather than hang.
  *
  * Outbound webhook delivery used axios.post(url, ...) with no `timeout` (axios default = infinite).
  * A tenant-controlled receiver that accepts the connection and never responds hangs the awaited
@@ -28,7 +27,7 @@ const CLIENT_WAIT_MS = 20_000
  *   - red  (unfixed): the call is still pending at 20s → client timer wins
  */
 export const webhook_timeout_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("F-0155: outbound webhook timeout")
+  log_header("outbound webhook timeout")
 
   let enduserId: string | undefined
   const slowServer = http.createServer(() => { /* accept connection, never respond */ })
@@ -42,7 +41,7 @@ export const webhook_timeout_tests = async ({ sdk } : { sdk: Session, sdkNonAdmi
     enduserId = enduser.id
 
     await async_test(
-      'F-0155: outbound webhook to a non-responding receiver times out server-side (does not hang)',
+      'outbound webhook to a non-responding receiver times out server-side (does not hang)',
       async () => {
         const start = Date.now()
         const outcome = await Promise.race([
@@ -75,11 +74,11 @@ if (require.main === module) {
 
   runTests()
     .then(() => {
-      console.log("✅ F-0155 webhook timeout test suite completed successfully")
+      console.log("✅ webhook timeout test suite completed successfully")
       process.exit(0)
     })
     .catch((error) => {
-      console.error("❌ F-0155 webhook timeout test suite failed:", error)
+      console.error("❌ webhook timeout test suite failed:", error)
       process.exit(1)
     })
 }

package/src/tests/api_tests/webhook_error_handling.test.ts

@@ -133,7 +133,7 @@ export const webhook_error_handling_tests = async ({ sdk, sdkNonAdmin } : { sdk:
 
     // Scenario 3 (timeout): skipped — WEBHOOK_TIMEOUT_MS is a constant (15s), not env-overridable,
     // and a 15s+ non-responding receiver would make this suite unacceptably slow.
-    // Covered by security/F-0155-webhook-timeout.test.ts via send_automation_webhook.
+    // Covered by security/webhook-timeout.test.ts via send_automation_webhook.
 
     // Scenario 4: success path unchanged — 200 logged, counter untouched
     await sdk.api.webhooks.update({ url: `${receiverBase}/success` })