@tellescope/sdk 1.256.14 → 1.256.16

package/src/tests/tests.ts

@@ -112,33 +112,34 @@ import { nutrition_tracking_tests } from "./api_tests/nutrition_tracking.test";
 import { no_access_permission_checks_tests } from "./api_tests/no_access_permission_checks.test";
 import { resource_access_tags_tests } from "./api_tests/resource_access_tags.test";
 import { field_redaction_tests } from "./api_tests/field_redaction.test";
-import { data_sync_redaction_bypass_tests } from "./api_tests/security/F-0001-data-sync-redaction-bypass.test";
-import { enduser_write_restrictions_tests } from "./api_tests/security/F-0106-F-0110-enduser-write-restrictions.test";
-import { ai_conversations_rbac_tests } from "./api_tests/security/F-0005-ai-conversations-rbac.test";
-import { develop_health_benefit_verification_rbac_tests } from "./api_tests/security/F-0006-develop-health-benefit-verification-rbac.test";
-import { cascade_role_rename_cross_tenant_tests } from "./api_tests/security/F-0053-cascade-role-rename-cross-tenant.test";
-import { self_admin_role_assignment_tests } from "./api_tests/security/F-0076-self-admin-role-assignment.test";
-import { invite_user_enumeration_tests } from "./api_tests/security/F-0007-invite-user-enumeration.test";
+import { data_sync_redaction_bypass_tests } from "./api_tests/security/data-sync-redaction-bypass.test";
+import { enduser_write_restrictions_tests } from "./api_tests/security/enduser-write-restrictions.test";
+import { ai_conversations_rbac_tests } from "./api_tests/security/ai-conversations-rbac.test";
+import { develop_health_benefit_verification_rbac_tests } from "./api_tests/security/develop-health-benefit-verification-rbac.test";
+import { cascade_role_rename_cross_tenant_tests } from "./api_tests/security/cascade-role-rename-cross-tenant.test";
+import { self_admin_role_assignment_tests } from "./api_tests/security/self-admin-role-assignment.test";
+import { invite_user_enumeration_tests } from "./api_tests/security/invite-user-enumeration.test";
 import { register_business_id_injection_tests } from "./api_tests/security/register_business_id_injection.test";
-import { handle_incoming_communication_cross_tenant_tests } from "./api_tests/security/F-0008-handle-incoming-communication-cross-tenant.test";
-import { sanitize_user_html_xss_tests } from "./api_tests/security/F-0013-sanitize-user-html.test";
-import { sanitize_user_html_with_iframes_tests } from "./api_tests/security/F-0013-sanitize-user-html-with-iframes.test";
-import { prototype_pollution_tests } from "./api_tests/security/F-0016-prototype-pollution.test";
-import { enduser_cross_create_tests } from "./api_tests/security/F-0116-F-0119-enduser-cross-create.test";
-import { globalunique_leak_tests } from "./api_tests/security/F-0145-globalunique-leak.test";
-import { load_inbox_redaction_tests } from "./api_tests/security/F-0151-load-inbox-redaction.test";
+import { handle_incoming_communication_cross_tenant_tests } from "./api_tests/security/handle-incoming-communication-cross-tenant.test";
+import { sanitize_user_html_xss_tests } from "./api_tests/security/sanitize-user-html.test";
+import { sanitize_user_html_with_iframes_tests } from "./api_tests/security/sanitize-user-html-with-iframes.test";
+import { prototype_pollution_tests } from "./api_tests/security/prototype-pollution.test";
+import { enduser_cross_create_tests } from "./api_tests/security/enduser-cross-create.test";
+import { globalunique_leak_tests } from "./api_tests/security/globalunique-conflict-redaction.test";
+import { load_inbox_redaction_tests } from "./api_tests/security/load-inbox-redaction.test";
 import { suggested_reply_redaction_tests } from "./api_tests/security/suggested-reply-redaction.test";
-import { webhook_timeout_tests } from "./api_tests/security/F-0155-webhook-timeout.test";
+import { webhook_timeout_tests } from "./api_tests/security/webhook-timeout.test";
 import { enduser_ai_summary_trust_gate_tests } from "./api_tests/security/enduser-ai-summary-trust-gate.test";
-import { allowed_paths_confinement_tests } from "./api_tests/security/F-0166-allowed-paths-wildcard-bypass.test";
-import { proxy_image_ssrf_tests } from "./api_tests/security/F-0025-proxy-image-unauth-ssrf.test";
-import { webhook_outbound_ssrf_tests } from "./api_tests/security/F-0015-webhook-outbound-ssrf.test";
+import { allowed_paths_confinement_tests } from "./api_tests/security/allowed-paths-confinement.test";
+import { proxy_image_ssrf_tests } from "./api_tests/security/proxy-image-unauth-ssrf.test";
+import { webhook_outbound_ssrf_tests } from "./api_tests/security/webhook-outbound-ssrf.test";
 import { public_endpoint_auth_field_lock_tests } from "./api_tests/security/public_endpoint_auth_field_lock.test";
 import { formsort_webhook_auth_field_lock_tests } from "./api_tests/security/formsort_webhook_auth_field_lock.test";
-import { booking_info_idor_tests } from "./api_tests/security/F-0179-booking-info-idor-token-mint.test";
-import { automated_actions_process_gate_tests } from "./api_tests/security/F-0192-automated-actions-process-gate.test";
-import { schema_adminonly_enforcement_tests } from "./api_tests/security/F-0191-schema-adminonly-enforcement.test";
-import { startlinktoken_escalation_tests } from "./api_tests/security/F-0185-startlinktoken-enduser-staff-escalation.test";
+import { booking_info_idor_tests } from "./api_tests/security/booking-info-idor-token-mint.test";
+import { automated_actions_process_gate_tests } from "./api_tests/security/automated-actions-process-gate.test";
+import { schema_adminonly_enforcement_tests } from "./api_tests/security/schema-adminonly-enforcement.test";
+import { startlinktoken_escalation_tests } from "./api_tests/security/startlinktoken-enduser-staff-escalation.test";
+import { form_logic_js_execution_checks } from "./api_tests/security/form-logic-js-execution.test";
 import { bulk_assignment_tests } from "./api_tests/bulk_assignment.test";
 import { tickets_bulk_assign_care_team_tests } from "./api_tests/tickets_bulk_assign_care_team.test";
 import { managed_content_enduser_access_tests } from "./api_tests/managed_content_enduser_access.test";
@@ -159,8 +160,10 @@ import { phone_validation_unit_tests } from "./unit_tests/phone_validation.test"
 import { openapi_spec_freshness_unit_tests } from "./unit_tests/openapi_spec_freshness.test";
 import { do_not_send_address_unit_tests } from "./unit_tests/do_not_send_address.test";
 import { organization_signup_checks } from "./api_tests/organization_signup.test";
-import { add_to_journey_foreign_enduserid_checks } from "./api_tests/security/F-0196-add-to-journey-foreign-enduserid.test";
+import { add_to_journey_foreign_enduserid_checks } from "./api_tests/security/add-to-journey-foreign-enduserid.test";
 import { tickets_bulk_assign_from_queue_checks } from "./api_tests/tickets_bulk_assign_from_queue.test";
+import { enduser_observations_auto_review_checks } from "./api_tests/enduser_observations_auto_review.test";
+import { file_link_session_confinement_checks } from "./api_tests/security/file-link-session-confinement.test";
 import { run_isolated_in_parallel } from "./setup_isolated";
 import { elation_user_id_tests } from "./api_tests/elation_user_id.test";
 import { organization_settings_duplicates_tests } from "./api_tests/organization_settings_duplicates.test";
@@ -10903,6 +10906,19 @@ export const form_conditional_logic_tests = async () => {
   run_conditional_form_test({ $and: [{ condition: { [FORM_LOGIC_CALCULATED_FIELDS[0]]: { $exists: true } } }] }, true)
   run_conditional_form_test({ $and: [{ condition: { [FORM_LOGIC_CALCULATED_FIELDS[0]]: { $gt: 25 } } }] }, true)
   run_conditional_form_test({ $and: [{ condition: { [FORM_LOGIC_CALCULATED_FIELDS[0]]: { $lt: 25 } } }] }, false)
+
+  // A $JS(...) condition value was previously compiled and executed with new Function().
+  // These must evaluate to false (parseInt -> NaN -> no match), and must never be executed.
+  // The values are typed `number` on BasicFilter but are strings in stored data, hence the casts.
+  delete (globalThis as any).__F0200
+  run_conditional_form_test({ $and: [{ condition: { '3': { $gt: '$JS(return 0)' as any } } }] }, false, '$gt $JS not evaluated')
+  run_conditional_form_test({ $and: [{ condition: { '3': { $lt: '$JS(return 99999)' as any } } }] }, false, '$lt $JS not evaluated')
+  run_conditional_form_test({ $and: [{ condition: { '3': { $gt: '$JS(globalThis.__F0200 = 1; return 0)' as any } } }] }, false, '$JS side effect not evaluated')
+  assert(
+    (globalThis as any).__F0200 === undefined,
+    'a $JS(...) condition value was executed',
+    '$JS payload never executed',
+  )
 }
 
 export const enduser_conditional_logic_tests = async () => {
@@ -15386,8 +15402,11 @@ const ip_address_form_tests = async () => {
     // process.exit, which would otherwise strand the other suite's tenants.
     await run_isolated_in_parallel([
       { name: 'Organization signup', run: organization_signup_checks },
-      { name: 'F-0196 add_to_journey foreign enduserId', run: add_to_journey_foreign_enduserid_checks },
+      { name: 'add_to_journey foreign enduserId', run: add_to_journey_foreign_enduserid_checks },
       { name: 'Tickets bulk assign from queue', run: tickets_bulk_assign_from_queue_checks },
+      { name: 'Vital auto-review on create', run: enduser_observations_auto_review_checks },
+      { name: '$JS in stored conditional logic', run: form_logic_js_execution_checks },
+      { name: 'Shared file link session confinement', run: file_link_session_confinement_checks },
     ])
     await embeddables_auth_token_tests({ sdk, sdkNonAdmin })
     await proxy_image_ssrf_tests({ sdk, sdkNonAdmin })

package/src/tests/unit_tests/openapi_spec_freshness.test.ts

@@ -17,7 +17,7 @@ import {
  * .npmignore covers only set_vars.sh), but nothing in the build or CI regenerates it. It had
  * therefore drifted several commits behind schema.ts — which mattered because `adminOnly` is
  * rendered into the spec as an "**Admin only.**" description prefix, so the published docs were
- * advertising gates that had changed. That drift is the doc half of F-0191; the runtime half was
+ * advertising gates that had changed. That drift is the documentation half of the problem; the runtime half was
  * fixed by making getCustomEndpointFields fall back to the schema flag.
  *
  * The generator is byte-deterministic (date `getExample`s are pinned in validation.ts precisely so

package/src/tests/api_tests/security/readonly-enduser-preview.test.ts

@@ -1,301 +0,0 @@
-require('source-map-support').install();
-
-import axios from "axios"
-
-import { Session, EnduserSession } from "../../../sdk"
-import {
-  assert,
-  log_header,
-} from "@tellescope/testing"
-import { PROVIDER_PERMISSIONS, NO_ACCESS } from "@tellescope/constants"
-import { setup_tests } from "../../setup"
-
-const host = process.env.API_URL || 'http://localhost:8080' as const
-
-const RAND = () => Math.random().toString(36).slice(2, 10)
-
-const ALL = 'All' as const
-const READ_ONLY = { create: NO_ACCESS, read: ALL, update: NO_ACCESS, delete: NO_ACCESS }
-const FULL_ACCESS = { create: ALL, read: ALL, update: ALL, delete: ALL }
-const ASSIGNED_UPDATE = { create: NO_ACCESS, read: ALL, update: 'Assigned' as const, delete: NO_ACCESS }
-
-const PORTAL_PREVIEW_SCOPE = 'portal-preview'
-
-type ProbeMethod = 'get' | 'post' | 'patch' | 'put' | 'delete'
-
-// A single collected check. Everything is gathered first and asserted at the end, because the
-// testing harness exits the process on the first failed assert — collecting first means a RED run
-// prints the full evidence table before the first vulnerability assert trips the exit.
-type Check = {
-  label: string,
-  pass: boolean,
-  detail: string,
-}
-
-/**
- * Regression test for F-0138
- * (security-audit/findings/F-0138-endusers-generate-auth-token-no-admin-gate.md).
- *
- * `endusers.generate_auth_token` (the "View portal as patient" preview flow) requires only
- * `endusers.read`, yet mints a FULLY-PRIVILEGED enduser session. A staff user who cannot update a
- * patient can therefore act AS that patient: edit the record, submit forms, send chats, book
- * appointments, even set the portal password.
- *
- * The fix mints the preview token with `sessionScopes: ['portal-preview']` whenever the calling
- * staff user lacks update access to that specific enduser (record-level, honoring `Assigned`
- * scoping). The scope's allowlist (api/modules/session_scopes.ts) grants exactly the portal's read
- * surface plus session maintenance; every write path 403s via existing path confinement.
- *
- * RED (pre-fix): section A fails — the response carries no sessionScopes and every write in A2
- * SUCCEEDS. Sections D/E (controls) pass pre-fix. GREEN (post-fix): all sections pass.
- *
- * Probes use raw axios rather than the SDK: parseError (sdk/src/session.ts) discards the status
- * code, and a path-confinement denial (403 "Inaccessible") is byte-identical in message to a
- * permissions denial. Write/blocked-read probes additionally confirm an UNCONFINED enduser token
- * gets a non-403 on the same path in the same run, so a 403 can only be confinement, never bad
- * permissions or a bad body.
- */
-export const readonly_enduser_preview_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("F-0138: portal-preview scope for read-only staff generate_auth_token")
-
-  const checks: Check[] = []
-  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
-
-  const request = async (token: string, method: ProbeMethod, path: string, data?: any) => {
-    const r = await axios.request({
-      method,
-      url: `${host}/v1${path}`,
-      ...method === 'get' ? { params: data } : { data },
-      headers: { Authorization: `Bearer ${token}` },
-      validateStatus: () => true,
-    })
-    return { status: r.status, body: r.data }
-  }
-
-  const isPathDenial = (r: { status: number, body: any }) => (
-    r.status === 403 && r.body?.message === 'Inaccessible'
-  )
-
-  // The confined token must be denied `path` by confinement, while an unconfined baseline is not.
-  const expectDenied = async (
-    label: string, confinedToken: string, baselineToken: string,
-    method: ProbeMethod, path: string, data?: any,
-  ) => {
-    const baseline = await request(baselineToken, method, path, data)
-    const confined = await request(confinedToken, method, path, data)
-    const badProbe = baseline.status === 403
-    record(
-      label,
-      !badProbe && isPathDenial(confined),
-      `${method}:${path} confined=${confined.status} baseline=${baseline.status}` + (badProbe ? ' BAD PROBE: baseline also 403' : ''),
-    )
-  }
-
-  // The path must not be blocked by confinement (neither 403 nor 401).
-  const expectAllowed = async (
-    label: string, token: string, method: ProbeMethod, path: string, data?: any,
-  ) => {
-    const r = await request(token, method, path, data)
-    record(label, r.status !== 403 && r.status !== 401, `${method}:${path} status=${r.status}`)
-  }
-
-  const hasScope = (enduser: any) => !!enduser?.sessionScopes?.includes?.(PORTAL_PREVIEW_SCOPE)
-
-  const readonlyRole = `f0138-readonly-${RAND()}`
-  const fullUpdateRole = `f0138-full-${RAND()}`
-  const assignedUpdateRole = `f0138-assigned-${RAND()}`
-  const roleIds: string[] = []
-  const userIds: string[] = []
-  const enduserIds: string[] = []
-
-  try {
-    /* ================= fixtures ================= */
-
-    for (const [role, endusersPerm] of [
-      [readonlyRole, READ_ONLY],
-      [fullUpdateRole, FULL_ACCESS],
-      [assignedUpdateRole, ASSIGNED_UPDATE],
-    ] as const) {
-      const rbap = await sdk.api.role_based_access_permissions.createOne({
-        role,
-        permissions: { ...PROVIDER_PERMISSIONS, endusers: endusersPerm },
-      } as any)
-      roleIds.push(rbap.id)
-    }
-
-    // Throwaway staff users. verifiedEmail must be set at create (rejected on update).
-    const mkUser = async (role: string) => {
-      const u = await sdk.api.users.createOne({
-        email: `f0138-${role}-${RAND()}@tellescope.example`,
-        fname: 'F0138', lname: 'Staff',
-        verifiedEmail: true,
-        notificationEmailsDisabled: true,
-        roles: [role],
-      } as any)
-      userIds.push(u.id)
-      return u
-    }
-    const readonlyUser = await mkUser(readonlyRole)
-    const fullUpdateUser = await mkUser(fullUpdateRole)
-    const assignedUpdateUser = await mkUser(assignedUpdateRole)
-
-    // Staff sessions from admin-minted tokens (avoids the password / login-rate-limit dance).
-    const staffSession = async (userId: string) => {
-      const { authToken } = await sdk.api.users.generate_auth_token({ id: userId })
-      return new Session({ host, authToken })
-    }
-    const readonlyStaff = await staffSession(readonlyUser.id)
-    const fullUpdateStaff = await staffSession(fullUpdateUser.id)
-    const assignedUpdateStaff = await staffSession(assignedUpdateUser.id)
-
-    // Endusers: unassigned patient, a bystander, and one assigned to the assigned-update user.
-    const enduser = await sdk.api.endusers.createOne({
-      email: `f0138-patient-${RAND()}@tellescope.example`, fname: 'F0138', lname: 'Patient',
-    })
-    enduserIds.push(enduser.id)
-    const assignedEnduser = await sdk.api.endusers.createOne({
-      email: `f0138-assigned-${RAND()}@tellescope.example`, fname: 'F0138', lname: 'Assigned',
-      assignedTo: [assignedUpdateUser.id],
-    } as any)
-    enduserIds.push(assignedEnduser.id)
-
-    // A form_response the patient owns, for the submit-form-response write probe.
-    const form = await sdk.api.forms.createOne({ title: `F-0138 preview form ${RAND()}` })
-    const { response: formResponse } = await sdk.api.form_responses.prepare_form_response({
-      formId: form.id, enduserId: enduser.id,
-    })
-
-    /* ===== A1: read-only staff mints a scoped preview token ===== */
-
-    const previewMint = await readonlyStaff.api.endusers.generate_auth_token({ id: enduser.id })
-    const previewToken = previewMint.authToken
-    record('A1: read-only staff receives an authToken', !!previewToken, `authToken present=${!!previewToken}`)
-    record(
-      'A1: read-only staff mint is scoped to portal-preview',
-      hasScope(previewMint.enduser),
-      `sessionScopes=${JSON.stringify((previewMint.enduser as any)?.sessionScopes)} (F-0138 vuln if absent)`,
-    )
-    record(
-      'A1(E): scoped preview token carries denySocket',
-      (previewMint.enduser as any)?.denySocket === true,
-      `denySocket=${(previewMint.enduser as any)?.denySocket}`,
-    )
-
-    // Unconfined enduser baseline (admin-minted) — proves the scoped token's 403s are confinement.
-    const { authToken: baselineEnduserToken } = await sdk.api.endusers.generate_auth_token({ id: enduser.id })
-
-    /* ===== A2: writes blocked for the scoped session ===== */
-
-    await expectDenied('A2: cannot self-update the patient record', previewToken, baselineEnduserToken,
-      'patch', `/enduser/${enduser.id}`, { updates: { fname: 'Hacked' } })
-    await expectDenied('A2: cannot set the patient portal password', previewToken, baselineEnduserToken,
-      'post', '/set-enduser-password', { id: enduser.id, password: `F0138Pw!${RAND()}` })
-    await expectDenied('A2: cannot send a chat as the patient', previewToken, baselineEnduserToken,
-      'post', '/chat', { message: 'hi from preview' })
-    await expectDenied('A2: cannot submit a form as the patient', previewToken, baselineEnduserToken,
-      'patch', '/submit-form-response', { id: formResponse.id, responses: [] })
-    await expectDenied('A2: cannot book an appointment as the patient', previewToken, baselineEnduserToken,
-      'post', '/book-appointment', {})
-    await expectDenied('A2: cannot start a file upload as the patient', previewToken, baselineEnduserToken,
-      'post', '/prepare-file-upload', { name: 'x.pdf', type: 'application/pdf', enduserId: enduser.id })
-
-    /* ===== B: no laundering via refresh ===== */
-
-    const refreshed = await request(previewToken, 'post', '/refresh-enduser-session', {})
-    const refreshedToken = refreshed.body?.authToken as string | undefined
-    record('B: refresh succeeds', refreshed.status === 200 && !!refreshedToken, `status=${refreshed.status} token=${!!refreshedToken}`)
-    record(
-      'B: refreshed session still carries portal-preview scope',
-      hasScope(refreshed.body?.enduser),
-      `sessionScopes=${JSON.stringify(refreshed.body?.enduser?.sessionScopes)} (laundering if absent)`,
-    )
-    if (refreshedToken) {
-      await expectDenied('B: refreshed token still cannot write', refreshedToken, baselineEnduserToken,
-        'patch', `/enduser/${enduser.id}`, { updates: { fname: 'HackedAfterRefresh' } })
-    }
-    await expectAllowed('B: logout allowed', previewToken, 'post', '/logout-enduser')
-
-    /* ===== C: ungranted mutating "reads" blocked ===== */
-
-    // Re-mint (the previous token was just logged out).
-    const cMint = await readonlyStaff.api.endusers.generate_auth_token({ id: enduser.id })
-    const cToken = cMint.authToken
-    await expectDenied('C: proxy_read blocked', cToken, baselineEnduserToken,
-      'get', '/integrations/proxy-read', { integration: 'Stripe', type: 'subscriptions' })
-    await expectDenied('C: booking_info (mints a token) blocked', cToken, baselineEnduserToken,
-      'get', '/form-fields/booking-info', { bookingPageId: 'x' })
-    await expectDenied('C: form_responses stripe_details blocked', cToken, baselineEnduserToken,
-      'get', '/form-responses/stripe-details', {})
-    await expectDenied('C: products stripe-portal-session blocked', cToken, baselineEnduserToken,
-      'get', '/products/stripe-portal-session', {})
-
-    /* ===== D: granted portal reads still work ===== */
-
-    await expectAllowed('D: portal-customizations', cToken, 'get', '/portal-customizations')
-    await expectAllowed('D: calendar-events', cToken, 'get', '/calendar-events')
-    await expectAllowed('D: my-meetings', cToken, 'get', '/my-meetings')
-    await expectAllowed('D: chat-rooms', cToken, 'get', '/chat-rooms')
-    await expectAllowed('D: care-plans', cToken, 'get', '/care-plans')
-    await expectAllowed('D: form-responses', cToken, 'get', '/form-responses')
-    await expectAllowed('D: self enduser read', cToken, 'get', `/enduser/${enduser.id}`)
-    await expectAllowed('D: file-download-URL', cToken, 'get', '/file-download-URL', { secureName: 'nonexistent' })
-    await expectAllowed('D: enduser-session-info', cToken, 'get', '/enduser-session-info')
-
-    /* ===== E: zero behavior change controls ===== */
-
-    const adminMint = await sdk.api.endusers.generate_auth_token({ id: enduser.id })
-    record('E: admin-minted token is NOT scoped', !hasScope(adminMint.enduser),
-      `sessionScopes=${JSON.stringify((adminMint.enduser as any)?.sessionScopes)}`)
-    await expectAllowed('E: admin-minted token can write', adminMint.authToken, 'patch',
-      `/enduser/${enduser.id}`, { updates: { fname: 'AdminEditOk' } })
-
-    const fullMint = await fullUpdateStaff.api.endusers.generate_auth_token({ id: enduser.id })
-    record('E: update:All staff mints an UNSCOPED token', !hasScope(fullMint.enduser),
-      `sessionScopes=${JSON.stringify((fullMint.enduser as any)?.sessionScopes)}`)
-
-    const assignedMint = await assignedUpdateStaff.api.endusers.generate_auth_token({ id: assignedEnduser.id })
-    record('E: assigned-update staff UNSCOPED for an assigned patient', !hasScope(assignedMint.enduser),
-      `sessionScopes=${JSON.stringify((assignedMint.enduser as any)?.sessionScopes)}`)
-
-    const assignedMintUnassigned = await assignedUpdateStaff.api.endusers.generate_auth_token({ id: enduser.id })
-    record('E: assigned-update staff SCOPED for an unassigned patient', hasScope(assignedMintUnassigned.enduser),
-      `sessionScopes=${JSON.stringify((assignedMintUnassigned.enduser as any)?.sessionScopes)}`)
-
-    /* ===== report: print full table first, then assert (harness exits on first failure) ===== */
-    console.log('\n  F-0138 check summary:')
-    for (const c of checks) {
-      console.log(`    ${c.pass ? 'PASS' : 'FAIL'}  ${c.label}  —  ${c.detail}`)
-    }
-    console.log('')
-
-    for (const c of checks) {
-      assert(c.pass, `${c.label} — ${c.detail}`, c.label)
-    }
-  } finally {
-    for (const id of enduserIds) { try { await sdk.api.endusers.deleteOne(id) } catch {} }
-    for (const id of userIds) { try { await sdk.api.users.deleteOne(id) } catch {} }
-    for (const id of roleIds) { try { await sdk.api.role_based_access_permissions.deleteOne(id) } catch {} }
-  }
-}
-
-// Allow running this test file independently
-if (require.main === module) {
-  console.log(`🌐 Using API URL: ${host}`)
-  const sdk = new Session({ host })
-  const sdkNonAdmin = new Session({ host })
-
-  const runTests = async () => {
-    await setup_tests(sdk, sdkNonAdmin)
-    await readonly_enduser_preview_tests({ sdk, sdkNonAdmin })
-  }
-
-  runTests()
-    .then(() => {
-      console.log("✅ F-0138 portal-preview scope test suite completed successfully")
-      process.exit(0)
-    })
-    .catch((error) => {
-      console.error("❌ F-0138 portal-preview scope test suite failed:", error)
-      process.exit(1)
-    })
-}