@tellescope/sdk 1.256.14 → 1.256.16

package/lib/cjs/tests/api_tests/security/allowed-paths-confinement.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowed-paths-confinement.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/allowed-paths-confinement.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,gDAAyB;AAEzB,oCAAsD;AACtD,+CAG4B;AAC5B,qCAAyC;AAEzC,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,IAAM,IAAI,GAAG,cAAM,OAAA,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAvC,CAAuC,CAAA;AAC1D,IAAM,SAAS,GAAG,0BAA0B,CAAA;AAerC,IAAM,+BAA+B,GAAG,UAAO,EAAgD;QAA9C,GAAG,SAAA;;;;;;;;oBACzD,IAAA,oBAAU,EAAC,yDAAyD,CAAC,CAAA;oBAE/D,MAAM,GAAY,EAAE,CAAA;oBAIpB,OAAO,GAAG,UAAO,KAAa,EAAE,MAAmB,EAAE,IAAY,EAAE,IAAU;;;;wCACvE,qBAAM,eAAK,CAAC,OAAO,qBAC3B,MAAM,QAAA,EACN,GAAG,EAAE,UAAG,IAAI,gBAAM,IAAI,CAAE,IACrB,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,MAAA,EAAE,KACjD,OAAO,EAAE,EAAE,aAAa,EAAE,iBAAU,KAAK,CAAE,EAAE,EAC7C,cAAc,EAAE,cAAM,OAAA,IAAI,EAAJ,CAAI,IAC1B,EAAA;;oCANI,CAAC,GAAG,SAMR;oCACF,sBAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAA;;;yBAC1C,CAAA;oBAEK,YAAY,GAAG,UAAC,CAAgC;;wBAAK,OAAA,CACzD,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAA,MAAA,CAAC,CAAC,IAAI,0CAAE,OAAO,MAAK,cAAc,CACvD,CAAA;qBAAA,CAAA;oBASK,YAAY,GAAG,UACnB,QAAgB,EAAE,KAAa,EAAE,aAAqB,EAAE,aAAqB,EAC7E,MAAmB,EAAE,IAAY,EAAE,IAAU;;;;wCAE5B,qBAAM,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,EAAA;;oCAA3D,QAAQ,GAAG,SAAgD;oCAChD,qBAAM,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,EAAA;;oCAA3D,QAAQ,GAAG,SAAgD;oCAEjE,MAAM,CAAC,IAAI,CAAC;wCACV,QAAQ,UAAA;wCACR,KAAK,OAAA;wCACL,IAAI,MAAA;wCACJ,QAAQ,EAAE,QAAQ;wCAClB,MAAM,EAAE,QAAQ,CAAC,MAAM;wCACvB,cAAc,EAAE,QAAQ,CAAC,MAAM;wCAC/B,IAAI,EAAE,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,QAAQ,CAAC;wCACvD,IAAI,EAAE,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC,SAAS;qCACvF,CAAC,CAAA;;;;yBACH,CAAA;oBAUK,aAAa,GAAG,UACpB,QAAgB,EAAE,KAAa,EAAE,KAAa,EAC9C,MAAmB,EAAE,IAAY,EAAE,IAAU,EAC7C,EAAiD;4BAAjD,qBAA+C,EAAE,KAAA,EAA/C,gBAAgB,EAAhB,QAAQ,mBAAG,KAAK,KAAA;;;;;4CAER,qBAAM,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,EAAA;;wCAA5C,CAAC,GAAG,SAAwC;wCAClD,MAAM,CAAC,IAAI,CAAC;4CACV,QAAQ,UAAA;4CACR,KAAK,OAAA;4CACL,IAAI,MAAA;4CACJ,QAAQ,EAAE,SAAS;4CACnB,MAAM,EAAE,CAAC,CAAC,MAAM;4CAChB,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC;4CACxD,IAAI,EAAE,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,sDAAsD,CAAC,CAAC,CAAC,SAAS;yCACxG,CAAC,CAAA;;;;;qBACH,CAAA;oBASK,QAAQ,GAAa,EAAE,CAAA;;;;oBAKrB,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAA;oBAG7B,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;4BACzC,KAAK,EAAE,2BAAoB,IAAI,EAAE,CAAE;4BACnC,cAAc,EAAE,IAAI;yBACrB,CAAC,EAAA;;oBAHI,IAAI,GAAG,UAGX;oBACF,MAAM,GAAG,IAAI,CAAC,EAAE,CAAA;oBAChB,qBAAM,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC;4BAClC,MAAM,EAAE,IAAI,CAAC,EAAE;4BACf,KAAK,EAAE,GAAG;4BACV,IAAI,EAAE,QAAQ;4BACd,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;yBAC7C,CAAC,EAAA;;oBALF,UAKE,CAAA;oBACF,gBAAgB,GAAG,qBAAc,IAAI,EAAE,wBAAqB,CAAA;oBAClC,qBAAM,IAAI,oBAAc,CAAC,EAAE,IAAI,MAAA,EAAE,UAAU,YAAA,EAAE,CAAC;6BACrE,GAAG,CAAC,cAAc,CAAC,uBAAuB,CAAC;4BAC1C,UAAU,YAAA;4BACV,MAAM,EAAE,IAAI,CAAC,EAAE;4BACf,KAAK,EAAE,gBAAgB;4BACvB,KAAK,EAAE,MAAM;4BACb,KAAK,EAAE,aAAa;4BACpB,SAAS,EAAE,IAAI,EAAE,0CAA0C;yBAC5D,CAAC,EAAA;;oBARE,iBAAiB,GAAG,UAQtB;oBAEY,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;4BAC/C,KAAK,EAAE,kBAAW,IAAI,EAAE,CAAE;4BAC1B,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE;4BACtC,SAAS,EAAE,QAAQ;yBACb,CAAC,EAAA;;oBAJH,OAAO,GAAG,UAIP;oBACT,SAAS,GAAG,OAAO,CAAC,EAAE,CAAA;oBAGF,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;4BACnD,KAAK,EAAE,qBAAc,IAAI,EAAE,wBAAqB;yBACjD,CAAC,EAAA;;oBAFI,WAAW,GAAG,UAElB;oBACF,aAAa,GAAG,WAAW,CAAC,EAAE,CAAA;oBAExB,aAAa,GAAG,qBAAc,IAAI,EAAE,SAAG,IAAI,EAAE,CAAE,CAAA;oBACnC,qBAAM,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC;4BACxD,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAQ;4BAC1E,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,aAAa,eAAA,EAAE,CAAC;yBAC7D,CAAC,EAAA;;oBAHH,SAAS,GAAG,UAGT;oBACT,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;oBAEJ,qBAAM,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC;4BAC7D,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAQ;4BAC/E,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC;yBAC9C,CAAC,EAAA;;oBAHH,cAAc,GAAG,UAGd;oBACT,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAA;oBAEZ,qBAAM,IAAI,oBAAc,CAAC,EAAE,IAAI,MAAA,EAAE,UAAU,YAAA,EAAE,CAAC;6BAC/D,GAAG,CAAC,eAAe,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;wBAEtE,kEAAkE;wBAClE,sFAAsF;sBAHhB;;oBADhE,WAAW,GAAG,UACkD;oBAIrD,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;4BAC7C,KAAK,EAAE,qBAAc,IAAI,EAAE,wBAAqB;4BAChD,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;4BAC5B,aAAa,EAAE,IAAI;4BACnB,0BAA0B,EAAE,IAAI;yBAC1B,CAAC,EAAA;;oBALH,QAAQ,GAAG,UAKR;oBACT,UAAU,GAAG,QAAQ,CAAC,EAAE,CAAA;oBAElB,cAAc,GAAG,sBAAe,IAAI,EAAE,SAAG,IAAI,EAAE,CAAE,CAAA;oBACpC,qBAAM,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC;4BACzD,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAQ;4BAC3E,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC;4BACvF,cAAc,gBAAA;yBACR,CAAC,EAAA;;oBAJH,UAAU,GAAG,UAIV;oBACT,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;oBAEP,qBAAM,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,sBAAsB,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;wBAEpG,0FAA0F;sBAFU;;oBAA9F,YAAY,GAAG,UAA+E;oBAGxD,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,EAAA;;oBAA3F,oBAAoB,GAAK,CAAA,UAAkE,CAAA,UAAvE;oBACE,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;wBAErG,iGAAiG;sBAFI;;oBAAlF,iBAAiB,GAAK,CAAA,UAA4D,CAAA,UAAjE;oBAI9B,EAAE,GAAG,gBAAgB,CAAA;oBAC3B,qBAAM,aAAa,CAAC,EAAE,EAAE,qBAAqB,EAAE,iBAAiB,CAAC,SAAS,EAAE,KAAK,EAAE,qBAAqB,CAAC,EAAA;;oBAAzG,UAAyG,CAAA;oBACzG,qBAAM,aAAa,CAAC,EAAE,EAAE,mCAAmC,EAAE,iBAAiB,CAAC,SAAS,EAAE,KAAK,EAAE,4BAA4B,EAAE,EAAE,UAAU,EAAE,iBAAiB,CAAC,UAAU,EAAE,CAAC,EAAA;;oBAA5K,UAA4K,CAAA;oBAC5K,qBAAM,aAAa,CAAC,EAAE,EAAE,iCAAiC,EAAE,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,0BAA0B,CAAC,EAAA;;oBAA3H,UAA2H,CAAA;oBAC3H,qBAAM,aAAa,CAAC,EAAE,EAAE,uBAAuB,EAAE,iBAAiB,CAAC,SAAS,EAAE,KAAK,EAAE,mBAAY,SAAS,CAAE,CAAC,EAAA;;oBAA7G,UAA6G,CAAA;oBAE7G,qBAAM,YAAY,CAAC,EAAE,EAAE,2BAA2B,EAAE,iBAAiB,CAAC,SAAS,EAAE,oBAAoB,EAAE,KAAK,EAAE,kBAAkB,CAAC,EAAA;;oBAAjI,UAAiI,CAAA;oBACjI,qBAAM,YAAY,CAAC,EAAE,EAAE,0BAA0B,EAAE,iBAAiB,CAAC,SAAS,EAAE,oBAAoB,EAAE,KAAK,EAAE,iBAAiB,CAAC,EAAA;;oBAA/H,UAA+H,CAAA;oBAC/H,qBAAM,YAAY,CAAC,EAAE,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,SAAS,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,CAAC;wBAE7G,gGAAgG;wBAChG,8FAA8F;sBAHe;;oBAA7G,UAA6G,CAAA;oBAE7G,gGAAgG;oBAChG,8FAA8F;oBAC9F,qBAAM,YAAY,CAAC,EAAE,EAAE,uDAAuD,EAAE,iBAAiB,CAAC,SAAS,EAAE,oBAAoB,EAAE,KAAK,EAAE,WAAW,CAAC;wBAEtJ;;;;;2BAKG;sBAPmJ;;oBAFtJ,gGAAgG;oBAChG,8FAA8F;oBAC9F,UAAsJ,CAAA;oBAQhJ,aAAa,GAAG,iBAAiB,CAAC,SAAS,CAAA;oBAM3B,qBAAM,OAAO,CAAC,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAE,CAAC,EAAA;;oBAAlG,aAAa,GAAG,UAAkF;oBAClG,qBAAmB,MAAA,MAAA,aAAa,CAAC,IAAI,0CAAE,OAAO,mCAAI,EAAE,CAAA;oBAC1D,MAAM,CAAC,IAAI,CAAC;wBACV,QAAQ,EAAE,EAAE;wBACZ,KAAK,EAAE,8CAA8C;wBACrD,IAAI,EAAE,0BAA0B;wBAChC,QAAQ,EAAE,SAAS;wBACnB,MAAM,EAAE,kBAAgB,CAAC,EAAE,KAAK,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;wBACzD,IAAI,EAAE,kBAAgB,CAAC,EAAE,KAAK,aAAa;wBAC3C,IAAI,EAAE,aAAM,kBAAgB,CAAC,EAAE,CAAE;qBAClC,CAAC,CAAA;oBACI,QAAQ,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC;yBAC9F,MAAM,CAAC,UAAA,CAAC,IAAI,OAAA,kBAAgB,CAAC,CAAC,CAAC,KAAK,SAAS,EAAjC,CAAiC,CAAC,CAAA;oBACjD,MAAM,CAAC,IAAI,CAAC;wBACV,QAAQ,EAAE,EAAE;wBACZ,KAAK,EAAE,mDAAmD;wBAC1D,IAAI,EAAE,0BAA0B;wBAChC,QAAQ,EAAE,QAAQ;wBAClB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;wBACnC,IAAI,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;wBAC3B,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAW,QAAQ,MAAG,CAAC,CAAC,CAAC,gBAAS,MAAM,CAAC,IAAI,CAAC,kBAAgB,CAAC,MAAG;qBAC3F,CAAC,CAAA;oBAEF,qBAAM,aAAa,CACjB,EAAE,EAAE,4CAA4C,EAAE,iBAAiB,CAAC,SAAS,EAC7E,OAAO,EAAE,mBAAY,aAAa,CAAE,EACpC,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,EAAE,CAC1E;wBAED,mGAAmG;wBACnG,gGAAgG;wBAChG,gGAAgG;wBAChG,0EAA0E;sBALzE;;oBAJD,UAIC,CAAA;oBAMmB,qBAAM,OAAO,CAC/B,iBAAiB,CAAC,SAAS,EAAE,OAAO,EAAE,mBAAY,aAAa,CAAE,EACjE,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,EAAE,CACnC,EAAA;;oBAHK,WAAW,GAAG,UAGnB;oBACK,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAA,WAAW,CAAC,IAAI,mCAAI,EAAE,CAAC,CAAA;oBAChD,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,IAAI,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAlD,CAAkD,CAAC,CAAA;oBAC7F,MAAM,CAAC,IAAI,CAAC;wBACV,QAAQ,EAAE,EAAE;wBACZ,KAAK,EAAE,mEAAmE;wBAC1E,IAAI,EAAE,mBAAY,aAAa,CAAE;wBACjC,QAAQ,EAAE,SAAS;wBACnB,MAAM,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG;wBAC1D,IAAI,EAAE,WAAW,CAAC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;wBAC3D,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAW,UAAU,MAAG,CAAC,CAAC,CAAC,kBAAW,UAAU,MAAG;qBAC9E,CAAC,CAAA;oBAKI,uBAAuB,GAAoB;wBAC/C,CAAC,OAAO,EAAE,yBAAkB,IAAI,EAAE,wBAAqB,CAAC;wBACxD,CAAC,OAAO,EAAE,cAAc,CAAC;wBACzB,CAAC,UAAU,EAAE,cAAc,CAAC;wBAC5B,CAAC,aAAa,EAAE,YAAY,CAAC;wBAC7B,CAAC,OAAO,EAAE,kBAAkB,CAAC;qBAC9B,CAAA;0BACmD,EAAvB,mDAAuB;;;yBAAvB,CAAA,qCAAuB,CAAA;oBAAzC,kCAAc,EAAb,KAAK,QAAA,EAAE,KAAK,QAAA;oBACZ,qBAAM,OAAO,CACrB,iBAAiB,CAAC,SAAS,EAAE,OAAO,EAAE,mBAAY,aAAa,CAAE,EAAE,EAAE,OAAO,YAAI,GAAC,KAAK,IAAG,KAAK,KAAE,EAAE,CACnG,EAAA;;oBAFK,CAAC,GAAG,UAET;oBACD,MAAM,CAAC,IAAI,CAAC;wBACV,QAAQ,EAAE,EAAE;wBACZ,KAAK,EAAE,kDAA2C,KAAK,MAAG;wBAC1D,IAAI,EAAE,mBAAY,aAAa,CAAE;wBACjC,QAAQ,EAAE,QAAQ;wBAClB,MAAM,EAAE,CAAC,CAAC,MAAM;wBAChB,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,GAAG;wBACtB,IAAI,EAAE,4DAA4D;qBACnE,CAAC,CAAA;;;oBAZyB,IAAuB,CAAA;;yBAiBtC,qBAAM,OAAO,CACzB,iBAAiB,CAAC,SAAS,EAAE,OAAO,EAAE,mBAAY,aAAa,CAAE,EACjE,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,KAAK,EAAE,sBAAe,IAAI,EAAE,wBAAqB,EAAE,EAAE,CACtF,EAAA;;oBAHK,KAAK,GAAG,UAGb;oBACD,MAAM,CAAC,IAAI,CAAC;wBACV,QAAQ,EAAE,EAAE;wBACZ,KAAK,EAAE,kEAAkE;wBACzE,IAAI,EAAE,mBAAY,aAAa,CAAE;wBACjC,QAAQ,EAAE,QAAQ;wBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,IAAI,EAAE,KAAK,CAAC,MAAM,KAAK,GAAG;wBAC1B,IAAI,EAAE,sEAAsE;qBAC7E,CAAC,CAAA;oBAGkB,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,EAAA;;oBAA1D,WAAW,GAAG,UAA4C;oBAChE,MAAM,CAAC,IAAI,CAAC;wBACV,QAAQ,EAAE,EAAE;wBACZ,KAAK,EAAE,uDAAuD;wBAC9D,IAAI,EAAE,mBAAY,aAAa,CAAE;wBACjC,QAAQ,EAAE,QAAQ;wBAClB,MAAM,EAAE,WAAW,CAAC,KAAK,KAAK,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;wBAC1D,IAAI,EAAE,WAAW,CAAC,KAAK,KAAK,gBAAgB;wBAC5C,IAAI,EAAE,iBAAU,WAAW,CAAC,KAAK,CAAE;qBACpC,CAAC,CAAA;oBAII,EAAE,GAAG,wBAAwB,CAAA;oBACnC,qBAAM,YAAY,CAAC,EAAE,EAAE,0BAA0B,EAAE,WAAW,CAAC,SAAS,EAAE,oBAAoB,EAAE,KAAK,EAAE,iBAAiB,CAAC,EAAA;;oBAAzH,UAAyH,CAAA;oBACzH,qBAAM,YAAY,CAAC,EAAE,EAAE,iBAAiB,EAAE,WAAW,CAAC,SAAS,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAA;;oBAAvG,UAAuG,CAAA;oBACvG,qBAAM,YAAY,CAAC,EAAE,EAAE,iCAAiC,EAAE,WAAW,CAAC,SAAS,EAAE,oBAAoB,EAAE,KAAK,EAAE,wBAAwB,CAAC,EAAA;;oBAAvI,UAAuI,CAAA;oBACvI,qBAAM,YAAY,CAAC,EAAE,EAAE,oCAAoC,EAAE,WAAW,CAAC,SAAS,EAAE,oBAAoB,EAAE,KAAK,EAAE,0BAAmB,cAAc,CAAC,EAAE,CAAE,CAAC,EAAA;;oBAAxJ,UAAwJ,CAAA;oBAExJ,qBAAM,aAAa,CAAC,EAAE,EAAE,qBAAqB,EAAE,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,qBAAqB,CAAC,EAAA;;oBAAnG,UAAmG,CAAA;oBACnG,qBAAM,aAAa,CAAC,EAAE,EAAE,qBAAqB,EAAE,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,cAAc,CAAC;wBAC5F,4FAA4F;sBADA;;oBAA5F,UAA4F,CAAA;oBAC5F,4FAA4F;oBAC5F,qBAAM,aAAa,CAAC,EAAE,EAAE,uBAAuB,EAAE,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAA;;oBAD/H,4FAA4F;oBAC5F,UAA+H,CAAA;oBAC/H,qBAAM,aAAa,CAAC,EAAE,EAAE,eAAe,EAAE,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAA;;oBAAhF,UAAgF,CAAA;oBAChF,qBAAM,aAAa,CAAC,EAAE,EAAE,+BAA+B,EAAE,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,0BAAmB,SAAS,CAAC,EAAE,CAAE,CAAC,EAAA;;oBAAzH,UAAyH,CAAA;oBACzH,qBAAM,aAAa,CAAC,EAAE,EAAE,yBAAyB,EAAE,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,mBAAY,SAAS,CAAE,CAAC;wBACzG,8EAA8E;sBAD2B;;oBAAzG,UAAyG,CAAA;oBACzG,8EAA8E;oBAC9E,qBAAM,aAAa,CAAC,EAAE,EAAE,+BAA+B,EAAE,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,kBAAkB,CAAC,EAAA;;oBAD1G,8EAA8E;oBAC9E,UAA0G,CAAA;oBAC1G,qBAAM,aAAa,CAAC,EAAE,EAAE,iCAAiC,EAAE,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,yBAAyB,EAAE,EAAE,eAAe,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC;wBAEvJ,8FAA8F;wBAC9F,gGAAgG;wBAChG,8FAA8F;wBAC9F,+FAA+F;wBAC/F,uEAAuE;sBANgF;;oBAAvJ,UAAuJ,CAAA;oBAO/H,qBAAM,OAAO,CACnC,WAAW,CAAC,SAAS,EAAE,OAAO,EAAE,0BAAmB,SAAS,CAAC,EAAE,CAAE,EACjE,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE,CACxF,EAAA;;oBAHK,eAAe,GAAG,UAGvB;oBACD,MAAM,CAAC,IAAI,CAAC;wBACV,QAAQ,EAAE,EAAE;wBACZ,KAAK,EAAE,2CAA2C;wBAClD,IAAI,EAAE,0BAAmB,SAAS,CAAC,EAAE,CAAE;wBACvC,QAAQ,EAAE,SAAS;wBACnB,MAAM,EAAE,eAAe,CAAC,MAAM;wBAC9B,IAAI,EAAE,eAAe,CAAC,MAAM,KAAK,GAAG;qBACrC,CAAC,CAAA;oBAGI,WAAW,GAAG,MAAA,eAAe,CAAC,IAAI,mCAAI,EAAE,CAAA;oBAC9C,MAAM,CAAC,IAAI,CAAC;wBACV,QAAQ,EAAE,EAAE;wBACZ,KAAK,EAAE,gFAAgF;wBACvF,IAAI,EAAE,0BAAmB,SAAS,CAAC,EAAE,CAAE;wBACvC,QAAQ,EAAE,SAAS;wBACnB,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,IAAI,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;wBACxE,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,CAAC,WAAW,CAAC,iBAAiB,IAAI,CAAC,CAAC,WAAW,CAAC,eAAe;wBAC7F,IAAI,EAAE,iBAAU,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,UAAO;qBACvD,CAAC,CAAA;oBAGoB,qBAAM,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAE,CAAC,EAAA;;oBAA5F,aAAa,GAAG,UAA4E;oBAC5F,kBAAkB,GAAG,MAAA,aAAa,CAAC,IAAI,0CAAE,SAAS,CAAA;oBACxD,MAAM,CAAC,IAAI,CAAC;wBACV,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,0BAA0B;wBACrF,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,kBAAkB;qBAC9E,CAAC,CAAA;yBACE,kBAAkB,EAAlB,yBAAkB;oBACpB,qBAAM,YAAY,CAAC,EAAE,EAAE,4CAA4C,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,KAAK,EAAE,iBAAiB,CAAC,EAAA;;oBAAxI,UAAwI,CAAA;oBACxI,qBAAM,aAAa,CAAC,EAAE,EAAE,0CAA0C,EAAE,kBAAkB,EAAE,KAAK,EAAE,cAAc,CAAC,EAAA;;oBAA9G,UAA8G,CAAA;;;oBAK1G,EAAE,GAAG,uBAAuB,CAAA;oBAClC,qBAAM,YAAY,CAAC,EAAE,EAAE,0BAA0B,EAAE,YAAY,CAAC,SAAS,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,CAAC,EAAA;;oBAAvH,UAAuH,CAAA;oBACvH,qBAAM,YAAY,CAAC,EAAE,EAAE,oBAAoB,EAAE,YAAY,CAAC,SAAS,EAAE,iBAAiB,EAAE,KAAK,EAAE,WAAW,CAAC,EAAA;;oBAA3G,UAA2G,CAAA;oBAC3G,qBAAM,YAAY,CAAC,EAAE,EAAE,mBAAmB,EAAE,YAAY,CAAC,SAAS,EAAE,iBAAiB,EAAE,KAAK,EAAE,UAAU,CAAC,EAAA;;oBAAzG,UAAyG,CAAA;oBACzG,qBAAM,YAAY,CAAC,EAAE,EAAE,gDAAgD,EAAE,YAAY,CAAC,SAAS,EAAE,iBAAiB,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,EAAA;;oBAA/L,UAA+L,CAAA;oBAC/L,qBAAM,YAAY,CAAC,EAAE,EAAE,6BAA6B,EAAE,YAAY,CAAC,SAAS,EAAE,iBAAiB,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,UAAU,EAAE,sBAAsB,EAAE,CAAC,EAAA;;oBAArK,UAAqK,CAAA;oBACrK,qBAAM,YAAY,CAAC,EAAE,EAAE,oCAAoC,EAAE,YAAY,CAAC,SAAS,EAAE,iBAAiB,EAAE,KAAK,EAAE,0BAAmB,cAAc,CAAC,EAAE,CAAE,CAAC,EAAA;;oBAAtJ,UAAsJ,CAAA;oBAEtJ,qBAAM,aAAa,CAAC,EAAE,EAAE,qBAAqB,EAAE,YAAY,CAAC,SAAS,EAAE,KAAK,EAAE,qBAAqB,CAAC,EAAA;;oBAApG,UAAoG,CAAA;oBACpG,qBAAM,aAAa,CAAC,EAAE,EAAE,qBAAqB,EAAE,YAAY,CAAC,SAAS,EAAE,KAAK,EAAE,cAAc,CAAC,EAAA;;oBAA7F,UAA6F,CAAA;oBAC7F,qBAAM,aAAa,CAAC,EAAE,EAAE,yBAAyB,EAAE,YAAY,CAAC,SAAS,EAAE,KAAK,EAAE,kBAAkB,CAAC,EAAA;;oBAArG,UAAqG,CAAA;oBACrG,qBAAM,aAAa,CAAC,EAAE,EAAE,uBAAuB,EAAE,YAAY,CAAC,SAAS,EAAE,KAAK,EAAE,gBAAgB,CAAC,EAAA;;oBAAjG,UAAiG,CAAA;oBACjG,qBAAM,aAAa,CAAC,EAAE,EAAE,eAAe,EAAE,YAAY,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAA;;oBAAjF,UAAiF,CAAA;oBACjF,qBAAM,aAAa,CAAC,EAAE,EAAE,kBAAkB,EAAE,YAAY,CAAC,SAAS,EAAE,KAAK,EAAE,WAAW,CAAC,EAAA;;oBAAvF,UAAuF,CAAA;oBACvF,qBAAM,aAAa,CAAC,EAAE,EAAE,+BAA+B,EAAE,YAAY,CAAC,SAAS,EAAE,KAAK,EAAE,0BAAmB,UAAU,CAAC,EAAE,CAAE,CAAC,EAAA;;oBAA3H,UAA2H,CAAA;oBAC3H,qBAAM,aAAa,CAAC,EAAE,EAAE,yBAAyB,EAAE,YAAY,CAAC,SAAS,EAAE,KAAK,EAAE,mBAAY,SAAS,CAAE,CAAC,EAAA;;oBAA1G,UAA0G,CAAA;oBAC1G,qBAAM,aAAa,CAAC,EAAE,EAAE,oCAAoC,EAAE,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,EAAA;;oBAAzI,UAAyI,CAAA;oBACzI,qBAAM,aAAa,CAAC,EAAE,EAAE,uCAAuC,EAAE,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC,EAAA;;oBAAlJ,UAAkJ,CAAA;oBAClJ,qBAAM,aAAa,CAAC,EAAE,EAAE,iCAAiC,EAAE,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,yBAAyB,EAAE,EAAE,eAAe,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,EAAA;;oBAAzJ,UAAyJ,CAAA;oBACzJ,qBAAM,aAAa,CAAC,EAAE,EAAE,mCAAmC,EAAE,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,2BAA2B,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;wBAE5I,wFAAwF;wBACxF,oFAAoF;sBAHwD;;oBAA5I,UAA4I,CAAA;oBAIrH,qBAAM,OAAO,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,EAAA;;oBAAtF,cAAc,GAAG,UAAqE;oBACtF,mBAAmB,GAAG,MAAA,cAAc,CAAC,IAAI,0CAAE,SAAS,CAAA;oBAC1D,MAAM,CAAC,IAAI,CAAC;wBACV,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,kBAAkB;wBAC7E,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,mBAAmB;qBAChF,CAAC,CAAA;yBACE,mBAAmB,EAAnB,yBAAmB;oBACrB,qBAAM,YAAY,CAAC,EAAE,EAAE,sCAAsC,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,KAAK,EAAE,WAAW,CAAC,EAAA;;oBAA1H,UAA0H,CAAA;oBAC1H,qBAAM,aAAa,CAAC,EAAE,EAAE,0CAA0C,EAAE,mBAAmB,EAAE,KAAK,EAAE,cAAc,CAAC,EAAA;;oBAA/G,UAA+G,CAAA;;;oBAS3G,EAAE,GAAG,0BAA0B,CAAA;oBAC/B,aAAa,GAAmC;wBACpD,CAAC,OAAO,EAAE,8BAA8B,CAAC;wBACzC,CAAC,MAAM,EAAE,yBAAyB,CAAC;qBACpC,CAAA;0BACyC,EAAb,+BAAa;;;yBAAb,CAAA,2BAAa,CAAA;oBAA/B,wBAAc,EAAb,MAAM,QAAA,EAAE,IAAI,QAAA;oBACZ,qBAAM,eAAK,CAAC,OAAO,CAAC;4BAC5B,MAAM,QAAA;4BACN,GAAG,EAAE,UAAG,IAAI,gBAAM,IAAI,CAAE;4BACxB,IAAI,EAAE,EAAE;4BACR,OAAO,EAAE,EAAE,aAAa,EAAE,iBAAU,WAAW,CAAC,SAAS,CAAE,EAAE;4BAC7D,cAAc,EAAE,cAAM,OAAA,IAAI,EAAJ,CAAI;yBAC3B,CAAC,EAAA;;oBANI,CAAC,GAAG,UAMR;oBACF,MAAM,CAAC,IAAI,CAAC;wBACV,QAAQ,EAAE,EAAE;wBACZ,KAAK,EAAE,uCAAgC,MAAM,CAAC,WAAW,EAAE,cAAI,IAAI,CAAE;wBACrE,IAAI,MAAA;wBACJ,QAAQ,EAAE,QAAQ;wBAClB,MAAM,EAAE,CAAC,CAAC,MAAM;wBAChB,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;wBAC1C,IAAI,EAAE,uEAAuE;qBAC9E,CAAC,CAAA;;;oBAhByB,IAAa,CAAA;;;oBAyBpC,EAAE,GAAG,sBAAsB,CAAA;oBAM3B,WAAW,GAAG,0BAA0B,CAAA;oBACxC,WAAW,GAAG,0BAA0B,CAAA;oBACxC,aAAa,GAAG,oBAAoB,CAAA;oBAE1C,qBAAM,YAAY,CAAC,EAAE,EAAE,qDAAqD,EAAE,YAAY,CAAC,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,EAAA;;oBAA1K,UAA0K,CAAA;oBAC1K,qBAAM,YAAY,CAAC,EAAE,EAAE,+BAA+B,EAAE,YAAY,CAAC,SAAS,EAAE,iBAAiB,EAAE,MAAM,EAAE,uBAAuB,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,EAAA;;oBAAlK,UAAkK,CAAA;oBAClK,qBAAM,YAAY,CAAC,EAAE,EAAE,gCAAgC,EAAE,YAAY,CAAC,SAAS,EAAE,iBAAiB,EAAE,MAAM,EAAE,wBAAwB,EAAE,EAAE,CAAC,EAAA;;oBAAzI,UAAyI,CAAA;oBACzI,qBAAM,YAAY,CAAC,EAAE,EAAE,gCAAgC,EAAE,YAAY,CAAC,SAAS,EAAE,iBAAiB,EAAE,KAAK,EAAE,2BAA2B,CAAC,EAAA;;oBAAvI,UAAuI,CAAA;oBACvI,qBAAM,YAAY,CAAC,EAAE,EAAE,uBAAuB,EAAE,YAAY,CAAC,SAAS,EAAE,iBAAiB,EAAE,KAAK,EAAE,kBAAkB,CAAC,EAAA;;oBAArH,UAAqH,CAAA;oBACrH,qBAAM,YAAY,CAAC,EAAE,EAAE,2BAA2B,EAAE,YAAY,CAAC,SAAS,EAAE,iBAAiB,EAAE,KAAK,EAAE,sBAAsB,CAAC,EAAA;;oBAA7H,UAA6H,CAAA;oBAC7H,qBAAM,YAAY,CAAC,EAAE,EAAE,8BAA8B,EAAE,YAAY,CAAC,SAAS,EAAE,iBAAiB,EAAE,MAAM,EAAE,iBAAiB,EAAE,EAAE,eAAe,EAAE,WAAW,EAAE,oBAAoB,EAAE,WAAW,EAAE,CAAC,EAAA;;oBAAjM,UAAiM,CAAA;oBACjM,qBAAM,YAAY,CAAC,EAAE,EAAE,oCAAoC,EAAE,YAAY,CAAC,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;wBAE7K,0EAA0E;wBAC1E,iGAAiG;wBACjG,+FAA+F;sBAJ8E;;oBAA7K,UAA6K,CAAA;oBAE7K,0EAA0E;oBAC1E,iGAAiG;oBACjG,+FAA+F;oBAC/F,qBAAM,aAAa,CAAC,EAAE,EAAE,uCAAuC,EAAE,YAAY,CAAC,SAAS,EAAE,KAAK,EAAE,WAAW,CAAC,EAAA;;oBAH5G,0EAA0E;oBAC1E,iGAAiG;oBACjG,+FAA+F;oBAC/F,UAA4G,CAAA;oBAC5G,qBAAM,YAAY,CAAC,EAAE,EAAE,gDAAgD,EAAE,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,EAAA;;oBAA9J,UAA8J,CAAA;oBAC9J,qBAAM,aAAa,CAAC,EAAE,EAAE,oCAAoC,EAAE,YAAY,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAA;;oBAAtG,UAAsG,CAAA;oBACtG,qBAAM,YAAY,CAAC,EAAE,EAAE,6CAA6C,EAAE,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;wBAExJ,2FAA2F;sBAF6D;;oBAAxJ,UAAwJ,CAAA;oBAGjI,qBAAM,OAAO,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,EAAA;;oBAAxG,cAAc,GAAG,UAAuF;yBAC1G,CAAA,cAAc,CAAC,MAAM,KAAK,GAAG,KAAI,MAAA,cAAc,CAAC,IAAI,0CAAE,SAAS,CAAA,CAAA,EAA/D,yBAA+D;oBACjE,qBAAM,YAAY,CAAC,EAAE,EAAE,wCAAwC,EAAE,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,EAAE,KAAK,EAAE,WAAW,CAAC,EAAA;;oBAAtI,UAAsI,CAAA;;yBAM7G,qBAAM,OAAO,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,EAAA;;oBAA1F,kBAAkB,GAAG,UAAqE;oBAC1F,aAAa,GAAG,MAAA,kBAAkB,CAAC,IAAI,0CAAE,SAAS,CAAA;oBACxD,MAAM,CAAC,IAAI,CAAC;wBACV,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,kBAAkB;wBAC7E,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,kBAAkB,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,aAAa;qBAC9E,CAAC,CAAA;yBACE,aAAa,EAAb,yBAAa;oBACf,qBAAM,YAAY,CAAC,EAAE,EAAE,kDAAkD,EAAE,aAAa,EAAE,iBAAiB,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,EAAA;;oBAA9J,UAA8J,CAAA;oBAC9J,qBAAM,YAAY,CAAC,EAAE,EAAE,6DAA6D,EAAE,aAAa,EAAE,iBAAiB,EAAE,KAAK,EAAE,2BAA2B,CAAC,EAAA;;oBAA3J,UAA2J,CAAA;oBAC3J,qBAAM,YAAY,CAAC,EAAE,EAAE,4CAA4C,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,iCAA0B,IAAI,EAAE,wBAAqB,EAAE,CAAC,EAAA;;oBAA7L,UAA6L,CAAA;oBAC7L,qBAAM,aAAa,CAAC,EAAE,EAAE,4CAA4C,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,CAAC,EAAA;;oBAAxG,UAAwG,CAAA;oBACxG,qBAAM,aAAa,CAAC,EAAE,EAAE,0CAA0C,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,CAAC,EAAA;;oBAAzG,UAAyG,CAAA;;;oBASrG,EAAE,GAAG,wBAAwB,CAAA;oBAEX,qBAAM,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,SAAS,CAAC;4BACvE,KAAK,EAAE,kBAAW,IAAI,EAAE,CAAE,EAAE,iBAAiB,EAAE,EAAE;yBAClD,CAAC,EAAA;;oBAFI,eAAe,GAAG,UAEtB;oBACF,UAAU,GAAG,eAAe,CAAC,EAAE,CAAA;oBAEzB,mBAAmB,GAAG,wBAAiB,IAAI,EAAE,wBAAqB,CAAA;oBACjD,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;4BACtD,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa;yBACnE,CAAC,EAAA;;oBAFI,cAAc,GAAG,UAErB;oBACF,gBAAgB,GAAG,cAAc,CAAC,EAAE,CAAA;oBAEb,qBAAM,IAAI,oBAAc,CAAC,EAAE,IAAI,MAAA,EAAE,UAAU,YAAA,EAAE,CAAC;6BAClE,GAAG,CAAC,eAAe,CAAC,sCAAsC,CAAC;4BAC1D,UAAU,YAAA;4BACV,uBAAuB,EAAE,eAAe,CAAC,EAAE;4BAC3C,KAAK,EAAE,mBAAmB;4BAC1B,KAAK,EAAE,SAAS;4BAChB,KAAK,EAAE,aAAa;yBACrB,CAAC,EAAA;;oBAPE,cAAc,GAAG,UAOnB;oBAEJ,qBAAM,aAAa,CACjB,EAAE,EAAE,4CAA4C,EAAE,cAAc,CAAC,SAAS,EAC1E,OAAO,EAAE,mBAAY,cAAc,CAAC,EAAE,CAAE,EACxC,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,EAAE,CAC1E,EAAA;;oBAJD,UAIC,CAAA;oBAEmB,qBAAM,OAAO,CAC/B,cAAc,CAAC,SAAS,EAAE,OAAO,EAAE,mBAAY,cAAc,CAAC,EAAE,CAAE,EAAE,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,EAAE,CACvG,EAAA;;oBAFK,WAAW,GAAG,UAEnB;oBACK,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,OAAA,WAAW,CAAC,IAAI,qCAAI,EAAE,CAAC;yBACtD,MAAM,CAAC,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,IAAI,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAlD,CAAkD,CAAC,CAAA;oBAClE,MAAM,CAAC,IAAI,CAAC;wBACV,QAAQ,EAAE,EAAE;wBACZ,KAAK,EAAE,mEAAmE;wBAC1E,IAAI,EAAE,mBAAY,cAAc,CAAC,EAAE,CAAE;wBACrC,QAAQ,EAAE,SAAS;wBACnB,MAAM,EAAE,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG;wBAC7D,IAAI,EAAE,WAAW,CAAC,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;wBAC9D,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAW,aAAa,MAAG,CAAC,CAAC,CAAC,SAAS;qBACrE,CAAC,CAAA;0BAE6H,EAAlG,KAAA,CAAC,CAAC,OAAO,EAAE,mBAAY,IAAI,EAAE,wBAAqB,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,CAAC,CAAoB;;;yBAAlG,CAAA,cAAkG,CAAA;oBAApH,WAAc,EAAb,KAAK,QAAA,EAAE,KAAK,QAAA;oBACZ,qBAAM,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,OAAO,EAAE,mBAAY,cAAc,CAAC,EAAE,CAAE,EAAE,EAAE,OAAO,YAAI,GAAC,KAAK,IAAG,KAAK,KAAE,EAAE,CAAC,EAAA;;oBAAtH,CAAC,GAAG,UAAkH;oBAC5H,MAAM,CAAC,IAAI,CAAC;wBACV,QAAQ,EAAE,EAAE;wBACZ,KAAK,EAAE,kDAA2C,KAAK,MAAG;wBAC1D,IAAI,EAAE,mBAAY,cAAc,CAAC,EAAE,CAAE;wBACrC,QAAQ,EAAE,QAAQ;wBAClB,MAAM,EAAE,CAAC,CAAC,MAAM;wBAChB,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,GAAG;wBACtB,IAAI,EAAE,4DAA4D;qBACnE,CAAC,CAAA;;;oBAVyB,IAAkG,CAAA;;;gBAa/H,oFAAoF;gBACpF,qBAAM,YAAY,CAAC,EAAE,EAAE,0BAA0B,EAAE,cAAc,CAAC,SAAS,EAAE,oBAAoB,EAAE,KAAK,EAAE,iBAAiB,CAAC,EAAA;;oBAD5H,oFAAoF;oBACpF,UAA4H,CAAA;oBAC5H,qBAAM,YAAY,CAAC,EAAE,EAAE,2BAA2B,EAAE,cAAc,CAAC,SAAS,EAAE,oBAAoB,EAAE,KAAK,EAAE,kBAAkB,CAAC,EAAA;;oBAA9H,UAA8H,CAAA;oBAC9H,qBAAM,aAAa,CAAC,EAAE,EAAE,iCAAiC,EAAE,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,0BAA0B,CAAC;wBAExH,gFAAgF;sBAFwC;;oBAAxH,UAAwH,CAAA;oBAIlH,EAAE,GAAG,wBAAwB,CAAA;0BAC6D,EAA7E,MAAC,WAAW,EAAE,iBAAiB,EAAE,WAAW,EAAE,kBAAkB,EAAE,UAAU,CAAC;;;yBAA7E,CAAA,cAA6E,CAAA;oBAArF,IAAI;oBACb,qBAAM,aAAa,CAAC,EAAE,EAAE,gCAAyB,IAAI,CAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,IAAI,CAAC,EAAA;;oBAAxF,UAAwF,CAAA;;;oBADvE,IAA6E,CAAA;;0BAGhG,qBAAM,aAAa,CAAC,EAAE,EAAE,kCAAkC,EAAE,iBAAiB,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,EAAA;;oBAA1J,UAA0J,CAAA;0BACtF,EAAjD,MAAC,iBAAiB,EAAE,kBAAkB,EAAE,QAAQ,CAAC;;;yBAAjD,CAAA,cAAiD,CAAA;oBAAzD,IAAI;oBACb,qBAAM,aAAa,CAAC,EAAE,EAAE,kCAA2B,IAAI,CAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,IAAI,CAAC,EAAA;;oBAA7F,UAA6F,CAAA;;;oBAD5E,IAAiD,CAAA;;0BAGzC,qBAAM,GAAG,CAAC,kBAAkB,EAAE,EAAA;;oBAAnD,kBAAkB,GAAG,UAA8B;oBACzD,MAAM,CAAC,IAAI,CAAC;wBACV,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,+BAA+B,EAAE,IAAI,EAAE,qBAAqB;wBACjF,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,kBAAkB,KAAK,gBAAgB;qBAChF,CAAC,CAAA;oBAMI,SAAS,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC,CAAA;0BACD,EAA3E,MAAC,WAAW,EAAE,iBAAiB,EAAE,WAAW,EAAE,kBAAkB,EAAE,QAAQ,CAAC;;;yBAA3E,CAAA,cAA2E,CAAA;oBAAnF,IAAI;oBACH,qBAAM,eAAK,CAAC,OAAO,CAAC;4BAC5B,MAAM,EAAE,KAAK;4BACb,GAAG,EAAE,UAAG,IAAI,gBAAM,IAAI,CAAE;4BACxB,OAAO,EAAE,EAAE,aAAa,EAAE,kBAAY,SAAiB,CAAC,MAAM,CAAE,EAAE;4BAClE,cAAc,EAAE,cAAM,OAAA,IAAI,EAAJ,CAAI;yBAC3B,CAAC,EAAA;;oBALI,CAAC,GAAG,UAKR;oBACF,MAAM,CAAC,IAAI,CAAC;wBACV,QAAQ,EAAE,EAAE;wBACZ,KAAK,EAAE,qCAA8B,IAAI,CAAE;wBAC3C,IAAI,MAAA;wBACJ,QAAQ,EAAE,SAAS;wBACnB,MAAM,EAAE,CAAC,CAAC,MAAM;wBAChB,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,GAAG;qBACvB,CAAC,CAAA;;;oBAde,IAA2E,CAAA;;;oBAqBxF,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,CAAC,IAAI,EAAP,CAAO,CAAC,CAAA;oBAE5C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;oBACf,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;oBACjC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;oBAC7B,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,QAAQ,EAAV,CAAU,CAAC,CAAC,MAAM,CAAC,UAAC,CAAC,EAAE,CAAC,EAAE,GAAG,IAAK,OAAA,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAApB,CAAoB,CAAC,CAAA;wCAC9E,QAAQ;wBACjB,IAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAvB,CAAuB,CAAC,CAAA;wBAC9D,IAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,CAAC,IAAI,EAAP,CAAO,CAAC,CAAC,MAAM,CAAA;wBACrD,OAAO,CAAC,GAAG,CAAC,YAAK,QAAQ,eAAK,UAAU,CAAC,MAAM,GAAG,MAAM,cAAI,UAAU,CAAC,MAAM,qBAAW,MAAM,CAAC,CAAC,CAAC,gBAAS,MAAM,aAAU,CAAC,CAAC,CAAC,EAAE,CAAE,CAAC,CAAA;wBAClI,KAAgB,WAAU,EAAV,yBAAU,EAAV,yBAAU,EAAV,KAAU,EAAE;4BAAvB,IAAM,CAAC,oBAAA;4BACV,IAAM,QAAQ,GAAG,CAAC,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAa,CAAC,CAAC,cAAc,CAAE,CAAC,CAAC,CAAC,EAAE,CAAA;4BACtF,OAAO,CAAC,GAAG,CAAC,cAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,oBAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAQ,CAAC,CAAC,MAAM,SAAG,QAAQ,eAAK,CAAC,CAAC,KAAK,SAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAM,CAAC,CAAC,IAAI,MAAG,CAAC,CAAC,CAAC,EAAE,CAAE,CAAC,CAAA;yBACpJ;;oBAPH,WAAgC,EAAT,uBAAS,EAAT,uBAAS,EAAT,IAAS;wBAArB,QAAQ;gCAAR,QAAQ;qBAQlB;oBACD,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;oBACnC,OAAO,CAAC,GAAG,CAAC,mBAAY,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,cAAI,MAAM,CAAC,MAAM,uBAAa,QAAQ,CAAC,MAAM,aAAU,CAAC,CAAA;oBAC/G,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;oBAEf,WAAsB,EAAN,iBAAM,EAAN,oBAAM,EAAN,IAAM,EAAE;wBAAb,CAAC;wBACV,IAAA,gBAAM,EACJ,CAAC,CAAC,IAAI,EACN,UAAG,CAAC,CAAC,QAAQ,qBAAM,CAAC,CAAC,KAAK,eAAK,CAAC,CAAC,IAAI,uBAAa,CAAC,CAAC,QAAQ,0BAAgB,CAAC,CAAC,MAAM,CAAE;8BAClF,CAAC,CAAC,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,oCAA6B,CAAC,CAAC,cAAc,MAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAC5F,UAAG,CAAC,CAAC,QAAQ,qBAAM,CAAC,CAAC,KAAK,CAAE,CAC7B,CAAA;qBACF;;;0BAEwB,EAAR,qBAAQ;;;yBAAR,CAAA,sBAAQ,CAAA;oBAAd,EAAE;;;;oBACL,qBAAM,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC,EAAA;;oBAA3C,UAA2C,CAAA;;;;;;oBADlC,IAAQ,CAAA;;;yBAGrB,aAAa,EAAb,0BAAa;;;;oBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,aAAa,CAAC,EAAA;;oBAA/C,UAA+C,CAAA;;;;;;yBACtE,gBAAgB,EAAhB,0BAAgB;;;;oBAEN,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,EAAA;;oBAA9D,CAAC,GAAG,UAA0D;yBAChE,CAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,EAAE,CAAA,EAAL,0BAAK;oBAAE,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,EAAA;;oBAAtC,UAAsC,CAAA;;;;;;;yBAGjD,UAAU,EAAV,0BAAU;;;;oBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,EAAA;;oBAAzC,UAAyC,CAAA;;;;;;yBAC7D,gBAAgB,EAAhB,0BAAgB;;;;oBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAA;;oBAAlD,UAAkD,CAAA;;;;;;yBAC5E,UAAU,EAAV,0BAAU;;;;oBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,SAAS,CAAC,UAAU,CAAC,EAAA;;oBAA5D,UAA4D,CAAA;;;;;;yBAChF,SAAS,EAAT,0BAAS;;;;oBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,EAAA;;oBAA3C,UAA2C,CAAA;;;;;;yBAC9D,MAAM,EAAN,0BAAM;;;;oBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAA;;oBAArC,UAAqC,CAAA;;;;;;;;;;CAE5D,CAAA;AArnBY,QAAA,+BAA+B,mCAqnB3C;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAM,KAAG,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACjC,IAAM,aAAW,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IAEzC,IAAM,QAAQ,GAAG;;;wBACf,qBAAM,IAAA,mBAAW,EAAC,KAAG,EAAE,aAAW,CAAC,EAAA;;oBAAnC,SAAmC,CAAA;oBACnC,qBAAM,IAAA,uCAA+B,EAAC,EAAE,GAAG,OAAA,EAAE,WAAW,eAAA,EAAE,CAAC,EAAA;;oBAA3D,SAA2D,CAAA;;;;SAC5D,CAAA;IAED,QAAQ,EAAE;SACT,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAA;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,+CAA+C,EAAE,KAAK,CAAC,CAAA;QACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACH"}

package/lib/cjs/tests/api_tests/security/automated-actions-process-gate.test.d.ts

@@ -0,0 +1,42 @@
+import { Session } from "../../../sdk";
+/**
+ * Regression test: `automated_actions.process` must be admin-gated, single-fire and audited.
+ *
+ * `automated_actions.process` (api.ts:3902) is the WORKER's action runner — its schema description
+ * reads "Used by worker for new action types". It was registered with only
+ * `{ requiresSubscription: true }`, so the framework gated it on the ordinary
+ * `automated_actions.update` verb, which the default provider role holds ('Assigned'). The handler
+ * then dispatched `automatedAction.action` through a 14-branch if-chain reaching real vendors:
+ * chargebeeChargeCardOnFile (card charge), belugaAutoRx / belugaTriggerRefill / mdiTriggerRefill
+ * (prescriptions and refills), createScriptSureDraft (medication draft), healthiePushForms /
+ * metriportPushFormResponse (PHI export). It checked neither the row's `status` nor whether it had
+ * already run, so any row was replayable: MDI advances to the next scheduled refill each call,
+ * Chargebee charges again. And there was no storeUserLog, so the action was attributed to the
+ * worker rather than the caller.
+ *
+ * The fix has three parts:
+ *   1. `adminOnly: true` on the api.ts registration (routing.ts:944 reads the flag from that
+ *      options object — a schema-only flag is inert, which is a separate issue).
+ *   2. A single-fire claim for human callers: an atomic findOneAndUpdate with `status: 'active'` in
+ *      the filter, stamping `finished` + `processedAt` before the vendor dispatch. The worker
+ *      (`wasAutomated`) is exempt because its own claim in
+ *      worker/modules/database.ts:114 is already atomic and it needs the row to stay 'active'
+ *      across the call so a retryable failure (worker/modules/automations.ts:2053) can be
+ *      re-claimed after the lock times out.
+ *   3. storeUserLog on the human path, recording the caller and the automatedActionId.
+ *
+ * The seeded row uses `setEnduserStatus`, which is NOT one of the API's if-chain branches, so it
+ * falls through to `{ success: false, unimplemented: true }` (api.ts) — no vendor call, no Bedrock,
+ * no PHI export. `processAfter` is set an hour out so the live worker cannot race the row (the same
+ * trick mdi_trigger_refill / beluga_trigger_refill use).
+ *
+ * RED (pre-fix): A1 fails (a non-admin holding only `automated_actions.update` reaches the handler)
+ * and C1 fails (the second call on the same row executes again instead of being rejected).
+ * B1 (admin positive control) passes pre-fix and must keep passing.
+ * GREEN (post-fix): all five checks pass.
+ */
+export declare const automated_actions_process_gate_tests: ({ sdk }: {
+    sdk: Session;
+    sdkNonAdmin: Session;
+}) => Promise<void>;
+//# sourceMappingURL=automated-actions-process-gate.test.d.ts.map

package/lib/cjs/tests/api_tests/security/automated-actions-process-gate.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"automated-actions-process-gate.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/automated-actions-process-gate.test.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AA0BtC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,eAAO,MAAM,oCAAoC;SAA2B,OAAO;iBAAe,OAAO;mBAoJxG,CAAA"}

package/lib/cjs/tests/api_tests/security/automated-actions-process-gate.test.js

@@ -0,0 +1,323 @@
+"use strict";
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.automated_actions_process_gate_tests = void 0;
+require('source-map-support').install();
+var axios_1 = __importDefault(require("axios"));
+var sdk_1 = require("../../../sdk");
+var testing_1 = require("@tellescope/testing");
+var constants_1 = require("@tellescope/constants");
+var setup_1 = require("../../setup");
+var host = process.env.API_URL || 'http://localhost:8080';
+var RAND = function () { return Math.random().toString(36).slice(2, 10); };
+var ALL = 'All';
+var FULL_ACCESS = { create: ALL, read: ALL, update: ALL, delete: ALL };
+var PROCESS_PATH = '/v1/automated-actions/process';
+/**
+ * Regression test: `automated_actions.process` must be admin-gated, single-fire and audited.
+ *
+ * `automated_actions.process` (api.ts:3902) is the WORKER's action runner — its schema description
+ * reads "Used by worker for new action types". It was registered with only
+ * `{ requiresSubscription: true }`, so the framework gated it on the ordinary
+ * `automated_actions.update` verb, which the default provider role holds ('Assigned'). The handler
+ * then dispatched `automatedAction.action` through a 14-branch if-chain reaching real vendors:
+ * chargebeeChargeCardOnFile (card charge), belugaAutoRx / belugaTriggerRefill / mdiTriggerRefill
+ * (prescriptions and refills), createScriptSureDraft (medication draft), healthiePushForms /
+ * metriportPushFormResponse (PHI export). It checked neither the row's `status` nor whether it had
+ * already run, so any row was replayable: MDI advances to the next scheduled refill each call,
+ * Chargebee charges again. And there was no storeUserLog, so the action was attributed to the
+ * worker rather than the caller.
+ *
+ * The fix has three parts:
+ *   1. `adminOnly: true` on the api.ts registration (routing.ts:944 reads the flag from that
+ *      options object — a schema-only flag is inert, which is a separate issue).
+ *   2. A single-fire claim for human callers: an atomic findOneAndUpdate with `status: 'active'` in
+ *      the filter, stamping `finished` + `processedAt` before the vendor dispatch. The worker
+ *      (`wasAutomated`) is exempt because its own claim in
+ *      worker/modules/database.ts:114 is already atomic and it needs the row to stay 'active'
+ *      across the call so a retryable failure (worker/modules/automations.ts:2053) can be
+ *      re-claimed after the lock times out.
+ *   3. storeUserLog on the human path, recording the caller and the automatedActionId.
+ *
+ * The seeded row uses `setEnduserStatus`, which is NOT one of the API's if-chain branches, so it
+ * falls through to `{ success: false, unimplemented: true }` (api.ts) — no vendor call, no Bedrock,
+ * no PHI export. `processAfter` is set an hour out so the live worker cannot race the row (the same
+ * trick mdi_trigger_refill / beluga_trigger_refill use).
+ *
+ * RED (pre-fix): A1 fails (a non-admin holding only `automated_actions.update` reaches the handler)
+ * and C1 fails (the second call on the same row executes again instead of being rejected).
+ * B1 (admin positive control) passes pre-fix and must keep passing.
+ * GREEN (post-fix): all five checks pass.
+ */
+var automated_actions_process_gate_tests = function (_a) {
+    var sdk = _a.sdk;
+    return __awaiter(void 0, void 0, void 0, function () {
+        var checks, record, post, roleId, attackerId, enduserId, automatedActionIds, role, rbap, attacker, attackerToken, adminToken, attackerSDK, enduser, seedAction, attackerRow, attackerAttempt, baselineRow, baseline, badProbe, attackerRowAfter, replay, baselineRowAfter, _i, checks_1, c, _b, checks_2, c, _c, automatedActionIds_1, id, _d, _e, _f, _g;
+        var _h, _j;
+        return __generator(this, function (_k) {
+            switch (_k.label) {
+                case 0:
+                    (0, testing_1.log_header)("automated_actions.process must be admin-only and single-fire");
+                    checks = [];
+                    record = function (label, pass, detail) { return checks.push({ label: label, pass: pass, detail: detail }); };
+                    post = function (authToken, automatedActionId) { return __awaiter(void 0, void 0, void 0, function () {
+                        var r;
+                        return __generator(this, function (_a) {
+                            switch (_a.label) {
+                                case 0: return [4 /*yield*/, axios_1.default.request({
+                                        method: 'post',
+                                        url: "".concat(host).concat(PROCESS_PATH),
+                                        data: { automatedActionId: automatedActionId },
+                                        headers: { Authorization: "Bearer ".concat(authToken) },
+                                        validateStatus: function () { return true; },
+                                    })];
+                                case 1:
+                                    r = _a.sent();
+                                    return [2 /*return*/, { status: r.status, body: r.data }];
+                            }
+                        });
+                    }); };
+                    roleId = '';
+                    attackerId = '';
+                    enduserId = '';
+                    automatedActionIds = [];
+                    _k.label = 1;
+                case 1:
+                    _k.trys.push([1, , 15, 34]);
+                    role = "f0192-automations-".concat(RAND());
+                    return [4 /*yield*/, sdk.api.role_based_access_permissions.createOne({
+                            role: role,
+                            permissions: __assign(__assign({}, constants_1.PROVIDER_PERMISSIONS), { automated_actions: FULL_ACCESS }),
+                        })];
+                case 2:
+                    rbap = _k.sent();
+                    roleId = rbap.id;
+                    return [4 /*yield*/, sdk.api.users.createOne({
+                            email: "f0192-attacker-".concat(RAND(), "@tellescope.example"),
+                            fname: 'F0192', lname: 'Staff',
+                            verifiedEmail: true,
+                            notificationEmailsDisabled: true,
+                            roles: [role],
+                        })];
+                case 3:
+                    attacker = _k.sent();
+                    attackerId = attacker.id;
+                    return [4 /*yield*/, sdk.api.users.generate_auth_token({ id: attackerId })];
+                case 4:
+                    attackerToken = (_k.sent()).authToken;
+                    return [4 /*yield*/, sdk.api.users.generate_auth_token({ id: sdk.userInfo.id })];
+                case 5:
+                    adminToken = (_k.sent()).authToken;
+                    attackerSDK = new sdk_1.Session({ host: host, authToken: attackerToken });
+                    return [4 /*yield*/, attackerSDK.refresh_session()];
+                case 6:
+                    _k.sent();
+                    record('setup: attacker session is a non-admin holding automated_actions.update', attackerSDK.userInfo.id === attackerId && !((_h = attackerSDK.userInfo.roles) !== null && _h !== void 0 ? _h : []).includes('Admin'), "id=".concat(attackerSDK.userInfo.id, " roles=").concat(JSON.stringify(attackerSDK.userInfo.roles)));
+                    return [4 /*yield*/, sdk.api.endusers.createOne({ fname: 'F0192', lname: 'Patient' })];
+                case 7:
+                    enduser = _k.sent();
+                    enduserId = enduser.id;
+                    seedAction = function () { return __awaiter(void 0, void 0, void 0, function () {
+                        var a;
+                        return __generator(this, function (_a) {
+                            switch (_a.label) {
+                                case 0: return [4 /*yield*/, sdk.api.automated_actions.createOne({
+                                        enduserId: enduserId,
+                                        journeyId: constants_1.PLACEHOLDER_ID,
+                                        automationStepId: constants_1.PLACEHOLDER_ID,
+                                        event: { type: 'onJourneyStart', info: {} },
+                                        action: { type: 'setEnduserStatus', info: { status: 'Working' } },
+                                        status: 'active',
+                                        processAfter: Date.now() + 60 * 60 * 1000,
+                                    })];
+                                case 1:
+                                    a = _a.sent();
+                                    automatedActionIds.push(a.id);
+                                    return [2 /*return*/, a];
+                            }
+                        });
+                    }); };
+                    return [4 /*yield*/, seedAction()];
+                case 8:
+                    attackerRow = _k.sent();
+                    return [4 /*yield*/, post(attackerToken, attackerRow.id)
+                        // Baseline on the same path with an admin token, so a blanket 401 (expired subscription,
+                        // bad route, broken fixture) cannot masquerade as a working gate.
+                    ];
+                case 9:
+                    attackerAttempt = _k.sent();
+                    return [4 /*yield*/, seedAction()];
+                case 10:
+                    baselineRow = _k.sent();
+                    return [4 /*yield*/, post(adminToken, baselineRow.id)];
+                case 11:
+                    baseline = _k.sent();
+                    badProbe = baseline.status === 401 || baseline.status === 403;
+                    record('A1: a non-admin holding automated_actions.update cannot call process', !badProbe && (attackerAttempt.status === 401 || attackerAttempt.status === 403), "attacker=".concat(attackerAttempt.status, " ").concat(JSON.stringify(attackerAttempt.body), " baseline(admin)=").concat(baseline.status)
+                        + (badProbe ? ' BAD PROBE: admin baseline was also rejected' : ''));
+                    return [4 /*yield*/, sdk.api.automated_actions.getOne(attackerRow.id)];
+                case 12:
+                    attackerRowAfter = _k.sent();
+                    record('A2: a rejected non-admin call leaves the row unfired (status still active)', attackerRowAfter.status === 'active', "status=".concat(attackerRowAfter.status, " (expected active)"));
+                    /* ===== B: positive control — an admin can still call it ===== */
+                    record('B1: an admin can still process a pending row', baseline.status === 200 && ((_j = baseline.body) === null || _j === void 0 ? void 0 : _j.unimplemented) === true, "status=".concat(baseline.status, " body=").concat(JSON.stringify(baseline.body)));
+                    return [4 /*yield*/, post(adminToken, baselineRow.id)];
+                case 13:
+                    replay = _k.sent();
+                    record('C1: processing the same row twice is rejected (no replay)', replay.status === 409, "second call status=".concat(replay.status, " body=").concat(JSON.stringify(replay.body), " (expected 409)"));
+                    return [4 /*yield*/, sdk.api.automated_actions.getOne(baselineRow.id)];
+                case 14:
+                    baselineRowAfter = _k.sent();
+                    record('C2: a processed row is marked finished so neither a replay nor the worker re-runs it', baselineRowAfter.status === 'finished', "status=".concat(baselineRowAfter.status, " (expected finished)"));
+                    /* ===== report: print full table first, then assert (harness exits on first failure) ===== */
+                    console.log('\n  check summary:');
+                    for (_i = 0, checks_1 = checks; _i < checks_1.length; _i++) {
+                        c = checks_1[_i];
+                        console.log("    ".concat(c.pass ? 'PASS' : 'FAIL', "  ").concat(c.label, "  \u2014  ").concat(c.detail));
+                    }
+                    console.log('');
+                    for (_b = 0, checks_2 = checks; _b < checks_2.length; _b++) {
+                        c = checks_2[_b];
+                        (0, testing_1.assert)(c.pass, "".concat(c.label, " \u2014 ").concat(c.detail), c.label);
+                    }
+                    return [3 /*break*/, 34];
+                case 15:
+                    _c = 0, automatedActionIds_1 = automatedActionIds;
+                    _k.label = 16;
+                case 16:
+                    if (!(_c < automatedActionIds_1.length)) return [3 /*break*/, 21];
+                    id = automatedActionIds_1[_c];
+                    _k.label = 17;
+                case 17:
+                    _k.trys.push([17, 19, , 20]);
+                    return [4 /*yield*/, sdk.api.automated_actions.deleteOne(id)];
+                case 18:
+                    _k.sent();
+                    return [3 /*break*/, 20];
+                case 19:
+                    _d = _k.sent();
+                    return [3 /*break*/, 20];
+                case 20:
+                    _c++;
+                    return [3 /*break*/, 16];
+                case 21:
+                    if (!enduserId) return [3 /*break*/, 25];
+                    _k.label = 22;
+                case 22:
+                    _k.trys.push([22, 24, , 25]);
+                    return [4 /*yield*/, sdk.api.endusers.deleteOne(enduserId)];
+                case 23:
+                    _k.sent();
+                    return [3 /*break*/, 25];
+                case 24:
+                    _e = _k.sent();
+                    return [3 /*break*/, 25];
+                case 25:
+                    if (!attackerId) return [3 /*break*/, 29];
+                    _k.label = 26;
+                case 26:
+                    _k.trys.push([26, 28, , 29]);
+                    return [4 /*yield*/, sdk.api.users.deleteOne(attackerId)];
+                case 27:
+                    _k.sent();
+                    return [3 /*break*/, 29];
+                case 28:
+                    _f = _k.sent();
+                    return [3 /*break*/, 29];
+                case 29:
+                    if (!roleId) return [3 /*break*/, 33];
+                    _k.label = 30;
+                case 30:
+                    _k.trys.push([30, 32, , 33]);
+                    return [4 /*yield*/, sdk.api.role_based_access_permissions.deleteOne(roleId)];
+                case 31:
+                    _k.sent();
+                    return [3 /*break*/, 33];
+                case 32:
+                    _g = _k.sent();
+                    return [3 /*break*/, 33];
+                case 33: return [7 /*endfinally*/];
+                case 34: return [2 /*return*/];
+            }
+        });
+    });
+};
+exports.automated_actions_process_gate_tests = automated_actions_process_gate_tests;
+// Allow running this test file independently
+if (require.main === module) {
+    console.log("\uD83C\uDF10 Using API URL: ".concat(host));
+    var sdk_2 = new sdk_1.Session({ host: host });
+    var sdkNonAdmin_1 = new sdk_1.Session({ host: host });
+    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, (0, setup_1.setup_tests)(sdk_2, sdkNonAdmin_1)];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, (0, exports.automated_actions_process_gate_tests)({ sdk: sdk_2, sdkNonAdmin: sdkNonAdmin_1 })];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); };
+    runTests()
+        .then(function () {
+        console.log("✅ automated_actions.process gate test suite completed successfully");
+        process.exit(0);
+    })
+        .catch(function (error) {
+        console.error("❌ automated_actions.process gate test suite failed:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=automated-actions-process-gate.test.js.map

package/lib/cjs/tests/api_tests/security/automated-actions-process-gate.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"automated-actions-process-gate.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/automated-actions-process-gate.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,gDAAyB;AAEzB,oCAAsC;AACtC,+CAG4B;AAC5B,mDAA4E;AAC5E,qCAAyC;AAEzC,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE,IAAM,IAAI,GAAG,cAAM,OAAA,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAvC,CAAuC,CAAA;AAE1D,IAAM,GAAG,GAAG,KAAc,CAAA;AAC1B,IAAM,WAAW,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;AAExE,IAAM,YAAY,GAAG,+BAA+B,CAAA;AAWpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACI,IAAM,oCAAoC,GAAG,UAAO,EAAgD;QAA9C,GAAG,SAAA;;;;;;;oBAC9D,IAAA,oBAAU,EAAC,8DAA8D,CAAC,CAAA;oBAEpE,MAAM,GAAY,EAAE,CAAA;oBACpB,MAAM,GAAG,UAAC,KAAa,EAAE,IAAa,EAAE,MAAc,IAAK,OAAA,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,OAAA,EAAE,IAAI,MAAA,EAAE,MAAM,QAAA,EAAE,CAAC,EAApC,CAAoC,CAAA;oBAI/F,IAAI,GAAG,UAAO,SAAiB,EAAE,iBAAyB;;;;wCACpD,qBAAM,eAAK,CAAC,OAAO,CAAC;wCAC5B,MAAM,EAAE,MAAM;wCACd,GAAG,EAAE,UAAG,IAAI,SAAG,YAAY,CAAE;wCAC7B,IAAI,EAAE,EAAE,iBAAiB,mBAAA,EAAE;wCAC3B,OAAO,EAAE,EAAE,aAAa,EAAE,iBAAU,SAAS,CAAE,EAAE;wCACjD,cAAc,EAAE,cAAM,OAAA,IAAI,EAAJ,CAAI;qCAC3B,CAAC,EAAA;;oCANI,CAAC,GAAG,SAMR;oCACF,sBAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAA;;;yBAC1C,CAAA;oBAEG,MAAM,GAAG,EAAE,CAAA;oBACX,UAAU,GAAG,EAAE,CAAA;oBACf,SAAS,GAAG,EAAE,CAAA;oBACZ,kBAAkB,GAAa,EAAE,CAAA;;;;oBAO/B,IAAI,GAAG,4BAAqB,IAAI,EAAE,CAAE,CAAA;oBAC7B,qBAAM,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,SAAS,CAAC;4BACjE,IAAI,MAAA;4BACJ,WAAW,wBAAO,gCAAoB,KAAE,iBAAiB,EAAE,WAAW,GAAE;yBAClE,CAAC,EAAA;;oBAHH,IAAI,GAAG,SAGJ;oBACT,MAAM,GAAG,IAAI,CAAC,EAAE,CAAA;oBAKC,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;4BAC7C,KAAK,EAAE,yBAAkB,IAAI,EAAE,wBAAqB;4BACpD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO;4BAC9B,aAAa,EAAE,IAAI;4BACnB,0BAA0B,EAAE,IAAI;4BAChC,KAAK,EAAE,CAAC,IAAI,CAAC;yBACP,CAAC,EAAA;;oBANH,QAAQ,GAAG,SAMR;oBACT,UAAU,GAAG,QAAQ,CAAC,EAAE,CAAA;oBAGD,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAA;;oBAA5E,aAAa,GAAG,CAAC,SAA2D,CAAC,CAAC,SAAS;oBACzE,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,EAAA;;oBAA9E,UAAU,GAAG,CAAC,SAAgE,CAAC,CAAC,SAAS;oBAEzF,WAAW,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAA;oBACnE,qBAAM,WAAW,CAAC,eAAe,EAAE,EAAA;;oBAAnC,SAAmC,CAAA;oBACnC,MAAM,CACJ,yEAAyE,EACzE,WAAW,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,IAAI,CAAC,CAAC,MAAA,WAAW,CAAC,QAAQ,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAC/F,aAAM,WAAW,CAAC,QAAQ,CAAC,EAAE,oBAAU,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAE,CACpF,CAAA;oBAEe,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAA;;oBAAhF,OAAO,GAAG,SAAsE;oBACtF,SAAS,GAAG,OAAO,CAAC,EAAE,CAAA;oBAKhB,UAAU,GAAG;;;;wCACP,qBAAM,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,SAAS,CAAC;wCAClD,SAAS,WAAA;wCACT,SAAS,EAAE,0BAAc;wCACzB,gBAAgB,EAAE,0BAAc;wCAChC,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,EAAE;wCAC3C,MAAM,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE;wCACjE,MAAM,EAAE,QAAQ;wCAChB,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;qCACnC,CAAC,EAAA;;oCARH,CAAC,GAAG,SAQD;oCACT,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;oCAC7B,sBAAO,CAAC,EAAA;;;yBACT,CAAA;oBAImB,qBAAM,UAAU,EAAE,EAAA;;oBAAhC,WAAW,GAAG,SAAkB;oBACd,qBAAM,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,EAAE,CAAC;wBAEjE,yFAAyF;wBACzF,kEAAkE;sBAHD;;oBAA3D,eAAe,GAAG,SAAyC;oBAI7C,qBAAM,UAAU,EAAE,EAAA;;oBAAhC,WAAW,GAAG,SAAkB;oBACrB,qBAAM,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,CAAC,EAAA;;oBAAjD,QAAQ,GAAG,SAAsC;oBACjD,QAAQ,GAAG,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAA;oBAEnE,MAAM,CACJ,sEAAsE,EACtE,CAAC,QAAQ,IAAI,CAAC,eAAe,CAAC,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,MAAM,KAAK,GAAG,CAAC,EAC/E,mBAAY,eAAe,CAAC,MAAM,cAAI,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,8BAAoB,QAAQ,CAAC,MAAM,CAAE;0BAC3G,CAAC,QAAQ,CAAC,CAAC,CAAC,8CAA8C,CAAC,CAAC,CAAC,EAAE,CAAC,CACrE,CAAA;oBAGwB,qBAAM,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,EAAA;;oBAAzE,gBAAgB,GAAG,SAAsD;oBAC/E,MAAM,CACJ,4EAA4E,EAC5E,gBAAgB,CAAC,MAAM,KAAK,QAAQ,EACpC,iBAAU,gBAAgB,CAAC,MAAM,uBAAoB,CACtD,CAAA;oBAED,kEAAkE;oBAElE,MAAM,CACJ,8CAA8C,EAC9C,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAA,MAAA,QAAQ,CAAC,IAAI,0CAAE,aAAa,MAAK,IAAI,EAChE,iBAAU,QAAQ,CAAC,MAAM,mBAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAE,CAClE,CAAA;oBAIc,qBAAM,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,CAAC,EAAA;;oBAA/C,MAAM,GAAG,SAAsC;oBACrD,MAAM,CACJ,2DAA2D,EAC3D,MAAM,CAAC,MAAM,KAAK,GAAG,EACrB,6BAAsB,MAAM,CAAC,MAAM,mBAAS,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAiB,CACzF,CAAA;oBAEwB,qBAAM,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,EAAA;;oBAAzE,gBAAgB,GAAG,SAAsD;oBAC/E,MAAM,CACJ,sFAAsF,EACtF,gBAAgB,CAAC,MAAM,KAAK,UAAU,EACtC,iBAAU,gBAAgB,CAAC,MAAM,yBAAsB,CACxD,CAAA;oBAED,8FAA8F;oBAC9F,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;oBACjC,WAAsB,EAAN,iBAAM,EAAN,oBAAM,EAAN,IAAM,EAAE;wBAAb,CAAC;wBACV,OAAO,CAAC,GAAG,CAAC,cAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,eAAK,CAAC,CAAC,KAAK,uBAAQ,CAAC,CAAC,MAAM,CAAE,CAAC,CAAA;qBAC3E;oBACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;oBAEf,WAAsB,EAAN,iBAAM,EAAN,oBAAM,EAAN,IAAM,EAAE;wBAAb,CAAC;wBACV,IAAA,gBAAM,EAAC,CAAC,CAAC,IAAI,EAAE,UAAG,CAAC,CAAC,KAAK,qBAAM,CAAC,CAAC,MAAM,CAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAA;qBACpD;;;0BAIkC,EAAlB,yCAAkB;;;yBAAlB,CAAA,gCAAkB,CAAA;oBAAxB,EAAE;;;;oBAAgC,qBAAM,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC,EAAA;;oBAA7C,SAA6C,CAAA;;;;;;oBAAzE,IAAkB,CAAA;;;yBAC/B,SAAS,EAAT,yBAAS;;;;oBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,EAAA;;oBAA3C,SAA2C,CAAA;;;;;;yBAC9D,UAAU,EAAV,yBAAU;;;;oBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,EAAA;;oBAAzC,SAAyC,CAAA;;;;;;yBAC7D,MAAM,EAAN,yBAAM;;;;oBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,SAAS,CAAC,MAAM,CAAC,EAAA;;oBAA7D,SAA6D,CAAA;;;;;;;;;;CAEpF,CAAA;AApJY,QAAA,oCAAoC,wCAoJhD;AAED,6CAA6C;AAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAM,KAAG,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACjC,IAAM,aAAW,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IAEzC,IAAM,QAAQ,GAAG;;;wBACf,qBAAM,IAAA,mBAAW,EAAC,KAAG,EAAE,aAAW,CAAC,EAAA;;oBAAnC,SAAmC,CAAA;oBACnC,qBAAM,IAAA,4CAAoC,EAAC,EAAE,GAAG,OAAA,EAAE,WAAW,eAAA,EAAE,CAAC,EAAA;;oBAAhE,SAAgE,CAAA;;;;SACjE,CAAA;IAED,QAAQ,EAAE;SACP,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAA;QACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,qDAAqD,EAAE,KAAK,CAAC,CAAA;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}

package/lib/cjs/tests/api_tests/security/booking-info-idor-token-mint.test.d.ts

@@ -0,0 +1,29 @@
+import { Session } from "../../../sdk";
+/**
+ * Regression test: `form_fields.booking_info` must not mint a booking token for another patient.
+ *
+ * `form_fields.booking_info` resolved its target patient as
+ * `DB.endusers.findById(enduserId || req.session.id)` with no ownership check for enduser
+ * sessions. The enduser DB branch builds the endusers collection with `enduserAccess: true`
+ * (database.ts), so a FOREIGN in-tenant id resolves — and the handler then writes
+ * `enduserFields.state` onto that record and calls `login_enduser` with
+ * `sessionScopes: ['appointment-booking']`, returning a live 24h token for the victim inside
+ * `bookingURL`. booking_info is enduser-callable AND granted to the 'public-form' scope, so a
+ * portal patient or an anonymous form-filler could mint a working session as any co-tenant patient.
+ *
+ * The fix mirrors `prepare_form_response` (api.ts): reject when an enduser session supplies an
+ * `enduserId` other than its own, before the booking-page lookup and before the `state` write.
+ *
+ * RED (pre-fix): A1 and A2 fail — the exploit returns 200 with a bookingURL whose token decodes to
+ * the VICTIM's id, and the victim's `state` is overwritten. B/C (positive controls) pass pre-fix.
+ * GREEN (post-fix): all six checks pass.
+ *
+ * Checks are collected and printed before any assert runs: the testing harness has
+ * EXIT_ON_FIRST_ERROR, so asserting inline would kill the process before the evidence table and
+ * before `finally` cleanup.
+ */
+export declare const booking_info_idor_tests: ({ sdk }: {
+    sdk: Session;
+    sdkNonAdmin: Session;
+}) => Promise<void>;
+//# sourceMappingURL=booking-info-idor-token-mint.test.d.ts.map

package/lib/cjs/tests/api_tests/security/booking-info-idor-token-mint.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"booking-info-idor-token-mint.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/booking-info-idor-token-mint.test.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAkB,MAAM,cAAc,CAAA;AAqBtD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,uBAAuB;SAA2B,OAAO;iBAAe,OAAO;mBA2J3F,CAAA"}