@tellescope/sdk 1.256.16 → 2.0.0-beta.0

package/src/tests/api_tests/templated_message_date_fields.test.ts

@@ -0,0 +1,146 @@
+require('source-map-support').install();
+
+import {
+  assert_checks,
+  Check,
+  setup_isolated_tenant,
+} from "../setup_isolated"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+/**
+ * Coverage for how `get_templated_message` renders enduser field values that LOOK like dates.
+ *
+ * The rule: a value stored as text renders as the author stored it. `message_templating.ts` only
+ * reformats an actual `Date` object, and a custom field is always a string.
+ *
+ * This exists because that rule was silently broken IN PRODUCTION, and had been for a long time.
+ * The templating code read `if (fieldValue instanceof Date || isDate(fieldValue))`. Validator
+ * 13.11.0's `isDate` was timezone-dependent — it compared a UTC-parsed date against a local-time
+ * `.getDate()` — so it returned false on a US developer's machine but TRUE in UTC, which is what
+ * the servers run. A date of birth stored as "1985-03-12" therefore took the Date branch in
+ * production, was parsed as UTC midnight and localized to the enduser's timezone, and rendered in a
+ * patient-facing SMS or email as "3/11/1985, 7:00:00 PM" — the PREVIOUS day, with a time nobody
+ * entered. A January date lost a year: "2024-01-01" rendered "12/31/2023".
+ *
+ * The validator bump did not cause this; it made it reproducible locally, which is how it surfaced.
+ * Removing the `isDate` half of the condition fixes it in every timezone.
+ *
+ * This is the ONE intentional production behavior change in an otherwise behavior-neutral
+ * dependency PR, made deliberately rather than shipping wrong dates to patients for another
+ * cycle. Every other validator touched here was pinned to production's existing behavior.
+ *
+ * So the assertions below are about the day not moving and no clock time appearing, which is what a
+ * patient would actually notice. A pure-function test could not have caught this: the function that
+ * does the work is module-private and the endpoint is the real surface.
+ *
+ * Runs standalone or as part of the main suite:
+ *   npm run test:modular -- api_tests/templated_message_date_fields
+ */
+
+/** Values a customer realistically stores in a date-ish custom field, and what must come back. */
+const DATE_SHAPED_VALUES = [
+  { label: 'ISO date (the shape that regressed)', value: '1985-03-12' },
+  { label: 'ISO date, recent',                    value: '2024-01-01' },
+  { label: 'slash-separated date',                value: '1999/12/31' },
+  { label: 'MM-DD-YYYY (the dateOfBirth format)', value: '03-12-1985' },
+  { label: 'ISO datetime string',                 value: '2024-06-15T14:30:00.000Z' },
+  { label: 'leap day',                            value: '2000-02-29' },
+]
+
+/** A rendered date-only value must not have grown a clock time or a timezone abbreviation. */
+const LOOKS_REFORMATTED = /\d{1,2}:\d{2}|\bAM\b|\bPM\b|\bE[SD]T\b|\bUTC\b|\bGMT\b/
+
+const templated_message_date_field_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const tenant = await setup_isolated_tenant({ users: [{ isAdmin: true }] })
+
+  try {
+    const { sdk } = tenant
+    const userId = tenant.users[0].id
+
+    const fields = Object.fromEntries(DATE_SHAPED_VALUES.map((c, i) => [`DateField${i}`, c.value]))
+    const enduser = await sdk.api.endusers.createOne({
+      fname: 'Date',
+      lname: 'Fields',
+      timezone: 'America/New_York', // the timezone the shifted rendering localized into
+      fields,
+    })
+
+    for (let i = 0; i < DATE_SHAPED_VALUES.length; i++) {
+      const { label, value } = DATE_SHAPED_VALUES[i]
+      const { plaintext } = await sdk.api.templates.get_templated_message({
+        enduserId: enduser.id,
+        userId,
+        channel: 'Chat',
+        message: `[{{enduser.DateField${i}}}]`,
+      })
+
+      checks.push({
+        label: `${label} renders exactly as stored`,
+        pass: plaintext === `[${value}]`,
+        detail: `stored ${JSON.stringify(value)}, rendered ${JSON.stringify(plaintext)}`,
+      })
+      // A second, independent signal for the specific symptom, so this still catches a shifted
+      // rendering even if the equality check above is ever loosened. Only meaningful for values
+      // that carry no time of their own — an ISO datetime legitimately contains one.
+      if (!LOOKS_REFORMATTED.test(value)) {
+        checks.push({
+          label: `${label} does not gain a clock time`,
+          pass: !LOOKS_REFORMATTED.test(plaintext),
+          detail: `rendered ${JSON.stringify(plaintext)}`,
+        })
+      }
+    }
+
+    // The specific patient-visible symptom, asserted on its own so a failure names it.
+    const { plaintext: dob } = await sdk.api.templates.get_templated_message({
+      enduserId: enduser.id,
+      userId,
+      channel: 'Chat',
+      message: `DOB: {{enduser.DateField0}}`,
+    })
+    checks.push({
+      label: 'a date of birth does not render as the previous day',
+      pass: dob.includes('1985-03-12') && !dob.includes('3/11/1985'),
+      detail: `rendered ${JSON.stringify(dob)}`,
+    })
+
+    // Positive control: if templating itself were broken, every check above would pass vacuously
+    // (an unreplaced `{{enduser.X}}` is neither reformatted nor time-stamped).
+    const { plaintext: control } = await sdk.api.templates.get_templated_message({
+      enduserId: enduser.id,
+      userId,
+      channel: 'Chat',
+      message: `{{enduser.fname}} {{enduser.lname}}`,
+    })
+    checks.push({
+      label: 'control: non-date fields are still templated at all',
+      pass: control === 'Date Fields',
+      detail: `rendered ${JSON.stringify(control)}`,
+    })
+
+    return checks
+  } finally {
+    await tenant.teardown()
+  }
+}
+
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+export const templated_message_date_field_tests = async () => {
+  assert_checks('Templated message date-shaped fields', await templated_message_date_field_checks())
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  templated_message_date_field_tests()
+    .then(() => {
+      console.log("✅ Templated message date field test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Templated message date field test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/templated_message_links.test.ts

@@ -0,0 +1,192 @@
+require('source-map-support').install();
+
+import {
+  assert_checks,
+  Check,
+  setup_isolated_tenant,
+} from "../setup_isolated"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+/**
+ * Link templating through the real `templates.get_templated_message` — the same endpoint the worker
+ * calls on every outbound email and SMS.
+ *
+ * The exhaustive coverage of this path lives in the API's own module test
+ * (`packages/private/api/api/modules/message_templating.test.ts`), which stubs the database so a case
+ * costs microseconds. This suite exists to prove those stubs still describe the real thing: that a
+ * rendered link really is a `/r/<token>` redirect, and that `linkOpenTrackingIds` really is one id per
+ * redirect record created.
+ *
+ * Deliberately small. Every case here writes real `url_redirects` rows, and `teardown_tenant` does not
+ * remove them — that collection is in neither `schema` nor `getInternalQueries()` — so each extra case
+ * leaves rows behind in the database forever.
+ *
+ * Runs standalone or as part of the main suite:
+ *   npm run test:modular -- api_tests/templated_message_links
+ */
+
+/** A tracked link is `<portal or api url>/r/<token>`; the token itself is not predictable. */
+const REDIRECT = /https?:\/\/[^\s"'<>]+\/r\/[A-Za-z0-9_-]+/
+/** Bound on the one case that used to hang the request, so a regression fails instead of stalling. */
+const CLIENT_WAIT_MS = 20_000
+const LINK = 'https://example.com/landing'
+
+const templated_message_link_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const tenant = await setup_isolated_tenant({ users: [{ isAdmin: true }] })
+
+  try {
+    const { sdk } = tenant
+    const userId = tenant.users[0].id
+    const enduser = await sdk.api.endusers.createOne({ fname: 'Link', lname: 'Templating' })
+
+    const templated = (message: string, html: string) => sdk.api.templates.get_templated_message({
+      enduserId: enduser.id, userId, channel: 'Email', message, html,
+    })
+
+    // 1. one link: an anchor in html, "text (url)" in plaintext, one tracking id
+    {
+      const body = `Go: {${LINK}}[Click]`
+      const { html, plaintext, linkOpenTrackingIds } = await templated(body, `<p>${body}</p>`)
+
+      checks.push({
+        label: 'html renders an anchor whose href is a /r/ redirect',
+        pass: new RegExp(`^<p>Go: <a href="${REDIRECT.source}">Click</a></p>$`).test(html),
+        detail: `rendered ${JSON.stringify(html)}`,
+      })
+      checks.push({
+        label: 'plaintext appends the same redirect in parentheses',
+        pass: new RegExp(`^Go: Click \\(${REDIRECT.source}\\)$`).test(plaintext),
+        detail: `rendered ${JSON.stringify(plaintext)}`,
+      })
+      checks.push({
+        label: 'one link creates exactly one redirect record',
+        pass: linkOpenTrackingIds.length === 1,
+        detail: `linkOpenTrackingIds=${JSON.stringify(linkOpenTrackingIds)}`,
+      })
+    }
+
+    // 2. several links: one record each, all replaced
+    {
+      const body = `One {${LINK}/a}[A], two {${LINK}/b}[B], three {${LINK}/c}[C]`
+      const { html, linkOpenTrackingIds } = await templated(body, `<p>${body}</p>`)
+
+      checks.push({
+        label: 'every link in one message is replaced',
+        pass: (html.match(/<a href="/g) || []).length === 3 && !html.includes('{'),
+        detail: `rendered ${JSON.stringify(html)}`,
+      })
+      checks.push({
+        label: 'three links create exactly three redirect records',
+        pass: linkOpenTrackingIds.length === 3,
+        detail: `linkOpenTrackingIds=${JSON.stringify(linkOpenTrackingIds)}`,
+      })
+    }
+
+    // 3. $LINK_ONLY: the bare redirect url, no anchor
+    {
+      const body = `Go: {${LINK}}[$LINK_ONLY]`
+      const { html, plaintext, linkOpenTrackingIds } = await templated(body, `<p>${body}</p>`)
+
+      checks.push({
+        label: '$LINK_ONLY substitutes the bare redirect url',
+        pass: new RegExp(`^<p>Go: ${REDIRECT.source}</p>$`).test(html)
+          && new RegExp(`^Go: ${REDIRECT.source}$`).test(plaintext),
+        detail: `html ${JSON.stringify(html)}, plaintext ${JSON.stringify(plaintext)}`,
+      })
+      checks.push({
+        label: '$LINK_ONLY still creates its redirect record',
+        pass: linkOpenTrackingIds.length === 1,
+        detail: `linkOpenTrackingIds=${JSON.stringify(linkOpenTrackingIds)}`,
+      })
+    }
+
+    // 4. a link merge field resolves to the same {url}[text] form, then to an anchor
+    {
+      const form = await sdk.api.forms.createOne({ title: `Link templating ${Date.now()}` })
+      try {
+        const body = `Start here: {{forms.${form.id}.link:Begin}}`
+        const { html, linkOpenTrackingIds } = await templated(body, `<p>${body}</p>`)
+
+        checks.push({
+          label: 'a form link merge field becomes an anchor on a redirect',
+          pass: new RegExp(`^<p>Start here: <a href="${REDIRECT.source}">Begin</a></p>$`).test(html),
+          detail: `rendered ${JSON.stringify(html)}`,
+        })
+        checks.push({
+          label: 'the form link creates exactly one redirect record',
+          pass: linkOpenTrackingIds.length === 1,
+          detail: `linkOpenTrackingIds=${JSON.stringify(linkOpenTrackingIds)}`,
+        })
+      } finally {
+        await sdk.api.forms.deleteOne(form.id)
+      }
+    }
+
+    // 5. The loop-safety case, end to end. A space between the two halves of a link template is one
+    // find_link matches but the replacement key cannot, and this request used to never come back:
+    // the server looped on that same match, inserting a url_redirects row every time round. The
+    // client-side bound is what turns a regression here into a failure rather than a hung suite.
+    {
+      const body = `Go: {${LINK}} [Click]`
+      const outcome = await Promise.race([
+        templated(body, `<p>${body}</p>`).then(r => r).catch(e => ({ error: e?.message ?? String(e) } as any)),
+        new Promise<any>(resolve => setTimeout(() => resolve({ timedOut: true }), CLIENT_WAIT_MS)),
+      ])
+
+      checks.push({
+        label: 'a template the server cannot replace still returns a response',
+        pass: !outcome.timedOut && !outcome.error,
+        detail: outcome.timedOut
+          ? `no response within ${CLIENT_WAIT_MS}ms — the templating loop stopped terminating`
+          : outcome.error ? `errored: ${outcome.error}` : 'responded',
+      })
+      if (!outcome.timedOut && !outcome.error) {
+        checks.push({
+          label: 'it is left literal in both the html and the plaintext',
+          pass: outcome.html === `<p>${body}</p>` && outcome.plaintext === body,
+          detail: `html ${JSON.stringify(outcome.html)}, plaintext ${JSON.stringify(outcome.plaintext)}`,
+        })
+        checks.push({
+          label: 'and it creates no redirect records at all',
+          pass: outcome.linkOpenTrackingIds.length === 0,
+          detail: `linkOpenTrackingIds=${JSON.stringify(outcome.linkOpenTrackingIds)}`,
+        })
+      }
+    }
+
+    // Positive control: a body with no link syntax is left alone and creates nothing.
+    {
+      const { html, linkOpenTrackingIds } = await templated('No links here', '<p>No links here</p>')
+      checks.push({
+        label: 'control: a body without link syntax is untouched and creates no records',
+        pass: html === '<p>No links here</p>' && linkOpenTrackingIds.length === 0,
+        detail: `rendered ${JSON.stringify(html)}, linkOpenTrackingIds=${JSON.stringify(linkOpenTrackingIds)}`,
+      })
+    }
+
+    return checks
+  } finally {
+    await tenant.teardown()
+  }
+}
+
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+export const templated_message_link_tests = async () => {
+  assert_checks('Templated message links', await templated_message_link_checks())
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  templated_message_link_tests()
+    .then(() => {
+      console.log("✅ Templated message link test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Templated message link test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/time_tracks.test.ts

@@ -6,7 +6,7 @@ import { setup_tests } from "../setup"
 
 const log = console.log
 
-const host = process.env.REACT_APP_TELLESCOPE_API_URL || 'http://localhost:8080'
+const host = process.env.API_URL || process.env.REACT_APP_TELLESCOPE_API_URL || 'http://localhost:8080'
 
 // Helper to assert that an async function throws an error
 const assert_throws = async (fn: () => Promise<any>, description: string) => {

package/src/tests/api_tests/user_portal_settings.test.ts

@@ -10,7 +10,7 @@ import {
 import { setup_tests } from "../setup"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
-const businessId = '60398b1131a295e64f084ff6'
+const businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6'
 
 // Main test function that can be called independently
 export const user_portal_settings_tests = async ({ sdk, sdkNonAdmin }: { sdk: Session, sdkNonAdmin: Session }) => {

package/src/tests/api_tests/validation_behavior_locks.test.ts

@@ -0,0 +1,204 @@
+import { dateValidator, dateOptionalOrEmptyStringValidator, dateValidatorOptional, slugValidator, urlValidator } from "@tellescope/validation"
+
+// Pins the accept-sets of the validators whose behavior is delegated to the `validator` package, so
+// a dependency upgrade cannot move what the API accepts without a test failing.
+//
+// These assertions describe PRODUCTION — deliberately, including the parts that are wrong. Two of
+// them are: a bare `YYYY-MM-DD` is rejected while an ISO datetime is accepted, and an unparseable
+// string is accepted and persisted as an `Invalid Date`. Both predate this work and both are
+// API-visible across ~135 schema fields, so changing them belongs in its own PR. Pinning them is
+// what makes this file useful: it is proof of how the deployed API behaves, not an aspiration.
+//
+// Why it was needed. Validator 13.11.0's `isDate` was timezone-dependent — its last step compared a
+// UTC-parsed date against a local-time `.getDate()` — so it answered false west of Greenwich and
+// true in UTC. The servers run UTC, so the behavior pinned below is what production has been doing,
+// while the same code on a US developer's machine did the opposite. 13.12.0 fixed that (#2257), and
+// 13.15.35 was verified to return exactly what 13.11.0 returned under UTC, across 26 inputs and four
+// timezones. So every assertion here holds in EVERY timezone — that is the point of the file, and
+// the reason it can be trusted as a statement about production while running on a laptop.
+//
+// The `isSlug` half is different: 13.15.35 genuinely narrowed it (lowercase-only, alphanumeric ends,
+// 1-character minimum), which would have moved the subdomain accept-set. `validation.ts` pins
+// 13.11.0's pattern inline instead, and the checks below are that pattern.
+//
+// The `isURL` half (section 5) is neither: 13.11.0 and 13.15.35 were compared across 37 URL inputs
+// and agreed on every one, so nothing was at risk in that upgrade and nothing needed pinning inline.
+// It is here as a forward guard — webhook destinations are customer-configured and an accept-set that
+// narrows silently breaks live integrations — and because the staging QA asserted this behavior with
+// no test behind it. `isURL` reads no clock, so that section has no timezone caveat.
+//
+// Pure-function test — no Session needed. Runs as part of the main suite and standalone:
+//   npm run test:modular -- api_tests/validation_behavior_locks
+//   TZ=UTC npm run test:modular -- api_tests/validation_behavior_locks   (must give the same result)
+
+// Every assertion runs before anything throws, so one run reports the complete diff rather than the
+// first case that happened to trip.
+const failures: string[] = []
+
+const accepts = (label: string, validate: (v: any) => any, value: any) => {
+  try { validate(value) }
+  catch (err: any) { failures.push(`${label}: expected to ACCEPT ${JSON.stringify(value)}, but it was rejected (${err?.message || err})`) }
+}
+
+const rejects = (label: string, validate: (v: any) => any, value: any) => {
+  let accepted = false
+  try { validate(value); accepted = true }
+  catch { /* expected */ }
+  if (accepted) failures.push(`${label}: expected to REJECT ${JSON.stringify(value)}, but it was accepted`)
+}
+
+export const validation_behavior_lock_tests = async () => {
+  console.log(`Running validation behavior lock tests (TZ=${process.env.TZ || Intl.DateTimeFormat().resolvedOptions().timeZone})`)
+
+  const date = dateValidator.validate()
+  const dateOptional = dateValidatorOptional.validate()
+  const dateOrEmpty = dateOptionalOrEmptyStringValidator.validate()
+
+  // -----------------------------------------------------------------------------------------------
+  // 1. Date fields: ISO datetimes are accepted
+  // -----------------------------------------------------------------------------------------------
+  // What the SDK sends, since JSON.stringify turns a Date into one of these.
+  for (const value of [
+    '2024-06-15T14:30:00Z',
+    '2024-06-15T00:00:00.000Z',
+    '2024-06-15T14:30:00+05:00',
+  ]) {
+    accepts('dateValidator', date, value)
+    accepts('dateValidatorOptional', dateOptional, value)
+    accepts('dateOptionalOrEmptyStringValidator', dateOrEmpty, value)
+  }
+
+  // Epoch milliseconds round-trip through `new Date()`.
+  accepts('dateValidator', date, 1718400000000)
+
+  // The empty string is the "cleared" value for the two lenient variants only.
+  accepts('dateOptionalOrEmptyStringValidator', dateOrEmpty, '')
+  rejects('dateValidator', date, '')
+
+  // -----------------------------------------------------------------------------------------------
+  // 2. Date fields: a bare calendar date is REJECTED
+  // -----------------------------------------------------------------------------------------------
+  // Surprising, and not a typo. `isDate` returns true for these and the check is inverted, so they
+  // 400. This is long-standing production behavior; it is pinned, not endorsed. A client sending
+  // `"1985-03-12"` to a date field gets an error and must send an ISO datetime instead.
+  for (const value of ['1985-03-12', '2024-01-01', '2026-10-01', '2000-02-29', '1999/12/31']) {
+    rejects('dateValidator', date, value)
+    rejects('dateValidatorOptional', dateOptional, value)
+  }
+
+  // A real Date object is rejected by the same mechanism (isDate is true for one). Nothing sends a
+  // Date over HTTP, so this only reaches internal callers — but the three validators disagree here:
+  // the `dateOrEmpty` variant coerces with `.toString()` first, producing "Sat Jun 15 2024 ...",
+  // which isDate calls false, so it accepts. Pinned because it is a real inconsistency.
+  rejects('dateValidator', date, new Date('2024-06-15T14:30:00Z'))
+  rejects('dateValidatorOptional', dateOptional, new Date('2024-06-15T14:30:00Z'))
+  accepts('dateOptionalOrEmptyStringValidator', dateOrEmpty, new Date('2024-06-15T14:30:00Z'))
+
+  // -----------------------------------------------------------------------------------------------
+  // 3. Date fields: an unparseable string is ACCEPTED and stored as an Invalid Date
+  // -----------------------------------------------------------------------------------------------
+  // A data-corruption path, pinned so it is documented and so a future fix is a deliberate, visible
+  // change rather than a silent one. `new Date('not a date')` is an Invalid Date, and it is what
+  // gets written.
+  for (const value of ['not a date', 'hello world', 'tomorrow', '??']) {
+    accepts('dateValidator', date, value)
+    accepts('dateValidatorOptional', dateOptional, value)
+    accepts('dateOptionalOrEmptyStringValidator', dateOrEmpty, value)
+  }
+
+  // -----------------------------------------------------------------------------------------------
+  // 4. Organization subdomain
+  // -----------------------------------------------------------------------------------------------
+  const slug = slugValidator.validate()
+
+  // Valid, and must stay valid — 13.15.35's isSlug would reject the mixed-case ones.
+  for (const value of ['acme', 'acme-health', 'tellescope-demo', 'demo_org_1', 'Acme', 'My-Org', 'TellescopeDemo', 'abc']) {
+    accepts('slugValidator', slug, value)
+  }
+
+  // Also accepted today, though none of these are valid DNS labels. Pinned so the upgrade does not
+  // quietly change them; tightening is a separate decision.
+  for (const value of ['acme.health', 'org/sub', 'my@org', 'org?x=1']) {
+    accepts('slugValidator', slug, value)
+  }
+
+  // Rejected today — note 13.15.35's isSlug would ACCEPT the 1- and 2-character cases.
+  for (const value of ['a', 'ab', 'my--org', 'my__org', '-acme', 'acme-', 'org name']) {
+    rejects('slugValidator', slug, value)
+  }
+
+  // -----------------------------------------------------------------------------------------------
+  // 5. Webhook and other URL fields
+  // -----------------------------------------------------------------------------------------------
+  // `urlValidator` is a thin `isURL` passthrough behind `build_validator`, used for webhook
+  // subscriptions (schema `webhooks.url`) among others. It is a SYNTAX check only — refusing internal
+  // destinations is a separate layer (`api/modules/outbound_url.ts`), which is why several things
+  // accepted here are refused at delivery time.
+  const url = urlValidator.validate()
+
+  // Ports and query strings, the cases the staging QA calls out.
+  for (const value of [
+    'https://example.com:8443/hook',
+    'https://example.com/hook?a=1&b=two',
+    'https://example.com:8443/hook?a=1',
+    'https://example.com/a?b=c&d=%7B%22x%22%3A1%7D', // percent-encoded JSON in the query
+    'https://example.com:443/hook',
+    'https://example.com:8443',                      // port, no path
+    'https://example.com/hook#frag',
+    'HTTPS://EXAMPLE.COM/Hook',
+    'https://[::1]:8443/hook',
+  ]) {
+    accepts('urlValidator', url, value)
+  }
+
+  // Accepted, but quirks rather than intent — pinned like the date quirks above so that tightening any
+  // of them is a deliberate, visible change.
+  //  - schemeless: values of this shape exist in the webhooks collection today (outbound_url.ts:213)
+  //  - ftp: isURL's default protocol list is http/https/ftp
+  //  - the last two are refused by assertPublicHttpUrl at delivery, not here
+  for (const value of [
+    'api.customer.com/hook',
+    'ftp://example.com/x',
+    'http://10.0.0.1/hook',
+    'https://user:pass@example.com/hook',
+  ]) {
+    accepts('urlValidator', url, value)
+  }
+
+  // Rejected. `localhost` fails isURL's require_tld, which defaults on — a local webhook receiver has
+  // to be configured as 127.0.0.1, and that is why the SSRF suite binds loopback by address.
+  for (const value of [
+    'http://localhost:8080/hook',
+    'localhost:8080/hook',
+    'https://example.com:65536/hook',
+    'https://example.com:0/hook',
+    'https://example.com:abc/x',
+    'javascript:alert(1)',
+    'file:///etc/passwd',
+    'mailto:a@b.com',
+    '//example.com/hook',
+    'not a url',
+    'https://example.com/hook with space',
+    'https://example.com./hook', // trailing dot
+  ]) {
+    rejects('urlValidator', url, value)
+  }
+
+  // Non-string and absent values. The empty string is rejected by build_validator's non-empty rule
+  // rather than by isURL, so it is pinned separately from the malformed strings above.
+  rejects('urlValidator', url, '')
+  rejects('urlValidator', url, 123)
+  rejects('urlValidator', url, null)
+  rejects('urlValidator', url, undefined)
+
+  if (failures.length) {
+    throw new Error(`${failures.length} validation behavior lock(s) broken:\n  - ` + failures.join('\n  - '))
+  }
+  console.log("✅ validation behavior lock tests passed")
+}
+
+if (require.main === module) {
+  validation_behavior_lock_tests()
+    .then(() => { console.log("✅ suite completed"); process.exit(0) })
+    .catch((err) => { console.error("❌ suite failed:", err); process.exit(1) })
+}

package/src/tests/public_endpoint_tests.ts

@@ -9,6 +9,7 @@ import {
 } from "@tellescope/utilities"
 import { Session, /* APIQuery */ } from "../sdk"
 import { PublicEndpoints } from "../public"
+import { reset_test_tenant } from "./setup"
 
 const host = process.env.API_URL || 'http://localhost:8080'
 const [email, password] = [process.env.TEST_EMAIL, process.env.TEST_PASSWORD]
@@ -18,7 +19,7 @@ const sdkPub = PublicEndpoints({ host })
 
 if (!(email && password)) {
   console.error("Set TEST_EMAIL and TEST_PASSWORD")
-  process.exit()
+  process.exit(1) // 1, not 0: an unconfigured run must not report success
 }
 
 const enduser_login_tests = async () => {
@@ -59,7 +60,7 @@ const enduser_login_tests = async () => {
 
   try {
     await sdk.authenticate(email, password)
-    await sdk.reset_db()
+    await reset_test_tenant(sdk)
 
     await enduser_login_tests()
   } catch(err) {