@tellescope/sdk 1.256.16 → 2.0.0-beta.1

package/src/tests/api_tests/mdi_case_offerings.test.ts

@@ -91,10 +91,41 @@ const resolve_displayed_options = (
   ) ? field.options.choices : undefined
 }
 
+// Local replica of the API's mdiIgnore handling (md_integrations.ts): the same field lookup
+// (_id first, externalId fallback — Formsort / form-ingestion answers carry no fieldId), with
+// patient-mapped fields exempt. Used to filter both case_questions and case file uploads.
+type IgnorableField = { _id: string, externalId?: string, mdiIgnore?: boolean }
+type IgnorableResponse = { fieldId?: string, externalId?: string, answer: { type?: string } }
+
+const is_mdi_ignored = (response: IgnorableResponse, formFields: IgnorableField[]): boolean => {
+  if (response.externalId && PATIENT_MAPPED_EXTERNAL_IDS.has(response.externalId)) return false
+  const field = (
+       formFields.find(f => f._id.toString() === response.fieldId)
+    || formFields.find(f => response.externalId && f.externalId === response.externalId)
+  )
+  return !!field?.mdiIgnore
+}
+
+const case_question_responses = (responses: IgnorableResponse[], formFields: IgnorableField[]) => (
+  responses.filter(r =>
+       r.answer.type !== 'file' && r.answer.type !== 'files'
+    && !(r.externalId && PATIENT_MAPPED_EXTERNAL_IDS.has(r.externalId))
+    && !is_mdi_ignored(r, formFields)
+  )
+)
+
+const uploadable_file_responses = (responses: IgnorableResponse[], formFields: IgnorableField[]) => (
+  responses.filter(r =>
+       (r.answer.type === 'file' || r.answer.type === 'files')
+    && !is_mdi_ignored(r, formFields)
+  )
+)
+
 export const mdi_case_offerings_tests = async ({ sdk, sdkNonAdmin }: { sdk: Session, sdkNonAdmin: Session }) => {
   log_header("MDI Case Offerings Tests")
 
   let testFormId: string | undefined
+  let testFieldId: string | undefined
 
   try {
     // --- Schema round-trip tests ---
@@ -385,7 +416,114 @@ export const mdi_case_offerings_tests = async ({ sdk, sdkNonAdmin }: { sdk: Sess
       },
       { expectedResult: true }
     )
+
+    // --- mdiIgnore tests ---
+
+    await async_test(
+      "Form field mdiIgnore round-trips through create and update",
+      async () => {
+        if (!testFormId) throw new Error("No test form")
+
+        const field = await sdk.api.form_fields.createOne({
+          formId: testFormId,
+          title: 'Offering IDs',
+          type: 'string',
+          externalId: 'offeringIds',
+          mdiIgnore: true,
+          previousFields: [{ type: 'root', info: {} }],
+        })
+        testFieldId = field.id
+        const created = await sdk.api.form_fields.getOne(field.id)
+
+        await sdk.api.form_fields.updateOne(field.id, { mdiIgnore: false })
+        const updated = await sdk.api.form_fields.getOne(field.id)
+
+        return created.mdiIgnore === true && updated.mdiIgnore === false
+      },
+      { expectedResult: true }
+    )
+
+    const IGNORE_FIELDS: IgnorableField[] = [
+      { _id: 'field-ignored', externalId: 'internal_note', mdiIgnore: true },
+      { _id: 'field-offerings', externalId: 'offeringIds', mdiIgnore: true },
+      { _id: 'field-kept', externalId: 'symptoms' },
+      { _id: 'field-kept-explicit', externalId: 'duration', mdiIgnore: false },
+      { _id: 'field-allergies', externalId: 'allergies', mdiIgnore: true }, // patient-mapped → exempt
+      { _id: 'field-ignored-upload', externalId: 'internal_upload', mdiIgnore: true },
+      { _id: 'field-kept-upload', externalId: 'mdi:lab-result' },
+    ]
+
+    await async_test(
+      "mdiIgnore drops native form answers (matched by fieldId) from case_questions",
+      async () => {
+        const kept = case_question_responses([
+          { fieldId: 'field-ignored', answer: { type: 'string' } },
+          { fieldId: 'field-kept', answer: { type: 'string' } },
+          { fieldId: 'field-kept-explicit', answer: { type: 'string' } },
+        ], IGNORE_FIELDS)
+        return kept.length === 2 && kept.every(r => r.fieldId !== 'field-ignored')
+      },
+      { expectedResult: true }
+    )
+
+    await async_test(
+      "mdiIgnore drops Formsort / form-ingestion answers (matched by externalId) from case_questions",
+      async () => {
+        const kept = case_question_responses([
+          { fieldId: '', externalId: 'offeringIds', answer: { type: 'string' } },
+          { fieldId: '', externalId: 'symptoms', answer: { type: 'string' } },
+          { fieldId: '', externalId: 'unconfigured_key', answer: { type: 'string' } }, // no field → kept
+        ], IGNORE_FIELDS)
+        return (
+          kept.length === 2
+          && !kept.some(r => r.externalId === 'offeringIds')
+          && kept.some(r => r.externalId === 'unconfigured_key')
+        )
+      },
+      { expectedResult: true }
+    )
+
+    await async_test(
+      "mdiIgnore does not affect patient-mapped fields",
+      async () => (
+        !is_mdi_ignored({ fieldId: 'field-allergies', externalId: 'allergies', answer: { type: 'string' } }, IGNORE_FIELDS)
+      ),
+      { expectedResult: true }
+    )
+
+    await async_test(
+      "mdiIgnore skips file uploads for ignored fields only",
+      async () => {
+        const uploadable = uploadable_file_responses([
+          { fieldId: 'field-ignored-upload', answer: { type: 'file' } },
+          { fieldId: '', externalId: 'internal_upload', answer: { type: 'files' } },
+          { fieldId: 'field-kept-upload', answer: { type: 'file' } },
+        ], IGNORE_FIELDS)
+        return uploadable.length === 1 && uploadable[0].fieldId === 'field-kept-upload'
+      },
+      { expectedResult: true }
+    )
+
+    await async_test(
+      "mdiIgnore does not stop offering conditions from reading the answer",
+      async () => {
+        const offerings: MDIOffering[] = [
+          { offering_id: "03b7", conditions: { condition: { offeringIds: { $contains: "03b7" } as any } } },
+        ]
+        const responses = [{ externalId: 'offeringIds', value: '1d15,03b7,03b7' }]
+        const resolved = resolve_case_offerings(offerings, responses)
+        const questions = case_question_responses(
+          [{ fieldId: '', externalId: 'offeringIds', answer: { type: 'string' } }],
+          IGNORE_FIELDS,
+        )
+        return resolved.length === 1 && questions.length === 0
+      },
+      { expectedResult: true }
+    )
   } finally {
+    if (testFieldId) {
+      await sdk.api.form_fields.deleteOne(testFieldId).catch(console.error)
+    }
     if (testFormId) {
       await sdk.api.forms.deleteOne(testFormId).catch(console.error)
     }

package/src/tests/api_tests/mdi_webhooks.test.ts

@@ -75,6 +75,15 @@ export const mdi_webhooks_tests = async ({ sdk, sdkNonAdmin }: { sdk: Session, s
     )
     assert(status === 401, `message_created with bad auth should 401 (got ${status})`, "MDI webhook authenticates before patient lookup")
   }
+
+  // 5. case_order_created / case_order_updated with bogus auth -> still 401.
+  for (const event_type of ['case_order_created', 'case_order_updated']) {
+    const { status } = await postMDI(
+      { event_type, case_id: 'mdi-case-test-1', case_order_id: 'mdi-order-test-1', order_status: 'ready' },
+      { 'Authorization': `Bearer not-a-real-mdi-token-${Date.now()}` },
+    )
+    assert(status === 401, `${event_type} with bad auth should 401 (got ${status})`, `MDI webhook authenticates before ${event_type} dispatch`)
+  }
 }
 
 // Allow running this test file independently

package/src/tests/api_tests/nutrition_tracking.test.ts

@@ -9,7 +9,7 @@ import { ObservationComponent } from "@tellescope/types-models"
 import { authenticate_enduser_via_token, setup_tests } from "../setup"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
-const businessId = '60398b1131a295e64f084ff6'
+const businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6'
 
 const ENDUSER_PASSWORD = 'NutritionTestPassword!123'
 

package/src/tests/api_tests/openloop_webhooks.test.ts

@@ -10,7 +10,7 @@ import {
 import { setup_tests } from "../setup"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
-const businessId = '60398b1131a295e64f084ff6'
+const businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6'
 
 const v1Url = `${host}/v1/webhooks/openloop/${businessId}`
 const v2Url = `${host}/v1/webhooks/openloop-v2/${businessId}`

package/src/tests/api_tests/security/add-to-journey-foreign-enduserid.test.ts

@@ -5,6 +5,7 @@ import {
   Check,
   setup_isolated_tenant,
 } from "../../setup_isolated"
+import { poll_for_results } from "@tellescope/testing"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
@@ -97,6 +98,11 @@ export const add_to_journey_foreign_enduserid_checks = async (): Promise<Check[]
       await attacker!.sdk.api.automated_actions.getSome({ filter: { journeyId } } as any)
     )
     const enduserIdsFor = async (journeyId: string) => (await rowsFor(journeyId)).map((r: any) => r.enduserId)
+    // add_to_journey's automated_actions.insertMany is fire-and-forget on both branches, so the 204
+    // can arrive before the rows exist: poll until the expected id shows (last read on timeout)
+    const enduserIdsForOnceContains = (journeyId: string, enduserId: string) => (
+      poll_for_results(() => enduserIdsFor(journeyId), ids => ids.includes(enduserId))
+    )
 
     /* ===== A: the foreign id must never be planted, on EITHER branch ===== */
 
@@ -108,13 +114,6 @@ export const add_to_journey_foreign_enduserid_checks = async (): Promise<Check[]
       startAt: FUTURE_START(),
     } as any).then(() => 'resolved').catch((e: any) => `rejected: ${e?.message || e}`)
 
-    const inlineIds = await enduserIdsFor(inline.journey.id)
-    record(
-      'A1: inline branch (automationStepId) does not plant a foreign enduserId',
-      !inlineIds.includes(victim.id),
-      `call=${inlineResult}; automated_actions enduserIds=${JSON.stringify(inlineIds)} (must not contain ${victim.id})`,
-    )
-
     // A2 — module branch: no automationStepId, so it routes through handle_automation_event
     const moduleResult = await attacker.sdk.api.endusers.add_to_journey({
       enduserIds: [victim.id],
@@ -122,22 +121,6 @@ export const add_to_journey_foreign_enduserid_checks = async (): Promise<Check[]
       startAt: FUTURE_START(),
     } as any).then(() => 'resolved').catch((e: any) => `rejected: ${e?.message || e}`)
 
-    const moduleIds = await enduserIdsFor(modulePath.journey.id)
-    record(
-      'A2: module branch (no automationStepId) does not plant a foreign enduserId',
-      !moduleIds.includes(victim.id),
-      `call=${moduleResult}; automated_actions enduserIds=${JSON.stringify(moduleIds)} (must not contain ${victim.id})`,
-    )
-
-    // A3 — the victim's own record must be untouched (the scoped updateMany should already ensure it)
-    const victimAfter = await victimTenant.sdk.api.endusers.getOne(victim.id)
-    const victimJourneys = (victimAfter as any)?.journeys ?? {}
-    record(
-      'A3: the victim enduser was not enrolled in the attacker\'s journey',
-      !victimJourneys[inline.journey.id] && !victimJourneys[modulePath.journey.id],
-      `victim journeys=${JSON.stringify(victimJourneys)}`,
-    )
-
     /* ===== B: legitimate use must keep working ===== */
 
     // B1 — positive control on both branches, so a blanket failure can't masquerade as a fix
@@ -153,8 +136,32 @@ export const add_to_journey_foreign_enduserid_checks = async (): Promise<Check[]
       startAt: FUTURE_START(),
     } as any)
 
-    const inlineOwn = await enduserIdsFor(inline.journey.id)
-    const moduleOwn = await enduserIdsFor(modulePath.journey.id)
+    const inlineOwn = await enduserIdsForOnceContains(inline.journey.id, own.id)
+    const moduleOwn = await enduserIdsForOnceContains(modulePath.journey.id, own.id)
+
+    // A1/A2 are judged against the post-B1 reads: those include every row for the journey, and the
+    // legitimate insert having landed is what makes the victim's absence meaningful rather than
+    // "not written yet"
+    record(
+      'A1: inline branch (automationStepId) does not plant a foreign enduserId',
+      !inlineOwn.includes(victim.id),
+      `call=${inlineResult}; automated_actions enduserIds=${JSON.stringify(inlineOwn)} (must not contain ${victim.id})`,
+    )
+    record(
+      'A2: module branch (no automationStepId) does not plant a foreign enduserId',
+      !moduleOwn.includes(victim.id),
+      `call=${moduleResult}; automated_actions enduserIds=${JSON.stringify(moduleOwn)} (must not contain ${victim.id})`,
+    )
+
+    // A3 — the victim's own record must be untouched (the scoped updateMany should already ensure it)
+    const victimAfter = await victimTenant.sdk.api.endusers.getOne(victim.id)
+    const victimJourneys = (victimAfter as any)?.journeys ?? {}
+    record(
+      'A3: the victim enduser was not enrolled in the attacker\'s journey',
+      !victimJourneys[inline.journey.id] && !victimJourneys[modulePath.journey.id],
+      `victim journeys=${JSON.stringify(victimJourneys)}`,
+    )
+
     record(
       'B1: the caller\'s OWN enduser still enrolls on both branches',
       inlineOwn.includes(own.id) && moduleOwn.includes(own.id),
@@ -170,7 +177,7 @@ export const add_to_journey_foreign_enduserid_checks = async (): Promise<Check[]
       startAt: FUTURE_START(),
     } as any).then(() => 'resolved').catch((e: any) => `rejected: ${e?.message || e}`)
 
-    const mixedIds = await enduserIdsFor(mixed.journey.id)
+    const mixedIds = await enduserIdsForOnceContains(mixed.journey.id, own.id)
     record(
       'B2: a mixed list enrolls the visible enduser and drops only the foreign one',
       mixedIds.includes(own.id) && !mixedIds.includes(victim.id),

package/src/tests/api_tests/security/allowed-paths-confinement.test.ts

@@ -631,7 +631,7 @@ export const allowed_paths_confinement_tests = async ({ sdk } : { sdk: Session,
     // record. `allowedPaths` is a JWT claim only (WithAllowedPaths in types-models is used solely on
     // the session type; there is no schema validator for it), so an API-key session can never carry
     // one and is never path-confined. Assert that rather than reason about it.
-    const apiKeySDK = new Session({ host, apiKey: '3n5q0SCBT_iUvZz-b9BJtX7o7HQUVJ9v132PgHJNJsg.' })
+    const apiKeySDK = new Session({ host, apiKey: process.env.TEST_API_KEY || '3n5q0SCBT_iUvZz-b9BJtX7o7HQUVJ9v132PgHJNJsg.' })
     for (const path of ['/journeys', '/form-responses', '/endusers', '/calendar-events', '/files']) {
       const r = await axios.request({
         method: 'get',