@tellescope/sdk 1.256.16 → 2.0.0-beta.1

package/src/tests/api_tests/security/appointment-reschedule-ownership.test.ts

@@ -0,0 +1,432 @@
+require('source-map-support').install();
+
+import {
+  assert_checks,
+  Check,
+  setup_isolated_tenant,
+} from "../../setup_isolated"
+import { EnduserSession } from "../../../sdk"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
+const userAttendeeIds = (event: any): string[] => (event?.attendees ?? []).filter((a: any) => a.type === 'user').map((a: any) => a.id)
+const enduserAttendees = (event: any): any[] => (event?.attendees ?? []).filter((a: any) => a.type === 'enduser')
+/** the first enduser attendee — what routing.ts get_enduserId, event_handlers_v2, the EHR syncs and
+ *  session_for_join_link all resolve as "the patient for this event" */
+const primaryEnduserId = (event: any): string => enduserAttendees(event)[0]?.id ?? ''
+
+/**
+ * `calendar_events.book_appointment` must not act on a `rescheduledCalendarEventId` belonging to
+ * another patient.
+ *
+ * The handler loaded the reschedule target with `buildOrganizationWideQueries`, which is
+ * `buildAllQueries({ unrestricted: true })` and therefore never applies the `attendees.id` access
+ * constraint calendar_events declares — the effective filter was businessId only. Any authenticated
+ * enduser could pass a co-tenant's event id and (a) have that event stamped
+ * `rescheduledAt` / `rescheduledTo`, which the portal renders as "rescheduled or deleted", (b) have
+ * the victim attached as the primary enduser attendee of the replacement event, carrying the
+ * victim's `joinLinkToken` (a capability that resolves an event by token), and (c) receive the whole
+ * stored document back, including the victim's staff-authored `internalNotes`.
+ *
+ * Both lookup sites are guarded: the initial load and the re-lookup that performs the
+ * `rescheduledAt` write. A guard on only the first leaves the write path reachable.
+ *
+ * Also covered here, because they are the same "the portal UI was the only gate" bug:
+ *   - `preventRescheduleInPortal` / `preventRescheduleMinutesInAdvance` were enforced only by
+ *     portal/src/pages/Events.tsx, so a direct API call ignored both even for the owner.
+ *   - Group events (`enduserAttendeeLimit > 1`): being an attendee is necessary but not sufficient,
+ *     since any attendee rescheduling moves the appointment for everyone. The server now mirrors the
+ *     portal's gate — a group event is reschedulable only when the template set
+ *     `allowGroupReschedule`. The attendee the appointment belongs to (the first enduser attendee) is
+ *     preserved on the replacement event, so a co-attendee rescheduling does not re-point the
+ *     appointment at themselves. Carrying the REMAINING co-attendees over is unchanged pre-existing
+ *     behaviour: they come along only when `replaceHostOnReschedule` is false, and not at all on the
+ *     group-join branch, where a reschedule landing on an existing group event only appends the caller.
+ *
+ * Sections: A cross-enduser attempt, B the owner's own reschedule, C the reschedule window, D group
+ * events, E the caregiver / related-contact flow, F both replaceHostOnReschedule branches (E and F are
+ * regression controls — F mirrors tests.ts ~7372-7460, which only runs against the shared seeded
+ * tenant, and the attendee-copy loop changed here).
+ *
+ * RED (pre-fix): A1-A3 fail (the victim's event is stamped and a replacement carries them), C1/C2 and
+ * D1 fail (no server-side enforcement at all). GREEN: every positive control (B, D2, E, F) still
+ * passes, before and after.
+ */
+export const appointment_reschedule_ownership_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+
+  try {
+    tenant = await setup_isolated_tenant({
+      name: `reschedule ownership ${RAND()}`,
+      users: [{ isAdmin: true }, { isAdmin: true }],
+      apiKeys: 0,
+    })
+    const sdk = tenant.sdk
+    const secondHostId = tenant.users[1].id
+
+    /* ================= fixtures: one host with a full day of availability ================= */
+
+    // deliberately not today, so "now" can never fall inside the availability window
+    const dayOfWeekStartingSundayIndexedByZero = (new Date().getDay() + 1) % 7
+    const availability = {
+      weeklyAvailabilities: [{
+        dayOfWeekStartingSundayIndexedByZero,
+        startTimeInMinutes: 60 * 9,  // 9am
+        endTimeInMinutes: 60 * 17,   // 5pm — 16 half-hour slots per occurrence
+      }],
+      timezone: 'America/New_York' as const,
+    }
+    // both hosts, so the replaceHostOnReschedule branches below have a second user to swap in
+    await sdk.api.users.updateOne(sdk.userInfo.id, availability, { replaceObjectFields: true })
+    await sdk.api.users.updateOne(secondHostId, availability, { replaceObjectFields: true })
+
+    const makeTemplate = (extra: object = {}) => sdk.api.calendar_event_templates.createOne({
+      title: `reschedule test ${RAND()}`,
+      durationInMinutes: 30,
+      confirmationEmailDisabled: true,
+      confirmationSMSDisabled: true,
+      ...extra,
+    } as any)
+
+    const makeEnduser = async (label: string) => {
+      const enduser = await sdk.api.endusers.createOne({
+        email: `reschedule_${label}_${Date.now()}_${RAND()}@test.tellescope.com`,
+      })
+      const { authToken } = await sdk.api.endusers.generate_auth_token({ id: enduser.id })
+      const session = new EnduserSession({ host, authToken, enduser, businessId: tenant!.businessId })
+      return { enduser, session }
+    }
+
+    const [victim, attacker] = await Promise.all([makeEnduser('victim'), makeEnduser('attacker')])
+
+    // Every template here is a plain 30-minute one with no restrictions, so one availability query
+    // describes them all. Slots are handed out from that pool and never reused — deriving each booking
+    // from a fresh "earliest available" query instead makes the suite race with its own bookings
+    // (a booking from one template can land on a slot another template still advertises).
+    const slotTemplate = await makeTemplate()
+    const { availabilityBlocks: allBlocks } = await victim.session.api.calendar_events.get_appointment_availability({
+      calendarEventTemplateId: slotTemplate.id,
+      from: new Date(Date.now() - 10000),
+      to: new Date(Date.now() + 15 * 24 * 60 * 60 * 1000),
+    })
+    const startTimes = allBlocks.map(b => b.startTimeInMS).filter((t, i, all) => all.indexOf(t) === i).sort((a, b) => a - b)
+    const hostsByStartTime = new Map(startTimes.map(t => [t, allBlocks.filter(b => b.startTimeInMS === t).map(b => b.userId)]))
+    const usedStartTimes = new Set<number>()
+
+    /** an unused start time this host is free for; the whole start time is consumed, for every host,
+     *  because a multi-host booking takes the slot off all of them */
+    const takeSlot = (hostId?: string) => {
+      const startTimeInMS = startTimes.find(t => (
+        !usedStartTimes.has(t) && (!hostId || (hostsByStartTime.get(t) ?? []).includes(hostId))
+      ))
+      if (startTimeInMS === undefined) throw new Error(`no unused availability left${hostId ? ` for host ${hostId}` : ''}`)
+      usedStartTimes.add(startTimeInMS)
+      return { startTimeInMS, userId: hostId || (hostsByStartTime.get(startTimeInMS) ?? [])[0] }
+    }
+
+    const book = async (as: EnduserSession, templateId: string, opts: { startTimeInMS?: number, userId?: string, hostId?: string, otherUserIds?: string[], bookingPageId?: string, rescheduledCalendarEventId?: string } = {}) => {
+      const slot = opts.startTimeInMS !== undefined && opts.userId
+        ? { startTimeInMS: opts.startTimeInMS, userId: opts.userId }
+        : takeSlot(opts.hostId)
+      return (await as.api.calendar_events.book_appointment({
+        calendarEventTemplateId: templateId,
+        startTime: new Date(slot.startTimeInMS),
+        userId: slot.userId,
+        ...opts.otherUserIds ? { otherUserIds: opts.otherUserIds } : {},
+        ...opts.bookingPageId ? { bookingPageId: opts.bookingPageId } : {},
+        ...opts.rescheduledCalendarEventId ? { rescheduledCalendarEventId: opts.rescheduledCalendarEventId } : {},
+      })).createdEvent
+    }
+
+    /** runs a booking and reports either the created event or a flattened error payload */
+    const attempt = async (run: () => Promise<any>) => (
+      run()
+      .then((createdEvent: any) => ({ rejected: false, createdEvent, payload: '' }))
+      .catch((err: any) => ({
+        rejected: true,
+        createdEvent: undefined,
+        payload: (() => {
+          try { return JSON.stringify({ data: err?.response?.data, message: err?.message }) }
+          catch { return String(err?.message || err) }
+        })(),
+      }))
+    )
+
+    const template = slotTemplate
+
+    /* ================= A: a co-tenant's event is untouchable ================= */
+
+    const victimEvent = await book(victim.session, template.id)
+    const INTERNAL_NOTE = `staff-only note ${RAND()} not visible to another patient`
+    await sdk.api.calendar_events.updateOne(victimEvent.id, { internalNotes: INTERNAL_NOTE })
+    const victimJoinToken = victimEvent.attendees.find(a => a.type === 'enduser')?.joinLinkToken || ''
+
+    record(
+      'setup: victim booked an appointment with a joinLinkToken and staff internalNotes',
+      !!victimEvent.id && !!victimJoinToken
+        && victimEvent.attendees.some(a => a.type === 'enduser' && a.id === victim.enduser.id),
+      `event=${victimEvent.id} attendees=${JSON.stringify(victimEvent.attendees.map(a => ({ type: a.type, id: a.id })))}`,
+    )
+
+    const eventsWithVictimBefore = (await sdk.api.calendar_events.getSome({ limit: 100 }))
+      .filter(e => e.attendees.some(a => a.id === victim.enduser.id))
+      .map(e => e.id)
+
+    const crossAttempt = await attempt(() => book(attacker.session, template.id, {
+      rescheduledCalendarEventId: victimEvent.id,
+    }))
+
+    record(
+      'A1: another enduser\'s book_appointment with the victim\'s rescheduledCalendarEventId is rejected',
+      crossAttempt.rejected,
+      crossAttempt.rejected
+        ? `rejected: ${crossAttempt.payload}`
+        : `WRONGLY SUCCEEDED, created ${crossAttempt.createdEvent?.id}`,
+    )
+
+    const victimEventAfter = await sdk.api.calendar_events.getOne(victimEvent.id)
+    record(
+      'A2: the victim\'s event is not stamped rescheduledAt / rescheduledTo',
+      !victimEventAfter.rescheduledAt && !victimEventAfter.rescheduledTo,
+      `rescheduledAt=${String(victimEventAfter.rescheduledAt)} rescheduledTo=${String(victimEventAfter.rescheduledTo)}`,
+    )
+
+    const eventsWithVictimAfter = (await sdk.api.calendar_events.getSome({ limit: 100 }))
+      .filter(e => e.attendees.some(a => a.id === victim.enduser.id))
+      .map(e => e.id)
+    record(
+      'A3: no replacement event was created with the victim as an attendee',
+      eventsWithVictimAfter.length === eventsWithVictimBefore.length
+        && eventsWithVictimAfter.every(id => eventsWithVictimBefore.includes(id)),
+      `before=${JSON.stringify(eventsWithVictimBefore)} after=${JSON.stringify(eventsWithVictimAfter)}`,
+    )
+
+    record(
+      'A4: the rejection carries none of the victim\'s internalNotes, joinLinkToken or reminder config',
+      !crossAttempt.payload.includes(INTERNAL_NOTE)
+        && !(victimJoinToken && crossAttempt.payload.includes(victimJoinToken))
+        && !crossAttempt.payload.includes('"reminders"'),
+      `response=${crossAttempt.payload.slice(0, 400)}`,
+    )
+
+    /* ================= B: the owner's own reschedule still works ================= */
+
+    const ownReschedule = await attempt(() => book(victim.session, template.id, {
+      rescheduledCalendarEventId: victimEvent.id,
+    }))
+    record(
+      'B1: the owner can still reschedule their own appointment',
+      !ownReschedule.rejected && !!ownReschedule.createdEvent?.id,
+      ownReschedule.rejected ? `rejected: ${ownReschedule.payload}` : `created ${ownReschedule.createdEvent.id}`,
+    )
+
+    if (!ownReschedule.rejected) {
+      const replacement = ownReschedule.createdEvent
+      const originalAfter = await sdk.api.calendar_events.getOne(victimEvent.id)
+
+      record(
+        'B2: the original event is stamped rescheduledAt / rescheduledTo -> the replacement',
+        !!originalAfter.rescheduledAt && originalAfter.rescheduledTo === replacement.id,
+        `rescheduledAt=${String(originalAfter.rescheduledAt)} rescheduledTo=${String(originalAfter.rescheduledTo)} replacement=${replacement.id}`,
+      )
+      record(
+        'B3: internalNotes and the attendee set carry over to the replacement',
+        replacement.internalNotes === INTERNAL_NOTE
+          && replacement.attendees.some((a: any) => a.type === 'enduser' && a.id === victim.enduser.id)
+          && replacement.attendees.some((a: any) => a.type === 'user'),
+        `internalNotes=${JSON.stringify(replacement.internalNotes)} attendees=${JSON.stringify(replacement.attendees.map((a: any) => ({ type: a.type, id: a.id })))}`,
+      )
+      record(
+        'B4: the owner stays the primary attendee, keeps their OWN joinLinkToken, and no other enduser is attached',
+        primaryEnduserId(replacement) === victim.enduser.id
+          && replacement.attendees.filter((a: any) => a.type === 'enduser').every((a: any) => a.id === victim.enduser.id)
+          && replacement.attendees.find((a: any) => a.type === 'enduser' && a.id === victim.enduser.id)?.joinLinkToken === victimJoinToken,
+        `enduser attendees=${JSON.stringify(replacement.attendees.filter((a: any) => a.type === 'enduser').map((a: any) => ({ id: a.id, sameToken: a.joinLinkToken === victimJoinToken })))}`,
+      )
+    }
+
+    /* ================= C: reschedule window enforced server-side, not just in the portal ================= */
+
+    const noPortalRescheduleTemplate = await makeTemplate({ preventRescheduleInPortal: true })
+    const noPortalEvent = await book(victim.session, noPortalRescheduleTemplate.id)
+    const noPortalAttempt = await attempt(() => book(victim.session, noPortalRescheduleTemplate.id, {
+      rescheduledCalendarEventId: noPortalEvent.id,
+    }))
+    const noPortalAfter = await sdk.api.calendar_events.getOne(noPortalEvent.id)
+    record(
+      'C1: preventRescheduleInPortal is enforced on a direct API call by the owner',
+      noPortalAttempt.rejected && !noPortalAfter.rescheduledAt,
+      `rejected=${noPortalAttempt.rejected} detail=${noPortalAttempt.payload || `created ${noPortalAttempt.createdEvent?.id}`}`,
+    )
+
+    // 100000 minutes (~69 days) is longer than the booking horizon, so any slot is inside the window
+    const windowTemplate = await makeTemplate({ preventRescheduleMinutesInAdvance: 100000 })
+    const windowEvent = await book(victim.session, windowTemplate.id)
+    const windowAttempt = await attempt(() => book(victim.session, windowTemplate.id, {
+      rescheduledCalendarEventId: windowEvent.id,
+    }))
+    const windowAfter = await sdk.api.calendar_events.getOne(windowEvent.id)
+    record(
+      'C2: preventRescheduleMinutesInAdvance is enforced on a direct API call by the owner',
+      windowAttempt.rejected && !windowAfter.rescheduledAt,
+      `rejected=${windowAttempt.rejected} detail=${windowAttempt.payload || `created ${windowAttempt.createdEvent?.id}`}`,
+    )
+
+    /* ================= D: group events ================= */
+
+    // D1 — no allowGroupReschedule: not reschedulable by anyone, mirroring the portal's own gate
+    const groupTemplate = await makeTemplate({ enduserAttendeeLimit: 2 })
+    const groupEvent = await book(victim.session, groupTemplate.id)
+    await book(attacker.session, groupTemplate.id, {
+      startTimeInMS: groupEvent.startTimeInMS,
+      userId: groupEvent.attendees.find(a => a.type === 'user')!.id,
+    })
+    const groupAttempt = await attempt(() => book(attacker.session, groupTemplate.id, {
+      rescheduledCalendarEventId: groupEvent.id,
+    }))
+    const groupAfter = await sdk.api.calendar_events.getOne(groupEvent.id)
+    record(
+      'D1: a co-attendee cannot reschedule a group event without allowGroupReschedule',
+      groupAttempt.rejected && !groupAfter.rescheduledAt,
+      `rejected=${groupAttempt.rejected} rescheduledAt=${String(groupAfter.rescheduledAt)} detail=${groupAttempt.payload}`,
+    )
+
+    // D2 — allowGroupReschedule: permitted, and the co-attendee is carried over rather than dropped
+    const groupReschedulableTemplate = await makeTemplate({ enduserAttendeeLimit: 2, allowGroupReschedule: true })
+    const groupReschedulable = await book(victim.session, groupReschedulableTemplate.id)
+    await book(attacker.session, groupReschedulableTemplate.id, {
+      startTimeInMS: groupReschedulable.startTimeInMS,
+      userId: groupReschedulable.attendees.find(a => a.type === 'user')!.id,
+    })
+    const groupRescheduleAttempt = await attempt(() => book(attacker.session, groupReschedulableTemplate.id, {
+      rescheduledCalendarEventId: groupReschedulable.id,
+    }))
+    record(
+      'D2: with allowGroupReschedule a co-attendee may reschedule; both attend and the original primary is kept',
+      !groupRescheduleAttempt.rejected
+        && !!groupRescheduleAttempt.createdEvent?.attendees.some((a: any) => a.id === victim.enduser.id)
+        && !!groupRescheduleAttempt.createdEvent?.attendees.some((a: any) => a.id === attacker.enduser.id)
+        // the co-attendee rescheduling must NOT become the event's derived patient
+        && primaryEnduserId(groupRescheduleAttempt.createdEvent) === victim.enduser.id,
+      groupRescheduleAttempt.rejected
+        ? `rejected: ${groupRescheduleAttempt.payload}`
+        : `attendees=${JSON.stringify(groupRescheduleAttempt.createdEvent.attendees.map((a: any) => ({ type: a.type, id: a.id })))}`
+          + ` primaryEnduser=${primaryEnduserId(groupRescheduleAttempt.createdEvent)} (want ${victim.enduser.id})`,
+    )
+
+    /* ================= E: the caregiver / related-contact flow still works ================= */
+
+    // A booking page with includeRelatedContactTypes adds the patient's related contacts as attendees
+    // at booking time, so the attendee-based guard has to keep letting the caregiver reschedule.
+    const caregiver = await makeEnduser('caregiver')
+    await sdk.api.endusers.updateOne(victim.enduser.id, {
+      relationships: [{ type: 'Caregiver', id: caregiver.enduser.id }],
+    } as any, { replaceObjectFields: true })
+
+    const relatedContactTemplate = await makeTemplate()
+    const bookingPage = await sdk.api.appointment_booking_pages.createOne({
+      title: `related contacts ${RAND()}`,
+      locationIds: [],
+      calendarEventTemplateIds: [relatedContactTemplate.id],
+      includeRelatedContactTypes: ['Caregiver'],
+    } as any)
+
+    const relatedContactEvent = await book(victim.session, relatedContactTemplate.id, { bookingPageId: bookingPage.id })
+    record(
+      'E1: a related contact is attached as an attendee at booking time',
+      relatedContactEvent.attendees.some((a: any) => a.id === caregiver.enduser.id),
+      `attendees=${JSON.stringify(relatedContactEvent.attendees.map((a: any) => ({ type: a.type, id: a.id })))} caregiver=${caregiver.enduser.id}`,
+    )
+
+    const caregiverReschedule = await attempt(() => book(caregiver.session, relatedContactTemplate.id, {
+      rescheduledCalendarEventId: relatedContactEvent.id,
+    }))
+    record(
+      'E2: the caregiver can still reschedule, and the PATIENT stays the primary enduser attendee',
+      !caregiverReschedule.rejected
+        && !!caregiverReschedule.createdEvent?.attendees.some((a: any) => a.id === caregiver.enduser.id)
+        // the appointment must still resolve to the patient: EHR sync, triggers/webhooks and
+        // session_for_join_link all read the first enduser attendee
+        && primaryEnduserId(caregiverReschedule.createdEvent) === victim.enduser.id,
+      caregiverReschedule.rejected
+        ? `rejected: ${caregiverReschedule.payload}`
+        : `attendees=${JSON.stringify(caregiverReschedule.createdEvent.attendees.map((a: any) => ({ type: a.type, id: a.id })))}`
+          + ` primaryEnduser=${primaryEnduserId(caregiverReschedule.createdEvent)} (want patient ${victim.enduser.id})`,
+    )
+
+    /* ================= F: replaceHostOnReschedule, both branches ================= */
+
+    // Equivalent to tests.ts ~7372-7460, which only runs against the shared seeded tenant. The
+    // attendee-copy loop changed here, so both branches need coverage that runs anywhere.
+    const preserveHostsTemplate = await makeTemplate({ replaceHostOnReschedule: false })
+    const preserveOriginal = await book(victim.session, preserveHostsTemplate.id, {
+      hostId: sdk.userInfo.id,
+      otherUserIds: [secondHostId],
+    })
+    const preserveReplacement = await attempt(() => book(victim.session, preserveHostsTemplate.id, {
+      hostId: secondHostId,
+      rescheduledCalendarEventId: preserveOriginal.id,
+    }))
+    record(
+      'F1: replaceHostOnReschedule false still preserves both user attendees',
+      !preserveReplacement.rejected
+        && userAttendeeIds(preserveReplacement.createdEvent).length === 2
+        && userAttendeeIds(preserveReplacement.createdEvent).includes(sdk.userInfo.id)
+        && userAttendeeIds(preserveReplacement.createdEvent).includes(secondHostId),
+      preserveReplacement.rejected
+        ? `rejected: ${preserveReplacement.payload}`
+        : `user attendees=${JSON.stringify(userAttendeeIds(preserveReplacement.createdEvent))}`,
+    )
+
+    const replaceHostsTemplate = await makeTemplate({ replaceHostOnReschedule: true })
+    const replaceOriginal = await book(victim.session, replaceHostsTemplate.id, {
+      hostId: sdk.userInfo.id,
+      otherUserIds: [secondHostId],
+    })
+    const replaceReplacement = await attempt(() => book(victim.session, replaceHostsTemplate.id, {
+      hostId: secondHostId,
+      rescheduledCalendarEventId: replaceOriginal.id,
+    }))
+    record(
+      'F2: replaceHostOnReschedule true still replaces the hosts and keeps the enduser attendee',
+      !replaceReplacement.rejected
+        && userAttendeeIds(replaceReplacement.createdEvent).length === 1
+        && userAttendeeIds(replaceReplacement.createdEvent)[0] === secondHostId
+        && replaceReplacement.createdEvent.attendees.filter((a: any) => a.type === 'enduser').length === 1
+        && replaceReplacement.createdEvent.attendees.some((a: any) => a.id === victim.enduser.id),
+      replaceReplacement.rejected
+        ? `rejected: ${replaceReplacement.payload}`
+        : `attendees=${JSON.stringify(replaceReplacement.createdEvent.attendees.map((a: any) => ({ type: a.type, id: a.id })))}`,
+    )
+  } finally {
+    // Teardown before anything asserts — assert calls process.exit, which skips pending finallys and
+    // would strand the provisioned tenant permanently.
+    if (tenant) { try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) } }
+  }
+
+  return checks
+}
+
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+export const appointment_reschedule_ownership_tests = async () => {
+  assert_checks('book_appointment reschedule ownership', await appointment_reschedule_ownership_checks())
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  appointment_reschedule_ownership_tests()
+    .then(() => {
+      console.log("✅ book_appointment reschedule ownership test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ book_appointment reschedule ownership test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/security/booking-info-idor-token-mint.test.ts

@@ -8,7 +8,7 @@ import {
 import { authenticate_enduser_via_token, setup_tests } from "../../setup"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
-const businessId = '60398b1131a295e64f084ff6'
+const businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6'
 
 const RAND = () => Math.random().toString(36).slice(2, 10)
 

package/src/tests/api_tests/security/enduser-ai-summary-trust-gate.test.ts

@@ -6,7 +6,7 @@ import { FormResponse } from "@tellescope/types-client"
 import { setup_tests } from "../../setup"
 
 const host = process.env.API_URL || "http://localhost:8080"
-const businessId = '60398b1131a295e64f084ff6'
+const businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6'
 
 const ENDUSER_PASSWORD = 'AISummaryGateTestPassword!123'
 

package/src/tests/api_tests/security/enduser-cross-create.test.ts

@@ -8,7 +8,7 @@ import {
 import { setup_tests } from "../../setup"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
-const businessId = '60398b1131a295e64f084ff6'
+const businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6'
 
 const ENDUSER_PASSWORD = 'F0116TestPassword!123'
 

package/src/tests/api_tests/security/enduser-write-restrictions.test.ts

@@ -8,7 +8,7 @@ import {
 import { setup_tests } from "../../setup"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
-const businessId = '60398b1131a295e64f084ff6'
+const businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6'
 
 const ENDUSER_PASSWORD = 'F0106TestPassword!123'
 

package/src/tests/api_tests/security/invite-user-enumeration.test.ts

@@ -7,7 +7,7 @@ import {
   log_header,
   wait,
 } from "@tellescope/testing"
-import { setup_tests } from "../../setup"
+import { reset_test_tenant, setup_tests } from "../../setup"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
@@ -53,7 +53,7 @@ export const invite_user_enumeration_tests = async ({ sdk, sdkNonAdmin } : { sdk
   log_header("users.invite_user cross-tenant enumeration regression")
 
   // Reset state so prior tests' rate-limit accounting doesn't leak in.
-  await sdk.reset_db()
+  await reset_test_tenant(sdk)
 
   const organizationId = sdk.userInfo.organizationIds?.[0] ?? sdk.userInfo.businessId
   // Use the test admin's own email — guaranteed to exist in the test tenant, so every invite
@@ -98,7 +98,7 @@ export const invite_user_enumeration_tests = async ({ sdk, sdkNonAdmin } : { sdk
   // ====================================================================
   // Let rate limit decay so this single call isn't blocked.
   await wait(undefined, 5000)
-  await sdk.reset_db()
+  await reset_test_tenant(sdk)
 
   const sameTenantRes = await post(
     '/v1/invite-user-to-organization',