@tellescope/sdk 1.256.16 → 2.0.0-beta.1

package/src/tests/api_tests/security/rich-text-answer-sanitized-on-write.test.ts

@@ -0,0 +1,197 @@
+require('source-map-support').install();
+
+import { EnduserSession } from "../../../sdk"
+import {
+  assert_checks,
+  Check,
+  setup_isolated_tenant,
+} from "../../setup_isolated"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
+/**
+ * Form "Rich Text" answers must be sanitized when they are stored, not only when they are rendered.
+ *
+ * A Rich Text answer is HTML authored by whoever fills the form — including an unauthenticated
+ * visitor on a public intake page — and it is stored verbatim by the generic write path (the only
+ * thing it strips is `<script>`). Every read path re-sanitizes before `dangerouslySetInnerHTML`,
+ * but the staff-side rich text *editor* did not: `@tellescope/react-components`'s `RichTextInput`
+ * fed the stored answer straight into `html-to-draftjs`, whose `<iframe>` handling produces a
+ * Draft.js EMBEDDED_LINK block that `react-draft-wysiwyg` renders as a real, unsandboxed iframe.
+ * So an enduser could submit `<iframe src="javascript:…">` in an answer and have it execute in the
+ * session of the staff member who opened that response for editing (enduser -> staff stored XSS,
+ * i.e. a PHI-egress class). The editor was fixed to sanitize before parsing; this test covers the
+ * second layer: the answer is sanitized once, on write, so exports, PDFs, integrations, AI
+ * summaries and any future consumer inherit it instead of each having to remember.
+ *
+ * Every client write of answers goes through `formResponseValidator` — generic create/update
+ * (endusers may PATCH `responses`), `submit_form_response` and `save_field_response` — so all three
+ * are exercised here. The server-side writers that bypass validation (Formsort, Healthie sync, AI
+ * form filling) never construct a `'Rich Text'` answer; see the note on the validator in
+ * `@tellescope/validation`.
+ *
+ * The negative checks are paired with positive ones: formatting and legitimate external links must
+ * survive, or a "sanitized" result could just mean the answer was discarded. The last two checks
+ * guard the two ways this change could break normal use: an empty answer must round-trip
+ * unchanged (the portal compares against `''` / `'<p></p>'`), and a long answer must not be
+ * rejected because the sanitizer's own `target`/`rel` additions pushed it over the length limit.
+ */
+export const rich_text_answer_sanitized_on_write_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  const PAYLOAD = '<p>hi <b>bold</b> <a href="https://x.io">l</a></p>'
+    + '<iframe src="javascript:alert(1)"></iframe>'
+    + '<img src="x" onerror="alert(1)">'
+    + '<script>alert(1)</script>'
+    + '<a href="javascript:alert(2)">j</a>'
+
+  const dangerous = (stored: string) => ([
+    ['<iframe', stored.toLowerCase().includes('<iframe')],
+    ['onerror', stored.toLowerCase().includes('onerror')],
+    ['<script', stored.toLowerCase().includes('<script')],
+    ['javascript:', stored.toLowerCase().includes('javascript:')],
+  ] as [string, boolean][]).filter(([, present]) => present).map(([name]) => name)
+
+  const record_sanitized = (label: string, stored: string | undefined) => {
+    if (typeof stored !== 'string') {
+      record(label, false, `no answer stored (got ${JSON.stringify(stored)})`)
+      return
+    }
+    const bad = dangerous(stored)
+    const keptFormatting = stored.includes('<b>bold</b>')
+    const keptLink = stored.includes('href="https://x.io"') && stored.includes('rel="noopener noreferrer"')
+
+    record(label, bad.length === 0 && keptFormatting && keptLink,
+      bad.length !== 0 ? `dangerous markup stored: ${bad.join(', ')} — ${stored.slice(0, 300)}`
+      : !keptFormatting ? `formatting did not survive — ${stored.slice(0, 300)}`
+      : !keptLink ? `external link lost its href or rel — ${stored.slice(0, 300)}`
+      : `stored sanitized: ${stored.slice(0, 300)}`
+    )
+  }
+
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+
+  try {
+    tenant = await setup_isolated_tenant({ name: `RichText ${RAND()}`, users: [{ isAdmin: true }], apiKeys: 0 })
+    const sdk = tenant.sdk
+
+    const form = await sdk.api.forms.createOne({ title: `rich text ${RAND()}` })
+    const field = await sdk.api.form_fields.createOne({
+      formId: form.id, title: 'Tell us more', type: 'Rich Text', previousFields: [{ type: 'root', info: {} }],
+    })
+    const enduser = await sdk.api.endusers.createOne({
+      email: `richtext-${RAND()}@tellescope.com`, fname: 'Rich', lname: 'Text',
+    })
+    // generate_auth_token rather than .authenticate — repeated logins hit the rate limiter.
+    const { authToken } = await sdk.api.endusers.generate_auth_token({ id: enduser.id })
+    const enduserSDK = new EnduserSession({ host, businessId: tenant.businessId, authToken })
+
+    const prepare = () => sdk.api.form_responses.prepare_form_response({ formId: form.id, enduserId: enduser.id })
+    const answer = (value: string) => ({
+      fieldId: field.id, fieldTitle: field.title, answer: { type: 'Rich Text' as const, value },
+    })
+    /** What is actually in the database, read back by an admin session. */
+    const stored_answer = async (formResponseId: string) => {
+      const formResponse = await sdk.api.form_responses.getOne(formResponseId)
+      const response = (formResponse.responses || []).find(r => r.fieldId === field.id)
+      return (response?.answer as { value?: string } | undefined)?.value
+    }
+
+    /* ===== 1. submit_form_response — the path a patient filling out a form takes ===== */
+
+    const submitted = await prepare()
+    await enduserSDK.api.form_responses.submit_form_response({
+      accessCode: submitted.accessCode, responses: [answer(PAYLOAD)],
+    })
+    const submittedValue = await stored_answer(submitted.response.id)
+    record_sanitized('1: submit_form_response stores a sanitized answer', submittedValue)
+
+    /* ===== 2. save_field_response — the partial/draft save the portal fires per question ===== */
+
+    const partial = await prepare()
+    await enduserSDK.api.form_responses.save_field_response({
+      accessCode: partial.accessCode, response: answer(PAYLOAD),
+    })
+    record_sanitized('2: save_field_response stores a sanitized answer', await stored_answer(partial.response.id))
+
+    /* ===== 3. generic PATCH of responses — endusers are allowed to update their own ===== */
+
+    const patched = await prepare()
+    await enduserSDK.api.form_responses.updateOne(patched.response.id, { responses: [answer(PAYLOAD)] })
+    record_sanitized('3: enduser PATCH of responses stores a sanitized answer', await stored_answer(patched.response.id))
+
+    /* ===== 4. Idempotence: re-submitting what was stored must not change it again ===== */
+
+    if (typeof submittedValue === 'string') {
+      const resubmitted = await prepare()
+      await enduserSDK.api.form_responses.submit_form_response({
+        accessCode: resubmitted.accessCode, responses: [answer(submittedValue)],
+      })
+      const again = await stored_answer(resubmitted.response.id)
+      record('4: re-submitting a sanitized answer is idempotent', again === submittedValue,
+        again === submittedValue ? 'unchanged on the second pass' : `changed — ${String(again).slice(0, 300)}`)
+    } else {
+      record('4: re-submitting a sanitized answer is idempotent', false, 'skipped: check 1 stored nothing')
+    }
+
+    /* ===== 5. Empty answers round-trip: the portal treats '' and '<p></p>' as "unanswered" ===== */
+
+    const empties = await prepare()
+    const roundTrips: string[] = []
+    for (const value of ['<p></p>', '']) {
+      await enduserSDK.api.form_responses.save_field_response({
+        accessCode: empties.accessCode, response: answer(value),
+      })
+      roundTrips.push(`${JSON.stringify(value)} -> ${JSON.stringify(await stored_answer(empties.response.id))}`)
+    }
+    const emptiesOk = roundTrips[0] === '"<p></p>" -> "<p></p>"' && roundTrips[1] === '"" -> ""'
+    record('5: empty and <p></p> answers round-trip unchanged', emptiesOk, roundTrips.join(', '))
+
+    /* ===== 6. Length headroom: the sanitizer ADDS target/rel to every external link ===== */
+
+    // ~24.9k of legitimate answer, just under the old 25000 limit. Sanitizing adds ~41 characters
+    // per external link, so at the old limit the sanitized result would be rejected on a re-save.
+    const LINKS = 12
+    const longAnswer = `<p>${'a'.repeat(24400)}</p>`
+      + `<a href="https://example.com/a">link</a>`.repeat(LINKS)
+    const longResponse = await prepare()
+    const longResult = await enduserSDK.api.form_responses.submit_form_response({
+      accessCode: longResponse.accessCode, responses: [answer(longAnswer)],
+    }).then(() => stored_answer(longResponse.response.id))
+     .catch((e: any) => `rejected: ${e?.message || e}`)
+
+    const longOk = typeof longResult === 'string'
+      && longResult.split('rel="noopener noreferrer"').length - 1 === LINKS
+    record('6: a ~24.9k answer with external links is accepted after sanitizing', longOk,
+      longOk ? `stored ${longResult.length} characters with ${LINKS} rel-tagged links (submitted ${longAnswer.length})`
+             : `submitted ${longAnswer.length} characters — ${String(longResult).slice(0, 300)}`)
+  } finally {
+    // Teardown BEFORE anything asserts — assert calls process.exit, which skips pending finallys and
+    // would strand the provisioned tenant permanently.
+    if (tenant) { try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) } }
+  }
+
+  return checks
+}
+
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+export const rich_text_answer_sanitized_on_write_tests = async () => {
+  assert_checks('Rich Text answers sanitized on write', await rich_text_answer_sanitized_on_write_checks())
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  rich_text_answer_sanitized_on_write_tests()
+    .then(() => {
+      console.log("✅ rich text answer sanitization test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ rich text answer sanitization test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/security/sanitize-user-html-with-iframes.test.ts

@@ -147,7 +147,10 @@ export const sanitize_user_html_with_iframes_tests = async () => {
   // sandbox="" is the MOST restrictive value and must not be replaced by the default
   const emptySandbox = sanitize_user_html_with_iframes(`<iframe src="https://ok.example" sandbox=""></iframe>`)
   if (emptySandbox.includes('allow-')) fail(`empty sandbox was replaced with the permissive default: ${emptySandbox}`)
-  if (!/\ssandbox(\s|>)/.test(emptySandbox)) fail(`empty sandbox attribute lost entirely: ${emptySandbox}`)
+  // Accepts either spelling — a bare `sandbox` and `sandbox=""` are identical per the HTML spec,
+  // and which one sanitize-html emits has changed between releases. What must never happen is the
+  // attribute disappearing, which leaves the frame with no sandbox at all.
+  if (!/\ssandbox(=""|\s|>)/.test(emptySandbox)) fail(`empty sandbox attribute lost entirely: ${emptySandbox}`)
 
   // author referrerpolicy honored
   const noref = sanitize_user_html_with_iframes(`<iframe src="https://ok.example" referrerpolicy="no-referrer"></iframe>`)

package/src/tests/api_tests/templated_message_date_fields.test.ts

@@ -0,0 +1,146 @@
+require('source-map-support').install();
+
+import {
+  assert_checks,
+  Check,
+  setup_isolated_tenant,
+} from "../setup_isolated"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+/**
+ * Coverage for how `get_templated_message` renders enduser field values that LOOK like dates.
+ *
+ * The rule: a value stored as text renders as the author stored it. `message_templating.ts` only
+ * reformats an actual `Date` object, and a custom field is always a string.
+ *
+ * This exists because that rule was silently broken IN PRODUCTION, and had been for a long time.
+ * The templating code read `if (fieldValue instanceof Date || isDate(fieldValue))`. Validator
+ * 13.11.0's `isDate` was timezone-dependent — it compared a UTC-parsed date against a local-time
+ * `.getDate()` — so it returned false on a US developer's machine but TRUE in UTC, which is what
+ * the servers run. A date of birth stored as "1985-03-12" therefore took the Date branch in
+ * production, was parsed as UTC midnight and localized to the enduser's timezone, and rendered in a
+ * patient-facing SMS or email as "3/11/1985, 7:00:00 PM" — the PREVIOUS day, with a time nobody
+ * entered. A January date lost a year: "2024-01-01" rendered "12/31/2023".
+ *
+ * The validator bump did not cause this; it made it reproducible locally, which is how it surfaced.
+ * Removing the `isDate` half of the condition fixes it in every timezone.
+ *
+ * This is the ONE intentional production behavior change in an otherwise behavior-neutral
+ * dependency PR, made deliberately rather than shipping wrong dates to patients for another
+ * cycle. Every other validator touched here was pinned to production's existing behavior.
+ *
+ * So the assertions below are about the day not moving and no clock time appearing, which is what a
+ * patient would actually notice. A pure-function test could not have caught this: the function that
+ * does the work is module-private and the endpoint is the real surface.
+ *
+ * Runs standalone or as part of the main suite:
+ *   npm run test:modular -- api_tests/templated_message_date_fields
+ */
+
+/** Values a customer realistically stores in a date-ish custom field, and what must come back. */
+const DATE_SHAPED_VALUES = [
+  { label: 'ISO date (the shape that regressed)', value: '1985-03-12' },
+  { label: 'ISO date, recent',                    value: '2024-01-01' },
+  { label: 'slash-separated date',                value: '1999/12/31' },
+  { label: 'MM-DD-YYYY (the dateOfBirth format)', value: '03-12-1985' },
+  { label: 'ISO datetime string',                 value: '2024-06-15T14:30:00.000Z' },
+  { label: 'leap day',                            value: '2000-02-29' },
+]
+
+/** A rendered date-only value must not have grown a clock time or a timezone abbreviation. */
+const LOOKS_REFORMATTED = /\d{1,2}:\d{2}|\bAM\b|\bPM\b|\bE[SD]T\b|\bUTC\b|\bGMT\b/
+
+const templated_message_date_field_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const tenant = await setup_isolated_tenant({ users: [{ isAdmin: true }] })
+
+  try {
+    const { sdk } = tenant
+    const userId = tenant.users[0].id
+
+    const fields = Object.fromEntries(DATE_SHAPED_VALUES.map((c, i) => [`DateField${i}`, c.value]))
+    const enduser = await sdk.api.endusers.createOne({
+      fname: 'Date',
+      lname: 'Fields',
+      timezone: 'America/New_York', // the timezone the shifted rendering localized into
+      fields,
+    })
+
+    for (let i = 0; i < DATE_SHAPED_VALUES.length; i++) {
+      const { label, value } = DATE_SHAPED_VALUES[i]
+      const { plaintext } = await sdk.api.templates.get_templated_message({
+        enduserId: enduser.id,
+        userId,
+        channel: 'Chat',
+        message: `[{{enduser.DateField${i}}}]`,
+      })
+
+      checks.push({
+        label: `${label} renders exactly as stored`,
+        pass: plaintext === `[${value}]`,
+        detail: `stored ${JSON.stringify(value)}, rendered ${JSON.stringify(plaintext)}`,
+      })
+      // A second, independent signal for the specific symptom, so this still catches a shifted
+      // rendering even if the equality check above is ever loosened. Only meaningful for values
+      // that carry no time of their own — an ISO datetime legitimately contains one.
+      if (!LOOKS_REFORMATTED.test(value)) {
+        checks.push({
+          label: `${label} does not gain a clock time`,
+          pass: !LOOKS_REFORMATTED.test(plaintext),
+          detail: `rendered ${JSON.stringify(plaintext)}`,
+        })
+      }
+    }
+
+    // The specific patient-visible symptom, asserted on its own so a failure names it.
+    const { plaintext: dob } = await sdk.api.templates.get_templated_message({
+      enduserId: enduser.id,
+      userId,
+      channel: 'Chat',
+      message: `DOB: {{enduser.DateField0}}`,
+    })
+    checks.push({
+      label: 'a date of birth does not render as the previous day',
+      pass: dob.includes('1985-03-12') && !dob.includes('3/11/1985'),
+      detail: `rendered ${JSON.stringify(dob)}`,
+    })
+
+    // Positive control: if templating itself were broken, every check above would pass vacuously
+    // (an unreplaced `{{enduser.X}}` is neither reformatted nor time-stamped).
+    const { plaintext: control } = await sdk.api.templates.get_templated_message({
+      enduserId: enduser.id,
+      userId,
+      channel: 'Chat',
+      message: `{{enduser.fname}} {{enduser.lname}}`,
+    })
+    checks.push({
+      label: 'control: non-date fields are still templated at all',
+      pass: control === 'Date Fields',
+      detail: `rendered ${JSON.stringify(control)}`,
+    })
+
+    return checks
+  } finally {
+    await tenant.teardown()
+  }
+}
+
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+export const templated_message_date_field_tests = async () => {
+  assert_checks('Templated message date-shaped fields', await templated_message_date_field_checks())
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  templated_message_date_field_tests()
+    .then(() => {
+      console.log("✅ Templated message date field test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Templated message date field test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/templated_message_links.test.ts

@@ -0,0 +1,192 @@
+require('source-map-support').install();
+
+import {
+  assert_checks,
+  Check,
+  setup_isolated_tenant,
+} from "../setup_isolated"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+/**
+ * Link templating through the real `templates.get_templated_message` — the same endpoint the worker
+ * calls on every outbound email and SMS.
+ *
+ * The exhaustive coverage of this path lives in the API's own module test
+ * (`packages/private/api/api/modules/message_templating.test.ts`), which stubs the database so a case
+ * costs microseconds. This suite exists to prove those stubs still describe the real thing: that a
+ * rendered link really is a `/r/<token>` redirect, and that `linkOpenTrackingIds` really is one id per
+ * redirect record created.
+ *
+ * Deliberately small. Every case here writes real `url_redirects` rows, and `teardown_tenant` does not
+ * remove them — that collection is in neither `schema` nor `getInternalQueries()` — so each extra case
+ * leaves rows behind in the database forever.
+ *
+ * Runs standalone or as part of the main suite:
+ *   npm run test:modular -- api_tests/templated_message_links
+ */
+
+/** A tracked link is `<portal or api url>/r/<token>`; the token itself is not predictable. */
+const REDIRECT = /https?:\/\/[^\s"'<>]+\/r\/[A-Za-z0-9_-]+/
+/** Bound on the one case that used to hang the request, so a regression fails instead of stalling. */
+const CLIENT_WAIT_MS = 20_000
+const LINK = 'https://example.com/landing'
+
+const templated_message_link_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const tenant = await setup_isolated_tenant({ users: [{ isAdmin: true }] })
+
+  try {
+    const { sdk } = tenant
+    const userId = tenant.users[0].id
+    const enduser = await sdk.api.endusers.createOne({ fname: 'Link', lname: 'Templating' })
+
+    const templated = (message: string, html: string) => sdk.api.templates.get_templated_message({
+      enduserId: enduser.id, userId, channel: 'Email', message, html,
+    })
+
+    // 1. one link: an anchor in html, "text (url)" in plaintext, one tracking id
+    {
+      const body = `Go: {${LINK}}[Click]`
+      const { html, plaintext, linkOpenTrackingIds } = await templated(body, `<p>${body}</p>`)
+
+      checks.push({
+        label: 'html renders an anchor whose href is a /r/ redirect',
+        pass: new RegExp(`^<p>Go: <a href="${REDIRECT.source}">Click</a></p>$`).test(html),
+        detail: `rendered ${JSON.stringify(html)}`,
+      })
+      checks.push({
+        label: 'plaintext appends the same redirect in parentheses',
+        pass: new RegExp(`^Go: Click \\(${REDIRECT.source}\\)$`).test(plaintext),
+        detail: `rendered ${JSON.stringify(plaintext)}`,
+      })
+      checks.push({
+        label: 'one link creates exactly one redirect record',
+        pass: linkOpenTrackingIds.length === 1,
+        detail: `linkOpenTrackingIds=${JSON.stringify(linkOpenTrackingIds)}`,
+      })
+    }
+
+    // 2. several links: one record each, all replaced
+    {
+      const body = `One {${LINK}/a}[A], two {${LINK}/b}[B], three {${LINK}/c}[C]`
+      const { html, linkOpenTrackingIds } = await templated(body, `<p>${body}</p>`)
+
+      checks.push({
+        label: 'every link in one message is replaced',
+        pass: (html.match(/<a href="/g) || []).length === 3 && !html.includes('{'),
+        detail: `rendered ${JSON.stringify(html)}`,
+      })
+      checks.push({
+        label: 'three links create exactly three redirect records',
+        pass: linkOpenTrackingIds.length === 3,
+        detail: `linkOpenTrackingIds=${JSON.stringify(linkOpenTrackingIds)}`,
+      })
+    }
+
+    // 3. $LINK_ONLY: the bare redirect url, no anchor
+    {
+      const body = `Go: {${LINK}}[$LINK_ONLY]`
+      const { html, plaintext, linkOpenTrackingIds } = await templated(body, `<p>${body}</p>`)
+
+      checks.push({
+        label: '$LINK_ONLY substitutes the bare redirect url',
+        pass: new RegExp(`^<p>Go: ${REDIRECT.source}</p>$`).test(html)
+          && new RegExp(`^Go: ${REDIRECT.source}$`).test(plaintext),
+        detail: `html ${JSON.stringify(html)}, plaintext ${JSON.stringify(plaintext)}`,
+      })
+      checks.push({
+        label: '$LINK_ONLY still creates its redirect record',
+        pass: linkOpenTrackingIds.length === 1,
+        detail: `linkOpenTrackingIds=${JSON.stringify(linkOpenTrackingIds)}`,
+      })
+    }
+
+    // 4. a link merge field resolves to the same {url}[text] form, then to an anchor
+    {
+      const form = await sdk.api.forms.createOne({ title: `Link templating ${Date.now()}` })
+      try {
+        const body = `Start here: {{forms.${form.id}.link:Begin}}`
+        const { html, linkOpenTrackingIds } = await templated(body, `<p>${body}</p>`)
+
+        checks.push({
+          label: 'a form link merge field becomes an anchor on a redirect',
+          pass: new RegExp(`^<p>Start here: <a href="${REDIRECT.source}">Begin</a></p>$`).test(html),
+          detail: `rendered ${JSON.stringify(html)}`,
+        })
+        checks.push({
+          label: 'the form link creates exactly one redirect record',
+          pass: linkOpenTrackingIds.length === 1,
+          detail: `linkOpenTrackingIds=${JSON.stringify(linkOpenTrackingIds)}`,
+        })
+      } finally {
+        await sdk.api.forms.deleteOne(form.id)
+      }
+    }
+
+    // 5. The loop-safety case, end to end. A space between the two halves of a link template is one
+    // find_link matches but the replacement key cannot, and this request used to never come back:
+    // the server looped on that same match, inserting a url_redirects row every time round. The
+    // client-side bound is what turns a regression here into a failure rather than a hung suite.
+    {
+      const body = `Go: {${LINK}} [Click]`
+      const outcome = await Promise.race([
+        templated(body, `<p>${body}</p>`).then(r => r).catch(e => ({ error: e?.message ?? String(e) } as any)),
+        new Promise<any>(resolve => setTimeout(() => resolve({ timedOut: true }), CLIENT_WAIT_MS)),
+      ])
+
+      checks.push({
+        label: 'a template the server cannot replace still returns a response',
+        pass: !outcome.timedOut && !outcome.error,
+        detail: outcome.timedOut
+          ? `no response within ${CLIENT_WAIT_MS}ms — the templating loop stopped terminating`
+          : outcome.error ? `errored: ${outcome.error}` : 'responded',
+      })
+      if (!outcome.timedOut && !outcome.error) {
+        checks.push({
+          label: 'it is left literal in both the html and the plaintext',
+          pass: outcome.html === `<p>${body}</p>` && outcome.plaintext === body,
+          detail: `html ${JSON.stringify(outcome.html)}, plaintext ${JSON.stringify(outcome.plaintext)}`,
+        })
+        checks.push({
+          label: 'and it creates no redirect records at all',
+          pass: outcome.linkOpenTrackingIds.length === 0,
+          detail: `linkOpenTrackingIds=${JSON.stringify(outcome.linkOpenTrackingIds)}`,
+        })
+      }
+    }
+
+    // Positive control: a body with no link syntax is left alone and creates nothing.
+    {
+      const { html, linkOpenTrackingIds } = await templated('No links here', '<p>No links here</p>')
+      checks.push({
+        label: 'control: a body without link syntax is untouched and creates no records',
+        pass: html === '<p>No links here</p>' && linkOpenTrackingIds.length === 0,
+        detail: `rendered ${JSON.stringify(html)}, linkOpenTrackingIds=${JSON.stringify(linkOpenTrackingIds)}`,
+      })
+    }
+
+    return checks
+  } finally {
+    await tenant.teardown()
+  }
+}
+
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+export const templated_message_link_tests = async () => {
+  assert_checks('Templated message links', await templated_message_link_checks())
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  templated_message_link_tests()
+    .then(() => {
+      console.log("✅ Templated message link test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Templated message link test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/time_tracks.test.ts

@@ -6,7 +6,7 @@ import { setup_tests } from "../setup"
 
 const log = console.log
 
-const host = process.env.REACT_APP_TELLESCOPE_API_URL || 'http://localhost:8080'
+const host = process.env.API_URL || process.env.REACT_APP_TELLESCOPE_API_URL || 'http://localhost:8080'
 
 // Helper to assert that an async function throws an error
 const assert_throws = async (fn: () => Promise<any>, description: string) => {