@tellescope/sdk 1.256.16 → 2.0.0-beta.1

package/src/tests/api_tests/user_logs_restore_deleted.test.ts

@@ -0,0 +1,415 @@
+require('source-map-support').install();
+
+import { AUTOMATED_ACTION_CANCEL_REASONS } from "@tellescope/constants"
+import {
+  assert_checks,
+  Check,
+  setup_isolated_tenant,
+} from "../setup_isolated"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
+/**
+ * Coverage for POST /v1/user-logs/restore-deleted — re-creating a deleted contact, and the records
+ * cascade-deleted with it, by replaying user_logs rows.
+ *
+ * The check that most justifies the handler's shape is B. handleDeletionForDependencies runs BEFORE
+ * the parent `delete` row is inserted, so cascade rows have SMALLER _ids than the parent row. If the
+ * `_id` range is ever written the intuitive way round (forwards from the parent), the contact still
+ * comes back and every "contact restored" check still passes — only the dependent counts go to zero.
+ * B is what fails in that case.
+ *
+ * H is the other half of that: the window is scoped by enduserId, which the delete path stamps on
+ * every cascade row for every model. Deleting contact B's ticket inside the same five-minute window
+ * must not bring it back when contact A is restored.
+ *
+ * The suite MUST poll for audit rows: the delete endpoint responds 204 *before* writing them, so
+ * reading immediately after a delete is a race.
+ *
+ * Restores are deliberately not idempotent in the "refuse if present" sense — they RESUME. D and E
+ * pin that: a second press duplicates nothing, and a dependent deleted since comes back.
+ */
+
+const poll_for = async <T,>(get: () => Promise<T>, done: (v: T) => boolean, attempts = 40): Promise<T> => {
+  let value = await get()
+  for (let i = 0; i < attempts && !done(value); i++) {
+    await new Promise(resolve => setTimeout(resolve, 250))
+    value = await get()
+  }
+  return value
+}
+
+/** The delete endpoint returns before writing its audit rows, so every read of one polls. */
+const poll_for_delete_log = async (sdk: any, resource: string, resourceId: string) => {
+  const log = await poll_for(
+    async () => (
+      await sdk.api.user_logs.getSome({ filter: { resourceId } })
+    ).find((l: any) => l.action === 'delete' && l.resource === resource),
+    l => !!l,
+  )
+  if (!log) throw new Error(`no delete user_log appeared for ${resource} ${resourceId}`)
+  return log
+}
+
+const sum = (counts: Record<string, number> = {}) => Object.values(counts).reduce((a, b) => a + b, 0)
+
+const rejection_of = async (run: () => Promise<any>) => {
+  try {
+    await run()
+    return undefined
+  } catch (err: any) {
+    return err
+  }
+}
+
+export const user_logs_restore_deleted_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+  let otherTenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+
+  try {
+    ;[tenant, otherTenant] = await Promise.all([
+      setup_isolated_tenant({
+        name: `RestoreDeleted ${RAND()}`,
+        // A non-admin is provisioned deliberately: without one, sdkNonAdmin is an unauthenticated
+        // stub and the permission check (G) would pass for the wrong reason.
+        users: [{ isAdmin: true }, { roles: ['Non-Admin'] }],
+        apiKeys: 0,
+      }),
+      setup_isolated_tenant({ name: `RestoreDeletedOther ${RAND()}`, users: [{ isAdmin: true }], apiKeys: 0 }),
+    ])
+
+    const { sdk, sdkNonAdmin } = tenant
+
+    /* ============================== fixtures ============================== */
+
+    const queue = await sdk.api.ticket_queues.createOne({
+      title: `Restore Queue ${RAND()}`,
+      userIds: [sdk.userInfo.id],
+    })
+
+    const journey = await sdk.api.journeys.createOne({ title: `Restore Journey ${RAND()}` })
+    const step = await sdk.api.automation_steps.createOne({
+      journeyId: journey.id,
+      action: { type: 'setEnduserStatus', info: { status: 'Restored' } },
+      events: [{ type: 'onJourneyStart', info: {} }],
+    })
+
+    const emailA = `restore-a-${RAND()}@example.com`
+    const externalIdA = `restore-ext-${RAND()}`
+
+    const contactA = await sdk.api.endusers.createOne({
+      fname: 'Restore', lname: 'Target', email: emailA, externalId: externalIdA,
+    })
+    const contactB = await sdk.api.endusers.createOne({
+      fname: 'Bystander', lname: 'Contact', email: `restore-b-${RAND()}@example.com`,
+    })
+
+    const noteA = await sdk.api.notes.createOne({ enduserId: contactA.id, text: 'A note that must come back' })
+    const ticketA = await sdk.api.tickets.createOne({
+      title: `Ticket for A ${RAND()}`, enduserId: contactA.id, queueId: queue.id,
+    })
+    const actionA = await sdk.api.automated_actions.createOne({
+      journeyId: journey.id,
+      automationStepId: step.id,
+      enduserId: contactA.id,
+      processAfter: Date.now() + 100000000, // far future: the worker must not process it during the test
+      status: 'active',
+      event: { type: 'onJourneyStart', info: {} },
+      action: { type: 'setEnduserStatus', info: { status: 'Restored' } },
+    })
+    const ticketB = await sdk.api.tickets.createOne({
+      title: `Ticket for B ${RAND()}`, enduserId: contactB.id,
+    })
+
+    // ticket_queues.count is maintained by asynchronous side effects, so every read of it polls
+    const queueCountAfterCreate = (await poll_for(
+      () => sdk.api.ticket_queues.getOne(queue.id),
+      q => (q.count ?? 0) >= 1,
+    )).count ?? 0
+
+    /* ====================== delete A (and one of B's tickets) ====================== */
+
+    // H: deleted INSIDE the same window as A's delete, to prove enduserId scoping
+    await sdk.api.tickets.deleteOne(ticketB.id)
+    await poll_for_delete_log(sdk, 'tickets', ticketB.id)
+
+    await sdk.api.endusers.deleteOne(contactA.id)
+    const deleteLogA = await poll_for_delete_log(sdk, 'endusers', contactA.id)
+
+    const queueCountAfterDelete = (await poll_for(
+      () => sdk.api.ticket_queues.getOne(queue.id),
+      q => (q.count ?? 0) < queueCountAfterCreate,
+    )).count ?? 0
+
+    record(
+      'delete removes the contact and decrements the queue',
+      !(await sdk.api.endusers.getSome({ filter: { } })).some(e => e.id === contactA.id)
+        && queueCountAfterDelete === queueCountAfterCreate - 1,
+      `queue ${queueCountAfterCreate} -> ${queueCountAfterDelete}`,
+    )
+
+    const auditRowsBefore = (await sdk.api.user_logs.getSome({ filter: { resourceId: contactA.id } })).length
+
+    /* ============================== A: the restore ============================== */
+
+    const result = await sdk.api.user_logs.restore_deleted({ userLogId: deleteLogA.id })
+
+    record(
+      'A1: restore returns the contact resource and its original id',
+      result.resource === 'endusers' && result.resourceId === contactA.id,
+      `resource=${result.resource} resourceId=${result.resourceId} (expected ${contactA.id})`,
+    )
+
+    const restoredContact = await sdk.api.endusers.getOne(contactA.id)
+    record(
+      'A2: the contact is back at its original id with its fields intact',
+      restoredContact.id === contactA.id
+        && restoredContact.fname === 'Restore'
+        && restoredContact.lname === 'Target'
+        && restoredContact.email === emailA
+        && restoredContact.externalId === externalIdA,
+      `id=${restoredContact.id} fname=${restoredContact.fname} email=${restoredContact.email} externalId=${restoredContact.externalId}`,
+    )
+
+    record(
+      'A3: the contact keeps its original creation timestamp',
+      new Date(restoredContact.createdAt).getTime() === new Date(contactA.createdAt).getTime(),
+      `restored=${restoredContact.createdAt} original=${contactA.createdAt}`,
+    )
+
+    /* ---- B: the cascade. This is what fails if the _id range runs the wrong way. ---- */
+
+    const dependentModels = Object.keys(result.restoredCounts ?? {}).filter(m => m !== 'endusers')
+    record(
+      'B1: restoredCounts covers at least two dependent models',
+      dependentModels.length >= 2,
+      `restoredCounts=${JSON.stringify(result.restoredCounts)} (the _id range runs BACKWARDS from the parent row)`,
+    )
+
+    const restoredNote = await sdk.api.notes.getOne(noteA.id)
+    const restoredTicket = await sdk.api.tickets.getOne(ticketA.id)
+    record(
+      'B2: dependents come back at their original ids',
+      restoredNote?.id === noteA.id && restoredTicket?.id === ticketA.id,
+      `note=${restoredNote?.id} ticket=${restoredTicket?.id}`,
+    )
+    record(
+      'B3: dependents keep their original authorship and content',
+      restoredNote.creator === noteA.creator
+        && restoredNote.text === 'A note that must come back'
+        && restoredTicket.creator === ticketA.creator
+        && restoredTicket.title === ticketA.title,
+      `note.creator=${restoredNote.creator} (orig ${noteA.creator}); ticket.creator=${restoredTicket.creator} (orig ${ticketA.creator})`,
+    )
+
+    /* ---- C: journey actions come back CANCELLED, never active ---- */
+
+    const expectedCancelReason = AUTOMATED_ACTION_CANCEL_REASONS.indexOf('Restored from Deletion')
+    const restoredAction = await sdk.api.automated_actions.getOne(actionA.id)
+    record(
+      'C: the pending journey action is restored cancelled with the new reason',
+      restoredAction?.status === 'cancelled' && restoredAction?.cancelReason === expectedCancelReason,
+      `status=${restoredAction?.status} cancelReason=${restoredAction?.cancelReason} (expected ${expectedCancelReason})`,
+    )
+
+    /* ---- H: cross-contact isolation ---- */
+
+    const bTicketBack = await rejection_of(() => sdk.api.tickets.getOne(ticketB.id))
+    record(
+      "H: restoring A does not bring back contact B's separately-deleted ticket",
+      bTicketBack !== undefined,
+      `enduserId scoping; getOne(ticketB) ${bTicketBack === undefined ? 'UNEXPECTEDLY SUCCEEDED' : 'rejected as expected'}`,
+    )
+
+    /* ---- queue count round-trips ---- */
+
+    const queueCountAfterRestore = (await poll_for(
+      () => sdk.api.ticket_queues.getOne(queue.id),
+      q => (q.count ?? 0) > queueCountAfterDelete,
+    )).count ?? 0
+    record(
+      'F1: the ticket queue count round-trips on restore',
+      queueCountAfterRestore === queueCountAfterCreate,
+      `${queueCountAfterCreate} -> ${queueCountAfterDelete} -> ${queueCountAfterRestore}`,
+    )
+
+    /* ---- audit: exactly one new row per restore ---- */
+
+    const auditRowsAfter = await poll_for(
+      async () => await sdk.api.user_logs.getSome({ filter: { resourceId: contactA.id } }),
+      rows => rows.length > auditRowsBefore,
+    )
+    const restoreRows = auditRowsAfter.filter(r => r.action === 'create' && r.note === 'Restored from deletion')
+    record(
+      'I1: the restore writes exactly one audit row',
+      auditRowsAfter.length === auditRowsBefore + 1 && restoreRows.length === 1,
+      `rows ${auditRowsBefore} -> ${auditRowsAfter.length}; restore rows=${restoreRows.length}`,
+    )
+    record(
+      'I2: the restore audit row records the source log id and the counts',
+      (restoreRows[0]?.info as any)?.sourceUserLogId === deleteLogA.id
+        && !!(restoreRows[0]?.info as any)?.restoredCounts,
+      `info=${JSON.stringify(restoreRows[0]?.info)?.slice(0, 200)}`,
+    )
+
+    /* ---- D: a second restore resumes, and duplicates nothing ---- */
+
+    const second = await sdk.api.user_logs.restore_deleted({ userLogId: deleteLogA.id })
+    record(
+      'D1: a second restore restores nothing and skips everything',
+      sum(second.restoredCounts) === 0 && sum(second.skippedCounts) > 0,
+      `restored=${JSON.stringify(second.restoredCounts)} skipped=${JSON.stringify(second.skippedCounts)}`,
+    )
+
+    const allContacts = await sdk.api.endusers.getSome({ filter: { } })
+    const allNotes = await sdk.api.notes.getSome({ filter: { enduserId: contactA.id } })
+    record(
+      'D2: a second restore duplicates neither the contact nor its records',
+      allContacts.filter(e => e.id === contactA.id).length === 1 && allNotes.length === 1,
+      `contacts with that id=${allContacts.filter(e => e.id === contactA.id).length} notes=${allNotes.length}`,
+    )
+
+    const queueCountAfterSecond = (await sdk.api.ticket_queues.getOne(queue.id)).count ?? 0
+    record(
+      'F2: a second restore does not inflate the queue count',
+      queueCountAfterSecond === queueCountAfterCreate,
+      `expected ${queueCountAfterCreate}, got ${queueCountAfterSecond}`,
+    )
+
+    /* ---- E: resume brings back a dependent deleted since ---- */
+
+    await sdk.api.notes.deleteOne(noteA.id)
+    await poll_for_delete_log(sdk, 'notes', noteA.id)
+
+    const third = await sdk.api.user_logs.restore_deleted({ userLogId: deleteLogA.id })
+    const noteBackAgain = await sdk.api.notes.getOne(noteA.id)
+    record(
+      'E: a repeat restore brings back exactly the record deleted since',
+      (third.restoredCounts as any)?.notes === 1
+        && sum(third.restoredCounts) === 1
+        && noteBackAgain?.id === noteA.id,
+      `restored=${JSON.stringify(third.restoredCounts)} note back=${noteBackAgain?.id}`,
+    )
+
+    /* ============================== error cases ============================== */
+
+    // G: a non-admin is refused. NOTE: for the default Non-Admin role the role-permission layer fires
+    // FIRST with 403 "Inaccessible" (the role has no user_logs access at all), so the schema's
+    // adminOnly gate — 401 "Admin access only" — is never reached. Both refuse; this asserts only
+    // that the call is rejected, so it stays green whichever of the two gates fires.
+    const nonAdminErr = await rejection_of(() => sdkNonAdmin.api.user_logs.restore_deleted({ userLogId: deleteLogA.id }))
+    record(
+      'G: a non-admin is refused',
+      nonAdminErr !== undefined,
+      `error=${JSON.stringify(nonAdminErr)?.slice(0, 200)}`,
+    )
+
+    // another tenant's log id is not found (indistinguishable from nonexistent)
+    const otherContact = await otherTenant.sdk.api.endusers.createOne({ fname: 'Other', lname: 'Tenant' })
+    await otherTenant.sdk.api.endusers.deleteOne(otherContact.id)
+    const otherLog = await poll_for_delete_log(otherTenant.sdk, 'endusers', otherContact.id)
+
+    const crossTenantErr = await rejection_of(() => sdk.api.user_logs.restore_deleted({ userLogId: otherLog.id }))
+    record(
+      "J1: another tenant's log id is not found",
+      crossTenantErr !== undefined,
+      `error=${JSON.stringify(crossTenantErr)?.slice(0, 200)}`,
+    )
+
+    // a non-delete row is not found
+    const anyCreateRow = (await sdk.api.user_logs.getSome({ filter: { } })).find(l => l.action !== 'delete')
+    const nonDeleteErr = anyCreateRow
+      ? await rejection_of(() => sdk.api.user_logs.restore_deleted({ userLogId: anyCreateRow.id }))
+      : undefined
+    record(
+      'J2: a non-delete audit row is not found',
+      !anyCreateRow || nonDeleteErr !== undefined,
+      anyCreateRow ? `error=${JSON.stringify(nonDeleteErr)?.slice(0, 200)}` : 'no non-delete row available to test',
+    )
+
+    // K: a standalone ticket's delete row is refused as unsupported_resource, a 400 (not a 404)
+    const standaloneTicket = await sdk.api.tickets.createOne({ title: `Standalone ${RAND()}` })
+    await sdk.api.tickets.deleteOne(standaloneTicket.id)
+    const ticketLog = await poll_for_delete_log(sdk, 'tickets', standaloneTicket.id)
+
+    const unsupportedErr: any = await rejection_of(() => sdk.api.user_logs.restore_deleted({ userLogId: ticketLog.id }))
+    record(
+      'K: a non-contact delete row is refused with unsupported_resource',
+      unsupportedErr?.info?.reason === 'unsupported_resource',
+      `error=${JSON.stringify(unsupportedErr)?.slice(0, 300)}`,
+    )
+
+    // L: a merge's delete row carries the Profile merge marker and is refused
+    const mergeSource = await sdk.api.endusers.createOne({ fname: 'Merge', lname: 'Source', email: `merge-src-${RAND()}@example.com` })
+    const mergeDest = await sdk.api.endusers.createOne({ fname: 'Merge', lname: 'Dest', email: `merge-dst-${RAND()}@example.com` })
+    await sdk.api.endusers.merge({ sourceEnduserId: mergeSource.id, destinationEnduserId: mergeDest.id })
+    const mergeLog = await poll_for_delete_log(sdk, 'endusers', mergeSource.id)
+
+    record(
+      "L1: the merge's delete row is marked 'Profile merge'",
+      mergeLog.note === 'Profile merge',
+      `note=${mergeLog.note}`,
+    )
+
+    const mergeErr: any = await rejection_of(() => sdk.api.user_logs.restore_deleted({ userLogId: mergeLog.id }))
+    record(
+      'L2: a merge delete row is refused with merge_row',
+      mergeErr?.info?.reason === 'merge_row',
+      `error=${JSON.stringify(mergeErr)?.slice(0, 300)}`,
+    )
+
+    // M: reusing a deleted contact's email yields unique_conflict
+    const conflictEmail = `restore-conflict-${RAND()}@example.com`
+    const conflictContact = await sdk.api.endusers.createOne({ fname: 'Conflict', lname: 'Target', email: conflictEmail })
+    await sdk.api.endusers.deleteOne(conflictContact.id)
+    const conflictLog = await poll_for_delete_log(sdk, 'endusers', conflictContact.id)
+
+    const replacement = await sdk.api.endusers.createOne({ fname: 'Replacement', lname: 'Contact', email: conflictEmail })
+    const conflictErr: any = await rejection_of(() => sdk.api.user_logs.restore_deleted({ userLogId: conflictLog.id }))
+
+    record(
+      'M1: restoring into a reused email yields unique_conflict',
+      conflictErr?.info?.reason === 'unique_conflict',
+      `error=${JSON.stringify(conflictErr)?.slice(0, 300)}`,
+    )
+
+    const conflictStillGone = await rejection_of(() => sdk.api.endusers.getOne(conflictContact.id))
+    const replacementUntouched = await sdk.api.endusers.getOne(replacement.id)
+    record(
+      'M2: a unique conflict restores nothing and leaves the new contact untouched',
+      conflictStillGone !== undefined && replacementUntouched?.email === conflictEmail,
+      `deleted contact still absent=${conflictStillGone !== undefined}; replacement email=${replacementUntouched?.email}`,
+    )
+  } finally {
+    // Teardown BEFORE anything asserts — assert calls process.exit, which would strand these tenants.
+    for (const t of [tenant, otherTenant]) {
+      if (t) { try { await t.teardown() } catch (e) { console.error('teardown failed', e) } }
+    }
+  }
+
+  return checks
+}
+
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+export const user_logs_restore_deleted_tests = async () => {
+  assert_checks('user_logs restore_deleted', await user_logs_restore_deleted_checks())
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  user_logs_restore_deleted_tests()
+    .then(() => {
+      console.log("✅ user_logs restore_deleted test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ user_logs restore_deleted test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/user_portal_settings.test.ts

@@ -10,7 +10,7 @@ import {
 import { setup_tests } from "../setup"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
-const businessId = '60398b1131a295e64f084ff6'
+const businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6'
 
 // Main test function that can be called independently
 export const user_portal_settings_tests = async ({ sdk, sdkNonAdmin }: { sdk: Session, sdkNonAdmin: Session }) => {

package/src/tests/api_tests/validation_behavior_locks.test.ts

@@ -0,0 +1,204 @@
+import { dateValidator, dateOptionalOrEmptyStringValidator, dateValidatorOptional, slugValidator, urlValidator } from "@tellescope/validation"
+
+// Pins the accept-sets of the validators whose behavior is delegated to the `validator` package, so
+// a dependency upgrade cannot move what the API accepts without a test failing.
+//
+// These assertions describe PRODUCTION — deliberately, including the parts that are wrong. Two of
+// them are: a bare `YYYY-MM-DD` is rejected while an ISO datetime is accepted, and an unparseable
+// string is accepted and persisted as an `Invalid Date`. Both predate this work and both are
+// API-visible across ~135 schema fields, so changing them belongs in its own PR. Pinning them is
+// what makes this file useful: it is proof of how the deployed API behaves, not an aspiration.
+//
+// Why it was needed. Validator 13.11.0's `isDate` was timezone-dependent — its last step compared a
+// UTC-parsed date against a local-time `.getDate()` — so it answered false west of Greenwich and
+// true in UTC. The servers run UTC, so the behavior pinned below is what production has been doing,
+// while the same code on a US developer's machine did the opposite. 13.12.0 fixed that (#2257), and
+// 13.15.35 was verified to return exactly what 13.11.0 returned under UTC, across 26 inputs and four
+// timezones. So every assertion here holds in EVERY timezone — that is the point of the file, and
+// the reason it can be trusted as a statement about production while running on a laptop.
+//
+// The `isSlug` half is different: 13.15.35 genuinely narrowed it (lowercase-only, alphanumeric ends,
+// 1-character minimum), which would have moved the subdomain accept-set. `validation.ts` pins
+// 13.11.0's pattern inline instead, and the checks below are that pattern.
+//
+// The `isURL` half (section 5) is neither: 13.11.0 and 13.15.35 were compared across 37 URL inputs
+// and agreed on every one, so nothing was at risk in that upgrade and nothing needed pinning inline.
+// It is here as a forward guard — webhook destinations are customer-configured and an accept-set that
+// narrows silently breaks live integrations — and because the staging QA asserted this behavior with
+// no test behind it. `isURL` reads no clock, so that section has no timezone caveat.
+//
+// Pure-function test — no Session needed. Runs as part of the main suite and standalone:
+//   npm run test:modular -- api_tests/validation_behavior_locks
+//   TZ=UTC npm run test:modular -- api_tests/validation_behavior_locks   (must give the same result)
+
+// Every assertion runs before anything throws, so one run reports the complete diff rather than the
+// first case that happened to trip.
+const failures: string[] = []
+
+const accepts = (label: string, validate: (v: any) => any, value: any) => {
+  try { validate(value) }
+  catch (err: any) { failures.push(`${label}: expected to ACCEPT ${JSON.stringify(value)}, but it was rejected (${err?.message || err})`) }
+}
+
+const rejects = (label: string, validate: (v: any) => any, value: any) => {
+  let accepted = false
+  try { validate(value); accepted = true }
+  catch { /* expected */ }
+  if (accepted) failures.push(`${label}: expected to REJECT ${JSON.stringify(value)}, but it was accepted`)
+}
+
+export const validation_behavior_lock_tests = async () => {
+  console.log(`Running validation behavior lock tests (TZ=${process.env.TZ || Intl.DateTimeFormat().resolvedOptions().timeZone})`)
+
+  const date = dateValidator.validate()
+  const dateOptional = dateValidatorOptional.validate()
+  const dateOrEmpty = dateOptionalOrEmptyStringValidator.validate()
+
+  // -----------------------------------------------------------------------------------------------
+  // 1. Date fields: ISO datetimes are accepted
+  // -----------------------------------------------------------------------------------------------
+  // What the SDK sends, since JSON.stringify turns a Date into one of these.
+  for (const value of [
+    '2024-06-15T14:30:00Z',
+    '2024-06-15T00:00:00.000Z',
+    '2024-06-15T14:30:00+05:00',
+  ]) {
+    accepts('dateValidator', date, value)
+    accepts('dateValidatorOptional', dateOptional, value)
+    accepts('dateOptionalOrEmptyStringValidator', dateOrEmpty, value)
+  }
+
+  // Epoch milliseconds round-trip through `new Date()`.
+  accepts('dateValidator', date, 1718400000000)
+
+  // The empty string is the "cleared" value for the two lenient variants only.
+  accepts('dateOptionalOrEmptyStringValidator', dateOrEmpty, '')
+  rejects('dateValidator', date, '')
+
+  // -----------------------------------------------------------------------------------------------
+  // 2. Date fields: a bare calendar date is REJECTED
+  // -----------------------------------------------------------------------------------------------
+  // Surprising, and not a typo. `isDate` returns true for these and the check is inverted, so they
+  // 400. This is long-standing production behavior; it is pinned, not endorsed. A client sending
+  // `"1985-03-12"` to a date field gets an error and must send an ISO datetime instead.
+  for (const value of ['1985-03-12', '2024-01-01', '2026-10-01', '2000-02-29', '1999/12/31']) {
+    rejects('dateValidator', date, value)
+    rejects('dateValidatorOptional', dateOptional, value)
+  }
+
+  // A real Date object is rejected by the same mechanism (isDate is true for one). Nothing sends a
+  // Date over HTTP, so this only reaches internal callers — but the three validators disagree here:
+  // the `dateOrEmpty` variant coerces with `.toString()` first, producing "Sat Jun 15 2024 ...",
+  // which isDate calls false, so it accepts. Pinned because it is a real inconsistency.
+  rejects('dateValidator', date, new Date('2024-06-15T14:30:00Z'))
+  rejects('dateValidatorOptional', dateOptional, new Date('2024-06-15T14:30:00Z'))
+  accepts('dateOptionalOrEmptyStringValidator', dateOrEmpty, new Date('2024-06-15T14:30:00Z'))
+
+  // -----------------------------------------------------------------------------------------------
+  // 3. Date fields: an unparseable string is ACCEPTED and stored as an Invalid Date
+  // -----------------------------------------------------------------------------------------------
+  // A data-corruption path, pinned so it is documented and so a future fix is a deliberate, visible
+  // change rather than a silent one. `new Date('not a date')` is an Invalid Date, and it is what
+  // gets written.
+  for (const value of ['not a date', 'hello world', 'tomorrow', '??']) {
+    accepts('dateValidator', date, value)
+    accepts('dateValidatorOptional', dateOptional, value)
+    accepts('dateOptionalOrEmptyStringValidator', dateOrEmpty, value)
+  }
+
+  // -----------------------------------------------------------------------------------------------
+  // 4. Organization subdomain
+  // -----------------------------------------------------------------------------------------------
+  const slug = slugValidator.validate()
+
+  // Valid, and must stay valid — 13.15.35's isSlug would reject the mixed-case ones.
+  for (const value of ['acme', 'acme-health', 'tellescope-demo', 'demo_org_1', 'Acme', 'My-Org', 'TellescopeDemo', 'abc']) {
+    accepts('slugValidator', slug, value)
+  }
+
+  // Also accepted today, though none of these are valid DNS labels. Pinned so the upgrade does not
+  // quietly change them; tightening is a separate decision.
+  for (const value of ['acme.health', 'org/sub', 'my@org', 'org?x=1']) {
+    accepts('slugValidator', slug, value)
+  }
+
+  // Rejected today — note 13.15.35's isSlug would ACCEPT the 1- and 2-character cases.
+  for (const value of ['a', 'ab', 'my--org', 'my__org', '-acme', 'acme-', 'org name']) {
+    rejects('slugValidator', slug, value)
+  }
+
+  // -----------------------------------------------------------------------------------------------
+  // 5. Webhook and other URL fields
+  // -----------------------------------------------------------------------------------------------
+  // `urlValidator` is a thin `isURL` passthrough behind `build_validator`, used for webhook
+  // subscriptions (schema `webhooks.url`) among others. It is a SYNTAX check only — refusing internal
+  // destinations is a separate layer (`api/modules/outbound_url.ts`), which is why several things
+  // accepted here are refused at delivery time.
+  const url = urlValidator.validate()
+
+  // Ports and query strings, the cases the staging QA calls out.
+  for (const value of [
+    'https://example.com:8443/hook',
+    'https://example.com/hook?a=1&b=two',
+    'https://example.com:8443/hook?a=1',
+    'https://example.com/a?b=c&d=%7B%22x%22%3A1%7D', // percent-encoded JSON in the query
+    'https://example.com:443/hook',
+    'https://example.com:8443',                      // port, no path
+    'https://example.com/hook#frag',
+    'HTTPS://EXAMPLE.COM/Hook',
+    'https://[::1]:8443/hook',
+  ]) {
+    accepts('urlValidator', url, value)
+  }
+
+  // Accepted, but quirks rather than intent — pinned like the date quirks above so that tightening any
+  // of them is a deliberate, visible change.
+  //  - schemeless: values of this shape exist in the webhooks collection today (outbound_url.ts:213)
+  //  - ftp: isURL's default protocol list is http/https/ftp
+  //  - the last two are refused by assertPublicHttpUrl at delivery, not here
+  for (const value of [
+    'api.customer.com/hook',
+    'ftp://example.com/x',
+    'http://10.0.0.1/hook',
+    'https://user:pass@example.com/hook',
+  ]) {
+    accepts('urlValidator', url, value)
+  }
+
+  // Rejected. `localhost` fails isURL's require_tld, which defaults on — a local webhook receiver has
+  // to be configured as 127.0.0.1, and that is why the SSRF suite binds loopback by address.
+  for (const value of [
+    'http://localhost:8080/hook',
+    'localhost:8080/hook',
+    'https://example.com:65536/hook',
+    'https://example.com:0/hook',
+    'https://example.com:abc/x',
+    'javascript:alert(1)',
+    'file:///etc/passwd',
+    'mailto:a@b.com',
+    '//example.com/hook',
+    'not a url',
+    'https://example.com/hook with space',
+    'https://example.com./hook', // trailing dot
+  ]) {
+    rejects('urlValidator', url, value)
+  }
+
+  // Non-string and absent values. The empty string is rejected by build_validator's non-empty rule
+  // rather than by isURL, so it is pinned separately from the malformed strings above.
+  rejects('urlValidator', url, '')
+  rejects('urlValidator', url, 123)
+  rejects('urlValidator', url, null)
+  rejects('urlValidator', url, undefined)
+
+  if (failures.length) {
+    throw new Error(`${failures.length} validation behavior lock(s) broken:\n  - ` + failures.join('\n  - '))
+  }
+  console.log("✅ validation behavior lock tests passed")
+}
+
+if (require.main === module) {
+  validation_behavior_lock_tests()
+    .then(() => { console.log("✅ suite completed"); process.exit(0) })
+    .catch((err) => { console.error("❌ suite failed:", err); process.exit(1) })
+}

package/src/tests/public_endpoint_tests.ts

@@ -9,6 +9,7 @@ import {
 } from "@tellescope/utilities"
 import { Session, /* APIQuery */ } from "../sdk"
 import { PublicEndpoints } from "../public"
+import { reset_test_tenant } from "./setup"
 
 const host = process.env.API_URL || 'http://localhost:8080'
 const [email, password] = [process.env.TEST_EMAIL, process.env.TEST_PASSWORD]
@@ -18,7 +19,7 @@ const sdkPub = PublicEndpoints({ host })
 
 if (!(email && password)) {
   console.error("Set TEST_EMAIL and TEST_PASSWORD")
-  process.exit()
+  process.exit(1) // 1, not 0: an unconfigured run must not report success
 }
 
 const enduser_login_tests = async () => {
@@ -59,7 +60,7 @@ const enduser_login_tests = async () => {
 
   try {
     await sdk.authenticate(email, password)
-    await sdk.reset_db()
+    await reset_test_tenant(sdk)
 
     await enduser_login_tests()
   } catch(err) {