@tellescope/sdk 1.256.2 → 1.256.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tellescope/sdk",
-  "version": "1.256.2",
+  "version": "1.256.3",
   "description": "Code for interacting with the Tellescope API",
   "main": "./lib/cjs/sdk.js",
   "module": "./lib/esm/sdk.js",
@@ -32,14 +32,14 @@
   },
   "homepage": "https://github.com/tellescope-os/tellescope#readme",
   "dependencies": {
-    "@tellescope/constants": "1.256.2",
-    "@tellescope/schema": "1.256.2",
-    "@tellescope/testing": "1.256.2",
-    "@tellescope/types-client": "1.256.2",
-    "@tellescope/types-models": "1.256.2",
-    "@tellescope/types-utilities": "1.256.2",
-    "@tellescope/utilities": "1.256.2",
-    "@tellescope/validation": "1.256.2",
+    "@tellescope/constants": "1.256.3",
+    "@tellescope/schema": "1.256.3",
+    "@tellescope/testing": "1.256.3",
+    "@tellescope/types-client": "1.256.3",
+    "@tellescope/types-models": "1.256.3",
+    "@tellescope/types-utilities": "1.256.3",
+    "@tellescope/utilities": "1.256.3",
+    "@tellescope/validation": "1.256.3",
     "axios": "0.30.3",
     "dotenv": "14.3.2",
     "form-data": "4.0.4",
@@ -55,5 +55,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "a796b01e2a6ccc1f40aeb07084d8b8922e4d078e"
+  "gitHead": "0f451abd251f9b79af46bffb994b5e815477bd49"
 }

package/src/tests/api_tests/metriport_push_form_response.test.ts

@@ -0,0 +1,226 @@
+require('source-map-support').install();
+
+import { Session } from "../../sdk"
+import {
+  assert,
+  async_test,
+  log_header,
+} from "@tellescope/testing"
+import { setup_tests } from "../setup"
+import { METRIPORT_TITLE } from "@tellescope/constants"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+// metriportPushFormResponse journey action (CU-86e2cucba).
+//
+// Fast / no-upload: this exercises validation and the guard branches that reject before any
+// Metriport HTTP call. A real upload needs a Metriport sandbox API key plus a patient already
+// synced to a facility, so the happy path is verified manually (see the task plan).
+export const metriport_push_form_response_tests = async ({ sdk, sdkNonAdmin }: { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("Metriport Push Form Response Tests")
+
+  let enduserId: string | undefined
+  let otherEnduserId: string | undefined
+  let formId: string | undefined
+  let journeyId: string | undefined
+  let createdIntegrationId: string | undefined
+
+  try {
+    const journey = await sdk.api.journeys.createOne({ title: 'Metriport Push Form Response Journey' })
+    journeyId = journey.id
+
+    const form = await sdk.api.forms.createOne({ title: 'Metriport Push Form Response Form' })
+    formId = form.id
+    const field = await sdk.api.form_fields.createOne({
+      formId: form.id, type: 'string', title: 'Chief Complaint', previousFields: [{ type: 'root', info: {} }],
+    })
+
+    const enduser = await sdk.api.endusers.createOne({
+      fname: 'metriport-push',
+      lname: 'test',
+      email: `metriport_push_${Date.now()}@test.tellescope.com`,
+    })
+    enduserId = enduser.id
+
+    /*************** validation ***************/
+    const step = await sdk.api.automation_steps.createOne({
+      journeyId: journey.id,
+      events: [{ type: 'onJourneyStart', info: {} }],
+      action: { type: 'metriportPushFormResponse', info: { formId: form.id, integrationTitle: '' } },
+    })
+    assert(
+      step.action.type === 'metriportPushFormResponse' && step.action.info.formId === form.id,
+      'metriportPushFormResponse step round-trip failed',
+      'metriportPushFormResponse step round-trips',
+    )
+
+    // formId is optional — a step with no info at all is valid (uses the journey's form response)
+    const contextOnlyStep = await sdk.api.automation_steps.createOne({
+      journeyId: journey.id,
+      events: [{ type: 'onJourneyStart', info: {} }],
+      action: { type: 'metriportPushFormResponse', info: {} },
+    })
+    assert(
+      contextOnlyStep.action.type === 'metriportPushFormResponse',
+      'metriportPushFormResponse step without info was rejected',
+      'metriportPushFormResponse info is optional',
+    )
+
+    await async_test('metriportPushFormResponse with a malformed formId is rejected',
+      () => sdk.api.automation_steps.createOne({
+        journeyId: journey.id,
+        events: [{ type: 'onJourneyStart', info: {} }],
+        action: { type: 'metriportPushFormResponse', info: { formId: 'not-a-mongo-id' } },
+      }),
+      { shouldError: true, onError: () => true },
+    )
+
+    /*************** runtime ***************/
+    const { accessCode, response } = await sdk.api.form_responses.prepare_form_response({
+      enduserId: enduser.id, formId: form.id,
+    })
+    await sdk.api.form_responses.submit_form_response({
+      accessCode,
+      responses: [{ fieldId: field.id, fieldTitle: 'Chief Complaint', answer: { type: 'string', value: 'Headache' } }],
+    })
+    const formResponseId = response.id
+
+    const processStep = async () => {
+      const automatedAction = await sdk.api.automated_actions.createOne({
+        enduserId: enduser.id,
+        journeyId: journey.id,
+        automationStepId: step.id,
+        event: { type: 'onJourneyStart', info: {} },
+        action: { type: 'metriportPushFormResponse', info: { formId: form.id } },
+        journeyContext: { formResponseId },
+        status: 'active',
+        processAfter: Date.now(),
+      })
+      return sdk.api.automated_actions.process({ automatedActionId: automatedAction.id })
+    }
+
+    // The org may already have a Metriport integration; only the no-integration assertion depends
+    // on it being absent, so check first.
+    let metriportIntegrationExists = false
+    try {
+      const existing = await sdk.api.integrations.load_redacted({})
+      metriportIntegrationExists = !!existing.integrations.find((i: any) => i.title === METRIPORT_TITLE)
+    } catch { /* load not permitted — treat as absent and let the assertions below tell us */ }
+
+    if (!metriportIntegrationExists) {
+      const noIntegrationResult = await processStep()
+      assert(
+        !noIntegrationResult.success
+          && !noIntegrationResult.unimplemented
+          && noIntegrationResult.error === 'Metriport integration not found',
+        `expected 'Metriport integration not found', got: ${JSON.stringify(noIntegrationResult)}`,
+        'metriportPushFormResponse is wired into automated_actions.process (no integration)',
+      )
+
+      const created = await sdk.api.integrations.createOne({
+        title: METRIPORT_TITLE,
+        authentication: {
+          type: 'apiKey',
+          info: { access_token: 'test-metriport-api-key', refresh_token: 'unused', scope: '', token_type: 'Bearer', expiry_date: new Date().getTime() },
+        },
+      })
+      createdIntegrationId = created.id
+    }
+
+    // With an integration but a patient that was never synced to a facility, the action fails
+    // before any HTTP call to Metriport
+    const unsyncedResult = await processStep()
+    assert(
+      !unsyncedResult.success
+        && !unsyncedResult.unimplemented
+        && /not synced to Metriport/i.test(unsyncedResult.error || ''),
+      `expected a 'Patient is not synced to Metriport' error, got: ${JSON.stringify(unsyncedResult)}`,
+      'metriportPushFormResponse rejects a patient not synced to Metriport',
+    )
+
+    /*************** cross-patient ownership (CU-86e2cucba security fix) ***************/
+    // A journeyContext.formResponseId belonging to patient A must never be exported under a
+    // different patient B — the switchToRelatedContact path can move enduserId off the form
+    // response's owner while journeyContext still points at A's response.
+    const otherEnduser = await sdk.api.endusers.createOne({
+      fname: 'metriport-push-other',
+      lname: 'test',
+      email: `metriport_push_other_${Date.now()}@test.tellescope.com`,
+    })
+    otherEnduserId = otherEnduser.id
+
+    const crossPatientAction = await sdk.api.automated_actions.createOne({
+      enduserId: otherEnduser.id, // patient B
+      journeyId: journey.id,
+      automationStepId: step.id,
+      event: { type: 'onJourneyStart', info: {} },
+      action: { type: 'metriportPushFormResponse', info: { formId: form.id } },
+      journeyContext: { formResponseId }, // patient A's submitted response
+      status: 'active',
+      processAfter: Date.now(),
+    })
+    const crossPatientResult = await sdk.api.automated_actions.process({ automatedActionId: crossPatientAction.id })
+    assert(
+      !crossPatientResult.success
+        && !crossPatientResult.unimplemented
+        && crossPatientResult.error === 'Form response does not belong to this patient',
+      `expected a cross-patient ownership rejection, got: ${JSON.stringify(crossPatientResult)}`,
+      'metriportPushFormResponse rejects a form response owned by a different patient',
+    )
+
+    // the rejection must occur before any Metriport reference is stamped on A's response
+    const untouched = await sdk.api.form_responses.getOne(formResponseId)
+    assert(
+      !(untouched as any).references?.find((r: any) => r.type === METRIPORT_TITLE),
+      `patient A's form response was stamped despite a cross-patient rejection: ${JSON.stringify((untouched as any).references)}`,
+      'metriportPushFormResponse does not stamp a form response on cross-patient rejection',
+    )
+
+    /*************** idempotency ***************/
+    // form_responses.references is a readonly field, so it can only be stamped server-side (which
+    // is what a successful upload does). Attempt the stamp; if the API drops it, skip the check
+    // rather than assert on a state we couldn't set up.
+    await sdk.api.form_responses.updateOne(formResponseId, {
+      references: [{ type: METRIPORT_TITLE, id: 'test-document-reference-id' }],
+    } as any).catch(() => {})
+
+    const stamped = await sdk.api.form_responses.getOne(formResponseId)
+    if ((stamped as any).references?.find((r: any) => r.type === METRIPORT_TITLE)) {
+      const idempotentResult = await processStep()
+      assert(
+        idempotentResult.success === true,
+        `expected a no-op success for an already-shared form response, got: ${JSON.stringify(idempotentResult)}`,
+        'metriportPushFormResponse no-ops for an already-shared form response',
+      )
+    } else {
+      console.log("⏭️  Skipping idempotency check (form_responses.references is readonly over the API)")
+    }
+  } finally {
+    if (createdIntegrationId) await sdk.api.integrations.deleteOne(createdIntegrationId).catch(console.error)
+    if (journeyId) await sdk.api.journeys.deleteOne(journeyId).catch(console.error)
+    if (formId) await sdk.api.forms.deleteOne(formId).catch(console.error)
+    if (enduserId) await sdk.api.endusers.deleteOne(enduserId).catch(console.error)
+    if (otherEnduserId) await sdk.api.endusers.deleteOne(otherEnduserId).catch(console.error)
+  }
+}
+
+if (require.main === module) {
+  console.log(`Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await metriport_push_form_response_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ Metriport push form response test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Metriport push form response test suite failed:", error)
+      process.exit(1)
+    })
+}