@tellescope/sdk 1.256.2 → 1.256.4

package/src/tests/api_tests/welle_partner_token.test.ts

@@ -0,0 +1,249 @@
+require('source-map-support').install();
+
+import { createHmac } from "crypto"
+
+import { Session, EnduserSession } from "../../sdk"
+import {
+  assert,
+  async_test,
+  log_header,
+  wait,
+} from "@tellescope/testing"
+import { HEALTHIE_TITLE, WELLE_TITLE } from "@tellescope/constants"
+import { authenticate_enduser_via_token, setup_tests } from "../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const SIGNING_KEY = 'welle_test_signing_key_do_not_use_in_prod'
+const HEALTHIE_PATIENT_ID = '999888777'
+
+// decoding needs no dependency: these tests assert on CLAIMS, and verify the signature separately with crypto
+const decode_jwt_header = (token: string) => (
+  JSON.parse(Buffer.from(token.split('.')[0], 'base64url').toString())
+)
+const decode_jwt_payload = (token: string) => (
+  JSON.parse(Buffer.from(token.split('.')[1], 'base64url').toString()) as {
+    patientId: string,
+    iat: number,
+    exp: number,
+  }
+)
+const sign_hs256 = (signingInput: string, key: string) => (
+  createHmac('sha256', key).update(signingInput).digest('base64url')
+)
+
+// reset_db does NOT clear integrations, so a crashed prior run can leave a Welle record behind.
+// The partner-token branch does findOne({ title: WELLE_TITLE }), so a stray record would make the
+// "disconnected" assertion pass spuriously — clear them all rather than only the one we created.
+const delete_all_welle_integrations = async (sdk: Session) => {
+  const existing = await sdk.api.integrations.getSome({})
+  for (const integration of existing.filter(i => i.title === WELLE_TITLE)) {
+    await sdk.api.integrations.deleteOne(integration.id).catch(console.error)
+  }
+}
+
+export const welle_partner_token_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("Welle Partner Token Tests")
+
+  const suffix = Math.random().toString(36).slice(2, 10)
+  const linkedEmail = `welle.linked.${suffix}@tellescope.com`
+  const unlinkedEmail = `welle.unlinked.${suffix}@tellescope.com`
+
+  let linkedId = ''
+  let unlinkedId = ''
+
+  try {
+    await delete_all_welle_integrations(sdk)
+
+    await sdk.api.integrations.createOne({
+      title: WELLE_TITLE,
+      authentication: {
+        type: 'apiKey',
+        info: {
+          access_token: SIGNING_KEY,
+          refresh_token: 'unused',
+          scope: '',
+          token_type: 'Bearer',
+          expiry_date: 0,
+        },
+      },
+    })
+
+    // an enduser linked to Healthie — eligible for a partner token
+    const linked = await sdk.api.endusers.createOne({ email: linkedEmail, fname: 'Welle', lname: 'Linked' })
+    linkedId = linked.id
+    await sdk.api.endusers.updateOne(
+      linkedId,
+      { references: [{ type: HEALTHIE_TITLE, id: HEALTHIE_PATIENT_ID }] } as any,
+      { replaceObjectFields: true },
+    )
+
+    // an enduser with no Healthie reference
+    const unlinked = await sdk.api.endusers.createOne({ email: unlinkedEmail, fname: 'Welle', lname: 'Unlinked' })
+    unlinkedId = unlinked.id
+
+    const linkedSDK = new EnduserSession({ host, businessId: sdk.userInfo.businessId })
+    await authenticate_enduser_via_token(sdk, linkedSDK, { email: linkedEmail })
+
+    const unlinkedSDK = new EnduserSession({ host, businessId: sdk.userInfo.businessId })
+    await authenticate_enduser_via_token(sdk, unlinkedSDK, { email: unlinkedEmail })
+
+    // 1) happy path — claims are correct
+    let issuedToken = ''
+    await async_test(
+      `enduser can mint a Welle partner token with the expected claims`,
+      () => linkedSDK.api.integrations.proxy_read({ integration: WELLE_TITLE, type: 'partner-redirect-token' }),
+      { onResult: (r: any) => {
+        issuedToken = r?.data?.token
+        if (!issuedToken) return false
+
+        const header = decode_jwt_header(issuedToken)
+        const payload = decode_jwt_payload(issuedToken)
+        const expectedExp = Math.floor(Date.now() / 1000) + 3600
+
+        return (
+          header.alg === 'HS256'
+          && payload.patientId === HEALTHIE_PATIENT_ID
+          && Math.abs(payload.exp - expectedExp) < 60
+        )
+      }},
+    )
+
+    // 2) the signature is real — verifies against the stored signing key, and only that key
+    const [header, payload, signature] = issuedToken.split('.')
+    assert(
+      sign_hs256(`${header}.${payload}`, SIGNING_KEY) === signature,
+      "token signature does not verify against the stored Welle signing key",
+      "token is signed with the organization's Welle signing key",
+    )
+    assert(
+      sign_hs256(`${header}.${payload}`, `${SIGNING_KEY}_wrong`) !== signature,
+      "token signature verified against the WRONG key",
+      "token signature does not verify against a different key",
+    )
+
+    // 3) the subject is non-forgeable — the branch ignores the id param and uses the session's enduser
+    await async_test(
+      `enduser cannot mint a token for another enduser by passing id`,
+      () => linkedSDK.api.integrations.proxy_read({
+        integration: WELLE_TITLE,
+        type: 'partner-redirect-token',
+        id: unlinkedId,
+      }),
+      { onResult: (r: any) => (
+        !!r?.data?.token && decode_jwt_payload(r.data.token).patientId === HEALTHIE_PATIENT_ID
+      )},
+    )
+
+    // 4) an enduser with no Healthie reference gets no token
+    await async_test(
+      `enduser without a Healthie reference cannot mint a token`,
+      () => unlinkedSDK.api.integrations.proxy_read({ integration: WELLE_TITLE, type: 'partner-redirect-token' }),
+      { shouldError: true, onError: (e: any) => (e?.message || '').includes('enduser has no Healthie reference') },
+    )
+
+    // 5) staff sessions are not served by this branch (it is enduser-gated) — falls through to an empty result
+    await async_test(
+      `admin user session is not issued a Welle partner token`,
+      () => sdk.api.integrations.proxy_read({ integration: WELLE_TITLE, type: 'partner-redirect-token' }),
+      { onResult: (r: any) => !r?.data?.token },
+    )
+    await async_test(
+      `non-admin user session is not issued a Welle partner token`,
+      () => sdkNonAdmin.api.integrations.proxy_read({ integration: WELLE_TITLE, type: 'partner-redirect-token' }),
+      { onResult: (r: any) => !r?.data?.token },
+    )
+
+    // 6) no other Welle proxy_read type is reachable by an enduser
+    await async_test(
+      `enduser cannot read other Welle proxy types`,
+      () => linkedSDK.api.integrations.proxy_read({ integration: WELLE_TITLE, type: 'anything-else' }),
+      { shouldError: true, onError: (e: any) => (
+        (e?.message || '').includes('enduser session type not valid for this integration type')
+      )},
+    )
+
+    // 7) with the integration disconnected, no token can be minted
+    await delete_all_welle_integrations(sdk)
+    await async_test(
+      `no token is issued once the Welle integration is disconnected`,
+      () => linkedSDK.api.integrations.proxy_read({ integration: WELLE_TITLE, type: 'partner-redirect-token' }),
+      { shouldError: true, onError: (e: any) => (e?.message || '').includes('Welle integration not found') },
+    )
+
+    // 8) the real connect path — add_api_key_integration, not integrations.createOne.
+    // Welle has no credential-validation branch (an opaque HMAC key has nothing to authenticate
+    // against), so unlike Canvas/Candid/MDI this endpoint makes no upstream call and is testable.
+    await async_test(
+      `add_api_key_integration connects Welle`,
+      () => sdk.api.integrations.add_api_key_integration({ integration: WELLE_TITLE, API_KEY: SIGNING_KEY }),
+      { onResult: (r: any) => r?.integration?.title === WELLE_TITLE },
+    )
+    await async_test(
+      `add_api_key_integration sets hasConnectedWelle`,
+      () => sdk.api.organizations.getOne(sdk.userInfo.businessId),
+      { onResult: (o: any) => o?.hasConnectedWelle === true },
+    )
+
+    // the key stored by add_api_key_integration must land in the field the proxy_read branch reads
+    // (authentication.info.access_token) — minting a verifiable token proves the two paths agree
+    await async_test(
+      `token minted from the add_api_key_integration credential verifies`,
+      () => linkedSDK.api.integrations.proxy_read({ integration: WELLE_TITLE, type: 'partner-redirect-token' }),
+      { onResult: (r: any) => {
+        const token = r?.data?.token
+        if (!token) return false
+        const [h, p, s] = token.split('.')
+        return sign_hs256(`${h}.${p}`, SIGNING_KEY) === s
+          && decode_jwt_payload(token).patientId === HEALTHIE_PATIENT_ID
+      }},
+    )
+
+    // 9) the real disconnect path — remove_api_key_integration
+    await async_test(
+      `remove_api_key_integration disconnects Welle`,
+      () => sdk.api.integrations.remove_api_key_integration({ integration: WELLE_TITLE }),
+      { onResult: () => true },
+    )
+    // the org flag update is fire-and-forget on this handler (res.end() returns before the .then chain)
+    await wait(undefined, 250)
+    await async_test(
+      `remove_api_key_integration clears hasConnectedWelle`,
+      () => sdk.api.organizations.getOne(sdk.userInfo.businessId),
+      { onResult: (o: any) => !o?.hasConnectedWelle },
+    )
+    await async_test(
+      `no token is issued after remove_api_key_integration`,
+      () => linkedSDK.api.integrations.proxy_read({ integration: WELLE_TITLE, type: 'partner-redirect-token' }),
+      { shouldError: true, onError: (e: any) => (e?.message || '').includes('Welle integration not found') },
+    )
+  } finally {
+    await delete_all_welle_integrations(sdk).catch(console.error)
+    await sdk.api.organizations.updateOne(sdk.userInfo.businessId, { hasConnectedWelle: false }).catch(console.error)
+    for (const id of [linkedId, unlinkedId]) {
+      if (!id) continue
+      await sdk.api.endusers.deleteOne(id).catch(console.error)
+    }
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await welle_partner_token_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ Welle partner token test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Welle partner token test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/stripe_webhook_helpers.ts

@@ -0,0 +1,240 @@
+import crypto from "crypto"
+
+import { Session } from "../sdk"
+
+const host = process.env.API_URL || 'http://localhost:8080'
+
+// Marks the throwaway integrations created by tests so a run can clear residue left by an earlier
+// run that exited early. The test harness calls process.exit(1) on the first failed assertion, which
+// skips finally blocks, so cleanup cannot be relied on.
+export const TEST_STRIPE_ENVIRONMENT = 'tellescope-test-stripe-webhooks'
+
+// title must be exactly STRIPE_TITLE for the webhook handler to find the integration
+const STRIPE_TITLE = 'Stripe'
+
+let uniqueCounter = 0
+const unique_suffix = () => `${Date.now()}_${uniqueCounter++}`
+
+/**
+ * Stripe signs `${timestamp}.${rawBody}` with HMAC-SHA256 and sends it hex-encoded in a
+ * `t=<unixSeconds>,v1=<hex>` header. Reproducing it here lets tests exercise the real webhook
+ * route — signature verification included — without Stripe or network access.
+ *
+ * The default timestamp is always in tolerance (Stripe allows 300s and only rejects old ones);
+ * pass an old timestamp explicitly to test rejection.
+ */
+export const sign_stripe_payload = (
+  rawBody: string,
+  secret: string,
+  timestamp = Math.floor(Date.now() / 1000),
+) => (
+  `t=${timestamp},v1=${crypto.createHmac('sha256', secret).update(`${timestamp}.${rawBody}`, 'utf8').digest('hex')}`
+)
+
+/**
+ * POSTs an event to the custom Stripe webhook route.
+ *
+ * Serializes the body here and signs those exact bytes, because the route uses
+ * express.raw and the signature covers the raw body verbatim — handing a pre-serialized
+ * string to fetch is what keeps the two in sync.
+ *
+ * Pass `signature` to override the computed one (for rejection tests).
+ */
+export const post_stripe_webhook = async ({ stripePublicKey, event, secret, signature } : {
+  stripePublicKey: string,
+  event: object,
+  secret: string,
+  signature?: string,
+}) => {
+  const rawBody = JSON.stringify(event)
+
+  const res = await fetch(`${host}/v1/webhooks/stripe/custom/${stripePublicKey}`, {
+    method: 'POST',
+    headers: {
+      // express.raw({ type: 'application/json' }) leaves req.body unset without this
+      'Content-Type': 'application/json',
+      'stripe-signature': signature ?? sign_stripe_payload(rawBody, secret),
+    },
+    body: rawBody,
+  })
+
+  return { status: res.status, data: await res.text() }
+}
+
+/**
+ * Creates a throwaway custom Stripe integration and returns the values needed to sign webhooks for
+ * it, plus a cleanup function to call in a finally block.
+ *
+ * The access token is never used: neither invoice.payment_failed nor customer.subscription.deleted
+ * calls the Stripe API, and constructing a Stripe client doesn't validate the key or hit the network.
+ */
+export const setup_stripe_test_integration = async (sdk: Session) => {
+  // The handler looks up the integration across all businesses, so this must not collide with
+  // another tenant's real public key or with a concurrent run.
+  const stripePublicKey = `pk_test_tellescope_${unique_suffix()}`
+  const webhooksSecret = `whsec_test_${crypto.randomBytes(16).toString('hex')}`
+
+  await cleanup_stripe_test_integrations(sdk)
+
+  const integration = await sdk.api.integrations.createOne({
+    title: STRIPE_TITLE,
+    environment: TEST_STRIPE_ENVIRONMENT,
+    authentication: {
+      type: 'apiKey',
+      info: {
+        // all of these are required by integrationAuthenticationsValidator, and only
+        // external_id (the public key in the webhook URL) is actually read by the handler
+        access_token: 'sk_test_unused_by_this_path',
+        refresh_token: 'unused',
+        scope: '',
+        expiry_date: Date.now(),
+        token_type: 'Bearer',
+        external_id: stripePublicKey,
+      },
+    },
+    // never readable afterwards (redactions: ['all']), so the caller must keep the returned value
+    webhooksSecret,
+  })
+
+  return {
+    stripePublicKey,
+    webhooksSecret,
+    integrationId: integration.id,
+    cleanup: () => sdk.api.integrations.deleteOne(integration.id),
+  }
+}
+
+/** Deletes any test Stripe integrations left behind by a run that exited before its cleanup. */
+export const cleanup_stripe_test_integrations = async (sdk: Session) => {
+  const existing = await sdk.api.integrations.getSome({ filter: { title: STRIPE_TITLE } })
+    .catch(() => [])
+
+  await Promise.all(
+    existing
+      .filter(i => i.environment === TEST_STRIPE_ENVIRONMENT)
+      .map(i => sdk.api.integrations.deleteOne(i.id).catch(console.error))
+  )
+}
+
+/* ------------------------------- event fixtures ------------------------------- */
+
+// An invoice line item references its product through price.product on every modern line item, and
+// through plan.product only on subscription/proration lines. Either may be a bare id or an expanded
+// object, so each shape gets a builder.
+export const line_with_price_product = (stripeProductId: string) => ({
+  price: { product: stripeProductId },
+})
+export const line_with_expanded_price_product = (stripeProductId: string) => ({
+  price: { product: { id: stripeProductId, object: 'product' } },
+})
+export const line_with_plan_product = (stripeProductId: string) => ({
+  price: null,
+  plan: { product: stripeProductId },
+})
+
+/**
+ * Minimal invoice.payment_failed envelope. constructEvent only requires valid JSON — it does not
+ * validate id/object/api_version — so this carries just the fields the handler reads.
+ */
+export const invoice_payment_failed_event = ({ stripeCustomerId, lines = [], has_more = false } : {
+  stripeCustomerId: string,
+  lines?: object[],
+  has_more?: boolean,
+}) => ({
+  type: 'invoice.payment_failed',
+  data: {
+    object: {
+      id: `in_test_${unique_suffix()}`,
+      customer: stripeCustomerId,
+      lines: { object: 'list', data: lines, has_more },
+    },
+  },
+})
+
+/** Minimal customer.subscription.deleted envelope; the handler reads items.data[].plan.product. */
+export const subscription_deleted_event = ({ stripeCustomerId, stripeProductIds = [] } : {
+  stripeCustomerId: string,
+  stripeProductIds?: string[],
+}) => ({
+  type: 'customer.subscription.deleted',
+  data: {
+    object: {
+      id: `sub_test_${unique_suffix()}`,
+      customer: stripeCustomerId,
+      items: {
+        object: 'list',
+        data: stripeProductIds.map(product => ({ plan: { product } })),
+      },
+    },
+  },
+})
+
+/**
+ * A subscription item references its product through price.product on every modern item, and through
+ * plan.product on legacy ones. Either may be a bare id or an expanded object.
+ */
+export const item_with_price_product = (stripeProductId: string) => ({
+  price: { product: stripeProductId },
+})
+export const item_with_expanded_price_product = (stripeProductId: string) => ({
+  price: { product: { id: stripeProductId, object: 'product' } },
+})
+export const item_with_plan_product = (stripeProductId: string) => ({
+  price: null,
+  plan: { product: stripeProductId },
+})
+
+/** A pause_collection value, as Stripe carries it on a paused-collection subscription. */
+export const PAUSE_COLLECTION = { behavior: 'void', resumes_at: null }
+
+/**
+ * customer.subscription.updated envelope. `previousAttributes` is the whole previous_attributes bag,
+ * so a case can express "pause_collection key absent" (pass {}) distinctly from
+ * "pause_collection was null" (pass { pause_collection: null }) — that distinction is the entire
+ * gate the handler uses to avoid running on every renewal.
+ */
+export const subscription_updated_event = ({
+  stripeCustomerId, items = [], previousAttributes = {}, pauseCollection = null, status = 'active',
+} : {
+  stripeCustomerId: string,
+  items?: object[],
+  previousAttributes?: object,
+  pauseCollection?: object | null,
+  status?: string,
+}) => ({
+  type: 'customer.subscription.updated',
+  data: {
+    object: {
+      id: `sub_test_${unique_suffix()}`,
+      customer: stripeCustomerId,
+      status,
+      pause_collection: pauseCollection,
+      items: { object: 'list', data: items, has_more: false },
+    },
+    previous_attributes: previousAttributes,
+  },
+})
+
+/**
+ * The dedicated customer.subscription.paused / .resumed events, which Stripe emits only for
+ * status='paused' transitions. The handler fires unconditionally on these, so no previous_attributes.
+ */
+const subscription_pause_event = (type: string) => ({ stripeCustomerId, items = [], status } : {
+  stripeCustomerId: string,
+  items?: object[],
+  status?: string,
+}) => ({
+  type,
+  data: {
+    object: {
+      id: `sub_test_${unique_suffix()}`,
+      customer: stripeCustomerId,
+      status: status ?? (type === 'customer.subscription.paused' ? 'paused' : 'active'),
+      pause_collection: null,
+      items: { object: 'list', data: items, has_more: false },
+    },
+  },
+})
+
+export const subscription_paused_event = subscription_pause_event('customer.subscription.paused')
+export const subscription_resumed_event = subscription_pause_event('customer.subscription.resumed')

package/src/tests/tests.ts

@@ -41,6 +41,7 @@ import { translations_tests } from "./api_tests/translations.test"
 import { embeddables_auth_token_tests } from "./api_tests/embeddables_auth_token.test"
 import { user_portal_settings_tests } from "./api_tests/user_portal_settings.test"
 import { integrations_redacted_tests } from "./api_tests/integrations_redacted.test"
+import { welle_partner_token_tests } from "./api_tests/welle_partner_token.test"
 import { healthie_multi_integration_tests } from "./api_tests/healthie_multi_integration.test"
 import { get_some_projection_tests } from "./api_tests/get_some_projection.test"
 import { file_download_unicode_names_tests } from "./api_tests/file_download_unicode_names.test"
@@ -150,8 +151,10 @@ import { openloop_webhooks_tests } from "./api_tests/openloop_webhooks.test";
 import { beluga_pharmacy_mappings_tests } from "./api_tests/beluga_pharmacy_mappings.test";
 import { mdi_case_offerings_tests } from "./api_tests/mdi_case_offerings.test";
 import { beluga_manual_sync_tests } from "./api_tests/beluga_manual_sync.test";
+import { metriport_push_form_response_tests } from "./api_tests/metriport_push_form_response.test";
 import { beluga_trigger_refill_tests } from "./api_tests/beluga_trigger_refill.test";
 import { mdi_webhooks_tests } from "./api_tests/mdi_webhooks.test";
+import { stripe_webhook_triggers_tests } from "./api_tests/stripe_webhook_triggers.test";
 import { account_switcher_tests } from "./api_tests/account_switcher.test";
 import { totp_mfa_tests } from "./api_tests/totp_mfa.test";
 import { set_fields_order_templates_tests } from "./api_tests/set_fields_order_templates.test";
@@ -15293,6 +15296,7 @@ const ip_address_form_tests = async () => {
     await automation_trigger_tests()
     await resource_access_tags_tests({ sdk, sdkNonAdmin })
     await beluga_manual_sync_tests({ sdk, sdkNonAdmin })
+    await metriport_push_form_response_tests({ sdk, sdkNonAdmin })
     await beluga_trigger_refill_tests({ sdk, sdkNonAdmin })
     await beluga_pharmacy_mappings_tests({ sdk, sdkNonAdmin })
     await mdi_case_offerings_tests({ sdk, sdkNonAdmin })
@@ -15338,7 +15342,9 @@ const ip_address_form_tests = async () => {
     await phone_tree_enduser_condition_tests({ sdk, sdkNonAdmin })
     await openloop_webhooks_tests({ sdk, sdkNonAdmin })
     await mdi_webhooks_tests({ sdk, sdkNonAdmin })
+    await stripe_webhook_triggers_tests({ sdk, sdkNonAdmin })
     await integrations_redacted_tests({ sdk, sdkNonAdmin })
+    await welle_partner_token_tests({ sdk, sdkNonAdmin })
     await healthie_multi_integration_tests({ sdk, sdkNonAdmin })
     await mdb_sort_tests({ sdk, sdkNonAdmin })
     await search_tests()