@tellescope/sdk 1.256.6 → 1.256.7

package/src/tests/api_tests/purchase_made_trigger.test.ts

@@ -111,6 +111,37 @@ export const purchase_made_trigger_tests = async ({ sdk, sdkNonAdmin } : { sdk:
   const enduser13 = await sdk.api.endusers.createOne({})
   const enduser14 = await sdk.api.endusers.createOne({})
 
+  // couponCodes filter triggers
+  const t10 = await sdk.api.automation_triggers.createOne({
+    event: { type: 'Purchase Made', info: { couponCodes: ['SUMMER20'] } },
+    action: { type: 'Add Tags', info: { tags: ['Purchase-Coupon-Summer20'] }},
+    status: 'Active',
+    title: "Purchase - Coupon SUMMER20"
+  })
+
+  // Empty couponCodes array should behave like no filter
+  const t11 = await sdk.api.automation_triggers.createOne({
+    event: { type: 'Purchase Made', info: { couponCodes: [] } },
+    action: { type: 'Add Tags', info: { tags: ['Purchase-Coupon-Empty'] }},
+    status: 'Active',
+    title: "Purchase - Empty couponCodes Array"
+  })
+
+  // Combined filter: title AND coupon must both match
+  const t12 = await sdk.api.automation_triggers.createOne({
+    event: { type: 'Purchase Made', info: { titles: ['Premium Course Package'], couponCodes: ['SUMMER20'] } },
+    action: { type: 'Add Tags', info: { tags: ['Purchase-Title-And-Coupon'] }},
+    status: 'Active',
+    title: "Purchase - Title and Coupon"
+  })
+
+  const enduser15 = await sdk.api.endusers.createOne({})
+  const enduser16 = await sdk.api.endusers.createOne({})
+  const enduser17 = await sdk.api.endusers.createOne({})
+  const enduser18 = await sdk.api.endusers.createOne({})
+  const enduser19 = await sdk.api.endusers.createOne({})
+  const enduser20 = await sdk.api.endusers.createOne({})
+
   // Test 1: Purchase without specific filters (should trigger t1 for any purchase)
   const purchase1 = await sdk.api.purchases.createOne({
     enduserId: enduser1.id,
@@ -321,6 +352,103 @@ export const purchase_made_trigger_tests = async ({ sdk, sdkNonAdmin } : { sdk:
     { onResult: (e: Enduser) => !!e.tags?.includes('Purchase-Any') && !e.tags?.includes('Purchase-No-Title-Test') }
   )
 
+  // Test 15: exact coupon code match fires the coupon-scoped trigger
+  const purchase15 = await sdk.api.purchases.createOne({
+    enduserId: enduser15.id,
+    title: 'Coupon Test Purchase',
+    cost: { amount: 9999, currency: 'USD' },
+    processor: 'Stripe',
+    couponCodes: ['SUMMER20'],
+  })
+  await wait(undefined, 500)
+  await async_test(
+    "Purchase Made - Coupon Code Match (exact)",
+    () => sdk.api.endusers.getOne(enduser15.id),
+    { onResult: (e: Enduser) => !!e.tags?.includes('Purchase-Coupon-Summer20') && !!e.tags?.includes('Purchase-Coupon-Empty') }
+  )
+
+  // Test 16: coupon match is case-sensitive — Stripe returns the canonical merchant-defined
+  // code, so a differently-cased value must NOT fire the coupon-scoped trigger
+  const purchase16 = await sdk.api.purchases.createOne({
+    enduserId: enduser16.id,
+    title: 'Coupon Test Purchase',
+    cost: { amount: 9999, currency: 'USD' },
+    processor: 'Stripe',
+    couponCodes: ['summer20'],
+  })
+  await wait(undefined, 500)
+  await async_test(
+    "Purchase Made - Coupon Code Case Mismatch (case sensitive, 'summer20' vs 'SUMMER20')",
+    () => sdk.api.endusers.getOne(enduser16.id),
+    { onResult: (e: Enduser) => !!e.tags?.includes('Purchase-Any') && !e.tags?.includes('Purchase-Coupon-Summer20') }
+  )
+
+  // Test 17: a different coupon code does NOT fire the coupon-scoped trigger
+  const purchase17 = await sdk.api.purchases.createOne({
+    enduserId: enduser17.id,
+    title: 'Coupon Test Purchase',
+    cost: { amount: 9999, currency: 'USD' },
+    processor: 'Stripe',
+    couponCodes: ['WINTER10'],
+  })
+  await wait(undefined, 500)
+  await async_test(
+    "Purchase Made - Non-matching Coupon Code",
+    () => sdk.api.endusers.getOne(enduser17.id),
+    { onResult: (e: Enduser) => !!e.tags?.includes('Purchase-Any') && !e.tags?.includes('Purchase-Coupon-Summer20') }
+  )
+
+  // Test 18: a purchase with no couponCodes never matches a coupon-scoped trigger, but
+  // unscoped and empty-array coupon triggers still fire (backward compat)
+  const purchase18 = await sdk.api.purchases.createOne({
+    enduserId: enduser18.id,
+    title: 'Coupon Test Purchase',
+    cost: { amount: 9999, currency: 'USD' },
+    processor: 'Stripe',
+  })
+  await wait(undefined, 500)
+  await async_test(
+    "Purchase Made - No Coupon Data (backward compat)",
+    () => sdk.api.endusers.getOne(enduser18.id),
+    { onResult: (e: Enduser) => !!e.tags?.includes('Purchase-Any') && !!e.tags?.includes('Purchase-Coupon-Empty') && !e.tags?.includes('Purchase-Coupon-Summer20') }
+  )
+
+  // Test 19: combined titles + couponCodes filter fires when both match
+  const purchase19 = await sdk.api.purchases.createOne({
+    enduserId: enduser19.id,
+    title: 'Premium Course Package',
+    cost: { amount: 9999, currency: 'USD' },
+    processor: 'Stripe',
+    couponCodes: ['SUMMER20'],
+  })
+  await wait(undefined, 500)
+  await async_test(
+    "Purchase Made - Title AND Coupon Match",
+    () => sdk.api.endusers.getOne(enduser19.id),
+    { onResult: (e: Enduser) => !!e.tags?.includes('Purchase-Title-And-Coupon') }
+  )
+
+  // Test 20: combined filter does NOT fire when the title matches but the coupon does not
+  const purchase20 = await sdk.api.purchases.createOne({
+    enduserId: enduser20.id,
+    title: 'Premium Course Package',
+    cost: { amount: 9999, currency: 'USD' },
+    processor: 'Stripe',
+  })
+  await wait(undefined, 500)
+  await async_test(
+    "Purchase Made - Title Matches But Coupon Missing (AND semantics)",
+    () => sdk.api.endusers.getOne(enduser20.id),
+    { onResult: (e: Enduser) => !!e.tags?.includes('Purchase-Exact-Title') && !e.tags?.includes('Purchase-Title-And-Coupon') }
+  )
+
+  // Validator round-trip: couponCodes persists on the trigger's event.info
+  await async_test(
+    "Purchase Made - couponCodes round-trips on trigger info",
+    () => sdk.api.automation_triggers.getOne(t10.id),
+    { onResult: t => JSON.stringify((t.event as any)?.info?.couponCodes) === JSON.stringify(['SUMMER20']) }
+  )
+
   try {
     // Clean up test data - triggers first
     await sdk.api.automation_triggers.deleteOne(t1.id)
@@ -332,6 +460,9 @@ export const purchase_made_trigger_tests = async ({ sdk, sdkNonAdmin } : { sdk:
     await sdk.api.automation_triggers.deleteOne(t7.id)
     await sdk.api.automation_triggers.deleteOne(t8.id)
     await sdk.api.automation_triggers.deleteOne(t9.id)
+    await sdk.api.automation_triggers.deleteOne(t10.id)
+    await sdk.api.automation_triggers.deleteOne(t11.id)
+    await sdk.api.automation_triggers.deleteOne(t12.id)
 
     // Clean up products
     await sdk.api.products.deleteOne(product1.id)
@@ -353,6 +484,12 @@ export const purchase_made_trigger_tests = async ({ sdk, sdkNonAdmin } : { sdk:
     await sdk.api.endusers.deleteOne(enduser12.id)
     await sdk.api.endusers.deleteOne(enduser13.id)
     await sdk.api.endusers.deleteOne(enduser14.id)
+    await sdk.api.endusers.deleteOne(enduser15.id)
+    await sdk.api.endusers.deleteOne(enduser16.id)
+    await sdk.api.endusers.deleteOne(enduser17.id)
+    await sdk.api.endusers.deleteOne(enduser18.id)
+    await sdk.api.endusers.deleteOne(enduser19.id)
+    await sdk.api.endusers.deleteOne(enduser20.id)
   } finally {}
 }
 

package/src/tests/api_tests/security/F-0006-develop-health-benefit-verification-rbac.test.ts

@@ -0,0 +1,144 @@
+require('source-map-support').install();
+
+import { ObjectId } from 'bson'
+import { Session } from "../../../sdk"
+import {
+  async_test,
+  log_header,
+  wait,
+} from "@tellescope/testing"
+import { setup_tests } from "../../setup"
+import { PROVIDER_PERMISSIONS } from "@tellescope/constants"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+const [nonAdminEmail, nonAdminPassword] = [process.env.NON_ADMIN_EMAIL, process.env.NON_ADMIN_PASSWORD]
+
+/**
+ * Regression test for F-0006 (security-audit/findings/F-0006-zoom-and-benefit-verification-bypass-rbac.md),
+ * reopened 2026-08-17 for the `develop_health_run_benefit_verification` sub-item.
+ *
+ * `enduser_eligibility_results.develop_health_run_benefit_verification` is registered with
+ * `noAccessPermissions: true` (packages/private/api/api/v1/api.ts, ~line 24606). Before the fix,
+ * it had no in-handler check on `session.access?.endusers?.read` /
+ * `session.access?.enduser_eligibility_results?.create`, so it loaded the caller-supplied
+ * enduser's PHI via `DB.endusers.findById` and forwarded it to the Develop Health integration
+ * regardless of the caller's role. It also let a zero-access caller fingerprint an enduser's
+ * profile completeness via the distinct validation error messages returned for missing fields.
+ *
+ * This test:
+ *   1. Creates a role with explicit NO_ACCESS for `endusers` and `enduser_eligibility_results`.
+ *   2. Assigns the role to the non-admin user and re-authenticates.
+ *   3. Calls the endpoint with a fake enduserId — asserts a 403-equivalent access error, not the
+ *      validation-error / integration-not-found path that would run pre-fix.
+ *
+ * Pre-fix: the handler proceeds past `DB.endusers.findById` and either 400s with a
+ * `validate_enduser_for_develop_health` message (enduser not found — since the id is fake) or,
+ * for a real target id, would load PHI and forward it to Develop Health. Either way, the access
+ * check never fires. Test fails (no access-denial signal).
+ *
+ * Post-fix: the handler throws 403 before touching `DB.endusers` at all. Test passes.
+ */
+export const develop_health_benefit_verification_rbac_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("F-0006: develop_health benefit verification RBAC regression")
+
+  const roleName = `f0006-develop-health-no-access-${Date.now()}`
+  let rbapId: string | undefined
+  const originalRoles = sdkNonAdmin.userInfo.roles
+
+  try {
+    // 1. Create a role that explicitly denies endusers access AND enduser_eligibility_results
+    //    access. This is the realistic configuration the bypass affects: a tenant operator
+    //    deliberately restricts a role from reading enduser PHI (e.g. for PHI-restricted
+    //    integration/API-key roles).
+    const rbap = await sdk.api.role_based_access_permissions.createOne({
+      role: roleName,
+      permissions: {
+        ...PROVIDER_PERMISSIONS,
+        endusers:                      { create: null, read: null, update: null, delete: null },
+        enduser_eligibility_results:   { create: null, read: null, update: null, delete: null },
+      },
+    })
+    rbapId = rbap.id
+
+    // 2. Assign the role to the non-admin user and re-authenticate so the new
+    //    session reflects the role's denied permissions.
+    await sdk.api.users.updateOne(
+      sdkNonAdmin.userInfo.id,
+      { roles: [roleName] },
+      { replaceObjectFields: true },
+    )
+    await wait(undefined, 1500)
+    await sdkNonAdmin.authenticate(nonAdminEmail!, nonAdminPassword!)
+
+    // 3. develop_health_run_benefit_verification must throw 403 BEFORE any enduser lookup.
+    //    Pre-fix: proceeds to DB.endusers.findById and either 400s on validation (fake id) or
+    //    succeeds and forwards PHI to Develop Health (real id) — never a 403.
+    await async_test(
+      "F-0006: enduser_eligibility_results.develop_health_run_benefit_verification must throw 403 when role denies endusers/enduser_eligibility_results",
+      () => sdkNonAdmin.api.enduser_eligibility_results.develop_health_run_benefit_verification({
+        enduserId: new ObjectId().toHexString(),       // fake id — access check should fire first
+        providerUserId: new ObjectId().toHexString(),  // fake id — access check should fire first
+        insuranceType: 'primary',
+        diagnoses: [],
+        // drugs uses a plain (non-empty-ok) list validator, so a real-shaped entry is required
+        // to pass request validation and actually reach the handler's access check.
+        drugs: [{ name: 'Test Drug', dosage: '10mg', quantity: 1 }],
+        drug_history: { currently_taking_drugs: [], previously_taken_drugs: [] },
+      } as any),
+      {
+        shouldError: true,
+        onError: (e: any) => {
+          // Accept any 4xx access-denial response — handler uses 403 (recommended).
+          // Explicitly reject the pre-fix "Integration not found" / "Enduser is required" /
+          // similar validation messages, which would indicate the access check never fired.
+          const msg = (e?.message ?? '').toLowerCase()
+          const status = e?.status ?? e?.code
+          if (msg.includes('integration not found') || msg.includes('enduser is required')
+            || msg.includes('organization') || msg.includes('provider')) {
+            return false // reached past the access gate — regression
+          }
+          return status === 403 || status === 401
+            || msg.includes('access') || msg.includes('permission') || msg.includes('forbidden')
+        },
+      },
+    )
+  } finally {
+    // Cleanup: restore original roles, delete the test role.
+    try {
+      await sdk.api.users.updateOne(
+        sdkNonAdmin.userInfo.id,
+        { roles: originalRoles ?? [] },
+        { replaceObjectFields: true },
+      )
+    } catch {}
+    if (rbapId) {
+      try { await sdk.api.role_based_access_permissions.deleteOne(rbapId) } catch {}
+    }
+    // Re-authenticate the non-admin to drop the no-access role from their JWT
+    // before subsequent tests run.
+    await wait(undefined, 1500)
+    try { await sdkNonAdmin.authenticate(nonAdminEmail!, nonAdminPassword!) } catch {}
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await develop_health_benefit_verification_rbac_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ F-0006 develop_health_run_benefit_verification RBAC test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ F-0006 develop_health_run_benefit_verification RBAC test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/security/public_endpoint_auth_field_lock.test.ts

@@ -327,12 +327,22 @@ export const public_endpoint_auth_field_lock_tests = async (
 
   // Throwaway host user with all-7-day availability, so G9 has slots to find without depending on
   // (or mutating) the shared test user's calendar configuration.
-  const hostUser = await sdk.api.users.createOne({
-    email: emailFor('lock-host'),
-    verifiedEmail: true,
-    fname: 'Lock',
-    lname: `Host${RUN}`,
-  })
+  // Stable email + get-or-create (rather than a per-run address): the cleanup below is not in a
+  // finally, and reset_db does not clear the users collection, so an interrupted run strands this
+  // user permanently. Reusing one address means at most one can ever exist — otherwise every
+  // interrupted run adds another provider to org-wide availability queries, which are capped at 25
+  // users sorted newest-first and would eventually evict the real test users.
+  const hostEmail = 'lock-host@tellescope.com'
+  const hostUser = (
+    await sdk.api.users.getOne({ email: hostEmail }).catch(() => null)
+  ) || (
+    await sdk.api.users.createOne({
+      email: hostEmail,
+      verifiedEmail: true,
+      fname: 'Lock',
+      lname: 'Host',
+    })
+  )
   createdUserIds.push(hostUser.id)
   await sdk.api.users.updateOne(hostUser.id, {
     weeklyAvailabilities: [0, 1, 2, 3, 4, 5, 6].map(dayOfWeekStartingSundayIndexedByZero => ({

package/src/tests/api_tests/stripe_webhook_triggers.test.ts

@@ -4,7 +4,13 @@ import { Session } from "../../sdk"
 import { assert, log_header, wait } from "@tellescope/testing"
 import { setup_tests } from "../setup"
 import {
+  charge_succeeded_event,
   cleanup_stripe_test_integrations,
+  discount_with_coupon,
+  discount_with_promo_code,
+  discount_with_promo_code_ref,
+  invoice_paid_event,
+  invoice_paid_line,
   invoice_payment_failed_event,
   item_with_expanded_price_product,
   item_with_plan_product,
@@ -640,6 +646,221 @@ export const stripe_webhook_triggers_tests = async ({ sdk, sdkNonAdmin } : { sdk
     }
     assert(rejectedInvalidPausedProductId, 'expected a non-ObjectId productId to be rejected', 'invalid Subscription Paused productId rejected')
 
+    /* ============ invoice.paid / charge.succeeded — coupon codes ============ */
+
+    // Purchases are created by the webhook handler itself, so persistence is polled the same way
+    // tags are. Cleaned up automatically when the enduser is deleted (onDependencyDelete: 'delete').
+    const poll_for_purchase = async (enduserId: string, iterations = 20) => {
+      for (let i = 0; i < iterations; i++) {
+        await wait(undefined, 500)
+        const purchases = await sdk.api.purchases.getSome({ filter: { enduserId } })
+        if (purchases.length) return purchases
+      }
+      return []
+    }
+
+    // One webhook POST per case: a Purchase Made trigger (coupon-scoped unless couponCodes is
+    // undefined) and an invoice.paid built by the caller.
+    const run_coupon_invoice_case = async ({ label, couponCodes, discounts, discount, shouldFire, title } : {
+      label: string,
+      couponCodes?: string[],
+      discounts?: (object | string)[],
+      discount?: object,
+      shouldFire: boolean,
+      title: string,
+    }) => {
+      const caseTag = tag(label)
+      const enduser = await new_enduser(label)
+      await new_trigger({
+        title: `Stripe purchase made (${label}) ${RUN}`,
+        event: { type: 'Purchase Made', info: couponCodes !== undefined ? { couponCodes } : {} },
+        tags: [caseTag],
+      })
+
+      const res = await post_stripe_webhook({
+        stripePublicKey,
+        secret: webhooksSecret,
+        event: invoice_paid_event({
+          stripeCustomerId: enduser.stripeCustomerId,
+          lines: [invoice_paid_line({ description: `Coupon Test ${label} ${RUN}` })],
+          discounts,
+          discount,
+        }),
+      })
+      assert(res.status === 200, `expected 200, got ${res.status} (${res.data})`, `${label} webhook accepted`)
+
+      if (shouldFire) await expect_fired(enduser.id, caseTag, title)
+      else await expect_not_fired(enduser.id, caseTag, title)
+
+      return enduser
+    }
+
+    // C1: the feature — a coupon-scoped trigger fires for an invoice discounted with that promo
+    // code, and the code is persisted on the purchase record. The expanded promotion_code object
+    // reflects the post-expansion shape (and the checkout-session breakdown shape), not the raw
+    // webhook — it's the only way to E2E-prove the promo-code match without outbound Stripe calls;
+    // C1b covers the raw shape.
+    const c1Enduser = await run_coupon_invoice_case({
+      label: 'c1-matching-promo',
+      couponCodes: ['SUMMER20'],
+      discounts: [discount_with_promo_code('SUMMER20')],
+      shouldFire: true,
+      title: 'coupon-scoped Purchase Made trigger fires for a matching promo code',
+    })
+    const c1Purchases = await poll_for_purchase(c1Enduser.id)
+    assert(
+      c1Purchases.some(p => (p as any).couponCodes?.includes('SUMMER20')),
+      `expected a purchase with couponCodes containing SUMMER20, got ${JSON.stringify(c1Purchases.map(p => (p as any).couponCodes))}`,
+      'couponCodes persisted on the webhook-created purchase',
+    )
+
+    // C1b: the raw webhook shape, verified against a live sandbox invoice.paid event — the single
+    // discount embedded at invoice.discount, only its bare "di_..." string id in invoice.discounts
+    // (the dedupe must not trigger a re-fetch), and promotion_code as a bare promo_... string whose
+    // retrieve fails under this suite's fake API key. The coupon name + id are still captured
+    // call-free, a name-scoped trigger fires, and the failed promo retrieve is proven non-fatal.
+    // (No absence assertion on the promo code: in production the retrieve succeeds.)
+    const c1bDiscount = discount_with_promo_code_ref({ couponId: `coupon_test_c1b_${RUN}`, couponName: 'Test coupon' })
+    const c1bEnduser = await run_coupon_invoice_case({
+      label: 'c1b-real-shape',
+      couponCodes: ['Test coupon'],
+      discount: c1bDiscount,
+      discounts: [(c1bDiscount as any).id],
+      shouldFire: true,
+      title: 'real-shaped invoice.paid payload matches via coupon name',
+    })
+    const c1bPurchases = await poll_for_purchase(c1bEnduser.id)
+    assert(
+      c1bPurchases.some(p =>
+        (p as any).couponCodes?.includes('Test coupon') && (p as any).couponCodes?.includes(`coupon_test_c1b_${RUN}`)
+      ),
+      `expected couponCodes with the coupon name and id, got ${JSON.stringify(c1bPurchases.map(p => (p as any).couponCodes))}`,
+      'coupon name and id persisted from a real-shaped payload',
+    )
+
+    // C2: matching is case-sensitive — Stripe sends the canonical merchant-defined code, so a
+    // differently-cased trigger value must stay quiet (staff can list multiple variants if needed)
+    await run_coupon_invoice_case({
+      label: 'c2-case-mismatch',
+      couponCodes: ['summer20'],
+      discounts: [discount_with_promo_code('SUMMER20')],
+      shouldFire: false,
+      title: 'coupon match is case-sensitive: a differently-cased code does not fire',
+    })
+
+    // C3: a different code stays quiet
+    await run_coupon_invoice_case({
+      label: 'c3-nonmatching',
+      couponCodes: ['SUMMER20'],
+      discounts: [discount_with_promo_code('WINTER10')],
+      shouldFire: false,
+      title: 'coupon-scoped trigger does not fire for a different code',
+    })
+
+    // C4: an undiscounted invoice never matches a coupon-scoped trigger
+    await run_coupon_invoice_case({
+      label: 'c4-no-discounts',
+      couponCodes: ['SUMMER20'],
+      shouldFire: false,
+      title: 'an invoice with no discounts does not fire a coupon-scoped trigger',
+    })
+
+    // C5: admin-applied coupons carry a name but no promotion code, and must still match. Built
+    // once and referenced by id from `discounts`, mirroring the real single-discount payload shape.
+    const c5Discount = discount_with_coupon('Spring Promo')
+    await run_coupon_invoice_case({
+      label: 'c5-coupon-name',
+      couponCodes: ['Spring Promo'],
+      discount: c5Discount,
+      discounts: [(c5Discount as any).id],
+      shouldFire: true,
+      title: 'coupon-scoped trigger matches via coupon name (no promotion code)',
+    })
+
+    // C6: backward compat — an unscoped Purchase Made trigger fires for discounted and
+    // undiscounted invoices alike
+    await run_coupon_invoice_case({
+      label: 'c6-unscoped-discounted',
+      discounts: [discount_with_promo_code('SUMMER20')],
+      shouldFire: true,
+      title: 'unscoped Purchase Made trigger fires for a discounted invoice',
+    })
+    await run_coupon_invoice_case({
+      label: 'c6b-unscoped-undiscounted',
+      shouldFire: true,
+      title: 'unscoped Purchase Made trigger fires for an undiscounted invoice',
+    })
+
+    // C7: charge.succeeded with payment_intent null — the coupon lookup is skipped entirely, so
+    // the purchase is created, the unscoped trigger fires, and the coupon-scoped one does not
+    const C7_TAG = tag('c7-charge-unscoped')
+    const C7_SCOPED_TAG = tag('c7-charge-coupon-scoped')
+    const c7Enduser = await new_enduser('c7')
+    await new_trigger({
+      title: `Stripe purchase made (c7 unscoped) ${RUN}`,
+      event: { type: 'Purchase Made', info: {} },
+      tags: [C7_TAG],
+    })
+    await new_trigger({
+      title: `Stripe purchase made (c7 coupon-scoped) ${RUN}`,
+      event: { type: 'Purchase Made', info: { couponCodes: ['SUMMER20'] } },
+      tags: [C7_SCOPED_TAG],
+    })
+    const c7Res = await post_stripe_webhook({
+      stripePublicKey,
+      secret: webhooksSecret,
+      event: charge_succeeded_event({
+        customer: {
+          id: c7Enduser.stripeCustomerId,
+          email: `stripe-webhook-c7-${RUN}@tellescope.com`,
+          name: 'Stripe Webhook c7',
+        },
+      }),
+    })
+    assert(c7Res.status === 200, `expected 200, got ${c7Res.status} (${c7Res.data})`, 'charge.succeeded webhook accepted')
+    await expect_fired(c7Enduser.id, C7_TAG, 'unscoped Purchase Made trigger fires for charge.succeeded')
+    await expect_not_fired(c7Enduser.id, C7_SCOPED_TAG, 'coupon-scoped trigger does not fire for a charge with no coupon data')
+    const c7Purchases = await poll_for_purchase(c7Enduser.id)
+    assert(c7Purchases.length > 0, 'expected charge.succeeded to create a purchase', 'charge.succeeded purchase created')
+
+    // C8: graceful degradation — a payment_intent string triggers the checkout-session lookup,
+    // which fails against real Stripe under this suite's fake API key. That failure must be caught:
+    // the purchase is still created and the unscoped trigger still fires.
+    const C8_TAG = tag('c8-charge-failed-lookup')
+    const c8Enduser = await new_enduser('c8')
+    await new_trigger({
+      title: `Stripe purchase made (c8 failed session lookup) ${RUN}`,
+      event: { type: 'Purchase Made', info: {} },
+      tags: [C8_TAG],
+    })
+    const c8Res = await post_stripe_webhook({
+      stripePublicKey,
+      secret: webhooksSecret,
+      event: charge_succeeded_event({
+        customer: {
+          id: c8Enduser.stripeCustomerId,
+          email: `stripe-webhook-c8-${RUN}@tellescope.com`,
+          name: 'Stripe Webhook c8',
+        },
+        payment_intent: `pi_test_${RUN}`,
+      }),
+    })
+    assert(c8Res.status === 200, `expected 200, got ${c8Res.status} (${c8Res.data})`, 'charge.succeeded with failing session lookup still accepted')
+    await expect_fired(c8Enduser.id, C8_TAG, 'a failing checkout-session lookup does not block the purchase or its triggers')
+
+    // C9: couponCodes must round-trip on the trigger's event.info
+    const c9Trigger = await new_trigger({
+      title: `Stripe purchase made (validator round-trip) ${RUN}`,
+      event: { type: 'Purchase Made', info: { couponCodes: ['SUMMER20'] } },
+      tags: [tag('c9')],
+    })
+    const c9Fetched = await sdk.api.automation_triggers.getOne(c9Trigger.id)
+    assert(
+      JSON.stringify((c9Fetched.event as any).info?.couponCodes) === JSON.stringify(['SUMMER20']),
+      `expected couponCodes to round-trip, got ${JSON.stringify(c9Fetched.event)}`,
+      'couponCodes round-trips through the validator',
+    )
+
     console.log("All Stripe webhook trigger tests passed!")
   } finally {
     // Best-effort only: the harness exits the process on the first failed assertion, which skips

package/src/tests/api_tests/welle_partner_token.test.ts

@@ -23,9 +23,13 @@ const decode_jwt_header = (token: string) => (
 )
 const decode_jwt_payload = (token: string) => (
   JSON.parse(Buffer.from(token.split('.')[1], 'base64url').toString()) as {
-    patientId: string,
+    sub: string,
+    iss: string,
+    aud: string,
+    jti: string,
     iat: number,
     exp: number,
+    target?: string,
   }
 )
 const sign_hs256 = (signingInput: string, key: string) => (
@@ -99,16 +103,55 @@ export const welle_partner_token_tests = async ({ sdk, sdkNonAdmin } : { sdk: Se
 
         const header = decode_jwt_header(issuedToken)
         const payload = decode_jwt_payload(issuedToken)
-        const expectedExp = Math.floor(Date.now() / 1000) + 3600
+        const expectedExp = Math.floor(Date.now() / 1000) + 60
 
         return (
           header.alg === 'HS256'
-          && payload.patientId === HEALTHIE_PATIENT_ID
-          && Math.abs(payload.exp - expectedExp) < 60
+          && payload.sub === HEALTHIE_PATIENT_ID
+          && payload.iss === 'tellescope'
+          && payload.aud === 'welle:sso-launch'
+          && typeof payload.jti === 'string' && payload.jti.length > 0
+          && Math.abs(payload.exp - expectedExp) < 10
         )
       }},
     )
 
+    // each launch gets a unique jti
+    await async_test(
+      `back-to-back tokens carry distinct jti values`,
+      () => linkedSDK.api.integrations.proxy_read({ integration: WELLE_TITLE, type: 'partner-redirect-token' }),
+      { onResult: (r: any) => {
+        const second = r?.data?.token
+        if (!second) return false
+        return decode_jwt_payload(second).jti !== decode_jwt_payload(issuedToken).jti
+      }},
+    )
+
+    // optional deep-link target — allowlisted value is echoed as a claim
+    await async_test(
+      `target: 'plan' is included as a target claim`,
+      () => linkedSDK.api.integrations.proxy_read({ integration: WELLE_TITLE, type: 'partner-redirect-token', target: 'plan' }),
+      { onResult: (r: any) => (
+        !!r?.data?.token && decode_jwt_payload(r.data.token).target === 'plan'
+      )},
+    )
+    // omitted target → no target claim at all (the happy-path token above was minted without one)
+    assert(
+      decode_jwt_payload(issuedToken).target === undefined,
+      "token minted without a target has a target claim",
+      "token minted without a target has no target claim",
+    )
+    // non-allowlisted target is rejected at the API boundary by schema validation
+    await async_test(
+      `invalid target is rejected by schema validation`,
+      () => linkedSDK.api.integrations.proxy_read({
+        integration: WELLE_TITLE,
+        type: 'partner-redirect-token',
+        target: 'admin' as any,
+      }),
+      { shouldError: true, onError: () => true },
+    )
+
     // 2) the signature is real — verifies against the stored signing key, and only that key
     const [header, payload, signature] = issuedToken.split('.')
     assert(
@@ -131,7 +174,7 @@ export const welle_partner_token_tests = async ({ sdk, sdkNonAdmin } : { sdk: Se
         id: unlinkedId,
       }),
       { onResult: (r: any) => (
-        !!r?.data?.token && decode_jwt_payload(r.data.token).patientId === HEALTHIE_PATIENT_ID
+        !!r?.data?.token && decode_jwt_payload(r.data.token).sub === HEALTHIE_PATIENT_ID
       )},
     )
 
@@ -195,7 +238,7 @@ export const welle_partner_token_tests = async ({ sdk, sdkNonAdmin } : { sdk: Se
         if (!token) return false
         const [h, p, s] = token.split('.')
         return sign_hs256(`${h}.${p}`, SIGNING_KEY) === s
-          && decode_jwt_payload(token).patientId === HEALTHIE_PATIENT_ID
+          && decode_jwt_payload(token).sub === HEALTHIE_PATIENT_ID
       }},
     )