@tellescope/sdk 1.256.6 → 1.256.8

package/src/tests/api_tests/form_translations.test.ts

@@ -0,0 +1,205 @@
+require('source-map-support').install();
+
+import { Session, EnduserSession } from "../../sdk"
+import {
+  assert,
+  async_test,
+  handleAnyError,
+  log_header,
+} from "@tellescope/testing"
+import {
+  decodeTranslationMapFromStorage,
+  encodeTranslationMapForStorage,
+  objects_equivalent,
+} from "@tellescope/utilities"
+import { setup_tests } from "../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+// Modular test for AI form translations (display-language maps for v2 forms).
+//
+// Covers:
+// 1. Storage round-trip: encodeTranslationMapForStorage survives the configurations.value escapeHTML
+//    validator (sanitize_html strips tags and entity-encodes & < >) for maps containing HTML, & < >,
+//    quotes, {{placeholders}}, and non-ASCII text.
+// 2. Form.translationConfigurations (language -> configurationId) persistence.
+// 3. public_form_details language param: returns the map only for a publicRead-flagged configuration
+//    on a form that allows a public URL.
+// 4. submit_form_response viewedInLanguage: persisted as metadata while stored answers stay English.
+//
+// NOTE: this test deliberately does NOT invoke the AI translation endpoint (ai_conversations.send_message) —
+// that path consumes AI credits. Map generation is exercised via manual map fixtures.
+export const form_translations_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("Form Translations Tests")
+
+  const ENGLISH_CHOICES = ['Salt & Pepper', '<b>Bold</b> choice', `It's "quoted"`, 'Résumé 中文']
+
+  // keys AND values include the characters sanitize_html would otherwise mangle
+  const TRANSLATION_MAP: Record<string, string> = {
+    'What is your favorite seasoning?': '¿Cuál es tu condimento favorito?',
+    'Salt & Pepper': 'Sal & Pimienta',
+    '<b>Bold</b> choice': '<b>Negrita</b> elección',
+    [`It's "quoted"`]: `Está "citado"`,
+    'Résumé 中文': 'Currículum 中文',
+    'Hello {{enduser.fname}} <br/> welcome': 'Hola {{enduser.fname}} <br/> bienvenido',
+  }
+
+  const createdConfigurationIds: string[] = []
+  let formId: string | undefined
+  let fieldId: string | undefined
+  let enduserId: string | undefined
+
+  try {
+    // --- 1. escapeHTML-safe storage round-trip (run first: it guards the whole storage design) ---
+    const encoded = encodeTranslationMapForStorage(TRANSLATION_MAP)
+    const configuration = await sdk.api.configurations.createOne({
+      type: 'form-translations:test:es',
+      value: encoded,
+      publicRead: true,
+    })
+    createdConfigurationIds.push(configuration.id)
+
+    const storedConfiguration = await sdk.api.configurations.getOne(configuration.id)
+    const decoded = decodeTranslationMapFromStorage(storedConfiguration.value)
+    assert(
+      objects_equivalent(decoded, TRANSLATION_MAP),
+      `translation map corrupted by storage: ${JSON.stringify(decoded)}`,
+      'translation map with & < > quotes HTML and non-ASCII survives storage round-trip',
+    )
+
+    // an unflagged configuration, to verify the publicRead gate on public_form_details
+    const unflaggedConfiguration = await sdk.api.configurations.createOne({
+      type: 'form-translations:test:fr-unflagged',
+      value: encodeTranslationMapForStorage({ Hello: 'Bonjour' }),
+    })
+    createdConfigurationIds.push(unflaggedConfiguration.id)
+
+    // --- 2. form mapping persistence ---
+    const form = await sdk.api.forms.createOne({
+      title: 'Form Translations Test Form',
+      version: 'v2',
+      allowPublicURL: true,
+    })
+    formId = form.id
+
+    const field = await sdk.api.form_fields.createOne({
+      formId: form.id,
+      title: 'What is your favorite seasoning?',
+      type: 'multiple_choice',
+      options: { choices: ENGLISH_CHOICES, radio: true },
+      previousFields: [{ type: 'root', info: {} }],
+    })
+    fieldId = field.id
+
+    await sdk.api.forms.updateOne(form.id, {
+      translationConfigurations: [
+        { language: 'es', configurationId: configuration.id },
+        { language: 'fr', configurationId: unflaggedConfiguration.id },
+      ],
+    }, { replaceObjectFields: true })
+
+    const updatedForm = await sdk.api.forms.getOne(form.id)
+    assert(
+      updatedForm.translationConfigurations?.length === 2
+      && updatedForm.translationConfigurations.some(t => t.language === 'es' && t.configurationId === configuration.id),
+      `translationConfigurations not persisted: ${JSON.stringify(updatedForm.translationConfigurations)}`,
+      'form translationConfigurations mapping persists',
+    )
+
+    // --- 3. public_form_details language param (unauthenticated) ---
+    const publicSDK = new EnduserSession({ host, businessId: sdk.userInfo.businessId })
+
+    await async_test(
+      'public_form_details returns translations for a mapped language with a flagged configuration',
+      () => publicSDK.api.forms.public_form_details({ formId: form.id, language: 'es' }),
+      { onResult: r => objects_equivalent(r.translations, TRANSLATION_MAP) },
+    )
+    await async_test(
+      'public_form_details returns no translations without a language param',
+      () => publicSDK.api.forms.public_form_details({ formId: form.id }),
+      { onResult: r => !r.translations || Object.keys(r.translations).length === 0 },
+    )
+    await async_test(
+      'public_form_details returns no translations for an unmapped language',
+      () => publicSDK.api.forms.public_form_details({ formId: form.id, language: 'de' }),
+      { onResult: r => !r.translations || Object.keys(r.translations).length === 0 },
+    )
+    await async_test(
+      'public_form_details returns no translations for an UNFLAGGED configuration (publicRead gate)',
+      () => publicSDK.api.forms.public_form_details({ formId: form.id, language: 'fr' }),
+      { onResult: r => !r.translations || Object.keys(r.translations).length === 0 },
+    )
+
+    // a form without allowPublicURL still rejects public_form_details entirely
+    await sdk.api.forms.updateOne(form.id, { allowPublicURL: false })
+    await async_test(
+      'public_form_details still rejects forms without allowPublicURL',
+      () => publicSDK.api.forms.public_form_details({ formId: form.id, language: 'es' }),
+      handleAnyError,
+    )
+    await sdk.api.forms.updateOne(form.id, { allowPublicURL: true })
+
+    // --- 4. viewedInLanguage persists; stored answers remain English ---
+    const enduser = await sdk.api.endusers.createOne({
+      email: `form_translations_${Date.now()}@test.tellescope.com`,
+    })
+    enduserId = enduser.id
+
+    const { accessCode } = await sdk.api.form_responses.prepare_form_response({
+      formId: form.id, enduserId: enduser.id,
+    })
+
+    const { formResponse } = await sdk.api.form_responses.submit_form_response({
+      accessCode,
+      viewedInLanguage: 'es',
+      responses: [{
+        fieldId: field.id,
+        fieldTitle: field.title, // English snapshot, as the client submits it
+        answer: { type: 'multiple_choice', value: ['Salt & Pepper'] }, // English source value, never the translation
+      }],
+    })
+
+    const storedResponse = await sdk.api.form_responses.getOne(formResponse.id)
+    assert(
+      storedResponse.viewedInLanguage === 'es',
+      `viewedInLanguage not persisted: ${storedResponse.viewedInLanguage}`,
+      'viewedInLanguage persists on the submitted form response',
+    )
+    const storedAnswer = storedResponse.responses?.find(r => r.fieldId === field.id)
+    assert(
+      Array.isArray(storedAnswer?.answer?.value)
+      && (storedAnswer!.answer.value as string[])[0] === 'Salt & Pepper'
+      && storedAnswer!.fieldTitle === 'What is your favorite seasoning?',
+      `stored response not English: ${JSON.stringify(storedAnswer)}`,
+      'stored answer value and fieldTitle remain the English source strings',
+    )
+  } finally {
+    if (enduserId) await sdk.api.endusers.deleteOne(enduserId).catch(() => {})
+    if (fieldId) await sdk.api.form_fields.deleteOne(fieldId).catch(() => {})
+    if (formId) await sdk.api.forms.deleteOne(formId).catch(() => {})
+    for (const id of createdConfigurationIds) {
+      await sdk.api.configurations.deleteOne(id).catch(() => {})
+    }
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await form_translations_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ Form translations test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Form translations test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/group_event_attendee_self_update.test.ts

@@ -0,0 +1,161 @@
+require('source-map-support').install();
+
+import { Session, EnduserSession } from "../../sdk"
+import { async_test, handleAnyError, passOnAnyResult, log_header } from "@tellescope/testing"
+import { setup_tests } from "../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+// An enduser attendee can PATCH a calendar_event (needed to self-cancel out of a group event), and
+// attendeeStatuses / cancelledGroupAttendees are attendee-keyed arrays that drive per-attendee
+// automation triggers (handle_attendee_status_change_triggers + event-wide completion). The
+// calendar_events relationship constraint must let an enduser touch ONLY their own id's entry, so a
+// patient cannot fire or suppress a co-attendee's Appointment triggers by patching the shared event.
+export const group_event_attendee_self_update_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("Group Event Attendee Self-Update Constraint")
+
+  const createdEnduserIds: string[] = []
+  const createdEventIds: string[] = []
+
+  const createEnduser = async (label: string) => {
+    const e = await sdk.api.endusers.createOne({ email: `attendee_self_update_${label}_${Date.now()}@test.tellescope.com` })
+    createdEnduserIds.push(e.id)
+    return e
+  }
+  const enduserSession = async (id: string) => {
+    const { authToken, enduser } = await sdk.api.endusers.generate_auth_token({ id })
+    return new EnduserSession({ host, authToken, enduser, businessId: sdk.userInfo.businessId })
+  }
+  const createGroupEvent = async (attendeeIds: string[]) => {
+    const event = await sdk.api.calendar_events.createOne({
+      title: 'Attendee Self-Update Test',
+      durationInMinutes: 30,
+      startTimeInMS: Date.now() + Math.floor(Math.random() * 100000),
+      attendees: attendeeIds.map(id => ({ type: 'enduser' as const, id })),
+    })
+    createdEventIds.push(event.id)
+    return event
+  }
+
+  try {
+    const attacker = await createEnduser('self')
+    const victim = await createEnduser('other')
+    const attackerSDK = await enduserSession(attacker.id)
+
+    // ---- ALLOWED: self-cancel out of a fresh group event (the portal self-cancel path) ----
+    const e1 = await createGroupEvent([attacker.id, victim.id])
+    await async_test(
+      "enduser may add their OWN cancelledGroupAttendees entry (self-cancel)",
+      () => attackerSDK.api.calendar_events.updateOne(e1.id, {
+        cancelledGroupAttendees: [{ id: attacker.id, at: new Date() }],
+      }, { replaceObjectFields: true }),
+      passOnAnyResult,
+    )
+
+    // ---- ALLOWED: set own attendeeStatuses entry ----
+    const e2 = await createGroupEvent([attacker.id, victim.id])
+    await async_test(
+      "enduser may set their OWN attendeeStatuses entry",
+      () => attackerSDK.api.calendar_events.updateOne(e2.id, {
+        attendeeStatuses: [{ id: attacker.id, at: new Date(), status: 'Cancelled' }],
+      }, { replaceObjectFields: true }),
+      passOnAnyResult,
+    )
+
+    // ---- REJECTED: set a co-attendee's attendeeStatuses (would fire that patient's triggers) ----
+    const e3 = await createGroupEvent([attacker.id, victim.id])
+    await async_test(
+      "enduser may NOT set a co-attendee's attendeeStatuses entry",
+      () => attackerSDK.api.calendar_events.updateOne(e3.id, {
+        attendeeStatuses: [{ id: victim.id, at: new Date(), status: 'No-showed' }],
+      }, { replaceObjectFields: true }),
+      handleAnyError,
+    )
+
+    // ---- REJECTED: set a co-attendee's cancelledGroupAttendees entry ----
+    const e4 = await createGroupEvent([attacker.id, victim.id])
+    await async_test(
+      "enduser may NOT set a co-attendee's cancelledGroupAttendees entry",
+      () => attackerSDK.api.calendar_events.updateOne(e4.id, {
+        cancelledGroupAttendees: [{ id: victim.id, at: new Date() }],
+      }, { replaceObjectFields: true }),
+      handleAnyError,
+    )
+
+    // ---- REJECTED: drop a co-attendee's existing entry (would suppress their completion trigger) ----
+    const e5 = await createGroupEvent([attacker.id, victim.id])
+    await sdk.api.calendar_events.updateOne(e5.id, {
+      attendeeStatuses: [{ id: victim.id, at: new Date(), status: 'Completed' }],
+    }, { replaceObjectFields: true })
+    await async_test(
+      "enduser may NOT remove a co-attendee's existing attendeeStatuses entry",
+      () => attackerSDK.api.calendar_events.updateOne(e5.id, {
+        attendeeStatuses: [{ id: attacker.id, at: new Date(), status: 'Cancelled' }], // silently drops victim's entry
+      }, { replaceObjectFields: true }),
+      handleAnyError,
+    )
+
+    // ---- REJECTED: modify a co-attendee's existing entry ----
+    const e6 = await createGroupEvent([attacker.id, victim.id])
+    await sdk.api.calendar_events.updateOne(e6.id, {
+      attendeeStatuses: [{ id: victim.id, at: new Date(), status: 'Completed' }],
+    }, { replaceObjectFields: true })
+    await async_test(
+      "enduser may NOT modify a co-attendee's existing attendeeStatuses entry",
+      () => attackerSDK.api.calendar_events.updateOne(e6.id, {
+        attendeeStatuses: [{ id: victim.id, at: new Date(), status: 'No-showed' }],
+      }, { replaceObjectFields: true }),
+      handleAnyError,
+    )
+
+    // ---- ALLOWED: self-cancel while PRESERVING a co-attendee's existing entry (realistic group self-cancel) ----
+    const e7 = await createGroupEvent([attacker.id, victim.id])
+    await sdk.api.calendar_events.updateOne(e7.id, {
+      cancelledGroupAttendees: [{ id: victim.id, at: new Date() }],
+    }, { replaceObjectFields: true })
+    const e7ForAttacker = await attackerSDK.api.calendar_events.getOne(e7.id)
+    await async_test(
+      "enduser may self-cancel while preserving a co-attendee's existing entry",
+      () => attackerSDK.api.calendar_events.updateOne(e7.id, {
+        cancelledGroupAttendees: [...(e7ForAttacker.cancelledGroupAttendees || []), { id: attacker.id, at: new Date() }],
+      }, { replaceObjectFields: true }),
+      passOnAnyResult,
+    )
+
+    // ---- ALLOWED (baseline): staff may set any attendee's status (constraint is enduser-only) ----
+    const e8 = await createGroupEvent([attacker.id, victim.id])
+    await async_test(
+      "staff may set any attendee's status",
+      () => sdk.api.calendar_events.updateOne(e8.id, {
+        attendeeStatuses: [{ id: victim.id, at: new Date(), status: 'No-showed' }],
+      }, { replaceObjectFields: true }),
+      passOnAnyResult,
+    )
+
+  } finally {
+    for (const id of createdEventIds) { try { await sdk.api.calendar_events.deleteOne(id) } catch (_) {} }
+    for (const id of createdEnduserIds) { try { await sdk.api.endusers.deleteOne(id) } catch (_) {} }
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await group_event_attendee_self_update_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ Group event attendee self-update constraint tests completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Group event attendee self-update constraint tests failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/group_event_attendee_status_triggers.test.ts

@@ -54,6 +54,11 @@ export const group_event_attendee_status_triggers_tests = async ({ sdk } : { sdk
     }, { replaceObjectFields: true })
   )
 
+  // Replicates the webapp "Mark Completed" action on the whole event (Calendar.tsx)
+  const markEventCompleted = async (eventId: string) => (
+    sdk.api.calendar_events.updateOne(eventId, { completedAt: new Date(), completedBy: sdk.userInfo.id })
+  )
+
   const tagsOf = async (enduserId: string) => (await sdk.api.endusers.getOne(enduserId)).tags || []
 
   try {
@@ -345,6 +350,136 @@ export const group_event_attendee_status_triggers_tests = async ({ sdk } : { sdk
       { onResult: (tags: string[]) => tags.length === 1 && tags.includes(TAG['No-showed']) }
     )
 
+    // ============================================================
+    // Marking the WHOLE event Complete must not fan "Appointment Completed" out to attendees who
+    // already have an explicit per-attendee status — they were resolved individually (and already
+    // fired their own trigger via handle_attendee_status_change_triggers). Attendees with no status,
+    // or 'Confirmed', are still active participants and must still fire.
+    //
+    // Each case uses fresh endusers and a fresh event: triggers are throttled for 60s per
+    // trigger-per-enduser, and the completion handler early-returns once completedAt is already set.
+    //
+    // Not covered here: per-attendee 'Completed' followed by event-wide completion. That duplicate
+    // fire is already swallowed by the 60s throttle (which is applied before the action, and Add Tags
+    // is idempotent), so the assertion would pass with or without the filter.
+    // ============================================================
+    log_header("Event-wide completion respects per-attendee statuses")
+
+    // status -> tag that must NOT appear on the target after the event is completed
+    for (const status of ['No-showed', 'Cancelled', 'Rescheduled'] as const) {
+      const target = await createEnduser()
+      const active = await createEnduser()
+      const event = await createGroupEvent([target.id, active.id])
+
+      await setAttendeeStatuses(event.id, [{ id: target.id, status }])
+      await wait(undefined, 750)
+
+      // pre-condition: the per-attendee status fired its own trigger
+      await async_test(
+        `event-wide completion setup: '${status}' attendee has the '${status}' tag`,
+        () => tagsOf(target.id),
+        { onResult: (tags: string[]) => tags.includes(TAG[status]) }
+      )
+
+      await markEventCompleted(event.id)
+      await wait(undefined, 1000)
+
+      await async_test(
+        `event-wide completion does NOT fire Completed for the '${status}' attendee`,
+        () => tagsOf(target.id),
+        { onResult: (tags: string[]) => !tags.includes(TAG['Completed']) }
+      )
+      await async_test(
+        `event-wide completion leaves the '${status}' attendee with only its own tag`,
+        () => tagsOf(target.id),
+        { onResult: (tags: string[]) => tags.length === 1 && tags.includes(TAG[status]) }
+      )
+      // guard against over-filtering: the un-statused attendee must still be completed
+      await async_test(
+        `event-wide completion still fires Completed for the active attendee (alongside '${status}')`,
+        () => tagsOf(active.id),
+        { onResult: (tags: string[]) => tags.includes(TAG['Completed']) }
+      )
+    }
+
+    // cancelledGroupAttendees with no attendeeStatuses entry — the shape written by the patient
+    // portal when an enduser cancels themselves out of a group event.
+    log_header("Event-wide completion respects legacy cancelledGroupAttendees")
+
+    const portalCancelled = await createEnduser()
+    const portalActive = await createEnduser()
+    const portalEvent = await createGroupEvent([portalCancelled.id, portalActive.id])
+
+    await sdk.api.calendar_events.updateOne(portalEvent.id, {
+      cancelledGroupAttendees: [{ id: portalCancelled.id, at: new Date() }],
+    }, { replaceObjectFields: true })
+    await wait(undefined, 750)
+
+    // pre-condition: the legacy branch fires Cancelled for them
+    await async_test(
+      "legacy cancelledGroupAttendees setup: attendee has the Cancelled tag",
+      () => tagsOf(portalCancelled.id),
+      { onResult: (tags: string[]) => tags.includes(TAG['Cancelled']) }
+    )
+
+    await markEventCompleted(portalEvent.id)
+    await wait(undefined, 1000)
+
+    await async_test(
+      "event-wide completion does NOT fire Completed for a cancelledGroupAttendees attendee",
+      () => tagsOf(portalCancelled.id),
+      { onResult: (tags: string[]) => !tags.includes(TAG['Completed']) }
+    )
+    await async_test(
+      "event-wide completion still fires Completed for the active attendee (legacy cancel case)",
+      () => tagsOf(portalActive.id),
+      { onResult: (tags: string[]) => tags.includes(TAG['Completed']) }
+    )
+
+    // ============================================================
+    // Over-filtering guards: 'Confirmed' and no-status attendees must still complete.
+    // ============================================================
+    log_header("Event-wide completion still fires for Confirmed / un-statused attendees")
+
+    const confirmed = await createEnduser()
+    const confirmedBystander = await createEnduser()
+    const confirmedEvent = await createGroupEvent([confirmed.id, confirmedBystander.id])
+
+    await setAttendeeStatuses(confirmedEvent.id, [{ id: confirmed.id, status: 'Confirmed' }])
+    await wait(undefined, 750)
+    await markEventCompleted(confirmedEvent.id)
+    await wait(undefined, 1000)
+
+    await async_test(
+      "event-wide completion fires Completed for a 'Confirmed' attendee",
+      () => tagsOf(confirmed.id),
+      { onResult: (tags: string[]) => tags.includes(TAG['Completed']) }
+    )
+    await async_test(
+      "event-wide completion fires Completed for the bystander alongside 'Confirmed'",
+      () => tagsOf(confirmedBystander.id),
+      { onResult: (tags: string[]) => tags.includes(TAG['Completed']) }
+    )
+
+    // baseline: a group event with no per-attendee statuses completes for everyone
+    const plain1 = await createEnduser()
+    const plain2 = await createEnduser()
+    const plain3 = await createEnduser()
+    const plainEvent = await createGroupEvent([plain1.id, plain2.id, plain3.id])
+
+    await markEventCompleted(plainEvent.id)
+    await wait(undefined, 1000)
+
+    const plainAttendees = [plain1, plain2, plain3]
+    for (let i = 0; i < plainAttendees.length; i++) {
+      const enduserId = plainAttendees[i].id
+      await async_test(
+        `event-wide completion fires Completed for un-statused attendee #${i + 1}`,
+        () => tagsOf(enduserId),
+        { onResult: (tags: string[]) => tags.includes(TAG['Completed']) }
+      )
+    }
+
   } finally {
     for (const id of createdEventIds) {
       try { await sdk.api.calendar_events.deleteOne(id) } catch (_) {}