@tellescope/sdk 1.256.6 → 1.256.8

package/src/tests/api_tests/mdi_trigger_refill.test.ts

@@ -0,0 +1,184 @@
+require('source-map-support').install();
+
+import { Session } from "../../sdk"
+import {
+  async_test,
+  log_header,
+  passOnAnyResult,
+} from "@tellescope/testing"
+import { MD_INTEGRATIONS_TITLE } from "@tellescope/constants"
+import { setup_tests } from "../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+// MDI Trigger Refill journey action tests.
+//
+// Validator-acceptance plus handler-guard coverage: verifies that automation steps configured
+// with the new mdiTriggerRefill action pass validation (and invalid shapes are rejected), and
+// exercises the process endpoint's guard branches that return BEFORE any live MDI call (missing
+// integration, missing patient reference) — no sandbox credentials needed. The happy path
+// (fetch cases -> find scheduled orders -> submit) requires an MDI sandbox with a
+// Direct-to-Pharmacy refill sequence and is covered by manual QA.
+export const mdi_trigger_refill_tests = async ({ sdk, sdkNonAdmin }: { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("MDI Trigger Refill Journey Action Tests")
+
+  let journeyId: string | undefined
+  const stepIds: string[] = []
+  const automatedActionIds: string[] = []
+  let enduserId: string | undefined
+  let createdMDIIntegrationId: string | undefined
+
+  try {
+    const journey = await sdk.api.journeys.createOne({ title: 'MDI Trigger Refill Test Journey' })
+    journeyId = journey.id
+
+    // Full config accepted
+    await async_test(
+      "mdiTriggerRefill step accepted (onlySubmitWhenDue)",
+      () => sdk.api.automation_steps.createOne({
+        journeyId: journey.id,
+        events: [{ type: 'onJourneyStart', info: {} }],
+        action: {
+          type: 'mdiTriggerRefill',
+          info: { onlySubmitWhenDue: true },
+        },
+      }).then(s => { stepIds.push(s.id); return s }),
+      passOnAnyResult,
+    )
+
+    // Empty info accepted (all fields optional)
+    await async_test(
+      "mdiTriggerRefill step accepted (empty info)",
+      () => sdk.api.automation_steps.createOne({
+        journeyId: journey.id,
+        events: [{ type: 'onJourneyStart', info: {} }],
+        action: {
+          type: 'mdiTriggerRefill',
+          info: {},
+        },
+      }).then(s => { stepIds.push(s.id); return s }),
+      passOnAnyResult,
+    )
+
+    // Wrong type for onlySubmitWhenDue rejected
+    await async_test(
+      "mdiTriggerRefill step rejected (non-boolean onlySubmitWhenDue)",
+      () => sdk.api.automation_steps.createOne({
+        journeyId: journey.id,
+        events: [{ type: 'onJourneyStart', info: {} }],
+        action: {
+          type: 'mdiTriggerRefill',
+          info: { onlySubmitWhenDue: 'yes' },
+        } as any,
+      }),
+      { shouldError: true, onError: () => true },
+    )
+
+    // Unexpected info fields are stripped by objectValidator, not rejected — assert they never
+    // reach the stored config (the step itself is accepted)
+    await async_test(
+      "mdiTriggerRefill step strips unexpected info field",
+      () => sdk.api.automation_steps.createOne({
+        journeyId: journey.id,
+        events: [{ type: 'onJourneyStart', info: {} }],
+        action: {
+          type: 'mdiTriggerRefill',
+          info: { onlySubmitWhenDue: false, formId: 'not-allowed' },
+        } as any,
+      }).then(s => { stepIds.push(s.id); return s }),
+      {
+        onResult: s => (
+          (s.action.info as any).onlySubmitWhenDue === false
+          && (s.action.info as any).formId === undefined
+        ),
+      },
+    )
+
+    // ── Handler guards (process endpoint) ────────────────────────────────────────
+    const enduser = await sdk.api.endusers.createOne({ fname: 'MDI', lname: 'RefillPatient' })
+    enduserId = enduser.id
+
+    // processAfter is set in the future so no background worker picks these up before the explicit call
+    const createAutomatedAction = () => sdk.api.automated_actions.createOne({
+      journeyId: journey!.id,
+      automationStepId: stepIds[0],
+      enduserId: enduser.id,
+      event: { type: 'onJourneyStart', info: {} },
+      action: { type: 'mdiTriggerRefill', info: {} },
+      status: 'active',
+      processAfter: new Date().getTime() + 60 * 60 * 1000,
+    } as any).then(a => { automatedActionIds.push(a.id); return a })
+
+    let mdiIntegrationExists = false
+    try {
+      const existing = await sdk.api.integrations.load_redacted({})
+      mdiIntegrationExists = !!existing.integrations.find((i: any) => i.title === MD_INTEGRATIONS_TITLE)
+    } catch { /* load not permitted — assume absent */ }
+
+    if (!mdiIntegrationExists) {
+      const noIntegrationAction = await createAutomatedAction()
+      await async_test(
+        "mdiTriggerRefill fails cleanly without an MDI integration",
+        () => sdk.api.automated_actions.process({ automatedActionId: noIntegrationAction.id }),
+        { onResult: (r: any) => r?.success === false && /MD Integrations integration not found/i.test(r?.error || '') },
+      )
+
+      try {
+        const created = await sdk.api.integrations.createOne({
+          title: MD_INTEGRATIONS_TITLE,
+          authentication: {
+            type: 'oauth2',
+            info: { access_token: 'test-access-token', refresh_token: 'test-refresh-token', scope: '', token_type: 'Bearer', expiry_date: new Date().getTime() },
+          },
+        } as any)
+        createdMDIIntegrationId = created.id
+        mdiIntegrationExists = true
+      } catch (e) {
+        console.log("Could not create an MDI integration; skipping patient-reference guard test:", e)
+      }
+    } else {
+      console.log("⏭️  Skipping mdiTriggerRefill missing-integration guard test (an MDI integration already exists)")
+    }
+
+    if (mdiIntegrationExists) {
+      // enduser has no MD Integrations reference — the guard returns before any outbound MDI call
+      const noReferenceAction = await createAutomatedAction()
+      await async_test(
+        "mdiTriggerRefill fails cleanly for an enduser with no MDI patient reference",
+        () => sdk.api.automated_actions.process({ automatedActionId: noReferenceAction.id }),
+        { onResult: (r: any) => r?.success === false && /no MD Integrations patient reference/i.test(r?.error || '') },
+      )
+    }
+  } finally {
+    for (const id of automatedActionIds) {
+      await sdk.api.automated_actions.deleteOne(id).catch(console.error)
+    }
+    if (enduserId) await sdk.api.endusers.deleteOne(enduserId).catch(console.error)
+    if (createdMDIIntegrationId) await sdk.api.integrations.deleteOne(createdMDIIntegrationId).catch(console.error)
+    for (const id of stepIds) {
+      await sdk.api.automation_steps.deleteOne(id).catch(console.error)
+    }
+    if (journeyId) await sdk.api.journeys.deleteOne(journeyId).catch(console.error)
+  }
+}
+
+if (require.main === module) {
+  console.log(`Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await mdi_trigger_refill_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ MDI trigger refill test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ MDI trigger refill test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/purchase_made_trigger.test.ts

@@ -111,6 +111,37 @@ export const purchase_made_trigger_tests = async ({ sdk, sdkNonAdmin } : { sdk:
   const enduser13 = await sdk.api.endusers.createOne({})
   const enduser14 = await sdk.api.endusers.createOne({})
 
+  // couponCodes filter triggers
+  const t10 = await sdk.api.automation_triggers.createOne({
+    event: { type: 'Purchase Made', info: { couponCodes: ['SUMMER20'] } },
+    action: { type: 'Add Tags', info: { tags: ['Purchase-Coupon-Summer20'] }},
+    status: 'Active',
+    title: "Purchase - Coupon SUMMER20"
+  })
+
+  // Empty couponCodes array should behave like no filter
+  const t11 = await sdk.api.automation_triggers.createOne({
+    event: { type: 'Purchase Made', info: { couponCodes: [] } },
+    action: { type: 'Add Tags', info: { tags: ['Purchase-Coupon-Empty'] }},
+    status: 'Active',
+    title: "Purchase - Empty couponCodes Array"
+  })
+
+  // Combined filter: title AND coupon must both match
+  const t12 = await sdk.api.automation_triggers.createOne({
+    event: { type: 'Purchase Made', info: { titles: ['Premium Course Package'], couponCodes: ['SUMMER20'] } },
+    action: { type: 'Add Tags', info: { tags: ['Purchase-Title-And-Coupon'] }},
+    status: 'Active',
+    title: "Purchase - Title and Coupon"
+  })
+
+  const enduser15 = await sdk.api.endusers.createOne({})
+  const enduser16 = await sdk.api.endusers.createOne({})
+  const enduser17 = await sdk.api.endusers.createOne({})
+  const enduser18 = await sdk.api.endusers.createOne({})
+  const enduser19 = await sdk.api.endusers.createOne({})
+  const enduser20 = await sdk.api.endusers.createOne({})
+
   // Test 1: Purchase without specific filters (should trigger t1 for any purchase)
   const purchase1 = await sdk.api.purchases.createOne({
     enduserId: enduser1.id,
@@ -321,6 +352,103 @@ export const purchase_made_trigger_tests = async ({ sdk, sdkNonAdmin } : { sdk:
     { onResult: (e: Enduser) => !!e.tags?.includes('Purchase-Any') && !e.tags?.includes('Purchase-No-Title-Test') }
   )
 
+  // Test 15: exact coupon code match fires the coupon-scoped trigger
+  const purchase15 = await sdk.api.purchases.createOne({
+    enduserId: enduser15.id,
+    title: 'Coupon Test Purchase',
+    cost: { amount: 9999, currency: 'USD' },
+    processor: 'Stripe',
+    couponCodes: ['SUMMER20'],
+  })
+  await wait(undefined, 500)
+  await async_test(
+    "Purchase Made - Coupon Code Match (exact)",
+    () => sdk.api.endusers.getOne(enduser15.id),
+    { onResult: (e: Enduser) => !!e.tags?.includes('Purchase-Coupon-Summer20') && !!e.tags?.includes('Purchase-Coupon-Empty') }
+  )
+
+  // Test 16: coupon match is case-sensitive — Stripe returns the canonical merchant-defined
+  // code, so a differently-cased value must NOT fire the coupon-scoped trigger
+  const purchase16 = await sdk.api.purchases.createOne({
+    enduserId: enduser16.id,
+    title: 'Coupon Test Purchase',
+    cost: { amount: 9999, currency: 'USD' },
+    processor: 'Stripe',
+    couponCodes: ['summer20'],
+  })
+  await wait(undefined, 500)
+  await async_test(
+    "Purchase Made - Coupon Code Case Mismatch (case sensitive, 'summer20' vs 'SUMMER20')",
+    () => sdk.api.endusers.getOne(enduser16.id),
+    { onResult: (e: Enduser) => !!e.tags?.includes('Purchase-Any') && !e.tags?.includes('Purchase-Coupon-Summer20') }
+  )
+
+  // Test 17: a different coupon code does NOT fire the coupon-scoped trigger
+  const purchase17 = await sdk.api.purchases.createOne({
+    enduserId: enduser17.id,
+    title: 'Coupon Test Purchase',
+    cost: { amount: 9999, currency: 'USD' },
+    processor: 'Stripe',
+    couponCodes: ['WINTER10'],
+  })
+  await wait(undefined, 500)
+  await async_test(
+    "Purchase Made - Non-matching Coupon Code",
+    () => sdk.api.endusers.getOne(enduser17.id),
+    { onResult: (e: Enduser) => !!e.tags?.includes('Purchase-Any') && !e.tags?.includes('Purchase-Coupon-Summer20') }
+  )
+
+  // Test 18: a purchase with no couponCodes never matches a coupon-scoped trigger, but
+  // unscoped and empty-array coupon triggers still fire (backward compat)
+  const purchase18 = await sdk.api.purchases.createOne({
+    enduserId: enduser18.id,
+    title: 'Coupon Test Purchase',
+    cost: { amount: 9999, currency: 'USD' },
+    processor: 'Stripe',
+  })
+  await wait(undefined, 500)
+  await async_test(
+    "Purchase Made - No Coupon Data (backward compat)",
+    () => sdk.api.endusers.getOne(enduser18.id),
+    { onResult: (e: Enduser) => !!e.tags?.includes('Purchase-Any') && !!e.tags?.includes('Purchase-Coupon-Empty') && !e.tags?.includes('Purchase-Coupon-Summer20') }
+  )
+
+  // Test 19: combined titles + couponCodes filter fires when both match
+  const purchase19 = await sdk.api.purchases.createOne({
+    enduserId: enduser19.id,
+    title: 'Premium Course Package',
+    cost: { amount: 9999, currency: 'USD' },
+    processor: 'Stripe',
+    couponCodes: ['SUMMER20'],
+  })
+  await wait(undefined, 500)
+  await async_test(
+    "Purchase Made - Title AND Coupon Match",
+    () => sdk.api.endusers.getOne(enduser19.id),
+    { onResult: (e: Enduser) => !!e.tags?.includes('Purchase-Title-And-Coupon') }
+  )
+
+  // Test 20: combined filter does NOT fire when the title matches but the coupon does not
+  const purchase20 = await sdk.api.purchases.createOne({
+    enduserId: enduser20.id,
+    title: 'Premium Course Package',
+    cost: { amount: 9999, currency: 'USD' },
+    processor: 'Stripe',
+  })
+  await wait(undefined, 500)
+  await async_test(
+    "Purchase Made - Title Matches But Coupon Missing (AND semantics)",
+    () => sdk.api.endusers.getOne(enduser20.id),
+    { onResult: (e: Enduser) => !!e.tags?.includes('Purchase-Exact-Title') && !e.tags?.includes('Purchase-Title-And-Coupon') }
+  )
+
+  // Validator round-trip: couponCodes persists on the trigger's event.info
+  await async_test(
+    "Purchase Made - couponCodes round-trips on trigger info",
+    () => sdk.api.automation_triggers.getOne(t10.id),
+    { onResult: t => JSON.stringify((t.event as any)?.info?.couponCodes) === JSON.stringify(['SUMMER20']) }
+  )
+
   try {
     // Clean up test data - triggers first
     await sdk.api.automation_triggers.deleteOne(t1.id)
@@ -332,6 +460,9 @@ export const purchase_made_trigger_tests = async ({ sdk, sdkNonAdmin } : { sdk:
     await sdk.api.automation_triggers.deleteOne(t7.id)
     await sdk.api.automation_triggers.deleteOne(t8.id)
     await sdk.api.automation_triggers.deleteOne(t9.id)
+    await sdk.api.automation_triggers.deleteOne(t10.id)
+    await sdk.api.automation_triggers.deleteOne(t11.id)
+    await sdk.api.automation_triggers.deleteOne(t12.id)
 
     // Clean up products
     await sdk.api.products.deleteOne(product1.id)
@@ -353,6 +484,12 @@ export const purchase_made_trigger_tests = async ({ sdk, sdkNonAdmin } : { sdk:
     await sdk.api.endusers.deleteOne(enduser12.id)
     await sdk.api.endusers.deleteOne(enduser13.id)
     await sdk.api.endusers.deleteOne(enduser14.id)
+    await sdk.api.endusers.deleteOne(enduser15.id)
+    await sdk.api.endusers.deleteOne(enduser16.id)
+    await sdk.api.endusers.deleteOne(enduser17.id)
+    await sdk.api.endusers.deleteOne(enduser18.id)
+    await sdk.api.endusers.deleteOne(enduser19.id)
+    await sdk.api.endusers.deleteOne(enduser20.id)
   } finally {}
 }
 

package/src/tests/api_tests/security/F-0006-develop-health-benefit-verification-rbac.test.ts

@@ -0,0 +1,204 @@
+require('source-map-support').install();
+
+import { ObjectId } from 'bson'
+import { Session } from "../../../sdk"
+import {
+  async_test,
+  log_header,
+  wait,
+} from "@tellescope/testing"
+import { setup_tests } from "../../setup"
+import { PROVIDER_PERMISSIONS } from "@tellescope/constants"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+const [nonAdminEmail, nonAdminPassword] = [process.env.NON_ADMIN_EMAIL, process.env.NON_ADMIN_PASSWORD]
+
+/**
+ * Regression test for F-0006 (security-audit/findings/F-0006-zoom-and-benefit-verification-bypass-rbac.md),
+ * reopened 2026-08-17 for the `develop_health_run_benefit_verification` sub-item.
+ *
+ * `enduser_eligibility_results.develop_health_run_benefit_verification` is registered with
+ * `noAccessPermissions: true` (packages/private/api/api/v1/api.ts, ~line 24606). Before the fix,
+ * it had no in-handler check on `session.access?.endusers?.read` /
+ * `session.access?.enduser_eligibility_results?.create`, so it loaded the caller-supplied
+ * enduser's PHI via `DB.endusers.findById` and forwarded it to the Develop Health integration
+ * regardless of the caller's role. It also let a zero-access caller fingerprint an enduser's
+ * profile completeness via the distinct validation error messages returned for missing fields.
+ *
+ * This test:
+ *   1. Creates a role with explicit NO_ACCESS for `endusers` and `enduser_eligibility_results`.
+ *   2. Assigns the role to the non-admin user and re-authenticates.
+ *   3. Calls the endpoint with a fake enduserId — asserts a 403-equivalent access error, not the
+ *      validation-error / integration-not-found path that would run pre-fix.
+ *
+ * Pre-fix: the handler proceeds past `DB.endusers.findById` and either 400s with a
+ * `validate_enduser_for_develop_health` message (enduser not found — since the id is fake) or,
+ * for a real target id, would load PHI and forward it to Develop Health. Either way, the access
+ * check never fires. Test fails (no access-denial signal).
+ *
+ * Post-fix: the handler throws 403 before touching `DB.endusers` at all. Test passes.
+ */
+export const develop_health_benefit_verification_rbac_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("F-0006: develop_health benefit verification RBAC regression")
+
+  const roleName = `f0006-develop-health-no-access-${Date.now()}`
+  let rbapId: string | undefined
+  const originalRoles = sdkNonAdmin.userInfo.roles
+
+  try {
+    // 1. Create a role that explicitly denies endusers access AND enduser_eligibility_results
+    //    access. This is the realistic configuration the bypass affects: a tenant operator
+    //    deliberately restricts a role from reading enduser PHI (e.g. for PHI-restricted
+    //    integration/API-key roles).
+    const rbap = await sdk.api.role_based_access_permissions.createOne({
+      role: roleName,
+      permissions: {
+        ...PROVIDER_PERMISSIONS,
+        endusers:                      { create: null, read: null, update: null, delete: null },
+        enduser_eligibility_results:   { create: null, read: null, update: null, delete: null },
+      },
+    })
+    rbapId = rbap.id
+
+    // 2. Assign the role to the non-admin user and re-authenticate so the new
+    //    session reflects the role's denied permissions.
+    await sdk.api.users.updateOne(
+      sdkNonAdmin.userInfo.id,
+      { roles: [roleName] },
+      { replaceObjectFields: true },
+    )
+    await wait(undefined, 1500)
+    await sdkNonAdmin.authenticate(nonAdminEmail!, nonAdminPassword!)
+
+    // 3. develop_health_run_benefit_verification must throw 403 BEFORE any enduser lookup.
+    //    Pre-fix: proceeds to DB.endusers.findById and either 400s on validation (fake id) or
+    //    succeeds and forwards PHI to Develop Health (real id) — never a 403.
+    await async_test(
+      "F-0006: enduser_eligibility_results.develop_health_run_benefit_verification must throw 403 when role denies endusers/enduser_eligibility_results",
+      () => sdkNonAdmin.api.enduser_eligibility_results.develop_health_run_benefit_verification({
+        enduserId: new ObjectId().toHexString(),       // fake id — access check should fire first
+        providerUserId: new ObjectId().toHexString(),  // fake id — access check should fire first
+        insuranceType: 'primary',
+        diagnoses: [],
+        // drugs uses a plain (non-empty-ok) list validator, so a real-shaped entry is required
+        // to pass request validation and actually reach the handler's access check.
+        drugs: [{ name: 'Test Drug', dosage: '10mg', quantity: 1 }],
+        drug_history: { currently_taking_drugs: [], previously_taken_drugs: [] },
+      } as any),
+      {
+        shouldError: true,
+        onError: (e: any) => {
+          // Match the gate's exact message. The SDK error surfaces { message, info } (no top-level
+          // status/code), so we key on the message rather than the HTTP status. This is deliberately
+          // specific: a lapsed subscription ("Your subscription has expired") or an expired token
+          // ("Unauthenticated") also errors BEFORE the handler runs, but neither contains this string,
+          // so the test can't false-pass without the gate executing. Also reject the pre-fix
+          // downstream messages, which would indicate the access check never fired.
+          const msg = (e?.message ?? '').toLowerCase()
+          if (msg.includes('integration not found') || msg.includes('enduser is required')
+            || msg.includes('organization') || msg.includes('provider')) {
+            return false // reached past the access gate — regression
+          }
+          return msg.includes('access to this resource')
+        },
+      },
+    )
+
+    // 4. POSITIVE case: a provider role WITH enduser access must PASS the gate and reach the
+    //    integration stage (this test org has no Develop Health integration, so it 400s with
+    //    "Integration not found"). This guards against the gate over-blocking legitimate users —
+    //    the failure mode a future tightening (e.g. gating on 'All') would introduce.
+    const providerRoleName = `f0006-develop-health-provider-${Date.now()}`
+    let providerRbapId: string | undefined
+    try {
+      const providerRbap = await sdk.api.role_based_access_permissions.createOne({
+        role: providerRoleName,
+        permissions: { ...PROVIDER_PERMISSIONS }, // endusers read/create non-null, eligibility create non-null
+      })
+      providerRbapId = providerRbap.id
+
+      await sdk.api.users.updateOne(sdkNonAdmin.userInfo.id, { roles: [providerRoleName] }, { replaceObjectFields: true })
+      await wait(undefined, 1500)
+      await sdkNonAdmin.authenticate(nonAdminEmail!, nonAdminPassword!)
+
+      await async_test(
+        "F-0006: a provider role with enduser access passes the gate (reaches 'Integration not found', not 403)",
+        () => sdkNonAdmin.api.enduser_eligibility_results.develop_health_run_benefit_verification({
+          enduserId: new ObjectId().toHexString(),
+          providerUserId: new ObjectId().toHexString(),
+          insuranceType: 'primary',
+          diagnoses: [],
+          drugs: [{ name: 'Test Drug', dosage: '10mg', quantity: 1 }],
+          drug_history: { currently_taking_drugs: [], previously_taken_drugs: [] },
+        } as any),
+        {
+          shouldError: true,
+          onError: (e: any) => {
+            const msg = (e?.message ?? '').toLowerCase()
+            // Must NOT be the access-denial message (that would mean the gate wrongly blocked a
+            // provider). Reaching "Integration not found" (or org/provider validation) proves the
+            // gate passed and the read-scoped enduser load did not over-restrict a legitimate role.
+            if (msg.includes('access to this resource')) return false
+            return msg.includes('integration not found') || msg.includes('organization') || msg.includes('provider')
+          },
+        },
+      )
+    } finally {
+      if (providerRbapId) {
+        try {
+          await sdk.api.users.updateOne(sdkNonAdmin.userInfo.id, { roles: originalRoles ?? [] }, { replaceObjectFields: true })
+        } catch {}
+        try { await sdk.api.role_based_access_permissions.deleteOne(providerRbapId) } catch {}
+        await wait(undefined, 1500)
+        try { await sdkNonAdmin.authenticate(nonAdminEmail!, nonAdminPassword!) } catch {}
+      }
+    }
+
+    // NOTE — the create>read bypass (endusers.create broader than endusers.read) that the 2026-08-19
+    // read-scoping closes is NOT live-testable here: this org has no Develop Health integration, so
+    // the handler throws "Integration not found" BEFORE reaching the (now read-scoped) enduser load,
+    // and the enduser load is what the create>read fix governs. Exercising it would need either a real
+    // Develop Health integration or reordering the handler purely for the test. It is covered by code
+    // review + F-0166 (systemic follow-up). If a Develop Health sandbox integration is ever available
+    // in the test org, add: role { endusers: create 'All', read 'Assigned' } → call with a real
+    // enduser NOT assigned to the caller → expect the enduser-not-found path, not a successful forward.
+  } finally {
+    // Cleanup: restore original roles, delete the test role.
+    try {
+      await sdk.api.users.updateOne(
+        sdkNonAdmin.userInfo.id,
+        { roles: originalRoles ?? [] },
+        { replaceObjectFields: true },
+      )
+    } catch {}
+    if (rbapId) {
+      try { await sdk.api.role_based_access_permissions.deleteOne(rbapId) } catch {}
+    }
+    // Re-authenticate the non-admin to drop the no-access role from their JWT
+    // before subsequent tests run.
+    await wait(undefined, 1500)
+    try { await sdkNonAdmin.authenticate(nonAdminEmail!, nonAdminPassword!) } catch {}
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await develop_health_benefit_verification_rbac_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ F-0006 develop_health_run_benefit_verification RBAC test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ F-0006 develop_health_run_benefit_verification RBAC test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/security/public_endpoint_auth_field_lock.test.ts

@@ -327,12 +327,22 @@ export const public_endpoint_auth_field_lock_tests = async (
 
   // Throwaway host user with all-7-day availability, so G9 has slots to find without depending on
   // (or mutating) the shared test user's calendar configuration.
-  const hostUser = await sdk.api.users.createOne({
-    email: emailFor('lock-host'),
-    verifiedEmail: true,
-    fname: 'Lock',
-    lname: `Host${RUN}`,
-  })
+  // Stable email + get-or-create (rather than a per-run address): the cleanup below is not in a
+  // finally, and reset_db does not clear the users collection, so an interrupted run strands this
+  // user permanently. Reusing one address means at most one can ever exist — otherwise every
+  // interrupted run adds another provider to org-wide availability queries, which are capped at 25
+  // users sorted newest-first and would eventually evict the real test users.
+  const hostEmail = 'lock-host@tellescope.com'
+  const hostUser = (
+    await sdk.api.users.getOne({ email: hostEmail }).catch(() => null)
+  ) || (
+    await sdk.api.users.createOne({
+      email: hostEmail,
+      verifiedEmail: true,
+      fname: 'Lock',
+      lname: 'Host',
+    })
+  )
   createdUserIds.push(hostUser.id)
   await sdk.api.users.updateOne(hostUser.id, {
     weeklyAvailabilities: [0, 1, 2, 3, 4, 5, 6].map(dayOfWeekStartingSundayIndexedByZero => ({