@tellescope/sdk 1.256.6 → 1.256.8

package/src/tests/api_tests/stripe_webhook_triggers.test.ts

@@ -4,7 +4,13 @@ import { Session } from "../../sdk"
 import { assert, log_header, wait } from "@tellescope/testing"
 import { setup_tests } from "../setup"
 import {
+  charge_succeeded_event,
   cleanup_stripe_test_integrations,
+  discount_with_coupon,
+  discount_with_promo_code,
+  discount_with_promo_code_ref,
+  invoice_paid_event,
+  invoice_paid_line,
   invoice_payment_failed_event,
   item_with_expanded_price_product,
   item_with_plan_product,
@@ -640,6 +646,221 @@ export const stripe_webhook_triggers_tests = async ({ sdk, sdkNonAdmin } : { sdk
     }
     assert(rejectedInvalidPausedProductId, 'expected a non-ObjectId productId to be rejected', 'invalid Subscription Paused productId rejected')
 
+    /* ============ invoice.paid / charge.succeeded — coupon codes ============ */
+
+    // Purchases are created by the webhook handler itself, so persistence is polled the same way
+    // tags are. Cleaned up automatically when the enduser is deleted (onDependencyDelete: 'delete').
+    const poll_for_purchase = async (enduserId: string, iterations = 20) => {
+      for (let i = 0; i < iterations; i++) {
+        await wait(undefined, 500)
+        const purchases = await sdk.api.purchases.getSome({ filter: { enduserId } })
+        if (purchases.length) return purchases
+      }
+      return []
+    }
+
+    // One webhook POST per case: a Purchase Made trigger (coupon-scoped unless couponCodes is
+    // undefined) and an invoice.paid built by the caller.
+    const run_coupon_invoice_case = async ({ label, couponCodes, discounts, discount, shouldFire, title } : {
+      label: string,
+      couponCodes?: string[],
+      discounts?: (object | string)[],
+      discount?: object,
+      shouldFire: boolean,
+      title: string,
+    }) => {
+      const caseTag = tag(label)
+      const enduser = await new_enduser(label)
+      await new_trigger({
+        title: `Stripe purchase made (${label}) ${RUN}`,
+        event: { type: 'Purchase Made', info: couponCodes !== undefined ? { couponCodes } : {} },
+        tags: [caseTag],
+      })
+
+      const res = await post_stripe_webhook({
+        stripePublicKey,
+        secret: webhooksSecret,
+        event: invoice_paid_event({
+          stripeCustomerId: enduser.stripeCustomerId,
+          lines: [invoice_paid_line({ description: `Coupon Test ${label} ${RUN}` })],
+          discounts,
+          discount,
+        }),
+      })
+      assert(res.status === 200, `expected 200, got ${res.status} (${res.data})`, `${label} webhook accepted`)
+
+      if (shouldFire) await expect_fired(enduser.id, caseTag, title)
+      else await expect_not_fired(enduser.id, caseTag, title)
+
+      return enduser
+    }
+
+    // C1: the feature — a coupon-scoped trigger fires for an invoice discounted with that promo
+    // code, and the code is persisted on the purchase record. The expanded promotion_code object
+    // reflects the post-expansion shape (and the checkout-session breakdown shape), not the raw
+    // webhook — it's the only way to E2E-prove the promo-code match without outbound Stripe calls;
+    // C1b covers the raw shape.
+    const c1Enduser = await run_coupon_invoice_case({
+      label: 'c1-matching-promo',
+      couponCodes: ['SUMMER20'],
+      discounts: [discount_with_promo_code('SUMMER20')],
+      shouldFire: true,
+      title: 'coupon-scoped Purchase Made trigger fires for a matching promo code',
+    })
+    const c1Purchases = await poll_for_purchase(c1Enduser.id)
+    assert(
+      c1Purchases.some(p => (p as any).couponCodes?.includes('SUMMER20')),
+      `expected a purchase with couponCodes containing SUMMER20, got ${JSON.stringify(c1Purchases.map(p => (p as any).couponCodes))}`,
+      'couponCodes persisted on the webhook-created purchase',
+    )
+
+    // C1b: the raw webhook shape, verified against a live sandbox invoice.paid event — the single
+    // discount embedded at invoice.discount, only its bare "di_..." string id in invoice.discounts
+    // (the dedupe must not trigger a re-fetch), and promotion_code as a bare promo_... string whose
+    // retrieve fails under this suite's fake API key. The coupon name + id are still captured
+    // call-free, a name-scoped trigger fires, and the failed promo retrieve is proven non-fatal.
+    // (No absence assertion on the promo code: in production the retrieve succeeds.)
+    const c1bDiscount = discount_with_promo_code_ref({ couponId: `coupon_test_c1b_${RUN}`, couponName: 'Test coupon' })
+    const c1bEnduser = await run_coupon_invoice_case({
+      label: 'c1b-real-shape',
+      couponCodes: ['Test coupon'],
+      discount: c1bDiscount,
+      discounts: [(c1bDiscount as any).id],
+      shouldFire: true,
+      title: 'real-shaped invoice.paid payload matches via coupon name',
+    })
+    const c1bPurchases = await poll_for_purchase(c1bEnduser.id)
+    assert(
+      c1bPurchases.some(p =>
+        (p as any).couponCodes?.includes('Test coupon') && (p as any).couponCodes?.includes(`coupon_test_c1b_${RUN}`)
+      ),
+      `expected couponCodes with the coupon name and id, got ${JSON.stringify(c1bPurchases.map(p => (p as any).couponCodes))}`,
+      'coupon name and id persisted from a real-shaped payload',
+    )
+
+    // C2: matching is case-sensitive — Stripe sends the canonical merchant-defined code, so a
+    // differently-cased trigger value must stay quiet (staff can list multiple variants if needed)
+    await run_coupon_invoice_case({
+      label: 'c2-case-mismatch',
+      couponCodes: ['summer20'],
+      discounts: [discount_with_promo_code('SUMMER20')],
+      shouldFire: false,
+      title: 'coupon match is case-sensitive: a differently-cased code does not fire',
+    })
+
+    // C3: a different code stays quiet
+    await run_coupon_invoice_case({
+      label: 'c3-nonmatching',
+      couponCodes: ['SUMMER20'],
+      discounts: [discount_with_promo_code('WINTER10')],
+      shouldFire: false,
+      title: 'coupon-scoped trigger does not fire for a different code',
+    })
+
+    // C4: an undiscounted invoice never matches a coupon-scoped trigger
+    await run_coupon_invoice_case({
+      label: 'c4-no-discounts',
+      couponCodes: ['SUMMER20'],
+      shouldFire: false,
+      title: 'an invoice with no discounts does not fire a coupon-scoped trigger',
+    })
+
+    // C5: admin-applied coupons carry a name but no promotion code, and must still match. Built
+    // once and referenced by id from `discounts`, mirroring the real single-discount payload shape.
+    const c5Discount = discount_with_coupon('Spring Promo')
+    await run_coupon_invoice_case({
+      label: 'c5-coupon-name',
+      couponCodes: ['Spring Promo'],
+      discount: c5Discount,
+      discounts: [(c5Discount as any).id],
+      shouldFire: true,
+      title: 'coupon-scoped trigger matches via coupon name (no promotion code)',
+    })
+
+    // C6: backward compat — an unscoped Purchase Made trigger fires for discounted and
+    // undiscounted invoices alike
+    await run_coupon_invoice_case({
+      label: 'c6-unscoped-discounted',
+      discounts: [discount_with_promo_code('SUMMER20')],
+      shouldFire: true,
+      title: 'unscoped Purchase Made trigger fires for a discounted invoice',
+    })
+    await run_coupon_invoice_case({
+      label: 'c6b-unscoped-undiscounted',
+      shouldFire: true,
+      title: 'unscoped Purchase Made trigger fires for an undiscounted invoice',
+    })
+
+    // C7: charge.succeeded with payment_intent null — the coupon lookup is skipped entirely, so
+    // the purchase is created, the unscoped trigger fires, and the coupon-scoped one does not
+    const C7_TAG = tag('c7-charge-unscoped')
+    const C7_SCOPED_TAG = tag('c7-charge-coupon-scoped')
+    const c7Enduser = await new_enduser('c7')
+    await new_trigger({
+      title: `Stripe purchase made (c7 unscoped) ${RUN}`,
+      event: { type: 'Purchase Made', info: {} },
+      tags: [C7_TAG],
+    })
+    await new_trigger({
+      title: `Stripe purchase made (c7 coupon-scoped) ${RUN}`,
+      event: { type: 'Purchase Made', info: { couponCodes: ['SUMMER20'] } },
+      tags: [C7_SCOPED_TAG],
+    })
+    const c7Res = await post_stripe_webhook({
+      stripePublicKey,
+      secret: webhooksSecret,
+      event: charge_succeeded_event({
+        customer: {
+          id: c7Enduser.stripeCustomerId,
+          email: `stripe-webhook-c7-${RUN}@tellescope.com`,
+          name: 'Stripe Webhook c7',
+        },
+      }),
+    })
+    assert(c7Res.status === 200, `expected 200, got ${c7Res.status} (${c7Res.data})`, 'charge.succeeded webhook accepted')
+    await expect_fired(c7Enduser.id, C7_TAG, 'unscoped Purchase Made trigger fires for charge.succeeded')
+    await expect_not_fired(c7Enduser.id, C7_SCOPED_TAG, 'coupon-scoped trigger does not fire for a charge with no coupon data')
+    const c7Purchases = await poll_for_purchase(c7Enduser.id)
+    assert(c7Purchases.length > 0, 'expected charge.succeeded to create a purchase', 'charge.succeeded purchase created')
+
+    // C8: graceful degradation — a payment_intent string triggers the checkout-session lookup,
+    // which fails against real Stripe under this suite's fake API key. That failure must be caught:
+    // the purchase is still created and the unscoped trigger still fires.
+    const C8_TAG = tag('c8-charge-failed-lookup')
+    const c8Enduser = await new_enduser('c8')
+    await new_trigger({
+      title: `Stripe purchase made (c8 failed session lookup) ${RUN}`,
+      event: { type: 'Purchase Made', info: {} },
+      tags: [C8_TAG],
+    })
+    const c8Res = await post_stripe_webhook({
+      stripePublicKey,
+      secret: webhooksSecret,
+      event: charge_succeeded_event({
+        customer: {
+          id: c8Enduser.stripeCustomerId,
+          email: `stripe-webhook-c8-${RUN}@tellescope.com`,
+          name: 'Stripe Webhook c8',
+        },
+        payment_intent: `pi_test_${RUN}`,
+      }),
+    })
+    assert(c8Res.status === 200, `expected 200, got ${c8Res.status} (${c8Res.data})`, 'charge.succeeded with failing session lookup still accepted')
+    await expect_fired(c8Enduser.id, C8_TAG, 'a failing checkout-session lookup does not block the purchase or its triggers')
+
+    // C9: couponCodes must round-trip on the trigger's event.info
+    const c9Trigger = await new_trigger({
+      title: `Stripe purchase made (validator round-trip) ${RUN}`,
+      event: { type: 'Purchase Made', info: { couponCodes: ['SUMMER20'] } },
+      tags: [tag('c9')],
+    })
+    const c9Fetched = await sdk.api.automation_triggers.getOne(c9Trigger.id)
+    assert(
+      JSON.stringify((c9Fetched.event as any).info?.couponCodes) === JSON.stringify(['SUMMER20']),
+      `expected couponCodes to round-trip, got ${JSON.stringify(c9Fetched.event)}`,
+      'couponCodes round-trips through the validator',
+    )
+
     console.log("All Stripe webhook trigger tests passed!")
   } finally {
     // Best-effort only: the harness exits the process on the first failed assertion, which skips

package/src/tests/api_tests/welle_partner_token.test.ts

@@ -23,9 +23,13 @@ const decode_jwt_header = (token: string) => (
 )
 const decode_jwt_payload = (token: string) => (
   JSON.parse(Buffer.from(token.split('.')[1], 'base64url').toString()) as {
-    patientId: string,
+    sub: string,
+    iss: string,
+    aud: string,
+    jti: string,
     iat: number,
     exp: number,
+    target?: string,
   }
 )
 const sign_hs256 = (signingInput: string, key: string) => (
@@ -99,16 +103,55 @@ export const welle_partner_token_tests = async ({ sdk, sdkNonAdmin } : { sdk: Se
 
         const header = decode_jwt_header(issuedToken)
         const payload = decode_jwt_payload(issuedToken)
-        const expectedExp = Math.floor(Date.now() / 1000) + 3600
+        const expectedExp = Math.floor(Date.now() / 1000) + 60
 
         return (
           header.alg === 'HS256'
-          && payload.patientId === HEALTHIE_PATIENT_ID
-          && Math.abs(payload.exp - expectedExp) < 60
+          && payload.sub === HEALTHIE_PATIENT_ID
+          && payload.iss === 'tellescope'
+          && payload.aud === 'welle:sso-launch'
+          && typeof payload.jti === 'string' && payload.jti.length > 0
+          && Math.abs(payload.exp - expectedExp) < 10
         )
       }},
     )
 
+    // each launch gets a unique jti
+    await async_test(
+      `back-to-back tokens carry distinct jti values`,
+      () => linkedSDK.api.integrations.proxy_read({ integration: WELLE_TITLE, type: 'partner-redirect-token' }),
+      { onResult: (r: any) => {
+        const second = r?.data?.token
+        if (!second) return false
+        return decode_jwt_payload(second).jti !== decode_jwt_payload(issuedToken).jti
+      }},
+    )
+
+    // optional deep-link target — allowlisted value is echoed as a claim
+    await async_test(
+      `target: 'plan' is included as a target claim`,
+      () => linkedSDK.api.integrations.proxy_read({ integration: WELLE_TITLE, type: 'partner-redirect-token', target: 'plan' }),
+      { onResult: (r: any) => (
+        !!r?.data?.token && decode_jwt_payload(r.data.token).target === 'plan'
+      )},
+    )
+    // omitted target → no target claim at all (the happy-path token above was minted without one)
+    assert(
+      decode_jwt_payload(issuedToken).target === undefined,
+      "token minted without a target has a target claim",
+      "token minted without a target has no target claim",
+    )
+    // non-allowlisted target is rejected at the API boundary by schema validation
+    await async_test(
+      `invalid target is rejected by schema validation`,
+      () => linkedSDK.api.integrations.proxy_read({
+        integration: WELLE_TITLE,
+        type: 'partner-redirect-token',
+        target: 'admin' as any,
+      }),
+      { shouldError: true, onError: () => true },
+    )
+
     // 2) the signature is real — verifies against the stored signing key, and only that key
     const [header, payload, signature] = issuedToken.split('.')
     assert(
@@ -131,7 +174,7 @@ export const welle_partner_token_tests = async ({ sdk, sdkNonAdmin } : { sdk: Se
         id: unlinkedId,
       }),
       { onResult: (r: any) => (
-        !!r?.data?.token && decode_jwt_payload(r.data.token).patientId === HEALTHIE_PATIENT_ID
+        !!r?.data?.token && decode_jwt_payload(r.data.token).sub === HEALTHIE_PATIENT_ID
       )},
     )
 
@@ -195,7 +238,7 @@ export const welle_partner_token_tests = async ({ sdk, sdkNonAdmin } : { sdk: Se
         if (!token) return false
         const [h, p, s] = token.split('.')
         return sign_hs256(`${h}.${p}`, SIGNING_KEY) === s
-          && decode_jwt_payload(token).patientId === HEALTHIE_PATIENT_ID
+          && decode_jwt_payload(token).sub === HEALTHIE_PATIENT_ID
       }},
     )
 

package/src/tests/stripe_webhook_helpers.ts

@@ -151,6 +151,122 @@ export const invoice_payment_failed_event = ({ stripeCustomerId, lines = [], has
   },
 })
 
+/**
+ * Embedded Stripe.Discount-shaped object with an *expanded* promotion_code object. Real webhook
+ * payloads carry promotion_code as a bare promo_... string (see discount_with_promo_code_ref);
+ * the expanded variant reflects the post-expansion shape (and the checkout-session breakdown
+ * shape), and matters here because this suite signs payloads with a real HMAC but a fake Stripe
+ * API key, so any fallback fetch (promotionCodes.retrieve on a promo_... string) would fail —
+ * expanded objects prove the handler extracts codes without outbound Stripe calls.
+ */
+export const discount_with_promo_code = (code: string, couponName?: string) => ({
+  id: `di_test_${unique_suffix()}`,
+  object: 'discount',
+  coupon: {
+    id: `coupon_test_${unique_suffix()}`,
+    object: 'coupon',
+    name: couponName ?? null,
+  },
+  promotion_code: {
+    id: `promo_test_${unique_suffix()}`,
+    object: 'promotion_code',
+    code,
+  },
+})
+
+/**
+ * Mirrors a real invoice.paid webhook discount (verified against a live sandbox event): the
+ * embedded coupon carries id + name, but promotion_code is a bare promo_... string reference that
+ * only the retrieve fallback can resolve — which fails under this suite's fake API key, so a
+ * payload built from this captures the coupon name + id and (in tests) not the promo code.
+ */
+export const discount_with_promo_code_ref = ({ couponId, couponName } : { couponId: string, couponName: string }) => ({
+  id: `di_test_${unique_suffix()}`,
+  object: 'discount',
+  coupon: { id: couponId, object: 'coupon', name: couponName },
+  promotion_code: `promo_test_${unique_suffix()}`,
+})
+
+/** An admin-applied coupon: a name but no promotion code. */
+export const discount_with_coupon = (name: string) => ({
+  id: `di_test_${unique_suffix()}`,
+  object: 'discount',
+  coupon: {
+    id: `coupon_test_${unique_suffix()}`,
+    object: 'coupon',
+    name,
+  },
+  promotion_code: null,
+})
+
+/**
+ * An invoice line item for invoice.paid. `description` feeds purchase.title; the expanded
+ * price.product object (when a product id is given) avoids the handler's product-name
+ * stripe.products.retrieve network fallback.
+ */
+export const invoice_paid_line = ({ description, stripeProductId } : {
+  description?: string,
+  stripeProductId?: string,
+}) => ({
+  description: description ?? null,
+  price: stripeProductId
+    ? { product: { id: stripeProductId, object: 'product', name: description ?? 'Test Product' } }
+    : null,
+})
+
+/**
+ * Minimal invoice.paid envelope. The handler looks up the enduser by stripeCustomerId, so no
+ * customer_email/name are needed. Real webhooks embed the single-discount case at `discount` and
+ * carry only bare "di_..." string ids in `discounts` (verified against live sandbox events);
+ * cases may instead pass expanded objects in `discounts` to prove call-free extraction — see
+ * discount_with_promo_code.
+ */
+export const invoice_paid_event = ({ stripeCustomerId, lines = [], discounts, discount, amount_paid = 1999 } : {
+  stripeCustomerId: string,
+  lines?: object[],
+  discounts?: (object | string)[],
+  discount?: object,
+  amount_paid?: number,
+}) => ({
+  type: 'invoice.paid',
+  data: {
+    object: {
+      id: `in_test_${unique_suffix()}`,
+      customer: stripeCustomerId,
+      amount_paid,
+      lines: { object: 'list', data: lines, has_more: false },
+      discount: discount ?? null,
+      discounts: discounts ?? [],
+    },
+  },
+})
+
+/**
+ * Minimal charge.succeeded envelope. `customer` must be an embedded object — a bare string id makes
+ * the handler call stripe.customers.retrieve, an outbound call the fake API key cannot serve. The
+ * handler then matches the enduser by the embedded customer's email. `payment_intent: null` is the
+ * deterministic no-coupon case (the coupon lookup only runs for a payment_intent string).
+ */
+export const charge_succeeded_event = ({ customer, amount = 1999, currency = 'usd', payment_intent = null } : {
+  customer: { id: string, email: string, name?: string },
+  amount?: number,
+  currency?: string,
+  payment_intent?: string | null,
+}) => ({
+  type: 'charge.succeeded',
+  data: {
+    object: {
+      id: `ch_test_${unique_suffix()}`,
+      customer: { object: 'customer', ...customer },
+      amount,
+      currency,
+      payment_intent,
+      invoice: null,
+      metadata: {},
+    },
+  },
+})
+
 /** Minimal customer.subscription.deleted envelope; the handler reads items.data[].plan.product. */
 export const subscription_deleted_event = ({ stripeCustomerId, stripeProductIds = [] } : {
   stripeCustomerId: string,

package/src/tests/tests.ts

@@ -38,6 +38,8 @@ import {
 import { Session, APIQuery, EnduserSession } from "../sdk"
 import { enduser_observations_acknowledge_tests } from "./api_tests/enduser_observations_acknowledge.test"
 import { translations_tests } from "./api_tests/translations.test"
+import { configurations_public_read_tests } from "./api_tests/configurations_public_read.test"
+import { form_translations_tests } from "./api_tests/form_translations.test"
 import { embeddables_auth_token_tests } from "./api_tests/embeddables_auth_token.test"
 import { user_portal_settings_tests } from "./api_tests/user_portal_settings.test"
 import { integrations_redacted_tests } from "./api_tests/integrations_redacted.test"
@@ -56,6 +58,8 @@ import { purchase_made_trigger_tests } from "./api_tests/purchase_made_trigger.t
 import { appointment_rescheduled_trigger_tests } from "./api_tests/appointment_rescheduled_trigger.test"
 import { appointment_no_showed_trigger_tests } from "./api_tests/appointment_no_showed_trigger.test"
 import { group_event_attendee_status_triggers_tests } from "./api_tests/group_event_attendee_status_triggers.test"
+import { group_event_attendee_self_update_tests } from "./api_tests/group_event_attendee_self_update.test"
+import { calendar_event_create_and_bulk_triggers_tests } from "./api_tests/calendar_event_create_and_bulk_triggers.test"
 import { journey_error_branching_tests } from "./api_tests/journey_error_branching.test"
 import { journey_delete_cancels_actions_tests } from "./api_tests/journey_delete_cancels_actions.test"
 import { afteraction_day_of_month_delay_tests } from "./api_tests/afteraction_day_of_month_delay.test"
@@ -109,6 +113,7 @@ import { field_redaction_tests } from "./api_tests/field_redaction.test";
 import { data_sync_redaction_bypass_tests } from "./api_tests/security/F-0001-data-sync-redaction-bypass.test";
 import { enduser_write_restrictions_tests } from "./api_tests/security/F-0106-F-0110-enduser-write-restrictions.test";
 import { ai_conversations_rbac_tests } from "./api_tests/security/F-0005-ai-conversations-rbac.test";
+import { develop_health_benefit_verification_rbac_tests } from "./api_tests/security/F-0006-develop-health-benefit-verification-rbac.test";
 import { cascade_role_rename_cross_tenant_tests } from "./api_tests/security/F-0053-cascade-role-rename-cross-tenant.test";
 import { self_admin_role_assignment_tests } from "./api_tests/security/F-0076-self-admin-role-assignment.test";
 import { invite_user_enumeration_tests } from "./api_tests/security/F-0007-invite-user-enumeration.test";
@@ -153,6 +158,7 @@ import { mdi_case_offerings_tests } from "./api_tests/mdi_case_offerings.test";
 import { beluga_manual_sync_tests } from "./api_tests/beluga_manual_sync.test";
 import { metriport_push_form_response_tests } from "./api_tests/metriport_push_form_response.test";
 import { beluga_trigger_refill_tests } from "./api_tests/beluga_trigger_refill.test";
+import { mdi_trigger_refill_tests } from "./api_tests/mdi_trigger_refill.test";
 import { mdi_webhooks_tests } from "./api_tests/mdi_webhooks.test";
 import { stripe_webhook_triggers_tests } from "./api_tests/stripe_webhook_triggers.test";
 import { account_switcher_tests } from "./api_tests/account_switcher.test";
@@ -5752,6 +5758,8 @@ const automation_trigger_tests = async () => {
 
   await appointment_no_showed_trigger_tests({ sdk, sdkNonAdmin })
   await group_event_attendee_status_triggers_tests({ sdk, sdkNonAdmin })
+  await group_event_attendee_self_update_tests({ sdk, sdkNonAdmin })
+  await calendar_event_create_and_bulk_triggers_tests({ sdk, sdkNonAdmin })
   await assign_care_team_tests()
   await push_forms_to_portal_group_completion_tests({ sdk, sdkNonAdmin })
   await order_status_equals_tests()
@@ -6994,18 +7002,23 @@ export const self_serve_appointment_booking_tests = async () => {
       restrictedByState: false,
     }),
     { onResult: r => {
-      if (r.availabilityBlocks.length !== 4) return false // 2 providers with 1 hour availability for 30 minute meetings
-
-      const user1block1_ET = r.availabilityBlocks.find(b => b.userId === sdk.userInfo.id)
-      const user2block1_PT = r.availabilityBlocks.find(b => b.userId === sdkNonAdmin.userInfo.id)
-
-      if (!(user1block1_ET && user2block1_PT)) return false // should be slots for both users
-
-      if (user2block1_PT.startTimeInMS - user1block1_ET.startTimeInMS !== 1000 * 60 * 60 * 3) {
-        return false // difference should be three hours, since same availability in different timezones
-      }
-
-      return true
+      // without a state restriction this endpoint returns availability for EVERY user in the business
+      // with weeklyAvailabilities set, so scope to the two users this test provisions. An unrelated
+      // user (e.g. one stranded by an interrupted suite — reset_db does not clear the users
+      // collection) must not break this assertion.
+      const adminBlocks = r.availabilityBlocks.filter(b => b.userId === sdk.userInfo.id)
+      const nonAdminBlocks = r.availabilityBlocks.filter(b => b.userId === sdkNonAdmin.userInfo.id)
+
+      // 1 hour of availability each for 30 minute meetings, and the admin's duplicate
+      // weeklyAvailabilities entry must not produce extra slots
+      if (adminBlocks.length !== 2) return false
+      if (nonAdminBlocks.length !== 2) return false
+
+      // the server shuffles users, so compare earliest-to-earliest rather than relying on ordering
+      const earliest = (bs: typeof adminBlocks) => Math.min(...bs.map(b => b.startTimeInMS))
+
+      // difference should be three hours, since same availability in different timezones
+      return earliest(nonAdminBlocks) - earliest(adminBlocks) === 1000 * 60 * 60 * 3
     }},
   )
 
@@ -15298,6 +15311,7 @@ const ip_address_form_tests = async () => {
     await beluga_manual_sync_tests({ sdk, sdkNonAdmin })
     await metriport_push_form_response_tests({ sdk, sdkNonAdmin })
     await beluga_trigger_refill_tests({ sdk, sdkNonAdmin })
+    await mdi_trigger_refill_tests({ sdk, sdkNonAdmin })
     await beluga_pharmacy_mappings_tests({ sdk, sdkNonAdmin })
     await mdi_case_offerings_tests({ sdk, sdkNonAdmin })
     await enduser_write_restrictions_tests({ sdk, sdkNonAdmin })
@@ -15317,6 +15331,7 @@ const ip_address_form_tests = async () => {
     await enduser_login_rate_limits_tests({ sdk, sdkNonAdmin })
     await data_sync_redaction_bypass_tests({ sdk, sdkNonAdmin })
     await ai_conversations_rbac_tests({ sdk, sdkNonAdmin })
+    await develop_health_benefit_verification_rbac_tests({ sdk, sdkNonAdmin })
     await cascade_role_rename_cross_tenant_tests({ sdk, sdkNonAdmin })
     await self_admin_role_assignment_tests({ sdk, sdkNonAdmin })
     await sanitize_user_html_xss_tests()
@@ -15393,6 +15408,8 @@ const ip_address_form_tests = async () => {
     await enduser_observations_acknowledge_tests({ sdk, sdkNonAdmin })
     await nutrition_tracking_tests({ sdk, sdkNonAdmin })
     await translations_tests({ sdk, sdkNonAdmin })
+    await configurations_public_read_tests({ sdk, sdkNonAdmin })
+    await form_translations_tests({ sdk, sdkNonAdmin })
     await create_user_notifications_trigger_tests({ sdk })
     await group_mms_active_tests()
     await auto_reply_tests()