@tellescope/sdk 1.256.7 → 1.256.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tellescope/sdk",
-  "version": "1.256.7",
+  "version": "1.256.8",
   "description": "Code for interacting with the Tellescope API",
   "main": "./lib/cjs/sdk.js",
   "module": "./lib/esm/sdk.js",
@@ -33,7 +33,7 @@
   "homepage": "https://github.com/tellescope-os/tellescope#readme",
   "dependencies": {
     "@tellescope/constants": "1.256.7",
-    "@tellescope/schema": "1.256.7",
+    "@tellescope/schema": "1.256.8",
     "@tellescope/testing": "1.256.7",
     "@tellescope/types-client": "1.256.7",
     "@tellescope/types-models": "1.256.7",
@@ -55,5 +55,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "65726a9aff1e45ffbdd4a16d8b0fc3a21204fc6f"
+  "gitHead": "194f5c52adb83f8950ad515f37a9c638b8233c90"
 }

package/src/tests/api_tests/group_event_attendee_self_update.test.ts

@@ -0,0 +1,161 @@
+require('source-map-support').install();
+
+import { Session, EnduserSession } from "../../sdk"
+import { async_test, handleAnyError, passOnAnyResult, log_header } from "@tellescope/testing"
+import { setup_tests } from "../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+// An enduser attendee can PATCH a calendar_event (needed to self-cancel out of a group event), and
+// attendeeStatuses / cancelledGroupAttendees are attendee-keyed arrays that drive per-attendee
+// automation triggers (handle_attendee_status_change_triggers + event-wide completion). The
+// calendar_events relationship constraint must let an enduser touch ONLY their own id's entry, so a
+// patient cannot fire or suppress a co-attendee's Appointment triggers by patching the shared event.
+export const group_event_attendee_self_update_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("Group Event Attendee Self-Update Constraint")
+
+  const createdEnduserIds: string[] = []
+  const createdEventIds: string[] = []
+
+  const createEnduser = async (label: string) => {
+    const e = await sdk.api.endusers.createOne({ email: `attendee_self_update_${label}_${Date.now()}@test.tellescope.com` })
+    createdEnduserIds.push(e.id)
+    return e
+  }
+  const enduserSession = async (id: string) => {
+    const { authToken, enduser } = await sdk.api.endusers.generate_auth_token({ id })
+    return new EnduserSession({ host, authToken, enduser, businessId: sdk.userInfo.businessId })
+  }
+  const createGroupEvent = async (attendeeIds: string[]) => {
+    const event = await sdk.api.calendar_events.createOne({
+      title: 'Attendee Self-Update Test',
+      durationInMinutes: 30,
+      startTimeInMS: Date.now() + Math.floor(Math.random() * 100000),
+      attendees: attendeeIds.map(id => ({ type: 'enduser' as const, id })),
+    })
+    createdEventIds.push(event.id)
+    return event
+  }
+
+  try {
+    const attacker = await createEnduser('self')
+    const victim = await createEnduser('other')
+    const attackerSDK = await enduserSession(attacker.id)
+
+    // ---- ALLOWED: self-cancel out of a fresh group event (the portal self-cancel path) ----
+    const e1 = await createGroupEvent([attacker.id, victim.id])
+    await async_test(
+      "enduser may add their OWN cancelledGroupAttendees entry (self-cancel)",
+      () => attackerSDK.api.calendar_events.updateOne(e1.id, {
+        cancelledGroupAttendees: [{ id: attacker.id, at: new Date() }],
+      }, { replaceObjectFields: true }),
+      passOnAnyResult,
+    )
+
+    // ---- ALLOWED: set own attendeeStatuses entry ----
+    const e2 = await createGroupEvent([attacker.id, victim.id])
+    await async_test(
+      "enduser may set their OWN attendeeStatuses entry",
+      () => attackerSDK.api.calendar_events.updateOne(e2.id, {
+        attendeeStatuses: [{ id: attacker.id, at: new Date(), status: 'Cancelled' }],
+      }, { replaceObjectFields: true }),
+      passOnAnyResult,
+    )
+
+    // ---- REJECTED: set a co-attendee's attendeeStatuses (would fire that patient's triggers) ----
+    const e3 = await createGroupEvent([attacker.id, victim.id])
+    await async_test(
+      "enduser may NOT set a co-attendee's attendeeStatuses entry",
+      () => attackerSDK.api.calendar_events.updateOne(e3.id, {
+        attendeeStatuses: [{ id: victim.id, at: new Date(), status: 'No-showed' }],
+      }, { replaceObjectFields: true }),
+      handleAnyError,
+    )
+
+    // ---- REJECTED: set a co-attendee's cancelledGroupAttendees entry ----
+    const e4 = await createGroupEvent([attacker.id, victim.id])
+    await async_test(
+      "enduser may NOT set a co-attendee's cancelledGroupAttendees entry",
+      () => attackerSDK.api.calendar_events.updateOne(e4.id, {
+        cancelledGroupAttendees: [{ id: victim.id, at: new Date() }],
+      }, { replaceObjectFields: true }),
+      handleAnyError,
+    )
+
+    // ---- REJECTED: drop a co-attendee's existing entry (would suppress their completion trigger) ----
+    const e5 = await createGroupEvent([attacker.id, victim.id])
+    await sdk.api.calendar_events.updateOne(e5.id, {
+      attendeeStatuses: [{ id: victim.id, at: new Date(), status: 'Completed' }],
+    }, { replaceObjectFields: true })
+    await async_test(
+      "enduser may NOT remove a co-attendee's existing attendeeStatuses entry",
+      () => attackerSDK.api.calendar_events.updateOne(e5.id, {
+        attendeeStatuses: [{ id: attacker.id, at: new Date(), status: 'Cancelled' }], // silently drops victim's entry
+      }, { replaceObjectFields: true }),
+      handleAnyError,
+    )
+
+    // ---- REJECTED: modify a co-attendee's existing entry ----
+    const e6 = await createGroupEvent([attacker.id, victim.id])
+    await sdk.api.calendar_events.updateOne(e6.id, {
+      attendeeStatuses: [{ id: victim.id, at: new Date(), status: 'Completed' }],
+    }, { replaceObjectFields: true })
+    await async_test(
+      "enduser may NOT modify a co-attendee's existing attendeeStatuses entry",
+      () => attackerSDK.api.calendar_events.updateOne(e6.id, {
+        attendeeStatuses: [{ id: victim.id, at: new Date(), status: 'No-showed' }],
+      }, { replaceObjectFields: true }),
+      handleAnyError,
+    )
+
+    // ---- ALLOWED: self-cancel while PRESERVING a co-attendee's existing entry (realistic group self-cancel) ----
+    const e7 = await createGroupEvent([attacker.id, victim.id])
+    await sdk.api.calendar_events.updateOne(e7.id, {
+      cancelledGroupAttendees: [{ id: victim.id, at: new Date() }],
+    }, { replaceObjectFields: true })
+    const e7ForAttacker = await attackerSDK.api.calendar_events.getOne(e7.id)
+    await async_test(
+      "enduser may self-cancel while preserving a co-attendee's existing entry",
+      () => attackerSDK.api.calendar_events.updateOne(e7.id, {
+        cancelledGroupAttendees: [...(e7ForAttacker.cancelledGroupAttendees || []), { id: attacker.id, at: new Date() }],
+      }, { replaceObjectFields: true }),
+      passOnAnyResult,
+    )
+
+    // ---- ALLOWED (baseline): staff may set any attendee's status (constraint is enduser-only) ----
+    const e8 = await createGroupEvent([attacker.id, victim.id])
+    await async_test(
+      "staff may set any attendee's status",
+      () => sdk.api.calendar_events.updateOne(e8.id, {
+        attendeeStatuses: [{ id: victim.id, at: new Date(), status: 'No-showed' }],
+      }, { replaceObjectFields: true }),
+      passOnAnyResult,
+    )
+
+  } finally {
+    for (const id of createdEventIds) { try { await sdk.api.calendar_events.deleteOne(id) } catch (_) {} }
+    for (const id of createdEnduserIds) { try { await sdk.api.endusers.deleteOne(id) } catch (_) {} }
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await group_event_attendee_self_update_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ Group event attendee self-update constraint tests completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Group event attendee self-update constraint tests failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/security/F-0006-develop-health-benefit-verification-rbac.test.ts

@@ -88,20 +88,80 @@ export const develop_health_benefit_verification_rbac_tests = async ({ sdk, sdkN
       {
         shouldError: true,
         onError: (e: any) => {
-          // Accept any 4xx access-denial response — handler uses 403 (recommended).
-          // Explicitly reject the pre-fix "Integration not found" / "Enduser is required" /
-          // similar validation messages, which would indicate the access check never fired.
+          // Match the gate's exact message. The SDK error surfaces { message, info } (no top-level
+          // status/code), so we key on the message rather than the HTTP status. This is deliberately
+          // specific: a lapsed subscription ("Your subscription has expired") or an expired token
+          // ("Unauthenticated") also errors BEFORE the handler runs, but neither contains this string,
+          // so the test can't false-pass without the gate executing. Also reject the pre-fix
+          // downstream messages, which would indicate the access check never fired.
           const msg = (e?.message ?? '').toLowerCase()
-          const status = e?.status ?? e?.code
           if (msg.includes('integration not found') || msg.includes('enduser is required')
             || msg.includes('organization') || msg.includes('provider')) {
             return false // reached past the access gate — regression
           }
-          return status === 403 || status === 401
-            || msg.includes('access') || msg.includes('permission') || msg.includes('forbidden')
+          return msg.includes('access to this resource')
         },
       },
     )
+
+    // 4. POSITIVE case: a provider role WITH enduser access must PASS the gate and reach the
+    //    integration stage (this test org has no Develop Health integration, so it 400s with
+    //    "Integration not found"). This guards against the gate over-blocking legitimate users —
+    //    the failure mode a future tightening (e.g. gating on 'All') would introduce.
+    const providerRoleName = `f0006-develop-health-provider-${Date.now()}`
+    let providerRbapId: string | undefined
+    try {
+      const providerRbap = await sdk.api.role_based_access_permissions.createOne({
+        role: providerRoleName,
+        permissions: { ...PROVIDER_PERMISSIONS }, // endusers read/create non-null, eligibility create non-null
+      })
+      providerRbapId = providerRbap.id
+
+      await sdk.api.users.updateOne(sdkNonAdmin.userInfo.id, { roles: [providerRoleName] }, { replaceObjectFields: true })
+      await wait(undefined, 1500)
+      await sdkNonAdmin.authenticate(nonAdminEmail!, nonAdminPassword!)
+
+      await async_test(
+        "F-0006: a provider role with enduser access passes the gate (reaches 'Integration not found', not 403)",
+        () => sdkNonAdmin.api.enduser_eligibility_results.develop_health_run_benefit_verification({
+          enduserId: new ObjectId().toHexString(),
+          providerUserId: new ObjectId().toHexString(),
+          insuranceType: 'primary',
+          diagnoses: [],
+          drugs: [{ name: 'Test Drug', dosage: '10mg', quantity: 1 }],
+          drug_history: { currently_taking_drugs: [], previously_taken_drugs: [] },
+        } as any),
+        {
+          shouldError: true,
+          onError: (e: any) => {
+            const msg = (e?.message ?? '').toLowerCase()
+            // Must NOT be the access-denial message (that would mean the gate wrongly blocked a
+            // provider). Reaching "Integration not found" (or org/provider validation) proves the
+            // gate passed and the read-scoped enduser load did not over-restrict a legitimate role.
+            if (msg.includes('access to this resource')) return false
+            return msg.includes('integration not found') || msg.includes('organization') || msg.includes('provider')
+          },
+        },
+      )
+    } finally {
+      if (providerRbapId) {
+        try {
+          await sdk.api.users.updateOne(sdkNonAdmin.userInfo.id, { roles: originalRoles ?? [] }, { replaceObjectFields: true })
+        } catch {}
+        try { await sdk.api.role_based_access_permissions.deleteOne(providerRbapId) } catch {}
+        await wait(undefined, 1500)
+        try { await sdkNonAdmin.authenticate(nonAdminEmail!, nonAdminPassword!) } catch {}
+      }
+    }
+
+    // NOTE — the create>read bypass (endusers.create broader than endusers.read) that the 2026-08-19
+    // read-scoping closes is NOT live-testable here: this org has no Develop Health integration, so
+    // the handler throws "Integration not found" BEFORE reaching the (now read-scoped) enduser load,
+    // and the enduser load is what the create>read fix governs. Exercising it would need either a real
+    // Develop Health integration or reordering the handler purely for the test. It is covered by code
+    // review + F-0166 (systemic follow-up). If a Develop Health sandbox integration is ever available
+    // in the test org, add: role { endusers: create 'All', read 'Assigned' } → call with a real
+    // enduser NOT assigned to the caller → expect the enduser-not-found path, not a successful forward.
   } finally {
     // Cleanup: restore original roles, delete the test role.
     try {

package/src/tests/tests.ts

@@ -58,6 +58,7 @@ import { purchase_made_trigger_tests } from "./api_tests/purchase_made_trigger.t
 import { appointment_rescheduled_trigger_tests } from "./api_tests/appointment_rescheduled_trigger.test"
 import { appointment_no_showed_trigger_tests } from "./api_tests/appointment_no_showed_trigger.test"
 import { group_event_attendee_status_triggers_tests } from "./api_tests/group_event_attendee_status_triggers.test"
+import { group_event_attendee_self_update_tests } from "./api_tests/group_event_attendee_self_update.test"
 import { calendar_event_create_and_bulk_triggers_tests } from "./api_tests/calendar_event_create_and_bulk_triggers.test"
 import { journey_error_branching_tests } from "./api_tests/journey_error_branching.test"
 import { journey_delete_cancels_actions_tests } from "./api_tests/journey_delete_cancels_actions.test"
@@ -5757,6 +5758,7 @@ const automation_trigger_tests = async () => {
 
   await appointment_no_showed_trigger_tests({ sdk, sdkNonAdmin })
   await group_event_attendee_status_triggers_tests({ sdk, sdkNonAdmin })
+  await group_event_attendee_self_update_tests({ sdk, sdkNonAdmin })
   await calendar_event_create_and_bulk_triggers_tests({ sdk, sdkNonAdmin })
   await assign_care_team_tests()
   await push_forms_to_portal_group_completion_tests({ sdk, sdkNonAdmin })