@tellescope/sdk 1.256.9 → 1.256.11

package/lib/cjs/sdk.d.ts

@@ -4193,7 +4193,7 @@ export declare class Session extends SessionManager {
         iat: number;
         exp: number;
         requiresMFA?: boolean | undefined;
-        sessionScopes?: ("video-join-link" | "video-start-link" | "public-form" | "appointment-booking" | "ics-download" | "embeddables-token")[] | undefined;
+        sessionScopes?: ("video-join-link" | "video-start-link" | "public-form" | "appointment-booking" | "ics-download" | "embeddables-token" | "portal-preview")[] | undefined;
         scopeContext?: import("@tellescope/types-models").SessionScopeContext | undefined;
         allowedPaths?: string[] | undefined;
         users?: number | undefined;
@@ -4358,7 +4358,7 @@ export declare class Session extends SessionManager {
         iat: number;
         exp: number;
         requiresMFA?: boolean | undefined;
-        sessionScopes?: ("video-join-link" | "video-start-link" | "public-form" | "appointment-booking" | "ics-download" | "embeddables-token")[] | undefined;
+        sessionScopes?: ("video-join-link" | "video-start-link" | "public-form" | "appointment-booking" | "ics-download" | "embeddables-token" | "portal-preview")[] | undefined;
         scopeContext?: import("@tellescope/types-models").SessionScopeContext | undefined;
         allowedPaths?: string[] | undefined;
         users?: number | undefined;

package/lib/cjs/tests/api_tests/generate_suggested_reply.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate_suggested_reply.test.d.ts","sourceRoot":"","sources":["../../../../src/tests/api_tests/generate_suggested_reply.test.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAiBnC,eAAO,MAAM,8BAA8B;SAAwC,OAAO;iBAAe,OAAO;mBAgR/G,CAAA"}

package/lib/cjs/tests/api_tests/security/readonly-enduser-preview.test.d.ts

@@ -0,0 +1,29 @@
+import { Session } from "../../../sdk";
+/**
+ * Regression test for F-0138
+ * (security-audit/findings/F-0138-endusers-generate-auth-token-no-admin-gate.md).
+ *
+ * `endusers.generate_auth_token` (the "View portal as patient" preview flow) requires only
+ * `endusers.read`, yet mints a FULLY-PRIVILEGED enduser session. A staff user who cannot update a
+ * patient can therefore act AS that patient: edit the record, submit forms, send chats, book
+ * appointments, even set the portal password.
+ *
+ * The fix mints the preview token with `sessionScopes: ['portal-preview']` whenever the calling
+ * staff user lacks update access to that specific enduser (record-level, honoring `Assigned`
+ * scoping). The scope's allowlist (api/modules/session_scopes.ts) grants exactly the portal's read
+ * surface plus session maintenance; every write path 403s via existing path confinement.
+ *
+ * RED (pre-fix): section A fails — the response carries no sessionScopes and every write in A2
+ * SUCCEEDS. Sections D/E (controls) pass pre-fix. GREEN (post-fix): all sections pass.
+ *
+ * Probes use raw axios rather than the SDK: parseError (sdk/src/session.ts) discards the status
+ * code, and a path-confinement denial (403 "Inaccessible") is byte-identical in message to a
+ * permissions denial. Write/blocked-read probes additionally confirm an UNCONFINED enduser token
+ * gets a non-403 on the same path in the same run, so a 403 can only be confinement, never bad
+ * permissions or a bad body.
+ */
+export declare const readonly_enduser_preview_tests: ({ sdk }: {
+    sdk: Session;
+    sdkNonAdmin: Session;
+}) => Promise<void>;
+//# sourceMappingURL=readonly-enduser-preview.test.d.ts.map

package/lib/cjs/tests/api_tests/security/readonly-enduser-preview.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"readonly-enduser-preview.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/readonly-enduser-preview.test.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,OAAO,EAAkB,MAAM,cAAc,CAAA;AA8BtD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,8BAA8B;SAA2B,OAAO;iBAAe,OAAO;mBA6NlG,CAAA"}

package/lib/cjs/tests/api_tests/security/readonly-enduser-preview.test.js

@@ -0,0 +1,472 @@
+"use strict";
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readonly_enduser_preview_tests = void 0;
+require('source-map-support').install();
+var axios_1 = __importDefault(require("axios"));
+var sdk_1 = require("../../../sdk");
+var testing_1 = require("@tellescope/testing");
+var constants_1 = require("@tellescope/constants");
+var setup_1 = require("../../setup");
+var host = process.env.API_URL || 'http://localhost:8080';
+var RAND = function () { return Math.random().toString(36).slice(2, 10); };
+var ALL = 'All';
+var READ_ONLY = { create: constants_1.NO_ACCESS, read: ALL, update: constants_1.NO_ACCESS, delete: constants_1.NO_ACCESS };
+var FULL_ACCESS = { create: ALL, read: ALL, update: ALL, delete: ALL };
+var ASSIGNED_UPDATE = { create: constants_1.NO_ACCESS, read: ALL, update: 'Assigned', delete: constants_1.NO_ACCESS };
+var PORTAL_PREVIEW_SCOPE = 'portal-preview';
+/**
+ * Regression test for F-0138
+ * (security-audit/findings/F-0138-endusers-generate-auth-token-no-admin-gate.md).
+ *
+ * `endusers.generate_auth_token` (the "View portal as patient" preview flow) requires only
+ * `endusers.read`, yet mints a FULLY-PRIVILEGED enduser session. A staff user who cannot update a
+ * patient can therefore act AS that patient: edit the record, submit forms, send chats, book
+ * appointments, even set the portal password.
+ *
+ * The fix mints the preview token with `sessionScopes: ['portal-preview']` whenever the calling
+ * staff user lacks update access to that specific enduser (record-level, honoring `Assigned`
+ * scoping). The scope's allowlist (api/modules/session_scopes.ts) grants exactly the portal's read
+ * surface plus session maintenance; every write path 403s via existing path confinement.
+ *
+ * RED (pre-fix): section A fails — the response carries no sessionScopes and every write in A2
+ * SUCCEEDS. Sections D/E (controls) pass pre-fix. GREEN (post-fix): all sections pass.
+ *
+ * Probes use raw axios rather than the SDK: parseError (sdk/src/session.ts) discards the status
+ * code, and a path-confinement denial (403 "Inaccessible") is byte-identical in message to a
+ * permissions denial. Write/blocked-read probes additionally confirm an UNCONFINED enduser token
+ * gets a non-403 on the same path in the same run, so a 403 can only be confinement, never bad
+ * permissions or a bad body.
+ */
+var readonly_enduser_preview_tests = function (_a) {
+    var sdk = _a.sdk;
+    return __awaiter(void 0, void 0, void 0, function () {
+        var checks, record, request, isPathDenial, expectDenied, expectAllowed, hasScope, readonlyRole, fullUpdateRole, assignedUpdateRole, roleIds, userIds, enduserIds, _i, _b, _c, role, endusersPerm, rbap, mkUser, readonlyUser, fullUpdateUser, assignedUpdateUser, staffSession, readonlyStaff, fullUpdateStaff, assignedUpdateStaff, enduser, assignedEnduser, form, formResponse, previewMint, previewToken, baselineEnduserToken, refreshed, refreshedToken, cMint, cToken, adminMint, fullMint, assignedMint, assignedMintUnassigned, _d, checks_1, c, _e, checks_2, c, _f, enduserIds_1, id, _g, _h, userIds_1, id, _j, _k, roleIds_1, id, _l;
+        var _m, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x;
+        return __generator(this, function (_y) {
+            switch (_y.label) {
+                case 0:
+                    (0, testing_1.log_header)("F-0138: portal-preview scope for read-only staff generate_auth_token");
+                    checks = [];
+                    record = function (label, pass, detail) { return checks.push({ label: label, pass: pass, detail: detail }); };
+                    request = function (token, method, path, data) { return __awaiter(void 0, void 0, void 0, function () {
+                        var r;
+                        return __generator(this, function (_a) {
+                            switch (_a.label) {
+                                case 0: return [4 /*yield*/, axios_1.default.request(__assign(__assign({ method: method, url: "".concat(host, "/v1").concat(path) }, method === 'get' ? { params: data } : { data: data }), { headers: { Authorization: "Bearer ".concat(token) }, validateStatus: function () { return true; } }))];
+                                case 1:
+                                    r = _a.sent();
+                                    return [2 /*return*/, { status: r.status, body: r.data }];
+                            }
+                        });
+                    }); };
+                    isPathDenial = function (r) {
+                        var _a;
+                        return (r.status === 403 && ((_a = r.body) === null || _a === void 0 ? void 0 : _a.message) === 'Inaccessible');
+                    };
+                    expectDenied = function (label, confinedToken, baselineToken, method, path, data) { return __awaiter(void 0, void 0, void 0, function () {
+                        var baseline, confined, badProbe;
+                        return __generator(this, function (_a) {
+                            switch (_a.label) {
+                                case 0: return [4 /*yield*/, request(baselineToken, method, path, data)];
+                                case 1:
+                                    baseline = _a.sent();
+                                    return [4 /*yield*/, request(confinedToken, method, path, data)];
+                                case 2:
+                                    confined = _a.sent();
+                                    badProbe = baseline.status === 403;
+                                    record(label, !badProbe && isPathDenial(confined), "".concat(method, ":").concat(path, " confined=").concat(confined.status, " baseline=").concat(baseline.status) + (badProbe ? ' BAD PROBE: baseline also 403' : ''));
+                                    return [2 /*return*/];
+                            }
+                        });
+                    }); };
+                    expectAllowed = function (label, token, method, path, data) { return __awaiter(void 0, void 0, void 0, function () {
+                        var r;
+                        return __generator(this, function (_a) {
+                            switch (_a.label) {
+                                case 0: return [4 /*yield*/, request(token, method, path, data)];
+                                case 1:
+                                    r = _a.sent();
+                                    record(label, r.status !== 403 && r.status !== 401, "".concat(method, ":").concat(path, " status=").concat(r.status));
+                                    return [2 /*return*/];
+                            }
+                        });
+                    }); };
+                    hasScope = function (enduser) { var _a, _b; return !!((_b = (_a = enduser === null || enduser === void 0 ? void 0 : enduser.sessionScopes) === null || _a === void 0 ? void 0 : _a.includes) === null || _b === void 0 ? void 0 : _b.call(_a, PORTAL_PREVIEW_SCOPE)); };
+                    readonlyRole = "f0138-readonly-".concat(RAND());
+                    fullUpdateRole = "f0138-full-".concat(RAND());
+                    assignedUpdateRole = "f0138-assigned-".concat(RAND());
+                    roleIds = [];
+                    userIds = [];
+                    enduserIds = [];
+                    _y.label = 1;
+                case 1:
+                    _y.trys.push([1, , 47, 66]);
+                    _i = 0, _b = [
+                        [readonlyRole, READ_ONLY],
+                        [fullUpdateRole, FULL_ACCESS],
+                        [assignedUpdateRole, ASSIGNED_UPDATE],
+                    ];
+                    _y.label = 2;
+                case 2:
+                    if (!(_i < _b.length)) return [3 /*break*/, 5];
+                    _c = _b[_i], role = _c[0], endusersPerm = _c[1];
+                    return [4 /*yield*/, sdk.api.role_based_access_permissions.createOne({
+                            role: role,
+                            permissions: __assign(__assign({}, constants_1.PROVIDER_PERMISSIONS), { endusers: endusersPerm }),
+                        })];
+                case 3:
+                    rbap = _y.sent();
+                    roleIds.push(rbap.id);
+                    _y.label = 4;
+                case 4:
+                    _i++;
+                    return [3 /*break*/, 2];
+                case 5:
+                    mkUser = function (role) { return __awaiter(void 0, void 0, void 0, function () {
+                        var u;
+                        return __generator(this, function (_a) {
+                            switch (_a.label) {
+                                case 0: return [4 /*yield*/, sdk.api.users.createOne({
+                                        email: "f0138-".concat(role, "-").concat(RAND(), "@tellescope.example"),
+                                        fname: 'F0138', lname: 'Staff',
+                                        verifiedEmail: true,
+                                        notificationEmailsDisabled: true,
+                                        roles: [role],
+                                    })];
+                                case 1:
+                                    u = _a.sent();
+                                    userIds.push(u.id);
+                                    return [2 /*return*/, u];
+                            }
+                        });
+                    }); };
+                    return [4 /*yield*/, mkUser(readonlyRole)];
+                case 6:
+                    readonlyUser = _y.sent();
+                    return [4 /*yield*/, mkUser(fullUpdateRole)];
+                case 7:
+                    fullUpdateUser = _y.sent();
+                    return [4 /*yield*/, mkUser(assignedUpdateRole)
+                        // Staff sessions from admin-minted tokens (avoids the password / login-rate-limit dance).
+                    ];
+                case 8:
+                    assignedUpdateUser = _y.sent();
+                    staffSession = function (userId) { return __awaiter(void 0, void 0, void 0, function () {
+                        var authToken;
+                        return __generator(this, function (_a) {
+                            switch (_a.label) {
+                                case 0: return [4 /*yield*/, sdk.api.users.generate_auth_token({ id: userId })];
+                                case 1:
+                                    authToken = (_a.sent()).authToken;
+                                    return [2 /*return*/, new sdk_1.Session({ host: host, authToken: authToken })];
+                            }
+                        });
+                    }); };
+                    return [4 /*yield*/, staffSession(readonlyUser.id)];
+                case 9:
+                    readonlyStaff = _y.sent();
+                    return [4 /*yield*/, staffSession(fullUpdateUser.id)];
+                case 10:
+                    fullUpdateStaff = _y.sent();
+                    return [4 /*yield*/, staffSession(assignedUpdateUser.id)
+                        // Endusers: unassigned patient, a bystander, and one assigned to the assigned-update user.
+                    ];
+                case 11:
+                    assignedUpdateStaff = _y.sent();
+                    return [4 /*yield*/, sdk.api.endusers.createOne({
+                            email: "f0138-patient-".concat(RAND(), "@tellescope.example"), fname: 'F0138', lname: 'Patient',
+                        })];
+                case 12:
+                    enduser = _y.sent();
+                    enduserIds.push(enduser.id);
+                    return [4 /*yield*/, sdk.api.endusers.createOne({
+                            email: "f0138-assigned-".concat(RAND(), "@tellescope.example"), fname: 'F0138', lname: 'Assigned',
+                            assignedTo: [assignedUpdateUser.id],
+                        })];
+                case 13:
+                    assignedEnduser = _y.sent();
+                    enduserIds.push(assignedEnduser.id);
+                    return [4 /*yield*/, sdk.api.forms.createOne({ title: "F-0138 preview form ".concat(RAND()) })];
+                case 14:
+                    form = _y.sent();
+                    return [4 /*yield*/, sdk.api.form_responses.prepare_form_response({
+                            formId: form.id, enduserId: enduser.id,
+                        })
+                        /* ===== A1: read-only staff mints a scoped preview token ===== */
+                    ];
+                case 15:
+                    formResponse = (_y.sent()).response;
+                    return [4 /*yield*/, readonlyStaff.api.endusers.generate_auth_token({ id: enduser.id })];
+                case 16:
+                    previewMint = _y.sent();
+                    previewToken = previewMint.authToken;
+                    record('A1: read-only staff receives an authToken', !!previewToken, "authToken present=".concat(!!previewToken));
+                    record('A1: read-only staff mint is scoped to portal-preview', hasScope(previewMint.enduser), "sessionScopes=".concat(JSON.stringify((_m = previewMint.enduser) === null || _m === void 0 ? void 0 : _m.sessionScopes), " (F-0138 vuln if absent)"));
+                    record('A1(E): scoped preview token carries denySocket', ((_o = previewMint.enduser) === null || _o === void 0 ? void 0 : _o.denySocket) === true, "denySocket=".concat((_p = previewMint.enduser) === null || _p === void 0 ? void 0 : _p.denySocket));
+                    return [4 /*yield*/, sdk.api.endusers.generate_auth_token({ id: enduser.id })
+                        /* ===== A2: writes blocked for the scoped session ===== */
+                    ];
+                case 17:
+                    baselineEnduserToken = (_y.sent()).authToken;
+                    /* ===== A2: writes blocked for the scoped session ===== */
+                    return [4 /*yield*/, expectDenied('A2: cannot self-update the patient record', previewToken, baselineEnduserToken, 'patch', "/enduser/".concat(enduser.id), { updates: { fname: 'Hacked' } })];
+                case 18:
+                    /* ===== A2: writes blocked for the scoped session ===== */
+                    _y.sent();
+                    return [4 /*yield*/, expectDenied('A2: cannot set the patient portal password', previewToken, baselineEnduserToken, 'post', '/set-enduser-password', { id: enduser.id, password: "F0138Pw!".concat(RAND()) })];
+                case 19:
+                    _y.sent();
+                    return [4 /*yield*/, expectDenied('A2: cannot send a chat as the patient', previewToken, baselineEnduserToken, 'post', '/chat', { message: 'hi from preview' })];
+                case 20:
+                    _y.sent();
+                    return [4 /*yield*/, expectDenied('A2: cannot submit a form as the patient', previewToken, baselineEnduserToken, 'patch', '/submit-form-response', { id: formResponse.id, responses: [] })];
+                case 21:
+                    _y.sent();
+                    return [4 /*yield*/, expectDenied('A2: cannot book an appointment as the patient', previewToken, baselineEnduserToken, 'post', '/book-appointment', {})];
+                case 22:
+                    _y.sent();
+                    return [4 /*yield*/, expectDenied('A2: cannot start a file upload as the patient', previewToken, baselineEnduserToken, 'post', '/prepare-file-upload', { name: 'x.pdf', type: 'application/pdf', enduserId: enduser.id })
+                        /* ===== B: no laundering via refresh ===== */
+                    ];
+                case 23:
+                    _y.sent();
+                    return [4 /*yield*/, request(previewToken, 'post', '/refresh-enduser-session', {})];
+                case 24:
+                    refreshed = _y.sent();
+                    refreshedToken = (_q = refreshed.body) === null || _q === void 0 ? void 0 : _q.authToken;
+                    record('B: refresh succeeds', refreshed.status === 200 && !!refreshedToken, "status=".concat(refreshed.status, " token=").concat(!!refreshedToken));
+                    record('B: refreshed session still carries portal-preview scope', hasScope((_r = refreshed.body) === null || _r === void 0 ? void 0 : _r.enduser), "sessionScopes=".concat(JSON.stringify((_t = (_s = refreshed.body) === null || _s === void 0 ? void 0 : _s.enduser) === null || _t === void 0 ? void 0 : _t.sessionScopes), " (laundering if absent)"));
+                    if (!refreshedToken) return [3 /*break*/, 26];
+                    return [4 /*yield*/, expectDenied('B: refreshed token still cannot write', refreshedToken, baselineEnduserToken, 'patch', "/enduser/".concat(enduser.id), { updates: { fname: 'HackedAfterRefresh' } })];
+                case 25:
+                    _y.sent();
+                    _y.label = 26;
+                case 26: return [4 /*yield*/, expectAllowed('B: logout allowed', previewToken, 'post', '/logout-enduser')
+                    /* ===== C: ungranted mutating "reads" blocked ===== */
+                    // Re-mint (the previous token was just logged out).
+                ];
+                case 27:
+                    _y.sent();
+                    return [4 /*yield*/, readonlyStaff.api.endusers.generate_auth_token({ id: enduser.id })];
+                case 28:
+                    cMint = _y.sent();
+                    cToken = cMint.authToken;
+                    return [4 /*yield*/, expectDenied('C: proxy_read blocked', cToken, baselineEnduserToken, 'get', '/integrations/proxy-read', { integration: 'Stripe', type: 'subscriptions' })];
+                case 29:
+                    _y.sent();
+                    return [4 /*yield*/, expectDenied('C: booking_info (mints a token) blocked', cToken, baselineEnduserToken, 'get', '/form-fields/booking-info', { bookingPageId: 'x' })];
+                case 30:
+                    _y.sent();
+                    return [4 /*yield*/, expectDenied('C: form_responses stripe_details blocked', cToken, baselineEnduserToken, 'get', '/form-responses/stripe-details', {})];
+                case 31:
+                    _y.sent();
+                    return [4 /*yield*/, expectDenied('C: products stripe-portal-session blocked', cToken, baselineEnduserToken, 'get', '/products/stripe-portal-session', {})
+                        /* ===== D: granted portal reads still work ===== */
+                    ];
+                case 32:
+                    _y.sent();
+                    /* ===== D: granted portal reads still work ===== */
+                    return [4 /*yield*/, expectAllowed('D: portal-customizations', cToken, 'get', '/portal-customizations')];
+                case 33:
+                    /* ===== D: granted portal reads still work ===== */
+                    _y.sent();
+                    return [4 /*yield*/, expectAllowed('D: calendar-events', cToken, 'get', '/calendar-events')];
+                case 34:
+                    _y.sent();
+                    return [4 /*yield*/, expectAllowed('D: my-meetings', cToken, 'get', '/my-meetings')];
+                case 35:
+                    _y.sent();
+                    return [4 /*yield*/, expectAllowed('D: chat-rooms', cToken, 'get', '/chat-rooms')];
+                case 36:
+                    _y.sent();
+                    return [4 /*yield*/, expectAllowed('D: care-plans', cToken, 'get', '/care-plans')];
+                case 37:
+                    _y.sent();
+                    return [4 /*yield*/, expectAllowed('D: form-responses', cToken, 'get', '/form-responses')];
+                case 38:
+                    _y.sent();
+                    return [4 /*yield*/, expectAllowed('D: self enduser read', cToken, 'get', "/enduser/".concat(enduser.id))];
+                case 39:
+                    _y.sent();
+                    return [4 /*yield*/, expectAllowed('D: file-download-URL', cToken, 'get', '/file-download-URL', { secureName: 'nonexistent' })];
+                case 40:
+                    _y.sent();
+                    return [4 /*yield*/, expectAllowed('D: enduser-session-info', cToken, 'get', '/enduser-session-info')
+                        /* ===== E: zero behavior change controls ===== */
+                    ];
+                case 41:
+                    _y.sent();
+                    return [4 /*yield*/, sdk.api.endusers.generate_auth_token({ id: enduser.id })];
+                case 42:
+                    adminMint = _y.sent();
+                    record('E: admin-minted token is NOT scoped', !hasScope(adminMint.enduser), "sessionScopes=".concat(JSON.stringify((_u = adminMint.enduser) === null || _u === void 0 ? void 0 : _u.sessionScopes)));
+                    return [4 /*yield*/, expectAllowed('E: admin-minted token can write', adminMint.authToken, 'patch', "/enduser/".concat(enduser.id), { updates: { fname: 'AdminEditOk' } })];
+                case 43:
+                    _y.sent();
+                    return [4 /*yield*/, fullUpdateStaff.api.endusers.generate_auth_token({ id: enduser.id })];
+                case 44:
+                    fullMint = _y.sent();
+                    record('E: update:All staff mints an UNSCOPED token', !hasScope(fullMint.enduser), "sessionScopes=".concat(JSON.stringify((_v = fullMint.enduser) === null || _v === void 0 ? void 0 : _v.sessionScopes)));
+                    return [4 /*yield*/, assignedUpdateStaff.api.endusers.generate_auth_token({ id: assignedEnduser.id })];
+                case 45:
+                    assignedMint = _y.sent();
+                    record('E: assigned-update staff UNSCOPED for an assigned patient', !hasScope(assignedMint.enduser), "sessionScopes=".concat(JSON.stringify((_w = assignedMint.enduser) === null || _w === void 0 ? void 0 : _w.sessionScopes)));
+                    return [4 /*yield*/, assignedUpdateStaff.api.endusers.generate_auth_token({ id: enduser.id })];
+                case 46:
+                    assignedMintUnassigned = _y.sent();
+                    record('E: assigned-update staff SCOPED for an unassigned patient', hasScope(assignedMintUnassigned.enduser), "sessionScopes=".concat(JSON.stringify((_x = assignedMintUnassigned.enduser) === null || _x === void 0 ? void 0 : _x.sessionScopes)));
+                    /* ===== report: print full table first, then assert (harness exits on first failure) ===== */
+                    console.log('\n  F-0138 check summary:');
+                    for (_d = 0, checks_1 = checks; _d < checks_1.length; _d++) {
+                        c = checks_1[_d];
+                        console.log("    ".concat(c.pass ? 'PASS' : 'FAIL', "  ").concat(c.label, "  \u2014  ").concat(c.detail));
+                    }
+                    console.log('');
+                    for (_e = 0, checks_2 = checks; _e < checks_2.length; _e++) {
+                        c = checks_2[_e];
+                        (0, testing_1.assert)(c.pass, "".concat(c.label, " \u2014 ").concat(c.detail), c.label);
+                    }
+                    return [3 /*break*/, 66];
+                case 47:
+                    _f = 0, enduserIds_1 = enduserIds;
+                    _y.label = 48;
+                case 48:
+                    if (!(_f < enduserIds_1.length)) return [3 /*break*/, 53];
+                    id = enduserIds_1[_f];
+                    _y.label = 49;
+                case 49:
+                    _y.trys.push([49, 51, , 52]);
+                    return [4 /*yield*/, sdk.api.endusers.deleteOne(id)];
+                case 50:
+                    _y.sent();
+                    return [3 /*break*/, 52];
+                case 51:
+                    _g = _y.sent();
+                    return [3 /*break*/, 52];
+                case 52:
+                    _f++;
+                    return [3 /*break*/, 48];
+                case 53:
+                    _h = 0, userIds_1 = userIds;
+                    _y.label = 54;
+                case 54:
+                    if (!(_h < userIds_1.length)) return [3 /*break*/, 59];
+                    id = userIds_1[_h];
+                    _y.label = 55;
+                case 55:
+                    _y.trys.push([55, 57, , 58]);
+                    return [4 /*yield*/, sdk.api.users.deleteOne(id)];
+                case 56:
+                    _y.sent();
+                    return [3 /*break*/, 58];
+                case 57:
+                    _j = _y.sent();
+                    return [3 /*break*/, 58];
+                case 58:
+                    _h++;
+                    return [3 /*break*/, 54];
+                case 59:
+                    _k = 0, roleIds_1 = roleIds;
+                    _y.label = 60;
+                case 60:
+                    if (!(_k < roleIds_1.length)) return [3 /*break*/, 65];
+                    id = roleIds_1[_k];
+                    _y.label = 61;
+                case 61:
+                    _y.trys.push([61, 63, , 64]);
+                    return [4 /*yield*/, sdk.api.role_based_access_permissions.deleteOne(id)];
+                case 62:
+                    _y.sent();
+                    return [3 /*break*/, 64];
+                case 63:
+                    _l = _y.sent();
+                    return [3 /*break*/, 64];
+                case 64:
+                    _k++;
+                    return [3 /*break*/, 60];
+                case 65: return [7 /*endfinally*/];
+                case 66: return [2 /*return*/];
+            }
+        });
+    });
+};
+exports.readonly_enduser_preview_tests = readonly_enduser_preview_tests;
+// Allow running this test file independently
+if (require.main === module) {
+    console.log("\uD83C\uDF10 Using API URL: ".concat(host));
+    var sdk_2 = new sdk_1.Session({ host: host });
+    var sdkNonAdmin_1 = new sdk_1.Session({ host: host });
+    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, (0, setup_1.setup_tests)(sdk_2, sdkNonAdmin_1)];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, (0, exports.readonly_enduser_preview_tests)({ sdk: sdk_2, sdkNonAdmin: sdkNonAdmin_1 })];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); };
+    runTests()
+        .then(function () {
+        console.log("✅ F-0138 portal-preview scope test suite completed successfully");
+        process.exit(0);
+    })
+        .catch(function (error) {
+        console.error("❌ F-0138 portal-preview scope test suite failed:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=readonly-enduser-preview.test.js.map

package/lib/cjs/tests/api_tests/security/readonly-enduser-preview.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"readonly-enduser-preview.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/readonly-enduser-preview.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,gDAAyB;AAEzB,oCAAsD;AACtD,+CAG4B;AAC5B,mDAAuE;AACvE,qCAAyC;AAEzC,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE,IAAM,IAAI,GAAG,cAAM,OAAA,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAvC,CAAuC,CAAA;AAE1D,IAAM,GAAG,GAAG,KAAc,CAAA;AAC1B,IAAM,SAAS,GAAG,EAAE,MAAM,EAAE,qBAAS,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,qBAAS,EAAE,MAAM,EAAE,qBAAS,EAAE,CAAA;AACxF,IAAM,WAAW,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;AACxE,IAAM,eAAe,GAAG,EAAE,MAAM,EAAE,qBAAS,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,UAAmB,EAAE,MAAM,EAAE,qBAAS,EAAE,CAAA;AAExG,IAAM,oBAAoB,GAAG,gBAAgB,CAAA;AAa7C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACI,IAAM,8BAA8B,GAAG,UAAO,EAAgD;QAA9C,GAAG,SAAA;;;;;;;oBACxD,IAAA,oBAAU,EAAC,sEAAsE,CAAC,CAAA;oBAE5E,MAAM,GAAY,EAAE,CAAA;oBACpB,MAAM,GAAG,UAAC,KAAa,EAAE,IAAa,EAAE,MAAc,IAAK,OAAA,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,OAAA,EAAE,IAAI,MAAA,EAAE,MAAM,QAAA,EAAE,CAAC,EAApC,CAAoC,CAAA;oBAE/F,OAAO,GAAG,UAAO,KAAa,EAAE,MAAmB,EAAE,IAAY,EAAE,IAAU;;;;wCACvE,qBAAM,eAAK,CAAC,OAAO,qBAC3B,MAAM,QAAA,EACN,GAAG,EAAE,UAAG,IAAI,gBAAM,IAAI,CAAE,IACrB,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,MAAA,EAAE,KACjD,OAAO,EAAE,EAAE,aAAa,EAAE,iBAAU,KAAK,CAAE,EAAE,EAC7C,cAAc,EAAE,cAAM,OAAA,IAAI,EAAJ,CAAI,IAC1B,EAAA;;oCANI,CAAC,GAAG,SAMR;oCACF,sBAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAA;;;yBAC1C,CAAA;oBAEK,YAAY,GAAG,UAAC,CAAgC;;wBAAK,OAAA,CACzD,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAA,MAAA,CAAC,CAAC,IAAI,0CAAE,OAAO,MAAK,cAAc,CACvD,CAAA;qBAAA,CAAA;oBAGK,YAAY,GAAG,UACnB,KAAa,EAAE,aAAqB,EAAE,aAAqB,EAC3D,MAAmB,EAAE,IAAY,EAAE,IAAU;;;;wCAE5B,qBAAM,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,EAAA;;oCAA3D,QAAQ,GAAG,SAAgD;oCAChD,qBAAM,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,EAAA;;oCAA3D,QAAQ,GAAG,SAAgD;oCAC3D,QAAQ,GAAG,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAA;oCACxC,MAAM,CACJ,KAAK,EACL,CAAC,QAAQ,IAAI,YAAY,CAAC,QAAQ,CAAC,EACnC,UAAG,MAAM,cAAI,IAAI,uBAAa,QAAQ,CAAC,MAAM,uBAAa,QAAQ,CAAC,MAAM,CAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,EAAE,CAAC,CAChI,CAAA;;;;yBACF,CAAA;oBAGK,aAAa,GAAG,UACpB,KAAa,EAAE,KAAa,EAAE,MAAmB,EAAE,IAAY,EAAE,IAAU;;;;wCAEjE,qBAAM,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,EAAA;;oCAA5C,CAAC,GAAG,SAAwC;oCAClD,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,UAAG,MAAM,cAAI,IAAI,qBAAW,CAAC,CAAC,MAAM,CAAE,CAAC,CAAA;;;;yBAC5F,CAAA;oBAEK,QAAQ,GAAG,UAAC,OAAY,gBAAK,OAAA,CAAC,CAAC,CAAA,MAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa,0CAAE,QAAQ,mDAAG,oBAAoB,CAAC,CAAA,CAAA,EAAA,CAAA;oBAEvF,YAAY,GAAG,yBAAkB,IAAI,EAAE,CAAE,CAAA;oBACzC,cAAc,GAAG,qBAAc,IAAI,EAAE,CAAE,CAAA;oBACvC,kBAAkB,GAAG,yBAAkB,IAAI,EAAE,CAAE,CAAA;oBAC/C,OAAO,GAAa,EAAE,CAAA;oBACtB,OAAO,GAAa,EAAE,CAAA;oBACtB,UAAU,GAAa,EAAE,CAAA;;;;0BASnB,EAJyB,KAAA;wBACjC,CAAC,YAAY,EAAE,SAAS,CAAC;wBACzB,CAAC,cAAc,EAAE,WAAW,CAAC;wBAC7B,CAAC,kBAAkB,EAAE,eAAe,CAAC;qBAC7B;;;yBAJyB,CAAA,cAIzB,CAAA;oBAJC,WAAoB,EAAnB,IAAI,QAAA,EAAE,YAAY,QAAA;oBAKf,qBAAM,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,SAAS,CAAC;4BACjE,IAAI,MAAA;4BACJ,WAAW,wBAAO,gCAAoB,KAAE,QAAQ,EAAE,YAAY,GAAE;yBAC1D,CAAC,EAAA;;oBAHH,IAAI,GAAG,SAGJ;oBACT,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;;;oBATY,IAIzB,CAAA;;;oBASJ,MAAM,GAAG,UAAO,IAAY;;;;wCACtB,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;wCACtC,KAAK,EAAE,gBAAS,IAAI,cAAI,IAAI,EAAE,wBAAqB;wCACnD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO;wCAC9B,aAAa,EAAE,IAAI;wCACnB,0BAA0B,EAAE,IAAI;wCAChC,KAAK,EAAE,CAAC,IAAI,CAAC;qCACP,CAAC,EAAA;;oCANH,CAAC,GAAG,SAMD;oCACT,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;oCAClB,sBAAO,CAAC,EAAA;;;yBACT,CAAA;oBACoB,qBAAM,MAAM,CAAC,YAAY,CAAC,EAAA;;oBAAzC,YAAY,GAAG,SAA0B;oBACxB,qBAAM,MAAM,CAAC,cAAc,CAAC,EAAA;;oBAA7C,cAAc,GAAG,SAA4B;oBACxB,qBAAM,MAAM,CAAC,kBAAkB,CAAC;wBAE3D,0FAA0F;sBAF/B;;oBAArD,kBAAkB,GAAG,SAAgC;oBAGrD,YAAY,GAAG,UAAO,MAAc;;;;wCAClB,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAA;;oCAArE,SAAS,GAAK,CAAA,SAAuD,CAAA,UAA5D;oCACjB,sBAAO,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,SAAS,WAAA,EAAE,CAAC,EAAA;;;yBACxC,CAAA;oBACqB,qBAAM,YAAY,CAAC,YAAY,CAAC,EAAE,CAAC,EAAA;;oBAAnD,aAAa,GAAG,SAAmC;oBACjC,qBAAM,YAAY,CAAC,cAAc,CAAC,EAAE,CAAC,EAAA;;oBAAvD,eAAe,GAAG,SAAqC;oBACjC,qBAAM,YAAY,CAAC,kBAAkB,CAAC,EAAE,CAAC;wBAErE,2FAA2F;sBAFtB;;oBAA/D,mBAAmB,GAAG,SAAyC;oBAGrD,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;4BAC/C,KAAK,EAAE,wBAAiB,IAAI,EAAE,wBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;yBACtF,CAAC,EAAA;;oBAFI,OAAO,GAAG,SAEd;oBACF,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;oBACH,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;4BACvD,KAAK,EAAE,yBAAkB,IAAI,EAAE,wBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU;4BACvF,UAAU,EAAE,CAAC,kBAAkB,CAAC,EAAE,CAAC;yBAC7B,CAAC,EAAA;;oBAHH,eAAe,GAAG,SAGf;oBACT,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAA;oBAGtB,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,8BAAuB,IAAI,EAAE,CAAE,EAAE,CAAC,EAAA;;oBAAhF,IAAI,GAAG,SAAyE;oBACnD,qBAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,qBAAqB,CAAC;4BACpF,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE;yBACvC,CAAC;wBAEF,kEAAkE;sBAFhE;;oBAFgB,YAAY,GAAK,CAAA,SAEjC,CAAA,SAF4B;oBAMV,qBAAM,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,EAAA;;oBAAtF,WAAW,GAAG,SAAwE;oBACtF,YAAY,GAAG,WAAW,CAAC,SAAS,CAAA;oBAC1C,MAAM,CAAC,2CAA2C,EAAE,CAAC,CAAC,YAAY,EAAE,4BAAqB,CAAC,CAAC,YAAY,CAAE,CAAC,CAAA;oBAC1G,MAAM,CACJ,sDAAsD,EACtD,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,EAC7B,wBAAiB,IAAI,CAAC,SAAS,CAAC,MAAC,WAAW,CAAC,OAAe,0CAAE,aAAa,CAAC,6BAA0B,CACvG,CAAA;oBACD,MAAM,CACJ,gDAAgD,EAChD,CAAA,MAAC,WAAW,CAAC,OAAe,0CAAE,UAAU,MAAK,IAAI,EACjD,qBAAc,MAAC,WAAW,CAAC,OAAe,0CAAE,UAAU,CAAE,CACzD,CAAA;oBAG2C,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;wBAE1G,2DAA2D;sBAF+C;;oBAAvF,oBAAoB,GAAK,CAAA,SAA8D,CAAA,UAAnE;oBAEvC,2DAA2D;oBAE3D,qBAAM,YAAY,CAAC,2CAA2C,EAAE,YAAY,EAAE,oBAAoB,EAChG,OAAO,EAAE,mBAAY,OAAO,CAAC,EAAE,CAAE,EAAE,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,EAAA;;oBAHtE,2DAA2D;oBAE3D,SACsE,CAAA;oBACtE,qBAAM,YAAY,CAAC,4CAA4C,EAAE,YAAY,EAAE,oBAAoB,EACjG,MAAM,EAAE,uBAAuB,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAW,IAAI,EAAE,CAAE,EAAE,CAAC,EAAA;;oBADrF,SACqF,CAAA;oBACrF,qBAAM,YAAY,CAAC,uCAAuC,EAAE,YAAY,EAAE,oBAAoB,EAC5F,MAAM,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,EAAA;;oBADlD,SACkD,CAAA;oBAClD,qBAAM,YAAY,CAAC,yCAAyC,EAAE,YAAY,EAAE,oBAAoB,EAC9F,OAAO,EAAE,uBAAuB,EAAE,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,EAAA;;oBAD3E,SAC2E,CAAA;oBAC3E,qBAAM,YAAY,CAAC,+CAA+C,EAAE,YAAY,EAAE,oBAAoB,EACpG,MAAM,EAAE,mBAAmB,EAAE,EAAE,CAAC,EAAA;;oBADlC,SACkC,CAAA;oBAClC,qBAAM,YAAY,CAAC,+CAA+C,EAAE,YAAY,EAAE,oBAAoB,EACpG,MAAM,EAAE,sBAAsB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;wBAEpG,8CAA8C;sBAFsD;;oBADpG,SACoG,CAAA;oBAIlF,qBAAM,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAE,CAAC,EAAA;;oBAA/E,SAAS,GAAG,SAAmE;oBAC/E,cAAc,GAAG,MAAA,SAAS,CAAC,IAAI,0CAAE,SAA+B,CAAA;oBACtE,MAAM,CAAC,qBAAqB,EAAE,SAAS,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,cAAc,EAAE,iBAAU,SAAS,CAAC,MAAM,oBAAU,CAAC,CAAC,cAAc,CAAE,CAAC,CAAA;oBACnI,MAAM,CACJ,yDAAyD,EACzD,QAAQ,CAAC,MAAA,SAAS,CAAC,IAAI,0CAAE,OAAO,CAAC,EACjC,wBAAiB,IAAI,CAAC,SAAS,CAAC,MAAA,MAAA,SAAS,CAAC,IAAI,0CAAE,OAAO,0CAAE,aAAa,CAAC,4BAAyB,CACjG,CAAA;yBACG,cAAc,EAAd,yBAAc;oBAChB,qBAAM,YAAY,CAAC,uCAAuC,EAAE,cAAc,EAAE,oBAAoB,EAC9F,OAAO,EAAE,mBAAY,OAAO,CAAC,EAAE,CAAE,EAAE,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,CAAC,EAAA;;oBADlF,SACkF,CAAA;;yBAEpF,qBAAM,aAAa,CAAC,mBAAmB,EAAE,YAAY,EAAE,MAAM,EAAE,iBAAiB,CAAC;oBAEjF,uDAAuD;oBAEvD,oDAAoD;kBAJ6B;;oBAAjF,SAAiF,CAAA;oBAKnE,qBAAM,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,EAAA;;oBAAhF,KAAK,GAAG,SAAwE;oBAChF,MAAM,GAAG,KAAK,CAAC,SAAS,CAAA;oBAC9B,qBAAM,YAAY,CAAC,uBAAuB,EAAE,MAAM,EAAE,oBAAoB,EACtE,KAAK,EAAE,0BAA0B,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,EAAA;;oBADtF,SACsF,CAAA;oBACtF,qBAAM,YAAY,CAAC,yCAAyC,EAAE,MAAM,EAAE,oBAAoB,EACxF,KAAK,EAAE,2BAA2B,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,EAAA;;oBAD7D,SAC6D,CAAA;oBAC7D,qBAAM,YAAY,CAAC,0CAA0C,EAAE,MAAM,EAAE,oBAAoB,EACzF,KAAK,EAAE,gCAAgC,EAAE,EAAE,CAAC,EAAA;;oBAD9C,SAC8C,CAAA;oBAC9C,qBAAM,YAAY,CAAC,2CAA2C,EAAE,MAAM,EAAE,oBAAoB,EAC1F,KAAK,EAAE,iCAAiC,EAAE,EAAE,CAAC;wBAE/C,oDAAoD;sBAFL;;oBAD/C,SAC+C,CAAA;oBAE/C,oDAAoD;oBAEpD,qBAAM,aAAa,CAAC,0BAA0B,EAAE,MAAM,EAAE,KAAK,EAAE,wBAAwB,CAAC,EAAA;;oBAFxF,oDAAoD;oBAEpD,SAAwF,CAAA;oBACxF,qBAAM,aAAa,CAAC,oBAAoB,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,CAAC,EAAA;;oBAA5E,SAA4E,CAAA;oBAC5E,qBAAM,aAAa,CAAC,gBAAgB,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,CAAC,EAAA;;oBAApE,SAAoE,CAAA;oBACpE,qBAAM,aAAa,CAAC,eAAe,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,EAAA;;oBAAlE,SAAkE,CAAA;oBAClE,qBAAM,aAAa,CAAC,eAAe,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,EAAA;;oBAAlE,SAAkE,CAAA;oBAClE,qBAAM,aAAa,CAAC,mBAAmB,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,CAAC,EAAA;;oBAA1E,SAA0E,CAAA;oBAC1E,qBAAM,aAAa,CAAC,sBAAsB,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAY,OAAO,CAAC,EAAE,CAAE,CAAC,EAAA;;oBAApF,SAAoF,CAAA;oBACpF,qBAAM,aAAa,CAAC,sBAAsB,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,EAAA;;oBAA/G,SAA+G,CAAA;oBAC/G,qBAAM,aAAa,CAAC,yBAAyB,EAAE,MAAM,EAAE,KAAK,EAAE,uBAAuB,CAAC;wBAEtF,kDAAkD;sBAFoC;;oBAAtF,SAAsF,CAAA;oBAIpE,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,EAAA;;oBAA1E,SAAS,GAAG,SAA8D;oBAChF,MAAM,CAAC,qCAAqC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,EACxE,wBAAiB,IAAI,CAAC,SAAS,CAAC,MAAC,SAAS,CAAC,OAAe,0CAAE,aAAa,CAAC,CAAE,CAAC,CAAA;oBAC/E,qBAAM,aAAa,CAAC,iCAAiC,EAAE,SAAS,CAAC,SAAS,EAAE,OAAO,EACjF,mBAAY,OAAO,CAAC,EAAE,CAAE,EAAE,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,CAAC,EAAA;;oBADlE,SACkE,CAAA;oBAEjD,qBAAM,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,EAAA;;oBAArF,QAAQ,GAAG,SAA0E;oBAC3F,MAAM,CAAC,6CAA6C,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAC/E,wBAAiB,IAAI,CAAC,SAAS,CAAC,MAAC,QAAQ,CAAC,OAAe,0CAAE,aAAa,CAAC,CAAE,CAAC,CAAA;oBAEzD,qBAAM,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC,EAAA;;oBAArG,YAAY,GAAG,SAAsF;oBAC3G,MAAM,CAAC,2DAA2D,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,EACjG,wBAAiB,IAAI,CAAC,SAAS,CAAC,MAAC,YAAY,CAAC,OAAe,0CAAE,aAAa,CAAC,CAAE,CAAC,CAAA;oBAEnD,qBAAM,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,EAAA;;oBAAvG,sBAAsB,GAAG,SAA8E;oBAC7G,MAAM,CAAC,2DAA2D,EAAE,QAAQ,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAC1G,wBAAiB,IAAI,CAAC,SAAS,CAAC,MAAC,sBAAsB,CAAC,OAAe,0CAAE,aAAa,CAAC,CAAE,CAAC,CAAA;oBAE5F,8FAA8F;oBAC9F,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAA;oBACxC,WAAsB,EAAN,iBAAM,EAAN,oBAAM,EAAN,IAAM,EAAE;wBAAb,CAAC;wBACV,OAAO,CAAC,GAAG,CAAC,cAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,eAAK,CAAC,CAAC,KAAK,uBAAQ,CAAC,CAAC,MAAM,CAAE,CAAC,CAAA;qBAC3E;oBACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;oBAEf,WAAsB,EAAN,iBAAM,EAAN,oBAAM,EAAN,IAAM,EAAE;wBAAb,CAAC;wBACV,IAAA,gBAAM,EAAC,CAAC,CAAC,IAAI,EAAE,UAAG,CAAC,CAAC,KAAK,qBAAM,CAAC,CAAC,MAAM,CAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAA;qBACpD;;;0BAE0B,EAAV,yBAAU;;;yBAAV,CAAA,wBAAU,CAAA;oBAAhB,EAAE;;;;oBAAwB,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,EAAA;;oBAApC,SAAoC,CAAA;;;;;;oBAAxD,IAAU,CAAA;;;0BACH,EAAP,mBAAO;;;yBAAP,CAAA,qBAAO,CAAA;oBAAb,EAAE;;;;oBAAqB,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,EAAA;;oBAAjC,SAAiC,CAAA;;;;;;oBAAlD,IAAO,CAAA;;;0BACA,EAAP,mBAAO;;;yBAAP,CAAA,qBAAO,CAAA;oBAAb,EAAE;;;;oBAAqB,qBAAM,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,SAAS,CAAC,EAAE,CAAC,EAAA;;oBAAzD,SAAyD,CAAA;;;;;;oBAA1E,IAAO,CAAA;;;;;;;CAE3B,CAAA;AA7NY,QAAA,8BAA8B,kCA6N1C;AAED,6CAA6C;AAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAM,KAAG,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACjC,IAAM,aAAW,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IAEzC,IAAM,QAAQ,GAAG;;;wBACf,qBAAM,IAAA,mBAAW,EAAC,KAAG,EAAE,aAAW,CAAC,EAAA;;oBAAnC,SAAmC,CAAA;oBACnC,qBAAM,IAAA,sCAA8B,EAAC,EAAE,GAAG,OAAA,EAAE,WAAW,eAAA,EAAE,CAAC,EAAA;;oBAA1D,SAA0D,CAAA;;;;SAC3D,CAAA;IAED,QAAQ,EAAE;SACP,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAA;QAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,kDAAkD,EAAE,KAAK,CAAC,CAAA;QACxE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}

package/lib/cjs/tests/api_tests/security/suggested-reply-redaction.test.d.ts

@@ -0,0 +1,26 @@
+import { Session } from "../../../sdk";
+/**
+ * Security regressions for the generateSuggestedReply journey step.
+ *
+ * `suggestedReply` holds a staff-facing draft that may be AI-generated and unreviewed, built from the
+ * patient's own chart context. Four defects were fixed:
+ *
+ *   1. emails / sms_messages / group_mms_conversations `suggestedReply` had no `redactions: ['enduser']`
+ *      (only the sibling `suggestedReplyIsAIGenerated` flag did, so content leaked but the "machine
+ *      generated" marker was stripped).
+ *   2. POST /v1/bulk-actions/read admitted enduser sessions via schema.users.enduserActions.readMany but
+ *      never checked the REQUESTED model's enduserActions — so any model in the enduser query map was
+ *      readable, regardless of whether it grants endusers read.
+ *   3. chat_rooms.mark_read spread the whole room with no applyRedactions, bypassing the redaction that
+ *      *was* declared. The patient portal calls mark_read on every chat view.
+ *   4. generateSuggestedReply accepted an OUTBOUND message as its target (journeyContext carries outbound
+ *      ids for the Message Delivery Failure and Message Link Clicked triggers).
+ *
+ * NO BEDROCK: drafts are written directly with a staff updateOne, and the fix-4 case returns from the
+ * inbound guard before the context load / Bedrock call are reached. Deterministic, consumes no AI credits.
+ */
+export declare const suggested_reply_redaction_tests: ({ sdk }: {
+    sdk: Session;
+    sdkNonAdmin: Session;
+}) => Promise<void>;
+//# sourceMappingURL=suggested-reply-redaction.test.d.ts.map

package/lib/cjs/tests/api_tests/security/suggested-reply-redaction.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"suggested-reply-redaction.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/suggested-reply-redaction.test.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAStC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,+BAA+B;SAA2B,OAAO;iBAAe,OAAO;mBAmLnG,CAAA"}