@tellescope/sdk 1.256.9 → 1.256.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tellescope/sdk",
-  "version": "1.256.9",
+  "version": "1.256.11",
   "description": "Code for interacting with the Tellescope API",
   "main": "./lib/cjs/sdk.js",
   "module": "./lib/esm/sdk.js",
@@ -32,14 +32,14 @@
   },
   "homepage": "https://github.com/tellescope-os/tellescope#readme",
   "dependencies": {
-    "@tellescope/constants": "1.256.9",
-    "@tellescope/schema": "1.256.9",
-    "@tellescope/testing": "1.256.9",
-    "@tellescope/types-client": "1.256.9",
-    "@tellescope/types-models": "1.256.9",
-    "@tellescope/types-utilities": "1.256.9",
-    "@tellescope/utilities": "1.256.9",
-    "@tellescope/validation": "1.256.9",
+    "@tellescope/constants": "1.256.11",
+    "@tellescope/schema": "1.256.11",
+    "@tellescope/testing": "1.256.11",
+    "@tellescope/types-client": "1.256.11",
+    "@tellescope/types-models": "1.256.11",
+    "@tellescope/types-utilities": "1.256.11",
+    "@tellescope/utilities": "1.256.11",
+    "@tellescope/validation": "1.256.11",
     "axios": "0.30.3",
     "dotenv": "14.3.2",
     "form-data": "4.0.4",
@@ -55,5 +55,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "8952d9b32afa842c1488e4eab27fe1dadc859cdb"
+  "gitHead": "e0b2785223de7100a93651f4cf6f501223103054"
 }

package/src/tests/api_tests/security/readonly-enduser-preview.test.ts

@@ -0,0 +1,301 @@
+require('source-map-support').install();
+
+import axios from "axios"
+
+import { Session, EnduserSession } from "../../../sdk"
+import {
+  assert,
+  log_header,
+} from "@tellescope/testing"
+import { PROVIDER_PERMISSIONS, NO_ACCESS } from "@tellescope/constants"
+import { setup_tests } from "../../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
+const ALL = 'All' as const
+const READ_ONLY = { create: NO_ACCESS, read: ALL, update: NO_ACCESS, delete: NO_ACCESS }
+const FULL_ACCESS = { create: ALL, read: ALL, update: ALL, delete: ALL }
+const ASSIGNED_UPDATE = { create: NO_ACCESS, read: ALL, update: 'Assigned' as const, delete: NO_ACCESS }
+
+const PORTAL_PREVIEW_SCOPE = 'portal-preview'
+
+type ProbeMethod = 'get' | 'post' | 'patch' | 'put' | 'delete'
+
+// A single collected check. Everything is gathered first and asserted at the end, because the
+// testing harness exits the process on the first failed assert — collecting first means a RED run
+// prints the full evidence table before the first vulnerability assert trips the exit.
+type Check = {
+  label: string,
+  pass: boolean,
+  detail: string,
+}
+
+/**
+ * Regression test for F-0138
+ * (security-audit/findings/F-0138-endusers-generate-auth-token-no-admin-gate.md).
+ *
+ * `endusers.generate_auth_token` (the "View portal as patient" preview flow) requires only
+ * `endusers.read`, yet mints a FULLY-PRIVILEGED enduser session. A staff user who cannot update a
+ * patient can therefore act AS that patient: edit the record, submit forms, send chats, book
+ * appointments, even set the portal password.
+ *
+ * The fix mints the preview token with `sessionScopes: ['portal-preview']` whenever the calling
+ * staff user lacks update access to that specific enduser (record-level, honoring `Assigned`
+ * scoping). The scope's allowlist (api/modules/session_scopes.ts) grants exactly the portal's read
+ * surface plus session maintenance; every write path 403s via existing path confinement.
+ *
+ * RED (pre-fix): section A fails — the response carries no sessionScopes and every write in A2
+ * SUCCEEDS. Sections D/E (controls) pass pre-fix. GREEN (post-fix): all sections pass.
+ *
+ * Probes use raw axios rather than the SDK: parseError (sdk/src/session.ts) discards the status
+ * code, and a path-confinement denial (403 "Inaccessible") is byte-identical in message to a
+ * permissions denial. Write/blocked-read probes additionally confirm an UNCONFINED enduser token
+ * gets a non-403 on the same path in the same run, so a 403 can only be confinement, never bad
+ * permissions or a bad body.
+ */
+export const readonly_enduser_preview_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("F-0138: portal-preview scope for read-only staff generate_auth_token")
+
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  const request = async (token: string, method: ProbeMethod, path: string, data?: any) => {
+    const r = await axios.request({
+      method,
+      url: `${host}/v1${path}`,
+      ...method === 'get' ? { params: data } : { data },
+      headers: { Authorization: `Bearer ${token}` },
+      validateStatus: () => true,
+    })
+    return { status: r.status, body: r.data }
+  }
+
+  const isPathDenial = (r: { status: number, body: any }) => (
+    r.status === 403 && r.body?.message === 'Inaccessible'
+  )
+
+  // The confined token must be denied `path` by confinement, while an unconfined baseline is not.
+  const expectDenied = async (
+    label: string, confinedToken: string, baselineToken: string,
+    method: ProbeMethod, path: string, data?: any,
+  ) => {
+    const baseline = await request(baselineToken, method, path, data)
+    const confined = await request(confinedToken, method, path, data)
+    const badProbe = baseline.status === 403
+    record(
+      label,
+      !badProbe && isPathDenial(confined),
+      `${method}:${path} confined=${confined.status} baseline=${baseline.status}` + (badProbe ? ' BAD PROBE: baseline also 403' : ''),
+    )
+  }
+
+  // The path must not be blocked by confinement (neither 403 nor 401).
+  const expectAllowed = async (
+    label: string, token: string, method: ProbeMethod, path: string, data?: any,
+  ) => {
+    const r = await request(token, method, path, data)
+    record(label, r.status !== 403 && r.status !== 401, `${method}:${path} status=${r.status}`)
+  }
+
+  const hasScope = (enduser: any) => !!enduser?.sessionScopes?.includes?.(PORTAL_PREVIEW_SCOPE)
+
+  const readonlyRole = `f0138-readonly-${RAND()}`
+  const fullUpdateRole = `f0138-full-${RAND()}`
+  const assignedUpdateRole = `f0138-assigned-${RAND()}`
+  const roleIds: string[] = []
+  const userIds: string[] = []
+  const enduserIds: string[] = []
+
+  try {
+    /* ================= fixtures ================= */
+
+    for (const [role, endusersPerm] of [
+      [readonlyRole, READ_ONLY],
+      [fullUpdateRole, FULL_ACCESS],
+      [assignedUpdateRole, ASSIGNED_UPDATE],
+    ] as const) {
+      const rbap = await sdk.api.role_based_access_permissions.createOne({
+        role,
+        permissions: { ...PROVIDER_PERMISSIONS, endusers: endusersPerm },
+      } as any)
+      roleIds.push(rbap.id)
+    }
+
+    // Throwaway staff users. verifiedEmail must be set at create (rejected on update).
+    const mkUser = async (role: string) => {
+      const u = await sdk.api.users.createOne({
+        email: `f0138-${role}-${RAND()}@tellescope.example`,
+        fname: 'F0138', lname: 'Staff',
+        verifiedEmail: true,
+        notificationEmailsDisabled: true,
+        roles: [role],
+      } as any)
+      userIds.push(u.id)
+      return u
+    }
+    const readonlyUser = await mkUser(readonlyRole)
+    const fullUpdateUser = await mkUser(fullUpdateRole)
+    const assignedUpdateUser = await mkUser(assignedUpdateRole)
+
+    // Staff sessions from admin-minted tokens (avoids the password / login-rate-limit dance).
+    const staffSession = async (userId: string) => {
+      const { authToken } = await sdk.api.users.generate_auth_token({ id: userId })
+      return new Session({ host, authToken })
+    }
+    const readonlyStaff = await staffSession(readonlyUser.id)
+    const fullUpdateStaff = await staffSession(fullUpdateUser.id)
+    const assignedUpdateStaff = await staffSession(assignedUpdateUser.id)
+
+    // Endusers: unassigned patient, a bystander, and one assigned to the assigned-update user.
+    const enduser = await sdk.api.endusers.createOne({
+      email: `f0138-patient-${RAND()}@tellescope.example`, fname: 'F0138', lname: 'Patient',
+    })
+    enduserIds.push(enduser.id)
+    const assignedEnduser = await sdk.api.endusers.createOne({
+      email: `f0138-assigned-${RAND()}@tellescope.example`, fname: 'F0138', lname: 'Assigned',
+      assignedTo: [assignedUpdateUser.id],
+    } as any)
+    enduserIds.push(assignedEnduser.id)
+
+    // A form_response the patient owns, for the submit-form-response write probe.
+    const form = await sdk.api.forms.createOne({ title: `F-0138 preview form ${RAND()}` })
+    const { response: formResponse } = await sdk.api.form_responses.prepare_form_response({
+      formId: form.id, enduserId: enduser.id,
+    })
+
+    /* ===== A1: read-only staff mints a scoped preview token ===== */
+
+    const previewMint = await readonlyStaff.api.endusers.generate_auth_token({ id: enduser.id })
+    const previewToken = previewMint.authToken
+    record('A1: read-only staff receives an authToken', !!previewToken, `authToken present=${!!previewToken}`)
+    record(
+      'A1: read-only staff mint is scoped to portal-preview',
+      hasScope(previewMint.enduser),
+      `sessionScopes=${JSON.stringify((previewMint.enduser as any)?.sessionScopes)} (F-0138 vuln if absent)`,
+    )
+    record(
+      'A1(E): scoped preview token carries denySocket',
+      (previewMint.enduser as any)?.denySocket === true,
+      `denySocket=${(previewMint.enduser as any)?.denySocket}`,
+    )
+
+    // Unconfined enduser baseline (admin-minted) — proves the scoped token's 403s are confinement.
+    const { authToken: baselineEnduserToken } = await sdk.api.endusers.generate_auth_token({ id: enduser.id })
+
+    /* ===== A2: writes blocked for the scoped session ===== */
+
+    await expectDenied('A2: cannot self-update the patient record', previewToken, baselineEnduserToken,
+      'patch', `/enduser/${enduser.id}`, { updates: { fname: 'Hacked' } })
+    await expectDenied('A2: cannot set the patient portal password', previewToken, baselineEnduserToken,
+      'post', '/set-enduser-password', { id: enduser.id, password: `F0138Pw!${RAND()}` })
+    await expectDenied('A2: cannot send a chat as the patient', previewToken, baselineEnduserToken,
+      'post', '/chat', { message: 'hi from preview' })
+    await expectDenied('A2: cannot submit a form as the patient', previewToken, baselineEnduserToken,
+      'patch', '/submit-form-response', { id: formResponse.id, responses: [] })
+    await expectDenied('A2: cannot book an appointment as the patient', previewToken, baselineEnduserToken,
+      'post', '/book-appointment', {})
+    await expectDenied('A2: cannot start a file upload as the patient', previewToken, baselineEnduserToken,
+      'post', '/prepare-file-upload', { name: 'x.pdf', type: 'application/pdf', enduserId: enduser.id })
+
+    /* ===== B: no laundering via refresh ===== */
+
+    const refreshed = await request(previewToken, 'post', '/refresh-enduser-session', {})
+    const refreshedToken = refreshed.body?.authToken as string | undefined
+    record('B: refresh succeeds', refreshed.status === 200 && !!refreshedToken, `status=${refreshed.status} token=${!!refreshedToken}`)
+    record(
+      'B: refreshed session still carries portal-preview scope',
+      hasScope(refreshed.body?.enduser),
+      `sessionScopes=${JSON.stringify(refreshed.body?.enduser?.sessionScopes)} (laundering if absent)`,
+    )
+    if (refreshedToken) {
+      await expectDenied('B: refreshed token still cannot write', refreshedToken, baselineEnduserToken,
+        'patch', `/enduser/${enduser.id}`, { updates: { fname: 'HackedAfterRefresh' } })
+    }
+    await expectAllowed('B: logout allowed', previewToken, 'post', '/logout-enduser')
+
+    /* ===== C: ungranted mutating "reads" blocked ===== */
+
+    // Re-mint (the previous token was just logged out).
+    const cMint = await readonlyStaff.api.endusers.generate_auth_token({ id: enduser.id })
+    const cToken = cMint.authToken
+    await expectDenied('C: proxy_read blocked', cToken, baselineEnduserToken,
+      'get', '/integrations/proxy-read', { integration: 'Stripe', type: 'subscriptions' })
+    await expectDenied('C: booking_info (mints a token) blocked', cToken, baselineEnduserToken,
+      'get', '/form-fields/booking-info', { bookingPageId: 'x' })
+    await expectDenied('C: form_responses stripe_details blocked', cToken, baselineEnduserToken,
+      'get', '/form-responses/stripe-details', {})
+    await expectDenied('C: products stripe-portal-session blocked', cToken, baselineEnduserToken,
+      'get', '/products/stripe-portal-session', {})
+
+    /* ===== D: granted portal reads still work ===== */
+
+    await expectAllowed('D: portal-customizations', cToken, 'get', '/portal-customizations')
+    await expectAllowed('D: calendar-events', cToken, 'get', '/calendar-events')
+    await expectAllowed('D: my-meetings', cToken, 'get', '/my-meetings')
+    await expectAllowed('D: chat-rooms', cToken, 'get', '/chat-rooms')
+    await expectAllowed('D: care-plans', cToken, 'get', '/care-plans')
+    await expectAllowed('D: form-responses', cToken, 'get', '/form-responses')
+    await expectAllowed('D: self enduser read', cToken, 'get', `/enduser/${enduser.id}`)
+    await expectAllowed('D: file-download-URL', cToken, 'get', '/file-download-URL', { secureName: 'nonexistent' })
+    await expectAllowed('D: enduser-session-info', cToken, 'get', '/enduser-session-info')
+
+    /* ===== E: zero behavior change controls ===== */
+
+    const adminMint = await sdk.api.endusers.generate_auth_token({ id: enduser.id })
+    record('E: admin-minted token is NOT scoped', !hasScope(adminMint.enduser),
+      `sessionScopes=${JSON.stringify((adminMint.enduser as any)?.sessionScopes)}`)
+    await expectAllowed('E: admin-minted token can write', adminMint.authToken, 'patch',
+      `/enduser/${enduser.id}`, { updates: { fname: 'AdminEditOk' } })
+
+    const fullMint = await fullUpdateStaff.api.endusers.generate_auth_token({ id: enduser.id })
+    record('E: update:All staff mints an UNSCOPED token', !hasScope(fullMint.enduser),
+      `sessionScopes=${JSON.stringify((fullMint.enduser as any)?.sessionScopes)}`)
+
+    const assignedMint = await assignedUpdateStaff.api.endusers.generate_auth_token({ id: assignedEnduser.id })
+    record('E: assigned-update staff UNSCOPED for an assigned patient', !hasScope(assignedMint.enduser),
+      `sessionScopes=${JSON.stringify((assignedMint.enduser as any)?.sessionScopes)}`)
+
+    const assignedMintUnassigned = await assignedUpdateStaff.api.endusers.generate_auth_token({ id: enduser.id })
+    record('E: assigned-update staff SCOPED for an unassigned patient', hasScope(assignedMintUnassigned.enduser),
+      `sessionScopes=${JSON.stringify((assignedMintUnassigned.enduser as any)?.sessionScopes)}`)
+
+    /* ===== report: print full table first, then assert (harness exits on first failure) ===== */
+    console.log('\n  F-0138 check summary:')
+    for (const c of checks) {
+      console.log(`    ${c.pass ? 'PASS' : 'FAIL'}  ${c.label}  —  ${c.detail}`)
+    }
+    console.log('')
+
+    for (const c of checks) {
+      assert(c.pass, `${c.label} — ${c.detail}`, c.label)
+    }
+  } finally {
+    for (const id of enduserIds) { try { await sdk.api.endusers.deleteOne(id) } catch {} }
+    for (const id of userIds) { try { await sdk.api.users.deleteOne(id) } catch {} }
+    for (const id of roleIds) { try { await sdk.api.role_based_access_permissions.deleteOne(id) } catch {} }
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await readonly_enduser_preview_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ F-0138 portal-preview scope test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ F-0138 portal-preview scope test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/security/suggested-reply-redaction.test.ts

@@ -0,0 +1,232 @@
+require('source-map-support').install();
+
+import { Session } from "../../../sdk"
+import { schema } from "@tellescope/schema"
+import { async_test, assert, log_header } from "@tellescope/testing"
+import { setup_tests } from "../../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const DRAFT = 'STAFF-ONLY-DRAFT-do-not-show-the-patient'
+
+/**
+ * Security regressions for the generateSuggestedReply journey step.
+ *
+ * `suggestedReply` holds a staff-facing draft that may be AI-generated and unreviewed, built from the
+ * patient's own chart context. Four defects were fixed:
+ *
+ *   1. emails / sms_messages / group_mms_conversations `suggestedReply` had no `redactions: ['enduser']`
+ *      (only the sibling `suggestedReplyIsAIGenerated` flag did, so content leaked but the "machine
+ *      generated" marker was stripped).
+ *   2. POST /v1/bulk-actions/read admitted enduser sessions via schema.users.enduserActions.readMany but
+ *      never checked the REQUESTED model's enduserActions — so any model in the enduser query map was
+ *      readable, regardless of whether it grants endusers read.
+ *   3. chat_rooms.mark_read spread the whole room with no applyRedactions, bypassing the redaction that
+ *      *was* declared. The patient portal calls mark_read on every chat view.
+ *   4. generateSuggestedReply accepted an OUTBOUND message as its target (journeyContext carries outbound
+ *      ids for the Message Delivery Failure and Message Link Clicked triggers).
+ *
+ * NO BEDROCK: drafts are written directly with a staff updateOne, and the fix-4 case returns from the
+ * inbound guard before the context load / Bedrock call are reached. Deterministic, consumes no AI credits.
+ */
+export const suggested_reply_redaction_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("Suggested Reply redaction + inbound guard")
+
+  let enduserId: string | undefined
+  let emailId: string | undefined
+  let inboundSMSId: string | undefined
+  let outboundSMSId: string | undefined
+  let roomId: string | undefined
+  let journeyId: string | undefined
+
+  try {
+    /*************** Fixtures ***************/
+    const enduser = await sdk.api.endusers.createOne({
+      fname: 'SRRedaction', lname: 'Test', phone: '+15555550188',
+      email: `sr-redaction-${Date.now()}@example.com`,
+    })
+    enduserId = enduser.id
+
+    const email = await sdk.api.emails.createOne({
+      enduserId, subject: 'SR seed', textContent: 'seed', logOnly: true, inbound: true,
+    } as any)
+    emailId = email.id
+
+    const inboundSMS = await sdk.api.sms_messages.createOne({
+      enduserId, message: 'inbound seed', logOnly: true, inbound: true,
+    } as any)
+    inboundSMSId = inboundSMS.id
+
+    const outboundSMS = await sdk.api.sms_messages.createOne({
+      enduserId, message: 'outbound seed', logOnly: true, inbound: false,
+    } as any)
+    outboundSMSId = outboundSMS.id
+
+    const room = await sdk.api.chat_rooms.createOne({
+      type: 'internal', userIds: [], enduserIds: [enduserId], title: 'SR redaction room',
+    })
+    roomId = room.id
+
+    for (const [model, id] of [['emails', emailId], ['sms_messages', inboundSMSId], ['chat_rooms', roomId]] as const) {
+      await (sdk.api[model] as any).updateOne(id, { suggestedReply: DRAFT, suggestedReplyIsAIGenerated: true })
+    }
+
+    // POSITIVE CONTROL — a field the server's schema doesn't know is silently dropped on write and
+    // reads as absent, which would make every "absent for enduser" assertion below pass spuriously
+    // against a stale server. Prove the values actually persisted and are visible to staff first.
+    const roomAsAdmin = await sdk.api.chat_rooms.getOne(roomId)
+    const emailAsAdmin = await sdk.api.emails.getOne(emailId)
+    const smsAsAdmin = await sdk.api.sms_messages.getOne(inboundSMSId)
+    assert(
+      roomAsAdmin.suggestedReply === DRAFT && roomAsAdmin.suggestedReplyIsAIGenerated === true
+      && emailAsAdmin.suggestedReply === DRAFT && smsAsAdmin.suggestedReply === DRAFT,
+      'drafts did not persist / are not visible to staff — the API server is likely running a stale '
+      + '@tellescope/schema, so the redaction assertions below would pass spuriously. Restart it.',
+      'CONTROL: drafts persist and staff can read them on all three models',
+    )
+
+    /*************** Enduser session ***************/
+    // generate_auth_token rather than .authenticate, to stay clear of login rate limits
+    const { authToken } = await sdk.api.endusers.generate_auth_token({ id: enduserId })
+    const asEnduser = new Session({ host })
+    asEnduser.setAuthToken(authToken)
+
+    /*************** Fix 3: mark_read must redact ***************/
+    await async_test(
+      'chat_rooms.mark_read does not leak suggestedReply to the patient',
+      () => asEnduser.api.chat_rooms.mark_read({ id: roomId as string }),
+      {
+        onResult: (r: any) => {
+          const updated = r?.updated
+          if (!updated) return false
+          // unreadCount proves the handler still did its job rather than erroring out
+          const stillWorks = updated.infoForUser?.[enduserId as string]?.unreadCount === 0
+          return stillWorks
+            && updated.suggestedReply === undefined
+            && updated.suggestedReplyIsAIGenerated === undefined
+        },
+      },
+    )
+
+    /*************** Fix 1: plain reads on chat_rooms must redact ***************/
+    const roomAsEnduser = await asEnduser.api.chat_rooms.getOne(roomId)
+    assert(
+      roomAsEnduser.suggestedReply === undefined && roomAsEnduser.suggestedReplyIsAIGenerated === undefined,
+      `enduser read chat_rooms.suggestedReply: ${roomAsEnduser.suggestedReply}`,
+      'chat_rooms.getOne redacts suggestedReply for endusers',
+    )
+
+    const roomsAsEnduser = await asEnduser.api.chat_rooms.getSome({ limit: 50 })
+    const foundRoom = roomsAsEnduser.find(r => r.id === roomId)
+    assert(
+      !!foundRoom && foundRoom.suggestedReply === undefined,
+      'enduser readMany leaked chat_rooms.suggestedReply',
+      'chat_rooms.getSome redacts suggestedReply for endusers',
+    )
+
+    /*************** Fix 2: bulk-read must gate per requested model ***************/
+    const bulk = await (asEnduser as any).bulk_load({
+      load: [{ model: 'emails' }, { model: 'sms_messages' }, { model: 'chat_rooms' }],
+    })
+    assert(
+      bulk.results[0] === null && bulk.results[1] === null,
+      `bulk_load exposed models without enduser readMany: emails=${JSON.stringify(bulk.results[0])} sms=${JSON.stringify(bulk.results[1])}`,
+      'bulk_load returns null for models with no enduser readMany (emails, sms_messages)',
+    )
+    assert(
+      !!bulk.results[2]?.records && !bulk.results[2].records.some((r: any) => r.suggestedReply !== undefined),
+      'bulk_load leaked chat_rooms.suggestedReply',
+      'bulk_load still returns chat_rooms for endusers, with suggestedReply redacted',
+    )
+
+    // no staff regression — the gate must only affect enduser sessions
+    const bulkAsStaff = await sdk.bulk_load({ load: [{ model: 'emails' }] })
+    assert(
+      !!bulkAsStaff.results[0]?.records && bulkAsStaff.results[0].records.length > 0,
+      'bulk_load stopped returning emails for staff — the enduser gate leaked into staff sessions',
+      'bulk_load unchanged for staff sessions',
+    )
+
+    /*************** Fix 1 (defense-in-depth): redaction is declared in schema ***************/
+    // Once the bulk-read gate is in place, emails/sms_messages are unreachable by enduser sessions, so
+    // their redaction is no longer observable end-to-end. Assert it structurally so it survives the
+    // gate ever being relaxed.
+    for (const model of ['emails', 'sms_messages', 'group_mms_conversations'] as const) {
+      const field = (schema as any)[model].fields.suggestedReply
+      assert(
+        !!field?.redactions?.includes('enduser'),
+        `${model}.suggestedReply is missing redactions: ['enduser']`,
+        `${model}.suggestedReply declares an enduser redaction`,
+      )
+    }
+
+    /*************** Fix 4: outbound target must be rejected without writing ***************/
+    const journey = await sdk.api.journeys.createOne({ title: `SR Inbound Guard ${Date.now()}` })
+    journeyId = journey.id
+    const step = await sdk.api.automation_steps.createOne({
+      journeyId,
+      events: [{ type: 'onJourneyStart', info: {} }],
+      action: { type: 'generateSuggestedReply', info: {} },
+    })
+
+    const automatedAction = await sdk.api.automated_actions.createOne({
+      enduserId,
+      journeyId,
+      automationStepId: step.id,
+      event: { type: 'onJourneyStart', info: {} },
+      action: { type: 'generateSuggestedReply', info: {} },
+      status: 'active',
+      processAfter: Date.now(),
+      journeyContext: { smsId: outboundSMSId },
+    } as any)
+    // returns before loadAISummaryContextFromDB / Bedrock.sendMessage — no AI credits consumed
+    const processResult = await sdk.api.automated_actions.process({ automatedActionId: automatedAction.id })
+
+    const outboundAfter = await sdk.api.sms_messages.getOne(outboundSMSId)
+    assert(
+      !outboundAfter.suggestedReply,
+      `a draft was written onto an OUTBOUND message: ${outboundAfter.suggestedReply}`,
+      'outbound target is rejected without writing suggestedReply',
+    )
+
+    // success:false is what makes the worker throw — which marks the automated_action 'error', fires
+    // any onError branch, honors continueOnError, and logs the background_error. Returning
+    // success:true here would report a clean run and silently skip all of that. Asserted on the
+    // response rather than on background_errors because this calls the API directly, so the worker
+    // (which writes that row) is not in the loop.
+    assert(
+      (processResult as any).success === false
+      && /outbound message, not an incoming one/i.test((processResult as any).error ?? ''),
+      `expected success:false with an outbound-specific error, got: ${JSON.stringify(processResult)}`,
+      'outbound rejection returns success:false so journey error handling engages',
+    )
+  } finally {
+    if (journeyId) { try { await sdk.api.journeys.deleteOne(journeyId) } catch {} } // cascades to steps
+    if (roomId) { try { await sdk.api.chat_rooms.deleteOne(roomId) } catch {} }
+    if (emailId) { try { await sdk.api.emails.deleteOne(emailId) } catch {} }
+    if (inboundSMSId) { try { await sdk.api.sms_messages.deleteOne(inboundSMSId) } catch {} }
+    if (outboundSMSId) { try { await sdk.api.sms_messages.deleteOne(outboundSMSId) } catch {} }
+    if (enduserId) { try { await sdk.api.endusers.deleteOne(enduserId) } catch {} }
+  }
+}
+
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await suggested_reply_redaction_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ Suggested Reply redaction test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Suggested Reply redaction test suite failed:", error)
+      process.exit(1)
+    })
+}