@tellescope/sdk 1.256.9 → 1.256.11

package/src/tests/api_tests/stedi_approval.test.ts

@@ -0,0 +1,167 @@
+require('source-map-support').install();
+
+import { Session, EnduserSession } from "../../sdk"
+import {
+  async_test,
+  log_header,
+} from "@tellescope/testing"
+import { STEDI_TITLE } from "@tellescope/constants"
+import { authenticate_enduser_via_token, setup_tests } from "../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+// Stedi runs on Tellescope's own platform credentials (zz_secrets) and each eligibility check costs
+// Tellescope $0.10, so an organization must be approved by a Tellescope super admin
+// (Organization.stediAllowed) before any Stedi call is made on its behalf.
+//
+// Every assertion here is a REJECTION assertion, so nothing in this file ever reaches Stedi.
+export const stedi_approval_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("Stedi Pre-Approval (stediAllowed) Tests")
+
+  const orgId = sdk.userInfo.businessId
+  const businessId = orgId
+
+  // A. Super-admin write gate.
+  //
+  // `isa` is only minted by GET /switch-tenant, so this plainly-authenticated admin session never
+  // has it — even when TEST_EMAIL happens to be in the API's SUPER_ADMINS allowlist.
+  log_header("A. stediAllowed is writable by super admins only")
+
+  await async_test(
+    "org admin cannot enable stediAllowed for their own organization",
+    () => sdk.api.organizations.updateOne(orgId, { stediAllowed: true }),
+    { shouldError: true, onError: (e: { message: string }) => /not allowed/i.test(e.message) }
+  )
+
+  // Regression test for the truthiness hole in the shared super-admin relationship constraint:
+  // it used to test `options.updates?.stediAllowed` (falsy for `false`), so an org admin could
+  // clear super-admin-owned flags even though they could never set them.
+  await async_test(
+    "org admin cannot disable stediAllowed either (guard is key-presence, not truthiness)",
+    () => sdk.api.organizations.updateOne(orgId, { stediAllowed: false }),
+    { shouldError: true, onError: (e: { message: string }) => /not allowed/i.test(e.message) }
+  )
+
+  // Same bug, pre-existing field — proves the fix wasn't scoped to the new flag only.
+  await async_test(
+    "org admin cannot disable bedrockAIAllowed",
+    () => sdk.api.organizations.updateOne(orgId, { bedrockAIAllowed: false }),
+    { shouldError: true, onError: (e: { message: string }) => /not allowed/i.test(e.message) }
+  )
+
+  // ...and that it covers the whole gated list, not just the two booleans.
+  await async_test(
+    "org admin cannot disable allowCreateSuborganizations",
+    () => sdk.api.organizations.updateOne(orgId, { allowCreateSuborganizations: false }),
+    { shouldError: true, onError: (e: { message: string }) => /not allowed/i.test(e.message) }
+  )
+
+  // B. An unapproved organization is rejected at every Stedi entry point.
+  log_header("B. Unapproved organizations cannot reach Stedi")
+
+  const organization = await sdk.api.organizations.getOne(orgId)
+  if (organization.stediAllowed) {
+    console.log(
+      "⚠️  SKIPPING section B: the test organization already has stediAllowed=true "
+      + "(hand-toggled in this dev database). Turn it off in the super admin console and re-run — "
+      + "these assertions would otherwise report a false pass."
+    )
+    return
+  }
+
+  const enduser = await sdk.api.endusers.createOne({
+    email: `stedi-approval-${Date.now()}@test.tellescope.com`,
+    fname: 'Stedi',
+    lname: 'Approval',
+  })
+
+  try {
+    await async_test(
+      "staff: Stedi payer search (proxy_read) is rejected",
+      () => sdk.api.integrations.proxy_read({ integration: STEDI_TITLE, type: 'payers', query: 'aetna' }),
+      { shouldError: true, onError: (e: { message: string }) => /not enabled for this organization/i.test(e.message) }
+    )
+
+    await async_test(
+      "staff: Stedi payer importer (load_payers) is rejected",
+      () => sdk.api.integrations.load_payers({ integration: STEDI_TITLE, query: 'aetna' }),
+      { shouldError: true, onError: (e: { message: string }) => /not enabled for this organization/i.test(e.message) }
+    )
+
+    await async_test(
+      "staff: Stedi eligibility check is rejected on approval, before the credit checks",
+      () => sdk.api.integrations.proxy_read({
+        integration: STEDI_TITLE,
+        type: 'stedi-eligibility',
+        id: enduser.id,
+        query: JSON.stringify({ serviceCode: '30', npi: '1234567890' }),
+      }),
+      {
+        shouldError: true,
+        // The absence of /credit/ is the real assertion: it proves the approval gate fires ahead of
+        // the credit gate, so an unapproved org is never told to go buy credits.
+        onError: (e: { message: string }) => (
+          /not enabled for this organization/i.test(e.message) && !/credit/i.test(e.message)
+        ),
+      }
+    )
+
+    // Enduser sessions reach both branches for real: StediEligibilityInput auto-runs the check, and
+    // InsuranceInput search-on-types against the payer branch. Approval/billing state must not leak
+    // to patients.
+    const enduserSdk = new EnduserSession({ host, businessId })
+    await authenticate_enduser_via_token(sdk, enduserSdk, { id: enduser.id })
+
+    // Exact-match on the generic copy: no "Stedi", no "credits", no "contact sales", no mention that
+    // approval is the reason. Note this is deliberately the SAME string the enduser-facing credit
+    // rejection uses, so it cannot prove which gate fired — the staff assertion above is what pins
+    // down the approval-before-credits ordering.
+    const messageIsGenericForEnduser = (e: { message: string }) => (
+      e.message === 'Eligibility check is currently unavailable'
+    )
+
+    await async_test(
+      "enduser: eligibility check rejected with a generic message (no approval/billing leak)",
+      () => enduserSdk.api.integrations.proxy_read({
+        integration: STEDI_TITLE,
+        type: 'stedi-eligibility',
+        query: JSON.stringify({ serviceCode: '30', npi: '1234567890' }),
+      }),
+      { shouldError: true, onError: messageIsGenericForEnduser }
+    )
+
+    await async_test(
+      "enduser: payer search rejected with a generic message (no approval/billing leak)",
+      () => enduserSdk.api.integrations.proxy_read({
+        integration: STEDI_TITLE,
+        type: 'payers',
+        query: 'aetna',
+      }),
+      { shouldError: true, onError: messageIsGenericForEnduser }
+    )
+  } finally {
+    await sdk.api.endusers.deleteOne(enduser.id).catch(console.error)
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await stedi_approval_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ Stedi pre-approval tests completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Stedi pre-approval tests failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/tests.ts

@@ -125,6 +125,7 @@ import { prototype_pollution_tests } from "./api_tests/security/F-0016-prototype
 import { enduser_cross_create_tests } from "./api_tests/security/F-0116-F-0119-enduser-cross-create.test";
 import { globalunique_leak_tests } from "./api_tests/security/F-0145-globalunique-leak.test";
 import { load_inbox_redaction_tests } from "./api_tests/security/F-0151-load-inbox-redaction.test";
+import { suggested_reply_redaction_tests } from "./api_tests/security/suggested-reply-redaction.test";
 import { webhook_timeout_tests } from "./api_tests/security/F-0155-webhook-timeout.test";
 import { enduser_ai_summary_trust_gate_tests } from "./api_tests/security/enduser-ai-summary-trust-gate.test";
 import { allowed_paths_confinement_tests } from "./api_tests/security/F-0166-allowed-paths-wildcard-bypass.test";
@@ -151,6 +152,7 @@ import { conditional_logic_medication_unit_tests } from "./unit_tests/conditiona
 import { phone_validation_unit_tests } from "./unit_tests/phone_validation.test";
 import { elation_user_id_tests } from "./api_tests/elation_user_id.test";
 import { organization_settings_duplicates_tests } from "./api_tests/organization_settings_duplicates.test";
+import { stedi_approval_tests } from "./api_tests/stedi_approval.test";
 import { calendar_events_bulk_update_tests } from "./api_tests/calendar_events_bulk_update.test";
 import { calendar_event_references_update_tests } from "./api_tests/calendar_event_references_update.test";
 import { openloop_webhooks_tests } from "./api_tests/openloop_webhooks.test";
@@ -11242,21 +11244,38 @@ export const cancel_upcoming_appointments_journey_action_test = async () => {
     action: { type: 'cancelFutureAppointments', info: {} },
   })
 
+  // the worker processes automated actions on a poll (every 8s per thread, see worker/app.js pollingDelaySeconds),
+  // so wait for the action itself to reach a terminal status before checking its effects.
+  // shouldError=true so that a timeout returns the last result, letting us report status/errorMessage
+  const processedActions = await pollForResults(
+    () => sdk.api.automated_actions.getSome({ filter: { enduserId: enduser.id } }),
+    as => !!as.find(a => a.status !== 'active'),
+    500,
+    40,
+    true,
+  )
+  const processed = (processedActions as ClientModelForName['automated_actions'][])?.find(a => a.status !== 'active')
+  assert(
+    processed?.status === 'finished',
+    `cancelFutureAppointments action did not finish: status=${processed?.status ?? 'active (timed out)'}, error=${processed?.errorMessage ?? 'none'}`,
+    'cancelFutureAppointments action processed',
+  )
+
   await async_test(
-    `Upcoming event is cancelled, past appointment is not`,
-    () => pollForResults(
-      sdk.api.calendar_events.getSome,
-      es => (
-           !!es.find(e => e.id === e1.id && !e.cancelledAt)  // past event should not be cancelled
-        && !!es.find(e => e.id === e2.id && !!e.cancelledAt) // future event should be cancelled
-        && !!es.find(e => e.id === e3.id && !e.cancelledAt)  // past event not enduser should not be cancelled
-        && !!es.find(e => e.id === e4.id && !e.cancelledAt)  // future event not enduser should not be cancelled
-      ),
-      50,
-      100,
-    ),
+    `Upcoming event is cancelled`,
+    () => pollForResults(() => sdk.api.calendar_events.getOne(e2.id), e => !!e.cancelledAt, 250, 40),
     passOnAnyResult
-  )  
+  )
+
+  // a wrongly-cancelled event is a regression to surface immediately, not a state to wait on
+  for (const { event, label } of [
+    { event: e1, label: 'past event' },
+    { event: e3, label: 'non-enduser event 1' },
+    { event: e4, label: 'non-enduser event 2' },
+  ]) {
+    const fetched = await sdk.api.calendar_events.getOne(event.id)
+    assert(!fetched.cancelledAt, `${label} (${fetched.title}) was cancelled but should not be`, `${label} not cancelled`)
+  }
 
   await Promise.all([
     sdk.api.endusers.deleteOne(enduser.id),
@@ -15368,6 +15387,7 @@ const ip_address_form_tests = async () => {
     await enduser_cross_create_tests({ sdk, sdkNonAdmin })
     await globalunique_leak_tests({ sdk, sdkNonAdmin })
     await load_inbox_redaction_tests({ sdk, sdkNonAdmin })
+    await suggested_reply_redaction_tests({ sdk, sdkNonAdmin })
     await webhook_timeout_tests({ sdk, sdkNonAdmin })
     await public_endpoint_auth_field_lock_tests({ sdk, sdkNonAdmin })
     await formsort_webhook_auth_field_lock_tests({ sdk, sdkNonAdmin })
@@ -15397,6 +15417,7 @@ const ip_address_form_tests = async () => {
     await organization_api_keys_tests({ sdk, sdkNonAdmin })
     await scoped_api_keys_tests({ sdk, sdkNonAdmin })
     await organization_settings_duplicates_tests({ sdk, sdkNonAdmin })
+    await stedi_approval_tests({ sdk, sdkNonAdmin })
     await enduser_session_invalidation_tests({ sdk, sdkNonAdmin })
     await chats_analytics_tests({ sdk, sdkNonAdmin })
     await field_redaction_tests({ sdk, sdkNonAdmin })