@tellescope/sdk 1.75.0 → 1.77.0

package/lib/cjs/tests/tests.js

@@ -153,7 +153,7 @@ var voidResult = function () { return true; };
 var passOnVoid = { shouldError: false, onResult: voidResult };
 // const isNull = (d: any) => d === null
 var setup_tests = function () { return __awaiter(void 0, void 0, void 0, function () {
-    var uInfo, originalAuthToken;
+    var badSDK, badEnduserSDK, uInfo, originalAuthToken;
     return __generator(this, function (_a) {
         switch (_a.label) {
             case 0:
@@ -164,89 +164,142 @@ var setup_tests = function () { return __awaiter(void 0, void 0, void 0, functio
                 return [4 /*yield*/, (0, testing_1.async_test)('test_authenticated', sdk.test_authenticated, { expectedResult: 'Authenticated!' })];
             case 2:
                 _a.sent();
-                return [4 /*yield*/, (0, testing_1.async_test)('test_authenticated (with API Key)', (new sdk_1.Session({ host: host, apiKey: '3n5q0SCBT_iUvZz-b9BJtX7o7HQUVJ9v132PgHJNJsg.' /* local test key */ })).test_authenticated, { expectedResult: 'Authenticated!' })];
+                return [4 /*yield*/, (0, testing_1.async_test)('test_authenticated (with API Key)', (new sdk_1.Session({ host: host, apiKey: '3n5q0SCBT_iUvZz-b9BJtX7o7HQUVJ9v132PgHJNJsg.' /* local test key */ })).test_authenticated, { expectedResult: 'Authenticated!' })
+                    // login rate limit tests
+                ];
             case 3:
                 _a.sent();
-                return [4 /*yield*/, sdk.logout()];
+                badSDK = new sdk_1.Session({ host: host });
+                return [4 /*yield*/, badSDK.authenticate('bademail@tellescope.com', 'badpassword').catch(console.error)];
             case 4:
                 _a.sent();
-                return [4 /*yield*/, (0, testing_1.async_test)('test_authenticated - (logout invalidates jwt)', sdk.test_authenticated, { shouldError: true, onError: function (e) { return e === 'Unauthenticated'; } })];
+                return [4 /*yield*/, badSDK.authenticate('bademail@tellescope.com', 'badpassword').catch(console.error)];
             case 5:
                 _a.sent();
-                return [4 /*yield*/, sdk.authenticate(email, password)];
+                return [4 /*yield*/, badSDK.authenticate('bademail@tellescope.com', 'badpassword').catch(console.error)];
             case 6:
                 _a.sent();
-                return [4 /*yield*/, (0, testing_1.async_test)('test_authenticated (re-authenticated)', sdk.test_authenticated, { expectedResult: 'Authenticated!' })];
+                return [4 /*yield*/, badSDK.authenticate('bademail@tellescope.com', 'badpassword').catch(console.error)];
             case 7:
+                _a.sent();
+                return [4 /*yield*/, badSDK.authenticate('bademail@tellescope.com', 'badpassword').catch(console.error)];
+            case 8:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)('login rate limited', function () { return badSDK.authenticate('bademail@tellescope.com', 'badpassword@tellescope.com'); }, { shouldError: true, onError: function (e) { return e.message === 'Too many login attempts'; } })];
+            case 9:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)('login not rate limited for other user', function () { return sdk.authenticate(email, password); }, passOnAnyResult)];
+            case 10:
+                _a.sent();
+                badEnduserSDK = new sdk_1.EnduserSession({ host: host, businessId: businessId });
+                return [4 /*yield*/, badEnduserSDK.authenticate('bademail@tellescope.com', 'badpassword').catch(console.error)];
+            case 11:
+                _a.sent();
+                return [4 /*yield*/, badEnduserSDK.authenticate('bademail@tellescope.com', 'badpassword').catch(console.error)];
+            case 12:
+                _a.sent();
+                return [4 /*yield*/, badEnduserSDK.authenticate('bademail@tellescope.com', 'badpassword').catch(console.error)];
+            case 13:
+                _a.sent();
+                return [4 /*yield*/, badEnduserSDK.authenticate('bademail@tellescope.com', 'badpassword').catch(console.error)];
+            case 14:
+                _a.sent();
+                return [4 /*yield*/, badEnduserSDK.authenticate('bademail@tellescope.com', 'badpassword').catch(console.error)];
+            case 15:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)('login rate limited', function () { return badEnduserSDK.authenticate('bademail@tellescope.com', 'badpassword@tellescope.com'); }, { shouldError: true, onError: function (e) { return e.message === 'Too many login attempts'; } })];
+            case 16:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)('login not rate limited for other enduser', function () { return badEnduserSDK.authenticate('otherbademail@tellescope.com', 'badpassword@tellescope.com'); }, { shouldError: true, onError: function (e) { return e.message !== 'Too many login attempts'; } })
+                    // prevent additional login throttling
+                ];
+            case 17:
+                _a.sent();
+                // prevent additional login throttling
+                return [4 /*yield*/, (0, testing_1.async_test)('reset_db', function () { return sdk.reset_db(); }, passOnVoid)];
+            case 18:
+                // prevent additional login throttling
+                _a.sent();
+                return [4 /*yield*/, sdk.logout()];
+            case 19:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)('test_authenticated - (logout invalidates jwt)', sdk.test_authenticated, { shouldError: true, onError: function (e) { return e === 'Unauthenticated'; } })];
+            case 20:
+                _a.sent();
+                return [4 /*yield*/, sdk.authenticate(email, password)];
+            case 21:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)('test_authenticated (re-authenticated)', sdk.test_authenticated, { expectedResult: 'Authenticated!' })];
+            case 22:
                 _a.sent();
                 uInfo = sdk.userInfo;
                 originalAuthToken = sdk.authToken;
                 return [4 /*yield*/, sdk.refresh_session()];
-            case 8:
+            case 23:
                 _a.sent();
                 (0, testing_1.assert)(uInfo.id === sdk.userInfo.id, 'userInfo mismatch', 'userInfo id preserved after refresh');
                 (0, testing_1.assert)(!!originalAuthToken && !!sdk.authToken && sdk.authToken !== originalAuthToken, 'same authToken after refresh', 'authToken refresh');
                 return [4 /*yield*/, (0, testing_1.async_test)('role change by non-admin prevented (admin)', function () { return sdkNonAdmin.api.users.updateOne(sdkNonAdmin.userInfo.id, { roles: ['Admin'] }, { replaceObjectFields: true }); }, handleAnyError)];
-            case 9:
+            case 24:
                 _a.sent();
                 return [4 /*yield*/, (0, testing_1.async_test)('role change by non-admin prevented (non-admin)', function () { return sdkNonAdmin.api.users.updateOne(sdkNonAdmin.userInfo.id, { roles: ['Not Admin'] }, { replaceObjectFields: true }); }, handleAnyError)
                     // would assign default non-admin role, which could grant additional permissions than currently-defined non-admin role, should block
                 ];
-            case 10:
+            case 25:
                 _a.sent();
                 // would assign default non-admin role, which could grant additional permissions than currently-defined non-admin role, should block
                 return [4 /*yield*/, (0, testing_1.async_test)('role change by non-admin prevented (empty)', function () { return sdkNonAdmin.api.users.updateOne(sdkNonAdmin.userInfo.id, { roles: [] }, { replaceObjectFields: true }); }, handleAnyError)
                     // ensure that going to "Non-Admin" triggers a role change
                 ];
-            case 11:
+            case 26:
                 // would assign default non-admin role, which could grant additional permissions than currently-defined non-admin role, should block
                 _a.sent();
                 // ensure that going to "Non-Admin" triggers a role change
                 return [4 /*yield*/, sdk.api.users.updateOne(sdkNonAdmin.userInfo.id, { roles: ['Test'] }, { replaceObjectFields: true })];
-            case 12:
+            case 27:
                 // ensure that going to "Non-Admin" triggers a role change
                 _a.sent();
                 return [4 /*yield*/, sdkNonAdmin.authenticate(nonAdminEmail, nonAdminPassword)];
-            case 13:
+            case 28:
                 _a.sent();
                 return [4 /*yield*/, (0, testing_1.async_test)('non admin authenticated', sdkNonAdmin.test_authenticated, { expectedResult: 'Authenticated!' })
                     // reset nonAdmin role to a default non-admin
                 ];
-            case 14:
+            case 29:
                 _a.sent();
                 // reset nonAdmin role to a default non-admin
                 return [4 /*yield*/, sdk.api.users.updateOne(sdkNonAdmin.userInfo.id, { roles: ['Non-Admin'] }, { replaceObjectFields: true })];
-            case 15:
+            case 30:
                 // reset nonAdmin role to a default non-admin
                 _a.sent();
                 // should be unauthenticated due to role change
                 return [4 /*yield*/, (0, testing_1.wait)(undefined, 100)];
-            case 16:
+            case 31:
                 // reset nonAdmin role to a default non-admin
                 // should be unauthenticated due to role change
                 _a.sent();
                 return [4 /*yield*/, (0, testing_1.async_test)('role change causes deauthentication', sdkNonAdmin.test_authenticated, handleAnyError)
                     // reauthenticate
                 ];
-            case 17:
+            case 32:
                 _a.sent();
                 // reauthenticate
                 return [4 /*yield*/, (0, testing_1.wait)(undefined, 1000)];
-            case 18:
+            case 33:
                 // reauthenticate
                 _a.sent();
                 return [4 /*yield*/, sdkNonAdmin.authenticate(nonAdminEmail, nonAdminPassword)
                     // may do some stuff in background after returning
                 ];
-            case 19:
+            case 34:
                 _a.sent();
                 // may do some stuff in background after returning
                 return [4 /*yield*/, (0, testing_1.async_test)('reset_db', function () { return sdk.reset_db(); }, passOnVoid)];
-            case 20:
+            case 35:
                 // may do some stuff in background after returning
                 _a.sent();
                 return [4 /*yield*/, (0, testing_1.wait)(undefined, 250)];
-            case 21:
+            case 36:
                 _a.sent();
                 return [2 /*return*/];
         }
@@ -441,64 +494,73 @@ var sub_organization_enduser_tests = function () { return __awaiter(void 0, void
                 return [4 /*yield*/, enduserSDK.register({ email: 'root@tellescope.com', password: password })];
             case 1:
                 _d.sent();
-                return [4 /*yield*/, subEnduserSDK.register({ email: 'sub@tellescope.com', password: password })];
+                return [4 /*yield*/, (0, testing_1.wait)(undefined, 1000)]; // avoid rate limiting error
             case 2:
+                _d.sent(); // avoid rate limiting error
+                return [4 /*yield*/, subEnduserSDK.register({ email: 'sub@tellescope.com', password: password })];
+            case 3:
                 _d.sent();
+                return [4 /*yield*/, (0, testing_1.wait)(undefined, 1000)]; // avoid rate limiting error
+            case 4:
+                _d.sent(); // avoid rate limiting error
                 return [4 /*yield*/, enduserSDK.authenticate('root@tellescope.com', password)];
-            case 3:
+            case 5:
                 _d.sent();
+                return [4 /*yield*/, (0, testing_1.wait)(undefined, 1000)]; // avoid rate limiting error
+            case 6:
+                _d.sent(); // avoid rate limiting error
                 return [4 /*yield*/, subEnduserSDK.authenticate('sub@tellescope.com', password)];
-            case 4:
+            case 7:
                 _d.sent();
                 (0, testing_1.assert)(!((_a = enduserSDK.userInfo.organizationIds) === null || _a === void 0 ? void 0 : _a.length), 'bad root organizationIds', 'root auth org ids');
                 (0, testing_1.assert)(((_b = subEnduserSDK.userInfo.organizationIds) === null || _b === void 0 ? void 0 : _b.length) === 1, 'bad sub organizationIds', 'sub auth org ids');
                 return [4 /*yield*/, enduserSDK.api.tickets.createOne({ title: 'root', enduserId: enduserSDK.userInfo.id })];
-            case 5:
+            case 8:
                 rootTicket = _d.sent();
                 return [4 /*yield*/, (0, testing_1.async_test)("root get root", function () { return sdk.api.endusers.getOne(enduserSDK.userInfo.id); }, passOnAnyResult)];
-            case 6:
+            case 9:
                 _d.sent();
                 return [4 /*yield*/, (0, testing_1.async_test)("sub get root error", function () { return sdkSub.api.endusers.getOne(enduserSDK.userInfo.id); }, handleAnyError)];
-            case 7:
+            case 10:
                 _d.sent();
                 return [4 /*yield*/, (0, testing_1.async_test)("root get sub", function () { return sdk.api.endusers.getOne(subEnduserSDK.userInfo.id); }, passOnAnyResult)];
-            case 8:
+            case 11:
                 _d.sent();
                 return [4 /*yield*/, (0, testing_1.async_test)("sub get sub", function () { return sdkSub.api.endusers.getOne(subEnduserSDK.userInfo.id); }, passOnAnyResult)];
-            case 9:
+            case 12:
                 _d.sent();
                 return [4 /*yield*/, (0, testing_1.async_test)("root get root ticket", function () { return sdk.api.tickets.getOne(rootTicket.id); }, passOnAnyResult)];
-            case 10:
+            case 13:
                 _d.sent();
                 return [4 /*yield*/, (0, testing_1.async_test)("sub get root ticket error", function () { return sdkSub.api.tickets.getOne(rootTicket.id); }, handleAnyError)];
-            case 11:
+            case 14:
                 _d.sent();
                 return [4 /*yield*/, sdk.api.endusers.updateOne(enduserSDK.userInfo.id, { sharedWithOrganizations: [(_c = sdkSub.userInfo.organizationIds) !== null && _c !== void 0 ? _c : []] })];
-            case 12:
+            case 15:
                 _d.sent();
                 return [4 /*yield*/, enduserSDK.refresh_session()]; // ensure updated session includes new sharedWithOrganizations
-            case 13:
+            case 16:
                 _d.sent(); // ensure updated session includes new sharedWithOrganizations
                 return [4 /*yield*/, enduserSDK.api.tickets.createOne({ title: 'root with shared', enduserId: enduserSDK.userInfo.id })];
-            case 14:
+            case 17:
                 rootTicketAfterUpdate = _d.sent();
                 return [4 /*yield*/, (0, testing_1.async_test)("root get root", function () { return sdk.api.endusers.getOne(enduserSDK.userInfo.id); }, passOnAnyResult)];
-            case 15:
+            case 18:
                 _d.sent();
                 return [4 /*yield*/, (0, testing_1.async_test)("sub get root after update", function () { return sdkSub.api.endusers.getOne(enduserSDK.userInfo.id); }, passOnAnyResult)];
-            case 16:
+            case 19:
                 _d.sent();
                 return [4 /*yield*/, (0, testing_1.async_test)("root get sub", function () { return sdk.api.endusers.getOne(subEnduserSDK.userInfo.id); }, passOnAnyResult)];
-            case 17:
+            case 20:
                 _d.sent();
                 return [4 /*yield*/, (0, testing_1.async_test)("sub get sub", function () { return sdkSub.api.endusers.getOne(subEnduserSDK.userInfo.id); }, passOnAnyResult)];
-            case 18:
+            case 21:
                 _d.sent();
                 return [4 /*yield*/, (0, testing_1.async_test)("root get root ticket after update", function () { return sdk.api.tickets.getOne(rootTicketAfterUpdate.id); }, passOnAnyResult)];
-            case 19:
+            case 22:
                 _d.sent();
                 return [4 /*yield*/, (0, testing_1.async_test)("sub get root ticket after update", function () { return sdkSub.api.tickets.getOne(rootTicketAfterUpdate.id); }, passOnAnyResult)];
-            case 20:
+            case 23:
                 _d.sent();
                 return [4 /*yield*/, Promise.all([
                         sdk.api.endusers.deleteOne(enduserSDK.userInfo.id),
@@ -506,7 +568,7 @@ var sub_organization_enduser_tests = function () { return __awaiter(void 0, void
                         sdk.api.tickets.deleteOne(rootTicket.id),
                         sdk.api.tickets.deleteOne(rootTicketAfterUpdate.id),
                     ])];
-            case 21:
+            case 24:
                 _d.sent();
                 return [2 /*return*/];
         }
@@ -4918,7 +4980,7 @@ var filter_by_date_tests = function () { return __awaiter(void 0, void 0, void 0
 }); };
 exports.filter_by_date_tests = filter_by_date_tests;
 var self_serve_appointment_booking_tests = function () { return __awaiter(void 0, void 0, void 0, function () {
-    var e1, e2, event15min, event30min, dayOfWeekStartingSundayIndexedByZero, nySlots, bookedAppointment, conflict, multiSlots, bookedMultiAppointment;
+    var e1, e2, e3, event15min, event30min, event30minGroup, dayOfWeekStartingSundayIndexedByZero, enduserSDK2, enduserSDK3, nySlots, bookedAppointment, conflict, groupEvent, multiSlots, bookedMultiAppointment;
     return __generator(this, function (_a) {
         switch (_a.label) {
             case 0:
@@ -4929,28 +4991,42 @@ var self_serve_appointment_booking_tests = function () { return __awaiter(void 0
                 return [4 /*yield*/, sdk.api.endusers.createOne({ email: 'sebass+ca@tellescope.com', state: 'CA' })];
             case 2:
                 e2 = _a.sent();
-                return [4 /*yield*/, sdk.api.endusers.set_password({ id: e1.id, password: password })];
+                return [4 /*yield*/, sdk.api.endusers.createOne({ email: 'sebass+3@tellescope.com' })];
             case 3:
+                e3 = _a.sent();
+                return [4 /*yield*/, sdk.api.endusers.set_password({ id: e1.id, password: password })];
+            case 4:
                 _a.sent();
                 return [4 /*yield*/, sdk.api.endusers.set_password({ id: e2.id, password: password })];
-            case 4:
+            case 5:
+                _a.sent();
+                return [4 /*yield*/, sdk.api.endusers.set_password({ id: e3.id, password: password })];
+            case 6:
                 _a.sent();
                 return [4 /*yield*/, sdk.api.calendar_event_templates.createOne({
                         title: 'test 2', durationInMinutes: 15,
                         confirmationEmailDisabled: true,
                         confirmationSMSDisabled: true,
                     })];
-            case 5:
+            case 7:
                 event15min = _a.sent();
                 return [4 /*yield*/, sdk.api.calendar_event_templates.createOne({
                         title: 'test 1', durationInMinutes: 30,
                         confirmationEmailDisabled: true,
                         confirmationSMSDisabled: true,
+                    })];
+            case 8:
+                event30min = _a.sent();
+                return [4 /*yield*/, sdk.api.calendar_event_templates.createOne({
+                        title: 'test group', durationInMinutes: 30,
+                        confirmationEmailDisabled: true,
+                        confirmationSMSDisabled: true,
+                        enduserAttendeeLimit: 2,
                     })
                     // ensure it doesn't match current day, to avoid errors on testing
                 ];
-            case 6:
-                event30min = _a.sent();
+            case 9:
+                event30minGroup = _a.sent();
                 dayOfWeekStartingSundayIndexedByZero = (new Date().getDay() + 1) % 7;
                 return [4 /*yield*/, sdk.api.users.updateOne(sdk.userInfo.id, {
                         weeklyAvailabilities: [
@@ -4970,7 +5046,7 @@ var self_serve_appointment_booking_tests = function () { return __awaiter(void 0
                     }, {
                         replaceObjectFields: true,
                     })];
-            case 7:
+            case 10:
                 _a.sent();
                 return [4 /*yield*/, sdkNonAdmin.api.users.updateOne(sdkNonAdmin.userInfo.id, {
                         weeklyAvailabilities: [
@@ -4984,14 +5060,22 @@ var self_serve_appointment_booking_tests = function () { return __awaiter(void 0
                         timezone: 'America/Los_Angeles',
                     }, {
                         replaceObjectFields: true,
-                    })
+                    })];
+            case 11:
+                _a.sent();
+                enduserSDK2 = new sdk_1.EnduserSession({ host: host, businessId: businessId });
+                return [4 /*yield*/, enduserSDK2.authenticate('sebass+ca@tellescope.com', password).catch(console.error)];
+            case 12:
+                _a.sent();
+                enduserSDK3 = new sdk_1.EnduserSession({ host: host, businessId: businessId });
+                return [4 /*yield*/, enduserSDK3.authenticate('sebass+3@tellescope.com', password).catch(console.error)
                     // NY Enduser Tests
                 ];
-            case 8:
+            case 13:
                 _a.sent();
                 // NY Enduser Tests
                 return [4 /*yield*/, enduserSDK.authenticate('sebass+ny@tellescope.com', password).catch(console.error)];
-            case 9:
+            case 14:
                 // NY Enduser Tests
                 _a.sent();
                 return [4 /*yield*/, (0, testing_1.async_test)('30 minute slots for state restriction', function () { return enduserSDK.api.calendar_events.get_appointment_availability({
@@ -5000,7 +5084,7 @@ var self_serve_appointment_booking_tests = function () { return __awaiter(void 0
                         to: new Date(Date.now() + 3 * 24 * 60 * 60 * 1000),
                         restrictedByState: true,
                     }); }, { onResult: function (r) { return r.availabilityBlocks.length === 2; } })];
-            case 10:
+            case 15:
                 _a.sent();
                 return [4 /*yield*/, (0, testing_1.async_test)('30 minute slots for state restriction with 15 min interval', function () { return enduserSDK.api.calendar_events.get_appointment_availability({
                         calendarEventTemplateId: event30min.id,
@@ -5009,7 +5093,7 @@ var self_serve_appointment_booking_tests = function () { return __awaiter(void 0
                         restrictedByState: true,
                         intervalInMinutes: 15,
                     }); }, { onResult: function (r) { return r.availabilityBlocks.length === 3; } })];
-            case 11:
+            case 16:
                 _a.sent();
                 return [4 /*yield*/, (0, testing_1.async_test)('30 minute slots for state restriction with 10 min interval', function () { return enduserSDK.api.calendar_events.get_appointment_availability({
                         calendarEventTemplateId: event30min.id,
@@ -5018,7 +5102,7 @@ var self_serve_appointment_booking_tests = function () { return __awaiter(void 0
                         restrictedByState: true,
                         intervalInMinutes: 10,
                     }); }, { onResult: function (r) { return r.availabilityBlocks.length === 4; } })];
-            case 12:
+            case 17:
                 _a.sent();
                 return [4 /*yield*/, (0, testing_1.async_test)('30 minute slots for no state restrictions', function () { return enduserSDK.api.calendar_events.get_appointment_availability({
                         calendarEventTemplateId: event30min.id,
@@ -5037,7 +5121,7 @@ var self_serve_appointment_booking_tests = function () { return __awaiter(void 0
                             }
                             return true;
                         } })];
-            case 13:
+            case 18:
                 _a.sent();
                 return [4 /*yield*/, enduserSDK.api.calendar_events.get_appointment_availability({
                         calendarEventTemplateId: event30min.id,
@@ -5045,7 +5129,7 @@ var self_serve_appointment_booking_tests = function () { return __awaiter(void 0
                         to: new Date(Date.now() + 3 * 24 * 60 * 60 * 1000),
                         restrictedByState: true,
                     })];
-            case 14:
+            case 19:
                 nySlots = _a.sent();
                 return [4 /*yield*/, enduserSDK.api.calendar_events.book_appointment({
                         calendarEventTemplateId: event30min.id,
@@ -5056,7 +5140,7 @@ var self_serve_appointment_booking_tests = function () { return __awaiter(void 0
                             fields: "Test",
                         }
                     })];
-            case 15:
+            case 20:
                 bookedAppointment = (_a.sent()).createdEvent;
                 (0, testing_1.assert)(bookedAppointment.attendees.length === 2, 'did not get 2 attendees', '2 attendees fo non-multi-event');
                 return [4 /*yield*/, (0, testing_1.async_test)('double-booking prevented', function () { return enduserSDK.api.calendar_events.book_appointment({
@@ -5064,7 +5148,7 @@ var self_serve_appointment_booking_tests = function () { return __awaiter(void 0
                         startTime: new Date(nySlots.availabilityBlocks[0].startTimeInMS),
                         userId: nySlots.availabilityBlocks[0].userId,
                     }); }, handleAnyError)];
-            case 16:
+            case 21:
                 _a.sent();
                 return [4 /*yield*/, (0, testing_1.async_test)('30 minute slots for state restriction with 1 overlapping conflict', function () { return enduserSDK.api.calendar_events.get_appointment_availability({
                         calendarEventTemplateId: event30min.id,
@@ -5076,14 +5160,14 @@ var self_serve_appointment_booking_tests = function () { return __awaiter(void 0
                                 && r.availabilityBlocks[0].startTimeInMS === nySlots.availabilityBlocks[1].startTimeInMS;
                         } // the first slot of nySlots is booked
                     })];
-            case 17:
+            case 22:
                 _a.sent();
                 return [4 /*yield*/, sdk.api.calendar_events.createOne({
                         title: 'conflict',
                         startTimeInMS: nySlots.availabilityBlocks[1].startTimeInMS,
                         durationInMinutes: nySlots.availabilityBlocks[1].durationInMinutes,
                     })];
-            case 18:
+            case 23:
                 conflict = _a.sent();
                 return [4 /*yield*/, (0, testing_1.async_test)('30 minute slots for state restriction with 2 overlapping conflict', function () { return enduserSDK.api.calendar_events.get_appointment_availability({
                         calendarEventTemplateId: event30min.id,
@@ -5091,16 +5175,82 @@ var self_serve_appointment_booking_tests = function () { return __awaiter(void 0
                         to: new Date(Date.now() + 3 * 24 * 60 * 60 * 1000),
                         restrictedByState: true,
                     }); }, { onResult: function (r) { return r.availabilityBlocks.length === 0; } })];
-            case 19:
+            case 24:
                 _a.sent();
                 return [4 /*yield*/, (0, testing_1.async_test)('booking against conflict prevented', function () { return enduserSDK.api.calendar_events.book_appointment({
                         calendarEventTemplateId: event30min.id,
                         startTime: new Date(nySlots.availabilityBlocks[1].startTimeInMS),
                         userId: nySlots.availabilityBlocks[1].userId,
                     }); }, handleAnyError)
+                    // test group bookings
+                ];
+            case 25:
+                _a.sent();
+                // test group bookings
+                return [4 /*yield*/, sdk.api.calendar_events.updateOne(conflict.id, { enduserAttendeeLimit: 2 })];
+            case 26:
+                // test group bookings
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)('[group booking] different event type conflict as group still blocks availability', function () { return enduserSDK.api.calendar_events.get_appointment_availability({
+                        calendarEventTemplateId: event30minGroup.id,
+                        from: new Date(Date.now() - 10000),
+                        to: new Date(Date.now() + 3 * 24 * 60 * 60 * 1000),
+                    }); }, { onResult: function (r) { return r.availabilityBlocks.length === 2; } })];
+            case 27:
+                _a.sent();
+                return [4 /*yield*/, sdk.api.calendar_events.deleteOne(conflict.id)];
+            case 28:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)('[group booking] availability', function () { return enduserSDK.api.calendar_events.get_appointment_availability({
+                        calendarEventTemplateId: event30minGroup.id,
+                        from: new Date(Date.now() - 10000),
+                        to: new Date(Date.now() + 3 * 24 * 60 * 60 * 1000),
+                    }); }, { onResult: function (r) { return r.availabilityBlocks.length === 3; } })];
+            case 29:
+                _a.sent();
+                return [4 /*yield*/, enduserSDK.api.calendar_events.book_appointment({
+                        calendarEventTemplateId: event30minGroup.id,
+                        startTime: new Date(nySlots.availabilityBlocks[1].startTimeInMS),
+                        userId: nySlots.availabilityBlocks[1].userId,
+                    })];
+            case 30:
+                groupEvent = (_a.sent()).createdEvent;
+                return [4 /*yield*/, (0, testing_1.async_test)('[group booking] more booking allowed', function () { return enduserSDK.api.calendar_events.get_appointment_availability({
+                        calendarEventTemplateId: event30minGroup.id,
+                        from: new Date(Date.now() - 10000),
+                        to: new Date(Date.now() + 3 * 24 * 60 * 60 * 1000),
+                    }); }, { onResult: function (r) { return r.availabilityBlocks.length === 3; } })];
+            case 31:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)('[group booking] prevent double-book same-enduser', function () { return enduserSDK.api.calendar_events.book_appointment({
+                        calendarEventTemplateId: event30minGroup.id,
+                        startTime: new Date(nySlots.availabilityBlocks[1].startTimeInMS),
+                        userId: nySlots.availabilityBlocks[1].userId,
+                    }); }, handleAnyError)];
+            case 32:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)('[group booking] allow other enduser to book', function () { return enduserSDK2.api.calendar_events.book_appointment({
+                        calendarEventTemplateId: event30minGroup.id,
+                        startTime: new Date(nySlots.availabilityBlocks[1].startTimeInMS),
+                        userId: nySlots.availabilityBlocks[1].userId,
+                    }); }, passOnAnyResult)];
+            case 33:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)('[group booking] no more booking allowed', function () { return enduserSDK.api.calendar_events.get_appointment_availability({
+                        calendarEventTemplateId: event30minGroup.id,
+                        from: new Date(Date.now() - 10000),
+                        to: new Date(Date.now() + 3 * 24 * 60 * 60 * 1000),
+                    }); }, { onResult: function (r) { return r.availabilityBlocks.length === 2; } })];
+            case 34:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)('[group booking] other enduser cant book over capacity', function () { return enduserSDK3.api.calendar_events.book_appointment({
+                        calendarEventTemplateId: event30minGroup.id,
+                        startTime: new Date(nySlots.availabilityBlocks[1].startTimeInMS),
+                        userId: nySlots.availabilityBlocks[1].userId,
+                    }); }, handleAnyError)
                     // test 'multi' flag for booking multiple providers for a given patient
                 ];
-            case 20:
+            case 35:
                 _a.sent();
                 // test 'multi' flag for booking multiple providers for a given patient
                 return [4 /*yield*/, sdk.api.users.updateOne(sdk.userInfo.id, {
@@ -5115,7 +5265,7 @@ var self_serve_appointment_booking_tests = function () { return __awaiter(void 0
                     }, {
                         replaceObjectFields: true,
                     })];
-            case 21:
+            case 36:
                 // test 'multi' flag for booking multiple providers for a given patient
                 _a.sent();
                 return [4 /*yield*/, sdkNonAdmin.api.users.updateOne(sdkNonAdmin.userInfo.id, {
@@ -5130,7 +5280,7 @@ var self_serve_appointment_booking_tests = function () { return __awaiter(void 0
                     }, {
                         replaceObjectFields: true,
                     })];
-            case 22:
+            case 37:
                 _a.sent();
                 return [4 /*yield*/, enduserSDK.api.calendar_events.get_appointment_availability({
                         calendarEventTemplateId: event30min.id,
@@ -5139,7 +5289,7 @@ var self_serve_appointment_booking_tests = function () { return __awaiter(void 0
                         multi: true,
                         userIds: [sdk.userInfo.id, sdkNonAdmin.userInfo.id]
                     })];
-            case 23:
+            case 38:
                 multiSlots = _a.sent();
                 (0, testing_1.assert)(multiSlots.availabilityBlocks.length === 2, 'expected 2 slots', 'multi slots are intersection of availability');
                 return [4 /*yield*/, enduserSDK.api.calendar_events.book_appointment({
@@ -5148,7 +5298,7 @@ var self_serve_appointment_booking_tests = function () { return __awaiter(void 0
                         userId: sdk.userInfo.id,
                         otherUserIds: [sdkNonAdmin.userInfo.id]
                     })];
-            case 24:
+            case 39:
                 bookedMultiAppointment = (_a.sent()).createdEvent;
                 (0, testing_1.assert)((bookedMultiAppointment.attendees.length === 3
                     && bookedMultiAppointment.attendees.filter(function (a) { return a.type === 'enduser'; }).length === 1), 'did not get valid attendees', 'Multi attendees fo multi-event');
@@ -5157,14 +5307,14 @@ var self_serve_appointment_booking_tests = function () { return __awaiter(void 0
                         startTime: new Date(multiSlots.availabilityBlocks[0].startTimeInMS),
                         userId: sdk.userInfo.id,
                     }); }, handleAnyError)];
-            case 25:
+            case 40:
                 _a.sent();
                 return [4 /*yield*/, (0, testing_1.async_test)('booking against conflict prevented other user', function () { return enduserSDK.api.calendar_events.book_appointment({
                         calendarEventTemplateId: event30min.id,
                         startTime: new Date(multiSlots.availabilityBlocks[0].startTimeInMS),
                         userId: sdkNonAdmin.userInfo.id,
                     }); }, handleAnyError)];
-            case 26:
+            case 41:
                 _a.sent();
                 return [4 /*yield*/, (0, testing_1.async_test)('booking against conflict prevented 2 users', function () { return enduserSDK.api.calendar_events.book_appointment({
                         calendarEventTemplateId: event30min.id,
@@ -5172,18 +5322,20 @@ var self_serve_appointment_booking_tests = function () { return __awaiter(void 0
                         userId: sdk.userInfo.id,
                         otherUserIds: [sdkNonAdmin.userInfo.id],
                     }); }, handleAnyError)];
-            case 27:
+            case 42:
                 _a.sent();
                 return [4 /*yield*/, Promise.all([
                         sdk.api.endusers.deleteOne(e1.id),
                         sdk.api.endusers.deleteOne(e2.id),
+                        sdk.api.endusers.deleteOne(e3.id),
                         sdk.api.calendar_event_templates.deleteOne(event30min.id),
+                        sdk.api.calendar_event_templates.deleteOne(event30minGroup.id),
                         sdk.api.calendar_event_templates.deleteOne(event15min.id),
                         sdk.api.calendar_events.deleteOne(bookedAppointment.id),
-                        sdk.api.calendar_events.deleteOne(conflict.id),
                         sdk.api.calendar_events.deleteOne(bookedMultiAppointment.id),
+                        sdk.api.calendar_events.deleteOne(groupEvent.id),
                     ])];
-            case 28:
+            case 43:
                 _a.sent();
                 return [2 /*return*/];
         }
@@ -6948,6 +7100,7 @@ var validate_schema = function () {
             endpoints.add(path);
         }
     }
+    console.log("Schema validated");
 };
 var test_weighted_round_robin = function () { return __awaiter(void 0, void 0, void 0, function () {
     var testUsers, userIds, testAssignments, run_assignment_simulation;
@@ -7568,7 +7721,7 @@ var ticket_reminder_tests = function () { return __awaiter(void 0, void 0, void
                         return (((_b = (_a = t.reminders) === null || _a === void 0 ? void 0 : _a[0]) === null || _b === void 0 ? void 0 : _b.didRemind) === true
                             && t.nextReminderInMS !== -1
                             && ((_d = (_c = t.reminders) === null || _c === void 0 ? void 0 : _c.filter(function (r) { return r.didRemind; })) === null || _d === void 0 ? void 0 : _d.length) === 1);
-                    }, 25, 200); }, passOnAnyResult)];
+                    }, 10, 500); }, passOnAnyResult)];
             case 13:
                 _a.sent();
                 return [4 /*yield*/, (0, testing_1.async_test)("Delayed reminder not processed yet", function () { return sdk.api.tickets.getOne(tToRemind.id); }, {
@@ -7677,11 +7830,13 @@ var test_send_with_template = function () { return __awaiter(void 0, void 0, voi
     });
 }); };
 var delete_user_tests = function () { return __awaiter(void 0, void 0, void 0, function () {
-    var existing, u, authToken, createdUserSDK;
+    var existing, u, authToken, createdUserSDK, enduser, enduserAuthToken, enduserSDK;
     var _a;
     return __generator(this, function (_b) {
         switch (_b.label) {
-            case 0: return [4 /*yield*/, sdk.api.users.getSome({ filter: { email: 'deleteme@tellescope.com' } })];
+            case 0:
+                (0, testing_1.log_header)("Delete user tests");
+                return [4 /*yield*/, sdk.api.users.getSome({ filter: { email: 'deleteme@tellescope.com' } })];
             case 1:
                 existing = _b.sent();
                 if (!(((_a = existing[0]) === null || _a === void 0 ? void 0 : _a.email) === 'deleteme@tellescope.com')) return [3 /*break*/, 3];
@@ -7707,29 +7862,409 @@ var delete_user_tests = function () { return __awaiter(void 0, void 0, void 0, f
                 _b.sent();
                 return [4 /*yield*/, (0, testing_1.async_test)("De-authenticated after deletion", createdUserSDK.test_authenticated, handleAnyError)];
             case 9:
+                _b.sent();
+                return [4 /*yield*/, sdk.api.endusers.createOne({})];
+            case 10:
+                enduser = _b.sent();
+                return [4 /*yield*/, sdk.api.endusers.generate_auth_token({ id: enduser.id })];
+            case 11:
+                enduserAuthToken = (_b.sent()).authToken;
+                enduserSDK = new sdk_1.EnduserSession({ host: host, businessId: businessId, authToken: enduserAuthToken });
+                return [4 /*yield*/, (0, testing_1.async_test)("Enduser Authenticated", function () { return enduserSDK.api.endusers.getSome(); }, passOnAnyResult)];
+            case 12:
+                _b.sent();
+                return [4 /*yield*/, sdk.api.endusers.deleteOne(enduser.id)];
+            case 13:
+                _b.sent();
+                return [4 /*yield*/, (0, testing_1.wait)(undefined, 250)];
+            case 14:
+                _b.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("Enduser De-authenticated after deletion", function () { return enduserSDK.api.endusers.getSome(); }, handleAnyError)];
+            case 15:
                 _b.sent();
                 return [2 /*return*/];
         }
     });
 }); };
-(function () { return __awaiter(void 0, void 0, void 0, function () {
-    var err_1, n, _a, _b, _c, _i, returnValidation, t, _d, _f, _g, _h, err_2;
-    var _j, _k;
-    return __generator(this, function (_l) {
-        switch (_l.label) {
+var sdkMfaApiKeyUserId = '6525a43e1e75f0350d62afc4';
+var lockout_tests = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var nonAdminId;
+    return __generator(this, function (_a) {
+        switch (_a.label) {
             case 0:
-                (0, testing_1.log_header)("API");
-                return [4 /*yield*/, (0, testing_1.async_test)("email-image tracking endpoint is live", function () { return axios_1.default.get('http://localhost:8080/email-image/'); }, { onResult: function (result) { return result.data === TRACK_OPEN_IMAGE.toString('utf-8'); } })];
+                (0, testing_1.log_header)("Lockout tests");
+                return [4 /*yield*/, (0, testing_1.async_test)("API Key is authenticated", sdkMfaApiKey.test_authenticated, passOnAnyResult)];
             case 1:
-                _l.sent();
-                _l.label = 2;
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("API Key lock to future date", function () { return sdk.api.users.updateOne(sdkMfaApiKeyUserId, { lockedOutUntil: 0 }); }, passOnAnyResult)];
             case 2:
-                _l.trys.push([2, 46, , 47]);
-                (0, exports.form_conditional_logic_tests)();
-                return [4 /*yield*/, test_weighted_round_robin()];
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.wait)(undefined, 250)];
             case 3:
-                _l.sent();
-                return [4 /*yield*/, validate_schema()];
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("API Key is de-authenticated when locked", sdkMfaApiKey.test_authenticated, handleAnyError)];
+            case 4:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("API Key unlock to -1", function () { return sdk.api.users.updateOne(sdkMfaApiKeyUserId, { lockedOutUntil: -1 }); }, passOnAnyResult)];
+            case 5:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("API Key is authenticated", sdkMfaApiKey.test_authenticated, passOnAnyResult)];
+            case 6:
+                _a.sent();
+                nonAdminId = sdkNonAdmin.userInfo.id;
+                return [4 /*yield*/, (0, testing_1.async_test)("users cannot update own lock status", function () { return sdk.api.users.updateOne(sdk.userInfo.id, { lockedOutUntil: -1 }); }, handleAnyError)];
+            case 7:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("non-admin can't lock out others", function () { return sdkNonAdmin.api.users.updateOne(sdk.userInfo.id, { lockedOutUntil: Date.now() }); }, handleAnyError)];
+            case 8:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("non-admin is authenticated", sdkNonAdmin.test_authenticated, passOnAnyResult)];
+            case 9:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("admin unlock to -1", function () { return sdk.api.users.updateOne(nonAdminId, { lockedOutUntil: -1 }); }, passOnAnyResult)];
+            case 10:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("non-admin is authenticated (-1)", sdkNonAdmin.test_authenticated, passOnAnyResult)];
+            case 11:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("admin lock to past date", function () { return sdk.api.users.updateOne(nonAdminId, { lockedOutUntil: Date.now() - 1000 }); }, passOnAnyResult)];
+            case 12:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("non-admin is authenticated (past date)", sdkNonAdmin.test_authenticated, passOnAnyResult)];
+            case 13:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("admin lock to 0 (indefinite)", function () { return sdk.api.users.updateOne(nonAdminId, { lockedOutUntil: 0 }); }, passOnAnyResult)];
+            case 14:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.wait)(undefined, 250)];
+            case 15:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("non-admin is de-authenticated when locked to 0", sdkNonAdmin.test_authenticated, handleAnyError)];
+            case 16:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("non-admin can't authenciate when locked to 0", function () { return sdkNonAdmin.authenticate(nonAdminEmail, nonAdminPassword); }, handleAnyError)];
+            case 17:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("admin unlock to -1", function () { return sdk.api.users.updateOne(nonAdminId, { lockedOutUntil: -1 }); }, passOnAnyResult)];
+            case 18:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("non-admin can re authenciate when locked to 0", function () { return sdkNonAdmin.authenticate(nonAdminEmail, nonAdminPassword); }, passOnAnyResult)];
+            case 19:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("non-admin is authenticated", sdkNonAdmin.test_authenticated, passOnAnyResult)];
+            case 20:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("admin lock to future date", function () { return sdk.api.users.updateOne(nonAdminId, { lockedOutUntil: Date.now() + 10000 }); }, passOnAnyResult)];
+            case 21:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.wait)(undefined, 250)];
+            case 22:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("non-admin is de-authenticated when locked to future date", sdkNonAdmin.test_authenticated, handleAnyError)];
+            case 23:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("non-admin can't authenciate when locked to future date", function () { return sdkNonAdmin.authenticate(nonAdminEmail, nonAdminPassword); }, handleAnyError)];
+            case 24:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("admin unlock to -1", function () { return sdk.api.users.updateOne(nonAdminId, { lockedOutUntil: -1 }); }, passOnAnyResult)];
+            case 25:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("non-admin can re authenciate when locked to future date", function () { return sdkNonAdmin.authenticate(nonAdminEmail, nonAdminPassword); }, passOnAnyResult)];
+            case 26:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("non-admin is authenticated", sdkNonAdmin.test_authenticated, passOnAnyResult)];
+            case 27:
+                _a.sent();
+                return [2 /*return*/];
+        }
+    });
+}); };
+var sync_tests = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var from, e, t, e2;
+    return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0:
+                (0, testing_1.log_header)("Data Sync");
+                from = new Date();
+                return [4 /*yield*/, (0, testing_1.async_test)("No new records, admin", function () { return sdk.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 0;
+                        } })];
+            case 1:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("No new records, non-admin", function () { return sdkNonAdmin.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 0;
+                        } })];
+            case 2:
+                _a.sent();
+                return [4 /*yield*/, sdk.api.endusers.createOne({})];
+            case 3:
+                e = _a.sent();
+                return [4 /*yield*/, (0, testing_1.wait)(undefined, 100)];
+            case 4:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("Enduser create, admin", function () { return sdk.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return (results.length === 1
+                                && results[0].modelName === 'endusers'
+                                && results[0].recordId === e.id
+                                && results[0].data.includes(e.id)
+                                && JSON.parse(results[0].data) // tests no error throwing
+                            );
+                        } })];
+            case 5:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("Enduser create, non-admin", function () { return sdkNonAdmin.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 0;
+                        } })];
+            case 6:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("Enduser create, sub organization", function () { return sdkSub.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 0;
+                        } })];
+            case 7:
+                _a.sent();
+                return [4 /*yield*/, sdk.api.endusers.updateOne(e.id, { fname: "UPDATE_TEST" })];
+            case 8:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.wait)(undefined, 100)];
+            case 9:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("Enduser update, admin", function () { return sdk.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return (results.length === 1
+                                && results[0].modelName === 'endusers'
+                                && results[0].recordId === e.id
+                                && results[0].data.includes("UPDATE_TEST"));
+                        } })];
+            case 10:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("Enduser update, non-admin", function () { return sdkNonAdmin.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 0;
+                        } })];
+            case 11:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("Enduser update, sub organization", function () { return sdkSub.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 0;
+                        } })];
+            case 12:
+                _a.sent();
+                return [4 /*yield*/, sdk.api.tickets.createOne({ title: 'access test' })];
+            case 13:
+                t = _a.sent();
+                return [4 /*yield*/, (0, testing_1.wait)(undefined, 100)];
+            case 14:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("Non-admin can't access ticket", function () { return sdkNonAdmin.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 0;
+                        } })
+                    // creates a user notification which increments count/index
+                ];
+            case 15:
+                _a.sent();
+                // creates a user notification which increments count/index
+                sdk.api.tickets.updateOne(t.id, { owner: sdkNonAdmin.userInfo.id });
+                return [4 /*yield*/, (0, testing_1.wait)(undefined, 100)];
+            case 16:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("Non-admin can access tickets on assignment", function () { return sdkNonAdmin.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 2;
+                        } })];
+            case 17:
+                _a.sent();
+                sdk.api.tickets.updateOne(t.id, { owner: '' });
+                return [4 /*yield*/, (0, testing_1.wait)(undefined, 100)];
+            case 18:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("Non-admin can't access tickets on unassignment", function () { return sdkNonAdmin.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 1;
+                        } })];
+            case 19:
+                _a.sent();
+                return [4 /*yield*/, sdk.api.endusers.updateOne(e.id, { assignedTo: [sdkNonAdmin.userInfo.id] }, { replaceObjectFields: true })];
+            case 20:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.wait)(undefined, 100)];
+            case 21:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("Enduser update non-admin assignment, can access", function () { return sdkNonAdmin.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 2;
+                        } })];
+            case 22:
+                _a.sent();
+                sdk.api.tickets.updateOne(t.id, { owner: '', enduserId: e.id });
+                return [4 /*yield*/, (0, testing_1.wait)(undefined, 100)];
+            case 23:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("Non-admin can access ticket (and enduser) after enduser assignment", function () { return sdkNonAdmin.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 3;
+                        } })];
+            case 24:
+                _a.sent();
+                return [4 /*yield*/, sdk.api.endusers.updateOne(e.id, { assignedTo: [] }, { replaceObjectFields: true })];
+            case 25:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.wait)(undefined, 100)];
+            case 26:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("Enduser update non-admin assignment, revoked access to enduser and ticket", function () { return sdkNonAdmin.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 1;
+                        } })
+                    // enduser, ticket, and ticket assignment user_notification created
+                ];
+            case 27:
+                _a.sent();
+                // enduser, ticket, and ticket assignment user_notification created
+                return [4 /*yield*/, sdk.api.endusers.deleteOne(e.id)];
+            case 28:
+                // enduser, ticket, and ticket assignment user_notification created
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.wait)(undefined, 100)];
+            case 29:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("Enduser delete, admin", function () { return sdk.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return (results.length === 3
+                                && results[0].modelName === 'endusers'
+                                && results[0].recordId === e.id
+                                && results[0].data === 'deleted');
+                        } })];
+            case 30:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("Enduser delete, non-admin", function () { return sdkNonAdmin.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 1;
+                        } })];
+            case 31:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("Enduser delete, sub organization", function () { return sdkSub.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 0;
+                        } })
+                    // bulk create test coverage
+                ];
+            case 32:
+                _a.sent();
+                return [4 /*yield*/, sdk.api.endusers.createSome([{}])];
+            case 33:
+                e2 = (_a.sent()).created[0];
+                return [4 /*yield*/, (0, testing_1.wait)(undefined, 100)];
+            case 34:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("Bulk Enduser create, admin", function () { return sdk.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return (results.length === 4
+                                && results[0].modelName === 'endusers'
+                                && results[0].recordId === e2.id
+                                && results[0].data.includes(e2.id)
+                                && JSON.parse(results[0].data) // tests no error throwing
+                            );
+                        } })];
+            case 35:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("Bulk Enduser create, non-admin", function () { return sdkNonAdmin.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 1;
+                        } })];
+            case 36:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("Bulk Enduser create, sub organization", function () { return sdkSub.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 0;
+                        } })];
+            case 37:
+                _a.sent();
+                return [4 /*yield*/, sdk.api.endusers.deleteOne(e2.id)];
+            case 38:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.wait)(undefined, 100)];
+            case 39:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("Bulk Enduser delete, admin", function () { return sdk.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return (results.length === 4
+                                && results[0].modelName === 'endusers'
+                                && results[0].recordId === e2.id
+                                && results[0].data === 'deleted');
+                        } })];
+            case 40:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("Bulk Enduser delete, non-admin", function () { return sdkNonAdmin.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 1;
+                        } })];
+            case 41:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("Bulk Enduser delete, sub organization", function () { return sdkSub.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 0;
+                        } })];
+            case 42:
+                _a.sent();
+                return [2 /*return*/];
+        }
+    });
+}); };
+// to cover potential vulernabilities with enduser public register endpoint
+var register_as_enduser_tests = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var enduser;
+    return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0:
+                (0, testing_1.log_header)("Register as Enduser");
+                return [4 /*yield*/, (0, testing_1.async_test)("Enduser register", function () { return enduserSDK.register({ email: 'test@tellescope.com', password: 'testpassWord12345!' }); }, passOnAnyResult)];
+            case 1:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("Enduser register (rate limited)", function () { return enduserSDK.register({ email: 'test@tellescope.com', password: 'testpassWord12345!' }); }, { shouldError: true, onError: function (e) { return e.message === "Too many requests"; } })];
+            case 2:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.wait)(undefined, 1000)];
+            case 3:
+                _a.sent();
+                return [4 /*yield*/, (0, testing_1.async_test)("Enduser duplicate register (same response, no ability to enumerate contacts)", function () { return enduserSDK.register({ email: 'test@tellescope.com', password: 'testpassWord12345!' }); }, passOnAnyResult)];
+            case 4:
+                _a.sent();
+                return [4 /*yield*/, sdk.api.endusers.getOne({ email: 'test@tellescope.com' })];
+            case 5:
+                enduser = _a.sent();
+                if (!enduser) return [3 /*break*/, 7];
+                return [4 /*yield*/, sdk.api.endusers.deleteOne(enduser.id)];
+            case 6:
+                _a.sent();
+                _a.label = 7;
+            case 7: return [2 /*return*/];
+        }
+    });
+}); };
+(function () { return __awaiter(void 0, void 0, void 0, function () {
+    var err_1, n, _a, _b, _c, _i, returnValidation, t, _d, _f, _g, _h, err_2;
+    var _j, _k;
+    return __generator(this, function (_l) {
+        switch (_l.label) {
+            case 0:
+                (0, testing_1.log_header)("API");
+                return [4 /*yield*/, (0, testing_1.async_test)("email-image tracking endpoint is live", function () { return axios_1.default.get('http://localhost:8080/email-image/'); }, { onResult: function (result) { return result.data === TRACK_OPEN_IMAGE.toString('utf-8'); } })];
+            case 1:
+                _l.sent();
+                _l.label = 2;
+            case 2:
+                _l.trys.push([2, 49, , 50]);
+                (0, exports.form_conditional_logic_tests)();
+                return [4 /*yield*/, test_weighted_round_robin()];
+            case 3:
+                _l.sent();
+                return [4 /*yield*/, validate_schema()];
             case 4:
                 _l.sent();
                 return [4 /*yield*/, Promise.all([
@@ -7738,11 +8273,10 @@ var delete_user_tests = function () { return __awaiter(void 0, void 0, void 0, f
                         sdkOtherSub.authenticate(otherSubUserEmail, password),
                         sdkSubSub.authenticate(subSubUserEmail, password),
                         sdkNonAdmin.authenticate(nonAdminEmail, nonAdminPassword),
-                    ])
-                    // console.log(JSON.stringify(await sdk.bulk_load({ load: [{ model: 'users' }]}), null, 2))
-                ];
+                    ])];
             case 5:
                 _l.sent();
+                console.log("Authentication done");
                 // console.log(JSON.stringify(await sdk.bulk_load({ load: [{ model: 'users' }]}), null, 2))
                 return [4 /*yield*/, (0, testing_1.async_test)("count exists", 
                     // @ts-ignore
@@ -7762,117 +8296,126 @@ var delete_user_tests = function () { return __awaiter(void 0, void 0, void 0, f
                 return [4 /*yield*/, multi_tenant_tests()]; // should come right after setup tests
             case 10:
                 _l.sent(); // should come right after setup tests
-                return [4 /*yield*/, delete_user_tests()
-                    // await test_send_with_template()
-                ];
+                return [4 /*yield*/, register_as_enduser_tests()];
             case 11:
                 _l.sent();
-                // await test_send_with_template()
-                return [4 /*yield*/, (0, exports.self_serve_appointment_booking_tests)()];
+                return [4 /*yield*/, sync_tests()];
             case 12:
-                // await test_send_with_template()
                 _l.sent();
-                return [4 /*yield*/, bulk_read_tests()];
+                return [4 /*yield*/, lockout_tests()];
             case 13:
                 _l.sent();
-                return [4 /*yield*/, (0, exports.ticket_reminder_tests)()];
+                return [4 /*yield*/, (0, exports.self_serve_appointment_booking_tests)()];
             case 14:
                 _l.sent();
-                return [4 /*yield*/, enduser_access_tags_tests()];
+                return [4 /*yield*/, delete_user_tests()
+                    // await test_send_with_template()
+                ];
             case 15:
                 _l.sent();
-                return [4 /*yield*/, marketing_email_unsubscribe_tests()];
+                // await test_send_with_template()
+                return [4 /*yield*/, bulk_read_tests()];
             case 16:
+                // await test_send_with_template()
                 _l.sent();
-                return [4 /*yield*/, unique_strings_tests()];
+                return [4 /*yield*/, (0, exports.ticket_reminder_tests)()];
             case 17:
                 _l.sent();
-                return [4 /*yield*/, (0, exports.alternate_phones_tests)()];
+                return [4 /*yield*/, enduser_access_tags_tests()];
             case 18:
                 _l.sent();
-                return [4 /*yield*/, (0, exports.ticket_queue_tests)()];
+                return [4 /*yield*/, marketing_email_unsubscribe_tests()];
             case 19:
                 _l.sent();
-                return [4 /*yield*/, (0, exports.no_chained_triggers_tests)()];
+                return [4 /*yield*/, unique_strings_tests()];
             case 20:
                 _l.sent();
-                return [4 /*yield*/, field_equals_trigger_tests()];
+                return [4 /*yield*/, (0, exports.alternate_phones_tests)()];
             case 21:
                 _l.sent();
-                return [4 /*yield*/, test_ticket_automation_assignment_and_optimization()];
+                return [4 /*yield*/, (0, exports.ticket_queue_tests)()];
             case 22:
                 _l.sent();
-                return [4 /*yield*/, role_based_access_tests()];
+                return [4 /*yield*/, (0, exports.no_chained_triggers_tests)()];
             case 23:
                 _l.sent();
-                return [4 /*yield*/, automation_trigger_tests()];
+                return [4 /*yield*/, field_equals_trigger_tests()];
             case 24:
                 _l.sent();
-                return [4 /*yield*/, enduser_session_tests()];
+                return [4 /*yield*/, test_ticket_automation_assignment_and_optimization()];
             case 25:
                 _l.sent();
-                return [4 /*yield*/, nextReminderInMS_tests()];
+                return [4 /*yield*/, role_based_access_tests()];
             case 26:
                 _l.sent();
-                return [4 /*yield*/, search_tests()];
+                return [4 /*yield*/, automation_trigger_tests()];
             case 27:
                 _l.sent();
-                return [4 /*yield*/, wait_for_trigger_tests()];
+                return [4 /*yield*/, enduser_session_tests()];
             case 28:
                 _l.sent();
-                return [4 /*yield*/, pdf_generation()];
+                return [4 /*yield*/, nextReminderInMS_tests()];
             case 29:
                 _l.sent();
-                return [4 /*yield*/, remove_from_journey_on_incoming_comms_tests()];
+                return [4 /*yield*/, search_tests()];
             case 30:
                 _l.sent();
-                return [4 /*yield*/, rate_limit_tests()];
+                return [4 /*yield*/, wait_for_trigger_tests()];
             case 31:
                 _l.sent();
-                return [4 /*yield*/, merge_enduser_tests()];
+                return [4 /*yield*/, pdf_generation()];
             case 32:
                 _l.sent();
-                return [4 /*yield*/, auto_reply_tests()];
+                return [4 /*yield*/, remove_from_journey_on_incoming_comms_tests()];
             case 33:
                 _l.sent();
-                return [4 /*yield*/, sub_organization_enduser_tests()];
+                return [4 /*yield*/, rate_limit_tests()];
             case 34:
                 _l.sent();
-                return [4 /*yield*/, sub_organization_tests()];
+                return [4 /*yield*/, merge_enduser_tests()];
             case 35:
                 _l.sent();
-                return [4 /*yield*/, (0, exports.filter_by_date_tests)()];
+                return [4 /*yield*/, auto_reply_tests()];
             case 36:
                 _l.sent();
-                return [4 /*yield*/, generate_user_auth_tests()];
+                return [4 /*yield*/, sub_organization_enduser_tests()];
             case 37:
                 _l.sent();
-                return [4 /*yield*/, generateEnduserAuthTests()];
+                return [4 /*yield*/, sub_organization_tests()];
             case 38:
                 _l.sent();
-                return [4 /*yield*/, public_form_tests()];
+                return [4 /*yield*/, (0, exports.filter_by_date_tests)()];
             case 39:
                 _l.sent();
-                return [4 /*yield*/, badInputTests()];
+                return [4 /*yield*/, generate_user_auth_tests()];
             case 40:
                 _l.sent();
-                return [4 /*yield*/, filterTests()];
+                return [4 /*yield*/, generateEnduserAuthTests()];
             case 41:
                 _l.sent();
-                return [4 /*yield*/, updatesTests()];
+                return [4 /*yield*/, public_form_tests()];
             case 42:
                 _l.sent();
-                return [4 /*yield*/, threadKeyTests()];
+                return [4 /*yield*/, badInputTests()];
             case 43:
                 _l.sent();
-                return [4 /*yield*/, enduserAccessTests()];
+                return [4 /*yield*/, filterTests()];
             case 44:
                 _l.sent();
-                return [4 /*yield*/, enduser_redaction_tests()];
+                return [4 /*yield*/, updatesTests()];
             case 45:
                 _l.sent();
-                return [3 /*break*/, 47];
+                return [4 /*yield*/, threadKeyTests()];
             case 46:
+                _l.sent();
+                return [4 /*yield*/, enduserAccessTests()];
+            case 47:
+                _l.sent();
+                return [4 /*yield*/, enduser_redaction_tests()];
+            case 48:
+                _l.sent();
+                return [3 /*break*/, 50];
+            case 49:
                 err_1 = _l.sent();
                 console.error("Failed during custom test");
                 if (err_1.message && err_1.info) {
@@ -7882,18 +8425,18 @@ var delete_user_tests = function () { return __awaiter(void 0, void 0, void 0, f
                     console.error(err_1);
                 }
                 process.exit(1);
-                return [3 /*break*/, 47];
-            case 47:
+                return [3 /*break*/, 50];
+            case 50:
                 _a = schema_1.schema;
                 _b = [];
                 for (_c in _a)
                     _b.push(_c);
                 _i = 0;
-                _l.label = 48;
-            case 48:
-                if (!(_i < _b.length)) return [3 /*break*/, 51];
+                _l.label = 51;
+            case 51:
+                if (!(_i < _b.length)) return [3 /*break*/, 54];
                 _c = _b[_i];
-                if (!(_c in _a)) return [3 /*break*/, 50];
+                if (!(_c in _a)) return [3 /*break*/, 53];
                 n = _c;
                 returnValidation = (_k = (_j = schema_1.schema[n].customActions) === null || _j === void 0 ? void 0 : _j.create) === null || _k === void 0 ? void 0 : _k.returns;
                 return [4 /*yield*/, run_generated_tests({
@@ -7904,41 +8447,41 @@ var delete_user_tests = function () { return __awaiter(void 0, void 0, void 0, f
                             create: returnValidation // ModelFields<ClientModel>,
                         }
                     })];
-            case 49:
+            case 52:
                 _l.sent();
-                _l.label = 50;
-            case 50:
+                _l.label = 53;
+            case 53:
                 _i++;
-                return [3 /*break*/, 48];
-            case 51:
+                return [3 /*break*/, 51];
+            case 54:
                 _d = tests;
                 _f = [];
                 for (_g in _d)
                     _f.push(_g);
                 _h = 0;
-                _l.label = 52;
-            case 52:
-                if (!(_h < _f.length)) return [3 /*break*/, 57];
+                _l.label = 55;
+            case 55:
+                if (!(_h < _f.length)) return [3 /*break*/, 60];
                 _g = _f[_h];
-                if (!(_g in _d)) return [3 /*break*/, 56];
+                if (!(_g in _d)) return [3 /*break*/, 59];
                 t = _g;
-                _l.label = 53;
-            case 53:
-                _l.trys.push([53, 55, , 56]);
+                _l.label = 56;
+            case 56:
+                _l.trys.push([56, 58, , 59]);
                 return [4 /*yield*/, tests[t]()];
-            case 54:
+            case 57:
                 _l.sent();
-                return [3 /*break*/, 56];
-            case 55:
+                return [3 /*break*/, 59];
+            case 58:
                 err_2 = _l.sent();
                 console.error("Error running test:");
                 console.error(err_2);
                 process.exit(1);
-                return [3 /*break*/, 56];
-            case 56:
+                return [3 /*break*/, 59];
+            case 59:
                 _h++;
-                return [3 /*break*/, 52];
-            case 57:
+                return [3 /*break*/, 55];
+            case 60:
                 process.exit();
                 return [2 /*return*/];
         }