@tellescope/sdk 1.76.0 → 1.78.0

package/lib/esm/tests/tests.js

@@ -124,7 +124,7 @@ var voidResult = function () { return true; };
 var passOnVoid = { shouldError: false, onResult: voidResult };
 // const isNull = (d: any) => d === null
 var setup_tests = function () { return __awaiter(void 0, void 0, void 0, function () {
-    var uInfo, originalAuthToken;
+    var badSDK, badEnduserSDK, uInfo, originalAuthToken;
     return __generator(this, function (_a) {
         switch (_a.label) {
             case 0:
@@ -135,89 +135,142 @@ var setup_tests = function () { return __awaiter(void 0, void 0, void 0, functio
                 return [4 /*yield*/, async_test('test_authenticated', sdk.test_authenticated, { expectedResult: 'Authenticated!' })];
             case 2:
                 _a.sent();
-                return [4 /*yield*/, async_test('test_authenticated (with API Key)', (new Session({ host: host, apiKey: '3n5q0SCBT_iUvZz-b9BJtX7o7HQUVJ9v132PgHJNJsg.' /* local test key */ })).test_authenticated, { expectedResult: 'Authenticated!' })];
+                return [4 /*yield*/, async_test('test_authenticated (with API Key)', (new Session({ host: host, apiKey: '3n5q0SCBT_iUvZz-b9BJtX7o7HQUVJ9v132PgHJNJsg.' /* local test key */ })).test_authenticated, { expectedResult: 'Authenticated!' })
+                    // login rate limit tests
+                ];
             case 3:
                 _a.sent();
-                return [4 /*yield*/, sdk.logout()];
+                badSDK = new Session({ host: host });
+                return [4 /*yield*/, badSDK.authenticate('bademail@tellescope.com', 'badpassword').catch(console.error)];
             case 4:
                 _a.sent();
-                return [4 /*yield*/, async_test('test_authenticated - (logout invalidates jwt)', sdk.test_authenticated, { shouldError: true, onError: function (e) { return e === 'Unauthenticated'; } })];
+                return [4 /*yield*/, badSDK.authenticate('bademail@tellescope.com', 'badpassword').catch(console.error)];
             case 5:
                 _a.sent();
-                return [4 /*yield*/, sdk.authenticate(email, password)];
+                return [4 /*yield*/, badSDK.authenticate('bademail@tellescope.com', 'badpassword').catch(console.error)];
             case 6:
                 _a.sent();
-                return [4 /*yield*/, async_test('test_authenticated (re-authenticated)', sdk.test_authenticated, { expectedResult: 'Authenticated!' })];
+                return [4 /*yield*/, badSDK.authenticate('bademail@tellescope.com', 'badpassword').catch(console.error)];
             case 7:
+                _a.sent();
+                return [4 /*yield*/, badSDK.authenticate('bademail@tellescope.com', 'badpassword').catch(console.error)];
+            case 8:
+                _a.sent();
+                return [4 /*yield*/, async_test('login rate limited', function () { return badSDK.authenticate('bademail@tellescope.com', 'badpassword@tellescope.com'); }, { shouldError: true, onError: function (e) { return e.message === 'Too many login attempts'; } })];
+            case 9:
+                _a.sent();
+                return [4 /*yield*/, async_test('login not rate limited for other user', function () { return sdk.authenticate(email, password); }, passOnAnyResult)];
+            case 10:
+                _a.sent();
+                badEnduserSDK = new EnduserSession({ host: host, businessId: businessId });
+                return [4 /*yield*/, badEnduserSDK.authenticate('bademail@tellescope.com', 'badpassword').catch(console.error)];
+            case 11:
+                _a.sent();
+                return [4 /*yield*/, badEnduserSDK.authenticate('bademail@tellescope.com', 'badpassword').catch(console.error)];
+            case 12:
+                _a.sent();
+                return [4 /*yield*/, badEnduserSDK.authenticate('bademail@tellescope.com', 'badpassword').catch(console.error)];
+            case 13:
+                _a.sent();
+                return [4 /*yield*/, badEnduserSDK.authenticate('bademail@tellescope.com', 'badpassword').catch(console.error)];
+            case 14:
+                _a.sent();
+                return [4 /*yield*/, badEnduserSDK.authenticate('bademail@tellescope.com', 'badpassword').catch(console.error)];
+            case 15:
+                _a.sent();
+                return [4 /*yield*/, async_test('login rate limited', function () { return badEnduserSDK.authenticate('bademail@tellescope.com', 'badpassword@tellescope.com'); }, { shouldError: true, onError: function (e) { return e.message === 'Too many login attempts'; } })];
+            case 16:
+                _a.sent();
+                return [4 /*yield*/, async_test('login not rate limited for other enduser', function () { return badEnduserSDK.authenticate('otherbademail@tellescope.com', 'badpassword@tellescope.com'); }, { shouldError: true, onError: function (e) { return e.message !== 'Too many login attempts'; } })
+                    // prevent additional login throttling
+                ];
+            case 17:
+                _a.sent();
+                // prevent additional login throttling
+                return [4 /*yield*/, async_test('reset_db', function () { return sdk.reset_db(); }, passOnVoid)];
+            case 18:
+                // prevent additional login throttling
+                _a.sent();
+                return [4 /*yield*/, sdk.logout()];
+            case 19:
+                _a.sent();
+                return [4 /*yield*/, async_test('test_authenticated - (logout invalidates jwt)', sdk.test_authenticated, { shouldError: true, onError: function (e) { return e === 'Unauthenticated'; } })];
+            case 20:
+                _a.sent();
+                return [4 /*yield*/, sdk.authenticate(email, password)];
+            case 21:
+                _a.sent();
+                return [4 /*yield*/, async_test('test_authenticated (re-authenticated)', sdk.test_authenticated, { expectedResult: 'Authenticated!' })];
+            case 22:
                 _a.sent();
                 uInfo = sdk.userInfo;
                 originalAuthToken = sdk.authToken;
                 return [4 /*yield*/, sdk.refresh_session()];
-            case 8:
+            case 23:
                 _a.sent();
                 assert(uInfo.id === sdk.userInfo.id, 'userInfo mismatch', 'userInfo id preserved after refresh');
                 assert(!!originalAuthToken && !!sdk.authToken && sdk.authToken !== originalAuthToken, 'same authToken after refresh', 'authToken refresh');
                 return [4 /*yield*/, async_test('role change by non-admin prevented (admin)', function () { return sdkNonAdmin.api.users.updateOne(sdkNonAdmin.userInfo.id, { roles: ['Admin'] }, { replaceObjectFields: true }); }, handleAnyError)];
-            case 9:
+            case 24:
                 _a.sent();
                 return [4 /*yield*/, async_test('role change by non-admin prevented (non-admin)', function () { return sdkNonAdmin.api.users.updateOne(sdkNonAdmin.userInfo.id, { roles: ['Not Admin'] }, { replaceObjectFields: true }); }, handleAnyError)
                     // would assign default non-admin role, which could grant additional permissions than currently-defined non-admin role, should block
                 ];
-            case 10:
+            case 25:
                 _a.sent();
                 // would assign default non-admin role, which could grant additional permissions than currently-defined non-admin role, should block
                 return [4 /*yield*/, async_test('role change by non-admin prevented (empty)', function () { return sdkNonAdmin.api.users.updateOne(sdkNonAdmin.userInfo.id, { roles: [] }, { replaceObjectFields: true }); }, handleAnyError)
                     // ensure that going to "Non-Admin" triggers a role change
                 ];
-            case 11:
+            case 26:
                 // would assign default non-admin role, which could grant additional permissions than currently-defined non-admin role, should block
                 _a.sent();
                 // ensure that going to "Non-Admin" triggers a role change
                 return [4 /*yield*/, sdk.api.users.updateOne(sdkNonAdmin.userInfo.id, { roles: ['Test'] }, { replaceObjectFields: true })];
-            case 12:
+            case 27:
                 // ensure that going to "Non-Admin" triggers a role change
                 _a.sent();
                 return [4 /*yield*/, sdkNonAdmin.authenticate(nonAdminEmail, nonAdminPassword)];
-            case 13:
+            case 28:
                 _a.sent();
                 return [4 /*yield*/, async_test('non admin authenticated', sdkNonAdmin.test_authenticated, { expectedResult: 'Authenticated!' })
                     // reset nonAdmin role to a default non-admin
                 ];
-            case 14:
+            case 29:
                 _a.sent();
                 // reset nonAdmin role to a default non-admin
                 return [4 /*yield*/, sdk.api.users.updateOne(sdkNonAdmin.userInfo.id, { roles: ['Non-Admin'] }, { replaceObjectFields: true })];
-            case 15:
+            case 30:
                 // reset nonAdmin role to a default non-admin
                 _a.sent();
                 // should be unauthenticated due to role change
                 return [4 /*yield*/, wait(undefined, 100)];
-            case 16:
+            case 31:
                 // reset nonAdmin role to a default non-admin
                 // should be unauthenticated due to role change
                 _a.sent();
                 return [4 /*yield*/, async_test('role change causes deauthentication', sdkNonAdmin.test_authenticated, handleAnyError)
                     // reauthenticate
                 ];
-            case 17:
+            case 32:
                 _a.sent();
                 // reauthenticate
                 return [4 /*yield*/, wait(undefined, 1000)];
-            case 18:
+            case 33:
                 // reauthenticate
                 _a.sent();
                 return [4 /*yield*/, sdkNonAdmin.authenticate(nonAdminEmail, nonAdminPassword)
                     // may do some stuff in background after returning
                 ];
-            case 19:
+            case 34:
                 _a.sent();
                 // may do some stuff in background after returning
                 return [4 /*yield*/, async_test('reset_db', function () { return sdk.reset_db(); }, passOnVoid)];
-            case 20:
+            case 35:
                 // may do some stuff in background after returning
                 _a.sent();
                 return [4 /*yield*/, wait(undefined, 250)];
-            case 21:
+            case 36:
                 _a.sent();
                 return [2 /*return*/];
         }
@@ -412,64 +465,73 @@ var sub_organization_enduser_tests = function () { return __awaiter(void 0, void
                 return [4 /*yield*/, enduserSDK.register({ email: 'root@tellescope.com', password: password })];
             case 1:
                 _d.sent();
-                return [4 /*yield*/, subEnduserSDK.register({ email: 'sub@tellescope.com', password: password })];
+                return [4 /*yield*/, wait(undefined, 1000)]; // avoid rate limiting error
             case 2:
+                _d.sent(); // avoid rate limiting error
+                return [4 /*yield*/, subEnduserSDK.register({ email: 'sub@tellescope.com', password: password })];
+            case 3:
                 _d.sent();
+                return [4 /*yield*/, wait(undefined, 1000)]; // avoid rate limiting error
+            case 4:
+                _d.sent(); // avoid rate limiting error
                 return [4 /*yield*/, enduserSDK.authenticate('root@tellescope.com', password)];
-            case 3:
+            case 5:
                 _d.sent();
+                return [4 /*yield*/, wait(undefined, 1000)]; // avoid rate limiting error
+            case 6:
+                _d.sent(); // avoid rate limiting error
                 return [4 /*yield*/, subEnduserSDK.authenticate('sub@tellescope.com', password)];
-            case 4:
+            case 7:
                 _d.sent();
                 assert(!((_a = enduserSDK.userInfo.organizationIds) === null || _a === void 0 ? void 0 : _a.length), 'bad root organizationIds', 'root auth org ids');
                 assert(((_b = subEnduserSDK.userInfo.organizationIds) === null || _b === void 0 ? void 0 : _b.length) === 1, 'bad sub organizationIds', 'sub auth org ids');
                 return [4 /*yield*/, enduserSDK.api.tickets.createOne({ title: 'root', enduserId: enduserSDK.userInfo.id })];
-            case 5:
+            case 8:
                 rootTicket = _d.sent();
                 return [4 /*yield*/, async_test("root get root", function () { return sdk.api.endusers.getOne(enduserSDK.userInfo.id); }, passOnAnyResult)];
-            case 6:
+            case 9:
                 _d.sent();
                 return [4 /*yield*/, async_test("sub get root error", function () { return sdkSub.api.endusers.getOne(enduserSDK.userInfo.id); }, handleAnyError)];
-            case 7:
+            case 10:
                 _d.sent();
                 return [4 /*yield*/, async_test("root get sub", function () { return sdk.api.endusers.getOne(subEnduserSDK.userInfo.id); }, passOnAnyResult)];
-            case 8:
+            case 11:
                 _d.sent();
                 return [4 /*yield*/, async_test("sub get sub", function () { return sdkSub.api.endusers.getOne(subEnduserSDK.userInfo.id); }, passOnAnyResult)];
-            case 9:
+            case 12:
                 _d.sent();
                 return [4 /*yield*/, async_test("root get root ticket", function () { return sdk.api.tickets.getOne(rootTicket.id); }, passOnAnyResult)];
-            case 10:
+            case 13:
                 _d.sent();
                 return [4 /*yield*/, async_test("sub get root ticket error", function () { return sdkSub.api.tickets.getOne(rootTicket.id); }, handleAnyError)];
-            case 11:
+            case 14:
                 _d.sent();
                 return [4 /*yield*/, sdk.api.endusers.updateOne(enduserSDK.userInfo.id, { sharedWithOrganizations: [(_c = sdkSub.userInfo.organizationIds) !== null && _c !== void 0 ? _c : []] })];
-            case 12:
+            case 15:
                 _d.sent();
                 return [4 /*yield*/, enduserSDK.refresh_session()]; // ensure updated session includes new sharedWithOrganizations
-            case 13:
+            case 16:
                 _d.sent(); // ensure updated session includes new sharedWithOrganizations
                 return [4 /*yield*/, enduserSDK.api.tickets.createOne({ title: 'root with shared', enduserId: enduserSDK.userInfo.id })];
-            case 14:
+            case 17:
                 rootTicketAfterUpdate = _d.sent();
                 return [4 /*yield*/, async_test("root get root", function () { return sdk.api.endusers.getOne(enduserSDK.userInfo.id); }, passOnAnyResult)];
-            case 15:
+            case 18:
                 _d.sent();
                 return [4 /*yield*/, async_test("sub get root after update", function () { return sdkSub.api.endusers.getOne(enduserSDK.userInfo.id); }, passOnAnyResult)];
-            case 16:
+            case 19:
                 _d.sent();
                 return [4 /*yield*/, async_test("root get sub", function () { return sdk.api.endusers.getOne(subEnduserSDK.userInfo.id); }, passOnAnyResult)];
-            case 17:
+            case 20:
                 _d.sent();
                 return [4 /*yield*/, async_test("sub get sub", function () { return sdkSub.api.endusers.getOne(subEnduserSDK.userInfo.id); }, passOnAnyResult)];
-            case 18:
+            case 21:
                 _d.sent();
                 return [4 /*yield*/, async_test("root get root ticket after update", function () { return sdk.api.tickets.getOne(rootTicketAfterUpdate.id); }, passOnAnyResult)];
-            case 19:
+            case 22:
                 _d.sent();
                 return [4 /*yield*/, async_test("sub get root ticket after update", function () { return sdkSub.api.tickets.getOne(rootTicketAfterUpdate.id); }, passOnAnyResult)];
-            case 20:
+            case 23:
                 _d.sent();
                 return [4 /*yield*/, Promise.all([
                         sdk.api.endusers.deleteOne(enduserSDK.userInfo.id),
@@ -477,7 +539,7 @@ var sub_organization_enduser_tests = function () { return __awaiter(void 0, void
                         sdk.api.tickets.deleteOne(rootTicket.id),
                         sdk.api.tickets.deleteOne(rootTicketAfterUpdate.id),
                     ])];
-            case 21:
+            case 24:
                 _d.sent();
                 return [2 /*return*/];
         }
@@ -3998,23 +4060,35 @@ var search_tests = function () { return __awaiter(void 0, void 0, void 0, functi
                 return [4 /*yield*/, sdk.api.endusers.createOne({ email: 'e2_search@tellescope.com', fname: 'sebastian', lname: "coates" })];
             case 3:
                 e2 = _a.sent();
-                return [4 /*yield*/, async_test("Search full fname case insensitive", function () { return sdk.api.endusers.getSome({ search: { query: 'john' } }); }, { onResult: function (es) { return es.length === 1 && es[0].id === e1.id; } })];
+                return [4 /*yield*/, async_test("Search error message", function () { return sdk.api.endusers.getSome({ search: "alert(1)" }); }, {
+                        shouldError: true,
+                        onError: function (e) { return !e.message.includes('script') && e.message.startsWith("Error parsing field search: Expecting an object but got alert(1)"); }
+                    })];
             case 4:
                 _a.sent();
-                return [4 /*yield*/, async_test("Search start fname case insensitive", function () { return sdk.api.endusers.getSome({ search: { query: 'joh' } }); }, { onResult: function (es) { return es.length === 1 && es[0].id === e1.id; } })];
+                return [4 /*yield*/, async_test("Search error does not return script tags ", function () { return sdk.api.endusers.getSome({ search: "<script>alert(1)</script>" }); }, {
+                        shouldError: true,
+                        onError: function (e) { return !e.message.includes('script') && e.message.startsWith("Error parsing field search: Expecting an object but got"); }
+                    })];
             case 5:
                 _a.sent();
-                return [4 /*yield*/, async_test("Search end fname case insensitive", function () { return sdk.api.endusers.getSome({ search: { query: 'ohn' } }); }, { onResult: function (es) { return es.length === 1 && es[0].id === e1.id; } })];
+                return [4 /*yield*/, async_test("Search full fname case insensitive", function () { return sdk.api.endusers.getSome({ search: { query: 'john' } }); }, { onResult: function (es) { return es.length === 1 && es[0].id === e1.id; } })];
             case 6:
                 _a.sent();
-                return [4 /*yield*/, async_test("Search by email", function () { return sdk.api.endusers.getSome({ search: { query: 'search@tellescope' } }); }, { onResult: function (es) { return es.length === 2; } })];
+                return [4 /*yield*/, async_test("Search start fname case insensitive", function () { return sdk.api.endusers.getSome({ search: { query: 'joh' } }); }, { onResult: function (es) { return es.length === 1 && es[0].id === e1.id; } })];
             case 7:
+                _a.sent();
+                return [4 /*yield*/, async_test("Search end fname case insensitive", function () { return sdk.api.endusers.getSome({ search: { query: 'ohn' } }); }, { onResult: function (es) { return es.length === 1 && es[0].id === e1.id; } })];
+            case 8:
+                _a.sent();
+                return [4 /*yield*/, async_test("Search by email", function () { return sdk.api.endusers.getSome({ search: { query: 'search@tellescope' } }); }, { onResult: function (es) { return es.length === 2; } })];
+            case 9:
                 _a.sent();
                 return [4 /*yield*/, Promise.all([
                         sdk.api.endusers.deleteOne(e1.id),
                         sdk.api.endusers.deleteOne(e2.id),
                     ])];
-            case 8:
+            case 10:
                 _a.sent();
                 return [2 /*return*/];
         }
@@ -6994,6 +7068,7 @@ var validate_schema = function () {
             endpoints.add(path);
         }
     }
+    console.log("Schema validated");
 };
 var test_weighted_round_robin = function () { return __awaiter(void 0, void 0, void 0, function () {
     var testUsers, userIds, testAssignments, run_assignment_simulation;
@@ -7613,7 +7688,7 @@ export var ticket_reminder_tests = function () { return __awaiter(void 0, void 0
                         return (((_b = (_a = t.reminders) === null || _a === void 0 ? void 0 : _a[0]) === null || _b === void 0 ? void 0 : _b.didRemind) === true
                             && t.nextReminderInMS !== -1
                             && ((_d = (_c = t.reminders) === null || _c === void 0 ? void 0 : _c.filter(function (r) { return r.didRemind; })) === null || _d === void 0 ? void 0 : _d.length) === 1);
-                    }, 25, 200); }, passOnAnyResult)];
+                    }, 10, 500); }, passOnAnyResult)];
             case 13:
                 _a.sent();
                 return [4 /*yield*/, async_test("Delayed reminder not processed yet", function () { return sdk.api.tickets.getOne(tToRemind.id); }, {
@@ -7870,6 +7945,304 @@ var lockout_tests = function () { return __awaiter(void 0, void 0, void 0, funct
         }
     });
 }); };
+var sync_tests = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var from, e, t, e2;
+    return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0:
+                log_header("Data Sync");
+                from = new Date();
+                return [4 /*yield*/, async_test("No new records, admin", function () { return sdk.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 0;
+                        } })];
+            case 1:
+                _a.sent();
+                return [4 /*yield*/, async_test("No new records, non-admin", function () { return sdkNonAdmin.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 0;
+                        } })];
+            case 2:
+                _a.sent();
+                return [4 /*yield*/, sdk.api.endusers.createOne({})];
+            case 3:
+                e = _a.sent();
+                return [4 /*yield*/, wait(undefined, 100)];
+            case 4:
+                _a.sent();
+                return [4 /*yield*/, async_test("Enduser create, admin", function () { return sdk.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return (results.length === 1
+                                && results[0].modelName === 'endusers'
+                                && results[0].recordId === e.id
+                                && results[0].data.includes(e.id)
+                                && JSON.parse(results[0].data) // tests no error throwing
+                            );
+                        } })];
+            case 5:
+                _a.sent();
+                return [4 /*yield*/, async_test("Enduser create, non-admin", function () { return sdkNonAdmin.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 0;
+                        } })];
+            case 6:
+                _a.sent();
+                return [4 /*yield*/, async_test("Enduser create, sub organization", function () { return sdkSub.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 0;
+                        } })];
+            case 7:
+                _a.sent();
+                return [4 /*yield*/, async_test("Other organization", function () { return sdkOther.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 0;
+                        } })];
+            case 8:
+                _a.sent();
+                return [4 /*yield*/, sdk.api.endusers.updateOne(e.id, { fname: "UPDATE_TEST" })];
+            case 9:
+                _a.sent();
+                return [4 /*yield*/, wait(undefined, 100)];
+            case 10:
+                _a.sent();
+                return [4 /*yield*/, async_test("Enduser update, admin", function () { return sdk.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return (results.length === 1
+                                && results[0].modelName === 'endusers'
+                                && results[0].recordId === e.id
+                                && results[0].data.includes("UPDATE_TEST"));
+                        } })];
+            case 11:
+                _a.sent();
+                return [4 /*yield*/, async_test("Enduser update, non-admin", function () { return sdkNonAdmin.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 0;
+                        } })];
+            case 12:
+                _a.sent();
+                return [4 /*yield*/, async_test("Enduser update, sub organization", function () { return sdkSub.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 0;
+                        } })];
+            case 13:
+                _a.sent();
+                return [4 /*yield*/, async_test("Other organization", function () { return sdkOther.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 0;
+                        } })];
+            case 14:
+                _a.sent();
+                return [4 /*yield*/, sdk.api.tickets.createOne({ title: 'access test' })];
+            case 15:
+                t = _a.sent();
+                return [4 /*yield*/, wait(undefined, 100)];
+            case 16:
+                _a.sent();
+                return [4 /*yield*/, async_test("Non-admin can't access ticket", function () { return sdkNonAdmin.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 0;
+                        } })
+                    // creates a user notification which increments count/index
+                ];
+            case 17:
+                _a.sent();
+                // creates a user notification which increments count/index
+                sdk.api.tickets.updateOne(t.id, { owner: sdkNonAdmin.userInfo.id });
+                return [4 /*yield*/, wait(undefined, 100)];
+            case 18:
+                _a.sent();
+                return [4 /*yield*/, async_test("Non-admin can access tickets on assignment", function () { return sdkNonAdmin.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 2;
+                        } })];
+            case 19:
+                _a.sent();
+                sdk.api.tickets.updateOne(t.id, { owner: '' });
+                return [4 /*yield*/, wait(undefined, 100)];
+            case 20:
+                _a.sent();
+                return [4 /*yield*/, async_test("Non-admin can't access tickets on unassignment", function () { return sdkNonAdmin.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 1;
+                        } })];
+            case 21:
+                _a.sent();
+                return [4 /*yield*/, sdk.api.endusers.updateOne(e.id, { assignedTo: [sdkNonAdmin.userInfo.id] }, { replaceObjectFields: true })];
+            case 22:
+                _a.sent();
+                return [4 /*yield*/, wait(undefined, 100)];
+            case 23:
+                _a.sent();
+                return [4 /*yield*/, async_test("Enduser update non-admin assignment, can access", function () { return sdkNonAdmin.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 2;
+                        } })];
+            case 24:
+                _a.sent();
+                sdk.api.tickets.updateOne(t.id, { owner: '', enduserId: e.id });
+                return [4 /*yield*/, wait(undefined, 100)];
+            case 25:
+                _a.sent();
+                return [4 /*yield*/, async_test("Non-admin can access ticket (and enduser) after enduser assignment", function () { return sdkNonAdmin.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 3;
+                        } })];
+            case 26:
+                _a.sent();
+                return [4 /*yield*/, sdk.api.endusers.updateOne(e.id, { assignedTo: [] }, { replaceObjectFields: true })];
+            case 27:
+                _a.sent();
+                return [4 /*yield*/, wait(undefined, 100)];
+            case 28:
+                _a.sent();
+                return [4 /*yield*/, async_test("Enduser update non-admin assignment, revoked access to enduser and ticket", function () { return sdkNonAdmin.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 1;
+                        } })
+                    // enduser, ticket, and ticket assignment user_notification created
+                ];
+            case 29:
+                _a.sent();
+                // enduser, ticket, and ticket assignment user_notification created
+                return [4 /*yield*/, sdk.api.endusers.deleteOne(e.id)];
+            case 30:
+                // enduser, ticket, and ticket assignment user_notification created
+                _a.sent();
+                return [4 /*yield*/, wait(undefined, 100)];
+            case 31:
+                _a.sent();
+                return [4 /*yield*/, async_test("Enduser delete, admin", function () { return sdk.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return (results.length === 3
+                                && results[0].modelName === 'endusers'
+                                && results[0].recordId === e.id
+                                && results[0].data === 'deleted');
+                        } })];
+            case 32:
+                _a.sent();
+                return [4 /*yield*/, async_test("Enduser delete, non-admin", function () { return sdkNonAdmin.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 1;
+                        } })];
+            case 33:
+                _a.sent();
+                return [4 /*yield*/, async_test("Enduser delete, sub organization", function () { return sdkSub.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 0;
+                        } })];
+            case 34:
+                _a.sent();
+                return [4 /*yield*/, async_test("Other organization", function () { return sdkOther.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 0;
+                        } })
+                    // bulk create test coverage
+                ];
+            case 35:
+                _a.sent();
+                return [4 /*yield*/, sdk.api.endusers.createSome([{}])];
+            case 36:
+                e2 = (_a.sent()).created[0];
+                return [4 /*yield*/, wait(undefined, 100)];
+            case 37:
+                _a.sent();
+                return [4 /*yield*/, async_test("Bulk Enduser create, admin", function () { return sdk.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return (results.length === 4
+                                && results[0].modelName === 'endusers'
+                                && results[0].recordId === e2.id
+                                && results[0].data.includes(e2.id)
+                                && JSON.parse(results[0].data) // tests no error throwing
+                            );
+                        } })];
+            case 38:
+                _a.sent();
+                return [4 /*yield*/, async_test("Bulk Enduser create, non-admin", function () { return sdkNonAdmin.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 1;
+                        } })];
+            case 39:
+                _a.sent();
+                return [4 /*yield*/, async_test("Bulk Enduser create, sub organization", function () { return sdkSub.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 0;
+                        } })];
+            case 40:
+                _a.sent();
+                return [4 /*yield*/, async_test("Other organization", function () { return sdkOther.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 0;
+                        } })];
+            case 41:
+                _a.sent();
+                return [4 /*yield*/, sdk.api.endusers.deleteOne(e2.id)];
+            case 42:
+                _a.sent();
+                return [4 /*yield*/, wait(undefined, 100)];
+            case 43:
+                _a.sent();
+                return [4 /*yield*/, async_test("Bulk Enduser delete, admin", function () { return sdk.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return (results.length === 4
+                                && results[0].modelName === 'endusers'
+                                && results[0].recordId === e2.id
+                                && results[0].data === 'deleted');
+                        } })];
+            case 44:
+                _a.sent();
+                return [4 /*yield*/, async_test("Bulk Enduser delete, non-admin", function () { return sdkNonAdmin.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 1;
+                        } })];
+            case 45:
+                _a.sent();
+                return [4 /*yield*/, async_test("Bulk Enduser delete, sub organization", function () { return sdkSub.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 0;
+                        } })];
+            case 46:
+                _a.sent();
+                return [4 /*yield*/, async_test("Other organization", function () { return sdkOther.sync({ from: from }); }, { onResult: function (_a) {
+                            var results = _a.results;
+                            return results.length === 0;
+                        } })];
+            case 47:
+                _a.sent();
+                return [2 /*return*/];
+        }
+    });
+}); };
+// to cover potential vulernabilities with enduser public register endpoint
+var register_as_enduser_tests = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var enduser;
+    return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0:
+                log_header("Register as Enduser");
+                return [4 /*yield*/, async_test("Enduser register", function () { return enduserSDK.register({ email: 'test@tellescope.com', password: 'testpassWord12345!' }); }, passOnAnyResult)];
+            case 1:
+                _a.sent();
+                return [4 /*yield*/, async_test("Enduser register (rate limited)", function () { return enduserSDK.register({ email: 'test@tellescope.com', password: 'testpassWord12345!' }); }, { shouldError: true, onError: function (e) { return e.message === "Too many requests"; } })];
+            case 2:
+                _a.sent();
+                return [4 /*yield*/, wait(undefined, 1000)];
+            case 3:
+                _a.sent();
+                return [4 /*yield*/, async_test("Enduser duplicate register (same response, no ability to enumerate contacts)", function () { return enduserSDK.register({ email: 'test@tellescope.com', password: 'testpassWord12345!' }); }, passOnAnyResult)];
+            case 4:
+                _a.sent();
+                return [4 /*yield*/, sdk.api.endusers.getOne({ email: 'test@tellescope.com' })];
+            case 5:
+                enduser = _a.sent();
+                if (!enduser) return [3 /*break*/, 7];
+                return [4 /*yield*/, sdk.api.endusers.deleteOne(enduser.id)];
+            case 6:
+                _a.sent();
+                _a.label = 7;
+            case 7: return [2 /*return*/];
+        }
+    });
+}); };
 (function () { return __awaiter(void 0, void 0, void 0, function () {
     var err_1, n, _a, _b, _c, _i, returnValidation, t, _d, _f, _g, _h, err_2;
     var _j, _k;
@@ -7882,7 +8255,7 @@ var lockout_tests = function () { return __awaiter(void 0, void 0, void 0, funct
                 _l.sent();
                 _l.label = 2;
             case 2:
-                _l.trys.push([2, 47, , 48]);
+                _l.trys.push([2, 49, , 50]);
                 form_conditional_logic_tests();
                 return [4 /*yield*/, test_weighted_round_robin()];
             case 3:
@@ -7896,11 +8269,10 @@ var lockout_tests = function () { return __awaiter(void 0, void 0, void 0, funct
                         sdkOtherSub.authenticate(otherSubUserEmail, password),
                         sdkSubSub.authenticate(subSubUserEmail, password),
                         sdkNonAdmin.authenticate(nonAdminEmail, nonAdminPassword),
-                    ])
-                    // console.log(JSON.stringify(await sdk.bulk_load({ load: [{ model: 'users' }]}), null, 2))
-                ];
+                    ])];
             case 5:
                 _l.sent();
+                console.log("Authentication done");
                 // console.log(JSON.stringify(await sdk.bulk_load({ load: [{ model: 'users' }]}), null, 2))
                 return [4 /*yield*/, async_test("count exists", 
                     // @ts-ignore
@@ -7920,120 +8292,126 @@ var lockout_tests = function () { return __awaiter(void 0, void 0, void 0, funct
                 return [4 /*yield*/, multi_tenant_tests()]; // should come right after setup tests
             case 10:
                 _l.sent(); // should come right after setup tests
-                return [4 /*yield*/, lockout_tests()];
+                return [4 /*yield*/, register_as_enduser_tests()];
             case 11:
                 _l.sent();
-                return [4 /*yield*/, self_serve_appointment_booking_tests()];
+                return [4 /*yield*/, sync_tests()];
             case 12:
+                _l.sent();
+                return [4 /*yield*/, lockout_tests()];
+            case 13:
+                _l.sent();
+                return [4 /*yield*/, self_serve_appointment_booking_tests()];
+            case 14:
                 _l.sent();
                 return [4 /*yield*/, delete_user_tests()
                     // await test_send_with_template()
                 ];
-            case 13:
+            case 15:
                 _l.sent();
                 // await test_send_with_template()
                 return [4 /*yield*/, bulk_read_tests()];
-            case 14:
+            case 16:
                 // await test_send_with_template()
                 _l.sent();
                 return [4 /*yield*/, ticket_reminder_tests()];
-            case 15:
+            case 17:
                 _l.sent();
                 return [4 /*yield*/, enduser_access_tags_tests()];
-            case 16:
+            case 18:
                 _l.sent();
                 return [4 /*yield*/, marketing_email_unsubscribe_tests()];
-            case 17:
+            case 19:
                 _l.sent();
                 return [4 /*yield*/, unique_strings_tests()];
-            case 18:
+            case 20:
                 _l.sent();
                 return [4 /*yield*/, alternate_phones_tests()];
-            case 19:
+            case 21:
                 _l.sent();
                 return [4 /*yield*/, ticket_queue_tests()];
-            case 20:
+            case 22:
                 _l.sent();
                 return [4 /*yield*/, no_chained_triggers_tests()];
-            case 21:
+            case 23:
                 _l.sent();
                 return [4 /*yield*/, field_equals_trigger_tests()];
-            case 22:
+            case 24:
                 _l.sent();
                 return [4 /*yield*/, test_ticket_automation_assignment_and_optimization()];
-            case 23:
+            case 25:
                 _l.sent();
                 return [4 /*yield*/, role_based_access_tests()];
-            case 24:
+            case 26:
                 _l.sent();
                 return [4 /*yield*/, automation_trigger_tests()];
-            case 25:
+            case 27:
                 _l.sent();
                 return [4 /*yield*/, enduser_session_tests()];
-            case 26:
+            case 28:
                 _l.sent();
                 return [4 /*yield*/, nextReminderInMS_tests()];
-            case 27:
+            case 29:
                 _l.sent();
                 return [4 /*yield*/, search_tests()];
-            case 28:
+            case 30:
                 _l.sent();
                 return [4 /*yield*/, wait_for_trigger_tests()];
-            case 29:
+            case 31:
                 _l.sent();
                 return [4 /*yield*/, pdf_generation()];
-            case 30:
+            case 32:
                 _l.sent();
                 return [4 /*yield*/, remove_from_journey_on_incoming_comms_tests()];
-            case 31:
+            case 33:
                 _l.sent();
                 return [4 /*yield*/, rate_limit_tests()];
-            case 32:
+            case 34:
                 _l.sent();
                 return [4 /*yield*/, merge_enduser_tests()];
-            case 33:
+            case 35:
                 _l.sent();
                 return [4 /*yield*/, auto_reply_tests()];
-            case 34:
+            case 36:
                 _l.sent();
                 return [4 /*yield*/, sub_organization_enduser_tests()];
-            case 35:
+            case 37:
                 _l.sent();
                 return [4 /*yield*/, sub_organization_tests()];
-            case 36:
+            case 38:
                 _l.sent();
                 return [4 /*yield*/, filter_by_date_tests()];
-            case 37:
+            case 39:
                 _l.sent();
                 return [4 /*yield*/, generate_user_auth_tests()];
-            case 38:
+            case 40:
                 _l.sent();
                 return [4 /*yield*/, generateEnduserAuthTests()];
-            case 39:
+            case 41:
                 _l.sent();
                 return [4 /*yield*/, public_form_tests()];
-            case 40:
+            case 42:
                 _l.sent();
                 return [4 /*yield*/, badInputTests()];
-            case 41:
+            case 43:
                 _l.sent();
                 return [4 /*yield*/, filterTests()];
-            case 42:
+            case 44:
                 _l.sent();
                 return [4 /*yield*/, updatesTests()];
-            case 43:
+            case 45:
                 _l.sent();
                 return [4 /*yield*/, threadKeyTests()];
-            case 44:
+            case 46:
                 _l.sent();
                 return [4 /*yield*/, enduserAccessTests()];
-            case 45:
+            case 47:
                 _l.sent();
                 return [4 /*yield*/, enduser_redaction_tests()];
-            case 46:
+            case 48:
                 _l.sent();
-                return [3 /*break*/, 48];
-            case 47:
+                return [3 /*break*/, 50];
+            case 49:
                 err_1 = _l.sent();
                 console.error("Failed during custom test");
                 if (err_1.message && err_1.info) {
@@ -8043,18 +8421,18 @@ var lockout_tests = function () { return __awaiter(void 0, void 0, void 0, funct
                     console.error(err_1);
                 }
                 process.exit(1);
-                return [3 /*break*/, 48];
-            case 48:
+                return [3 /*break*/, 50];
+            case 50:
                 _a = schema;
                 _b = [];
                 for (_c in _a)
                     _b.push(_c);
                 _i = 0;
-                _l.label = 49;
-            case 49:
-                if (!(_i < _b.length)) return [3 /*break*/, 52];
+                _l.label = 51;
+            case 51:
+                if (!(_i < _b.length)) return [3 /*break*/, 54];
                 _c = _b[_i];
-                if (!(_c in _a)) return [3 /*break*/, 51];
+                if (!(_c in _a)) return [3 /*break*/, 53];
                 n = _c;
                 returnValidation = (_k = (_j = schema[n].customActions) === null || _j === void 0 ? void 0 : _j.create) === null || _k === void 0 ? void 0 : _k.returns;
                 return [4 /*yield*/, run_generated_tests({
@@ -8065,41 +8443,41 @@ var lockout_tests = function () { return __awaiter(void 0, void 0, void 0, funct
                             create: returnValidation // ModelFields<ClientModel>,
                         }
                     })];
-            case 50:
+            case 52:
                 _l.sent();
-                _l.label = 51;
-            case 51:
+                _l.label = 53;
+            case 53:
                 _i++;
-                return [3 /*break*/, 49];
-            case 52:
+                return [3 /*break*/, 51];
+            case 54:
                 _d = tests;
                 _f = [];
                 for (_g in _d)
                     _f.push(_g);
                 _h = 0;
-                _l.label = 53;
-            case 53:
-                if (!(_h < _f.length)) return [3 /*break*/, 58];
+                _l.label = 55;
+            case 55:
+                if (!(_h < _f.length)) return [3 /*break*/, 60];
                 _g = _f[_h];
-                if (!(_g in _d)) return [3 /*break*/, 57];
+                if (!(_g in _d)) return [3 /*break*/, 59];
                 t = _g;
-                _l.label = 54;
-            case 54:
-                _l.trys.push([54, 56, , 57]);
+                _l.label = 56;
+            case 56:
+                _l.trys.push([56, 58, , 59]);
                 return [4 /*yield*/, tests[t]()];
-            case 55:
+            case 57:
                 _l.sent();
-                return [3 /*break*/, 57];
-            case 56:
+                return [3 /*break*/, 59];
+            case 58:
                 err_2 = _l.sent();
                 console.error("Error running test:");
                 console.error(err_2);
                 process.exit(1);
-                return [3 /*break*/, 57];
-            case 57:
+                return [3 /*break*/, 59];
+            case 59:
                 _h++;
-                return [3 /*break*/, 53];
-            case 58:
+                return [3 /*break*/, 55];
+            case 60:
                 process.exit();
                 return [2 /*return*/];
         }