@tellescope/sdk 2.0.0-beta.0 → 2.0.0-beta.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tellescope/sdk",
-  "version": "2.0.0-beta.0",
+  "version": "2.0.0-beta.1",
   "description": "Code for interacting with the Tellescope API",
   "main": "./lib/cjs/sdk.js",
   "module": "./lib/esm/sdk.js",
@@ -35,14 +35,14 @@
     "node": ">=22.12.0"
   },
   "dependencies": {
-    "@tellescope/constants": "2.0.0-beta.0",
-    "@tellescope/schema": "2.0.0-beta.0",
-    "@tellescope/testing": "2.0.0-beta.0",
-    "@tellescope/types-client": "2.0.0-beta.0",
-    "@tellescope/types-models": "2.0.0-beta.0",
-    "@tellescope/types-utilities": "2.0.0-beta.0",
-    "@tellescope/utilities": "2.0.0-beta.0",
-    "@tellescope/validation": "2.0.0-beta.0",
+    "@tellescope/constants": "2.0.0-beta.1",
+    "@tellescope/schema": "2.0.0-beta.1",
+    "@tellescope/testing": "2.0.0-beta.1",
+    "@tellescope/types-client": "2.0.0-beta.1",
+    "@tellescope/types-models": "2.0.0-beta.1",
+    "@tellescope/types-utilities": "2.0.0-beta.1",
+    "@tellescope/utilities": "2.0.0-beta.1",
+    "@tellescope/validation": "2.0.0-beta.1",
     "axios": "0.33.0",
     "dotenv": "14.3.2",
     "form-data": "4.0.6",
@@ -58,5 +58,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "95b2448bb219e7634e29ef4b7850f8f74d73dcbc"
+  "gitHead": "20732ce4e382a7d81dde795ce9c7194c2aca1ce6"
 }

package/src/sdk.ts

@@ -234,6 +234,11 @@ const loadDefaultQueries = (s: Session): { [K in keyof ClientModelForName] : API
 })
 
 type Queries = { [K in keyof ClientModelForName]: APIQuery<K> } & {
+  user_logs: {
+    restore_deleted: (args: extractFields<CustomActions['user_logs']['restore_deleted']['parameters']>) => (
+      Promise<extractFields<CustomActions['user_logs']['restore_deleted']['returns']>>
+    ),
+  },
   inbox_threads: {
     build_threads: (args: extractFields<CustomActions['inbox_threads']['build_threads']['parameters']>) => (
       Promise<extractFields<CustomActions['inbox_threads']['build_threads']['returns']>>
@@ -996,6 +1001,7 @@ export class Session extends SessionManager {
     queries.api_keys.get_organization_api_keys = () => this._GET(`/v1${schema.api_keys.customActions.get_organization_api_keys.path}`)
     queries.api_keys.delete_organization_api_key = ({ id }) => this._DELETE(`/v1/organization-api-key/${id}`)
 
+    queries.user_logs.restore_deleted = a => this._POST(`/v1${schema.user_logs.customActions.restore_deleted.path}`, a)
     queries.enduser_orders.get_available_tests = a => this._GET(`/v1${schema.enduser_orders.customActions.get_available_tests.path}`, a)
     queries.enduser_orders.create_lab_order = a => this._POST(`/v1${schema.enduser_orders.customActions.create_lab_order.path}`, a)
     queries.enduser_orders.cancel_order = a => this._POST(`/v1${schema.enduser_orders.customActions.cancel_order.path}`, a)

package/src/tests/api_tests/enduser_fields_sync.test.ts

@@ -0,0 +1,150 @@
+require('source-map-support').install();
+
+import {
+  assert_checks,
+  Check,
+  setup_isolated_tenant,
+} from "../setup_isolated"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
+/**
+ * Schema round-trip for `Form.syncEnduserFieldsToEHR` and `Form.enduserFieldsSync`, the two fields
+ * behind "Sync Patient Fields to Healthie".
+ *
+ * The names are deliberately EHR-agnostic — each row's `externalId` is the question id in whichever
+ * EHR the form syncs to (`Form.externalId`) — even though only the Healthie push reads them today.
+ *
+ * What this file can and cannot cover: the actual `createFormAnswerGroup` round trip needs live
+ * Healthie credentials that no suite here has, and there is no Healthie mock or fixture layer in the
+ * repository, so the push itself is covered by the resolver's unit tests
+ * (api/modules/forms.test.ts) plus manual QA against Healthie staging. What IS covered here is
+ * everything the API owns: that the fields persist and read back unchanged, that validation rejects
+ * malformed rows, and — the one that guards a real decision in the form-editor modal — that an
+ * update with `replaceObjectFields` actually SHRINKS the list rather than merging into it, which is
+ * what makes deleting a mapping row persist.
+ */
+export const enduser_fields_sync_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  /** records a check that the given write is rejected (any 4xx), not silently accepted */
+  const record_rejected = async (label: string, write: () => Promise<any>) => {
+    try {
+      const accepted = await write()
+      record(label, false, `accepted, expected a validation error — got ${JSON.stringify(accepted?.enduserFieldsSync)}`)
+    } catch (err: any) {
+      const message = err?.message || String(err)
+      record(label, true, `rejected: ${message.slice(0, 200)}`)
+    }
+  }
+
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+
+  try {
+    tenant = await setup_isolated_tenant({ name: `FieldSync ${RAND()}`, users: [{ isAdmin: true }], apiKeys: 0 })
+    const sdk = tenant.sdk
+
+    const TWO_ROWS = [
+      { field: 'dateOfBirth', externalId: '111111' },
+      { field: 'Referring Provider', externalId: '222222' },
+    ]
+
+    /* ===== 1. Create with both fields set, and read them back ===== */
+    const created = await sdk.api.forms.createOne({
+      title: `Field sync ${RAND()}`,
+      externalId: 'healthie-form-id',
+      syncEnduserFieldsToEHR: true,
+      enduserFieldsSync: TWO_ROWS,
+    })
+    const readBack = await sdk.api.forms.getOne(created.id)
+
+    record('1: create persists syncEnduserFieldsToEHR', readBack.syncEnduserFieldsToEHR === true,
+      `got ${JSON.stringify(readBack.syncEnduserFieldsToEHR)}`)
+    record('1: create persists enduserFieldsSync verbatim',
+      JSON.stringify(readBack.enduserFieldsSync) === JSON.stringify(TWO_ROWS),
+      `got ${JSON.stringify(readBack.enduserFieldsSync)} expected ${JSON.stringify(TWO_ROWS)}`)
+
+    /* ===== 2. replaceObjectFields must SHRINK the list, not merge into it =====
+       This is the guard for the form-editor modal's `replaceObjectFields` change. Without it,
+       deleting a mapping row in the UI would save and then silently come back on reload. */
+    const ONE_ROW = [{ field: 'insurance.memberId', externalId: '333333' }]
+    await sdk.api.forms.updateOne(created.id, { enduserFieldsSync: ONE_ROW }, { replaceObjectFields: true })
+    const shrunk = await sdk.api.forms.getOne(created.id)
+
+    record('2: replaceObjectFields shrinks a two-row list to one row',
+      JSON.stringify(shrunk.enduserFieldsSync) === JSON.stringify(ONE_ROW),
+      `got ${JSON.stringify(shrunk.enduserFieldsSync)} expected ${JSON.stringify(ONE_ROW)}`)
+
+    /* ===== 3. Malformed rows are rejected ===== */
+    await record_rejected('3: a row with a non-string field is rejected', () =>
+      sdk.api.forms.updateOne(created.id, { enduserFieldsSync: [{ field: 1, externalId: '1' }] } as any,
+        { replaceObjectFields: true }))
+
+    await record_rejected('3: a row missing externalId is rejected', () =>
+      sdk.api.forms.updateOne(created.id, { enduserFieldsSync: [{ field: 'fname' }] } as any,
+        { replaceObjectFields: true }))
+
+    await record_rejected('3: an externalId over 100 characters is rejected', () =>
+      sdk.api.forms.updateOne(created.id,
+        { enduserFieldsSync: [{ field: 'fname', externalId: 'x'.repeat(101) }] },
+        { replaceObjectFields: true }))
+
+    // a rejected write must not have partially applied - the one-row list from step 2 stands
+    const afterRejections = await sdk.api.forms.getOne(created.id)
+    record('3: rejected writes leave the stored list untouched',
+      JSON.stringify(afterRejections.enduserFieldsSync) === JSON.stringify(ONE_ROW),
+      `got ${JSON.stringify(afterRejections.enduserFieldsSync)} expected ${JSON.stringify(ONE_ROW)}`)
+
+    /* ===== 4. An empty list is accepted (clearing every row) ===== */
+    try {
+      await sdk.api.forms.updateOne(created.id, { enduserFieldsSync: [] }, { replaceObjectFields: true })
+      const cleared = await sdk.api.forms.getOne(created.id)
+      const rows = cleared.enduserFieldsSync
+      record('4: an empty list is accepted and clears the mapping',
+        Array.isArray(rows) && rows.length === 0,
+        `got ${JSON.stringify(rows)}`)
+    } catch (err: any) {
+      record('4: an empty list is accepted and clears the mapping', false,
+        `rejected: ${(err?.message || String(err)).slice(0, 200)}`)
+    }
+
+    /* ===== 5. Backward compatibility: a form that sets neither field reads back with neither ===== */
+    const plain = await sdk.api.forms.createOne({ title: `No field sync ${RAND()}` })
+    const plainReadBack = await sdk.api.forms.getOne(plain.id)
+
+    record('5: a form created without either field has no syncEnduserFieldsToEHR',
+      plainReadBack.syncEnduserFieldsToEHR === undefined,
+      `got ${JSON.stringify(plainReadBack.syncEnduserFieldsToEHR)}`)
+    record('5: a form created without either field has no enduserFieldsSync',
+      plainReadBack.enduserFieldsSync === undefined,
+      `got ${JSON.stringify(plainReadBack.enduserFieldsSync)}`)
+  } finally {
+    // Teardown BEFORE anything asserts — assert calls process.exit, which skips pending finallys and
+    // would strand the provisioned tenant permanently.
+    if (tenant) { try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) } }
+  }
+
+  return checks
+}
+
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+export const enduser_fields_sync_tests = async () => {
+  assert_checks('Enduser fields sync schema round-trip', await enduser_fields_sync_checks())
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  enduser_fields_sync_tests()
+    .then(() => {
+      console.log("✅ enduser fields sync test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ enduser fields sync test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/load_threads_care_team.test.ts

@@ -0,0 +1,210 @@
+require('source-map-support').install();
+
+import {
+  assert_checks,
+  Check,
+  setup_isolated_tenant,
+} from "../setup_isolated"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
+/**
+ * Coverage for the `careTeamUserIds` parameter on `load_threads` (GET /v1/inbox-threads/load).
+ *
+ * The caller used to resolve "every patient these users are on the care team for" client-side and
+ * push the resulting enduser ids into `mdbFilter`. For a care team of hundreds of patients that
+ * overflows the GET query string (Node's 16KB header limit) before any Tellescope code runs. The
+ * parameter moves the join to the server: the API resolves the user ids to endusers via
+ * `assignedTo`, and ANDs `{ enduserIds: { $in: [...] } }` onto the thread filter.
+ *
+ * `setup_isolated` rather than `setup_tests` because several checks assert on the COMPLETE thread
+ * set of the tenant. On the shared fixture org, `build_threads` and the other inbox suites leave
+ * threads behind and every "returns exactly these" assertion would be flaky.
+ *
+ * The threads are created directly with `inbox_threads.createOne` (the model exposes create for
+ * exactly this reason) rather than via `build_threads`, so the tenant contains exactly three.
+ *
+ * Check 4 is the one that catches a wrong implementation: a care team with no patients resolves to
+ * an empty enduser list, and the clause must still be applied (returning nothing) rather than
+ * dropped (returning everything). Check 5 is its counterweight — it rules out an implementation
+ * that returns nothing for every call, which would satisfy 3, 4 and 7c vacuously.
+ *
+ * Check 7 is the permission boundary. A provisioned non-admin gets
+ * `sms_messages: ASSIGNED_AND_DEFAULT_ACCESS` (read: 'Assigned'), and the fixture threads carry
+ * `userIds: []`, so that session sees a thread only through the assigned-enduser branch. 7c fails
+ * if the care-team clause is ever pushed into the access `$or` instead of `filter.$and`, i.e. if
+ * the parameter could be used to WIDEN what a session can see.
+ */
+export const load_threads_care_team_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+
+  try {
+    /* ================= fixtures ================= */
+
+    tenant = await setup_isolated_tenant({
+      name: `LoadThreadsCareTeam ${RAND()}`,
+      users: [{ isAdmin: true }, { roles: ['Non-Admin'] }],
+      apiKeys: 0,
+    })
+
+    const { sdk, sdkNonAdmin } = tenant
+    const NA = tenant.users[1].id // the non-admin's own user id
+
+    // care-team users: they never log in, they exist only to appear in endusers.assignedTo
+    const [U1, U2, U3] = await Promise.all([1, 2, 3].map(n => sdk.api.users.createOne({
+      email: `dontsend-care-team-${n}-${RAND()}@tellescope.com`,
+      fname: 'CareTeam', lname: `User${n}`,
+      verifiedEmail: true,
+      notificationEmailsDisabled: true,
+    })))
+
+    // E1 is also assigned to the non-admin, so check 7a has a non-empty baseline to measure against
+    const E1 = await sdk.api.endusers.createOne({ fname: 'CareTeam', lname: 'PatientOne', assignedTo: [U1.id, NA] })
+    const E2 = await sdk.api.endusers.createOne({ fname: 'CareTeam', lname: 'PatientTwo', assignedTo: [U2.id] })
+    const E3 = await sdk.api.endusers.createOne({ fname: 'CareTeam', lname: 'PatientThree', assignedTo: [] })
+
+    const now = Date.now()
+    const MINUTE = 60 * 1000
+    const defaultThreadFields = {
+      type: 'SMS' as const,
+      assignedTo: [],
+      userIds: [],
+      inboxStatus: 'New',
+      preview: 'care team test',
+      title: 'Care team test',
+    }
+
+    const T1 = await sdk.api.inbox_threads.createOne({
+      ...defaultThreadFields,
+      enduserIds: [E1.id], threadId: `care-team-t1-${RAND()}`, timestamp: new Date(now - 3 * MINUTE),
+    })
+    const T2 = await sdk.api.inbox_threads.createOne({
+      ...defaultThreadFields,
+      enduserIds: [E2.id], threadId: `care-team-t2-${RAND()}`, timestamp: new Date(now - 2 * MINUTE),
+    })
+    const T3 = await sdk.api.inbox_threads.createOne({
+      ...defaultThreadFields,
+      enduserIds: [E3.id], threadId: `care-team-t3-${RAND()}`, timestamp: new Date(now - 1 * MINUTE),
+    })
+
+    const label_for: { [id: string]: string } = { [T1.id]: 'T1', [T2.id]: 'T2', [T3.id]: 'T3' }
+    const describe = (ids: string[]) => `[${ids.map(id => label_for[id] || id).sort().join(', ')}]`
+    const load = async (args: any, session = sdk) => (
+      (await session.api.inbox_threads.load_threads(args)).threads.map(t => t.id)
+    )
+    const same_set = (a: string[], b: string[]) => (
+      a.length === b.length && [...a].sort().join() === [...b].sort().join()
+    )
+
+    /* ===== 1: a single care-team user ===== */
+
+    const one = await load({ careTeamUserIds: [U1.id] })
+    record(
+      '1: careTeamUserIds=[U1] returns exactly the thread for U1\'s patient',
+      same_set(one, [T1.id]),
+      `got ${describe(one)} (want [T1])`,
+    )
+
+    /* ===== 2: multiple care-team users union their patients ===== */
+
+    const two = await load({ careTeamUserIds: [U1.id, U2.id] })
+    record(
+      '2: careTeamUserIds=[U1, U2] returns both their threads and not the unassigned one',
+      same_set(two, [T1.id, T2.id]),
+      `got ${describe(two)} (want [T1, T2] — T3\'s enduser has an empty care team)`,
+    )
+
+    /* ===== 3: ANDs with enduserIds rather than ORing ===== */
+
+    const intersect = await load({ careTeamUserIds: [U2.id], enduserIds: [E1.id] })
+    record(
+      '3: careTeamUserIds AND enduserIds narrows to the intersection',
+      intersect.length === 0,
+      `got ${describe(intersect)} (want [] — E1 is not on U2\'s care team; a non-empty result means the`
+      + ` two filters OR instead of AND)`,
+    )
+
+    /* ===== 4: an empty resolution must not degrade to "no filter" ===== */
+
+    const emptyCareTeam = await load({ careTeamUserIds: [U3.id] })
+    record(
+      '4: a care-team user with no patients returns no threads, not every thread',
+      emptyCareTeam.length === 0,
+      `got ${describe(emptyCareTeam)} (want [] — returning all three means the clause was dropped when`
+      + ` the enduser lookup came back empty)`,
+    )
+
+    /* ===== 5: the feature-off path is unchanged ===== */
+
+    const baseline = await load({})
+    const emptyParam = await load({ careTeamUserIds: [] })
+    record(
+      '5: omitting careTeamUserIds, and passing [], both return exactly the three fixture threads',
+      same_set(baseline, [T1.id, T2.id, T3.id]) && same_set(emptyParam, baseline),
+      `omitted=${describe(baseline)} empty=${describe(emptyParam)} (want [T1, T2, T3] for both)`,
+    )
+
+    /* ===== 6: the count path shares the filter ===== */
+
+    const { count } = await sdk.api.inbox_threads.load_threads({ careTeamUserIds: [U1.id], returnCount: true })
+    record(
+      '6: returnCount applies the care-team filter too',
+      count === 1,
+      `count=${count} (want 1 — 3 means the count path skipped the filter)`,
+    )
+
+    /* ===== 7: permission boundary — the parameter can only narrow, never widen ===== */
+
+    const naBaseline = await load({}, sdkNonAdmin)
+    record(
+      '7a: the non-admin\'s unfiltered inbox is exactly the thread for the patient assigned to them',
+      same_set(naBaseline, [T1.id]),
+      `got ${describe(naBaseline)} (want [T1] — the baseline the next two checks are measured against;`
+      + ` if this is empty, 7b and 7c pass vacuously)`,
+    )
+
+    const naOwnCareTeam = await load({ careTeamUserIds: [U1.id] }, sdkNonAdmin)
+    record(
+      '7b: the parameter does not remove a thread the non-admin legitimately sees',
+      same_set(naOwnCareTeam, [T1.id]),
+      `got ${describe(naOwnCareTeam)} (want [T1])`,
+    )
+
+    const naForeignCareTeam = await load({ careTeamUserIds: [U2.id] }, sdkNonAdmin)
+    record(
+      '7c: the parameter cannot reach a thread outside the non-admin\'s access',
+      naForeignCareTeam.length === 0,
+      `got ${describe(naForeignCareTeam)} (want [] — T2 matches U2\'s care team but is outside this`
+      + ` session's access; a non-empty result means the clause was pushed into the access $or)`,
+    )
+  } finally {
+    // Teardown BEFORE anything asserts — assert calls process.exit, which would strand the tenant.
+    if (tenant) { try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) } }
+  }
+
+  return checks
+}
+
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+export const load_threads_care_team_tests = async () => {
+  assert_checks('Load threads care team', await load_threads_care_team_checks())
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  load_threads_care_team_tests()
+    .then(() => {
+      console.log("✅ Load threads care team test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Load threads care team test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/mdi_case_offerings.test.ts

@@ -91,10 +91,41 @@ const resolve_displayed_options = (
   ) ? field.options.choices : undefined
 }
 
+// Local replica of the API's mdiIgnore handling (md_integrations.ts): the same field lookup
+// (_id first, externalId fallback — Formsort / form-ingestion answers carry no fieldId), with
+// patient-mapped fields exempt. Used to filter both case_questions and case file uploads.
+type IgnorableField = { _id: string, externalId?: string, mdiIgnore?: boolean }
+type IgnorableResponse = { fieldId?: string, externalId?: string, answer: { type?: string } }
+
+const is_mdi_ignored = (response: IgnorableResponse, formFields: IgnorableField[]): boolean => {
+  if (response.externalId && PATIENT_MAPPED_EXTERNAL_IDS.has(response.externalId)) return false
+  const field = (
+       formFields.find(f => f._id.toString() === response.fieldId)
+    || formFields.find(f => response.externalId && f.externalId === response.externalId)
+  )
+  return !!field?.mdiIgnore
+}
+
+const case_question_responses = (responses: IgnorableResponse[], formFields: IgnorableField[]) => (
+  responses.filter(r =>
+       r.answer.type !== 'file' && r.answer.type !== 'files'
+    && !(r.externalId && PATIENT_MAPPED_EXTERNAL_IDS.has(r.externalId))
+    && !is_mdi_ignored(r, formFields)
+  )
+)
+
+const uploadable_file_responses = (responses: IgnorableResponse[], formFields: IgnorableField[]) => (
+  responses.filter(r =>
+       (r.answer.type === 'file' || r.answer.type === 'files')
+    && !is_mdi_ignored(r, formFields)
+  )
+)
+
 export const mdi_case_offerings_tests = async ({ sdk, sdkNonAdmin }: { sdk: Session, sdkNonAdmin: Session }) => {
   log_header("MDI Case Offerings Tests")
 
   let testFormId: string | undefined
+  let testFieldId: string | undefined
 
   try {
     // --- Schema round-trip tests ---
@@ -385,7 +416,114 @@ export const mdi_case_offerings_tests = async ({ sdk, sdkNonAdmin }: { sdk: Sess
       },
       { expectedResult: true }
     )
+
+    // --- mdiIgnore tests ---
+
+    await async_test(
+      "Form field mdiIgnore round-trips through create and update",
+      async () => {
+        if (!testFormId) throw new Error("No test form")
+
+        const field = await sdk.api.form_fields.createOne({
+          formId: testFormId,
+          title: 'Offering IDs',
+          type: 'string',
+          externalId: 'offeringIds',
+          mdiIgnore: true,
+          previousFields: [{ type: 'root', info: {} }],
+        })
+        testFieldId = field.id
+        const created = await sdk.api.form_fields.getOne(field.id)
+
+        await sdk.api.form_fields.updateOne(field.id, { mdiIgnore: false })
+        const updated = await sdk.api.form_fields.getOne(field.id)
+
+        return created.mdiIgnore === true && updated.mdiIgnore === false
+      },
+      { expectedResult: true }
+    )
+
+    const IGNORE_FIELDS: IgnorableField[] = [
+      { _id: 'field-ignored', externalId: 'internal_note', mdiIgnore: true },
+      { _id: 'field-offerings', externalId: 'offeringIds', mdiIgnore: true },
+      { _id: 'field-kept', externalId: 'symptoms' },
+      { _id: 'field-kept-explicit', externalId: 'duration', mdiIgnore: false },
+      { _id: 'field-allergies', externalId: 'allergies', mdiIgnore: true }, // patient-mapped → exempt
+      { _id: 'field-ignored-upload', externalId: 'internal_upload', mdiIgnore: true },
+      { _id: 'field-kept-upload', externalId: 'mdi:lab-result' },
+    ]
+
+    await async_test(
+      "mdiIgnore drops native form answers (matched by fieldId) from case_questions",
+      async () => {
+        const kept = case_question_responses([
+          { fieldId: 'field-ignored', answer: { type: 'string' } },
+          { fieldId: 'field-kept', answer: { type: 'string' } },
+          { fieldId: 'field-kept-explicit', answer: { type: 'string' } },
+        ], IGNORE_FIELDS)
+        return kept.length === 2 && kept.every(r => r.fieldId !== 'field-ignored')
+      },
+      { expectedResult: true }
+    )
+
+    await async_test(
+      "mdiIgnore drops Formsort / form-ingestion answers (matched by externalId) from case_questions",
+      async () => {
+        const kept = case_question_responses([
+          { fieldId: '', externalId: 'offeringIds', answer: { type: 'string' } },
+          { fieldId: '', externalId: 'symptoms', answer: { type: 'string' } },
+          { fieldId: '', externalId: 'unconfigured_key', answer: { type: 'string' } }, // no field → kept
+        ], IGNORE_FIELDS)
+        return (
+          kept.length === 2
+          && !kept.some(r => r.externalId === 'offeringIds')
+          && kept.some(r => r.externalId === 'unconfigured_key')
+        )
+      },
+      { expectedResult: true }
+    )
+
+    await async_test(
+      "mdiIgnore does not affect patient-mapped fields",
+      async () => (
+        !is_mdi_ignored({ fieldId: 'field-allergies', externalId: 'allergies', answer: { type: 'string' } }, IGNORE_FIELDS)
+      ),
+      { expectedResult: true }
+    )
+
+    await async_test(
+      "mdiIgnore skips file uploads for ignored fields only",
+      async () => {
+        const uploadable = uploadable_file_responses([
+          { fieldId: 'field-ignored-upload', answer: { type: 'file' } },
+          { fieldId: '', externalId: 'internal_upload', answer: { type: 'files' } },
+          { fieldId: 'field-kept-upload', answer: { type: 'file' } },
+        ], IGNORE_FIELDS)
+        return uploadable.length === 1 && uploadable[0].fieldId === 'field-kept-upload'
+      },
+      { expectedResult: true }
+    )
+
+    await async_test(
+      "mdiIgnore does not stop offering conditions from reading the answer",
+      async () => {
+        const offerings: MDIOffering[] = [
+          { offering_id: "03b7", conditions: { condition: { offeringIds: { $contains: "03b7" } as any } } },
+        ]
+        const responses = [{ externalId: 'offeringIds', value: '1d15,03b7,03b7' }]
+        const resolved = resolve_case_offerings(offerings, responses)
+        const questions = case_question_responses(
+          [{ fieldId: '', externalId: 'offeringIds', answer: { type: 'string' } }],
+          IGNORE_FIELDS,
+        )
+        return resolved.length === 1 && questions.length === 0
+      },
+      { expectedResult: true }
+    )
   } finally {
+    if (testFieldId) {
+      await sdk.api.form_fields.deleteOne(testFieldId).catch(console.error)
+    }
     if (testFormId) {
       await sdk.api.forms.deleteOne(testFormId).catch(console.error)
     }

package/src/tests/api_tests/security/add-to-journey-foreign-enduserid.test.ts

@@ -5,6 +5,7 @@ import {
   Check,
   setup_isolated_tenant,
 } from "../../setup_isolated"
+import { poll_for_results } from "@tellescope/testing"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
@@ -97,6 +98,11 @@ export const add_to_journey_foreign_enduserid_checks = async (): Promise<Check[]
       await attacker!.sdk.api.automated_actions.getSome({ filter: { journeyId } } as any)
     )
     const enduserIdsFor = async (journeyId: string) => (await rowsFor(journeyId)).map((r: any) => r.enduserId)
+    // add_to_journey's automated_actions.insertMany is fire-and-forget on both branches, so the 204
+    // can arrive before the rows exist: poll until the expected id shows (last read on timeout)
+    const enduserIdsForOnceContains = (journeyId: string, enduserId: string) => (
+      poll_for_results(() => enduserIdsFor(journeyId), ids => ids.includes(enduserId))
+    )
 
     /* ===== A: the foreign id must never be planted, on EITHER branch ===== */
 
@@ -108,13 +114,6 @@ export const add_to_journey_foreign_enduserid_checks = async (): Promise<Check[]
       startAt: FUTURE_START(),
     } as any).then(() => 'resolved').catch((e: any) => `rejected: ${e?.message || e}`)
 
-    const inlineIds = await enduserIdsFor(inline.journey.id)
-    record(
-      'A1: inline branch (automationStepId) does not plant a foreign enduserId',
-      !inlineIds.includes(victim.id),
-      `call=${inlineResult}; automated_actions enduserIds=${JSON.stringify(inlineIds)} (must not contain ${victim.id})`,
-    )
-
     // A2 — module branch: no automationStepId, so it routes through handle_automation_event
     const moduleResult = await attacker.sdk.api.endusers.add_to_journey({
       enduserIds: [victim.id],
@@ -122,22 +121,6 @@ export const add_to_journey_foreign_enduserid_checks = async (): Promise<Check[]
       startAt: FUTURE_START(),
     } as any).then(() => 'resolved').catch((e: any) => `rejected: ${e?.message || e}`)
 
-    const moduleIds = await enduserIdsFor(modulePath.journey.id)
-    record(
-      'A2: module branch (no automationStepId) does not plant a foreign enduserId',
-      !moduleIds.includes(victim.id),
-      `call=${moduleResult}; automated_actions enduserIds=${JSON.stringify(moduleIds)} (must not contain ${victim.id})`,
-    )
-
-    // A3 — the victim's own record must be untouched (the scoped updateMany should already ensure it)
-    const victimAfter = await victimTenant.sdk.api.endusers.getOne(victim.id)
-    const victimJourneys = (victimAfter as any)?.journeys ?? {}
-    record(
-      'A3: the victim enduser was not enrolled in the attacker\'s journey',
-      !victimJourneys[inline.journey.id] && !victimJourneys[modulePath.journey.id],
-      `victim journeys=${JSON.stringify(victimJourneys)}`,
-    )
-
     /* ===== B: legitimate use must keep working ===== */
 
     // B1 — positive control on both branches, so a blanket failure can't masquerade as a fix
@@ -153,8 +136,32 @@ export const add_to_journey_foreign_enduserid_checks = async (): Promise<Check[]
       startAt: FUTURE_START(),
     } as any)
 
-    const inlineOwn = await enduserIdsFor(inline.journey.id)
-    const moduleOwn = await enduserIdsFor(modulePath.journey.id)
+    const inlineOwn = await enduserIdsForOnceContains(inline.journey.id, own.id)
+    const moduleOwn = await enduserIdsForOnceContains(modulePath.journey.id, own.id)
+
+    // A1/A2 are judged against the post-B1 reads: those include every row for the journey, and the
+    // legitimate insert having landed is what makes the victim's absence meaningful rather than
+    // "not written yet"
+    record(
+      'A1: inline branch (automationStepId) does not plant a foreign enduserId',
+      !inlineOwn.includes(victim.id),
+      `call=${inlineResult}; automated_actions enduserIds=${JSON.stringify(inlineOwn)} (must not contain ${victim.id})`,
+    )
+    record(
+      'A2: module branch (no automationStepId) does not plant a foreign enduserId',
+      !moduleOwn.includes(victim.id),
+      `call=${moduleResult}; automated_actions enduserIds=${JSON.stringify(moduleOwn)} (must not contain ${victim.id})`,
+    )
+
+    // A3 — the victim's own record must be untouched (the scoped updateMany should already ensure it)
+    const victimAfter = await victimTenant.sdk.api.endusers.getOne(victim.id)
+    const victimJourneys = (victimAfter as any)?.journeys ?? {}
+    record(
+      'A3: the victim enduser was not enrolled in the attacker\'s journey',
+      !victimJourneys[inline.journey.id] && !victimJourneys[modulePath.journey.id],
+      `victim journeys=${JSON.stringify(victimJourneys)}`,
+    )
+
     record(
       'B1: the caller\'s OWN enduser still enrolls on both branches',
       inlineOwn.includes(own.id) && moduleOwn.includes(own.id),
@@ -170,7 +177,7 @@ export const add_to_journey_foreign_enduserid_checks = async (): Promise<Check[]
       startAt: FUTURE_START(),
     } as any).then(() => 'resolved').catch((e: any) => `rejected: ${e?.message || e}`)
 
-    const mixedIds = await enduserIdsFor(mixed.journey.id)
+    const mixedIds = await enduserIdsForOnceContains(mixed.journey.id, own.id)
     record(
       'B2: a mixed list enrolls the visible enduser and drops only the foreign one',
       mixedIds.includes(own.id) && !mixedIds.includes(victim.id),