@tellescope/sdk 2.0.0-beta.0 → 2.0.0-beta.2

package/src/tests/api_tests/security/formsort_webhook_auth_field_lock.test.ts

@@ -65,6 +65,19 @@ const host = process.env.API_URL || 'http://localhost:8080' as const
  *   R14         both grace markers are load-bearing: neither source nor stripeCustomerId alone opens it
  *   R15         the grace is per-request — it does not clear the stored flag
  *
+ * ?alwaysSetPhone=true (CU-86e3k4ptv) is a second per-request override, narrower than ?enduserId=:
+ * it allows PHONE ONLY through the lock, on every finalized webhook, overwriting an existing and
+ * different number. Email — the password-reset channel this lock exists to protect — stays blocked.
+ *   G16 (GREEN) the flag overwrites an existing, different phone on a guessed match
+ *   G17 (GREEN) ...and in that same request the submitted email is still dropped
+ *   R16 (RED)   the identical request WITHOUT the flag leaves both phone and email blocked
+ *   R17 (RED)   the flag does not open email on a phone match either
+ *   R18 (RED)   only the literal string 'true' enables it — ?alwaysSetPhone=1 keeps the lock
+ *   G18 (GREEN) a flagged webhook still stamps authFieldIntakeDisabled on the response, so later
+ *               writes through save_enduser_updates_for_form_response stay blocked
+ *   R19 (RED)   it is request-scoped: a flag passed on an earlier webhook for the same
+ *               responder_uuid does not unlock a later one that omits it
+ *
  * The Stripe grace is deliberately confined to THIS endpoint, which is API-key authenticated. The
  * anonymous public-form path gets no exemption; that boundary is pinned by G28 in
  * public_endpoint_auth_field_lock.test.ts.
@@ -155,12 +168,15 @@ export const formsort_webhook_auth_field_lock_tests = async (
     finalized: boolean,
     enduserId?: string,
     createNewEnduser?: boolean,
+    // sent verbatim, so a scenario can pin that only the literal string 'true' enables the opt-in
+    alwaysSetPhone?: string,
   }) => {
     const url = new URL(`${host}/v1/webhooks/form-ingestion/${apiKey.key}`)
     url.searchParams.set('formId', form.id)
     url.searchParams.set('returnJSON', 'true')
     if (o.enduserId) url.searchParams.set('enduserId', o.enduserId)
     if (o.createNewEnduser) url.searchParams.set('createNewEnduser', 'true')
+    if (o.alwaysSetPhone !== undefined) url.searchParams.set('alwaysSetPhone', o.alwaysSetPhone)
 
     const res = await axios.post(
       url.toString(),
@@ -688,6 +704,215 @@ export const formsort_webhook_auth_field_lock_tests = async (
     }
   })
 
+  // ---------------------------------------------------------------------------------------------
+  // G16 — ?alwaysSetPhone=true: the opt-in allows phone through the lock on a GUESSED match (the
+  // path R2 blocks), overwriting a phone that is already stored and different. Phone is also the
+  // only field this submission changes, which exercises the "at least one update provided" guard —
+  // if the delete happened before that guard, nothing would be written at all.
+  // ---------------------------------------------------------------------------------------------
+  await runScenario('G16', 'alwaysSetPhone=true overwrites an existing phone on a guessed match', async () => {
+    const email = emailFor('g16')
+    const originalPhone = nextPhone()
+    const victim = await makeVictim('g16', { email, phone: originalPhone })
+    const intakePhone = nextPhone()
+
+    const { data } = await postWebhook({
+      label: 'g16',
+      finalized: true,
+      alwaysSetPhone: 'true',
+      answers: [{ key: 'email', value: email }, { key: 'phone', value: intakePhone }],
+    })
+    if (!matched('G16', 'alwaysSetPhone=true overwrites an existing phone on a guessed match', data, victim.id)) return
+
+    const enduser = await pollEnduser(victim.id, e => e.phone === intakePhone)
+    record('G16', 'alwaysSetPhone=true overwrites an existing phone on a guessed match',
+      enduser?.phone === intakePhone,
+      `phone=${enduser?.phone || '(unset)'} expected=${intakePhone}`)
+  })
+
+  // ---------------------------------------------------------------------------------------------
+  // G17 — the same request, with BOTH a new phone and a different email, so the two halves of the
+  // rule are observed together: phone lands, email does not. Shaped like R3 (a draft formed by a
+  // guess, finalized through the sticky flag) because that is the only resolution path where the
+  // submitted email can differ from the stored one while the patient still matches.
+  // ---------------------------------------------------------------------------------------------
+  await runScenario('G17', 'alwaysSetPhone=true writes phone and still drops email', async () => {
+    const originalEmail = emailFor('g17')
+    const originalPhone = nextPhone()
+    const victim = await makeVictim('g17', { email: originalEmail, phone: originalPhone })
+    const attackerEmail = emailFor('g17-attacker')
+    const intakePhone = nextPhone()
+
+    // draft matches the pre-existing patient by phone -> authFieldIntakeDisabled is stamped on it
+    await postWebhook({ label: 'g17', finalized: false, answers: [{ key: 'phone', value: originalPhone }] })
+
+    const { data } = await postWebhook({
+      label: 'g17',
+      finalized: true,
+      alwaysSetPhone: 'true',
+      answers: [{ key: 'phone', value: intakePhone }, { key: 'email', value: attackerEmail }],
+    })
+    if (!matched('G17', 'alwaysSetPhone=true writes phone and still drops email', data, victim.id)) return
+
+    const enduser = await pollEnduser(victim.id, e => e.phone === intakePhone)
+    record('G17', 'alwaysSetPhone=true writes phone through the sticky flag', enduser?.phone === intakePhone,
+      `phone=${enduser?.phone || '(unset)'} expected=${intakePhone}`)
+    record('G17', 'alwaysSetPhone=true leaves email blocked in the same request',
+      enduser?.email === originalEmail,
+      `email=${enduser?.email || '(unset)'} expected=${originalEmail}`)
+  })
+
+  // ---------------------------------------------------------------------------------------------
+  // R16 — the control for G17: byte-identical request without the flag. Both fields stay blocked,
+  // i.e. the default behavior is unchanged.
+  // ---------------------------------------------------------------------------------------------
+  await runScenario('R16', 'without the flag the same request blocks phone and email', async () => {
+    const originalEmail = emailFor('r16')
+    const originalPhone = nextPhone()
+    const victim = await makeVictim('r16', { email: originalEmail, phone: originalPhone })
+    const attackerEmail = emailFor('r16-attacker')
+    const intakePhone = nextPhone()
+
+    await postWebhook({ label: 'r16', finalized: false, answers: [{ key: 'phone', value: originalPhone }] })
+
+    const { data } = await postWebhook({
+      label: 'r16',
+      finalized: true,
+      answers: [{ key: 'phone', value: intakePhone }, { key: 'email', value: attackerEmail }],
+    })
+    if (!matched('R16', 'without the flag the same request blocks phone and email', data, victim.id)) return
+
+    const enduser = await pollEnduser(victim.id, e => e.phone === intakePhone || e.email === attackerEmail)
+    record('R16', 'without the flag phone stays blocked', enduser?.phone === originalPhone,
+      `phone=${enduser?.phone || '(unset)'} expected=${originalPhone}`)
+    record('R16', 'without the flag email stays blocked', enduser?.email === originalEmail,
+      `email=${enduser?.email || '(unset)'} expected=${originalEmail}`)
+  })
+
+  // ---------------------------------------------------------------------------------------------
+  // R17 — the flag is phone-only in BOTH match directions: matched on phone (R1's shape), the
+  // submitted email must still not land.
+  // ---------------------------------------------------------------------------------------------
+  await runScenario('R17', 'alwaysSetPhone=true does not repoint email on a phone match', async () => {
+    const originalEmail = emailFor('r17')
+    const phone = nextPhone()
+    const victim = await makeVictim('r17', { email: originalEmail, phone })
+    const attackerEmail = emailFor('r17-attacker')
+
+    const { data } = await postWebhook({
+      label: 'r17',
+      finalized: true,
+      alwaysSetPhone: 'true',
+      answers: [{ key: 'phone', value: phone }, { key: 'email', value: attackerEmail }],
+    })
+    if (!matched('R17', 'alwaysSetPhone=true does not repoint email on a phone match', data, victim.id)) return
+
+    const enduser = await pollEnduser(victim.id, e => e.email === attackerEmail)
+    record('R17', 'alwaysSetPhone=true does not repoint email on a phone match', enduser?.email === originalEmail,
+      `email=${enduser?.email || '(unset)'} expected=${originalEmail}`)
+  })
+
+  // ---------------------------------------------------------------------------------------------
+  // R18 — parsed as === 'true', matching createNewEnduser / matchByName. Any other value, including
+  // a truthy-looking one, keeps today's behavior.
+  // ---------------------------------------------------------------------------------------------
+  await runScenario('R18', 'alwaysSetPhone=1 does not enable the opt-in', async () => {
+    const email = emailFor('r18')
+    const originalPhone = nextPhone()
+    const victim = await makeVictim('r18', { email, phone: originalPhone })
+    const intakePhone = nextPhone()
+
+    const { data } = await postWebhook({
+      label: 'r18',
+      finalized: true,
+      alwaysSetPhone: '1',
+      answers: [{ key: 'email', value: email }, { key: 'phone', value: intakePhone }],
+    })
+    if (!matched('R18', 'alwaysSetPhone=1 does not enable the opt-in', data, victim.id)) return
+
+    const enduser = await pollEnduser(victim.id, e => e.phone === intakePhone)
+    record('R18', 'alwaysSetPhone=1 does not enable the opt-in', enduser?.phone === originalPhone,
+      `phone=${enduser?.phone || '(unset)'} expected=${originalPhone}`)
+  })
+
+  // ---------------------------------------------------------------------------------------------
+  // G18 — the opt-in is a per-REQUEST allow, exactly like G11 (?enduserId=) and R15 (the Stripe
+  // grace): the response still records that it attached to a pre-existing patient, so the other
+  // consumer of that flag — save_enduser_updates_for_form_response, reached by later staff edits —
+  // stays protected.
+  // ---------------------------------------------------------------------------------------------
+  await runScenario('G18', 'alwaysSetPhone does not clear the stored flag', async () => {
+    const email = emailFor('g18')
+    const victim = await makeVictim('g18', { email, phone: nextPhone() })
+    const intakePhone = nextPhone()
+
+    const { data } = await postWebhook({
+      label: 'g18',
+      finalized: true,
+      alwaysSetPhone: 'true',
+      answers: [{ key: 'email', value: email }, { key: 'phone', value: intakePhone }],
+    })
+    if (!matched('G18', 'alwaysSetPhone does not clear the stored flag', data, victim.id)) return
+
+    const enduser = await pollEnduser(victim.id, e => e.phone === intakePhone)
+    record('G18', 'flagged webhook landed the phone (probe precondition)', enduser?.phone === intakePhone,
+      `phone=${enduser?.phone || '(unset)'} expected=${intakePhone}`)
+
+    if (!data.formResponseId) {
+      skip('G18', 'alwaysSetPhone does not clear the stored flag', 'webhook returned no formResponseId')
+      return
+    }
+    const response: any = await sdk.api.form_responses.getOne(data.formResponseId).catch(() => null)
+    if (!response) {
+      skip('G18', 'alwaysSetPhone does not clear the stored flag', 'form response not readable')
+    } else if (response.authFieldIntakeDisabled === undefined) {
+      // deliberately absent from schema.ts; if reads project it away there is nothing to assert here
+      skip('G18', 'alwaysSetPhone does not clear the stored flag', 'authFieldIntakeDisabled not exposed on read')
+    } else {
+      record('G18', 'alwaysSetPhone does not clear the stored flag', response.authFieldIntakeDisabled === true,
+        `authFieldIntakeDisabled=${response.authFieldIntakeDisabled} expected=true`)
+    }
+  })
+
+  // ---------------------------------------------------------------------------------------------
+  // R19 — nothing about the opt-in is recorded on the response, so a later webhook for the same
+  // responder_uuid that omits it is blocked as usual. The earlier webhook here must be the DRAFT:
+  // once a response is submitted the handler returns 'Already submitted' before reaching the lock,
+  // which would make a finalized-then-finalized pair pass no matter what the implementation did.
+  // ---------------------------------------------------------------------------------------------
+  await runScenario('R19', 'alwaysSetPhone on an earlier webhook does not unlock a later one', async () => {
+    const email = emailFor('r19')
+    const originalPhone = nextPhone()
+    const victim = await makeVictim('r19', { email, phone: originalPhone })
+    const intakePhone = nextPhone()
+
+    // draft WITH the flag: matches the pre-existing patient by email and stamps the response
+    const draft = await postWebhook({
+      label: 'r19',
+      finalized: false,
+      alwaysSetPhone: 'true',
+      answers: [{ key: 'email', value: email }],
+    })
+    if (draft.status !== 200) {
+      record('R19', 'alwaysSetPhone on an earlier webhook does not unlock a later one', false,
+        `draft webhook returned ${draft.status}`)
+      return
+    }
+
+    // finalize WITHOUT the flag — if the opt-in were inherited from the response, this would land
+    const { data } = await postWebhook({
+      label: 'r19',
+      finalized: true,
+      answers: [{ key: 'email', value: email }, { key: 'phone', value: intakePhone }],
+    })
+    if (!matched('R19', 'alwaysSetPhone on an earlier webhook does not unlock a later one', data, victim.id)) return
+
+    const enduser = await pollEnduser(victim.id, e => e.phone === intakePhone)
+    record('R19', 'alwaysSetPhone on an earlier webhook does not unlock a later one',
+      enduser?.phone === originalPhone,
+      `phone=${enduser?.phone || '(unset)'} expected=${originalPhone}`)
+  })
+
   // ---------------------------------------------------------------------------------------------
   // Report
   // ---------------------------------------------------------------------------------------------

package/src/tests/api_tests/security/register_business_id_injection.test.ts

@@ -65,7 +65,7 @@ export const register_business_id_injection_tests = async ({ sdk } : { sdk: Sess
   // An anonymous caller registers with businessId set to the victim org. On vulnerable
   // code this creates a Business user INSIDE the victim org that no one invited.
   // ==================================================================================
-  const email1 = `security+reg-inject-${Date.now()}@wearehackerone.com`
+  const email1 = `dontsend+reg-inject-${Date.now()}@tellescope.com`
 
   const before = await sdk.api.users.getOne({ email: email1 }).catch(() => null)
   assert(before === null, `precondition failed: ${email1} already present in victim org`, 'precondition: victim org has no such user')
@@ -95,7 +95,7 @@ export const register_business_id_injection_tests = async ({ sdk } : { sdk: Sess
   // businessId. On vulnerable code the scoped duplicate check misses the org-less record,
   // so a SECOND user record for the same email is created inside the victim org.
   // ==================================================================================
-  const email2 = `security+reg-dup-${Date.now()}@wearehackerone.com`
+  const email2 = `dontsend+reg-dup-${Date.now()}@tellescope.com`
 
   const resRoot = await post('/v1/users/register', { email: email2, password, termsVersion })
   console.log(`   register(no businessId) -> HTTP ${resRoot.status}`)

package/src/tests/api_tests/security/rich-text-answer-sanitized-on-write.test.ts

@@ -5,6 +5,7 @@ import {
   assert_checks,
   Check,
   setup_isolated_tenant,
+  IsolatedSuite,
 } from "../../setup_isolated"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
@@ -182,6 +183,9 @@ export const rich_text_answer_sanitized_on_write_tests = async () => {
   assert_checks('Rich Text answers sanitized on write', await rich_text_answer_sanitized_on_write_checks())
 }
 
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = { name: 'Rich Text answers sanitized on write', run: rich_text_answer_sanitized_on_write_checks }
+
 // Allow running this test file independently
 if (require.main === module) {
   console.log(`🌐 Using API URL: ${host}`)

package/src/tests/api_tests/session_for_join_link.test.ts

@@ -0,0 +1,99 @@
+require('source-map-support').install();
+
+import {
+  assert_checks,
+  Check,
+  setup_isolated_tenant,
+  IsolatedSuite,
+} from "../setup_isolated"
+import { EnduserSession } from "../../sdk"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
+// the session is confined to the video-join-link paths, so read the identity from the token itself
+const enduserIdFromAuthToken = (authToken: string): string => (
+  JSON.parse(Buffer.from(authToken.split('.')[1], 'base64url').toString()).id
+)
+
+/**
+ * `calendar_events.session_for_join_link` must log in as the attendee who holds the token, not the
+ * first enduser attendee on the event.
+ */
+export const session_for_join_link_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+
+  try {
+    tenant = await setup_isolated_tenant({
+      name: `join link ${RAND()}`,
+      users: [{ isAdmin: true }],
+      apiKeys: 0,
+    })
+    const { sdk, businessId } = tenant
+
+    const [enduserA, enduserB] = await Promise.all([
+      sdk.api.endusers.createOne({ email: `join_a_${RAND()}@test.tellescope.com` }),
+      sdk.api.endusers.createOne({ email: `join_b_${RAND()}@test.tellescope.com` }),
+    ])
+
+    const tokenA = `join-a-${RAND()}${RAND()}`
+    const tokenB = `join-b-${RAND()}${RAND()}`
+    const event = await sdk.api.calendar_events.createOne({
+      title: 'join link', durationInMinutes: 30, startTimeInMS: Date.now() + 3600_000,
+      attendees: [
+        { type: 'enduser', id: enduserA.id, joinLinkToken: tokenA },
+        { type: 'enduser', id: enduserB.id, joinLinkToken: tokenB },
+      ],
+    })
+
+    const sessionFor = (token: string) => (
+      new EnduserSession({ host, businessId }).api.calendar_events.session_for_join_link({ token })
+    )
+
+    const resultB = await sessionFor(tokenB)
+    const idB = enduserIdFromAuthToken(resultB.authToken)
+    record(
+      "second attendee's token logs in as the second attendee",
+      idB === enduserB.id && resultB.eventId === event.id,
+      `expected ${enduserB.id}, got ${idB}${idB === enduserA.id ? ' (the first attendee)' : ''}`,
+    )
+
+    const resultA = await sessionFor(tokenA)
+    const idA = enduserIdFromAuthToken(resultA.authToken)
+    record(
+      "first attendee's token logs in as the first attendee",
+      idA === enduserA.id && resultA.eventId === event.id,
+      `expected ${enduserA.id}, got ${idA}`,
+    )
+  } finally {
+    // teardown before anything asserts — assert calls process.exit, which skips pending finallys
+    if (tenant) { try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) } }
+  }
+
+  return checks
+}
+
+export const session_for_join_link_tests = async () => {
+  assert_checks('session_for_join_link attendee', await session_for_join_link_checks())
+}
+
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = { name: 'session_for_join_link attendee', run: session_for_join_link_checks }
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  session_for_join_link_tests()
+    .then(() => {
+      console.log("✅ session_for_join_link test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ session_for_join_link test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/set_fields_order_templates.test.ts

@@ -22,6 +22,7 @@ const buildSetFieldsAction = (prefix: string) => ({
       { name: `${prefix}_tracking`,   value: '{{order.tracking}}',   type: 'Custom Value' as const },
       { name: `${prefix}_carrier`,    value: '{{order.carrier}}',    type: 'Custom Value' as const },
       { name: `${prefix}_sku`,        value: '{{order.sku}}',        type: 'Custom Value' as const },
+      { name: `${prefix}_bookingLink`, value: '{{order.bookingLink}}', type: 'Custom Value' as const },
       { name: `${prefix}_externalId`, value: '{{order.externalId}}', type: 'Custom Value' as const },
       { name: `${prefix}_id`,         value: '{{order.id}}',         type: 'Custom Value' as const },
       { name: `${prefix}_protocol`,   value: '{{order.protocol}}',   type: 'Custom Value' as const },
@@ -55,6 +56,7 @@ const direct_order_creation_block = async ({ sdk }: { sdk: Session }) => {
       carrier: 'UPS',
       sku: 'SKU-A',
       protocol: 'wl1',
+      bookingLink: 'https://booking.example.com/a-123',
     })
     createdOrderId = order.id
 
@@ -70,6 +72,7 @@ const direct_order_creation_block = async ({ sdk }: { sdk: Session }) => {
         && e.fields?.pharmacy_sku === 'SKU-A'
         && e.fields?.pharmacy_externalId === 'EXT-A-123'
         && e.fields?.pharmacy_protocol === 'wl1'
+        && e.fields?.pharmacy_bookingLink === 'https://booking.example.com/a-123'
         && typeof e.fields?.pharmacy_id === 'string'
         && (e.fields?.pharmacy_id as string).length > 0
         && (e.fields?.pharmacy_id as string) === order.id
@@ -86,6 +89,7 @@ const direct_order_creation_block = async ({ sdk }: { sdk: Session }) => {
       pharmacy_externalId: beforeNonMatch.fields?.pharmacy_externalId,
       pharmacy_id: beforeNonMatch.fields?.pharmacy_id,
       pharmacy_protocol: beforeNonMatch.fields?.pharmacy_protocol,
+      pharmacy_bookingLink: beforeNonMatch.fields?.pharmacy_bookingLink,
     }
 
     const nonMatching = await sdk.api.enduser_orders.createOne({
@@ -114,6 +118,7 @@ const direct_order_creation_block = async ({ sdk }: { sdk: Session }) => {
         && e.fields?.pharmacy_externalId === snapshot.pharmacy_externalId
         && e.fields?.pharmacy_id === snapshot.pharmacy_id
         && e.fields?.pharmacy_protocol === snapshot.pharmacy_protocol
+        && e.fields?.pharmacy_bookingLink === snapshot.pharmacy_bookingLink
       )}
     )
   } finally {
@@ -130,6 +135,8 @@ const beluga_webhook_block = async ({ sdk }: { sdk: Session }) => {
 
   const webhookUrl = `${host}/v1/webhooks/beluga`
   const externalOrderId = `EXT-B-${Date.now()}`
+  const noLinkOrderId = `EXT-B-NOLINK-${Date.now()}`
+  const bookingLink = 'https://booking.example.com/beluga-results'
 
   const enduser = await sdk.api.endusers.createOne({})
   const form = await sdk.api.forms.createOne({ title: 'Order Templates Beluga Form' })
@@ -139,6 +146,16 @@ const beluga_webhook_block = async ({ sdk }: { sdk: Session }) => {
     formTitle: form.title,
   })
 
+  // The no-bookingLink case needs its OWN enduser: a fired trigger is throttled per
+  // (trigger, enduser) for a minute, so a second order for the same enduser would be
+  // silently skipped and the assertion would pass vacuously.
+  const noLinkEnduser = await sdk.api.endusers.createOne({})
+  const noLinkFormResponse = await sdk.api.form_responses.createOne({
+    formId: form.id,
+    enduserId: noLinkEnduser.id,
+    formTitle: form.title,
+  })
+
   const trigger = await sdk.api.automation_triggers.createOne({
     title: TRIGGER_TITLE_BLOCK_B,
     status: 'Active',
@@ -153,6 +170,13 @@ const beluga_webhook_block = async ({ sdk }: { sdk: Session }) => {
     action: buildSetFieldsAction('pharmacy'),
   })
 
+  const resultsTrigger = await sdk.api.automation_triggers.createOne({
+    title: `${TRIGGER_TITLE_BLOCK_B} (Results Available)`,
+    status: 'Active',
+    event: { type: 'Order Status Equals', info: { source: 'Beluga', status: 'Results Available' } },
+    action: buildSetFieldsAction('pharmacy'),
+  })
+
   try {
     // Step 1: PHARMACY_ORDER_SHIPPED
     const shippedRes = await fetch(webhookUrl, {
@@ -179,9 +203,10 @@ const beluga_webhook_block = async ({ sdk }: { sdk: Session }) => {
         && e.fields?.pharmacy_externalId === externalOrderId
         && typeof e.fields?.pharmacy_id === 'string'
         && (e.fields?.pharmacy_id as string).length > 0
-        // Webhook does not set sku/protocol -> default branch in helper -> ''
+        // Webhook does not set sku/protocol/bookingLink -> default branch in helper -> ''
         && e.fields?.pharmacy_sku === ''
         && e.fields?.pharmacy_protocol === ''
+        && e.fields?.pharmacy_bookingLink === ''
       )}
     )
 
@@ -207,24 +232,84 @@ const beluga_webhook_block = async ({ sdk }: { sdk: Session }) => {
         && e.fields?.pharmacy_externalId === externalOrderId
       )}
     )
+
+    // Step 3: LAB_ORDER_RESULTS with a bookingLink -> status 'Results Available'
+    const resultsRes = await fetch(webhookUrl, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        masterId: `tellescope_${formResponse.id}`,
+        event: 'LAB_ORDER_RESULTS',
+        orderId: externalOrderId,
+        bookingLink,
+      }),
+    })
+    assert(resultsRes.status === 200, `Beluga webhook (results) expected 200, got ${resultsRes.status}`)
+
+    await wait(undefined, 250)
+
+    await async_test(
+      "Block B: LAB_ORDER_RESULTS resolves {{order.bookingLink}} into an enduser field",
+      () => sdk.api.endusers.getOne(enduser.id),
+      { onResult: e => !!(
+           e.fields?.pharmacy_status === 'Results Available'
+        && e.fields?.pharmacy_bookingLink === bookingLink
+        && e.fields?.pharmacy_externalId === externalOrderId
+      )}
+    )
+
+    // Step 4: LAB_ORDER_RESULTS for a different enduser/order with NO bookingLink -> resolves to ''
+    const noLinkRes = await fetch(webhookUrl, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        masterId: `tellescope_${noLinkFormResponse.id}`,
+        event: 'LAB_ORDER_RESULTS',
+        orderId: noLinkOrderId,
+      }),
+    })
+    assert(noLinkRes.status === 200, `Beluga webhook (results, no link) expected 200, got ${noLinkRes.status}`)
+
+    await wait(undefined, 250)
+
+    await async_test(
+      "Block B: LAB_ORDER_RESULTS without a bookingLink resolves to ''",
+      () => sdk.api.endusers.getOne(noLinkEnduser.id),
+      { onResult: e => !!(
+           e.fields?.pharmacy_status === 'Results Available' // proves the trigger did fire
+        && e.fields?.pharmacy_externalId === noLinkOrderId
+        && e.fields?.pharmacy_bookingLink === ''
+      )}
+    )
+
+    await async_test(
+      "Block B: the other enduser's bookingLink is untouched by the empty-link order",
+      () => sdk.api.endusers.getOne(enduser.id),
+      { onResult: e => e.fields?.pharmacy_bookingLink === bookingLink }
+    )
   } finally {
     // Clean up the order created by the webhook
-    try {
-      const orders = await sdk.api.enduser_orders.getSome({
-        filter: { source: 'Beluga', externalId: externalOrderId } as any,
-      })
-      for (const o of orders) {
-        await sdk.api.enduser_orders.deleteOne(o.id).catch(console.error)
+    for (const externalId of [externalOrderId, noLinkOrderId]) {
+      try {
+        const orders = await sdk.api.enduser_orders.getSome({
+          filter: { source: 'Beluga', externalId } as any,
+        })
+        for (const o of orders) {
+          await sdk.api.enduser_orders.deleteOne(o.id).catch(console.error)
+        }
+      } catch (err) {
+        console.error(err)
       }
-    } catch (err) {
-      console.error(err)
     }
 
     await sdk.api.automation_triggers.deleteOne(trigger.id).catch(console.error)
     await sdk.api.automation_triggers.deleteOne(deliveredTrigger.id).catch(console.error)
+    await sdk.api.automation_triggers.deleteOne(resultsTrigger.id).catch(console.error)
     await sdk.api.form_responses.deleteOne(formResponse.id).catch(console.error)
+    await sdk.api.form_responses.deleteOne(noLinkFormResponse.id).catch(console.error)
     await sdk.api.forms.deleteOne(form.id).catch(console.error)
     await sdk.api.endusers.deleteOne(enduser.id).catch(console.error)
+    await sdk.api.endusers.deleteOne(noLinkEnduser.id).catch(console.error)
   }
 }