@tellescope/sdk 2.0.0-beta.1 → 2.0.0-beta.2

package/lib/cjs/tests/api_tests/security/formsort_webhook_auth_field_lock.test.js

@@ -111,6 +111,19 @@ var host = process.env.API_URL || 'http://localhost:8080';
  *   R14         both grace markers are load-bearing: neither source nor stripeCustomerId alone opens it
  *   R15         the grace is per-request — it does not clear the stored flag
  *
+ * ?alwaysSetPhone=true (CU-86e3k4ptv) is a second per-request override, narrower than ?enduserId=:
+ * it allows PHONE ONLY through the lock, on every finalized webhook, overwriting an existing and
+ * different number. Email — the password-reset channel this lock exists to protect — stays blocked.
+ *   G16 (GREEN) the flag overwrites an existing, different phone on a guessed match
+ *   G17 (GREEN) ...and in that same request the submitted email is still dropped
+ *   R16 (RED)   the identical request WITHOUT the flag leaves both phone and email blocked
+ *   R17 (RED)   the flag does not open email on a phone match either
+ *   R18 (RED)   only the literal string 'true' enables it — ?alwaysSetPhone=1 keeps the lock
+ *   G18 (GREEN) a flagged webhook still stamps authFieldIntakeDisabled on the response, so later
+ *               writes through save_enduser_updates_for_form_response stay blocked
+ *   R19 (RED)   it is request-scoped: a flag passed on an earlier webhook for the same
+ *               responder_uuid does not unlock a later one that omits it
+ *
  * The Stripe grace is deliberately confined to THIS endpoint, which is API-key authenticated. The
  * anonymous public-form path gets no exemption; that boundary is pinned by G28 in
  * public_endpoint_auth_field_lock.test.ts.
@@ -198,6 +211,8 @@ var formsort_webhook_auth_field_lock_tests = function (_a) {
                                         url.searchParams.set('enduserId', o.enduserId);
                                     if (o.createNewEnduser)
                                         url.searchParams.set('createNewEnduser', 'true');
+                                    if (o.alwaysSetPhone !== undefined)
+                                        url.searchParams.set('alwaysSetPhone', o.alwaysSetPhone);
                                     return [4 /*yield*/, axios_1.default.post(url.toString(), { answers: o.answers, responder_uuid: uuidFor(o.label), finalized: o.finalized }, { validateStatus: function () { return true; } })
                                         // In-progress webhooks always return a bare 200 (the handler returns before the returnJSON
                                         // block), so `data` is only populated for finalized calls.
@@ -1070,7 +1085,10 @@ var formsort_webhook_auth_field_lock_tests = function (_a) {
                             });
                         }); })
                         // ---------------------------------------------------------------------------------------------
-                        // Report
+                        // G16 — ?alwaysSetPhone=true: the opt-in allows phone through the lock on a GUESSED match (the
+                        // path R2 blocks), overwriting a phone that is already stored and different. Phone is also the
+                        // only field this submission changes, which exercises the "at least one update provided" guard —
+                        // if the delete happened before that guard, nothing would be written at all.
                         // ---------------------------------------------------------------------------------------------
                     ];
                 case 20:
@@ -1081,6 +1099,373 @@ var formsort_webhook_auth_field_lock_tests = function (_a) {
                     // after the window closes) stays protected.
                     // ---------------------------------------------------------------------------------------------
                     _h.sent();
+                    // ---------------------------------------------------------------------------------------------
+                    // G16 — ?alwaysSetPhone=true: the opt-in allows phone through the lock on a GUESSED match (the
+                    // path R2 blocks), overwriting a phone that is already stored and different. Phone is also the
+                    // only field this submission changes, which exercises the "at least one update provided" guard —
+                    // if the delete happened before that guard, nothing would be written at all.
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, runScenario('G16', 'alwaysSetPhone=true overwrites an existing phone on a guessed match', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var email, originalPhone, victim, intakePhone, data, enduser;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        email = emailFor('g16');
+                                        originalPhone = nextPhone();
+                                        return [4 /*yield*/, makeVictim('g16', { email: email, phone: originalPhone })];
+                                    case 1:
+                                        victim = _a.sent();
+                                        intakePhone = nextPhone();
+                                        return [4 /*yield*/, postWebhook({
+                                                label: 'g16',
+                                                finalized: true,
+                                                alwaysSetPhone: 'true',
+                                                answers: [{ key: 'email', value: email }, { key: 'phone', value: intakePhone }],
+                                            })];
+                                    case 2:
+                                        data = (_a.sent()).data;
+                                        if (!matched('G16', 'alwaysSetPhone=true overwrites an existing phone on a guessed match', data, victim.id))
+                                            return [2 /*return*/];
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.phone === intakePhone; })];
+                                    case 3:
+                                        enduser = _a.sent();
+                                        record('G16', 'alwaysSetPhone=true overwrites an existing phone on a guessed match', (enduser === null || enduser === void 0 ? void 0 : enduser.phone) === intakePhone, "phone=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.phone) || '(unset)', " expected=").concat(intakePhone));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // G17 — the same request, with BOTH a new phone and a different email, so the two halves of the
+                        // rule are observed together: phone lands, email does not. Shaped like R3 (a draft formed by a
+                        // guess, finalized through the sticky flag) because that is the only resolution path where the
+                        // submitted email can differ from the stored one while the patient still matches.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 21:
+                    // ---------------------------------------------------------------------------------------------
+                    // G16 — ?alwaysSetPhone=true: the opt-in allows phone through the lock on a GUESSED match (the
+                    // path R2 blocks), overwriting a phone that is already stored and different. Phone is also the
+                    // only field this submission changes, which exercises the "at least one update provided" guard —
+                    // if the delete happened before that guard, nothing would be written at all.
+                    // ---------------------------------------------------------------------------------------------
+                    _h.sent();
+                    // ---------------------------------------------------------------------------------------------
+                    // G17 — the same request, with BOTH a new phone and a different email, so the two halves of the
+                    // rule are observed together: phone lands, email does not. Shaped like R3 (a draft formed by a
+                    // guess, finalized through the sticky flag) because that is the only resolution path where the
+                    // submitted email can differ from the stored one while the patient still matches.
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, runScenario('G17', 'alwaysSetPhone=true writes phone and still drops email', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var originalEmail, originalPhone, victim, attackerEmail, intakePhone, data, enduser;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        originalEmail = emailFor('g17');
+                                        originalPhone = nextPhone();
+                                        return [4 /*yield*/, makeVictim('g17', { email: originalEmail, phone: originalPhone })];
+                                    case 1:
+                                        victim = _a.sent();
+                                        attackerEmail = emailFor('g17-attacker');
+                                        intakePhone = nextPhone();
+                                        // draft matches the pre-existing patient by phone -> authFieldIntakeDisabled is stamped on it
+                                        return [4 /*yield*/, postWebhook({ label: 'g17', finalized: false, answers: [{ key: 'phone', value: originalPhone }] })];
+                                    case 2:
+                                        // draft matches the pre-existing patient by phone -> authFieldIntakeDisabled is stamped on it
+                                        _a.sent();
+                                        return [4 /*yield*/, postWebhook({
+                                                label: 'g17',
+                                                finalized: true,
+                                                alwaysSetPhone: 'true',
+                                                answers: [{ key: 'phone', value: intakePhone }, { key: 'email', value: attackerEmail }],
+                                            })];
+                                    case 3:
+                                        data = (_a.sent()).data;
+                                        if (!matched('G17', 'alwaysSetPhone=true writes phone and still drops email', data, victim.id))
+                                            return [2 /*return*/];
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.phone === intakePhone; })];
+                                    case 4:
+                                        enduser = _a.sent();
+                                        record('G17', 'alwaysSetPhone=true writes phone through the sticky flag', (enduser === null || enduser === void 0 ? void 0 : enduser.phone) === intakePhone, "phone=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.phone) || '(unset)', " expected=").concat(intakePhone));
+                                        record('G17', 'alwaysSetPhone=true leaves email blocked in the same request', (enduser === null || enduser === void 0 ? void 0 : enduser.email) === originalEmail, "email=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.email) || '(unset)', " expected=").concat(originalEmail));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // R16 — the control for G17: byte-identical request without the flag. Both fields stay blocked,
+                        // i.e. the default behavior is unchanged.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 22:
+                    // ---------------------------------------------------------------------------------------------
+                    // G17 — the same request, with BOTH a new phone and a different email, so the two halves of the
+                    // rule are observed together: phone lands, email does not. Shaped like R3 (a draft formed by a
+                    // guess, finalized through the sticky flag) because that is the only resolution path where the
+                    // submitted email can differ from the stored one while the patient still matches.
+                    // ---------------------------------------------------------------------------------------------
+                    _h.sent();
+                    // ---------------------------------------------------------------------------------------------
+                    // R16 — the control for G17: byte-identical request without the flag. Both fields stay blocked,
+                    // i.e. the default behavior is unchanged.
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, runScenario('R16', 'without the flag the same request blocks phone and email', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var originalEmail, originalPhone, victim, attackerEmail, intakePhone, data, enduser;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        originalEmail = emailFor('r16');
+                                        originalPhone = nextPhone();
+                                        return [4 /*yield*/, makeVictim('r16', { email: originalEmail, phone: originalPhone })];
+                                    case 1:
+                                        victim = _a.sent();
+                                        attackerEmail = emailFor('r16-attacker');
+                                        intakePhone = nextPhone();
+                                        return [4 /*yield*/, postWebhook({ label: 'r16', finalized: false, answers: [{ key: 'phone', value: originalPhone }] })];
+                                    case 2:
+                                        _a.sent();
+                                        return [4 /*yield*/, postWebhook({
+                                                label: 'r16',
+                                                finalized: true,
+                                                answers: [{ key: 'phone', value: intakePhone }, { key: 'email', value: attackerEmail }],
+                                            })];
+                                    case 3:
+                                        data = (_a.sent()).data;
+                                        if (!matched('R16', 'without the flag the same request blocks phone and email', data, victim.id))
+                                            return [2 /*return*/];
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.phone === intakePhone || e.email === attackerEmail; })];
+                                    case 4:
+                                        enduser = _a.sent();
+                                        record('R16', 'without the flag phone stays blocked', (enduser === null || enduser === void 0 ? void 0 : enduser.phone) === originalPhone, "phone=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.phone) || '(unset)', " expected=").concat(originalPhone));
+                                        record('R16', 'without the flag email stays blocked', (enduser === null || enduser === void 0 ? void 0 : enduser.email) === originalEmail, "email=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.email) || '(unset)', " expected=").concat(originalEmail));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // R17 — the flag is phone-only in BOTH match directions: matched on phone (R1's shape), the
+                        // submitted email must still not land.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 23:
+                    // ---------------------------------------------------------------------------------------------
+                    // R16 — the control for G17: byte-identical request without the flag. Both fields stay blocked,
+                    // i.e. the default behavior is unchanged.
+                    // ---------------------------------------------------------------------------------------------
+                    _h.sent();
+                    // ---------------------------------------------------------------------------------------------
+                    // R17 — the flag is phone-only in BOTH match directions: matched on phone (R1's shape), the
+                    // submitted email must still not land.
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, runScenario('R17', 'alwaysSetPhone=true does not repoint email on a phone match', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var originalEmail, phone, victim, attackerEmail, data, enduser;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        originalEmail = emailFor('r17');
+                                        phone = nextPhone();
+                                        return [4 /*yield*/, makeVictim('r17', { email: originalEmail, phone: phone })];
+                                    case 1:
+                                        victim = _a.sent();
+                                        attackerEmail = emailFor('r17-attacker');
+                                        return [4 /*yield*/, postWebhook({
+                                                label: 'r17',
+                                                finalized: true,
+                                                alwaysSetPhone: 'true',
+                                                answers: [{ key: 'phone', value: phone }, { key: 'email', value: attackerEmail }],
+                                            })];
+                                    case 2:
+                                        data = (_a.sent()).data;
+                                        if (!matched('R17', 'alwaysSetPhone=true does not repoint email on a phone match', data, victim.id))
+                                            return [2 /*return*/];
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.email === attackerEmail; })];
+                                    case 3:
+                                        enduser = _a.sent();
+                                        record('R17', 'alwaysSetPhone=true does not repoint email on a phone match', (enduser === null || enduser === void 0 ? void 0 : enduser.email) === originalEmail, "email=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.email) || '(unset)', " expected=").concat(originalEmail));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // R18 — parsed as === 'true', matching createNewEnduser / matchByName. Any other value, including
+                        // a truthy-looking one, keeps today's behavior.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 24:
+                    // ---------------------------------------------------------------------------------------------
+                    // R17 — the flag is phone-only in BOTH match directions: matched on phone (R1's shape), the
+                    // submitted email must still not land.
+                    // ---------------------------------------------------------------------------------------------
+                    _h.sent();
+                    // ---------------------------------------------------------------------------------------------
+                    // R18 — parsed as === 'true', matching createNewEnduser / matchByName. Any other value, including
+                    // a truthy-looking one, keeps today's behavior.
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, runScenario('R18', 'alwaysSetPhone=1 does not enable the opt-in', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var email, originalPhone, victim, intakePhone, data, enduser;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        email = emailFor('r18');
+                                        originalPhone = nextPhone();
+                                        return [4 /*yield*/, makeVictim('r18', { email: email, phone: originalPhone })];
+                                    case 1:
+                                        victim = _a.sent();
+                                        intakePhone = nextPhone();
+                                        return [4 /*yield*/, postWebhook({
+                                                label: 'r18',
+                                                finalized: true,
+                                                alwaysSetPhone: '1',
+                                                answers: [{ key: 'email', value: email }, { key: 'phone', value: intakePhone }],
+                                            })];
+                                    case 2:
+                                        data = (_a.sent()).data;
+                                        if (!matched('R18', 'alwaysSetPhone=1 does not enable the opt-in', data, victim.id))
+                                            return [2 /*return*/];
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.phone === intakePhone; })];
+                                    case 3:
+                                        enduser = _a.sent();
+                                        record('R18', 'alwaysSetPhone=1 does not enable the opt-in', (enduser === null || enduser === void 0 ? void 0 : enduser.phone) === originalPhone, "phone=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.phone) || '(unset)', " expected=").concat(originalPhone));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // G18 — the opt-in is a per-REQUEST allow, exactly like G11 (?enduserId=) and R15 (the Stripe
+                        // grace): the response still records that it attached to a pre-existing patient, so the other
+                        // consumer of that flag — save_enduser_updates_for_form_response, reached by later staff edits —
+                        // stays protected.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 25:
+                    // ---------------------------------------------------------------------------------------------
+                    // R18 — parsed as === 'true', matching createNewEnduser / matchByName. Any other value, including
+                    // a truthy-looking one, keeps today's behavior.
+                    // ---------------------------------------------------------------------------------------------
+                    _h.sent();
+                    // ---------------------------------------------------------------------------------------------
+                    // G18 — the opt-in is a per-REQUEST allow, exactly like G11 (?enduserId=) and R15 (the Stripe
+                    // grace): the response still records that it attached to a pre-existing patient, so the other
+                    // consumer of that flag — save_enduser_updates_for_form_response, reached by later staff edits —
+                    // stays protected.
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, runScenario('G18', 'alwaysSetPhone does not clear the stored flag', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var email, victim, intakePhone, data, enduser, response;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        email = emailFor('g18');
+                                        return [4 /*yield*/, makeVictim('g18', { email: email, phone: nextPhone() })];
+                                    case 1:
+                                        victim = _a.sent();
+                                        intakePhone = nextPhone();
+                                        return [4 /*yield*/, postWebhook({
+                                                label: 'g18',
+                                                finalized: true,
+                                                alwaysSetPhone: 'true',
+                                                answers: [{ key: 'email', value: email }, { key: 'phone', value: intakePhone }],
+                                            })];
+                                    case 2:
+                                        data = (_a.sent()).data;
+                                        if (!matched('G18', 'alwaysSetPhone does not clear the stored flag', data, victim.id))
+                                            return [2 /*return*/];
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.phone === intakePhone; })];
+                                    case 3:
+                                        enduser = _a.sent();
+                                        record('G18', 'flagged webhook landed the phone (probe precondition)', (enduser === null || enduser === void 0 ? void 0 : enduser.phone) === intakePhone, "phone=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.phone) || '(unset)', " expected=").concat(intakePhone));
+                                        if (!data.formResponseId) {
+                                            skip('G18', 'alwaysSetPhone does not clear the stored flag', 'webhook returned no formResponseId');
+                                            return [2 /*return*/];
+                                        }
+                                        return [4 /*yield*/, sdk.api.form_responses.getOne(data.formResponseId).catch(function () { return null; })];
+                                    case 4:
+                                        response = _a.sent();
+                                        if (!response) {
+                                            skip('G18', 'alwaysSetPhone does not clear the stored flag', 'form response not readable');
+                                        }
+                                        else if (response.authFieldIntakeDisabled === undefined) {
+                                            // deliberately absent from schema.ts; if reads project it away there is nothing to assert here
+                                            skip('G18', 'alwaysSetPhone does not clear the stored flag', 'authFieldIntakeDisabled not exposed on read');
+                                        }
+                                        else {
+                                            record('G18', 'alwaysSetPhone does not clear the stored flag', response.authFieldIntakeDisabled === true, "authFieldIntakeDisabled=".concat(response.authFieldIntakeDisabled, " expected=true"));
+                                        }
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // R19 — nothing about the opt-in is recorded on the response, so a later webhook for the same
+                        // responder_uuid that omits it is blocked as usual. The earlier webhook here must be the DRAFT:
+                        // once a response is submitted the handler returns 'Already submitted' before reaching the lock,
+                        // which would make a finalized-then-finalized pair pass no matter what the implementation did.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 26:
+                    // ---------------------------------------------------------------------------------------------
+                    // G18 — the opt-in is a per-REQUEST allow, exactly like G11 (?enduserId=) and R15 (the Stripe
+                    // grace): the response still records that it attached to a pre-existing patient, so the other
+                    // consumer of that flag — save_enduser_updates_for_form_response, reached by later staff edits —
+                    // stays protected.
+                    // ---------------------------------------------------------------------------------------------
+                    _h.sent();
+                    // ---------------------------------------------------------------------------------------------
+                    // R19 — nothing about the opt-in is recorded on the response, so a later webhook for the same
+                    // responder_uuid that omits it is blocked as usual. The earlier webhook here must be the DRAFT:
+                    // once a response is submitted the handler returns 'Already submitted' before reaching the lock,
+                    // which would make a finalized-then-finalized pair pass no matter what the implementation did.
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, runScenario('R19', 'alwaysSetPhone on an earlier webhook does not unlock a later one', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var email, originalPhone, victim, intakePhone, draft, data, enduser;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        email = emailFor('r19');
+                                        originalPhone = nextPhone();
+                                        return [4 /*yield*/, makeVictim('r19', { email: email, phone: originalPhone })];
+                                    case 1:
+                                        victim = _a.sent();
+                                        intakePhone = nextPhone();
+                                        return [4 /*yield*/, postWebhook({
+                                                label: 'r19',
+                                                finalized: false,
+                                                alwaysSetPhone: 'true',
+                                                answers: [{ key: 'email', value: email }],
+                                            })];
+                                    case 2:
+                                        draft = _a.sent();
+                                        if (draft.status !== 200) {
+                                            record('R19', 'alwaysSetPhone on an earlier webhook does not unlock a later one', false, "draft webhook returned ".concat(draft.status));
+                                            return [2 /*return*/];
+                                        }
+                                        return [4 /*yield*/, postWebhook({
+                                                label: 'r19',
+                                                finalized: true,
+                                                answers: [{ key: 'email', value: email }, { key: 'phone', value: intakePhone }],
+                                            })];
+                                    case 3:
+                                        data = (_a.sent()).data;
+                                        if (!matched('R19', 'alwaysSetPhone on an earlier webhook does not unlock a later one', data, victim.id))
+                                            return [2 /*return*/];
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.phone === intakePhone; })];
+                                    case 4:
+                                        enduser = _a.sent();
+                                        record('R19', 'alwaysSetPhone on an earlier webhook does not unlock a later one', (enduser === null || enduser === void 0 ? void 0 : enduser.phone) === originalPhone, "phone=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.phone) || '(unset)', " expected=").concat(originalPhone));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // Report
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 27:
+                    // ---------------------------------------------------------------------------------------------
+                    // R19 — nothing about the opt-in is recorded on the response, so a later webhook for the same
+                    // responder_uuid that omits it is blocked as usual. The earlier webhook here must be the DRAFT:
+                    // once a response is submitted the handler returns 'Already submitted' before reaching the lock,
+                    // which would make a finalized-then-finalized pair pass no matter what the implementation did.
+                    // ---------------------------------------------------------------------------------------------
+                    _h.sent();
                     failures = results.filter(function (r) { return !r.ok; });
                     skipped = results.filter(function (r) { return !!r.skipped; });
                     console.log('');
@@ -1093,69 +1478,69 @@ var formsort_webhook_auth_field_lock_tests = function (_a) {
                     console.log("   \u2514\u2500 ".concat(results.length - failures.length, "/").concat(results.length, " passed, ").concat(skipped.length, " skipped, ").concat(failures.length, " failed"));
                     console.log('');
                     _b = 0, createdFormIds_1 = createdFormIds;
-                    _h.label = 21;
-                case 21:
-                    if (!(_b < createdFormIds_1.length)) return [3 /*break*/, 27];
+                    _h.label = 28;
+                case 28:
+                    if (!(_b < createdFormIds_1.length)) return [3 /*break*/, 34];
                     formId = createdFormIds_1[_b];
                     return [4 /*yield*/, sdk.api.form_responses.getSome({ filter: { formId: formId } }).catch(function () { return []; })];
-                case 22:
+                case 29:
                     responses = _h.sent();
                     _c = 0, responses_1 = responses;
-                    _h.label = 23;
-                case 23:
-                    if (!(_c < responses_1.length)) return [3 /*break*/, 26];
+                    _h.label = 30;
+                case 30:
+                    if (!(_c < responses_1.length)) return [3 /*break*/, 33];
                     response = responses_1[_c];
                     return [4 /*yield*/, sdk.api.form_responses.deleteOne(response.id).catch(function () { return null; })];
-                case 24:
+                case 31:
                     _h.sent();
-                    _h.label = 25;
-                case 25:
+                    _h.label = 32;
+                case 32:
                     _c++;
-                    return [3 /*break*/, 23];
-                case 26:
+                    return [3 /*break*/, 30];
+                case 33:
                     _b++;
-                    return [3 /*break*/, 21];
-                case 27:
+                    return [3 /*break*/, 28];
+                case 34:
                     _d = 0, createdFormIds_2 = createdFormIds;
-                    _h.label = 28;
-                case 28:
-                    if (!(_d < createdFormIds_2.length)) return [3 /*break*/, 31];
+                    _h.label = 35;
+                case 35:
+                    if (!(_d < createdFormIds_2.length)) return [3 /*break*/, 38];
                     id = createdFormIds_2[_d];
                     return [4 /*yield*/, sdk.api.forms.deleteOne(id).catch(function () { return null; })];
-                case 29:
+                case 36:
                     _h.sent();
-                    _h.label = 30;
-                case 30:
+                    _h.label = 37;
+                case 37:
                     _d++;
-                    return [3 /*break*/, 28];
-                case 31:
+                    return [3 /*break*/, 35];
+                case 38:
                     uniqueEnduserIds = createdEnduserIds.filter(function (id, i) { return !!id && createdEnduserIds.indexOf(id) === i; });
                     _e = 0, uniqueEnduserIds_1 = uniqueEnduserIds;
-                    _h.label = 32;
-                case 32:
-                    if (!(_e < uniqueEnduserIds_1.length)) return [3 /*break*/, 35];
+                    _h.label = 39;
+                case 39:
+                    if (!(_e < uniqueEnduserIds_1.length)) return [3 /*break*/, 42];
                     id = uniqueEnduserIds_1[_e];
                     return [4 /*yield*/, sdk.api.endusers.deleteOne(id).catch(function () { return null; })];
-                case 33:
+                case 40:
                     _h.sent();
-                    _h.label = 34;
-                case 34:
+                    _h.label = 41;
+                case 41:
                     _e++;
-                    return [3 /*break*/, 32];
-                case 35:
+                    return [3 /*break*/, 39];
+                case 42:
                     _f = 0, createdApiKeyIds_1 = createdApiKeyIds;
-                    _h.label = 36;
-                case 36:
-                    if (!(_f < createdApiKeyIds_1.length)) return [3 /*break*/, 39];
+                    _h.label = 43;
+                case 43:
+                    if (!(_f < createdApiKeyIds_1.length)) return [3 /*break*/, 46];
                     id = createdApiKeyIds_1[_f];
                     return [4 /*yield*/, sdk.api.api_keys.deleteOne(id).catch(function () { return null; })];
-                case 37:
+                case 44:
                     _h.sent();
-                    _h.label = 38;
-                case 38:
+                    _h.label = 45;
+                case 45:
                     _f++;
-                    return [3 /*break*/, 36];
-                case 39:
+                    return [3 /*break*/, 43];
+                case 46:
                     // ---------------------------------------------------------------------------------------------
                     // Assert — single pass, last, so the full table above is always printed first.
                     // ---------------------------------------------------------------------------------------------