@tellescope/sdk 2.0.0-beta.1 → 2.0.0-beta.2

package/src/tests/api_tests/stripe_checkout_items.test.ts

@@ -0,0 +1,186 @@
+require('source-map-support').install();
+
+import {
+  assert_checks,
+  Check,
+  setup_isolated_tenant,
+  IsolatedSuite,
+} from "../setup_isolated"
+import { authenticate_enduser_via_token } from "../setup"
+import { EnduserSession } from "../../sdk"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
+const ENDUSER_RAW_IDS_MESSAGE = "stripePriceId and subscriptionPriceId are not supported for enduser sessions"
+const QUANTITY_MESSAGE = "quantity must be a whole number of at least 1"
+const EXACTLY_ONE_ID_MESSAGE = "Each items entry must specify exactly one of productId, stripePriceId, or subscriptionPriceId"
+// what the handler throws once a request is past every items guard and no Stripe account is
+// configured - the marker for "this cart was accepted, it only ran out of Stripe"
+const NO_STRIPE_MESSAGE = "Stripe Connection not found"
+
+/**
+ * The guards on the `items` parameter of products/prepare-stripe-checkout that run BEFORE any Stripe
+ * integration is resolved, so they are reachable without a Stripe account: the enduser rejection of
+ * raw Stripe price ids, the productIds/items exclusivity, the per-entry shape rules and the quantity
+ * validator.
+ *
+ * The quantity guards themselves (the cap of 99, the two "greater than 1" rejections) sit on the
+ * Stripe Custom branch and are pinned instead by the unit suite in
+ * packages/private/api/api/integrations/payments/stripe_line_items.test.ts, which needs no database
+ * and no Stripe account. Anything that creates or inspects a real Checkout session is manual QA.
+ */
+export const stripe_checkout_items_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+
+  try {
+    tenant = await setup_isolated_tenant({
+      name: `stripe items ${RAND()}`,
+      users: [{ isAdmin: true }],
+      apiKeys: 0,
+    })
+    const { sdk, businessId } = tenant
+
+    const product = await sdk.api.products.createOne({
+      title: `Checkout Item Product ${RAND()}`,
+      cost: { amount: 500, currency: 'USD' },
+      processor: 'Stripe',
+    })
+
+    const enduser = await sdk.api.endusers.createOne({ email: `items_${RAND()}@test.tellescope.com` })
+    const enduserSDK = new EnduserSession({ host, businessId })
+    await authenticate_enduser_via_token(sdk, enduserSDK, { id: enduser.id })
+
+    // returns the error message for a rejected request, or '' when the request succeeded
+    const errorFor = async (session: typeof sdk | typeof enduserSDK, args: any): Promise<string> => {
+      try {
+        await (session.api.products.prepare_stripe_checkout as any)(args)
+        return ''
+      } catch (err: any) {
+        return typeof err === 'string' ? err : (err?.message ?? JSON.stringify(err))
+      }
+    }
+
+    // ---- raw Stripe price ids are staff / API-key only ----
+    const enduserRawPrice = await errorFor(enduserSDK, { items: [{ stripePriceId: 'price_raw', quantity: 1 }] })
+    record(
+      'an enduser naming a raw stripePriceId is rejected',
+      enduserRawPrice === ENDUSER_RAW_IDS_MESSAGE,
+      `expected "${ENDUSER_RAW_IDS_MESSAGE}", got "${enduserRawPrice}"`,
+    )
+
+    const enduserRawSubscription = await errorFor(enduserSDK, { items: [{ subscriptionPriceId: 'price_sub', quantity: 1 }] })
+    record(
+      'an enduser naming a raw subscriptionPriceId is rejected',
+      enduserRawSubscription === ENDUSER_RAW_IDS_MESSAGE,
+      `expected "${ENDUSER_RAW_IDS_MESSAGE}", got "${enduserRawSubscription}"`,
+    )
+
+    // the rejection is about raw Stripe ids, not about items: a patient can still buy a Tellescope
+    // product at a quantity, and only runs out of road at the missing Stripe account
+    const enduserProduct = await errorFor(enduserSDK, { items: [{ productId: product.id, quantity: 2 }] })
+    record(
+      'an enduser naming a Tellescope productId is allowed through the guard',
+      enduserProduct === NO_STRIPE_MESSAGE,
+      `expected "${NO_STRIPE_MESSAGE}", got "${enduserProduct}"`,
+    )
+
+    // the same raw price from a staff session passes the guard
+    const userRawPrice = await errorFor(sdk, { items: [{ stripePriceId: 'price_raw', quantity: 1 }] })
+    record(
+      'a user session naming a raw stripePriceId is allowed through the guard',
+      userRawPrice === NO_STRIPE_MESSAGE,
+      `expected "${NO_STRIPE_MESSAGE}", got "${userRawPrice}"`,
+    )
+
+    // ---- productIds and items are mutually exclusive ----
+    const both = await errorFor(sdk, { productIds: [product.id], items: [{ productId: product.id, quantity: 1 }] })
+    record(
+      'passing both productIds and items is rejected',
+      both === "Pass either productIds or items, not both",
+      `expected the "not both" message, got "${both}"`,
+    )
+
+    const neither = await errorFor(sdk, {})
+    record(
+      'passing neither productIds nor items is rejected',
+      neither === "One of productIds or items is required",
+      `expected the "one of" message, got "${neither}"`,
+    )
+
+    // ---- per-entry shape ----
+    const noId = await errorFor(sdk, { items: [{ quantity: 1 }] })
+    record(
+      'an items entry naming no id is rejected',
+      noId === EXACTLY_ONE_ID_MESSAGE,
+      `expected the "exactly one" message, got "${noId}"`,
+    )
+
+    const twoIds = await errorFor(sdk, { items: [{ productId: product.id, stripePriceId: 'price_raw', quantity: 1 }] })
+    record(
+      'an items entry naming two ids is rejected',
+      twoIds === EXACTLY_ONE_ID_MESSAGE,
+      `expected the "exactly one" message, got "${twoIds}"`,
+    )
+
+    // unlike productIds, which silently drops ids it cannot find, items rejects the whole cart
+    const unknownId = '60398b0231a295e64f084fd9'
+    const unknown = await errorFor(sdk, { items: [{ productId: unknownId, quantity: 1 }] })
+    record(
+      'an items entry naming an unknown productId is rejected, naming the id',
+      unknown.includes(unknownId) && unknown.includes('No product found'),
+      `expected a "No product found for productId ${unknownId}", got "${unknown}"`,
+    )
+
+    // ---- quantity must be a whole number of at least 1 ----
+    // quantity: 0 is the one that nearly got away: build_validator returns 0 early for any isNumber
+    // field, so the schema validator cannot reject it and the guard in resolve_checkout_items is
+    // the only thing between a zero quantity and a Stripe line item
+    for (const quantity of [0, -1, 1.5]) {
+      const message = await errorFor(sdk, { items: [{ productId: product.id, quantity }] })
+      record(
+        `quantity ${quantity} is rejected`,
+        message.includes(QUANTITY_MESSAGE),
+        `expected a message containing "${QUANTITY_MESSAGE}", got "${message}"`,
+      )
+    }
+
+    // a productIds-only request still reaches the Stripe lookup exactly as before
+    const productIdsOnly = await errorFor(sdk, { productIds: [product.id] })
+    record(
+      'a productIds-only request is unaffected',
+      productIdsOnly === NO_STRIPE_MESSAGE,
+      `expected "${NO_STRIPE_MESSAGE}", got "${productIdsOnly}"`,
+    )
+  } finally {
+    // teardown before anything asserts — assert calls process.exit, which skips pending finallys
+    if (tenant) { try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) } }
+  }
+
+  return checks
+}
+
+export const stripe_checkout_items_tests = async () => {
+  assert_checks('prepare_stripe_checkout items guards', await stripe_checkout_items_checks())
+}
+
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = { name: 'prepare_stripe_checkout items guards', run: stripe_checkout_items_checks }
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  stripe_checkout_items_tests()
+    .then(() => {
+      console.log("✅ stripe_checkout_items test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ stripe_checkout_items test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/tickets_bulk_assign_from_queue.test.ts

@@ -5,6 +5,7 @@ import {
   assert_checks,
   Check,
   setup_isolated_tenant,
+  IsolatedSuite,
 } from "../setup_isolated"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
@@ -264,6 +265,9 @@ export const tickets_bulk_assign_from_queue_tests = async () => {
   assert_checks('Tickets bulk assign from queue', await tickets_bulk_assign_from_queue_checks())
 }
 
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = { name: 'Tickets bulk assign from queue', run: tickets_bulk_assign_from_queue_checks }
+
 // Allow running this test file independently
 if (require.main === module) {
   console.log(`🌐 Using API URL: ${host}`)

package/src/tests/api_tests/totp_mfa.test.ts

@@ -302,11 +302,16 @@ export const totp_mfa_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkN
     // the already-configured email method must keep working (no lockout)
     await set_allowed_mfa_methods(['authenticator'])
 
-    await async_test(
-      'E5. grace: configured email challenge still works after restriction',
-      () => sdkNonAdmin.api.users.generate_MFA_challenge({ method: 'email' }),
-      { shouldError: false, onResult: () => true }
-    )
+    // a successful challenge really emails the code, so only send it to a do-not-send address
+    if (NON_ADMIN_EMAIL.startsWith('dontsend') && NON_ADMIN_EMAIL.endsWith('@tellescope.com')) {
+      await async_test(
+        'E5. grace: configured email challenge still works after restriction',
+        () => sdkNonAdmin.api.users.generate_MFA_challenge({ method: 'email' }),
+        { shouldError: false, onResult: () => true }
+      )
+    } else {
+      console.log('   E5 skipped: NON_ADMIN_EMAIL is not a dontsend address, a challenge would send a real email')
+    }
 
     // cleanup E: clear restriction + disable email
     await clear_allowed_mfa_methods()

package/src/tests/api_tests/trigger_contains_matching.test.ts

@@ -4,6 +4,7 @@ import {
   assert_checks,
   Check,
   setup_isolated_tenant,
+  IsolatedSuite,
 } from "../setup_isolated"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
@@ -330,6 +331,9 @@ export const trigger_contains_matching_tests = async () => {
   assert_checks('Trigger contains title matching', await trigger_contains_matching_checks())
 }
 
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = { name: 'Trigger contains title matching', run: trigger_contains_matching_checks }
+
 // Allow running this test file independently
 if (require.main === module) {
   console.log(`🌐 Using API URL: ${host}`)

package/src/tests/api_tests/user_logs_restore_deleted.test.ts

@@ -5,6 +5,7 @@ import {
   assert_checks,
   Check,
   setup_isolated_tenant,
+  IsolatedSuite,
 } from "../setup_isolated"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
@@ -400,6 +401,9 @@ export const user_logs_restore_deleted_tests = async () => {
   assert_checks('user_logs restore_deleted', await user_logs_restore_deleted_checks())
 }
 
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = { name: 'user_logs restore_deleted', run: user_logs_restore_deleted_checks }
+
 // Allow running this test file independently
 if (require.main === module) {
   console.log(`🌐 Using API URL: ${host}`)