@tellescope/sdk 2.0.0-beta.1 → 2.0.0-beta.3

package/lib/esm/tests/api_tests/integrations_redacted.test.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"integrations_redacted.test.d.ts","sourceRoot":"","sources":["../../../../src/tests/api_tests/integrations_redacted.test.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAiBnC,eAAO,MAAM,2BAA2B;SAAwC,OAAO;iBAAe,OAAO;mBAsN5G,CAAA"}
+{"version":3,"file":"integrations_redacted.test.d.ts","sourceRoot":"","sources":["../../../../src/tests/api_tests/integrations_redacted.test.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,EACL,aAAa,EAEd,MAAM,mBAAmB,CAAA;AAqB1B,eAAO,MAAM,4BAA4B,QAAa,QAAQ,KAAK,EAAE,CAsRpE,CAAA;AAED,8CAA8C;AAC9C,eAAO,MAAM,2BAA2B,qBAEvC,CAAA;AAED,oGAAoG;AACpG,eAAO,MAAM,cAAc,EAAE,aAG5B,CAAA"}

package/lib/esm/tests/api_tests/integrations_redacted.test.js

@@ -35,11 +35,10 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
     }
 };
 require('source-map-support').install();
-import { Session } from "../../sdk";
-import { async_test, log_header, } from "@tellescope/testing";
-import { setup_tests } from "../setup";
 import { INTEGRATION_SENSITIVE_FIELDS } from "@tellescope/constants";
+import { assert_checks, setup_isolated_tenant, } from "../setup_isolated";
 var host = process.env.API_URL || 'http://localhost:8080';
+var RAND = function () { return Math.random().toString(36).slice(2, 10); };
 var hasNoSensitiveFields = function (integration) {
     for (var _i = 0, INTEGRATION_SENSITIVE_FIELDS_1 = INTEGRATION_SENSITIVE_FIELDS; _i < INTEGRATION_SENSITIVE_FIELDS_1.length; _i++) {
         var field = INTEGRATION_SENSITIVE_FIELDS_1[_i];
@@ -48,231 +47,325 @@ var hasNoSensitiveFields = function (integration) {
     }
     return true;
 };
-export var integrations_redacted_tests = function (_a) {
-    var sdk = _a.sdk, sdkNonAdmin = _a.sdkNonAdmin;
-    return __awaiter(void 0, void 0, void 0, function () {
-        var integrationId, sensitiveIntegrationId, created, sensitiveIntegration, error_1, error_2;
-        return __generator(this, function (_b) {
-            switch (_b.label) {
-                case 0:
-                    log_header("Integrations Redacted Endpoints Tests");
-                    integrationId = '';
-                    sensitiveIntegrationId = '';
-                    _b.label = 1;
-                case 1:
-                    _b.trys.push([1, , 27, 36]);
-                    return [4 /*yield*/, sdk.api.integrations.createOne({
-                            title: 'Test Redacted Integration',
-                            authentication: { type: 'oauth2', info: { access_token: 'test-access-token', refresh_token: 'test-refresh-token', scope: '', token_type: 'Bearer', expiry_date: new Date().getTime() } },
-                            webhooksSecret: 'super-secret-webhook',
-                            emailDisabled: false,
-                        })];
-                case 2:
-                    created = _b.sent();
-                    integrationId = created.id;
-                    // load_redacted as creator — verify integration is returned, no sensitive fields present
-                    return [4 /*yield*/, async_test("load_redacted as creator returns redacted integrations", function () { return sdk.api.integrations.load_redacted({}); }, { onResult: function (r) {
-                                var found = r.integrations.find(function (i) { return i.id === integrationId; });
-                                return !!found && hasNoSensitiveFields(found) && found.title === 'Test Redacted Integration';
-                            } })
-                        // load_redacted as non-creator — verify same integration visible and redacted
-                    ];
-                case 3:
-                    // load_redacted as creator — verify integration is returned, no sensitive fields present
-                    _b.sent();
+// integrations redaction / access-control coverage: load_redacted, the CREATOR_ONLY behaviour of
+// getOne / getSome, the update_settings allowlist (including dot-notation bypasses) and
+// connect_stripe's rejection of a caller-supplied accountId.
+//
+// Runs on its own provisioned tenant. The suite enumerates the organization's integrations to find
+// the two it created, which on the shared fixture meant reading every other concurrently running
+// suite's records (and, for one of them, racing a suite that deletes integrations by title). On a
+// tenant of its own the `.find(...)` filters match exactly the records created here.
+export var integrations_redacted_checks = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var checks, record, describe, errorMessage, expect_result, expect_rejected, tenant, integrationId, sensitiveIntegrationId, sdk_1, sdkNonAdmin_1, created, sensitiveIntegration, sdk, error_1, error_2, e_1;
+    return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0:
+                checks = [];
+                record = function (label, pass, detail) { return checks.push({ label: label, pass: pass, detail: detail }); };
+                describe = function (value) {
+                    if (value === undefined || value === null)
+                        return String(value);
+                    var stringified = JSON.stringify(value);
+                    return stringified === undefined ? String(value) : stringified;
+                };
+                errorMessage = function (e) { return (typeof (e === null || e === void 0 ? void 0 : e.message) === 'string' && e.message !== '' ? e.message : describe(e)); };
+                expect_result = function (label, fn, onResult) { return __awaiter(void 0, void 0, void 0, function () {
+                    var resolved, e_2, value;
+                    var _a;
+                    return __generator(this, function (_b) {
+                        switch (_b.label) {
+                            case 0:
+                                _b.trys.push([0, 2, , 3]);
+                                _a = {};
+                                return [4 /*yield*/, fn()];
+                            case 1:
+                                resolved = (_a.value = _b.sent(), _a);
+                                return [3 /*break*/, 3];
+                            case 2:
+                                e_2 = _b.sent();
+                                record(label, false, "rejected instead of resolving: ".concat(errorMessage(e_2)));
+                                return [2 /*return*/];
+                            case 3:
+                                value = resolved.value;
+                                try {
+                                    record(label, onResult(value), "result=".concat(describe(value)));
+                                }
+                                catch (predicateError) {
+                                    record(label, false, "predicate threw on result=".concat(describe(value), ": ").concat(errorMessage(predicateError)));
+                                }
+                                return [2 /*return*/];
+                        }
+                    });
+                }); };
+                expect_rejected = function (label, fn, onError) {
+                    if (onError === void 0) { onError = function () { return true; }; }
+                    return __awaiter(void 0, void 0, void 0, function () {
+                        var rejection, unexpected, e_3;
+                        return __generator(this, function (_a) {
+                            switch (_a.label) {
+                                case 0:
+                                    _a.trys.push([0, 2, , 3]);
+                                    return [4 /*yield*/, fn()];
+                                case 1:
+                                    unexpected = _a.sent();
+                                    record(label, false, "resolved instead of rejecting; result=".concat(describe(unexpected)));
+                                    return [2 /*return*/];
+                                case 2:
+                                    e_3 = _a.sent();
+                                    rejection = { e: e_3 };
+                                    return [3 /*break*/, 3];
+                                case 3:
+                                    // Outside the catch on purpose: a predicate that throws here would otherwise escape the suite
+                                    // and, per run_isolated_in_parallel, abort every remaining batch instead of failing one check.
+                                    try {
+                                        record(label, onError(rejection.e), "rejected with ".concat(errorMessage(rejection.e)));
+                                    }
+                                    catch (predicateError) {
+                                        record(label, false, "predicate threw on rejection ".concat(errorMessage(rejection.e), ": ").concat(errorMessage(predicateError)));
+                                    }
+                                    return [2 /*return*/];
+                            }
+                        });
+                    });
+                };
+                integrationId = '';
+                sensitiveIntegrationId = '';
+                _a.label = 1;
+            case 1:
+                _a.trys.push([1, , 28, 40]);
+                return [4 /*yield*/, setup_isolated_tenant({
+                        name: "Integrations redacted ".concat(RAND()),
+                        apiKeys: 0,
+                    })];
+            case 2:
+                // the default user spec provisions an Admin plus a non-admin — sdkNonAdmin is the non-creator
+                // used by the CREATOR_ONLY checks below
+                tenant = _a.sent();
+                sdk_1 = tenant.sdk, sdkNonAdmin_1 = tenant.sdkNonAdmin;
+                return [4 /*yield*/, sdk_1.api.integrations.createOne({
+                        title: 'Test Redacted Integration',
+                        authentication: { type: 'oauth2', info: { access_token: 'test-access-token', refresh_token: 'test-refresh-token', scope: '', token_type: 'Bearer', expiry_date: new Date().getTime() } },
+                        webhooksSecret: 'super-secret-webhook',
+                        emailDisabled: false,
+                    })];
+            case 3:
+                created = _a.sent();
+                integrationId = created.id;
+                // load_redacted as creator — verify integration is returned, no sensitive fields present
+                return [4 /*yield*/, expect_result("load_redacted as creator returns redacted integrations", function () { return sdk_1.api.integrations.load_redacted({}); }, function (r) {
+                        var found = r.integrations.find(function (i) { return i.id === integrationId; });
+                        return !!found && hasNoSensitiveFields(found) && found.title === 'Test Redacted Integration';
+                    })
                     // load_redacted as non-creator — verify same integration visible and redacted
-                    return [4 /*yield*/, async_test("load_redacted as non-creator returns redacted integrations (bypasses CREATOR_ONLY)", function () { return sdkNonAdmin.api.integrations.load_redacted({}); }, { onResult: function (r) {
-                                var found = r.integrations.find(function (i) { return i.id === integrationId; });
-                                return !!found && hasNoSensitiveFields(found) && found.title === 'Test Redacted Integration';
-                            } })
-                        // Standard load endpoints enforce CREATOR_ONLY — creator gets full object, non-creator gets nothing.
-                        // webhooksSecret has schema-level redactions: ['all'] (added with MDI webhooks support),
-                        // so it never goes over the wire on any read — even for the creator.
-                    ];
-                case 4:
-                    // load_redacted as non-creator — verify same integration visible and redacted
-                    _b.sent();
-                    // Standard load endpoints enforce CREATOR_ONLY — creator gets full object, non-creator gets nothing.
-                    // webhooksSecret has schema-level redactions: ['all'] (added with MDI webhooks support),
-                    // so it never goes over the wire on any read — even for the creator.
-                    return [4 /*yield*/, async_test("getOne as creator returns integration with authentication, webhooksSecret always redacted", function () { return sdk.api.integrations.getOne(integrationId); }, { onResult: function (i) { return !!i && 'authentication' in i && !('webhooksSecret' in i); } })];
-                case 5:
+                ];
+            case 4:
+                // load_redacted as creator — verify integration is returned, no sensitive fields present
+                _a.sent();
+                // load_redacted as non-creator — verify same integration visible and redacted
+                return [4 /*yield*/, expect_result("load_redacted as non-creator returns redacted integrations (bypasses CREATOR_ONLY)", function () { return sdkNonAdmin_1.api.integrations.load_redacted({}); }, function (r) {
+                        var found = r.integrations.find(function (i) { return i.id === integrationId; });
+                        return !!found && hasNoSensitiveFields(found) && found.title === 'Test Redacted Integration';
+                    })
                     // Standard load endpoints enforce CREATOR_ONLY — creator gets full object, non-creator gets nothing.
                     // webhooksSecret has schema-level redactions: ['all'] (added with MDI webhooks support),
                     // so it never goes over the wire on any read — even for the creator.
-                    _b.sent();
-                    return [4 /*yield*/, async_test("getOne as non-creator returns 404 (CREATOR_ONLY access control)", function () { return sdkNonAdmin.api.integrations.getOne(integrationId); }, { shouldError: true, onError: function () { return true; } })];
-                case 6:
-                    _b.sent();
-                    return [4 /*yield*/, async_test("getSome as non-creator returns empty list (CREATOR_ONLY access control)", function () { return sdkNonAdmin.api.integrations.getSome(); }, { onResult: function (r) { return Array.isArray(r) && r.find(function (i) { return i.id === integrationId; }) === undefined; } })
-                        // update_settings as creator — update a non-sensitive field
-                    ];
-                case 7:
-                    _b.sent();
+                ];
+            case 5:
+                // load_redacted as non-creator — verify same integration visible and redacted
+                _a.sent();
+                // Standard load endpoints enforce CREATOR_ONLY — creator gets full object, non-creator gets nothing.
+                // webhooksSecret has schema-level redactions: ['all'] (added with MDI webhooks support),
+                // so it never goes over the wire on any read — even for the creator.
+                return [4 /*yield*/, expect_result("getOne as creator returns integration with authentication, webhooksSecret always redacted", function () { return sdk_1.api.integrations.getOne(integrationId); }, function (i) { return !!i && 'authentication' in i && !('webhooksSecret' in i); })];
+            case 6:
+                // Standard load endpoints enforce CREATOR_ONLY — creator gets full object, non-creator gets nothing.
+                // webhooksSecret has schema-level redactions: ['all'] (added with MDI webhooks support),
+                // so it never goes over the wire on any read — even for the creator.
+                _a.sent();
+                return [4 /*yield*/, expect_rejected("getOne as non-creator returns 404 (CREATOR_ONLY access control)", function () { return sdkNonAdmin_1.api.integrations.getOne(integrationId); })];
+            case 7:
+                _a.sent();
+                return [4 /*yield*/, expect_result("getSome as non-creator returns empty list (CREATOR_ONLY access control)", function () { return sdkNonAdmin_1.api.integrations.getSome(); }, function (r) { return Array.isArray(r) && r.find(function (i) { return i.id === integrationId; }) === undefined; })
                     // update_settings as creator — update a non-sensitive field
-                    return [4 /*yield*/, async_test("update_settings as creator updates non-sensitive field", function () { return sdk.api.integrations.update_settings({ id: integrationId, updates: { emailDisabled: true } }); }, { onResult: function (r) {
-                                return !!r.integration && r.integration.emailDisabled === true && hasNoSensitiveFields(r.integration);
-                            } })
-                        // update_settings as non-creator — update another field
-                    ];
-                case 8:
-                    // update_settings as creator — update a non-sensitive field
-                    _b.sent();
-                    // update_settings as non-creator — update another field
-                    return [4 /*yield*/, async_test("update_settings as non-creator updates non-sensitive field", function () { return sdkNonAdmin.api.integrations.update_settings({ id: integrationId, updates: { disableEnduserAutoSync: true } }); }, { onResult: function (r) {
-                                return !!r.integration && r.integration.disableEnduserAutoSync === true && hasNoSensitiveFields(r.integration);
-                            } })
-                        // update_settings rejects sensitive fields
-                    ];
-                case 9:
+                ];
+            case 8:
+                _a.sent();
+                // update_settings as creator — update a non-sensitive field
+                return [4 /*yield*/, expect_result("update_settings as creator updates non-sensitive field", function () { return sdk_1.api.integrations.update_settings({ id: integrationId, updates: { emailDisabled: true } }); }, function (r) { return !!r.integration && r.integration.emailDisabled === true && hasNoSensitiveFields(r.integration); })
                     // update_settings as non-creator — update another field
-                    _b.sent();
+                ];
+            case 9:
+                // update_settings as creator — update a non-sensitive field
+                _a.sent();
+                // update_settings as non-creator — update another field
+                return [4 /*yield*/, expect_result("update_settings as non-creator updates non-sensitive field", function () { return sdkNonAdmin_1.api.integrations.update_settings({ id: integrationId, updates: { disableEnduserAutoSync: true } }); }, function (r) { return !!r.integration && r.integration.disableEnduserAutoSync === true && hasNoSensitiveFields(r.integration); })
                     // update_settings rejects sensitive fields
-                    return [4 /*yield*/, async_test("update_settings rejects authentication update", function () { return sdkNonAdmin.api.integrations.update_settings({ id: integrationId, updates: { authentication: { type: 'apiKey', info: { api_key: 'hacked' } } } }); }, { shouldError: true, onError: function () { return true; } })];
-                case 10:
-                    // update_settings rejects sensitive fields
-                    _b.sent();
-                    return [4 /*yield*/, async_test("update_settings rejects webhooksSecret update", function () { return sdkNonAdmin.api.integrations.update_settings({ id: integrationId, updates: { webhooksSecret: 'hacked' } }); }, { shouldError: true, onError: function () { return true; } })];
-                case 11:
-                    _b.sent();
-                    return [4 /*yield*/, async_test("update_settings rejects fhirClientSecret update", function () { return sdkNonAdmin.api.integrations.update_settings({ id: integrationId, updates: { fhirClientSecret: 'hacked' } }); }, { shouldError: true, onError: function () { return true; } })
-                        // Group 1: Dot-notation bypass tests (validates the allowlist fix)
-                    ];
-                case 12:
-                    _b.sent();
-                    // Group 1: Dot-notation bypass tests (validates the allowlist fix)
-                    return [4 /*yield*/, async_test("update_settings rejects dot-notation authentication.info.api_key update", function () { return sdk.api.integrations.update_settings({ id: integrationId, updates: { "authentication.info.api_key": "hacked" } }); }, { shouldError: true, onError: function () { return true; } })];
-                case 13:
+                ];
+            case 10:
+                // update_settings as non-creator — update another field
+                _a.sent();
+                // update_settings rejects sensitive fields
+                return [4 /*yield*/, expect_rejected("update_settings rejects authentication update", function () { return sdkNonAdmin_1.api.integrations.update_settings({ id: integrationId, updates: { authentication: { type: 'apiKey', info: { api_key: 'hacked' } } } }); })];
+            case 11:
+                // update_settings rejects sensitive fields
+                _a.sent();
+                return [4 /*yield*/, expect_rejected("update_settings rejects webhooksSecret update", function () { return sdkNonAdmin_1.api.integrations.update_settings({ id: integrationId, updates: { webhooksSecret: 'hacked' } }); })];
+            case 12:
+                _a.sent();
+                return [4 /*yield*/, expect_rejected("update_settings rejects fhirClientSecret update", function () { return sdkNonAdmin_1.api.integrations.update_settings({ id: integrationId, updates: { fhirClientSecret: 'hacked' } }); })
                     // Group 1: Dot-notation bypass tests (validates the allowlist fix)
-                    _b.sent();
-                    return [4 /*yield*/, async_test("update_settings rejects dot-notation authentication.type update", function () { return sdk.api.integrations.update_settings({ id: integrationId, updates: { "authentication.type": "hacked" } }); }, { shouldError: true, onError: function () { return true; } })
-                        // Group 2: Remaining sensitive field rejections
-                    ];
-                case 14:
-                    _b.sent();
+                ];
+            case 13:
+                _a.sent();
+                // Group 1: Dot-notation bypass tests (validates the allowlist fix)
+                return [4 /*yield*/, expect_rejected("update_settings rejects dot-notation authentication.info.api_key update", function () { return sdk_1.api.integrations.update_settings({ id: integrationId, updates: { "authentication.info.api_key": "hacked" } }); })];
+            case 14:
+                // Group 1: Dot-notation bypass tests (validates the allowlist fix)
+                _a.sent();
+                return [4 /*yield*/, expect_rejected("update_settings rejects dot-notation authentication.type update", function () { return sdk_1.api.integrations.update_settings({ id: integrationId, updates: { "authentication.type": "hacked" } }); })
                     // Group 2: Remaining sensitive field rejections
-                    return [4 /*yield*/, async_test("update_settings rejects fhirClientId update", function () { return sdk.api.integrations.update_settings({ id: integrationId, updates: { fhirClientId: 'hacked' } }); }, { shouldError: true, onError: function () { return true; } })];
-                case 15:
-                    // Group 2: Remaining sensitive field rejections
-                    _b.sent();
-                    return [4 /*yield*/, async_test("update_settings rejects fhirAccessToken update", function () { return sdk.api.integrations.update_settings({ id: integrationId, updates: { fhirAccessToken: 'hacked' } }); }, { shouldError: true, onError: function () { return true; } })
-                        // Group 3: Non-allowlisted field rejections
-                    ];
-                case 16:
-                    _b.sent();
-                    // Group 3: Non-allowlisted field rejections
-                    return [4 /*yield*/, async_test("update_settings rejects title update (not in allowlist)", function () { return sdk.api.integrations.update_settings({ id: integrationId, updates: { title: 'hacked' } }); }, { shouldError: true, onError: function () { return true; } })];
-                case 17:
+                ];
+            case 15:
+                _a.sent();
+                // Group 2: Remaining sensitive field rejections
+                return [4 /*yield*/, expect_rejected("update_settings rejects fhirClientId update", function () { return sdk_1.api.integrations.update_settings({ id: integrationId, updates: { fhirClientId: 'hacked' } }); })];
+            case 16:
+                // Group 2: Remaining sensitive field rejections
+                _a.sent();
+                return [4 /*yield*/, expect_rejected("update_settings rejects fhirAccessToken update", function () { return sdk_1.api.integrations.update_settings({ id: integrationId, updates: { fhirAccessToken: 'hacked' } }); })
                     // Group 3: Non-allowlisted field rejections
-                    _b.sent();
-                    return [4 /*yield*/, async_test("update_settings rejects environment update (not in allowlist)", function () { return sdk.api.integrations.update_settings({ id: integrationId, updates: { environment: 'hacked' } }); }, { shouldError: true, onError: function () { return true; } })];
-                case 18:
-                    _b.sent();
-                    return [4 /*yield*/, async_test("update_settings rejects unknown field update", function () { return sdk.api.integrations.update_settings({ id: integrationId, updates: { unknownField: 'hacked' } }); }, { shouldError: true, onError: function () { return true; } })
-                        // Group 4: Verify additional allowlisted fields can be updated
-                    ];
-                case 19:
-                    _b.sent();
+                ];
+            case 17:
+                _a.sent();
+                // Group 3: Non-allowlisted field rejections
+                return [4 /*yield*/, expect_rejected("update_settings rejects title update (not in allowlist)", function () { return sdk_1.api.integrations.update_settings({ id: integrationId, updates: { title: 'hacked' } }); })];
+            case 18:
+                // Group 3: Non-allowlisted field rejections
+                _a.sent();
+                return [4 /*yield*/, expect_rejected("update_settings rejects environment update (not in allowlist)", function () { return sdk_1.api.integrations.update_settings({ id: integrationId, updates: { environment: 'hacked' } }); })];
+            case 19:
+                _a.sent();
+                return [4 /*yield*/, expect_rejected("update_settings rejects unknown field update", function () { return sdk_1.api.integrations.update_settings({ id: integrationId, updates: { unknownField: 'hacked' } }); })
                     // Group 4: Verify additional allowlisted fields can be updated
-                    return [4 /*yield*/, async_test("update_settings allows syncUnrecognizedSenders update", function () { return sdk.api.integrations.update_settings({ id: integrationId, updates: { syncUnrecognizedSenders: true } }); }, { onResult: function (r) { return !!r.integration && r.integration.syncUnrecognizedSenders === true && hasNoSensitiveFields(r.integration); } })];
-                case 20:
-                    // Group 4: Verify additional allowlisted fields can be updated
-                    _b.sent();
-                    return [4 /*yield*/, async_test("update_settings allows pushCalendarDetails update", function () { return sdk.api.integrations.update_settings({ id: integrationId, updates: { pushCalendarDetails: true } }); }, { onResult: function (r) { return !!r.integration && r.integration.pushCalendarDetails === true && hasNoSensitiveFields(r.integration); } })
-                        // Group 5: Explicit per-field redaction verification
-                        // Note: fhirClientId/fhirClientSecret/fhirAccessToken are set server-side via OAuth flows only,
-                        // so we test redaction of the fields that can be set via createOne (authentication, webhooksSecret)
-                    ];
-                case 21:
-                    _b.sent();
-                    return [4 /*yield*/, sdk.api.integrations.createOne({
-                            title: 'Test All Sensitive Fields',
-                            authentication: { type: 'oauth2', info: { access_token: 'secret-access-token', refresh_token: 'secret-refresh-token', scope: '', token_type: 'Bearer', expiry_date: new Date().getTime() } },
-                            webhooksSecret: 'super-secret-webhook-456',
-                            emailDisabled: true,
-                        })];
-                case 22:
-                    sensitiveIntegration = _b.sent();
-                    sensitiveIntegrationId = sensitiveIntegration.id;
-                    return [4 /*yield*/, async_test("load_redacted omits authentication field individually", function () { return sdk.api.integrations.load_redacted({}); }, { onResult: function (r) {
-                                var found = r.integrations.find(function (i) { return i.id === sensitiveIntegrationId; });
-                                return !!found && !('authentication' in found);
-                            } })];
-                case 23:
-                    _b.sent();
-                    return [4 /*yield*/, async_test("load_redacted omits webhooksSecret field individually", function () { return sdk.api.integrations.load_redacted({}); }, { onResult: function (r) {
-                                var found = r.integrations.find(function (i) { return i.id === sensitiveIntegrationId; });
-                                return !!found && !('webhooksSecret' in found);
-                            } })];
-                case 24:
-                    _b.sent();
-                    return [4 /*yield*/, async_test("load_redacted still returns non-sensitive fields", function () { return sdk.api.integrations.load_redacted({}); }, { onResult: function (r) {
-                                var found = r.integrations.find(function (i) { return i.id === sensitiveIntegrationId; });
-                                return !!found && found.emailDisabled === true && found.title === 'Test All Sensitive Fields';
-                            } })
-                        // connect_stripe must reject caller-supplied accountId (Stripe-account-spoofing defense).
-                        // Stripe Connect is deprecated in Tellescope; accountId was a test shortcut, kept rejected to preserve SDK shape.
-                    ];
-                case 25:
-                    _b.sent();
-                    // connect_stripe must reject caller-supplied accountId (Stripe-account-spoofing defense).
-                    // Stripe Connect is deprecated in Tellescope; accountId was a test shortcut, kept rejected to preserve SDK shape.
-                    return [4 /*yield*/, async_test("connect_stripe rejects caller-supplied accountId", function () { return sdk.api.integrations.connect_stripe({ countryCode: 'US', accountId: 'acct_someoneElsesAccount' }); }, { shouldError: true, onError: function (e) { return /accountId is not supported/i.test((e === null || e === void 0 ? void 0 : e.message) || (e === null || e === void 0 ? void 0 : e.toString()) || ''); } })];
-                case 26:
+                ];
+            case 20:
+                _a.sent();
+                // Group 4: Verify additional allowlisted fields can be updated
+                return [4 /*yield*/, expect_result("update_settings allows syncUnrecognizedSenders update", function () { return sdk_1.api.integrations.update_settings({ id: integrationId, updates: { syncUnrecognizedSenders: true } }); }, function (r) { return !!r.integration && r.integration.syncUnrecognizedSenders === true && hasNoSensitiveFields(r.integration); })];
+            case 21:
+                // Group 4: Verify additional allowlisted fields can be updated
+                _a.sent();
+                return [4 /*yield*/, expect_result("update_settings allows pushCalendarDetails update", function () { return sdk_1.api.integrations.update_settings({ id: integrationId, updates: { pushCalendarDetails: true } }); }, function (r) { return !!r.integration && r.integration.pushCalendarDetails === true && hasNoSensitiveFields(r.integration); })
+                    // Group 5: Explicit per-field redaction verification
+                    // Note: fhirClientId/fhirClientSecret/fhirAccessToken are set server-side via OAuth flows only,
+                    // so we test redaction of the fields that can be set via createOne (authentication, webhooksSecret)
+                ];
+            case 22:
+                _a.sent();
+                return [4 /*yield*/, sdk_1.api.integrations.createOne({
+                        title: 'Test All Sensitive Fields',
+                        authentication: { type: 'oauth2', info: { access_token: 'secret-access-token', refresh_token: 'secret-refresh-token', scope: '', token_type: 'Bearer', expiry_date: new Date().getTime() } },
+                        webhooksSecret: 'super-secret-webhook-456',
+                        emailDisabled: true,
+                    })];
+            case 23:
+                sensitiveIntegration = _a.sent();
+                sensitiveIntegrationId = sensitiveIntegration.id;
+                return [4 /*yield*/, expect_result("load_redacted omits authentication field individually", function () { return sdk_1.api.integrations.load_redacted({}); }, function (r) {
+                        var found = r.integrations.find(function (i) { return i.id === sensitiveIntegrationId; });
+                        return !!found && !('authentication' in found);
+                    })];
+            case 24:
+                _a.sent();
+                return [4 /*yield*/, expect_result("load_redacted omits webhooksSecret field individually", function () { return sdk_1.api.integrations.load_redacted({}); }, function (r) {
+                        var found = r.integrations.find(function (i) { return i.id === sensitiveIntegrationId; });
+                        return !!found && !('webhooksSecret' in found);
+                    })];
+            case 25:
+                _a.sent();
+                return [4 /*yield*/, expect_result("load_redacted still returns non-sensitive fields", function () { return sdk_1.api.integrations.load_redacted({}); }, function (r) {
+                        var found = r.integrations.find(function (i) { return i.id === sensitiveIntegrationId; });
+                        return !!found && found.emailDisabled === true && found.title === 'Test All Sensitive Fields';
+                    })
                     // connect_stripe must reject caller-supplied accountId (Stripe-account-spoofing defense).
                     // Stripe Connect is deprecated in Tellescope; accountId was a test shortcut, kept rejected to preserve SDK shape.
-                    _b.sent();
-                    return [3 /*break*/, 36];
-                case 27:
-                    if (!integrationId) return [3 /*break*/, 31];
-                    _b.label = 28;
-                case 28:
-                    _b.trys.push([28, 30, , 31]);
-                    return [4 /*yield*/, sdk.api.integrations.deleteOne(integrationId)];
-                case 29:
-                    _b.sent();
-                    return [3 /*break*/, 31];
-                case 30:
-                    error_1 = _b.sent();
-                    console.error('Cleanup error:', error_1);
-                    return [3 /*break*/, 31];
-                case 31:
-                    if (!sensitiveIntegrationId) return [3 /*break*/, 35];
-                    _b.label = 32;
-                case 32:
-                    _b.trys.push([32, 34, , 35]);
-                    return [4 /*yield*/, sdk.api.integrations.deleteOne(sensitiveIntegrationId)];
-                case 33:
-                    _b.sent();
-                    return [3 /*break*/, 35];
-                case 34:
-                    error_2 = _b.sent();
-                    console.error('Cleanup error (sensitive integration):', error_2);
-                    return [3 /*break*/, 35];
-                case 35: return [7 /*endfinally*/];
-                case 36: return [2 /*return*/];
-            }
-        });
+                ];
+            case 26:
+                _a.sent();
+                // connect_stripe must reject caller-supplied accountId (Stripe-account-spoofing defense).
+                // Stripe Connect is deprecated in Tellescope; accountId was a test shortcut, kept rejected to preserve SDK shape.
+                return [4 /*yield*/, expect_rejected("connect_stripe rejects caller-supplied accountId", function () { return sdk_1.api.integrations.connect_stripe({ countryCode: 'US', accountId: 'acct_someoneElsesAccount' }); }, function (e) { return /accountId is not supported/i.test((e === null || e === void 0 ? void 0 : e.message) || (e === null || e === void 0 ? void 0 : e.toString()) || ''); })];
+            case 27:
+                // connect_stripe must reject caller-supplied accountId (Stripe-account-spoofing defense).
+                // Stripe Connect is deprecated in Tellescope; accountId was a test shortcut, kept rejected to preserve SDK shape.
+                _a.sent();
+                return [3 /*break*/, 40];
+            case 28:
+                if (!tenant) return [3 /*break*/, 39];
+                sdk = tenant.sdk;
+                if (!integrationId) return [3 /*break*/, 32];
+                _a.label = 29;
+            case 29:
+                _a.trys.push([29, 31, , 32]);
+                return [4 /*yield*/, sdk.api.integrations.deleteOne(integrationId)];
+            case 30:
+                _a.sent();
+                return [3 /*break*/, 32];
+            case 31:
+                error_1 = _a.sent();
+                console.error('Cleanup error:', error_1);
+                return [3 /*break*/, 32];
+            case 32:
+                if (!sensitiveIntegrationId) return [3 /*break*/, 36];
+                _a.label = 33;
+            case 33:
+                _a.trys.push([33, 35, , 36]);
+                return [4 /*yield*/, sdk.api.integrations.deleteOne(sensitiveIntegrationId)];
+            case 34:
+                _a.sent();
+                return [3 /*break*/, 36];
+            case 35:
+                error_2 = _a.sent();
+                console.error('Cleanup error (sensitive integration):', error_2);
+                return [3 /*break*/, 36];
+            case 36:
+                _a.trys.push([36, 38, , 39]);
+                return [4 /*yield*/, tenant.teardown()];
+            case 37:
+                _a.sent();
+                return [3 /*break*/, 39];
+            case 38:
+                e_1 = _a.sent();
+                console.error('teardown failed', e_1);
+                return [3 /*break*/, 39];
+            case 39: return [7 /*endfinally*/];
+            case 40: return [2 /*return*/, checks];
+        }
     });
+}); };
+/** Asserting wrapper, for standalone runs. */
+export var integrations_redacted_tests = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var _a, _b;
+    return __generator(this, function (_c) {
+        switch (_c.label) {
+            case 0:
+                _a = assert_checks;
+                _b = ['Integrations redacted'];
+                return [4 /*yield*/, integrations_redacted_checks()];
+            case 1:
+                _a.apply(void 0, _b.concat([_c.sent()]));
+                return [2 /*return*/];
+        }
+    });
+}); };
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export var ISOLATED_SUITE = {
+    name: 'Integrations redacted',
+    run: integrations_redacted_checks,
 };
 if (require.main === module) {
     console.log("Using API URL: ".concat(host));
-    var sdk_1 = new Session({ host: host });
-    var sdkNonAdmin_1 = new Session({ host: host });
-    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
-        return __generator(this, function (_a) {
-            switch (_a.label) {
-                case 0: return [4 /*yield*/, setup_tests(sdk_1, sdkNonAdmin_1)];
-                case 1:
-                    _a.sent();
-                    return [4 /*yield*/, integrations_redacted_tests({ sdk: sdk_1, sdkNonAdmin: sdkNonAdmin_1 })];
-                case 2:
-                    _a.sent();
-                    return [2 /*return*/];
-            }
-        });
-    }); };
-    runTests()
+    integrations_redacted_tests()
         .then(function () {
         console.log("Integrations redacted test suite completed successfully");
         process.exit(0);