@tellescope/sdk 2.0.0-beta.1 → 2.0.0-beta.3

package/lib/esm/tests/api_tests/security/enduser-cross-create.test.js

@@ -35,11 +35,10 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
     }
 };
 require('source-map-support').install();
-import { Session, EnduserSession } from "../../../sdk";
-import { async_test, log_header, } from "@tellescope/testing";
-import { setup_tests } from "../../setup";
+import { EnduserSession } from "../../../sdk";
+import { assert_checks, setup_isolated_tenant, } from "../../setup_isolated";
 var host = process.env.API_URL || 'http://localhost:8080';
-var businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6';
+var RAND = function () { return Math.random().toString(36).slice(2, 10); };
 var ENDUSER_PASSWORD = 'F0116TestPassword!123';
 var CROSS_ENDUSER_MESSAGE = "enduserId does not match creator id for enduser session";
 /**
@@ -56,296 +55,436 @@ var CROSS_ENDUSER_MESSAGE = "enduserId does not match creator id for enduser ses
  *
  * Methodology: each section asserts BOTH the exploit-is-blocked case AND that the
  * legitimate path (self-create + staff-create) still works.
+ *
+ * Runs on its own provisioned tenant, so the patient session's businessId comes from the tenant
+ * rather than a TEST_BUSINESS_ID env var with a hardcoded shared-org fallback. Checks are collected
+ * and returned rather than asserted inline: `assert` calls process.exit, which would skip this
+ * suite's `finally` cleanup and, in the parallel pool, every other in-flight suite's teardown.
  */
-export var enduser_cross_create_tests = function (_a) {
-    var sdk = _a.sdk;
-    return __awaiter(void 0, void 0, void 0, function () {
-        var attackerId, victimId, createdObservationIds, createdOrderIds, createdContentIds, createdRoomIds, attackerEmail, victimEmail, attacker, victim, attackerSDK_1, orderPayload_1, staffId_1, _i, createdRoomIds_1, id, _b, _c, createdContentIds_1, id, _d, _e, createdObservationIds_1, id, _f, _g, createdOrderIds_1, id, _h, _j, _k;
-        return __generator(this, function (_l) {
-            switch (_l.label) {
-                case 0:
-                    log_header("enduser cross-enduser create gates");
-                    createdObservationIds = [];
-                    createdOrderIds = [];
-                    createdContentIds = [];
-                    createdRoomIds = [];
-                    _l.label = 1;
-                case 1:
-                    _l.trys.push([1, , 21, 54]);
-                    attackerEmail = "f0116-attacker-".concat(Date.now(), "@example.com");
-                    victimEmail = "f0116-victim-".concat(Date.now(), "@example.com");
-                    return [4 /*yield*/, sdk.api.endusers.createOne({ email: attackerEmail, fname: 'F0116', lname: 'Attacker' })];
-                case 2:
-                    attacker = _l.sent();
-                    attackerId = attacker.id;
-                    return [4 /*yield*/, sdk.api.endusers.createOne({ email: victimEmail, fname: 'F0116', lname: 'Victim' })];
-                case 3:
-                    victim = _l.sent();
-                    victimId = victim.id;
-                    return [4 /*yield*/, sdk.api.endusers.set_password({ id: attacker.id, password: ENDUSER_PASSWORD })];
-                case 4:
-                    _l.sent();
-                    attackerSDK_1 = new EnduserSession({ host: host, businessId: businessId });
-                    return [4 /*yield*/, attackerSDK_1.authenticate(attackerEmail, ENDUSER_PASSWORD)
-                        // ============================================================
-                        // enduser_observations
-                        // ============================================================
-                    ];
-                case 5:
-                    _l.sent();
+export var enduser_cross_create_checks = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var checks, record, describe, errorMessage, expect_rejection, expect_result, tenant, attackerId, victimId, createdObservationIds, createdOrderIds, createdContentIds, createdRoomIds, sdk_1, attackerEmail, victimEmail, attacker, victim, attackerSDK_1, orderPayload_1, staffId_1, sdk, _i, createdRoomIds_1, id, _a, _b, createdContentIds_1, id, _c, _d, createdObservationIds_1, id, _e, _f, createdOrderIds_1, id, _g, _h, _j, e_1;
+    return __generator(this, function (_k) {
+        switch (_k.label) {
+            case 0:
+                checks = [];
+                record = function (label, pass, detail) { return checks.push({ label: label, pass: pass, detail: detail }); };
+                describe = function (value) {
+                    if (value === undefined || value === null)
+                        return String(value);
+                    var stringified = JSON.stringify(value);
+                    return stringified === undefined ? String(value) : stringified;
+                };
+                errorMessage = function (e) { return (typeof (e === null || e === void 0 ? void 0 : e.message) === 'string' && e.message !== '' ? e.message : describe(e)); };
+                expect_rejection = function (label, fn, expectedMessage) { return __awaiter(void 0, void 0, void 0, function () {
+                    var created, error, rejected, e_2, message;
+                    return __generator(this, function (_a) {
+                        switch (_a.label) {
+                            case 0:
+                                rejected = false;
+                                _a.label = 1;
+                            case 1:
+                                _a.trys.push([1, 3, , 4]);
+                                return [4 /*yield*/, fn()];
+                            case 2:
+                                created = _a.sent();
+                                return [3 /*break*/, 4];
+                            case 3:
+                                e_2 = _a.sent();
+                                rejected = true;
+                                error = e_2;
+                                return [3 /*break*/, 4];
+                            case 4:
+                                if (!rejected) {
+                                    // id only — the created record carries the patient linkage this check is about, and the table
+                                    // prints on every run
+                                    record(label, false, "NOT REJECTED: created ".concat(describe(created === null || created === void 0 ? void 0 : created.id), " (expected \"").concat(expectedMessage, "\")"));
+                                    return [2 /*return*/];
+                                }
+                                message = errorMessage(error);
+                                record(label, message === expectedMessage, message === expectedMessage
+                                    ? "rejected: ".concat(message)
+                                    : "rejected with the WRONG error: ".concat(message, " (expected \"").concat(expectedMessage, "\")"));
+                                return [2 /*return*/];
+                        }
+                    });
+                }); };
+                expect_result = function (label, fn, inspect) { return __awaiter(void 0, void 0, void 0, function () {
+                    var _a, pass, detail, _b, e_3;
+                    return __generator(this, function (_c) {
+                        switch (_c.label) {
+                            case 0:
+                                _c.trys.push([0, 2, , 3]);
+                                _b = inspect;
+                                return [4 /*yield*/, fn()];
+                            case 1:
+                                _a = _b.apply(void 0, [_c.sent()]), pass = _a.pass, detail = _a.detail;
+                                record(label, pass, detail);
+                                return [3 /*break*/, 3];
+                            case 2:
+                                e_3 = _c.sent();
+                                record(label, false, "rejected instead of resolving: ".concat(errorMessage(e_3)));
+                                return [3 /*break*/, 3];
+                            case 3: return [2 /*return*/];
+                        }
+                    });
+                }); };
+                createdObservationIds = [];
+                createdOrderIds = [];
+                createdContentIds = [];
+                createdRoomIds = [];
+                _k.label = 1;
+            case 1:
+                _k.trys.push([1, , 22, 58]);
+                return [4 /*yield*/, setup_isolated_tenant({
+                        name: "Enduser cross-enduser create gates ".concat(RAND()),
+                        users: [{ isAdmin: true }],
+                        apiKeys: 0,
+                    })];
+            case 2:
+                tenant = _k.sent();
+                sdk_1 = tenant.sdk;
+                attackerEmail = "f0116-attacker-".concat(Date.now(), "@example.com");
+                victimEmail = "f0116-victim-".concat(Date.now(), "@example.com");
+                return [4 /*yield*/, sdk_1.api.endusers.createOne({ email: attackerEmail, fname: 'F0116', lname: 'Attacker' })];
+            case 3:
+                attacker = _k.sent();
+                attackerId = attacker.id;
+                return [4 /*yield*/, sdk_1.api.endusers.createOne({ email: victimEmail, fname: 'F0116', lname: 'Victim' })];
+            case 4:
+                victim = _k.sent();
+                victimId = victim.id;
+                return [4 /*yield*/, sdk_1.api.endusers.set_password({ id: attacker.id, password: ENDUSER_PASSWORD })];
+            case 5:
+                _k.sent();
+                attackerSDK_1 = new EnduserSession({ host: host, businessId: tenant.businessId });
+                return [4 /*yield*/, attackerSDK_1.authenticate(attackerEmail, ENDUSER_PASSWORD)
                     // ============================================================
                     // enduser_observations
                     // ============================================================
-                    return [4 /*yield*/, async_test("enduser cannot create observation on another enduser (createOne)", function () { return attackerSDK_1.api.enduser_observations.createOne({
+                ];
+            case 6:
+                _k.sent();
+                // ============================================================
+                // enduser_observations
+                // ============================================================
+                return [4 /*yield*/, expect_rejection("enduser cannot create observation on another enduser (createOne)", function () { return attackerSDK_1.api.enduser_observations.createOne({
+                        enduserId: victimId, category: 'vital-signs', status: 'final',
+                        measurement: { unit: 'mmHg', value: 220 },
+                    }); }, CROSS_ENDUSER_MESSAGE)];
+            case 7:
+                // ============================================================
+                // enduser_observations
+                // ============================================================
+                _k.sent();
+                return [4 /*yield*/, expect_rejection("enduser cannot create observation on another enduser (createMany)", function () { return attackerSDK_1.api.enduser_observations.createSome([{
                             enduserId: victimId, category: 'vital-signs', status: 'final',
                             measurement: { unit: 'mmHg', value: 220 },
-                        }); }, { shouldError: true, onError: function (e) { return e.message === CROSS_ENDUSER_MESSAGE; } })];
-                case 6:
-                    // ============================================================
-                    // enduser_observations
-                    // ============================================================
-                    _l.sent();
-                    return [4 /*yield*/, async_test("enduser cannot create observation on another enduser (createMany)", function () { return attackerSDK_1.api.enduser_observations.createSome([{
-                                enduserId: victimId, category: 'vital-signs', status: 'final',
-                                measurement: { unit: 'mmHg', value: 220 },
-                            }]); }, { shouldError: true, onError: function (e) { return e.message === CROSS_ENDUSER_MESSAGE; } })
-                        // Positive control: enduser CAN create an observation on their OWN record
-                    ];
-                case 7:
-                    _l.sent();
+                        }]); }, CROSS_ENDUSER_MESSAGE)
                     // Positive control: enduser CAN create an observation on their OWN record
-                    return [4 /*yield*/, async_test("enduser can still create observation on own record", function () { return attackerSDK_1.api.enduser_observations.createOne({
-                            enduserId: attackerId, category: 'vital-signs', status: 'final',
-                            measurement: { unit: 'mmHg', value: 120 },
-                        }); }, { onResult: function (o) { if (o === null || o === void 0 ? void 0 : o.id)
-                                createdObservationIds.push(o.id); return (o === null || o === void 0 ? void 0 : o.enduserId) === attackerId; } })
-                        // Positive control: staff CAN create an observation on any tenant enduser
-                    ];
-                case 8:
-                    // Positive control: enduser CAN create an observation on their OWN record
-                    _l.sent();
-                    // Positive control: staff CAN create an observation on any tenant enduser
-                    return [4 /*yield*/, async_test("staff can still create observation on any enduser", function () { return sdk.api.enduser_observations.createOne({
-                            enduserId: victimId, category: 'vital-signs', status: 'final',
-                            measurement: { unit: 'mmHg', value: 118 },
-                        }); }, { onResult: function (o) { if (o === null || o === void 0 ? void 0 : o.id)
-                                createdObservationIds.push(o.id); return (o === null || o === void 0 ? void 0 : o.enduserId) === victimId; } })
-                        // ============================================================
-                        // enduser_orders
-                        // ============================================================
-                    ];
-                case 9:
+                ];
+            case 8:
+                _k.sent();
+                // Positive control: enduser CAN create an observation on their OWN record
+                return [4 /*yield*/, expect_result("enduser can still create observation on own record", function () { return attackerSDK_1.api.enduser_observations.createOne({
+                        enduserId: attackerId, category: 'vital-signs', status: 'final',
+                        measurement: { unit: 'mmHg', value: 120 },
+                    }); }, function (o) {
+                        if (o === null || o === void 0 ? void 0 : o.id)
+                            createdObservationIds.push(o.id);
+                        return {
+                            pass: (o === null || o === void 0 ? void 0 : o.enduserId) === attackerId,
+                            detail: "enduserId=".concat(describe(o === null || o === void 0 ? void 0 : o.enduserId), " (self=").concat(attackerId, ")"),
+                        };
+                    })
                     // Positive control: staff CAN create an observation on any tenant enduser
-                    _l.sent();
-                    orderPayload_1 = function (enduserId) { return ({
-                        enduserId: enduserId,
-                        externalId: "f0117-".concat(Date.now()), source: 'f0117-source',
-                        title: 'f0117 order', status: 'pending',
-                    }); };
-                    return [4 /*yield*/, async_test("enduser cannot create order on another enduser", function () { return attackerSDK_1.api.enduser_orders.createOne(orderPayload_1(victimId)); }, { shouldError: true, onError: function (e) { return e.message === CROSS_ENDUSER_MESSAGE; } })];
-                case 10:
-                    _l.sent();
-                    return [4 /*yield*/, async_test("enduser can still create order on own record", function () { return attackerSDK_1.api.enduser_orders.createOne(orderPayload_1(attackerId)); }, { onResult: function (o) { if (o === null || o === void 0 ? void 0 : o.id)
-                                createdOrderIds.push(o.id); return (o === null || o === void 0 ? void 0 : o.enduserId) === attackerId; } })];
-                case 11:
-                    _l.sent();
-                    return [4 /*yield*/, async_test("staff can still create order on any enduser", function () { return sdk.api.enduser_orders.createOne(orderPayload_1(victimId)); }, { onResult: function (o) { if (o === null || o === void 0 ? void 0 : o.id)
-                                createdOrderIds.push(o.id); return (o === null || o === void 0 ? void 0 : o.enduserId) === victimId; } })
-                        // ============================================================
-                        // managed_content_records
-                        // ============================================================
-                    ];
-                case 12:
-                    _l.sent();
+                ];
+            case 9:
+                // Positive control: enduser CAN create an observation on their OWN record
+                _k.sent();
+                // Positive control: staff CAN create an observation on any tenant enduser
+                return [4 /*yield*/, expect_result("staff can still create observation on any enduser", function () { return sdk_1.api.enduser_observations.createOne({
+                        enduserId: victimId, category: 'vital-signs', status: 'final',
+                        measurement: { unit: 'mmHg', value: 118 },
+                    }); }, function (o) {
+                        if (o === null || o === void 0 ? void 0 : o.id)
+                            createdObservationIds.push(o.id);
+                        return {
+                            pass: (o === null || o === void 0 ? void 0 : o.enduserId) === victimId,
+                            detail: "enduserId=".concat(describe(o === null || o === void 0 ? void 0 : o.enduserId), " (target=").concat(victimId, ")"),
+                        };
+                    })
                     // ============================================================
-                    // managed_content_records
+                    // enduser_orders
                     // ============================================================
-                    return [4 /*yield*/, async_test("enduser cannot create content with allowUnauthenticatedAccess", function () { return attackerSDK_1.api.managed_content_records.createOne({
-                            title: 'f0119 phishing', textContent: 'x', allowUnauthenticatedAccess: true,
-                        }); }, { shouldError: true, onError: function (e) { return e.message === "allowUnauthenticatedAccess cannot be set by endusers"; } })];
-                case 13:
+                ];
+            case 10:
+                // Positive control: staff CAN create an observation on any tenant enduser
+                _k.sent();
+                orderPayload_1 = function (enduserId) { return ({
+                    enduserId: enduserId,
+                    externalId: "f0117-".concat(Date.now()), source: 'f0117-source',
+                    title: 'f0117 order', status: 'pending',
+                }); };
+                return [4 /*yield*/, expect_rejection("enduser cannot create order on another enduser", function () { return attackerSDK_1.api.enduser_orders.createOne(orderPayload_1(victimId)); }, CROSS_ENDUSER_MESSAGE)];
+            case 11:
+                _k.sent();
+                return [4 /*yield*/, expect_result("enduser can still create order on own record", function () { return attackerSDK_1.api.enduser_orders.createOne(orderPayload_1(attackerId)); }, function (o) {
+                        if (o === null || o === void 0 ? void 0 : o.id)
+                            createdOrderIds.push(o.id);
+                        return {
+                            pass: (o === null || o === void 0 ? void 0 : o.enduserId) === attackerId,
+                            detail: "enduserId=".concat(describe(o === null || o === void 0 ? void 0 : o.enduserId), " (self=").concat(attackerId, ")"),
+                        };
+                    })];
+            case 12:
+                _k.sent();
+                return [4 /*yield*/, expect_result("staff can still create order on any enduser", function () { return sdk_1.api.enduser_orders.createOne(orderPayload_1(victimId)); }, function (o) {
+                        if (o === null || o === void 0 ? void 0 : o.id)
+                            createdOrderIds.push(o.id);
+                        return {
+                            pass: (o === null || o === void 0 ? void 0 : o.enduserId) === victimId,
+                            detail: "enduserId=".concat(describe(o === null || o === void 0 ? void 0 : o.enduserId), " (target=").concat(victimId, ")"),
+                        };
+                    })
                     // ============================================================
                     // managed_content_records
                     // ============================================================
-                    _l.sent();
-                    return [4 /*yield*/, async_test("enduser cannot create content with publicRead", function () { return attackerSDK_1.api.managed_content_records.createOne({
-                            title: 'f0119 broadcast', textContent: 'x', publicRead: true,
-                        }); }, { shouldError: true, onError: function (e) { return e.message === "publicRead cannot be set by endusers"; } })];
-                case 14:
-                    _l.sent();
-                    return [4 /*yield*/, async_test("enduser cannot create content bound to another enduser", function () { return attackerSDK_1.api.managed_content_records.createOne({
-                            title: 'f0119 cross', textContent: 'x', enduserId: victimId,
-                        }); }, { shouldError: true, onError: function (e) { return e.message === CROSS_ENDUSER_MESSAGE; } })];
-                case 15:
-                    _l.sent();
-                    return [4 /*yield*/, async_test("enduser can still create ordinary content", function () { return attackerSDK_1.api.managed_content_records.createOne({
-                            title: 'f0119 ok', textContent: 'hello',
-                        }); }, { onResult: function (o) { if (o === null || o === void 0 ? void 0 : o.id)
-                                createdContentIds.push(o.id); return !(o === null || o === void 0 ? void 0 : o.publicRead) && !(o === null || o === void 0 ? void 0 : o.allowUnauthenticatedAccess); } })];
-                case 16:
-                    _l.sent();
-                    return [4 /*yield*/, async_test("staff can still create public content", function () { return sdk.api.managed_content_records.createOne({
-                            title: 'f0119 staff public', textContent: 'x', publicRead: true,
-                        }); }, { onResult: function (o) { if (o === null || o === void 0 ? void 0 : o.id)
-                                createdContentIds.push(o.id); return (o === null || o === void 0 ? void 0 : o.publicRead) === true; } })
-                        // ============================================================
-                        // chat_rooms (enduserIds-only gate; staff userIds targeting is by-design)
-                        // ============================================================
-                    ];
-                case 17:
-                    _l.sent();
-                    staffId_1 = sdk.userInfo.id;
-                    return [4 /*yield*/, async_test("enduser cannot add another patient to a chat room (enduserIds)", function () { return attackerSDK_1.api.chat_rooms.createOne({
-                            type: 'internal', enduserIds: [attackerId, victimId], userIds: [staffId_1],
-                        }); }, { shouldError: true, onError: function (e) { return e.message === "enduserIds may only contain your own id for enduser session"; } })
-                        // Positive control: patient CAN create a room with care-team staff + self (intended feature)
-                    ];
-                case 18:
-                    _l.sent();
-                    // Positive control: patient CAN create a room with care-team staff + self (intended feature)
-                    return [4 /*yield*/, async_test("enduser can still create a room with staff + self", function () { return attackerSDK_1.api.chat_rooms.createOne({
-                            type: 'internal', enduserIds: [attackerId], userIds: [staffId_1],
-                        }); }, { onResult: function (o) { var _a, _b; if (o === null || o === void 0 ? void 0 : o.id)
-                                createdRoomIds.push(o.id); return ((_a = o === null || o === void 0 ? void 0 : o.enduserIds) === null || _a === void 0 ? void 0 : _a.length) === 1 && ((_b = o === null || o === void 0 ? void 0 : o.userIds) === null || _b === void 0 ? void 0 : _b.includes(staffId_1)); } })
-                        // Positive control: staff can still create multi-patient rooms
-                    ];
-                case 19:
+                ];
+            case 13:
+                _k.sent();
+                // ============================================================
+                // managed_content_records
+                // ============================================================
+                return [4 /*yield*/, expect_rejection("enduser cannot create content with allowUnauthenticatedAccess", function () { return attackerSDK_1.api.managed_content_records.createOne({
+                        title: 'f0119 phishing', textContent: 'x', allowUnauthenticatedAccess: true,
+                    }); }, "allowUnauthenticatedAccess cannot be set by endusers")];
+            case 14:
+                // ============================================================
+                // managed_content_records
+                // ============================================================
+                _k.sent();
+                return [4 /*yield*/, expect_rejection("enduser cannot create content with publicRead", function () { return attackerSDK_1.api.managed_content_records.createOne({
+                        title: 'f0119 broadcast', textContent: 'x', publicRead: true,
+                    }); }, "publicRead cannot be set by endusers")];
+            case 15:
+                _k.sent();
+                return [4 /*yield*/, expect_rejection("enduser cannot create content bound to another enduser", function () { return attackerSDK_1.api.managed_content_records.createOne({
+                        title: 'f0119 cross', textContent: 'x', enduserId: victimId,
+                    }); }, CROSS_ENDUSER_MESSAGE)];
+            case 16:
+                _k.sent();
+                return [4 /*yield*/, expect_result("enduser can still create ordinary content", function () { return attackerSDK_1.api.managed_content_records.createOne({
+                        title: 'f0119 ok', textContent: 'hello',
+                    }); }, function (o) {
+                        if (o === null || o === void 0 ? void 0 : o.id)
+                            createdContentIds.push(o.id);
+                        return {
+                            pass: !(o === null || o === void 0 ? void 0 : o.publicRead) && !(o === null || o === void 0 ? void 0 : o.allowUnauthenticatedAccess),
+                            detail: "publicRead=".concat(describe(o === null || o === void 0 ? void 0 : o.publicRead), " ")
+                                + "allowUnauthenticatedAccess=".concat(describe(o === null || o === void 0 ? void 0 : o.allowUnauthenticatedAccess), " (want both unset)"),
+                        };
+                    })];
+            case 17:
+                _k.sent();
+                return [4 /*yield*/, expect_result("staff can still create public content", function () { return sdk_1.api.managed_content_records.createOne({
+                        title: 'f0119 staff public', textContent: 'x', publicRead: true,
+                    }); }, function (o) {
+                        if (o === null || o === void 0 ? void 0 : o.id)
+                            createdContentIds.push(o.id);
+                        return {
+                            pass: (o === null || o === void 0 ? void 0 : o.publicRead) === true,
+                            detail: "publicRead=".concat(describe(o === null || o === void 0 ? void 0 : o.publicRead), " (want true)"),
+                        };
+                    })
+                    // ============================================================
+                    // chat_rooms (enduserIds-only gate; staff userIds targeting is by-design)
+                    // ============================================================
+                ];
+            case 18:
+                _k.sent();
+                staffId_1 = sdk_1.userInfo.id;
+                return [4 /*yield*/, expect_rejection("enduser cannot add another patient to a chat room (enduserIds)", function () { return attackerSDK_1.api.chat_rooms.createOne({
+                        type: 'internal', enduserIds: [attackerId, victimId], userIds: [staffId_1],
+                    }); }, "enduserIds may only contain your own id for enduser session")
                     // Positive control: patient CAN create a room with care-team staff + self (intended feature)
-                    _l.sent();
-                    // Positive control: staff can still create multi-patient rooms
-                    return [4 /*yield*/, async_test("staff can still create a room with multiple endusers", function () { return sdk.api.chat_rooms.createOne({
-                            type: 'internal', enduserIds: [attackerId, victimId], userIds: [staffId_1],
-                        }); }, { onResult: function (o) { var _a; if (o === null || o === void 0 ? void 0 : o.id)
-                                createdRoomIds.push(o.id); return ((_a = o === null || o === void 0 ? void 0 : o.enduserIds) === null || _a === void 0 ? void 0 : _a.length) === 2; } })];
-                case 20:
+                ];
+            case 19:
+                _k.sent();
+                // Positive control: patient CAN create a room with care-team staff + self (intended feature)
+                return [4 /*yield*/, expect_result("enduser can still create a room with staff + self", function () { return attackerSDK_1.api.chat_rooms.createOne({
+                        type: 'internal', enduserIds: [attackerId], userIds: [staffId_1],
+                    }); }, function (o) {
+                        var _a, _b, _c, _d;
+                        if (o === null || o === void 0 ? void 0 : o.id)
+                            createdRoomIds.push(o.id);
+                        return {
+                            pass: ((_a = o === null || o === void 0 ? void 0 : o.enduserIds) === null || _a === void 0 ? void 0 : _a.length) === 1 && ((_b = o === null || o === void 0 ? void 0 : o.userIds) === null || _b === void 0 ? void 0 : _b.includes(staffId_1)),
+                            detail: "enduserIds=".concat(describe((_c = o === null || o === void 0 ? void 0 : o.enduserIds) === null || _c === void 0 ? void 0 : _c.length), " userIds include staff=")
+                                + "".concat(describe(!!((_d = o === null || o === void 0 ? void 0 : o.userIds) === null || _d === void 0 ? void 0 : _d.includes(staffId_1))), " (want 1 and true)"),
+                        };
+                    })
                     // Positive control: staff can still create multi-patient rooms
-                    _l.sent();
-                    return [3 /*break*/, 54];
-                case 21:
-                    _i = 0, createdRoomIds_1 = createdRoomIds;
-                    _l.label = 22;
-                case 22:
-                    if (!(_i < createdRoomIds_1.length)) return [3 /*break*/, 27];
-                    id = createdRoomIds_1[_i];
-                    _l.label = 23;
-                case 23:
-                    _l.trys.push([23, 25, , 26]);
-                    return [4 /*yield*/, sdk.api.chat_rooms.deleteOne(id)];
-                case 24:
-                    _l.sent();
-                    return [3 /*break*/, 26];
-                case 25:
-                    _b = _l.sent();
-                    return [3 /*break*/, 26];
-                case 26:
-                    _i++;
-                    return [3 /*break*/, 22];
-                case 27:
-                    _c = 0, createdContentIds_1 = createdContentIds;
-                    _l.label = 28;
-                case 28:
-                    if (!(_c < createdContentIds_1.length)) return [3 /*break*/, 33];
-                    id = createdContentIds_1[_c];
-                    _l.label = 29;
-                case 29:
-                    _l.trys.push([29, 31, , 32]);
-                    return [4 /*yield*/, sdk.api.managed_content_records.deleteOne(id)];
-                case 30:
-                    _l.sent();
-                    return [3 /*break*/, 32];
-                case 31:
-                    _d = _l.sent();
-                    return [3 /*break*/, 32];
-                case 32:
-                    _c++;
-                    return [3 /*break*/, 28];
-                case 33:
-                    _e = 0, createdObservationIds_1 = createdObservationIds;
-                    _l.label = 34;
-                case 34:
-                    if (!(_e < createdObservationIds_1.length)) return [3 /*break*/, 39];
-                    id = createdObservationIds_1[_e];
-                    _l.label = 35;
-                case 35:
-                    _l.trys.push([35, 37, , 38]);
-                    return [4 /*yield*/, sdk.api.enduser_observations.deleteOne(id)];
-                case 36:
-                    _l.sent();
-                    return [3 /*break*/, 38];
-                case 37:
-                    _f = _l.sent();
-                    return [3 /*break*/, 38];
-                case 38:
-                    _e++;
-                    return [3 /*break*/, 34];
-                case 39:
-                    _g = 0, createdOrderIds_1 = createdOrderIds;
-                    _l.label = 40;
-                case 40:
-                    if (!(_g < createdOrderIds_1.length)) return [3 /*break*/, 45];
-                    id = createdOrderIds_1[_g];
-                    _l.label = 41;
-                case 41:
-                    _l.trys.push([41, 43, , 44]);
-                    return [4 /*yield*/, sdk.api.enduser_orders.deleteOne(id)];
-                case 42:
-                    _l.sent();
-                    return [3 /*break*/, 44];
-                case 43:
-                    _h = _l.sent();
-                    return [3 /*break*/, 44];
-                case 44:
-                    _g++;
-                    return [3 /*break*/, 40];
-                case 45:
-                    if (!attackerId) return [3 /*break*/, 49];
-                    _l.label = 46;
-                case 46:
-                    _l.trys.push([46, 48, , 49]);
-                    return [4 /*yield*/, sdk.api.endusers.deleteOne(attackerId)];
-                case 47:
-                    _l.sent();
-                    return [3 /*break*/, 49];
-                case 48:
-                    _j = _l.sent();
-                    return [3 /*break*/, 49];
-                case 49:
-                    if (!victimId) return [3 /*break*/, 53];
-                    _l.label = 50;
-                case 50:
-                    _l.trys.push([50, 52, , 53]);
-                    return [4 /*yield*/, sdk.api.endusers.deleteOne(victimId)];
-                case 51:
-                    _l.sent();
-                    return [3 /*break*/, 53];
-                case 52:
-                    _k = _l.sent();
-                    return [3 /*break*/, 53];
-                case 53: return [7 /*endfinally*/];
-                case 54: return [2 /*return*/];
-            }
-        });
+                ];
+            case 20:
+                // Positive control: patient CAN create a room with care-team staff + self (intended feature)
+                _k.sent();
+                // Positive control: staff can still create multi-patient rooms
+                return [4 /*yield*/, expect_result("staff can still create a room with multiple endusers", function () { return sdk_1.api.chat_rooms.createOne({
+                        type: 'internal', enduserIds: [attackerId, victimId], userIds: [staffId_1],
+                    }); }, function (o) {
+                        var _a, _b;
+                        if (o === null || o === void 0 ? void 0 : o.id)
+                            createdRoomIds.push(o.id);
+                        return {
+                            pass: ((_a = o === null || o === void 0 ? void 0 : o.enduserIds) === null || _a === void 0 ? void 0 : _a.length) === 2,
+                            detail: "enduserIds=".concat(describe((_b = o === null || o === void 0 ? void 0 : o.enduserIds) === null || _b === void 0 ? void 0 : _b.length), " (want 2)"),
+                        };
+                    })];
+            case 21:
+                // Positive control: staff can still create multi-patient rooms
+                _k.sent();
+                return [3 /*break*/, 58];
+            case 22:
+                if (!tenant) return [3 /*break*/, 57];
+                sdk = tenant.sdk;
+                _i = 0, createdRoomIds_1 = createdRoomIds;
+                _k.label = 23;
+            case 23:
+                if (!(_i < createdRoomIds_1.length)) return [3 /*break*/, 28];
+                id = createdRoomIds_1[_i];
+                _k.label = 24;
+            case 24:
+                _k.trys.push([24, 26, , 27]);
+                return [4 /*yield*/, sdk.api.chat_rooms.deleteOne(id)];
+            case 25:
+                _k.sent();
+                return [3 /*break*/, 27];
+            case 26:
+                _a = _k.sent();
+                return [3 /*break*/, 27];
+            case 27:
+                _i++;
+                return [3 /*break*/, 23];
+            case 28:
+                _b = 0, createdContentIds_1 = createdContentIds;
+                _k.label = 29;
+            case 29:
+                if (!(_b < createdContentIds_1.length)) return [3 /*break*/, 34];
+                id = createdContentIds_1[_b];
+                _k.label = 30;
+            case 30:
+                _k.trys.push([30, 32, , 33]);
+                return [4 /*yield*/, sdk.api.managed_content_records.deleteOne(id)];
+            case 31:
+                _k.sent();
+                return [3 /*break*/, 33];
+            case 32:
+                _c = _k.sent();
+                return [3 /*break*/, 33];
+            case 33:
+                _b++;
+                return [3 /*break*/, 29];
+            case 34:
+                _d = 0, createdObservationIds_1 = createdObservationIds;
+                _k.label = 35;
+            case 35:
+                if (!(_d < createdObservationIds_1.length)) return [3 /*break*/, 40];
+                id = createdObservationIds_1[_d];
+                _k.label = 36;
+            case 36:
+                _k.trys.push([36, 38, , 39]);
+                return [4 /*yield*/, sdk.api.enduser_observations.deleteOne(id)];
+            case 37:
+                _k.sent();
+                return [3 /*break*/, 39];
+            case 38:
+                _e = _k.sent();
+                return [3 /*break*/, 39];
+            case 39:
+                _d++;
+                return [3 /*break*/, 35];
+            case 40:
+                _f = 0, createdOrderIds_1 = createdOrderIds;
+                _k.label = 41;
+            case 41:
+                if (!(_f < createdOrderIds_1.length)) return [3 /*break*/, 46];
+                id = createdOrderIds_1[_f];
+                _k.label = 42;
+            case 42:
+                _k.trys.push([42, 44, , 45]);
+                return [4 /*yield*/, sdk.api.enduser_orders.deleteOne(id)];
+            case 43:
+                _k.sent();
+                return [3 /*break*/, 45];
+            case 44:
+                _g = _k.sent();
+                return [3 /*break*/, 45];
+            case 45:
+                _f++;
+                return [3 /*break*/, 41];
+            case 46:
+                if (!attackerId) return [3 /*break*/, 50];
+                _k.label = 47;
+            case 47:
+                _k.trys.push([47, 49, , 50]);
+                return [4 /*yield*/, sdk.api.endusers.deleteOne(attackerId)];
+            case 48:
+                _k.sent();
+                return [3 /*break*/, 50];
+            case 49:
+                _h = _k.sent();
+                return [3 /*break*/, 50];
+            case 50:
+                if (!victimId) return [3 /*break*/, 54];
+                _k.label = 51;
+            case 51:
+                _k.trys.push([51, 53, , 54]);
+                return [4 /*yield*/, sdk.api.endusers.deleteOne(victimId)];
+            case 52:
+                _k.sent();
+                return [3 /*break*/, 54];
+            case 53:
+                _j = _k.sent();
+                return [3 /*break*/, 54];
+            case 54:
+                _k.trys.push([54, 56, , 57]);
+                return [4 /*yield*/, tenant.teardown()];
+            case 55:
+                _k.sent();
+                return [3 /*break*/, 57];
+            case 56:
+                e_1 = _k.sent();
+                console.error('teardown failed', e_1);
+                return [3 /*break*/, 57];
+            case 57: return [7 /*endfinally*/];
+            case 58: return [2 /*return*/, checks];
+        }
+    });
+}); };
+/** Asserting wrapper, for standalone runs. */
+export var enduser_cross_create_tests = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var _a, _b;
+    return __generator(this, function (_c) {
+        switch (_c.label) {
+            case 0:
+                _a = assert_checks;
+                _b = ['Enduser cross-enduser create gates'];
+                return [4 /*yield*/, enduser_cross_create_checks()];
+            case 1:
+                _a.apply(void 0, _b.concat([_c.sent()]));
+                return [2 /*return*/];
+        }
     });
+}); };
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export var ISOLATED_SUITE = {
+    name: 'Enduser cross-enduser create gates',
+    run: enduser_cross_create_checks,
 };
 // Allow running this test file independently
 if (require.main === module) {
     console.log("\uD83C\uDF10 Using API URL: ".concat(host));
-    var sdk_1 = new Session({ host: host });
-    var sdkNonAdmin_1 = new Session({ host: host });
-    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
-        return __generator(this, function (_a) {
-            switch (_a.label) {
-                case 0: return [4 /*yield*/, setup_tests(sdk_1, sdkNonAdmin_1)];
-                case 1:
-                    _a.sent();
-                    return [4 /*yield*/, enduser_cross_create_tests({ sdk: sdk_1, sdkNonAdmin: sdkNonAdmin_1 })];
-                case 2:
-                    _a.sent();
-                    return [2 /*return*/];
-            }
-        });
-    }); };
-    runTests()
+    enduser_cross_create_tests()
         .then(function () {
         console.log("✅ enduser cross-create test suite completed successfully");
         process.exit(0);