@tellescope/sdk 2.0.0-beta.1 → 2.0.0-beta.3

package/lib/esm/tests/api_tests/security/enduser-write-restrictions.test.js

@@ -35,11 +35,10 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
     }
 };
 require('source-map-support').install();
-import { Session, EnduserSession } from "../../../sdk";
-import { async_test, log_header, } from "@tellescope/testing";
-import { setup_tests } from "../../setup";
+import { EnduserSession } from "../../../sdk";
+import { assert_checks, setup_isolated_tenant, } from "../../setup_isolated";
 var host = process.env.API_URL || 'http://localhost:8080';
-var businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6';
+var RAND = function () { return Math.random().toString(36).slice(2, 10); };
 var ENDUSER_PASSWORD = 'F0106TestPassword!123';
 // Every endusers field marked enduserUpdatesDisabled in schema.ts, with a
 // validator-passing sample value so the only rejection in play is the
@@ -114,242 +113,361 @@ var restrictedFormResponseUpdates = function (staffId, otherEnduserId) { return
  *   - nothing persists (spot-checked on assignedTo, the highest-impact field)
  *   - enduser self-updates of allowed fields still work (fname, hideFromEnduserPortal)
  *   - staff sessions can still update the restricted fields
+ *
+ * Runs on its own provisioned tenant, so the patient session's businessId comes from the tenant
+ * rather than a TEST_BUSINESS_ID env var with a hardcoded shared-org fallback. Checks are collected
+ * and returned rather than asserted inline: `assert` calls process.exit, which would skip this
+ * suite's `finally` cleanup and, in the parallel pool, every other in-flight suite's teardown.
  */
-export var enduser_write_restrictions_tests = function (_a) {
-    var sdk = _a.sdk;
-    return __awaiter(void 0, void 0, void 0, function () {
-        var enduserId, otherEnduserId, formId, formResponseId, enduserEmail, enduser_1, otherEnduser_1, enduserSDK_1, form, formResponse_1, _loop_1, _i, _b, _c, field, value, _loop_2, _d, _e, _f, field, value, _g, _h, _j, _k;
-        return __generator(this, function (_l) {
-            switch (_l.label) {
-                case 0:
-                    log_header("enduser write restrictions (enduserUpdatesDisabled)");
-                    _l.label = 1;
-                case 1:
-                    _l.trys.push([1, , 24, 41]);
-                    enduserEmail = "f0106-enduser-".concat(Date.now(), "@example.com");
-                    return [4 /*yield*/, sdk.api.endusers.createOne({ email: enduserEmail, fname: 'F0106', lname: 'Restricted' })];
-                case 2:
-                    enduser_1 = _l.sent();
-                    enduserId = enduser_1.id;
-                    return [4 /*yield*/, sdk.api.endusers.createOne({
-                            email: "f0106-other-".concat(Date.now(), "@example.com"), fname: 'F0106', lname: 'Other',
-                        })];
-                case 3:
-                    otherEnduser_1 = _l.sent();
-                    otherEnduserId = otherEnduser_1.id;
-                    return [4 /*yield*/, sdk.api.endusers.set_password({ id: enduser_1.id, password: ENDUSER_PASSWORD })];
-                case 4:
-                    _l.sent();
-                    enduserSDK_1 = new EnduserSession({ host: host, businessId: businessId });
-                    return [4 /*yield*/, enduserSDK_1.authenticate(enduserEmail, ENDUSER_PASSWORD)];
-                case 5:
-                    _l.sent();
-                    return [4 /*yield*/, sdk.api.forms.createOne({ title: 'Write Restriction Test Form' })];
-                case 6:
-                    form = _l.sent();
-                    formId = form.id;
-                    return [4 /*yield*/, sdk.api.form_responses.prepare_form_response({
-                            formId: form.id,
-                            enduserId: enduser_1.id,
-                        })];
-                case 7:
-                    formResponse_1 = (_l.sent()).response;
-                    formResponseId = formResponse_1.id;
-                    _loop_1 = function (field, value) {
-                        return __generator(this, function (_m) {
-                            switch (_m.label) {
-                                case 0: return [4 /*yield*/, async_test("enduser cannot self-update endusers.".concat(field), function () {
-                                        var _a;
-                                        return enduserSDK_1.api.endusers.updateOne(enduser_1.id, (_a = {}, _a[field] = value, _a));
-                                    }, { shouldError: true, onError: function (e) { return e.message === "".concat(field, " cannot be updated by endusers"); } })];
-                                case 1:
-                                    _m.sent();
+export var enduser_write_restrictions_checks = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var checks, record, describe, errorMessage, expect_rejection, expect_result, tenant, enduserId, otherEnduserId, formId, formResponseId, sdk_1, enduserEmail, enduser_1, otherEnduser_1, enduserSDK_1, form, formResponse_1, _loop_1, _i, _a, _b, field, value, _loop_2, _c, _d, _e, field, value, sdk, _f, _g, _h, _j, e_1;
+    return __generator(this, function (_k) {
+        switch (_k.label) {
+            case 0:
+                checks = [];
+                record = function (label, pass, detail) { return checks.push({ label: label, pass: pass, detail: detail }); };
+                describe = function (value) {
+                    if (value === undefined || value === null)
+                        return String(value);
+                    var stringified = JSON.stringify(value);
+                    return stringified === undefined ? String(value) : stringified;
+                };
+                errorMessage = function (e) { return (typeof (e === null || e === void 0 ? void 0 : e.message) === 'string' && e.message !== '' ? e.message : describe(e)); };
+                expect_rejection = function (label, fn, expectedMessage) { return __awaiter(void 0, void 0, void 0, function () {
+                    var error, rejected, e_2, message;
+                    return __generator(this, function (_a) {
+                        switch (_a.label) {
+                            case 0:
+                                rejected = false;
+                                _a.label = 1;
+                            case 1:
+                                _a.trys.push([1, 3, , 4]);
+                                return [4 /*yield*/, fn()];
+                            case 2:
+                                _a.sent();
+                                return [3 /*break*/, 4];
+                            case 3:
+                                e_2 = _a.sent();
+                                rejected = true;
+                                error = e_2;
+                                return [3 /*break*/, 4];
+                            case 4:
+                                if (!rejected) {
+                                    // deliberately does NOT print the record: it is a patient profile / form response
+                                    record(label, false, "NOT REJECTED: the update succeeded (expected \"".concat(expectedMessage, "\")"));
                                     return [2 /*return*/];
-                            }
-                        });
-                    };
-                    _i = 0, _b = Object.entries(restrictedEnduserUpdates(sdk.userInfo.id, enduser_1.id));
-                    _l.label = 8;
-                case 8:
-                    if (!(_i < _b.length)) return [3 /*break*/, 11];
-                    _c = _b[_i], field = _c[0], value = _c[1];
-                    return [5 /*yield**/, _loop_1(field, value)];
-                case 9:
-                    _l.sent();
-                    _l.label = 10;
-                case 10:
-                    _i++;
-                    return [3 /*break*/, 8];
-                case 11: 
+                                }
+                                message = errorMessage(error);
+                                record(label, message === expectedMessage, message === expectedMessage
+                                    ? "rejected: ".concat(message)
+                                    : "rejected with the WRONG error: ".concat(message, " (expected \"").concat(expectedMessage, "\")"));
+                                return [2 /*return*/];
+                        }
+                    });
+                }); };
+                expect_result = function (label, fn, inspect) { return __awaiter(void 0, void 0, void 0, function () {
+                    var _a, pass, detail, _b, e_3;
+                    return __generator(this, function (_c) {
+                        switch (_c.label) {
+                            case 0:
+                                _c.trys.push([0, 2, , 3]);
+                                _b = inspect;
+                                return [4 /*yield*/, fn()];
+                            case 1:
+                                _a = _b.apply(void 0, [_c.sent()]), pass = _a.pass, detail = _a.detail;
+                                record(label, pass, detail);
+                                return [3 /*break*/, 3];
+                            case 2:
+                                e_3 = _c.sent();
+                                record(label, false, "rejected instead of resolving: ".concat(errorMessage(e_3)));
+                                return [3 /*break*/, 3];
+                            case 3: return [2 /*return*/];
+                        }
+                    });
+                }); };
+                _k.label = 1;
+            case 1:
+                _k.trys.push([1, , 25, 45]);
+                return [4 /*yield*/, setup_isolated_tenant({
+                        name: "Enduser write restrictions ".concat(RAND()),
+                        users: [{ isAdmin: true }],
+                        apiKeys: 0,
+                    })];
+            case 2:
+                tenant = _k.sent();
+                sdk_1 = tenant.sdk;
+                enduserEmail = "f0106-enduser-".concat(Date.now(), "@example.com");
+                return [4 /*yield*/, sdk_1.api.endusers.createOne({ email: enduserEmail, fname: 'F0106', lname: 'Restricted' })];
+            case 3:
+                enduser_1 = _k.sent();
+                enduserId = enduser_1.id;
+                return [4 /*yield*/, sdk_1.api.endusers.createOne({
+                        email: "f0106-other-".concat(Date.now(), "@example.com"), fname: 'F0106', lname: 'Other',
+                    })];
+            case 4:
+                otherEnduser_1 = _k.sent();
+                otherEnduserId = otherEnduser_1.id;
+                return [4 /*yield*/, sdk_1.api.endusers.set_password({ id: enduser_1.id, password: ENDUSER_PASSWORD })];
+            case 5:
+                _k.sent();
+                enduserSDK_1 = new EnduserSession({ host: host, businessId: tenant.businessId });
+                return [4 /*yield*/, enduserSDK_1.authenticate(enduserEmail, ENDUSER_PASSWORD)];
+            case 6:
+                _k.sent();
+                return [4 /*yield*/, sdk_1.api.forms.createOne({ title: 'Write Restriction Test Form' })];
+            case 7:
+                form = _k.sent();
+                formId = form.id;
+                return [4 /*yield*/, sdk_1.api.form_responses.prepare_form_response({
+                        formId: form.id,
+                        enduserId: enduser_1.id,
+                    })];
+            case 8:
+                formResponse_1 = (_k.sent()).response;
+                formResponseId = formResponse_1.id;
+                _loop_1 = function (field, value) {
+                    return __generator(this, function (_l) {
+                        switch (_l.label) {
+                            case 0: return [4 /*yield*/, expect_rejection("enduser cannot self-update endusers.".concat(field), function () {
+                                    var _a;
+                                    return enduserSDK_1.api.endusers.updateOne(enduser_1.id, (_a = {}, _a[field] = value, _a));
+                                }, "".concat(field, " cannot be updated by endusers"))];
+                            case 1:
+                                _l.sent();
+                                return [2 /*return*/];
+                        }
+                    });
+                };
+                _i = 0, _a = Object.entries(restrictedEnduserUpdates(sdk_1.userInfo.id, enduser_1.id));
+                _k.label = 9;
+            case 9:
+                if (!(_i < _a.length)) return [3 /*break*/, 12];
+                _b = _a[_i], field = _b[0], value = _b[1];
+                return [5 /*yield**/, _loop_1(field, value)];
+            case 10:
+                _k.sent();
+                _k.label = 11;
+            case 11:
+                _i++;
+                return [3 /*break*/, 9];
+            case 12: 
+            // Variant A persistence check: the rejected assignedTo write must not
+            // have granted the staff read-filter match.
+            return [4 /*yield*/, expect_result('rejected assignedTo write did not persist', function () { return sdk_1.api.endusers.getOne(enduser_1.id); }, function (e) {
+                    var _a, _b;
+                    return ({
+                        pass: !((_a = e.assignedTo) === null || _a === void 0 ? void 0 : _a.length) && !((_b = e.tags) === null || _b === void 0 ? void 0 : _b.length) && e.externalId === undefined,
+                        detail: "assignedTo=".concat(describe(e.assignedTo), " tags=").concat(describe(e.tags), " ")
+                            + "externalId=".concat(describe(e.externalId), " (want none of them set)"),
+                    });
+                })
+                // ---- enduser self-update of restricted form_responses fields must 400 ----
+            ];
+            case 13:
                 // Variant A persistence check: the rejected assignedTo write must not
                 // have granted the staff read-filter match.
-                return [4 /*yield*/, async_test('rejected assignedTo write did not persist', function () { return sdk.api.endusers.getOne(enduser_1.id); }, { onResult: function (e) { var _a, _b; return !((_a = e.assignedTo) === null || _a === void 0 ? void 0 : _a.length) && !((_b = e.tags) === null || _b === void 0 ? void 0 : _b.length) && e.externalId === undefined; } })
-                    // ---- enduser self-update of restricted form_responses fields must 400 ----
+                _k.sent();
+                _loop_2 = function (field, value) {
+                    return __generator(this, function (_m) {
+                        switch (_m.label) {
+                            case 0: return [4 /*yield*/, expect_rejection("enduser cannot self-update form_responses.".concat(field), function () {
+                                    var _a;
+                                    return enduserSDK_1.api.form_responses.updateOne(formResponse_1.id, (_a = {}, _a[field] = value, _a));
+                                }, "".concat(field, " cannot be updated by endusers"))];
+                            case 1:
+                                _m.sent();
+                                return [2 /*return*/];
+                        }
+                    });
+                };
+                _c = 0, _d = Object.entries(restrictedFormResponseUpdates(sdk_1.userInfo.id, otherEnduser_1.id));
+                _k.label = 14;
+            case 14:
+                if (!(_c < _d.length)) return [3 /*break*/, 17];
+                _e = _d[_c], field = _e[0], value = _e[1];
+                return [5 /*yield**/, _loop_2(field, value)];
+            case 15:
+                _k.sent();
+                _k.label = 16;
+            case 16:
+                _c++;
+                return [3 /*break*/, 14];
+            case 17: return [4 /*yield*/, expect_result('rejected writes did not persist (markedAsSubmitted, procedureCodes, submittedBy, enduserId)', function () { return sdk_1.api.form_responses.getOne(formResponse_1.id); }, function (fr) {
+                    var _a, _b;
+                    return ({
+                        pass: (!fr.markedAsSubmitted && !((_a = fr.procedureCodes) === null || _a === void 0 ? void 0 : _a.length) && fr.submittedBy === undefined
+                            // still points at its own patient: a successful repoint is what redirects the intake write
+                            && fr.enduserId === enduser_1.id),
+                        detail: "markedAsSubmitted=".concat(describe(fr.markedAsSubmitted), " ")
+                            + "procedureCodes=".concat(describe((_b = fr.procedureCodes) === null || _b === void 0 ? void 0 : _b.length), " submittedBy=").concat(describe(fr.submittedBy), " ")
+                            + "enduserId matches own=".concat(describe(fr.enduserId === enduser_1.id)),
+                    });
+                })
+                // ---- Positive controls: intended enduser self-updates still work ----
+            ];
+            case 18:
+                _k.sent();
+                // ---- Positive controls: intended enduser self-updates still work ----
+                return [4 /*yield*/, expect_result('enduser can still update own profile fields (fname/lname)', function () { return enduserSDK_1.api.endusers.updateOne(enduser_1.id, { fname: 'StillAllowed', lname: 'Patient' }); }, function (e) { return ({
+                        pass: e.fname === 'StillAllowed' && e.lname === 'Patient',
+                        detail: "fname set=".concat(describe(e.fname === 'StillAllowed'), " lname set=").concat(describe(e.lname === 'Patient')),
+                    }); })];
+            case 19:
+                // ---- Positive controls: intended enduser self-updates still work ----
+                _k.sent();
+                return [4 /*yield*/, expect_result('enduser can still update own form_response (hideFromEnduserPortal — intended per schema)', function () { return enduserSDK_1.api.form_responses.updateOne(formResponse_1.id, { hideFromEnduserPortal: true }); }, function (fr) { return ({
+                        pass: fr.hideFromEnduserPortal === true,
+                        detail: "hideFromEnduserPortal=".concat(describe(fr.hideFromEnduserPortal), " (want true)"),
+                    }); })
+                    // ---- Positive controls: staff sessions are unaffected by enduserUpdatesDisabled ----
                 ];
-                case 12:
-                    // Variant A persistence check: the rejected assignedTo write must not
-                    // have granted the staff read-filter match.
-                    _l.sent();
-                    _loop_2 = function (field, value) {
-                        return __generator(this, function (_o) {
-                            switch (_o.label) {
-                                case 0: return [4 /*yield*/, async_test("enduser cannot self-update form_responses.".concat(field), function () {
-                                        var _a;
-                                        return enduserSDK_1.api.form_responses.updateOne(formResponse_1.id, (_a = {}, _a[field] = value, _a));
-                                    }, { shouldError: true, onError: function (e) { return e.message === "".concat(field, " cannot be updated by endusers"); } })];
-                                case 1:
-                                    _o.sent();
-                                    return [2 /*return*/];
-                            }
+            case 20:
+                _k.sent();
+                // ---- Positive controls: staff sessions are unaffected by enduserUpdatesDisabled ----
+                return [4 /*yield*/, expect_result('staff can still update restricted endusers fields (tags, assignedTo, externalId, note, source)', function () { return sdk_1.api.endusers.updateOne(enduser_1.id, {
+                        tags: ['staff-set-tag'],
+                        assignedTo: [sdk_1.userInfo.id],
+                        externalId: 'staff-set-external-id',
+                        note: 'staff-set note',
+                        source: 'staff-set-source',
+                    }); }, function (e) {
+                        var _a, _b, _c;
+                        return ({
+                            pass: (!!((_a = e.tags) === null || _a === void 0 ? void 0 : _a.includes('staff-set-tag'))
+                                && !!((_b = e.assignedTo) === null || _b === void 0 ? void 0 : _b.includes(sdk_1.userInfo.id))
+                                && e.externalId === 'staff-set-external-id'),
+                            detail: "tags=".concat(describe(e.tags), " assignedTo includes staff=")
+                                + "".concat(describe(!!((_c = e.assignedTo) === null || _c === void 0 ? void 0 : _c.includes(sdk_1.userInfo.id))), " externalId=").concat(describe(e.externalId)),
                         });
-                    };
-                    _d = 0, _e = Object.entries(restrictedFormResponseUpdates(sdk.userInfo.id, otherEnduser_1.id));
-                    _l.label = 13;
-                case 13:
-                    if (!(_d < _e.length)) return [3 /*break*/, 16];
-                    _f = _e[_d], field = _f[0], value = _f[1];
-                    return [5 /*yield**/, _loop_2(field, value)];
-                case 14:
-                    _l.sent();
-                    _l.label = 15;
-                case 15:
-                    _d++;
-                    return [3 /*break*/, 13];
-                case 16: return [4 /*yield*/, async_test('rejected writes did not persist (markedAsSubmitted, procedureCodes, submittedBy, enduserId)', function () { return sdk.api.form_responses.getOne(formResponse_1.id); }, { onResult: function (fr) {
-                            var _a;
-                            return (!fr.markedAsSubmitted && !((_a = fr.procedureCodes) === null || _a === void 0 ? void 0 : _a.length) && fr.submittedBy === undefined
-                                // still points at its own patient: a successful repoint is what redirects the intake write
-                                && fr.enduserId === enduser_1.id);
-                        } })
-                    // ---- Positive controls: intended enduser self-updates still work ----
-                ];
-                case 17:
-                    _l.sent();
-                    // ---- Positive controls: intended enduser self-updates still work ----
-                    return [4 /*yield*/, async_test('enduser can still update own profile fields (fname/lname)', function () { return enduserSDK_1.api.endusers.updateOne(enduser_1.id, { fname: 'StillAllowed', lname: 'Patient' }); }, { onResult: function (e) { return e.fname === 'StillAllowed' && e.lname === 'Patient'; } })];
-                case 18:
-                    // ---- Positive controls: intended enduser self-updates still work ----
-                    _l.sent();
-                    return [4 /*yield*/, async_test('enduser can still update own form_response (hideFromEnduserPortal — intended per schema)', function () { return enduserSDK_1.api.form_responses.updateOne(formResponse_1.id, { hideFromEnduserPortal: true }); }, { onResult: function (fr) { return fr.hideFromEnduserPortal === true; } })
-                        // ---- Positive controls: staff sessions are unaffected by enduserUpdatesDisabled ----
-                    ];
-                case 19:
-                    _l.sent();
-                    // ---- Positive controls: staff sessions are unaffected by enduserUpdatesDisabled ----
-                    return [4 /*yield*/, async_test('staff can still update restricted endusers fields (tags, assignedTo, externalId, note, source)', function () { return sdk.api.endusers.updateOne(enduser_1.id, {
-                            tags: ['staff-set-tag'],
-                            assignedTo: [sdk.userInfo.id],
-                            externalId: 'staff-set-external-id',
-                            note: 'staff-set note',
-                            source: 'staff-set-source',
-                        }); }, { onResult: function (e) {
-                                var _a, _b;
-                                return (!!((_a = e.tags) === null || _a === void 0 ? void 0 : _a.includes('staff-set-tag'))
-                                    && !!((_b = e.assignedTo) === null || _b === void 0 ? void 0 : _b.includes(sdk.userInfo.id))
-                                    && e.externalId === 'staff-set-external-id');
-                            } })];
-                case 20:
-                    // ---- Positive controls: staff sessions are unaffected by enduserUpdatesDisabled ----
-                    _l.sent();
-                    return [4 /*yield*/, async_test('staff can still update restricted form_responses fields (procedureCodes, diagnosisCodes, tags)', function () { return sdk.api.form_responses.updateOne(formResponse_1.id, {
-                            procedureCodes: [{ code: 'G0019', units: 1 }],
-                            diagnosisCodes: [{ code: 'Z71.3', description: 'Dietary counseling and surveillance' }],
-                            tags: ['staff-set-tag'],
-                        }); }, { onResult: function (fr) {
-                                var _a, _b, _c, _d, _e;
-                                return (((_b = (_a = fr.procedureCodes) === null || _a === void 0 ? void 0 : _a[0]) === null || _b === void 0 ? void 0 : _b.code) === 'G0019'
-                                    && ((_d = (_c = fr.diagnosisCodes) === null || _c === void 0 ? void 0 : _c[0]) === null || _d === void 0 ? void 0 : _d.code) === 'Z71.3'
-                                    && !!((_e = fr.tags) === null || _e === void 0 ? void 0 : _e.includes('staff-set-tag')));
-                            } })
-                        // enduserId is enduserUpdatesDisabled rather than updatesDisabled specifically so this keeps
-                        // working: staff sometimes need to move a response to the correct profile to fix a mistake.
-                    ];
-                case 21:
-                    _l.sent();
-                    // enduserId is enduserUpdatesDisabled rather than updatesDisabled specifically so this keeps
-                    // working: staff sometimes need to move a response to the correct profile to fix a mistake.
-                    return [4 /*yield*/, async_test('staff can still repoint form_responses.enduserId to another patient', function () { return sdk.api.form_responses.updateOne(formResponse_1.id, { enduserId: otherEnduser_1.id }); }, { onResult: function (fr) { return fr.enduserId === otherEnduser_1.id; } })];
-                case 22:
+                    })];
+            case 21:
+                // ---- Positive controls: staff sessions are unaffected by enduserUpdatesDisabled ----
+                _k.sent();
+                return [4 /*yield*/, expect_result('staff can still update restricted form_responses fields (procedureCodes, diagnosisCodes, tags)', function () { return sdk_1.api.form_responses.updateOne(formResponse_1.id, {
+                        procedureCodes: [{ code: 'G0019', units: 1 }],
+                        diagnosisCodes: [{ code: 'Z71.3', description: 'Dietary counseling and surveillance' }],
+                        tags: ['staff-set-tag'],
+                    }); }, function (fr) {
+                        var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+                        return ({
+                            pass: (((_b = (_a = fr.procedureCodes) === null || _a === void 0 ? void 0 : _a[0]) === null || _b === void 0 ? void 0 : _b.code) === 'G0019'
+                                && ((_d = (_c = fr.diagnosisCodes) === null || _c === void 0 ? void 0 : _c[0]) === null || _d === void 0 ? void 0 : _d.code) === 'Z71.3'
+                                && !!((_e = fr.tags) === null || _e === void 0 ? void 0 : _e.includes('staff-set-tag'))),
+                            detail: "procedureCodes[0].code=".concat(describe((_g = (_f = fr.procedureCodes) === null || _f === void 0 ? void 0 : _f[0]) === null || _g === void 0 ? void 0 : _g.code), " ")
+                                + "diagnosisCodes[0].code=".concat(describe((_j = (_h = fr.diagnosisCodes) === null || _h === void 0 ? void 0 : _h[0]) === null || _j === void 0 ? void 0 : _j.code), " tags=").concat(describe(fr.tags)),
+                        });
+                    })
                     // enduserId is enduserUpdatesDisabled rather than updatesDisabled specifically so this keeps
                     // working: staff sometimes need to move a response to the correct profile to fix a mistake.
-                    _l.sent();
-                    return [4 /*yield*/, async_test('staff can repoint form_responses.enduserId back', function () { return sdk.api.form_responses.updateOne(formResponse_1.id, { enduserId: enduser_1.id }); }, { onResult: function (fr) { return fr.enduserId === enduser_1.id; } })];
-                case 23:
-                    _l.sent();
-                    return [3 /*break*/, 41];
-                case 24:
-                    if (!formResponseId) return [3 /*break*/, 28];
-                    _l.label = 25;
-                case 25:
-                    _l.trys.push([25, 27, , 28]);
-                    return [4 /*yield*/, sdk.api.form_responses.deleteOne(formResponseId)];
-                case 26:
-                    _l.sent();
-                    return [3 /*break*/, 28];
-                case 27:
-                    _g = _l.sent();
-                    return [3 /*break*/, 28];
-                case 28:
-                    if (!formId) return [3 /*break*/, 32];
-                    _l.label = 29;
-                case 29:
-                    _l.trys.push([29, 31, , 32]);
-                    return [4 /*yield*/, sdk.api.forms.deleteOne(formId)];
-                case 30:
-                    _l.sent();
-                    return [3 /*break*/, 32];
-                case 31:
-                    _h = _l.sent();
-                    return [3 /*break*/, 32];
-                case 32:
-                    if (!enduserId) return [3 /*break*/, 36];
-                    _l.label = 33;
-                case 33:
-                    _l.trys.push([33, 35, , 36]);
-                    return [4 /*yield*/, sdk.api.endusers.deleteOne(enduserId)];
-                case 34:
-                    _l.sent();
-                    return [3 /*break*/, 36];
-                case 35:
-                    _j = _l.sent();
-                    return [3 /*break*/, 36];
-                case 36:
-                    if (!otherEnduserId) return [3 /*break*/, 40];
-                    _l.label = 37;
-                case 37:
-                    _l.trys.push([37, 39, , 40]);
-                    return [4 /*yield*/, sdk.api.endusers.deleteOne(otherEnduserId)];
-                case 38:
-                    _l.sent();
-                    return [3 /*break*/, 40];
-                case 39:
-                    _k = _l.sent();
-                    return [3 /*break*/, 40];
-                case 40: return [7 /*endfinally*/];
-                case 41: return [2 /*return*/];
-            }
-        });
+                ];
+            case 22:
+                _k.sent();
+                // enduserId is enduserUpdatesDisabled rather than updatesDisabled specifically so this keeps
+                // working: staff sometimes need to move a response to the correct profile to fix a mistake.
+                return [4 /*yield*/, expect_result('staff can still repoint form_responses.enduserId to another patient', function () { return sdk_1.api.form_responses.updateOne(formResponse_1.id, { enduserId: otherEnduser_1.id }); }, function (fr) { return ({
+                        pass: fr.enduserId === otherEnduser_1.id,
+                        detail: "repointed to the other patient=".concat(describe(fr.enduserId === otherEnduser_1.id)),
+                    }); })];
+            case 23:
+                // enduserId is enduserUpdatesDisabled rather than updatesDisabled specifically so this keeps
+                // working: staff sometimes need to move a response to the correct profile to fix a mistake.
+                _k.sent();
+                return [4 /*yield*/, expect_result('staff can repoint form_responses.enduserId back', function () { return sdk_1.api.form_responses.updateOne(formResponse_1.id, { enduserId: enduser_1.id }); }, function (fr) { return ({
+                        pass: fr.enduserId === enduser_1.id,
+                        detail: "repointed back to the owner=".concat(describe(fr.enduserId === enduser_1.id)),
+                    }); })];
+            case 24:
+                _k.sent();
+                return [3 /*break*/, 45];
+            case 25:
+                if (!tenant) return [3 /*break*/, 44];
+                sdk = tenant.sdk;
+                if (!formResponseId) return [3 /*break*/, 29];
+                _k.label = 26;
+            case 26:
+                _k.trys.push([26, 28, , 29]);
+                return [4 /*yield*/, sdk.api.form_responses.deleteOne(formResponseId)];
+            case 27:
+                _k.sent();
+                return [3 /*break*/, 29];
+            case 28:
+                _f = _k.sent();
+                return [3 /*break*/, 29];
+            case 29:
+                if (!formId) return [3 /*break*/, 33];
+                _k.label = 30;
+            case 30:
+                _k.trys.push([30, 32, , 33]);
+                return [4 /*yield*/, sdk.api.forms.deleteOne(formId)];
+            case 31:
+                _k.sent();
+                return [3 /*break*/, 33];
+            case 32:
+                _g = _k.sent();
+                return [3 /*break*/, 33];
+            case 33:
+                if (!enduserId) return [3 /*break*/, 37];
+                _k.label = 34;
+            case 34:
+                _k.trys.push([34, 36, , 37]);
+                return [4 /*yield*/, sdk.api.endusers.deleteOne(enduserId)];
+            case 35:
+                _k.sent();
+                return [3 /*break*/, 37];
+            case 36:
+                _h = _k.sent();
+                return [3 /*break*/, 37];
+            case 37:
+                if (!otherEnduserId) return [3 /*break*/, 41];
+                _k.label = 38;
+            case 38:
+                _k.trys.push([38, 40, , 41]);
+                return [4 /*yield*/, sdk.api.endusers.deleteOne(otherEnduserId)];
+            case 39:
+                _k.sent();
+                return [3 /*break*/, 41];
+            case 40:
+                _j = _k.sent();
+                return [3 /*break*/, 41];
+            case 41:
+                _k.trys.push([41, 43, , 44]);
+                return [4 /*yield*/, tenant.teardown()];
+            case 42:
+                _k.sent();
+                return [3 /*break*/, 44];
+            case 43:
+                e_1 = _k.sent();
+                console.error('teardown failed', e_1);
+                return [3 /*break*/, 44];
+            case 44: return [7 /*endfinally*/];
+            case 45: return [2 /*return*/, checks];
+        }
     });
+}); };
+/** Asserting wrapper, for standalone runs. */
+export var enduser_write_restrictions_tests = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var _a, _b;
+    return __generator(this, function (_c) {
+        switch (_c.label) {
+            case 0:
+                _a = assert_checks;
+                _b = ['Enduser write restrictions'];
+                return [4 /*yield*/, enduser_write_restrictions_checks()];
+            case 1:
+                _a.apply(void 0, _b.concat([_c.sent()]));
+                return [2 /*return*/];
+        }
+    });
+}); };
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export var ISOLATED_SUITE = {
+    name: 'Enduser write restrictions',
+    run: enduser_write_restrictions_checks,
 };
 // Allow running this test file independently
 if (require.main === module) {
     console.log("\uD83C\uDF10 Using API URL: ".concat(host));
-    var sdk_1 = new Session({ host: host });
-    var sdkNonAdmin_1 = new Session({ host: host });
-    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
-        return __generator(this, function (_a) {
-            switch (_a.label) {
-                case 0: return [4 /*yield*/, setup_tests(sdk_1, sdkNonAdmin_1)];
-                case 1:
-                    _a.sent();
-                    return [4 /*yield*/, enduser_write_restrictions_tests({ sdk: sdk_1, sdkNonAdmin: sdkNonAdmin_1 })];
-                case 2:
-                    _a.sent();
-                    return [2 /*return*/];
-            }
-        });
-    }); };
-    runTests()
+    enduser_write_restrictions_tests()
         .then(function () {
         console.log("✅ enduser write-restriction test suite completed successfully");
         process.exit(0);