@tellescope/sdk 2.0.0-beta.1 → 2.0.0-beta.3

package/lib/esm/tests/api_tests/welle_partner_token.test.js

@@ -36,20 +36,28 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
 };
 require('source-map-support').install();
 import { createHmac } from "crypto";
-import { Session, EnduserSession } from "../../sdk";
-import { assert, async_test, log_header, wait, } from "@tellescope/testing";
+import { EnduserSession } from "../../sdk";
 import { HEALTHIE_TITLE, WELLE_TITLE } from "@tellescope/constants";
-import { authenticate_enduser_via_token, setup_tests } from "../setup";
+import { assert_checks, setup_isolated_tenant, } from "../setup_isolated";
 var host = process.env.API_URL || 'http://localhost:8080';
+var RAND = function () { return Math.random().toString(36).slice(2, 10); };
 var SIGNING_KEY = 'welle_test_signing_key_do_not_use_in_prod';
 var HEALTHIE_PATIENT_ID = '999888777';
 // decoding needs no dependency: these tests assert on CLAIMS, and verify the signature separately with crypto
 var decode_jwt_header = function (token) { return (JSON.parse(Buffer.from(token.split('.')[0], 'base64url').toString())); };
 var decode_jwt_payload = function (token) { return JSON.parse(Buffer.from(token.split('.')[1], 'base64url').toString()); };
 var sign_hs256 = function (signingInput, key) { return (createHmac('sha256', key).update(signingInput).digest('base64url')); };
-// reset_db does NOT clear integrations, so a crashed prior run can leave a Welle record behind.
-// The partner-token branch does findOne({ title: WELLE_TITLE }), so a stray record would make the
-// "disconnected" assertion pass spuriously — clear them all rather than only the one we created.
+/**
+ * Deletes this tenant's Welle integration records.
+ *
+ * Scenario 7 below (the "disconnected" rejection) is what needs it: the partner-token branch does
+ * findOne({ title: WELLE_TITLE }), so the record has to be gone for that assertion to mean anything.
+ * It is deliberately a delete-by-title rather than a delete of the id created here, because
+ * add_api_key_integration later creates a second record the same way the product does.
+ *
+ * On a provisioned tenant it can only ever see this suite's own records — on the shared organization
+ * it deleted other suites' Welle integrations too, which is one of the reasons this suite moved.
+ */
 var delete_all_welle_integrations = function (sdk) { return __awaiter(void 0, void 0, void 0, function () {
     var existing, _i, _a, integration;
     return __generator(this, function (_b) {
@@ -73,269 +81,402 @@ var delete_all_welle_integrations = function (sdk) { return __awaiter(void 0, vo
         }
     });
 }); };
-export var welle_partner_token_tests = function (_a) {
-    var sdk = _a.sdk, sdkNonAdmin = _a.sdkNonAdmin;
-    return __awaiter(void 0, void 0, void 0, function () {
-        var suffix, linkedEmail, unlinkedEmail, linkedId, unlinkedId, linked, unlinked, linkedSDK_1, unlinkedSDK_1, issuedToken_1, _b, header, payload, signature, _i, _c, id;
-        return __generator(this, function (_d) {
-            switch (_d.label) {
-                case 0:
-                    log_header("Welle Partner Token Tests");
-                    suffix = Math.random().toString(36).slice(2, 10);
-                    linkedEmail = "welle.linked.".concat(suffix, "@tellescope.com");
-                    unlinkedEmail = "welle.unlinked.".concat(suffix, "@tellescope.com");
-                    linkedId = '';
-                    unlinkedId = '';
-                    _d.label = 1;
-                case 1:
-                    _d.trys.push([1, , 27, 34]);
-                    return [4 /*yield*/, delete_all_welle_integrations(sdk)];
-                case 2:
-                    _d.sent();
-                    return [4 /*yield*/, sdk.api.integrations.createOne({
-                            title: WELLE_TITLE,
-                            authentication: {
-                                type: 'apiKey',
-                                info: {
-                                    access_token: SIGNING_KEY,
-                                    refresh_token: 'unused',
-                                    scope: '',
-                                    token_type: 'Bearer',
-                                    expiry_date: 0,
-                                },
+// Welle partner-token (SSO launch) coverage: HS256 claims for a Healthie-linked patient, jti
+// uniqueness, the 60s expiry, the non-forgeable subject, the disconnected / unlinked / staff-session
+// rejections, and the real add_api_key_integration / remove_api_key_integration connect paths.
+//
+// Runs on its own provisioned tenant, so no pre-run "clear every Welle record in the org" reset is
+// needed and no other suite's integrations are ever touched.
+export var welle_partner_token_checks = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var checks, record, describe, errorMessage, expect_result, expect_rejected, record_sync, tenant, suffix, linkedEmail, unlinkedEmail, linkedId, unlinkedId, sdk_1, sdkNonAdmin_1, businessId_1, linked, unlinked, enduser_session, linkedSDK_1, unlinkedSDK_1, issuedToken_1, sdk, businessId, _i, _a, id, e_1;
+    return __generator(this, function (_b) {
+        switch (_b.label) {
+            case 0:
+                checks = [];
+                record = function (label, pass, detail) { return checks.push({ label: label, pass: pass, detail: detail }); };
+                describe = function (value) {
+                    if (value === undefined || value === null)
+                        return String(value);
+                    var stringified = JSON.stringify(value);
+                    return stringified === undefined ? String(value) : stringified;
+                };
+                errorMessage = function (e) { return (typeof (e === null || e === void 0 ? void 0 : e.message) === 'string' && e.message !== '' ? e.message : describe(e)); };
+                expect_result = function (label, fn, onResult) { return __awaiter(void 0, void 0, void 0, function () {
+                    var resolved, e_2, value;
+                    var _a;
+                    return __generator(this, function (_b) {
+                        switch (_b.label) {
+                            case 0:
+                                _b.trys.push([0, 2, , 3]);
+                                _a = {};
+                                return [4 /*yield*/, fn()];
+                            case 1:
+                                resolved = (_a.value = _b.sent(), _a);
+                                return [3 /*break*/, 3];
+                            case 2:
+                                e_2 = _b.sent();
+                                record(label, false, "rejected instead of resolving: ".concat(errorMessage(e_2)));
+                                return [2 /*return*/];
+                            case 3:
+                                value = resolved.value;
+                                try {
+                                    record(label, onResult(value), "result=".concat(describe(value)));
+                                }
+                                catch (predicateError) {
+                                    record(label, false, "predicate threw on result=".concat(describe(value), ": ").concat(errorMessage(predicateError)));
+                                }
+                                return [2 /*return*/];
+                        }
+                    });
+                }); };
+                expect_rejected = function (label, fn, onError) {
+                    if (onError === void 0) { onError = function () { return true; }; }
+                    return __awaiter(void 0, void 0, void 0, function () {
+                        var rejection, unexpected, e_3;
+                        return __generator(this, function (_a) {
+                            switch (_a.label) {
+                                case 0:
+                                    _a.trys.push([0, 2, , 3]);
+                                    return [4 /*yield*/, fn()];
+                                case 1:
+                                    unexpected = _a.sent();
+                                    record(label, false, "resolved instead of rejecting; result=".concat(describe(unexpected)));
+                                    return [2 /*return*/];
+                                case 2:
+                                    e_3 = _a.sent();
+                                    rejection = { e: e_3 };
+                                    return [3 /*break*/, 3];
+                                case 3:
+                                    // Outside the catch on purpose: a predicate that throws here would otherwise escape the suite
+                                    // and, per run_isolated_in_parallel, abort every remaining batch instead of failing one check.
+                                    try {
+                                        record(label, onError(rejection.e), "rejected with ".concat(errorMessage(rejection.e)));
+                                    }
+                                    catch (predicateError) {
+                                        record(label, false, "predicate threw on rejection ".concat(errorMessage(rejection.e), ": ").concat(errorMessage(predicateError)));
+                                    }
+                                    return [2 /*return*/];
+                            }
+                        });
+                    });
+                };
+                record_sync = function (label, evaluate) {
+                    try {
+                        var _a = evaluate(), pass = _a.pass, detail = _a.detail;
+                        record(label, pass, detail);
+                    }
+                    catch (e) {
+                        record(label, false, "evaluation threw: ".concat(errorMessage(e)));
+                    }
+                };
+                suffix = RAND();
+                linkedEmail = "welle.linked.".concat(suffix, "@tellescope.com");
+                unlinkedEmail = "welle.unlinked.".concat(suffix, "@tellescope.com");
+                linkedId = '';
+                unlinkedId = '';
+                _b.label = 1;
+            case 1:
+                _b.trys.push([1, , 27, 37]);
+                return [4 /*yield*/, setup_isolated_tenant({
+                        name: "Welle partner token ".concat(RAND()),
+                        apiKeys: 0,
+                    })];
+            case 2:
+                // the default user spec provisions an Admin plus a non-admin — sdkNonAdmin is the staff session
+                // checked below, which must also not be served a partner token
+                tenant = _b.sent();
+                sdk_1 = tenant.sdk, sdkNonAdmin_1 = tenant.sdkNonAdmin, businessId_1 = tenant.businessId;
+                return [4 /*yield*/, sdk_1.api.integrations.createOne({
+                        title: WELLE_TITLE,
+                        authentication: {
+                            type: 'apiKey',
+                            info: {
+                                access_token: SIGNING_KEY,
+                                refresh_token: 'unused',
+                                scope: '',
+                                token_type: 'Bearer',
+                                expiry_date: 0,
                             },
-                        })
-                        // an enduser linked to Healthie — eligible for a partner token
-                    ];
-                case 3:
-                    _d.sent();
-                    return [4 /*yield*/, sdk.api.endusers.createOne({ email: linkedEmail, fname: 'Welle', lname: 'Linked' })];
-                case 4:
-                    linked = _d.sent();
-                    linkedId = linked.id;
-                    return [4 /*yield*/, sdk.api.endusers.updateOne(linkedId, { references: [{ type: HEALTHIE_TITLE, id: HEALTHIE_PATIENT_ID }] }, { replaceObjectFields: true })
-                        // an enduser with no Healthie reference
-                    ];
-                case 5:
-                    _d.sent();
-                    return [4 /*yield*/, sdk.api.endusers.createOne({ email: unlinkedEmail, fname: 'Welle', lname: 'Unlinked' })];
-                case 6:
-                    unlinked = _d.sent();
-                    unlinkedId = unlinked.id;
-                    linkedSDK_1 = new EnduserSession({ host: host, businessId: sdk.userInfo.businessId });
-                    return [4 /*yield*/, authenticate_enduser_via_token(sdk, linkedSDK_1, { email: linkedEmail })];
-                case 7:
-                    _d.sent();
-                    unlinkedSDK_1 = new EnduserSession({ host: host, businessId: sdk.userInfo.businessId });
-                    return [4 /*yield*/, authenticate_enduser_via_token(sdk, unlinkedSDK_1, { email: unlinkedEmail })
-                        // 1) happy path — claims are correct
-                    ];
-                case 8:
-                    _d.sent();
-                    issuedToken_1 = '';
-                    return [4 /*yield*/, async_test("enduser can mint a Welle partner token with the expected claims", function () { return linkedSDK_1.api.integrations.proxy_read({ integration: WELLE_TITLE, type: 'partner-redirect-token' }); }, { onResult: function (r) {
-                                var _a;
-                                issuedToken_1 = (_a = r === null || r === void 0 ? void 0 : r.data) === null || _a === void 0 ? void 0 : _a.token;
-                                if (!issuedToken_1)
-                                    return false;
-                                var header = decode_jwt_header(issuedToken_1);
-                                var payload = decode_jwt_payload(issuedToken_1);
-                                var expectedExp = Math.floor(Date.now() / 1000) + 60;
-                                return (header.alg === 'HS256'
-                                    && payload.sub === HEALTHIE_PATIENT_ID
-                                    && payload.iss === 'tellescope'
-                                    && payload.aud === 'welle:sso-launch'
-                                    && typeof payload.jti === 'string' && payload.jti.length > 0
-                                    && Math.abs(payload.exp - expectedExp) < 10);
-                            } })
-                        // each launch gets a unique jti
-                    ];
-                case 9:
-                    _d.sent();
-                    // each launch gets a unique jti
-                    return [4 /*yield*/, async_test("back-to-back tokens carry distinct jti values", function () { return linkedSDK_1.api.integrations.proxy_read({ integration: WELLE_TITLE, type: 'partner-redirect-token' }); }, { onResult: function (r) {
-                                var _a;
-                                var second = (_a = r === null || r === void 0 ? void 0 : r.data) === null || _a === void 0 ? void 0 : _a.token;
-                                if (!second)
-                                    return false;
-                                return decode_jwt_payload(second).jti !== decode_jwt_payload(issuedToken_1).jti;
-                            } })
-                        // optional deep-link target — allowlisted value is echoed as a claim
-                    ];
-                case 10:
+                        },
+                    })
+                    // an enduser linked to Healthie — eligible for a partner token
+                ];
+            case 3:
+                _b.sent();
+                return [4 /*yield*/, sdk_1.api.endusers.createOne({ email: linkedEmail, fname: 'Welle', lname: 'Linked' })];
+            case 4:
+                linked = _b.sent();
+                linkedId = linked.id;
+                return [4 /*yield*/, sdk_1.api.endusers.updateOne(linkedId, { references: [{ type: HEALTHIE_TITLE, id: HEALTHIE_PATIENT_ID }] }, { replaceObjectFields: true })
+                    // an enduser with no Healthie reference
+                ];
+            case 5:
+                _b.sent();
+                return [4 /*yield*/, sdk_1.api.endusers.createOne({ email: unlinkedEmail, fname: 'Welle', lname: 'Unlinked' })];
+            case 6:
+                unlinked = _b.sent();
+                unlinkedId = unlinked.id;
+                enduser_session = function (filter) { return __awaiter(void 0, void 0, void 0, function () {
+                    var enduserSDK, _a, authToken, enduser;
+                    return __generator(this, function (_b) {
+                        switch (_b.label) {
+                            case 0:
+                                enduserSDK = new EnduserSession({ host: host, businessId: businessId_1 });
+                                return [4 /*yield*/, sdk_1.api.endusers.generate_auth_token(filter)];
+                            case 1:
+                                _a = _b.sent(), authToken = _a.authToken, enduser = _a.enduser;
+                                return [4 /*yield*/, enduserSDK.handle_new_session({ authToken: authToken, enduser: enduser })];
+                            case 2:
+                                _b.sent();
+                                return [2 /*return*/, enduserSDK];
+                        }
+                    });
+                }); };
+                return [4 /*yield*/, enduser_session({ email: linkedEmail })];
+            case 7:
+                linkedSDK_1 = _b.sent();
+                return [4 /*yield*/, enduser_session({ email: unlinkedEmail })
+                    // 1) happy path — claims are correct
+                ];
+            case 8:
+                unlinkedSDK_1 = _b.sent();
+                issuedToken_1 = '';
+                return [4 /*yield*/, expect_result("enduser can mint a Welle partner token with the expected claims", function () { return linkedSDK_1.api.integrations.proxy_read({ integration: WELLE_TITLE, type: 'partner-redirect-token' }); }, function (r) {
+                        var _a;
+                        issuedToken_1 = (_a = r === null || r === void 0 ? void 0 : r.data) === null || _a === void 0 ? void 0 : _a.token;
+                        if (!issuedToken_1)
+                            return false;
+                        var header = decode_jwt_header(issuedToken_1);
+                        var payload = decode_jwt_payload(issuedToken_1);
+                        var expectedExp = Math.floor(Date.now() / 1000) + 60;
+                        return (header.alg === 'HS256'
+                            && payload.sub === HEALTHIE_PATIENT_ID
+                            && payload.iss === 'tellescope'
+                            && payload.aud === 'welle:sso-launch'
+                            && typeof payload.jti === 'string' && payload.jti.length > 0
+                            && Math.abs(payload.exp - expectedExp) < 10);
+                    })
                     // each launch gets a unique jti
-                    _d.sent();
-                    // optional deep-link target — allowlisted value is echoed as a claim
-                    return [4 /*yield*/, async_test("target: 'plan' is included as a target claim", function () { return linkedSDK_1.api.integrations.proxy_read({ integration: WELLE_TITLE, type: 'partner-redirect-token', target: 'plan' }); }, { onResult: function (r) {
-                                var _a;
-                                return (!!((_a = r === null || r === void 0 ? void 0 : r.data) === null || _a === void 0 ? void 0 : _a.token) && decode_jwt_payload(r.data.token).target === 'plan');
-                            } })
-                        // omitted target → no target claim at all (the happy-path token above was minted without one)
-                    ];
-                case 11:
+                ];
+            case 9:
+                _b.sent();
+                // each launch gets a unique jti
+                return [4 /*yield*/, expect_result("back-to-back tokens carry distinct jti values", function () { return linkedSDK_1.api.integrations.proxy_read({ integration: WELLE_TITLE, type: 'partner-redirect-token' }); }, function (r) {
+                        var _a;
+                        var second = (_a = r === null || r === void 0 ? void 0 : r.data) === null || _a === void 0 ? void 0 : _a.token;
+                        if (!second || !issuedToken_1)
+                            return false;
+                        return decode_jwt_payload(second).jti !== decode_jwt_payload(issuedToken_1).jti;
+                    })
                     // optional deep-link target — allowlisted value is echoed as a claim
-                    _d.sent();
+                ];
+            case 10:
+                // each launch gets a unique jti
+                _b.sent();
+                // optional deep-link target — allowlisted value is echoed as a claim
+                return [4 /*yield*/, expect_result("target: 'plan' is included as a target claim", function () { return linkedSDK_1.api.integrations.proxy_read({ integration: WELLE_TITLE, type: 'partner-redirect-token', target: 'plan' }); }, function (r) { var _a; return !!((_a = r === null || r === void 0 ? void 0 : r.data) === null || _a === void 0 ? void 0 : _a.token) && decode_jwt_payload(r.data.token).target === 'plan'; })
                     // omitted target → no target claim at all (the happy-path token above was minted without one)
-                    assert(decode_jwt_payload(issuedToken_1).target === undefined, "token minted without a target has a target claim", "token minted without a target has no target claim");
-                    // non-allowlisted target is rejected at the API boundary by schema validation
-                    return [4 /*yield*/, async_test("invalid target is rejected by schema validation", function () { return linkedSDK_1.api.integrations.proxy_read({
-                            integration: WELLE_TITLE,
-                            type: 'partner-redirect-token',
-                            target: 'admin',
-                        }); }, { shouldError: true, onError: function () { return true; } })
-                        // 2) the signature is real — verifies against the stored signing key, and only that key
-                    ];
-                case 12:
-                    // non-allowlisted target is rejected at the API boundary by schema validation
-                    _d.sent();
-                    _b = issuedToken_1.split('.'), header = _b[0], payload = _b[1], signature = _b[2];
-                    assert(sign_hs256("".concat(header, ".").concat(payload), SIGNING_KEY) === signature, "token signature does not verify against the stored Welle signing key", "token is signed with the organization's Welle signing key");
-                    assert(sign_hs256("".concat(header, ".").concat(payload), "".concat(SIGNING_KEY, "_wrong")) !== signature, "token signature verified against the WRONG key", "token signature does not verify against a different key");
-                    // 3) the subject is non-forgeable — the branch ignores the id param and uses the session's enduser
-                    return [4 /*yield*/, async_test("enduser cannot mint a token for another enduser by passing id", function () { return linkedSDK_1.api.integrations.proxy_read({
-                            integration: WELLE_TITLE,
-                            type: 'partner-redirect-token',
-                            id: unlinkedId,
-                        }); }, { onResult: function (r) {
-                                var _a;
-                                return (!!((_a = r === null || r === void 0 ? void 0 : r.data) === null || _a === void 0 ? void 0 : _a.token) && decode_jwt_payload(r.data.token).sub === HEALTHIE_PATIENT_ID);
-                            } })
-                        // 4) an enduser with no Healthie reference gets no token
-                    ];
-                case 13:
-                    // 3) the subject is non-forgeable — the branch ignores the id param and uses the session's enduser
-                    _d.sent();
-                    // 4) an enduser with no Healthie reference gets no token
-                    return [4 /*yield*/, async_test("enduser without a Healthie reference cannot mint a token", function () { return unlinkedSDK_1.api.integrations.proxy_read({ integration: WELLE_TITLE, type: 'partner-redirect-token' }); }, { shouldError: true, onError: function (e) { return ((e === null || e === void 0 ? void 0 : e.message) || '').includes('enduser has no Healthie reference'); } })
-                        // 5) staff sessions are not served by this branch (it is enduser-gated) — falls through to an empty result
-                    ];
-                case 14:
+                ];
+            case 11:
+                // optional deep-link target — allowlisted value is echoed as a claim
+                _b.sent();
+                // omitted target → no target claim at all (the happy-path token above was minted without one)
+                record_sync("token minted without a target has no target claim", function () { return ({
+                    pass: !!issuedToken_1 && decode_jwt_payload(issuedToken_1).target === undefined,
+                    detail: issuedToken_1
+                        ? "target=".concat(describe(decode_jwt_payload(issuedToken_1).target))
+                        : 'no token was minted above, so the claim could not be read',
+                }); });
+                // non-allowlisted target is rejected at the API boundary by schema validation
+                return [4 /*yield*/, expect_rejected("invalid target is rejected by schema validation", function () { return linkedSDK_1.api.integrations.proxy_read({
+                        integration: WELLE_TITLE,
+                        type: 'partner-redirect-token',
+                        target: 'admin',
+                    }); })
+                    // 2) the signature is real — verifies against the stored signing key, and only that key
+                ];
+            case 12:
+                // non-allowlisted target is rejected at the API boundary by schema validation
+                _b.sent();
+                // 2) the signature is real — verifies against the stored signing key, and only that key
+                record_sync("token is signed with the organization's Welle signing key", function () {
+                    if (!issuedToken_1)
+                        return { pass: false, detail: 'no token was minted above, so the signature could not be checked' };
+                    var _a = issuedToken_1.split('.'), header = _a[0], payload = _a[1], signature = _a[2];
+                    return {
+                        pass: sign_hs256("".concat(header, ".").concat(payload), SIGNING_KEY) === signature,
+                        detail: "signature=".concat(describe(signature)),
+                    };
+                });
+                record_sync("token signature does not verify against a different key", function () {
+                    if (!issuedToken_1)
+                        return { pass: false, detail: 'no token was minted above, so the signature could not be checked' };
+                    var _a = issuedToken_1.split('.'), header = _a[0], payload = _a[1], signature = _a[2];
+                    return {
+                        pass: sign_hs256("".concat(header, ".").concat(payload), "".concat(SIGNING_KEY, "_wrong")) !== signature,
+                        detail: "signature=".concat(describe(signature)),
+                    };
+                });
+                // 3) the subject is non-forgeable — the branch ignores the id param and uses the session's enduser
+                return [4 /*yield*/, expect_result("enduser cannot mint a token for another enduser by passing id", function () { return linkedSDK_1.api.integrations.proxy_read({
+                        integration: WELLE_TITLE,
+                        type: 'partner-redirect-token',
+                        id: unlinkedId,
+                    }); }, function (r) { var _a; return !!((_a = r === null || r === void 0 ? void 0 : r.data) === null || _a === void 0 ? void 0 : _a.token) && decode_jwt_payload(r.data.token).sub === HEALTHIE_PATIENT_ID; })
                     // 4) an enduser with no Healthie reference gets no token
-                    _d.sent();
-                    // 5) staff sessions are not served by this branch (it is enduser-gated) — falls through to an empty result
-                    return [4 /*yield*/, async_test("admin user session is not issued a Welle partner token", function () { return sdk.api.integrations.proxy_read({ integration: WELLE_TITLE, type: 'partner-redirect-token' }); }, { onResult: function (r) { var _a; return !((_a = r === null || r === void 0 ? void 0 : r.data) === null || _a === void 0 ? void 0 : _a.token); } })];
-                case 15:
+                ];
+            case 13:
+                // 3) the subject is non-forgeable — the branch ignores the id param and uses the session's enduser
+                _b.sent();
+                // 4) an enduser with no Healthie reference gets no token
+                return [4 /*yield*/, expect_rejected("enduser without a Healthie reference cannot mint a token", function () { return unlinkedSDK_1.api.integrations.proxy_read({ integration: WELLE_TITLE, type: 'partner-redirect-token' }); }, function (e) { return ((e === null || e === void 0 ? void 0 : e.message) || '').includes('enduser has no Healthie reference'); })
                     // 5) staff sessions are not served by this branch (it is enduser-gated) — falls through to an empty result
-                    _d.sent();
-                    return [4 /*yield*/, async_test("non-admin user session is not issued a Welle partner token", function () { return sdkNonAdmin.api.integrations.proxy_read({ integration: WELLE_TITLE, type: 'partner-redirect-token' }); }, { onResult: function (r) { var _a; return !((_a = r === null || r === void 0 ? void 0 : r.data) === null || _a === void 0 ? void 0 : _a.token); } })
-                        // 6) no other Welle proxy_read type is reachable by an enduser
-                    ];
-                case 16:
-                    _d.sent();
-                    // 6) no other Welle proxy_read type is reachable by an enduser
-                    return [4 /*yield*/, async_test("enduser cannot read other Welle proxy types", function () { return linkedSDK_1.api.integrations.proxy_read({ integration: WELLE_TITLE, type: 'anything-else' }); }, { shouldError: true, onError: function (e) { return (((e === null || e === void 0 ? void 0 : e.message) || '').includes('enduser session type not valid for this integration type')); } })
-                        // 7) with the integration disconnected, no token can be minted
-                    ];
-                case 17:
+                ];
+            case 14:
+                // 4) an enduser with no Healthie reference gets no token
+                _b.sent();
+                // 5) staff sessions are not served by this branch (it is enduser-gated) — falls through to an empty result
+                return [4 /*yield*/, expect_result("admin user session is not issued a Welle partner token", function () { return sdk_1.api.integrations.proxy_read({ integration: WELLE_TITLE, type: 'partner-redirect-token' }); }, function (r) { var _a; return !((_a = r === null || r === void 0 ? void 0 : r.data) === null || _a === void 0 ? void 0 : _a.token); })];
+            case 15:
+                // 5) staff sessions are not served by this branch (it is enduser-gated) — falls through to an empty result
+                _b.sent();
+                return [4 /*yield*/, expect_result("non-admin user session is not issued a Welle partner token", function () { return sdkNonAdmin_1.api.integrations.proxy_read({ integration: WELLE_TITLE, type: 'partner-redirect-token' }); }, function (r) { var _a; return !((_a = r === null || r === void 0 ? void 0 : r.data) === null || _a === void 0 ? void 0 : _a.token); })
                     // 6) no other Welle proxy_read type is reachable by an enduser
-                    _d.sent();
-                    // 7) with the integration disconnected, no token can be minted
-                    return [4 /*yield*/, delete_all_welle_integrations(sdk)];
-                case 18:
+                ];
+            case 16:
+                _b.sent();
+                // 6) no other Welle proxy_read type is reachable by an enduser
+                return [4 /*yield*/, expect_rejected("enduser cannot read other Welle proxy types", function () { return linkedSDK_1.api.integrations.proxy_read({ integration: WELLE_TITLE, type: 'anything-else' }); }, function (e) { return ((e === null || e === void 0 ? void 0 : e.message) || '').includes('enduser session type not valid for this integration type'); })
                     // 7) with the integration disconnected, no token can be minted
-                    _d.sent();
-                    return [4 /*yield*/, async_test("no token is issued once the Welle integration is disconnected", function () { return linkedSDK_1.api.integrations.proxy_read({ integration: WELLE_TITLE, type: 'partner-redirect-token' }); }, { shouldError: true, onError: function (e) { return ((e === null || e === void 0 ? void 0 : e.message) || '').includes('Welle integration not found'); } })
-                        // 8) the real connect path — add_api_key_integration, not integrations.createOne.
-                        // Welle has no credential-validation branch (an opaque HMAC key has nothing to authenticate
-                        // against), so unlike Canvas/Candid/MDI this endpoint makes no upstream call and is testable.
-                    ];
-                case 19:
-                    _d.sent();
-                    // 8) the real connect path — add_api_key_integration, not integrations.createOne.
-                    // Welle has no credential-validation branch (an opaque HMAC key has nothing to authenticate
-                    // against), so unlike Canvas/Candid/MDI this endpoint makes no upstream call and is testable.
-                    return [4 /*yield*/, async_test("add_api_key_integration connects Welle", function () { return sdk.api.integrations.add_api_key_integration({ integration: WELLE_TITLE, API_KEY: SIGNING_KEY }); }, { onResult: function (r) { var _a; return ((_a = r === null || r === void 0 ? void 0 : r.integration) === null || _a === void 0 ? void 0 : _a.title) === WELLE_TITLE; } })];
-                case 20:
+                ];
+            case 17:
+                // 6) no other Welle proxy_read type is reachable by an enduser
+                _b.sent();
+                // 7) with the integration disconnected, no token can be minted
+                return [4 /*yield*/, delete_all_welle_integrations(sdk_1)];
+            case 18:
+                // 7) with the integration disconnected, no token can be minted
+                _b.sent();
+                return [4 /*yield*/, expect_rejected("no token is issued once the Welle integration is disconnected", function () { return linkedSDK_1.api.integrations.proxy_read({ integration: WELLE_TITLE, type: 'partner-redirect-token' }); }, function (e) { return ((e === null || e === void 0 ? void 0 : e.message) || '').includes('Welle integration not found'); })
                     // 8) the real connect path — add_api_key_integration, not integrations.createOne.
                     // Welle has no credential-validation branch (an opaque HMAC key has nothing to authenticate
                     // against), so unlike Canvas/Candid/MDI this endpoint makes no upstream call and is testable.
-                    _d.sent();
-                    return [4 /*yield*/, async_test("add_api_key_integration sets hasConnectedWelle", function () { return sdk.api.organizations.getOne(sdk.userInfo.businessId); }, { onResult: function (o) { return (o === null || o === void 0 ? void 0 : o.hasConnectedWelle) === true; } })
-                        // the key stored by add_api_key_integration must land in the field the proxy_read branch reads
-                        // (authentication.info.access_token) — minting a verifiable token proves the two paths agree
-                    ];
-                case 21:
-                    _d.sent();
-                    // the key stored by add_api_key_integration must land in the field the proxy_read branch reads
-                    // (authentication.info.access_token) — minting a verifiable token proves the two paths agree
-                    return [4 /*yield*/, async_test("token minted from the add_api_key_integration credential verifies", function () { return linkedSDK_1.api.integrations.proxy_read({ integration: WELLE_TITLE, type: 'partner-redirect-token' }); }, { onResult: function (r) {
-                                var _a;
-                                var token = (_a = r === null || r === void 0 ? void 0 : r.data) === null || _a === void 0 ? void 0 : _a.token;
-                                if (!token)
-                                    return false;
-                                var _b = token.split('.'), h = _b[0], p = _b[1], s = _b[2];
-                                return sign_hs256("".concat(h, ".").concat(p), SIGNING_KEY) === s
-                                    && decode_jwt_payload(token).sub === HEALTHIE_PATIENT_ID;
-                            } })
-                        // 9) the real disconnect path — remove_api_key_integration
-                    ];
-                case 22:
+                ];
+            case 19:
+                _b.sent();
+                // 8) the real connect path — add_api_key_integration, not integrations.createOne.
+                // Welle has no credential-validation branch (an opaque HMAC key has nothing to authenticate
+                // against), so unlike Canvas/Candid/MDI this endpoint makes no upstream call and is testable.
+                return [4 /*yield*/, expect_result("add_api_key_integration connects Welle", function () { return sdk_1.api.integrations.add_api_key_integration({ integration: WELLE_TITLE, API_KEY: SIGNING_KEY }); }, function (r) { var _a; return ((_a = r === null || r === void 0 ? void 0 : r.integration) === null || _a === void 0 ? void 0 : _a.title) === WELLE_TITLE; })];
+            case 20:
+                // 8) the real connect path — add_api_key_integration, not integrations.createOne.
+                // Welle has no credential-validation branch (an opaque HMAC key has nothing to authenticate
+                // against), so unlike Canvas/Candid/MDI this endpoint makes no upstream call and is testable.
+                _b.sent();
+                return [4 /*yield*/, expect_result("add_api_key_integration sets hasConnectedWelle", function () { return sdk_1.api.organizations.getOne(businessId_1); }, function (o) { return (o === null || o === void 0 ? void 0 : o.hasConnectedWelle) === true; })
                     // the key stored by add_api_key_integration must land in the field the proxy_read branch reads
                     // (authentication.info.access_token) — minting a verifiable token proves the two paths agree
-                    _d.sent();
-                    // 9) the real disconnect path — remove_api_key_integration
-                    return [4 /*yield*/, async_test("remove_api_key_integration disconnects Welle", function () { return sdk.api.integrations.remove_api_key_integration({ integration: WELLE_TITLE }); }, { onResult: function () { return true; } })
-                        // the org flag update is fire-and-forget on this handler (res.end() returns before the .then chain)
-                    ];
-                case 23:
+                ];
+            case 21:
+                _b.sent();
+                // the key stored by add_api_key_integration must land in the field the proxy_read branch reads
+                // (authentication.info.access_token) — minting a verifiable token proves the two paths agree
+                return [4 /*yield*/, expect_result("token minted from the add_api_key_integration credential verifies", function () { return linkedSDK_1.api.integrations.proxy_read({ integration: WELLE_TITLE, type: 'partner-redirect-token' }); }, function (r) {
+                        var _a;
+                        var token = (_a = r === null || r === void 0 ? void 0 : r.data) === null || _a === void 0 ? void 0 : _a.token;
+                        if (!token)
+                            return false;
+                        var _b = token.split('.'), h = _b[0], p = _b[1], s = _b[2];
+                        return sign_hs256("".concat(h, ".").concat(p), SIGNING_KEY) === s
+                            && decode_jwt_payload(token).sub === HEALTHIE_PATIENT_ID;
+                    })
                     // 9) the real disconnect path — remove_api_key_integration
-                    _d.sent();
-                    // the org flag update is fire-and-forget on this handler (res.end() returns before the .then chain)
-                    return [4 /*yield*/, wait(undefined, 250)];
-                case 24:
+                ];
+            case 22:
+                // the key stored by add_api_key_integration must land in the field the proxy_read branch reads
+                // (authentication.info.access_token) — minting a verifiable token proves the two paths agree
+                _b.sent();
+                // 9) the real disconnect path — remove_api_key_integration
+                return [4 /*yield*/, expect_result("remove_api_key_integration disconnects Welle", function () { return sdk_1.api.integrations.remove_api_key_integration({ integration: WELLE_TITLE }); }, function () { return true; })
                     // the org flag update is fire-and-forget on this handler (res.end() returns before the .then chain)
-                    _d.sent();
-                    return [4 /*yield*/, async_test("remove_api_key_integration clears hasConnectedWelle", function () { return sdk.api.organizations.getOne(sdk.userInfo.businessId); }, { onResult: function (o) { return !(o === null || o === void 0 ? void 0 : o.hasConnectedWelle); } })];
-                case 25:
-                    _d.sent();
-                    return [4 /*yield*/, async_test("no token is issued after remove_api_key_integration", function () { return linkedSDK_1.api.integrations.proxy_read({ integration: WELLE_TITLE, type: 'partner-redirect-token' }); }, { shouldError: true, onError: function (e) { return ((e === null || e === void 0 ? void 0 : e.message) || '').includes('Welle integration not found'); } })];
-                case 26:
-                    _d.sent();
-                    return [3 /*break*/, 34];
-                case 27: return [4 /*yield*/, delete_all_welle_integrations(sdk).catch(console.error)];
-                case 28:
-                    _d.sent();
-                    return [4 /*yield*/, sdk.api.organizations.updateOne(sdk.userInfo.businessId, { hasConnectedWelle: false }).catch(console.error)];
-                case 29:
-                    _d.sent();
-                    _i = 0, _c = [linkedId, unlinkedId];
-                    _d.label = 30;
-                case 30:
-                    if (!(_i < _c.length)) return [3 /*break*/, 33];
-                    id = _c[_i];
-                    if (!id)
-                        return [3 /*break*/, 32];
-                    return [4 /*yield*/, sdk.api.endusers.deleteOne(id).catch(console.error)];
-                case 31:
-                    _d.sent();
-                    _d.label = 32;
-                case 32:
-                    _i++;
-                    return [3 /*break*/, 30];
-                case 33: return [7 /*endfinally*/];
-                case 34: return [2 /*return*/];
-            }
-        });
+                ];
+            case 23:
+                // 9) the real disconnect path — remove_api_key_integration
+                _b.sent();
+                // the org flag update is fire-and-forget on this handler (res.end() returns before the .then chain)
+                return [4 /*yield*/, new Promise(function (resolve) { return setTimeout(resolve, 250); })];
+            case 24:
+                // the org flag update is fire-and-forget on this handler (res.end() returns before the .then chain)
+                _b.sent();
+                return [4 /*yield*/, expect_result("remove_api_key_integration clears hasConnectedWelle", function () { return sdk_1.api.organizations.getOne(businessId_1); }, function (o) { return !(o === null || o === void 0 ? void 0 : o.hasConnectedWelle); })];
+            case 25:
+                _b.sent();
+                return [4 /*yield*/, expect_rejected("no token is issued after remove_api_key_integration", function () { return linkedSDK_1.api.integrations.proxy_read({ integration: WELLE_TITLE, type: 'partner-redirect-token' }); }, function (e) { return ((e === null || e === void 0 ? void 0 : e.message) || '').includes('Welle integration not found'); })];
+            case 26:
+                _b.sent();
+                return [3 /*break*/, 37];
+            case 27:
+                if (!tenant) return [3 /*break*/, 36];
+                sdk = tenant.sdk, businessId = tenant.businessId;
+                return [4 /*yield*/, delete_all_welle_integrations(sdk).catch(console.error)];
+            case 28:
+                _b.sent();
+                return [4 /*yield*/, sdk.api.organizations.updateOne(businessId, { hasConnectedWelle: false }).catch(console.error)];
+            case 29:
+                _b.sent();
+                _i = 0, _a = [linkedId, unlinkedId];
+                _b.label = 30;
+            case 30:
+                if (!(_i < _a.length)) return [3 /*break*/, 33];
+                id = _a[_i];
+                if (!id)
+                    return [3 /*break*/, 32];
+                return [4 /*yield*/, sdk.api.endusers.deleteOne(id).catch(console.error)];
+            case 31:
+                _b.sent();
+                _b.label = 32;
+            case 32:
+                _i++;
+                return [3 /*break*/, 30];
+            case 33:
+                _b.trys.push([33, 35, , 36]);
+                return [4 /*yield*/, tenant.teardown()];
+            case 34:
+                _b.sent();
+                return [3 /*break*/, 36];
+            case 35:
+                e_1 = _b.sent();
+                console.error('teardown failed', e_1);
+                return [3 /*break*/, 36];
+            case 36: return [7 /*endfinally*/];
+            case 37: return [2 /*return*/, checks];
+        }
     });
+}); };
+/** Asserting wrapper, for standalone runs. */
+export var welle_partner_token_tests = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var _a, _b;
+    return __generator(this, function (_c) {
+        switch (_c.label) {
+            case 0:
+                _a = assert_checks;
+                _b = ['Welle partner token'];
+                return [4 /*yield*/, welle_partner_token_checks()];
+            case 1:
+                _a.apply(void 0, _b.concat([_c.sent()]));
+                return [2 /*return*/];
+        }
+    });
+}); };
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export var ISOLATED_SUITE = {
+    name: 'Welle partner token',
+    run: welle_partner_token_checks,
 };
 // Allow running this test file independently
 if (require.main === module) {
-    var sdk_1 = new Session({ host: host });
-    var sdkNonAdmin_1 = new Session({ host: host });
-    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
-        return __generator(this, function (_a) {
-            switch (_a.label) {
-                case 0: return [4 /*yield*/, setup_tests(sdk_1, sdkNonAdmin_1)];
-                case 1:
-                    _a.sent();
-                    return [4 /*yield*/, welle_partner_token_tests({ sdk: sdk_1, sdkNonAdmin: sdkNonAdmin_1 })];
-                case 2:
-                    _a.sent();
-                    return [2 /*return*/];
-            }
-        });
-    }); };
-    runTests()
+    console.log("\uD83C\uDF10 Using API URL: ".concat(host));
+    welle_partner_token_tests()
         .then(function () {
         console.log("✅ Welle partner token test suite completed successfully");
         process.exit(0);