@tellescope/sdk 2.0.0-beta.1 → 2.0.0-beta.3

package/src/tests/api_tests/group_event_attendee_self_update.test.ts

@@ -1,85 +1,131 @@
 require('source-map-support').install();
 
-import { Session, EnduserSession } from "../../sdk"
-import { async_test, handleAnyError, passOnAnyResult, log_header } from "@tellescope/testing"
-import { setup_tests } from "../setup"
+import { EnduserSession } from "../../sdk"
+import {
+  assert_checks,
+  Check,
+  IsolatedSuite,
+  setup_isolated_tenant,
+} from "../setup_isolated"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
+/** Prefers the error's message, falling back to the raw value — JSON.stringify('') is '""' (truthy),
+ *  so a `|| fallback` on the stringified value would make the fallback unreachable. */
+const error_detail = (e: any) => (
+  typeof e?.message === 'string' && e.message !== ''
+    ? e.message
+    : (e === undefined || e === null ? String(e) : JSON.stringify(e))
+)
+
 // An enduser attendee can PATCH a calendar_event (needed to self-cancel out of a group event), and
 // attendeeStatuses / cancelledGroupAttendees are attendee-keyed arrays that drive per-attendee
 // automation triggers (handle_attendee_status_change_triggers + event-wide completion). The
 // calendar_events relationship constraint must let an enduser touch ONLY their own id's entry, so a
 // patient cannot fire or suppress a co-attendee's Appointment triggers by patching the shared event.
-export const group_event_attendee_self_update_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("Group Event Attendee Self-Update Constraint")
+//
+// Runs on its own provisioned tenant: the suite mints enduser sessions and leans on the tenant's
+// calendar events, so it must not share an organization with concurrently running suites.
+export const group_event_attendee_self_update_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
 
   const createdEnduserIds: string[] = []
   const createdEventIds: string[] = []
 
-  const createEnduser = async (label: string) => {
-    const e = await sdk.api.endusers.createOne({ email: `attendee_self_update_${label}_${Date.now()}@test.tellescope.com` })
-    createdEnduserIds.push(e.id)
-    return e
-  }
-  const enduserSession = async (id: string) => {
-    const { authToken, enduser } = await sdk.api.endusers.generate_auth_token({ id })
-    return new EnduserSession({ host, authToken, enduser, businessId: sdk.userInfo.businessId })
-  }
-  const createGroupEvent = async (attendeeIds: string[]) => {
-    const event = await sdk.api.calendar_events.createOne({
-      title: 'Attendee Self-Update Test',
-      durationInMinutes: 30,
-      startTimeInMS: Date.now() + Math.floor(Math.random() * 100000),
-      attendees: attendeeIds.map(id => ({ type: 'enduser' as const, id })),
+  try {
+    tenant = await setup_isolated_tenant({
+      name: `GroupEventAttendeeSelfUpdate ${RAND()}`,
+      users: [{ isAdmin: true }],
+      apiKeys: 0,
     })
-    createdEventIds.push(event.id)
-    return event
-  }
+    const { sdk } = tenant
+
+    const createEnduser = async (label: string) => {
+      const e = await sdk.api.endusers.createOne({ email: `attendee_self_update_${label}_${Date.now()}@test.tellescope.com` })
+      createdEnduserIds.push(e.id)
+      return e
+    }
+    const enduserSession = async (id: string) => {
+      const { authToken, enduser } = await sdk.api.endusers.generate_auth_token({ id })
+      return new EnduserSession({ host, authToken, enduser, businessId: tenant!.businessId })
+    }
+    const createGroupEvent = async (attendeeIds: string[]) => {
+      const event = await sdk.api.calendar_events.createOne({
+        title: 'Attendee Self-Update Test',
+        durationInMinutes: 30,
+        startTimeInMS: Date.now() + Math.floor(Math.random() * 100000),
+        attendees: attendeeIds.map(id => ({ type: 'enduser' as const, id })),
+      })
+      createdEventIds.push(event.id)
+      return event
+    }
+
+    // The two outcomes the constraint can produce. Neither asserts — a `run` collects Checks only.
+    const expect_allowed = async (label: string, fn: () => Promise<any>) => {
+      try {
+        await fn()
+        record(label, true, 'the update was accepted')
+      } catch (e: any) {
+        record(label, false, `the update was rejected: ${error_detail(e)}`)
+      }
+    }
+    const expect_rejected = async (label: string, fn: () => Promise<any>) => {
+      try {
+        const unexpected = await fn()
+        record(
+          label,
+          false,
+          `the update succeeded (result=${unexpected === undefined ? '(none)' : JSON.stringify(unexpected)});`
+          + ` it must be rejected`,
+        )
+      } catch (e: any) {
+        record(label, true, `rejected with ${error_detail(e)}`)
+      }
+    }
 
-  try {
     const attacker = await createEnduser('self')
     const victim = await createEnduser('other')
     const attackerSDK = await enduserSession(attacker.id)
 
     // ---- ALLOWED: self-cancel out of a fresh group event (the portal self-cancel path) ----
     const e1 = await createGroupEvent([attacker.id, victim.id])
-    await async_test(
+    await expect_allowed(
       "enduser may add their OWN cancelledGroupAttendees entry (self-cancel)",
       () => attackerSDK.api.calendar_events.updateOne(e1.id, {
         cancelledGroupAttendees: [{ id: attacker.id, at: new Date() }],
       }, { replaceObjectFields: true }),
-      passOnAnyResult,
     )
 
     // ---- ALLOWED: set own attendeeStatuses entry ----
     const e2 = await createGroupEvent([attacker.id, victim.id])
-    await async_test(
+    await expect_allowed(
       "enduser may set their OWN attendeeStatuses entry",
       () => attackerSDK.api.calendar_events.updateOne(e2.id, {
         attendeeStatuses: [{ id: attacker.id, at: new Date(), status: 'Cancelled' }],
       }, { replaceObjectFields: true }),
-      passOnAnyResult,
     )
 
     // ---- REJECTED: set a co-attendee's attendeeStatuses (would fire that patient's triggers) ----
     const e3 = await createGroupEvent([attacker.id, victim.id])
-    await async_test(
+    await expect_rejected(
       "enduser may NOT set a co-attendee's attendeeStatuses entry",
       () => attackerSDK.api.calendar_events.updateOne(e3.id, {
         attendeeStatuses: [{ id: victim.id, at: new Date(), status: 'No-showed' }],
       }, { replaceObjectFields: true }),
-      handleAnyError,
     )
 
     // ---- REJECTED: set a co-attendee's cancelledGroupAttendees entry ----
     const e4 = await createGroupEvent([attacker.id, victim.id])
-    await async_test(
+    await expect_rejected(
       "enduser may NOT set a co-attendee's cancelledGroupAttendees entry",
       () => attackerSDK.api.calendar_events.updateOne(e4.id, {
         cancelledGroupAttendees: [{ id: victim.id, at: new Date() }],
       }, { replaceObjectFields: true }),
-      handleAnyError,
     )
 
     // ---- REJECTED: drop a co-attendee's existing entry (would suppress their completion trigger) ----
@@ -87,12 +133,11 @@ export const group_event_attendee_self_update_tests = async ({ sdk } : { sdk: Se
     await sdk.api.calendar_events.updateOne(e5.id, {
       attendeeStatuses: [{ id: victim.id, at: new Date(), status: 'Completed' }],
     }, { replaceObjectFields: true })
-    await async_test(
+    await expect_rejected(
       "enduser may NOT remove a co-attendee's existing attendeeStatuses entry",
       () => attackerSDK.api.calendar_events.updateOne(e5.id, {
         attendeeStatuses: [{ id: attacker.id, at: new Date(), status: 'Cancelled' }], // silently drops victim's entry
       }, { replaceObjectFields: true }),
-      handleAnyError,
     )
 
     // ---- REJECTED: modify a co-attendee's existing entry ----
@@ -100,12 +145,11 @@ export const group_event_attendee_self_update_tests = async ({ sdk } : { sdk: Se
     await sdk.api.calendar_events.updateOne(e6.id, {
       attendeeStatuses: [{ id: victim.id, at: new Date(), status: 'Completed' }],
     }, { replaceObjectFields: true })
-    await async_test(
+    await expect_rejected(
       "enduser may NOT modify a co-attendee's existing attendeeStatuses entry",
       () => attackerSDK.api.calendar_events.updateOne(e6.id, {
         attendeeStatuses: [{ id: victim.id, at: new Date(), status: 'No-showed' }],
       }, { replaceObjectFields: true }),
-      handleAnyError,
     )
 
     // ---- ALLOWED: self-cancel while PRESERVING a co-attendee's existing entry (realistic group self-cancel) ----
@@ -114,42 +158,49 @@ export const group_event_attendee_self_update_tests = async ({ sdk } : { sdk: Se
       cancelledGroupAttendees: [{ id: victim.id, at: new Date() }],
     }, { replaceObjectFields: true })
     const e7ForAttacker = await attackerSDK.api.calendar_events.getOne(e7.id)
-    await async_test(
+    await expect_allowed(
       "enduser may self-cancel while preserving a co-attendee's existing entry",
       () => attackerSDK.api.calendar_events.updateOne(e7.id, {
         cancelledGroupAttendees: [...(e7ForAttacker.cancelledGroupAttendees || []), { id: attacker.id, at: new Date() }],
       }, { replaceObjectFields: true }),
-      passOnAnyResult,
     )
 
     // ---- ALLOWED (baseline): staff may set any attendee's status (constraint is enduser-only) ----
     const e8 = await createGroupEvent([attacker.id, victim.id])
-    await async_test(
+    await expect_allowed(
       "staff may set any attendee's status",
       () => sdk.api.calendar_events.updateOne(e8.id, {
         attendeeStatuses: [{ id: victim.id, at: new Date(), status: 'No-showed' }],
       }, { replaceObjectFields: true }),
-      passOnAnyResult,
     )
-
   } finally {
-    for (const id of createdEventIds) { try { await sdk.api.calendar_events.deleteOne(id) } catch (_) {} }
-    for (const id of createdEnduserIds) { try { await sdk.api.endusers.deleteOne(id) } catch (_) {} }
+    if (tenant) {
+      const { sdk } = tenant
+      for (const id of createdEventIds) { try { await sdk.api.calendar_events.deleteOne(id) } catch (_) {} }
+      for (const id of createdEnduserIds) { try { await sdk.api.endusers.deleteOne(id) } catch (_) {} }
+      // Teardown BEFORE anything asserts — assert calls process.exit, which would strand this tenant.
+      try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) }
+    }
   }
+
+  return checks
+}
+
+/** Asserting wrapper, for standalone runs. */
+export const group_event_attendee_self_update_tests = async () => {
+  assert_checks('Group event attendee self-update', await group_event_attendee_self_update_checks())
+}
+
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = {
+  name: 'Group event attendee self-update',
+  run: group_event_attendee_self_update_checks,
 }
 
 // Allow running this test file independently
 if (require.main === module) {
   console.log(`🌐 Using API URL: ${host}`)
-  const sdk = new Session({ host })
-  const sdkNonAdmin = new Session({ host })
-
-  const runTests = async () => {
-    await setup_tests(sdk, sdkNonAdmin)
-    await group_event_attendee_self_update_tests({ sdk, sdkNonAdmin })
-  }
-
-  runTests()
+  group_event_attendee_self_update_tests()
     .then(() => {
       console.log("✅ Group event attendee self-update constraint tests completed successfully")
       process.exit(0)

package/src/tests/api_tests/integrations_redacted.test.ts

@@ -1,15 +1,17 @@
 require('source-map-support').install();
 
-import { Session } from "../../sdk"
-import {
-  async_test,
-  log_header,
-} from "@tellescope/testing"
-import { setup_tests } from "../setup"
 import { INTEGRATION_SENSITIVE_FIELDS } from "@tellescope/constants"
+import {
+  assert_checks,
+  Check,
+  IsolatedSuite,
+  setup_isolated_tenant,
+} from "../setup_isolated"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
 const hasNoSensitiveFields = (integration: any) => {
   for (const field of INTEGRATION_SENSITIVE_FIELDS) {
     if (field in integration) return false
@@ -17,13 +19,94 @@ const hasNoSensitiveFields = (integration: any) => {
   return true
 }
 
-export const integrations_redacted_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("Integrations Redacted Endpoints Tests")
+// integrations redaction / access-control coverage: load_redacted, the CREATOR_ONLY behaviour of
+// getOne / getSome, the update_settings allowlist (including dot-notation bypasses) and
+// connect_stripe's rejection of a caller-supplied accountId.
+//
+// Runs on its own provisioned tenant. The suite enumerates the organization's integrations to find
+// the two it created, which on the shared fixture meant reading every other concurrently running
+// suite's records (and, for one of them, racing a suite that deletes integrations by title). On a
+// tenant of its own the `.find(...)` filters match exactly the records created here.
+export const integrations_redacted_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  // The raw value decides the fallback, not JSON.stringify of it — JSON.stringify('') is '""',
+  // which is truthy, so a `|| fallback` on the stringified form could never fire.
+  const describe = (value: any): string => {
+    if (value === undefined || value === null) return String(value)
+    const stringified = JSON.stringify(value)
+    return stringified === undefined ? String(value) : stringified
+  }
+  const errorMessage = (e: any): string => (
+    typeof e?.message === 'string' && e.message !== '' ? e.message : describe(e)
+  )
+
+  /**
+   * The async_test({ onResult }) equivalent, as a soft Check: a call that REJECTS is a failure
+   * (async_test treats it the same way), and a resolved call passes only when onResult agrees.
+   *
+   * The call and the predicate are caught separately, so a predicate that throws fails THIS check
+   * with its own detail instead of being misreported as an API rejection — and never escapes `run`,
+   * which would fail the whole run once the batch settles rather than failing one check.
+   */
+  const expect_result = async <T,>(label: string, fn: () => Promise<T>, onResult: (r: T) => boolean) => {
+    let resolved: { value: T }
+    try {
+      resolved = { value: await fn() }
+    } catch (e: any) {
+      record(label, false, `rejected instead of resolving: ${errorMessage(e)}`)
+      return
+    }
+
+    const { value } = resolved
+    try {
+      record(label, onResult(value), `result=${describe(value)}`)
+    } catch (predicateError: any) {
+      record(label, false, `predicate threw on result=${describe(value)}: ${errorMessage(predicateError)}`)
+    }
+  }
+
+  /**
+   * The async_test({ shouldError: true, onError }) equivalent: a call that RESOLVES is a failure
+   * (async_test treats it the same way), and a rejection passes only when onError agrees.
+   */
+  const expect_rejected = async (label: string, fn: () => Promise<any>, onError: (e: any) => boolean = () => true) => {
+    let rejection: { e: any }
+    try {
+      const unexpected = await fn()
+      record(label, false, `resolved instead of rejecting; result=${describe(unexpected)}`)
+      return
+    } catch (e: any) {
+      rejection = { e }
+    }
+
+    // Outside the catch on purpose: a predicate that throws here would otherwise escape the suite
+    // and, per run_isolated_in_parallel, abort every remaining batch instead of failing one check.
+    try {
+      record(label, onError(rejection.e), `rejected with ${errorMessage(rejection.e)}`)
+    } catch (predicateError: any) {
+      record(
+        label,
+        false,
+        `predicate threw on rejection ${errorMessage(rejection.e)}: ${errorMessage(predicateError)}`,
+      )
+    }
+  }
 
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
   let integrationId = ''
   let sensitiveIntegrationId = ''
 
   try {
+    // the default user spec provisions an Admin plus a non-admin — sdkNonAdmin is the non-creator
+    // used by the CREATOR_ONLY checks below
+    tenant = await setup_isolated_tenant({
+      name: `Integrations redacted ${RAND()}`,
+      apiKeys: 0,
+    })
+    const { sdk, sdkNonAdmin } = tenant
+
     // Create an integration with real auth data
     const created = await sdk.api.integrations.createOne({
       title: 'Test Redacted Integration',
@@ -34,139 +117,124 @@ export const integrations_redacted_tests = async ({ sdk, sdkNonAdmin } : { sdk:
     integrationId = created.id
 
     // load_redacted as creator — verify integration is returned, no sensitive fields present
-    await async_test(
+    await expect_result(
       "load_redacted as creator returns redacted integrations",
       () => sdk.api.integrations.load_redacted({}),
-      { onResult: r => {
+      r => {
         const found = r.integrations.find((i: any) => i.id === integrationId)
         return !!found && hasNoSensitiveFields(found) && found.title === 'Test Redacted Integration'
-      }}
+      },
     )
 
     // load_redacted as non-creator — verify same integration visible and redacted
-    await async_test(
+    await expect_result(
       "load_redacted as non-creator returns redacted integrations (bypasses CREATOR_ONLY)",
       () => sdkNonAdmin.api.integrations.load_redacted({}),
-      { onResult: r => {
+      r => {
         const found = r.integrations.find((i: any) => i.id === integrationId)
         return !!found && hasNoSensitiveFields(found) && found.title === 'Test Redacted Integration'
-      }}
+      },
     )
 
     // Standard load endpoints enforce CREATOR_ONLY — creator gets full object, non-creator gets nothing.
     // webhooksSecret has schema-level redactions: ['all'] (added with MDI webhooks support),
     // so it never goes over the wire on any read — even for the creator.
-    await async_test(
+    await expect_result(
       "getOne as creator returns integration with authentication, webhooksSecret always redacted",
       () => sdk.api.integrations.getOne(integrationId),
-      { onResult: i => !!i && 'authentication' in i && !('webhooksSecret' in i) }
+      i => !!i && 'authentication' in i && !('webhooksSecret' in i),
     )
 
-    await async_test(
+    await expect_rejected(
       "getOne as non-creator returns 404 (CREATOR_ONLY access control)",
       () => sdkNonAdmin.api.integrations.getOne(integrationId),
-      { shouldError: true, onError: () => true }
     )
 
-    await async_test(
+    await expect_result(
       "getSome as non-creator returns empty list (CREATOR_ONLY access control)",
       () => sdkNonAdmin.api.integrations.getSome(),
-      { onResult: r => Array.isArray(r) && r.find((i: any) => i.id === integrationId) === undefined }
+      r => Array.isArray(r) && r.find((i: any) => i.id === integrationId) === undefined,
     )
 
     // update_settings as creator — update a non-sensitive field
-    await async_test(
+    await expect_result(
       "update_settings as creator updates non-sensitive field",
       () => sdk.api.integrations.update_settings({ id: integrationId, updates: { emailDisabled: true } }),
-      { onResult: r => {
-        return !!r.integration && r.integration.emailDisabled === true && hasNoSensitiveFields(r.integration)
-      }}
+      r => !!r.integration && r.integration.emailDisabled === true && hasNoSensitiveFields(r.integration),
     )
 
     // update_settings as non-creator — update another field
-    await async_test(
+    await expect_result(
       "update_settings as non-creator updates non-sensitive field",
       () => sdkNonAdmin.api.integrations.update_settings({ id: integrationId, updates: { disableEnduserAutoSync: true } }),
-      { onResult: r => {
-        return !!r.integration && r.integration.disableEnduserAutoSync === true && hasNoSensitiveFields(r.integration)
-      }}
+      r => !!r.integration && r.integration.disableEnduserAutoSync === true && hasNoSensitiveFields(r.integration),
     )
 
     // update_settings rejects sensitive fields
-    await async_test(
+    await expect_rejected(
       "update_settings rejects authentication update",
       () => sdkNonAdmin.api.integrations.update_settings({ id: integrationId, updates: { authentication: { type: 'apiKey', info: { api_key: 'hacked' } } } as any }),
-      { shouldError: true, onError: () => true }
     )
 
-    await async_test(
+    await expect_rejected(
       "update_settings rejects webhooksSecret update",
       () => sdkNonAdmin.api.integrations.update_settings({ id: integrationId, updates: { webhooksSecret: 'hacked' } as any }),
-      { shouldError: true, onError: () => true }
     )
 
-    await async_test(
+    await expect_rejected(
       "update_settings rejects fhirClientSecret update",
       () => sdkNonAdmin.api.integrations.update_settings({ id: integrationId, updates: { fhirClientSecret: 'hacked' } as any }),
-      { shouldError: true, onError: () => true }
     )
 
     // Group 1: Dot-notation bypass tests (validates the allowlist fix)
-    await async_test(
+    await expect_rejected(
       "update_settings rejects dot-notation authentication.info.api_key update",
       () => sdk.api.integrations.update_settings({ id: integrationId, updates: { "authentication.info.api_key": "hacked" } as any }),
-      { shouldError: true, onError: () => true }
     )
 
-    await async_test(
+    await expect_rejected(
       "update_settings rejects dot-notation authentication.type update",
       () => sdk.api.integrations.update_settings({ id: integrationId, updates: { "authentication.type": "hacked" } as any }),
-      { shouldError: true, onError: () => true }
     )
 
     // Group 2: Remaining sensitive field rejections
-    await async_test(
+    await expect_rejected(
       "update_settings rejects fhirClientId update",
       () => sdk.api.integrations.update_settings({ id: integrationId, updates: { fhirClientId: 'hacked' } as any }),
-      { shouldError: true, onError: () => true }
     )
 
-    await async_test(
+    await expect_rejected(
       "update_settings rejects fhirAccessToken update",
       () => sdk.api.integrations.update_settings({ id: integrationId, updates: { fhirAccessToken: 'hacked' } as any }),
-      { shouldError: true, onError: () => true }
     )
 
     // Group 3: Non-allowlisted field rejections
-    await async_test(
+    await expect_rejected(
       "update_settings rejects title update (not in allowlist)",
       () => sdk.api.integrations.update_settings({ id: integrationId, updates: { title: 'hacked' } as any }),
-      { shouldError: true, onError: () => true }
     )
 
-    await async_test(
+    await expect_rejected(
       "update_settings rejects environment update (not in allowlist)",
       () => sdk.api.integrations.update_settings({ id: integrationId, updates: { environment: 'hacked' } as any }),
-      { shouldError: true, onError: () => true }
     )
 
-    await async_test(
+    await expect_rejected(
       "update_settings rejects unknown field update",
       () => sdk.api.integrations.update_settings({ id: integrationId, updates: { unknownField: 'hacked' } as any }),
-      { shouldError: true, onError: () => true }
     )
 
     // Group 4: Verify additional allowlisted fields can be updated
-    await async_test(
+    await expect_result(
       "update_settings allows syncUnrecognizedSenders update",
       () => sdk.api.integrations.update_settings({ id: integrationId, updates: { syncUnrecognizedSenders: true } }),
-      { onResult: r => !!r.integration && r.integration.syncUnrecognizedSenders === true && hasNoSensitiveFields(r.integration) }
+      r => !!r.integration && r.integration.syncUnrecognizedSenders === true && hasNoSensitiveFields(r.integration),
     )
 
-    await async_test(
+    await expect_result(
       "update_settings allows pushCalendarDetails update",
       () => sdk.api.integrations.update_settings({ id: integrationId, updates: { pushCalendarDetails: true } }),
-      { onResult: r => !!r.integration && r.integration.pushCalendarDetails === true && hasNoSensitiveFields(r.integration) }
+      r => !!r.integration && r.integration.pushCalendarDetails === true && hasNoSensitiveFields(r.integration),
     )
 
     // Group 5: Explicit per-field redaction verification
@@ -180,70 +248,79 @@ export const integrations_redacted_tests = async ({ sdk, sdkNonAdmin } : { sdk:
     })
     sensitiveIntegrationId = sensitiveIntegration.id
 
-    await async_test(
+    await expect_result(
       "load_redacted omits authentication field individually",
       () => sdk.api.integrations.load_redacted({}),
-      { onResult: r => {
+      r => {
         const found = r.integrations.find((i: any) => i.id === sensitiveIntegrationId)
         return !!found && !('authentication' in found)
-      }}
+      },
     )
 
-    await async_test(
+    await expect_result(
       "load_redacted omits webhooksSecret field individually",
       () => sdk.api.integrations.load_redacted({}),
-      { onResult: r => {
+      r => {
         const found = r.integrations.find((i: any) => i.id === sensitiveIntegrationId)
         return !!found && !('webhooksSecret' in found)
-      }}
+      },
     )
 
-    await async_test(
+    await expect_result(
       "load_redacted still returns non-sensitive fields",
       () => sdk.api.integrations.load_redacted({}),
-      { onResult: r => {
+      r => {
         const found = r.integrations.find((i: any) => i.id === sensitiveIntegrationId)
         return !!found && found.emailDisabled === true && found.title === 'Test All Sensitive Fields'
-      }}
+      },
     )
 
     // connect_stripe must reject caller-supplied accountId (Stripe-account-spoofing defense).
     // Stripe Connect is deprecated in Tellescope; accountId was a test shortcut, kept rejected to preserve SDK shape.
-    await async_test(
+    await expect_rejected(
       "connect_stripe rejects caller-supplied accountId",
       () => sdk.api.integrations.connect_stripe({ countryCode: 'US', accountId: 'acct_someoneElsesAccount' } as any),
-      { shouldError: true, onError: (e: any) => /accountId is not supported/i.test(e?.message || e?.toString() || '') }
+      (e: any) => /accountId is not supported/i.test(e?.message || e?.toString() || ''),
     )
-
   } finally {
-    if (integrationId) {
-      try {
-        await sdk.api.integrations.deleteOne(integrationId)
-      } catch (error) {
-        console.error('Cleanup error:', error)
+    if (tenant) {
+      const { sdk } = tenant
+      if (integrationId) {
+        try {
+          await sdk.api.integrations.deleteOne(integrationId)
+        } catch (error) {
+          console.error('Cleanup error:', error)
+        }
       }
-    }
-    if (sensitiveIntegrationId) {
-      try {
-        await sdk.api.integrations.deleteOne(sensitiveIntegrationId)
-      } catch (error) {
-        console.error('Cleanup error (sensitive integration):', error)
+      if (sensitiveIntegrationId) {
+        try {
+          await sdk.api.integrations.deleteOne(sensitiveIntegrationId)
+        } catch (error) {
+          console.error('Cleanup error (sensitive integration):', error)
+        }
       }
+      // Teardown BEFORE anything asserts — assert calls process.exit, which would strand this tenant.
+      try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) }
     }
   }
+
+  return checks
 }
 
-if (require.main === module) {
-  console.log(`Using API URL: ${host}`)
-  const sdk = new Session({ host })
-  const sdkNonAdmin = new Session({ host })
+/** Asserting wrapper, for standalone runs. */
+export const integrations_redacted_tests = async () => {
+  assert_checks('Integrations redacted', await integrations_redacted_checks())
+}
 
-  const runTests = async () => {
-    await setup_tests(sdk, sdkNonAdmin)
-    await integrations_redacted_tests({ sdk, sdkNonAdmin })
-  }
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = {
+  name: 'Integrations redacted',
+  run: integrations_redacted_checks,
+}
 
-  runTests()
+if (require.main === module) {
+  console.log(`Using API URL: ${host}`)
+  integrations_redacted_tests()
     .then(() => {
       console.log("Integrations redacted test suite completed successfully")
       process.exit(0)