@tellescope/sdk 2.0.0-beta.1 → 2.0.0-beta.3

package/src/tests/api_tests/managed_content_file_access.test.ts

@@ -1,15 +1,16 @@
 require('source-map-support').install();
 
-import * as buffer from 'buffer'
-import { Session, EnduserSession } from "../../sdk"
+import { EnduserSession } from "../../sdk"
 import {
-  async_test,
-  log_header,
-} from "@tellescope/testing"
-import { setup_tests } from "../setup"
+  assert_checks,
+  Check,
+  IsolatedSuite,
+  setup_isolated_tenant,
+} from "../setup_isolated"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
-const businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6'
+
+const RAND = () => Math.random().toString(36).slice(2, 10)
 
 /**
  * Tests for file_download_URL enduser access via managed content fallback.
@@ -17,10 +18,32 @@ const businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6'
  * Verifies the backend fallback logic that allows endusers to access files
  * attached to managed content records they have access to, even when the
  * file itself does not have enduserId set or publicRead: true.
+ *
+ * Runs on its own provisioned tenant: the patient sessions are pointed at `tenant.businessId`
+ * instead of a TEST_BUSINESS_ID env var with a hardcoded organization-id fallback, which tied the
+ * suite to one person's seeded database.
+ *
+ * File records are created with prepare_file_upload alone — no S3 round-trip. file_download_URL
+ * only signs a GET against the secureName and never checks that the object exists, so the upload
+ * added nothing to what is being asserted (same approach as
+ * security/file-link-session-confinement.test.ts).
  */
-export const managed_content_file_access_tests = async ({ sdk, sdkNonAdmin }: { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("Managed Content File Access Tests")
+export const managed_content_file_access_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  // The raw value decides the fallback, not JSON.stringify of it — JSON.stringify('') is '""',
+  // which is truthy, so a `|| fallback` on the stringified form could never fire.
+  const describe = (value: any): string => {
+    if (value === undefined || value === null) return String(value)
+    const stringified = JSON.stringify(value)
+    return stringified === undefined ? String(value) : stringified
+  }
+  const errorMessage = (e: any): string => (
+    typeof e?.message === 'string' && e.message !== '' ? e.message : describe(e)
+  )
 
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
   const contentRecordIds: string[] = []
   const assignmentIds: string[] = []
   const fileIds: string[] = []
@@ -29,46 +52,71 @@ export const managed_content_file_access_tests = async ({ sdk, sdkNonAdmin }: {
   let enduserSDK: EnduserSession | undefined
   let otherEnduserSDK: EnduserSession | undefined
 
-  const uploadFile = async (
-    name: string,
-    opts: { enduserId?: string, publicRead?: boolean } = {}
-  ) => {
-    const buff = buffer.Buffer.from(`test file content for ${name}`)
-    const { presignedUpload, file } = await sdk.api.files.prepare_file_upload({
-      name,
-      type: 'text/plain',
-      size: buff.byteLength,
-      ...opts,
+  try {
+    tenant = await setup_isolated_tenant({
+      name: `Managed content file access ${RAND()}`,
+      users: [{ isAdmin: true }],
+      apiKeys: 0,
     })
-    await sdk.UPLOAD(presignedUpload as any, buff)
-    await sdk.api.files.confirm_file_upload({ id: file.id })
-    fileIds.push(file.id)
-    return file
-  }
+    const { sdk } = tenant
+
+    const createFileRecord = async (
+      name: string,
+      opts: { enduserId?: string, publicRead?: boolean } = {}
+    ) => {
+      const { file } = await sdk.api.files.prepare_file_upload({
+        name,
+        type: 'text/plain',
+        // byteLength, not .length: a non-ASCII fixture name would otherwise mis-size the record
+        size: Buffer.byteLength(`test file content for ${name}`),
+        ...opts,
+      })
+      fileIds.push(file.id)
+      return file
+    }
+
+    /** enduser CAN download: file_download_URL resolves with a signed URL. */
+    const expect_download_allowed = async (label: string, session: EnduserSession, secureName: string) => {
+      try {
+        const result = await session.api.files.file_download_URL({ secureName })
+        record(label, !!result?.downloadURL, `downloadURL=${result?.downloadURL ? 'present' : 'missing'}`)
+      } catch (e: any) {
+        record(label, false, `rejected instead of signing a URL: ${errorMessage(e)}`)
+      }
+    }
+
+    /** enduser CANNOT download: file_download_URL must reject. */
+    const expect_download_denied = async (label: string, session: EnduserSession, secureName: string) => {
+      try {
+        const unexpected = await session.api.files.file_download_URL({ secureName })
+        record(label, false, `resolved instead of rejecting; result=${describe(unexpected)}`)
+      } catch (e: any) {
+        record(label, true, `rejected with ${errorMessage(e)}`)
+      }
+    }
 
-  try {
     console.log("Setting up test data...")
 
     const testEnduser = await sdk.api.endusers.createOne({
-      email: `mcr_file_access_test_${Date.now()}@test.tellescope.com`,
+      email: `mcr_file_access_test_${Date.now()}_${RAND()}@test.tellescope.com`,
     })
     testEnduserId = testEnduser.id
     await sdk.api.endusers.set_password({ id: testEnduser.id, password: 'TestPassword123!' })
 
     const otherEnduser = await sdk.api.endusers.createOne({
-      email: `mcr_file_access_other_${Date.now()}@test.tellescope.com`,
+      email: `mcr_file_access_other_${Date.now()}_${RAND()}@test.tellescope.com`,
     })
     otherEnduserId = otherEnduser.id
     await sdk.api.endusers.set_password({ id: otherEnduser.id, password: 'TestPassword123!' })
 
-    enduserSDK = new EnduserSession({ host, businessId })
+    enduserSDK = new EnduserSession({ host, businessId: tenant.businessId })
     await enduserSDK.authenticate(testEnduser.email!, 'TestPassword123!')
 
-    otherEnduserSDK = new EnduserSession({ host, businessId })
+    otherEnduserSDK = new EnduserSession({ host, businessId: tenant.businessId })
     await otherEnduserSDK.authenticate(otherEnduser.email!, 'TestPassword123!')
 
     // ===== Test 1: File attached to assignmentType: 'All' content - enduser CAN access =====
-    const fileForAll = await uploadFile('mcr-file-all.txt')
+    const fileForAll = await createFileRecord('mcr-file-all.txt')
     const contentAll = await sdk.api.managed_content_records.createOne({
       title: 'MCR File Access - All',
       htmlContent: '<p>All</p>',
@@ -78,17 +126,13 @@ export const managed_content_file_access_tests = async ({ sdk, sdkNonAdmin }: {
     })
     contentRecordIds.push(contentAll.id)
 
-    await async_test(
+    await expect_download_allowed(
       'staff-uploaded file in assignmentType:All content - enduser CAN access',
-      async () => {
-        const result = await enduserSDK!.api.files.file_download_URL({ secureName: fileForAll.secureName })
-        return !!result?.downloadURL
-      },
-      { onResult: (r) => r === true }
+      enduserSDK, fileForAll.secureName,
     )
 
     // ===== Test 2: File attached to Individual content for enduser A - enduser B CANNOT access =====
-    const fileForIndividual = await uploadFile('mcr-file-individual.txt')
+    const fileForIndividual = await createFileRecord('mcr-file-individual.txt')
     const contentIndividual = await sdk.api.managed_content_records.createOne({
       title: 'MCR File Access - Individual',
       htmlContent: '<p>Individual</p>',
@@ -98,111 +142,91 @@ export const managed_content_file_access_tests = async ({ sdk, sdkNonAdmin }: {
     })
     contentRecordIds.push(contentIndividual.id)
 
-    await async_test(
+    await expect_download_allowed(
       'file attached to Individual content - assigned enduser CAN access',
-      async () => {
-        const result = await enduserSDK!.api.files.file_download_URL({ secureName: fileForIndividual.secureName })
-        return !!result?.downloadURL
-      },
-      { onResult: (r) => r === true }
+      enduserSDK, fileForIndividual.secureName,
     )
 
-    await async_test(
+    await expect_download_denied(
       'file attached to Individual content - unassigned enduser CANNOT access',
-      async () => {
-        try {
-          await otherEnduserSDK!.api.files.file_download_URL({ secureName: fileForIndividual.secureName })
-          return false
-        } catch (err) {
-          return true
-        }
-      },
-      { onResult: (r) => r === true }
+      otherEnduserSDK, fileForIndividual.secureName,
     )
 
     // ===== Test 3: File not attached to any managed content - enduser CANNOT access =====
-    const fileNoContent = await uploadFile('mcr-file-no-content.txt')
+    const fileNoContent = await createFileRecord('mcr-file-no-content.txt')
 
-    await async_test(
+    await expect_download_denied(
       'file not attached to any managed content - enduser CANNOT access',
-      async () => {
-        try {
-          await enduserSDK!.api.files.file_download_URL({ secureName: fileNoContent.secureName })
-          return false
-        } catch (err) {
-          return true
-        }
-      },
-      { onResult: (r) => r === true }
+      enduserSDK, fileNoContent.secureName,
     )
 
     // ===== Test 4: File with enduserId set - existing behavior preserved =====
-    const fileWithEnduser = await uploadFile('mcr-file-with-enduser.txt', { enduserId: testEnduser.id })
+    const fileWithEnduser = await createFileRecord('mcr-file-with-enduser.txt', { enduserId: testEnduser.id })
 
-    await async_test(
+    await expect_download_allowed(
       'file with enduserId set - enduser CAN access (no fallback needed)',
-      async () => {
-        const result = await enduserSDK!.api.files.file_download_URL({ secureName: fileWithEnduser.secureName })
-        return !!result?.downloadURL
-      },
-      { onResult: (r) => r === true }
+      enduserSDK, fileWithEnduser.secureName,
     )
 
     // ===== Test 5: File with publicRead: true - existing behavior preserved =====
-    const filePublic = await uploadFile('mcr-file-public.txt', { publicRead: true })
+    const filePublic = await createFileRecord('mcr-file-public.txt', { publicRead: true })
 
-    await async_test(
+    await expect_download_allowed(
       'file with publicRead - enduser CAN access',
-      async () => {
-        const result = await enduserSDK!.api.files.file_download_URL({ secureName: filePublic.secureName })
-        return !!result?.downloadURL
-      },
-      { onResult: (r) => r === true }
+      enduserSDK, filePublic.secureName,
     )
-
-    console.log("All Managed Content File Access tests passed!")
-
   } finally {
     console.log("Cleaning up test data...")
 
-    try {
-      for (const assignmentId of assignmentIds) {
-        await sdk.api.managed_content_record_assignments.deleteOne(assignmentId).catch(() => {})
-      }
+    if (tenant) {
+      const { sdk } = tenant
+      try {
+        for (const assignmentId of assignmentIds) {
+          await sdk.api.managed_content_record_assignments.deleteOne(assignmentId).catch(() => {})
+        }
 
-      for (const recordId of contentRecordIds) {
-        await sdk.api.managed_content_records.deleteOne(recordId).catch(() => {})
-      }
+        for (const recordId of contentRecordIds) {
+          await sdk.api.managed_content_records.deleteOne(recordId).catch(() => {})
+        }
 
-      for (const fileId of fileIds) {
-        await sdk.api.files.deleteOne(fileId).catch(() => {})
-      }
+        for (const fileId of fileIds) {
+          await sdk.api.files.deleteOne(fileId).catch(() => {})
+        }
 
-      if (testEnduserId) {
-        await sdk.api.endusers.deleteOne(testEnduserId).catch(() => {})
-      }
-      if (otherEnduserId) {
-        await sdk.api.endusers.deleteOne(otherEnduserId).catch(() => {})
+        if (testEnduserId) {
+          await sdk.api.endusers.deleteOne(testEnduserId).catch(() => {})
+        }
+        if (otherEnduserId) {
+          await sdk.api.endusers.deleteOne(otherEnduserId).catch(() => {})
+        }
+
+        console.log("Cleanup completed")
+      } catch (error) {
+        console.error('Cleanup error:', error)
       }
 
-      console.log("Cleanup completed")
-    } catch (error) {
-      console.error('Cleanup error:', error)
+      // Teardown BEFORE anything asserts — assert calls process.exit, which would strand this tenant.
+      try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) }
     }
   }
+
+  return checks
 }
 
-if (require.main === module) {
-  console.log(`Using API URL: ${host}`)
-  const sdk = new Session({ host })
-  const sdkNonAdmin = new Session({ host })
+/** Asserting wrapper, for standalone runs. */
+export const managed_content_file_access_tests = async () => {
+  assert_checks('Managed content file access', await managed_content_file_access_checks())
+}
 
-  const runTests = async () => {
-    await setup_tests(sdk, sdkNonAdmin)
-    await managed_content_file_access_tests({ sdk, sdkNonAdmin })
-  }
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = {
+  name: 'Managed content file access',
+  run: managed_content_file_access_checks,
+}
 
-  runTests()
+if (require.main === module) {
+  console.log(`Using API URL: ${host}`)
+  managed_content_file_access_tests()
     .then(() => {
       console.log("Managed content file access test suite completed successfully")
       process.exit(0)