@tellescope/sdk 2.0.0-beta.1 → 2.0.0-beta.3

package/src/tests/api_tests/phone_calls_cold_transfer.test.ts

@@ -1,161 +1,223 @@
 require('source-map-support').install();
 
 import { Session } from "../../sdk"
-import {
-  async_test,
-  handleAnyError,
-  log_header,
-} from "@tellescope/testing"
 import { FULL_ACCESS, PROVIDER_PERMISSIONS } from "@tellescope/constants"
-import { setup_tests } from "../setup"
+import {
+  assert_checks,
+  Check,
+  IsolatedSuite,
+  setup_isolated_tenant,
+} from "../setup_isolated"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
 const NONEXISTENT_MONGO_ID = '60398b1131a295e64f084fff'
 const RAND = () => Math.random().toString(36).slice(2, 10)
 
+/** Prefers the error's message, falling back to the raw value — JSON.stringify('') is '""' (truthy),
+ *  so a `|| fallback` on the stringified value would make the fallback unreachable. */
+const error_detail = (e: any) => (
+  typeof e?.message === 'string' && e.message !== ''
+    ? e.message
+    : (e === undefined || e === null ? String(e) : JSON.stringify(e))
+)
+
 // Validation-path tests for the cold transfer endpoint. All assertions below hit
 // validations that run before any Twilio access, so no Twilio config is needed.
-export const phone_calls_cold_transfer_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("Phone Calls Cold Transfer Tests")
+//
+// Runs on its own provisioned tenant: the suite creates throwaway users and roles, and the
+// disabled-target user's address is globalUnique across every organization.
+export const phone_calls_cold_transfer_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
 
-  const enduser = await sdk.api.endusers.createOne({ fname: 'Cold', lname: 'Transfer' })
-  const targetUsers: { id: string }[] = []
-  const createdRoleIds: string[] = []
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
 
   try {
-    const inboundCall = await sdk.api.phone_calls.createOne({
-      enduserId: enduser.id,
-      inbound: true,
-      externalId: 'CAcoldtransfertestinbound000000001',
-      from: '+15550001111',
-      to: '+15550002222',
-      userId: sdk.userInfo.id,
+    tenant = await setup_isolated_tenant({
+      name: `ColdTransfer ${RAND()}`,
+      // users[1] is load-bearing: without it tenant.sdkNonAdmin is an unauthenticated stub, and the
+      // non-admin check below would pass for the wrong reason.
+      users: [{ isAdmin: true }, { roles: ['Non-Admin'] }],
+      apiKeys: 0,
     })
-    const outboundCall = await sdk.api.phone_calls.createOne({
-      enduserId: enduser.id,
-      inbound: false,
-      externalId: 'CAcoldtransfertestoutbound00000001',
-      from: '+15550002222',
-      to: '+15550001111',
-      userId: sdk.userInfo.id,
-    })
-
-    // throwaway target users (never modify existing users' roles)
-    const disabledTargetUser = await sdk.api.users.createOne({
-      email: 'cold.transfer.disabled@tellescope.com',
-      verifiedEmail: true,
-      notificationEmailsDisabled: true,
-      disableIncomingPhoneCalls: true,
-    })
-    targetUsers.push(disabledTargetUser)
-
-    await async_test(
-      "cold_transfer: cannot transfer to yourself",
-      () => sdk.api.phone_calls.cold_transfer({ callSid: inboundCall.externalId, targetUserId: sdk.userInfo.id }),
-      { shouldError: true, onError: (e: any) => e.message === "Cannot transfer a call to yourself" }
-    )
-    await async_test(
-      "cold_transfer: bogus callSid rejected",
-      () => sdk.api.phone_calls.cold_transfer({ callSid: 'CAdoesnotexist0000000000000000000', targetUserId: disabledTargetUser.id }),
-      { shouldError: true, onError: (e: any) => e.message === "Call not found" }
-    )
-    await async_test(
-      "cold_transfer: outbound calls rejected",
-      () => sdk.api.phone_calls.cold_transfer({ callSid: outboundCall.externalId, targetUserId: disabledTargetUser.id }),
-      { shouldError: true, onError: (e: any) => e.message === "Only inbound calls can be transferred" }
-    )
-    // conferenceId is not settable via the public API (only set internally by conference webhooks),
-    // so the "Conference calls cannot be transferred" branch is covered by manual E2E testing only
-    await async_test(
-      "cold_transfer: nonexistent target user rejected",
-      () => sdk.api.phone_calls.cold_transfer({ callSid: inboundCall.externalId, targetUserId: NONEXISTENT_MONGO_ID }),
-      { shouldError: true, onError: (e: any) => e.message === "Target user not found" }
-    )
-    await async_test(
-      "cold_transfer: target user with incoming calls disabled rejected",
-      () => sdk.api.phone_calls.cold_transfer({ callSid: inboundCall.externalId, targetUserId: disabledTargetUser.id }),
-      { shouldError: true, onError: (e: any) => e.message === "Target user has incoming calls disabled" }
-    )
-    // non-admin either can't see the call (Call not found) or is stopped by a later
-    // validation (target has incoming calls disabled) — errors on every path
-    await async_test(
-      "cold_transfer: non-admin cannot transfer an inaccessible call",
-      () => sdkNonAdmin.api.phone_calls.cold_transfer({ callSid: inboundCall.externalId, targetUserId: disabledTargetUser.id }),
-      handleAnyError
-    )
-
-    // ── target-user lookup must be gated by users READ access, not the endpoint's update access ──
-    // PROVIDER_PERMISSIONS already models the reported bug: users read='All', update='Default'.
-    // phone_calls gets FULL_ACCESS so the call itself is visible under update-level filtering.
-    const mkRoleUser = async (permissions: any) => {
-      const role = `cold-transfer-${RAND()}`
-      const rbap = await sdk.api.role_based_access_permissions.createOne({ role, permissions })
-      createdRoleIds.push(rbap.id)
-
-      const user = await sdk.api.users.createOne({
-        email: `cold.transfer.${RAND()}@tellescope.example`,
-        fname: 'Cold', lname: 'TransferRole',
-        notificationEmailsDisabled: true, verifiedEmail: true,
-        roles: [role],
-      } as any)
-      targetUsers.push(user)
-
-      const { authToken, user: sessionUser } = await sdk.api.users.generate_auth_token({ id: user.id })
-      const session = new Session({ host })
-      session.setAuthToken(authToken)
-      session.setUserInfo(sessionUser as any)
-      return session
+    const { sdk, sdkNonAdmin } = tenant
+
+    // Exact-message rejection, preserving the equality match each case asserted before the migration.
+    const expect_error_message = async (label: string, fn: () => Promise<any>, expected: string) => {
+      try {
+        const unexpected = await fn()
+        record(
+          label,
+          false,
+          `the call succeeded (result=${unexpected === undefined ? '(none)' : JSON.stringify(unexpected)});`
+          + ` expected the error ${JSON.stringify(expected)}`,
+        )
+      } catch (e: any) {
+        record(label, e?.message === expected, `error=${error_detail(e)} (want ${JSON.stringify(expected)})`)
+      }
+    }
+    const expect_any_error = async (label: string, fn: () => Promise<any>) => {
+      try {
+        const unexpected = await fn()
+        record(
+          label,
+          false,
+          `the call succeeded (result=${unexpected === undefined ? '(none)' : JSON.stringify(unexpected)});`
+          + ` it must be rejected`,
+        )
+      } catch (e: any) {
+        record(label, true, `rejected with ${error_detail(e)}`)
+      }
     }
 
-    const sdkUpdateDefault = await mkRoleUser({ ...PROVIDER_PERMISSIONS, phone_calls: FULL_ACCESS })
-    const sdkReadDefault = await mkRoleUser({
-      ...PROVIDER_PERMISSIONS,
-      phone_calls: FULL_ACCESS,
-      users: { create: null, read: 'Default', update: 'Default', delete: null },
-    })
-
-    // regression: previously failed with "Target user not found" because the lookup was
-    // filtered by users update='Default' (self-only); getting past it to the
-    // incoming-calls-disabled validation proves the lookup now uses read access
-    await async_test(
-      "cold_transfer: users update=Default no longer blocks the target lookup",
-      () => sdkUpdateDefault.api.phone_calls.cold_transfer({ callSid: inboundCall.externalId, targetUserId: disabledTargetUser.id }),
-      { shouldError: true, onError: (e: any) => e.message === "Target user has incoming calls disabled" }
-    )
-    // guard: the lookup is read-filtered (not org-wide) — users read='Default' still can't see the target
-    await async_test(
-      "cold_transfer: users read=Default still hides the target user",
-      () => sdkReadDefault.api.phone_calls.cold_transfer({ callSid: inboundCall.externalId, targetUserId: disabledTargetUser.id }),
-      { shouldError: true, onError: (e: any) => e.message === "Target user not found" }
-    )
-    await async_test(
-      "cold_transfer: nonexistent target still rejected for restricted role",
-      () => sdkUpdateDefault.api.phone_calls.cold_transfer({ callSid: inboundCall.externalId, targetUserId: NONEXISTENT_MONGO_ID }),
-      { shouldError: true, onError: (e: any) => e.message === "Target user not found" }
-    )
+    const enduser = await sdk.api.endusers.createOne({ fname: 'Cold', lname: 'Transfer' })
+    const targetUsers: { id: string }[] = []
+    const createdRoleIds: string[] = []
+
+    try {
+      const inboundCall = await sdk.api.phone_calls.createOne({
+        enduserId: enduser.id,
+        inbound: true,
+        externalId: 'CAcoldtransfertestinbound000000001',
+        from: '+15550001111',
+        to: '+15550002222',
+        userId: sdk.userInfo.id,
+      })
+      const outboundCall = await sdk.api.phone_calls.createOne({
+        enduserId: enduser.id,
+        inbound: false,
+        externalId: 'CAcoldtransfertestoutbound00000001',
+        from: '+15550002222',
+        to: '+15550001111',
+        userId: sdk.userInfo.id,
+      })
+
+      // throwaway target users (never modify existing users' roles). The address carries a random
+      // suffix because users.email is globalUnique across ALL organizations — a fixed address plus
+      // one skipped teardown would take the address permanently.
+      const disabledTargetUser = await sdk.api.users.createOne({
+        email: `cold.transfer.disabled.${RAND()}@tellescope.com`,
+        verifiedEmail: true,
+        notificationEmailsDisabled: true,
+        disableIncomingPhoneCalls: true,
+      })
+      targetUsers.push(disabledTargetUser)
+
+      await expect_error_message(
+        "cold_transfer: cannot transfer to yourself",
+        () => sdk.api.phone_calls.cold_transfer({ callSid: inboundCall.externalId, targetUserId: sdk.userInfo.id }),
+        "Cannot transfer a call to yourself",
+      )
+      await expect_error_message(
+        "cold_transfer: bogus callSid rejected",
+        () => sdk.api.phone_calls.cold_transfer({ callSid: 'CAdoesnotexist0000000000000000000', targetUserId: disabledTargetUser.id }),
+        "Call not found",
+      )
+      await expect_error_message(
+        "cold_transfer: outbound calls rejected",
+        () => sdk.api.phone_calls.cold_transfer({ callSid: outboundCall.externalId, targetUserId: disabledTargetUser.id }),
+        "Only inbound calls can be transferred",
+      )
+      // conferenceId is not settable via the public API (only set internally by conference webhooks),
+      // so the "Conference calls cannot be transferred" branch is covered by manual E2E testing only
+      await expect_error_message(
+        "cold_transfer: nonexistent target user rejected",
+        () => sdk.api.phone_calls.cold_transfer({ callSid: inboundCall.externalId, targetUserId: NONEXISTENT_MONGO_ID }),
+        "Target user not found",
+      )
+      await expect_error_message(
+        "cold_transfer: target user with incoming calls disabled rejected",
+        () => sdk.api.phone_calls.cold_transfer({ callSid: inboundCall.externalId, targetUserId: disabledTargetUser.id }),
+        "Target user has incoming calls disabled",
+      )
+      // non-admin either can't see the call (Call not found) or is stopped by a later
+      // validation (target has incoming calls disabled) — errors on every path
+      await expect_any_error(
+        "cold_transfer: non-admin cannot transfer an inaccessible call",
+        () => sdkNonAdmin.api.phone_calls.cold_transfer({ callSid: inboundCall.externalId, targetUserId: disabledTargetUser.id }),
+      )
+
+      // ── target-user lookup must be gated by users READ access, not the endpoint's update access ──
+      // PROVIDER_PERMISSIONS already models the reported bug: users read='All', update='Default'.
+      // phone_calls gets FULL_ACCESS so the call itself is visible under update-level filtering.
+      const mkRoleUser = async (permissions: any) => {
+        const role = `cold-transfer-${RAND()}`
+        const rbap = await sdk.api.role_based_access_permissions.createOne({ role, permissions })
+        createdRoleIds.push(rbap.id)
+
+        const user = await sdk.api.users.createOne({
+          email: `cold.transfer.${RAND()}@tellescope.example`,
+          fname: 'Cold', lname: 'TransferRole',
+          notificationEmailsDisabled: true, verifiedEmail: true,
+          roles: [role],
+        } as any)
+        targetUsers.push(user)
+
+        const { authToken, user: sessionUser } = await sdk.api.users.generate_auth_token({ id: user.id })
+        const session = new Session({ host })
+        session.setAuthToken(authToken)
+        session.setUserInfo(sessionUser as any)
+        return session
+      }
+
+      const sdkUpdateDefault = await mkRoleUser({ ...PROVIDER_PERMISSIONS, phone_calls: FULL_ACCESS })
+      const sdkReadDefault = await mkRoleUser({
+        ...PROVIDER_PERMISSIONS,
+        phone_calls: FULL_ACCESS,
+        users: { create: null, read: 'Default', update: 'Default', delete: null },
+      })
+
+      // regression: previously failed with "Target user not found" because the lookup was
+      // filtered by users update='Default' (self-only); getting past it to the
+      // incoming-calls-disabled validation proves the lookup now uses read access
+      await expect_error_message(
+        "cold_transfer: users update=Default no longer blocks the target lookup",
+        () => sdkUpdateDefault.api.phone_calls.cold_transfer({ callSid: inboundCall.externalId, targetUserId: disabledTargetUser.id }),
+        "Target user has incoming calls disabled",
+      )
+      // guard: the lookup is read-filtered (not org-wide) — users read='Default' still can't see the target
+      await expect_error_message(
+        "cold_transfer: users read=Default still hides the target user",
+        () => sdkReadDefault.api.phone_calls.cold_transfer({ callSid: inboundCall.externalId, targetUserId: disabledTargetUser.id }),
+        "Target user not found",
+      )
+      await expect_error_message(
+        "cold_transfer: nonexistent target still rejected for restricted role",
+        () => sdkUpdateDefault.api.phone_calls.cold_transfer({ callSid: inboundCall.externalId, targetUserId: NONEXISTENT_MONGO_ID }),
+        "Target user not found",
+      )
+    } finally {
+      // deleting the enduser cascades deletion of its phone_calls records
+      await Promise.all([
+        sdk.api.endusers.deleteOne(enduser.id),
+        ...targetUsers.map(u => sdk.api.users.deleteOne(u.id)),
+        ...createdRoleIds.map(id => sdk.api.role_based_access_permissions.deleteOne(id)),
+      ]).catch(console.error)
+    }
   } finally {
-    // deleting the enduser cascades deletion of its phone_calls records
-    await Promise.all([
-      sdk.api.endusers.deleteOne(enduser.id),
-      ...targetUsers.map(u => sdk.api.users.deleteOne(u.id)),
-      ...createdRoleIds.map(id => sdk.api.role_based_access_permissions.deleteOne(id)),
-    ]).catch(console.error)
+    // Teardown BEFORE anything asserts — assert calls process.exit, which would strand this tenant.
+    if (tenant) { try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) } }
   }
+
+  return checks
+}
+
+/** Asserting wrapper, for standalone runs. */
+export const phone_calls_cold_transfer_tests = async () => {
+  assert_checks('Phone calls cold transfer', await phone_calls_cold_transfer_checks())
+}
+
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = {
+  name: 'Phone calls cold transfer',
+  run: phone_calls_cold_transfer_checks,
 }
 
 // Allow running this test file independently
 if (require.main === module) {
   console.log(`🌐 Using API URL: ${host}`)
-  const sdk = new Session({ host })
-  const sdkNonAdmin = new Session({ host })
-
-  const runTests = async () => {
-    await setup_tests(sdk, sdkNonAdmin)
-    await phone_calls_cold_transfer_tests({ sdk, sdkNonAdmin })
-  }
-
-  runTests()
+  phone_calls_cold_transfer_tests()
     .then(() => {
       console.log("✅ Phone calls cold transfer test suite completed successfully")
       process.exit(0)

package/src/tests/api_tests/phone_calls_conference_hold.test.ts

@@ -1,56 +1,126 @@
 require('source-map-support').install();
 
-import { Session } from "../../sdk"
 import {
-  async_test,
-  handleAnyError,
-  log_header,
-} from "@tellescope/testing"
-import { setup_tests } from "../setup"
+  assert_checks,
+  Check,
+  setup_isolated_tenant,
+  IsolatedSuite,
+} from "../setup_isolated"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
-// Validation-path tests for the modify-conference-attendee-status endpoint. All assertions
-// below hit validations that run before any Twilio access, so no Twilio config is needed.
-// conferenceId is not settable via the public API (only set internally by conference
-// webhooks), so the Twilio hold/unhold branches are covered by manual E2E testing only.
-export const phone_calls_conference_hold_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("Phone Calls Conference Hold Tests")
-
-  await async_test(
-    "modify_conference_attendee_status: no status fields rejected",
-    () => sdk.api.phone_calls.modify_conference_attendee_status({ conferenceId: 'CAconferenceholdtest0000000000001' }),
-    { shouldError: true, onError: (e: any) => e.message === "At least one status field (e.g. hold) must be provided" }
-  )
-  await async_test(
-    "modify_conference_attendee_status: bogus conferenceId rejected",
-    () => sdk.api.phone_calls.modify_conference_attendee_status({ conferenceId: 'CAdoesnotexist0000000000000000000', hold: true }),
-    { shouldError: true, onError: (e: any) => e.message === "Call not found" }
-  )
-  await async_test(
-    "modify_conference_attendee_status: hold false also validated against record access",
-    () => sdk.api.phone_calls.modify_conference_attendee_status({ conferenceId: 'CAdoesnotexist0000000000000000000', hold: false }),
-    { shouldError: true, onError: (e: any) => e.message === "Call not found" }
-  )
-  await async_test(
-    "modify_conference_attendee_status: non-admin cannot hold an inaccessible conference",
-    () => sdkNonAdmin.api.phone_calls.modify_conference_attendee_status({ conferenceId: 'CAdoesnotexist0000000000000000000', hold: true }),
-    handleAnyError
-  )
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
+/**
+ * Validation-path coverage for the modify-conference-attendee-status endpoint. Every check below
+ * hits a validation that runs before any Twilio access, so no Twilio config is needed.
+ * conferenceId is not settable via the public API (only set internally by conference webhooks),
+ * so the Twilio hold/unhold branches are covered by manual E2E testing only.
+ *
+ * Provisions its own throwaway tenant, so the "Call not found" results below are statements about
+ * an empty tenant's phone_calls rather than about whatever the shared fixture happens to hold.
+ */
+export const phone_calls_conference_hold_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  /** `err` may be an Error, a plain object, or a bare string. Branch the "no detail" fallback on the
+   *  raw value: JSON.stringify('') is '""', which is truthy, so stringifying first makes it dead. */
+  const describe_error = (err: any) => {
+    const raw = err?.message ?? err
+    return raw ? JSON.stringify(raw) : '(the rejection carried no message)'
+  }
+
+  /**
+   * async_test/handleAnyError call process.exit on failure, which would strand the tenant — record
+   * the outcome instead, mirroring user_preferences.test.ts.
+   *
+   * The expected message is a parameter rather than a wildcard on purpose: a helper that records a
+   * pass for *any* rejection is vacuous, and this endpoint's whole point is which message comes back.
+   */
+  const expect_rejected_with = async (label: string, expectedMessage: string, call: () => Promise<any>) => {
+    try {
+      await call()
+      record(label, false, `the call resolved, but it should have been rejected with ${JSON.stringify(expectedMessage)}`)
+    } catch (err) {
+      const message = (err as any)?.message
+      record(
+        label,
+        message === expectedMessage,
+        message === expectedMessage
+          ? `rejected with ${JSON.stringify(expectedMessage)}`
+          : `expected ${JSON.stringify(expectedMessage)}, got ${describe_error(err)}`,
+      )
+    }
+  }
+
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+
+  try {
+    tenant = await setup_isolated_tenant({
+      name: `ConferenceHold ${RAND()}`,
+      apiKeys: 0,
+    })
+    const { sdk, sdkNonAdmin } = tenant
+
+    await expect_rejected_with(
+      'A: modify_conference_attendee_status with no status field is rejected',
+      "At least one status field (e.g. hold) must be provided",
+      () => sdk.api.phone_calls.modify_conference_attendee_status({
+        conferenceId: 'CAconferenceholdtest0000000000001',
+      }),
+    )
+
+    await expect_rejected_with(
+      'B: hold true against a conferenceId with no phone_call record is rejected',
+      "Call not found",
+      () => sdk.api.phone_calls.modify_conference_attendee_status({
+        conferenceId: 'CAdoesnotexist0000000000000000000', hold: true,
+      }),
+    )
+
+    // hold: false takes the same record lookup — unholding is not a shortcut around it
+    await expect_rejected_with(
+      'C: hold false is validated against record access the same way',
+      "Call not found",
+      () => sdk.api.phone_calls.modify_conference_attendee_status({
+        conferenceId: 'CAdoesnotexist0000000000000000000', hold: false,
+      }),
+    )
+
+    // The provisioned Non-Admin clears checkAccess and reaches the same findOne, so it must fail with
+    // the record error rather than a permission error — asserting the exact message is what keeps
+    // this from passing on any incidental 401/403.
+    await expect_rejected_with(
+      'D: a non-admin session reaches the same record lookup and is rejected by it',
+      "Call not found",
+      () => sdkNonAdmin.api.phone_calls.modify_conference_attendee_status({
+        conferenceId: 'CAdoesnotexist0000000000000000000', hold: true,
+      }),
+    )
+  } finally {
+    // Teardown BEFORE anything asserts — assert calls process.exit, which would strand this tenant.
+    if (tenant) { try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) } }
+  }
+
+  return checks
+}
+
+/** Asserting wrapper, for standalone runs. */
+export const phone_calls_conference_hold_tests = async () => {
+  assert_checks('Phone calls conference hold', await phone_calls_conference_hold_checks())
+}
+
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = {
+  name: 'Phone calls conference hold',
+  run: phone_calls_conference_hold_checks,
 }
 
 // Allow running this test file independently
 if (require.main === module) {
   console.log(`🌐 Using API URL: ${host}`)
-  const sdk = new Session({ host })
-  const sdkNonAdmin = new Session({ host })
-
-  const runTests = async () => {
-    await setup_tests(sdk, sdkNonAdmin)
-    await phone_calls_conference_hold_tests({ sdk, sdkNonAdmin })
-  }
-
-  runTests()
+  phone_calls_conference_hold_tests()
     .then(() => {
       console.log("✅ Phone calls conference hold test suite completed successfully")
       process.exit(0)