@tellescope/sdk 2.0.0-beta.1 → 2.0.0-beta.3

package/src/tests/api_tests/security/ai-conversations-rbac.test.ts

@@ -1,17 +1,20 @@
 require('source-map-support').install();
 
 import { ObjectId } from 'bson'
-import { Session } from "../../../sdk"
 import {
-  async_test,
-  log_header,
   wait,
 } from "@tellescope/testing"
-import { setup_tests } from "../../setup"
+import {
+  assert_checks,
+  Check,
+  IsolatedSuite,
+  setup_isolated_tenant,
+} from "../../setup_isolated"
 import { PROVIDER_PERMISSIONS } from "@tellescope/constants"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
-const [nonAdminEmail, nonAdminPassword] = [process.env.NON_ADMIN_EMAIL, process.env.NON_ADMIN_PASSWORD]
+
+const RAND = () => Math.random().toString(36).slice(2, 10)
 
 /**
  * Regression test: `ai_conversations` RBAC.
@@ -44,23 +47,78 @@ const [nonAdminEmail, nonAdminPassword] = [process.env.NON_ADMIN_EMAIL, process.
  *   - generate_ai_decision: 200 with `{}` (handler responds early before access check). Test fails.
  *
  * Post-fix: both endpoints throw 403 before any work happens. Test passes.
+ *
+ * Runs on its own provisioned tenant, so the three roles below are assigned to a throwaway
+ * non-admin rather than to the SHARED fixture user, whose permissions were previously arbitrary
+ * for every concurrent suite while this ran (and stayed broken if cleanup crashed).
  */
-export const ai_conversations_rbac_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("ai_conversations RBAC bypass regression")
+export const ai_conversations_rbac_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  // The raw value decides the fallback, not JSON.stringify of it — JSON.stringify('') is '""',
+  // which is truthy, so a `|| fallback` on the stringified form could never fire.
+  const describe = (value: any): string => {
+    if (value === undefined || value === null) return String(value)
+    const stringified = JSON.stringify(value)
+    return stringified === undefined ? String(value) : stringified
+  }
+  const errorMessage = (e: any): string => (
+    typeof e?.message === 'string' && e.message !== '' ? e.message : describe(e)
+  )
+
+  /**
+   * The async_test({ shouldError: true, onError }) equivalent, as a soft Check: a call that RESOLVES
+   * is a failure (async_test treats it the same way), and a rejection passes only when onError agrees.
+   */
+  const expect_rejected = async (label: string, fn: () => Promise<any>, onError: (e: any) => boolean) => {
+    let rejection: { e: any }
+    try {
+      const unexpected = await fn()
+      record(label, false, `resolved instead of rejecting; result=${describe(unexpected)}`)
+      return
+    } catch (e: any) {
+      rejection = { e }
+    }
+
+    // Evaluated after the error is captured, and caught in its own right: an uncaught throw from
+    // the predicate would escape `run` and, per run_isolated_in_parallel, fail the whole run once
+    // the batch settles instead of failing this one check.
+    const { e } = rejection
+    try {
+      record(label, onError(e), `rejected with ${errorMessage(e)}`)
+    } catch (predicateError: any) {
+      record(label, false, `predicate threw on rejection "${errorMessage(e)}": ${errorMessage(predicateError)}`)
+    }
+  }
+
+  /** True for any 4xx access-denial response — 403 (recommended) or 400 with "access" / "permission". */
+  const isAccessDenial = (e: any) => {
+    const msg = (e?.message ?? '').toLowerCase()
+    const status = e?.status ?? e?.code
+    return status === 403 || status === 401
+      || msg.includes('access') || msg.includes('permission') || msg.includes('forbidden')
+  }
 
-  const roleName = `f0005-ai-conversations-no-access-${Date.now()}`
-  const grantRoleName = `f0005-ai-conversations-create-granted-${Date.now()}`
-  const assignedRoleName = `f0005-ai-conversations-assigned-default-${Date.now()}`
-  let rbapId: string | undefined
-  let grantRbapId: string | undefined
-  let assignedRbapId: string | undefined
-  const originalRoles = sdkNonAdmin.userInfo.roles
+  const roleName = `f0005-ai-conversations-no-access-${RAND()}`
+  const grantRoleName = `f0005-ai-conversations-create-granted-${RAND()}`
+  const assignedRoleName = `f0005-ai-conversations-assigned-default-${RAND()}`
+
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
 
   try {
+    tenant = await setup_isolated_tenant({
+      name: `ai_conversations RBAC ${RAND()}`,
+      users: [{ isAdmin: true }, { roles: ['Non-Admin'] }],
+      apiKeys: 0,
+    })
+    const { sdk, sdkNonAdmin } = tenant
+    const nonAdmin = tenant.users[1]
+
     // 1. Create a role that explicitly denies ai_conversations access AND endusers access.
     //    This is the realistic configuration the bypass affects: a tenant operator
     //    deliberately restricts a role from reading AI conversations / enduser PHI.
-    const rbap = await sdk.api.role_based_access_permissions.createOne({
+    await sdk.api.role_based_access_permissions.createOne({
       role: roleName,
       permissions: {
         ...PROVIDER_PERMISSIONS,
@@ -68,43 +126,39 @@ export const ai_conversations_rbac_tests = async ({ sdk, sdkNonAdmin } : { sdk:
         endusers:         { create: null, read: null, update: null, delete: null },
       },
     })
-    rbapId = rbap.id
 
-    // 2. Assign the role to the non-admin user and re-authenticate so the new
+    // 2. Assign the role to this tenant's own non-admin user and re-authenticate so the new
     //    session reflects the role's denied permissions.
     await sdk.api.users.updateOne(
-      sdkNonAdmin.userInfo.id,
+      nonAdmin.id,
       { roles: [roleName] },
       { replaceObjectFields: true },
     )
     await wait(undefined, 1500)
-    await sdkNonAdmin.authenticate(nonAdminEmail!, nonAdminPassword!)
+    await sdkNonAdmin.authenticate(nonAdmin.email, nonAdmin.password)
 
     // 3a. send_message must throw 403 (or equivalent access error). Pre-fix: succeeds (or
     //     fails downstream in Bedrock without 403). Post-fix: throws before any work.
-    await async_test(
+    await expect_rejected(
       "ai_conversations.send_message must throw 403 when role denies ai_conversations",
       () => sdkNonAdmin.api.ai_conversations.send_message({
         message: 'regression test',
         type: 'Test',
       } as any),
-      {
-        shouldError: true,
-        onError: (e: any) => {
-          // Accept any 4xx access-denial response — handler may use 403 (recommended)
-          // or 400 with "access" / "permission" in the message.
-          const msg = (e?.message ?? '').toLowerCase()
-          const status = e?.status ?? e?.code
-          return status === 403 || status === 401
-            || msg.includes('access') || msg.includes('permission') || msg.includes('forbidden')
-        },
+      (e: any) => {
+        // Accept any 4xx access-denial response — handler may use 403 (recommended)
+        // or 400 with "access" / "permission" in the message.
+        const msg = (e?.message ?? '').toLowerCase()
+        const status = e?.status ?? e?.code
+        return status === 403 || status === 401
+          || msg.includes('access') || msg.includes('permission') || msg.includes('forbidden')
       },
     )
 
     // 3b. generate_ai_decision must throw 403 BEFORE the early res.json({}) response.
     //     Pre-fix: handler responds 200 with {} immediately and processes in background.
     //     Post-fix: handler throws 403 before res.json({}).
-    await async_test(
+    await expect_rejected(
       "ai_conversations.generate_ai_decision must throw 403 when role denies endusers/ai_conversations",
       () => sdkNonAdmin.api.ai_conversations.generate_ai_decision({
         enduserId: new ObjectId().toHexString(),        // fake id — access check should fire first
@@ -113,61 +167,93 @@ export const ai_conversations_rbac_tests = async ({ sdk, sdkNonAdmin } : { sdk:
         prompt: 'regression test',
         sources: [{ type: 'SMS', limit: 1 }],            // non-empty so the validator passes; access check then fires
       } as any),
-      {
-        shouldError: true,
-        onError: (e: any) => {
-          const msg = (e?.message ?? '').toLowerCase()
-          const status = e?.status ?? e?.code
-          return status === 403 || status === 401
-            || msg.includes('access') || msg.includes('permission') || msg.includes('forbidden')
-        },
+      (e: any) => {
+        const msg = (e?.message ?? '').toLowerCase()
+        const status = e?.status ?? e?.code
+        return status === 403 || status === 401
+          || msg.includes('access') || msg.includes('permission') || msg.includes('forbidden')
       },
     )
 
+    // 3c. agent_message carries the SAME gate as send_message and must not be an exception:
+    //     it is a second way to spend the tenant's credits and to read a stored conversation.
+    //     The body is deliberately valid, so a 403 here can only come from the access check —
+    //     an invalid body would 400 in validation before the gate and pass this check vacuously.
+    await expect_rejected(
+      "ai_conversations.agent_message must throw 403 when role denies ai_conversations",
+      () => sdkNonAdmin.api.ai_conversations.agent_message({
+        messages: [{ role: 'user', content: [{ type: 'text', text: 'regression test' }] }],
+        maxTokens: 16,
+      } as any),
+      isAccessDenial,
+    )
+
     // 4. Positive case: granting only ai_conversations create must pass the RBAC gate.
     //    send_message may still fail downstream (e.g. 400 "Organization has not set up credits"),
     //    but it must NOT be an access-denial error.
-    const grantRbap = await sdk.api.role_based_access_permissions.createOne({
+    await sdk.api.role_based_access_permissions.createOne({
       role: grantRoleName,
       permissions: {
         ...PROVIDER_PERMISSIONS,
         ai_conversations: { create: 'All', read: null, update: null, delete: null },
       },
     })
-    grantRbapId = grantRbap.id
 
     await sdk.api.users.updateOne(
-      sdkNonAdmin.userInfo.id,
+      nonAdmin.id,
       { roles: [grantRoleName] },
       { replaceObjectFields: true },
     )
     await wait(undefined, 1500)
-    await sdkNonAdmin.authenticate(nonAdminEmail!, nonAdminPassword!)
+    await sdkNonAdmin.authenticate(nonAdmin.email, nonAdmin.password)
 
-    await async_test(
-      "ai_conversations.send_message must NOT be access-denied when role grants create",
-      () => sdkNonAdmin.api.ai_conversations.send_message({
-        message: 'positive-case test',
-        type: 'Test',
-        maxTokens: 1,
-      } as any)
-        .then(() => 'allowed' as const)
-        .catch((e: any) => {
-          const msg = (e?.message ?? '').toLowerCase()
-          const status = e?.status ?? e?.code
-          if (status === 403 || status === 401
-            || msg.includes('access') || msg.includes('permission') || msg.includes('forbidden')) {
-            throw e // access denial — the gate incorrectly blocked a create-granted role
-          }
-          return 'allowed' as const // downstream (e.g. credits) error is fine — the gate passed
-        }),
-      { onResult: r => r === 'allowed' },
-    )
+    {
+      const label = "ai_conversations.send_message must NOT be access-denied when role grants create"
+      let outcome: { resolved: true, value: any } | { resolved: false, error: any }
+      try {
+        outcome = { resolved: true, value: await sdkNonAdmin.api.ai_conversations.send_message({
+          message: 'positive-case test',
+          type: 'Test',
+          maxTokens: 1,
+        } as any) }
+      } catch (e: any) {
+        outcome = { resolved: false, error: e }
+      }
+      // A downstream (e.g. credits) error is fine — the gate passed. An access denial is not.
+      record(
+        label,
+        outcome.resolved || !isAccessDenial(outcome.error),
+        outcome.resolved
+          ? `allowed; result=${describe(outcome.value)}`
+          : `gate passed, rejected downstream with ${errorMessage(outcome.error)}`,
+      )
+    }
+
+    {
+      const label = "ai_conversations.agent_message must NOT be access-denied when role grants create"
+      let outcome: { resolved: true, value: any } | { resolved: false, error: any }
+      try {
+        outcome = { resolved: true, value: await sdkNonAdmin.api.ai_conversations.agent_message({
+          messages: [{ role: 'user', content: [{ type: 'text', text: 'positive-case test' }] }],
+          maxTokens: 16,
+        } as any) }
+      } catch (e: any) {
+        outcome = { resolved: false, error: e }
+      }
+      // A downstream (e.g. credits) error is fine — the gate passed. An access denial is not.
+      record(
+        label,
+        outcome.resolved || !isAccessDenial(outcome.error),
+        outcome.resolved
+          ? `allowed; result=${describe(outcome.value)}`
+          : `gate passed, rejected downstream with ${errorMessage(outcome.error)}`,
+      )
+    }
 
     // 5. The create-granted (read/update-denied) role must still be blocked from CONTINUING an
     //    existing conversation — send_message with conversationId returns the full stored history
     //    and appends to it. Fake id is fine: the access check must fire before any lookup.
-    await async_test(
+    await expect_rejected(
       "ai_conversations.send_message with conversationId must 403 when role denies read/update",
       () => sdkNonAdmin.api.ai_conversations.send_message({
         message: 'conversationId bypass test',
@@ -175,97 +261,131 @@ export const ai_conversations_rbac_tests = async ({ sdk, sdkNonAdmin } : { sdk:
         maxTokens: 1,
         conversationId: new ObjectId().toHexString(),
       } as any),
-      {
-        shouldError: true,
-        onError: (e: any) => {
-          const msg = (e?.message ?? '').toLowerCase()
-          const status = e?.status ?? e?.code
-          return status === 403 || status === 401
-            || msg.includes('access') || msg.includes('permission') || msg.includes('forbidden')
-        },
+      (e: any) => {
+        const msg = (e?.message ?? '').toLowerCase()
+        const status = e?.status ?? e?.code
+        return status === 403 || status === 401
+          || msg.includes('access') || msg.includes('permission') || msg.includes('forbidden')
       },
     )
 
+    await expect_rejected(
+      "ai_conversations.agent_message with conversationId must 403 when role denies read/update",
+      () => sdkNonAdmin.api.ai_conversations.agent_message({
+        messages: [{ role: 'user', content: [{ type: 'text', text: 'conversationId bypass test' }] }],
+        maxTokens: 16,
+        conversationId: new ObjectId().toHexString(),
+      } as any),
+      isAccessDenial,
+    )
+
     // 6. Regression: a role with default provider permissions (ai_conversations = Assigned)
     //    must be able to generate a new conversation without a 500. Previously the
     //    post-generation $push ran through the access-scoped DB, matched nothing under
     //    "Assigned", and crashed the handler with "Cannot read properties of null ('_id')".
-    const assignedRbap = await sdk.api.role_based_access_permissions.createOne({
+    //
+    //    GATE-ONLY, by construction: organizations.creditCount is readonly in the schema, so a
+    //    provisioned tenant has no credits and send_message 400s on credits BEFORE it reaches the
+    //    $push this check guards. What it still proves is that the Assigned role passes the RBAC
+    //    gate and the handler does not 500 on the way — the observed error is printed in the
+    //    detail so a change of failure mode is visible in the check table rather than silent.
+    await sdk.api.role_based_access_permissions.createOne({
       role: assignedRoleName,
       permissions: { ...PROVIDER_PERMISSIONS },
     })
-    assignedRbapId = assignedRbap.id
 
     await sdk.api.users.updateOne(
-      sdkNonAdmin.userInfo.id,
+      nonAdmin.id,
       { roles: [assignedRoleName] },
       { replaceObjectFields: true },
     )
     await wait(undefined, 1500)
-    await sdkNonAdmin.authenticate(nonAdminEmail!, nonAdminPassword!)
+    await sdkNonAdmin.authenticate(nonAdmin.email, nonAdmin.password)
 
-    await async_test(
-      "ai_conversations.send_message must not 500 for Assigned-access (default provider) role",
-      () => sdkNonAdmin.api.ai_conversations.send_message({
-        message: 'assigned-access regression test',
-        type: 'Test',
-        maxTokens: 1,
-      } as any)
-        .then(() => 'ok' as const)
-        .catch((e: any) => {
-          const msg = (e?.message ?? '').toLowerCase()
-          const status = e?.status ?? e?.code
-          if (status === 500 || msg.includes('internal error') || msg.includes('cannot read properties')) {
-            throw e // the null-update crash — regression
-          }
-          if (status === 403 || status === 401
-            || msg.includes('access') || msg.includes('permission') || msg.includes('forbidden')) {
-            throw e // Assigned access must pass the RBAC gate
-          }
-          return 'ok' as const // downstream (e.g. credits) error is fine
-        }),
-      { onResult: r => r === 'ok' },
-    )
-  } finally {
-    // Cleanup: restore original roles, delete the test role.
-    try {
-      await sdk.api.users.updateOne(
-        sdkNonAdmin.userInfo.id,
-        { roles: originalRoles ?? [] },
-        { replaceObjectFields: true },
-      )
-    } catch {}
-    if (rbapId) {
-      try { await sdk.api.role_based_access_permissions.deleteOne(rbapId) } catch {}
+    {
+      const label = "ai_conversations.send_message must not 500 for Assigned-access (default provider) role"
+      let outcome: { resolved: true, value: any } | { resolved: false, error: any }
+      try {
+        outcome = { resolved: true, value: await sdkNonAdmin.api.ai_conversations.send_message({
+          message: 'assigned-access regression test',
+          type: 'Test',
+          maxTokens: 1,
+        } as any) }
+      } catch (e: any) {
+        outcome = { resolved: false, error: e }
+      }
+
+      if (outcome.resolved) {
+        record(label, true, `ok; result=${describe(outcome.value)}`)
+      } else {
+        const e = outcome.error
+        const msg = (e?.message ?? '').toLowerCase()
+        const status = e?.status ?? e?.code
+        const isCrash = status === 500 || msg.includes('internal error') || msg.includes('cannot read properties')
+        record(
+          label,
+          !isCrash && !isAccessDenial(e), // the null-update crash, and an Assigned denial, are both regressions
+          `${isCrash ? 'CRASHED' : isAccessDenial(e) ? 'ACCESS-DENIED' : 'gate passed, rejected downstream'}`
+          + ` with ${errorMessage(e)}`,
+        )
+      }
     }
-    if (grantRbapId) {
-      try { await sdk.api.role_based_access_permissions.deleteOne(grantRbapId) } catch {}
+    {
+      // The same Assigned-access regression, for agent_message: its ledger writes go through the
+      // tenant-scoped org-wide handle for exactly this reason (an "Assigned" scope cannot match a
+      // conversation that has no enduserId), so a 500 here means that was undone.
+      const label = "ai_conversations.agent_message must not 500 for Assigned-access (default provider) role"
+      let outcome: { resolved: true, value: any } | { resolved: false, error: any }
+      try {
+        outcome = { resolved: true, value: await sdkNonAdmin.api.ai_conversations.agent_message({
+          messages: [{ role: 'user', content: [{ type: 'text', text: 'assigned-access regression test' }] }],
+          maxTokens: 16,
+        } as any) }
+      } catch (e: any) {
+        outcome = { resolved: false, error: e }
+      }
+
+      if (outcome.resolved) {
+        record(label, true, `ok; result=${describe(outcome.value)}`)
+      } else {
+        const e = outcome.error
+        const msg = (e?.message ?? '').toLowerCase()
+        const status = e?.status ?? e?.code
+        const isCrash = status === 500 || msg.includes('internal error') || msg.includes('cannot read properties')
+        record(
+          label,
+          !isCrash && !isAccessDenial(e),
+          `${isCrash ? 'CRASHED' : isAccessDenial(e) ? 'ACCESS-DENIED' : 'gate passed, rejected downstream'}`
+          + ` with ${errorMessage(e)}`,
+        )
+      }
     }
-    if (assignedRbapId) {
-      try { await sdk.api.role_based_access_permissions.deleteOne(assignedRbapId) } catch {}
+
+  } finally {
+    // Teardown BEFORE anything asserts — assert calls process.exit, which would strand this tenant.
+    if (tenant) {
+      try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) }
     }
-    // Re-authenticate the non-admin to drop the no-access role from their JWT
-    // before subsequent tests run.
-    // Role restore above re-triggers deauthenticate_user; wait > 1s so the freshly minted
-    // token's (second-floored) iat lands after the deauth timestamp and isn't permanently
-    // rejected by is_logged_in's iat-slack check. Matches the in-test re-auth above.
-    await wait(undefined, 1500)
-    try { await sdkNonAdmin.authenticate(nonAdminEmail!, nonAdminPassword!) } catch {}
   }
+
+  return checks
+}
+
+/** Asserting wrapper, for standalone runs. */
+export const ai_conversations_rbac_tests = async () => {
+  assert_checks('ai_conversations RBAC', await ai_conversations_rbac_checks())
+}
+
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = {
+  name: 'ai_conversations RBAC',
+  run: ai_conversations_rbac_checks,
 }
 
 // Allow running this test file independently
 if (require.main === module) {
   console.log(`🌐 Using API URL: ${host}`)
-  const sdk = new Session({ host })
-  const sdkNonAdmin = new Session({ host })
-
-  const runTests = async () => {
-    await setup_tests(sdk, sdkNonAdmin)
-    await ai_conversations_rbac_tests({ sdk, sdkNonAdmin })
-  }
-
-  runTests()
+  ai_conversations_rbac_tests()
     .then(() => {
       console.log("✅ ai_conversations RBAC test suite completed successfully")
       process.exit(0)

package/src/tests/api_tests/security/appointment-reschedule-ownership.test.ts

@@ -4,6 +4,7 @@ import {
   assert_checks,
   Check,
   setup_isolated_tenant,
+  IsolatedSuite,
 } from "../../setup_isolated"
 import { EnduserSession } from "../../../sdk"
 
@@ -417,6 +418,9 @@ export const appointment_reschedule_ownership_tests = async () => {
   assert_checks('book_appointment reschedule ownership', await appointment_reschedule_ownership_checks())
 }
 
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = { name: 'book_appointment reschedule ownership', run: appointment_reschedule_ownership_checks }
+
 // Allow running this test file independently
 if (require.main === module) {
   console.log(`🌐 Using API URL: ${host}`)

package/src/tests/api_tests/security/automated-actions-process-gate.test.ts

@@ -3,12 +3,13 @@ require('source-map-support').install();
 import axios from "axios"
 
 import { Session } from "../../../sdk"
-import {
-  assert,
-  log_header,
-} from "@tellescope/testing"
 import { PROVIDER_PERMISSIONS, PLACEHOLDER_ID } from "@tellescope/constants"
-import { setup_tests } from "../../setup"
+import {
+  assert_checks,
+  Check,
+  IsolatedSuite,
+  setup_isolated_tenant,
+} from "../../setup_isolated"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
@@ -19,14 +20,10 @@ const FULL_ACCESS = { create: ALL, read: ALL, update: ALL, delete: ALL }
 
 const PROCESS_PATH = '/v1/automated-actions/process'
 
-// A single collected check. Everything is gathered first and asserted at the end, because the
-// testing harness exits the process on the first failed assert — collecting first means a RED run
-// prints the full evidence table (and reaches `finally` cleanup) before the first assert exits.
-type Check = {
-  label: string,
-  pass: boolean,
-  detail: string,
-}
+// Checks are gathered and returned rather than asserted inline, because the testing harness exits
+// the process on the first failed assert — collecting first means a RED run prints the full evidence
+// table (and reaches `finally` cleanup) before anything exits, and in the parallel pool nothing
+// asserts until every concurrent suite has torn its own tenant down.
 
 /**
  * Regression test: `automated_actions.process` must be admin-gated, single-fire and audited.
@@ -63,10 +60,11 @@ type Check = {
  * and C1 fails (the second call on the same row executes again instead of being rejected).
  * B1 (admin positive control) passes pre-fix and must keep passing.
  * GREEN (post-fix): all five checks pass.
+ *
+ * Runs on its own provisioned tenant: the throwaway role, staff user and automated_actions rows all
+ * live there, so nothing touches the shared organization.
  */
-export const automated_actions_process_gate_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("automated_actions.process must be admin-only and single-fire")
-
+export const automated_actions_process_gate_checks = async (): Promise<Check[]> => {
   const checks: Check[] = []
   const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
 
@@ -83,12 +81,20 @@ export const automated_actions_process_gate_tests = async ({ sdk } : { sdk: Sess
     return { status: r.status, body: r.data }
   }
 
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
   let roleId = ''
   let attackerId = ''
   let enduserId = ''
   const automatedActionIds: string[] = []
 
   try {
+    tenant = await setup_isolated_tenant({
+      name: `Automated actions process gate ${RAND()}`,
+      users: [{ isAdmin: true }],
+      apiKeys: 0,
+    })
+    const { sdk } = tenant
+
     /* ================= fixtures ================= */
 
     // A non-admin role that explicitly HOLDS automated_actions update — the point of the finding is
@@ -193,39 +199,38 @@ export const automated_actions_process_gate_tests = async ({ sdk } : { sdk: Sess
       baselineRowAfter.status === 'finished',
       `status=${baselineRowAfter.status} (expected finished)`,
     )
-
-    /* ===== report: print full table first, then assert (harness exits on first failure) ===== */
-    console.log('\n  check summary:')
-    for (const c of checks) {
-      console.log(`    ${c.pass ? 'PASS' : 'FAIL'}  ${c.label}  —  ${c.detail}`)
-    }
-    console.log('')
-
-    for (const c of checks) {
-      assert(c.pass, `${c.label} — ${c.detail}`, c.label)
-    }
   } finally {
-    // Reverse order. The automated_actions go first: they hang off enduserId with
-    // onDependencyDelete 'delete', so deleting the enduser would take them with it.
-    for (const id of automatedActionIds) { try { await sdk.api.automated_actions.deleteOne(id) } catch {} }
-    if (enduserId) { try { await sdk.api.endusers.deleteOne(enduserId) } catch {} }
-    if (attackerId) { try { await sdk.api.users.deleteOne(attackerId) } catch {} }
-    if (roleId) { try { await sdk.api.role_based_access_permissions.deleteOne(roleId) } catch {} }
+    if (tenant) {
+      const { sdk } = tenant
+      // Reverse order. The automated_actions go first: they hang off enduserId with
+      // onDependencyDelete 'delete', so deleting the enduser would take them with it.
+      for (const id of automatedActionIds) { try { await sdk.api.automated_actions.deleteOne(id) } catch {} }
+      if (enduserId) { try { await sdk.api.endusers.deleteOne(enduserId) } catch {} }
+      if (attackerId) { try { await sdk.api.users.deleteOne(attackerId) } catch {} }
+      if (roleId) { try { await sdk.api.role_based_access_permissions.deleteOne(roleId) } catch {} }
+      // Teardown BEFORE anything asserts — assert calls process.exit, which would strand this tenant.
+      try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) }
+    }
   }
+
+  return checks
+}
+
+/** Asserting wrapper, for standalone runs. */
+export const automated_actions_process_gate_tests = async () => {
+  assert_checks('Automated actions process gate', await automated_actions_process_gate_checks())
+}
+
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = {
+  name: 'Automated actions process gate',
+  run: automated_actions_process_gate_checks,
 }
 
 // Allow running this test file independently
 if (require.main === module) {
   console.log(`🌐 Using API URL: ${host}`)
-  const sdk = new Session({ host })
-  const sdkNonAdmin = new Session({ host })
-
-  const runTests = async () => {
-    await setup_tests(sdk, sdkNonAdmin)
-    await automated_actions_process_gate_tests({ sdk, sdkNonAdmin })
-  }
-
-  runTests()
+  automated_actions_process_gate_tests()
     .then(() => {
       console.log("✅ automated_actions.process gate test suite completed successfully")
       process.exit(0)