@tellescope/sdk 2.0.0-beta.1 → 2.0.0-beta.3

package/src/tests/api_tests/security/data-sync-redaction-bypass.test.ts

@@ -1,16 +1,19 @@
 require('source-map-support').install();
 
-import { Session } from "../../../sdk"
 import {
-  async_test,
-  log_header,
   wait,
 } from "@tellescope/testing"
-import { setup_tests } from "../../setup"
+import {
+  assert_checks,
+  Check,
+  IsolatedSuite,
+  setup_isolated_tenant,
+} from "../../setup_isolated"
 import { PROVIDER_PERMISSIONS } from "@tellescope/constants"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
-const [nonAdminEmail, nonAdminPassword] = [process.env.NON_ADMIN_EMAIL, process.env.NON_ADMIN_PASSWORD]
+
+const RAND = () => Math.random().toString(36).slice(2, 10)
 
 const FULL_ACCESS = { create: 'All' as const, read: 'All' as const, update: 'All' as const, delete: 'All' as const }
 
@@ -61,20 +64,68 @@ const collectViolations = (results: { modelName: string, recordId: string, data:
  *
  * Pre-fix: assertion fails with leaked records.
  * Post-fix: assertion passes.
+ *
+ * Runs on its own provisioned tenant. It used to overwrite the SHARED non-admin user's roles with
+ * this deliberately over-permissive role and restore them in a finally, so a crash stranded the
+ * fixture user on it; the mutated user is now this tenant's own, and it is thrown away at teardown.
  */
-export const data_sync_redaction_bypass_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("/v1/data-sync field-redaction bypass regression")
+export const data_sync_redaction_bypass_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  // The raw value decides the fallback, not JSON.stringify of it — JSON.stringify('') is '""',
+  // which is truthy, so a `|| fallback` on the stringified form could never fire.
+  const describe = (value: any): string => {
+    if (value === undefined || value === null) return String(value)
+    const stringified = JSON.stringify(value)
+    return stringified === undefined ? String(value) : stringified
+  }
+  const errorMessage = (e: any): string => (
+    typeof e?.message === 'string' && e.message !== '' ? e.message : describe(e)
+  )
 
-  const roleName = `f0001-data-sync-bypass-${Date.now()}`
-  let testEnduserId: string | undefined
-  let rbapId: string | undefined
-  const originalRoles = sdkNonAdmin.userInfo.roles
+  /**
+   * The async_test({ onResult }) equivalent, as a soft Check: a call that REJECTS is a failure
+   * (async_test treats it the same way), and a resolved call passes only when onResult agrees.
+   *
+   * The call and the predicate are caught separately, so a predicate that throws fails THIS check
+   * with its own detail instead of being misreported as an API rejection — and never escapes `run`,
+   * which would fail the whole run once the batch settles rather than failing one check.
+   */
+  const expect_result = async <T,>(label: string, fn: () => Promise<T>, onResult: (r: T) => boolean) => {
+    let resolved: { value: T }
+    try {
+      resolved = { value: await fn() }
+    } catch (e: any) {
+      record(label, false, `rejected instead of resolving: ${errorMessage(e)}`)
+      return
+    }
+
+    const { value } = resolved
+    try {
+      record(label, onResult(value), `result=${describe(value)}`)
+    } catch (predicateError: any) {
+      record(label, false, `predicate threw on result=${describe(value)}: ${errorMessage(predicateError)}`)
+    }
+  }
+
+  const roleName = `f0001-data-sync-bypass-${RAND()}`
+
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
 
   try {
+    tenant = await setup_isolated_tenant({
+      name: `Data-sync field redaction ${RAND()}`,
+      users: [{ isAdmin: true }, { roles: ['Non-Admin'] }],
+      apiKeys: 0,
+    })
+    const { sdk, sdkNonAdmin } = tenant
+    const [admin, nonAdmin] = tenant.users
+
     // 1. Create a role with broad read access but NO fieldRedactions.
     //    This is the realistic "regular user with read access" condition
     //    that triggers the bypass in the pre-fix handler.
-    const rbap = await sdk.api.role_based_access_permissions.createOne({
+    await sdk.api.role_based_access_permissions.createOne({
       role: roleName,
       permissions: {
         ...PROVIDER_PERMISSIONS,
@@ -83,17 +134,40 @@ export const data_sync_redaction_bypass_tests = async ({ sdk, sdkNonAdmin } : {
       },
       // intentionally NO fieldRedactions — this is the exploit condition.
     })
-    rbapId = rbap.id
 
-    // 2. Assign role to the non-admin user and re-authenticate so the new
+    // 2. Assign role to this tenant's own non-admin user and re-authenticate so the new
     //    session reflects the role's permissions.
     await sdk.api.users.updateOne(
-      sdkNonAdmin.userInfo.id,
+      nonAdmin.id,
       { roles: [roleName] },
       { replaceObjectFields: true },
     )
     await wait(undefined, 1500)
-    await sdkNonAdmin.authenticate(nonAdminEmail!, nonAdminPassword!)
+    await sdkNonAdmin.authenticate(nonAdmin.email, nonAdmin.password)
+
+    // 2b. Seed a real `linkedAccountAccess` entry on the ADMIN's user record, so coverage B below
+    //     can actually fail. A verbatim port asserted "no other user's record carries the field",
+    //     which on a fresh tenant no record carries anyway — it passed even with applyRedactions'
+    //     owner-only branch deleted.
+    //
+    //     The entry is written by request_linked_account_access, which needs account switching
+    //     enabled on both the actor's and the target's org (here, the one tenant org), and lands
+    //     the requester's snapshot on the TARGET's record — hence the non-admin requesting access
+    //     to the admin. The handler writes raw through getDB() and leaves no data_sync_record, so
+    //     the admin then touches its own record through the SDK to produce one.
+    await sdk.api.organizations.updateOne(tenant.businessId, { accountSwitchingEnabled: true })
+    await sdkNonAdmin.api.users.request_linked_account_access({ targetEmail: admin.email })
+    await sdk.api.users.updateOne(admin.id, { fname: 'DataSyncAdmin' })
+
+    // The handler answers `{}` on every rejection path (enumeration safety), so the only way to
+    // know the seed landed is to read it back as the record's owner — the one session
+    // applyRedactions does not strip the field from. Without this the coverage-B check below is
+    // vacuous, so a missing field is a FAIL here rather than a silent no-op.
+    await expect_result(
+      "fixture: linkedAccountAccess is seeded on the admin's user record (owner read)",
+      () => sdk.api.users.getOne(admin.id),
+      u => ((u as any).linkedAccountAccess ?? []).some((e: any) => e?.userId === nonAdmin.id),
+    )
 
     // 3. Create a test enduser and set a password — this populates
     //    `hashedPassword` on the enduser record and writes a data_sync_records
@@ -103,7 +177,6 @@ export const data_sync_redaction_bypass_tests = async ({ sdk, sdkNonAdmin } : {
       lname: 'Patient',
       email: `f0001-target-${Date.now()}@example.com`,
     })
-    testEnduserId = testEnduser.id
     await sdk.api.endusers.set_password({ id: testEnduser.id, password: 'F0001TestPassword!123' })
 
     // The non-admin user's own `hashedPass` is set from login and refreshed
@@ -123,13 +196,13 @@ export const data_sync_redaction_bypass_tests = async ({ sdk, sdkNonAdmin } : {
     // (the non-admin's own record). If the stream is empty, the assertion below
     // would pass vacuously — guard against that.
     const userRecordsInStream = sync.results.filter(r => r.modelName === 'users').length
-    await async_test(
+    await expect_result(
       "guard: /v1/data-sync sync stream contains at least one user record",
       async () => ({ userRecords: userRecordsInStream, totalRecords: sync.results.length }),
-      { onResult: r => r.userRecords >= 1 },
+      r => r.userRecords >= 1,
     )
 
-    await async_test(
+    await expect_result(
       "/v1/data-sync must NOT return hashedPass / hashedPassword / hashedInviteCode",
       async () => ({
         violationCount: violations.length,
@@ -137,7 +210,7 @@ export const data_sync_redaction_bypass_tests = async ({ sdk, sdkNonAdmin } : {
         affectedModels: Array.from(new Set(violations.map(v => v.modelName))),
         affectedFields: Array.from(new Set(violations.map(v => v.leakedField))),
       }),
-      { onResult: r => r.violationCount === 0 },
+      r => r.violationCount === 0,
     )
 
     // ========================================================================
@@ -152,13 +225,13 @@ export const data_sync_redaction_bypass_tests = async ({ sdk, sdkNonAdmin } : {
     // Post-fix: applyRedactions always runs and `redactions: ['all']` strips for everyone.
     const adminSync = await sdk.sync({ from: new Date(0) })
     const adminViolations = collectViolations(adminSync.results)
-    await async_test(
+    await expect_result(
       "coverage A: admin /v1/data-sync also strips redactions:['all'] fields (hashedPass etc.)",
       async () => ({
         violationCount: adminViolations.length,
         violations: adminViolations.slice(0, 10),
       }),
-      { onResult: r => r.violationCount === 0 },
+      r => r.violationCount === 0,
     )
 
     // Case B: `linkedAccountAccess` on users must be stripped when the caller is NOT
@@ -166,65 +239,58 @@ export const data_sync_redaction_bypass_tests = async ({ sdk, sdkNonAdmin } : {
     // and protects against cross-user enumeration of who-requested-access-to-whom.
     // The non-admin user reads other user records via data-sync; if any of those
     // records have linkedAccountAccess set, it must be stripped on read.
+    // The admin's record genuinely carries the field (seeded in 2b), so deleting the owner-only
+    // branch turns this check red.
     const otherUsersInStream = sync.results.filter(
-      r => r.modelName === 'users' && r.recordId !== sdkNonAdmin.userInfo.id
+      r => r.modelName === 'users' && r.recordId !== nonAdmin.id
     )
     const linkedAccountLeaks: { recordId: string }[] = []
-    for (const record of otherUsersInStream) {
-      if (!record.data || record.data === 'deleted') continue
+    for (const syncRecord of otherUsersInStream) {
+      if (!syncRecord.data || syncRecord.data === 'deleted') continue
       try {
-        const parsed = JSON.parse(record.data)
+        const parsed = JSON.parse(syncRecord.data)
         if ('linkedAccountAccess' in parsed && parsed.linkedAccountAccess !== undefined) {
-          linkedAccountLeaks.push({ recordId: record.recordId })
+          linkedAccountLeaks.push({ recordId: syncRecord.recordId })
         }
       } catch {}
     }
-    await async_test(
+    await expect_result(
       "coverage B: /v1/data-sync strips linkedAccountAccess from other users' records",
       async () => ({
         otherUserRecords: otherUsersInStream.length,
+        adminRecordInStream: otherUsersInStream.some(r => r.recordId === admin.id),
         leakCount: linkedAccountLeaks.length,
         leaks: linkedAccountLeaks.slice(0, 5),
       }),
-      { onResult: r => r.leakCount === 0 },
+      // The seeded admin record must be in the stream, or there is nothing to strip and the check
+      // proves nothing.
+      r => r.adminRecordInStream && r.leakCount === 0,
     )
   } finally {
-    // Cleanup: restore non-admin's original roles, delete role and test enduser.
-    try {
-      await sdk.api.users.updateOne(
-        sdkNonAdmin.userInfo.id,
-        { roles: originalRoles ?? [] },
-        { replaceObjectFields: true },
-      )
-    } catch {}
-    if (rbapId) {
-      try { await sdk.api.role_based_access_permissions.deleteOne(rbapId) } catch {}
+    // Teardown BEFORE anything asserts — assert calls process.exit, which would strand this tenant.
+    if (tenant) {
+      try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) }
     }
-    if (testEnduserId) {
-      try { await sdk.api.endusers.deleteOne(testEnduserId) } catch {}
-    }
-    // Re-authenticate the non-admin to drop the exploit role from their JWT
-    // before subsequent tests run.
-    // Role restore above re-triggers deauthenticate_user; wait > 1s so the freshly minted
-    // token's (second-floored) iat lands after the deauth timestamp and isn't permanently
-    // rejected by is_logged_in's iat-slack check. Matches the in-test re-auth above.
-    await wait(undefined, 1500)
-    try { await sdkNonAdmin.authenticate(nonAdminEmail!, nonAdminPassword!) } catch {}
   }
+
+  return checks
+}
+
+/** Asserting wrapper, for standalone runs. */
+export const data_sync_redaction_bypass_tests = async () => {
+  assert_checks('data-sync field-redaction bypass', await data_sync_redaction_bypass_checks())
+}
+
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = {
+  name: 'data-sync field-redaction bypass',
+  run: data_sync_redaction_bypass_checks,
 }
 
 // Allow running this test file independently
 if (require.main === module) {
   console.log(`🌐 Using API URL: ${host}`)
-  const sdk = new Session({ host })
-  const sdkNonAdmin = new Session({ host })
-
-  const runTests = async () => {
-    await setup_tests(sdk, sdkNonAdmin)
-    await data_sync_redaction_bypass_tests({ sdk, sdkNonAdmin })
-  }
-
-  runTests()
+  data_sync_redaction_bypass_tests()
     .then(() => {
       console.log("✅ data-sync redaction-bypass test suite completed successfully")
       process.exit(0)

package/src/tests/api_tests/security/develop-health-benefit-verification-rbac.test.ts

@@ -1,17 +1,20 @@
 require('source-map-support').install();
 
 import { ObjectId } from 'bson'
-import { Session } from "../../../sdk"
 import {
-  async_test,
-  log_header,
   wait,
 } from "@tellescope/testing"
-import { setup_tests } from "../../setup"
+import {
+  assert_checks,
+  Check,
+  IsolatedSuite,
+  setup_isolated_tenant,
+} from "../../setup_isolated"
 import { PROVIDER_PERMISSIONS } from "@tellescope/constants"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
-const [nonAdminEmail, nonAdminPassword] = [process.env.NON_ADMIN_EMAIL, process.env.NON_ADMIN_PASSWORD]
+
+const RAND = () => Math.random().toString(36).slice(2, 10)
 
 /**
  * Regression test: the `develop_health_run_benefit_verification` RBAC gate.
@@ -36,20 +39,72 @@ const [nonAdminEmail, nonAdminPassword] = [process.env.NON_ADMIN_EMAIL, process.
  * check never fires. Test fails (no access-denial signal).
  *
  * Post-fix: the handler throws 403 before touching `DB.endusers` at all. Test passes.
+ *
+ * Runs on its own provisioned tenant: both roles below are assigned to a throwaway non-admin
+ * rather than to the SHARED fixture user, whose permissions were previously arbitrary for every
+ * concurrent suite while this ran (and stayed broken if either cleanup crashed). A freshly
+ * provisioned tenant also has no Develop Health integration, which is what the positive control
+ * below depends on — on the shared org that was whatever the last developer left behind.
  */
-export const develop_health_benefit_verification_rbac_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("develop_health benefit verification RBAC regression")
+export const develop_health_benefit_verification_rbac_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  // The raw value decides the fallback, not JSON.stringify of it — JSON.stringify('') is '""',
+  // which is truthy, so a `|| fallback` on the stringified form could never fire.
+  const describe = (value: any): string => {
+    if (value === undefined || value === null) return String(value)
+    const stringified = JSON.stringify(value)
+    return stringified === undefined ? String(value) : stringified
+  }
+  const errorMessage = (e: any): string => (
+    typeof e?.message === 'string' && e.message !== '' ? e.message : describe(e)
+  )
+
+  /**
+   * The async_test({ shouldError: true, onError }) equivalent, as a soft Check: a call that RESOLVES
+   * is a failure (async_test treats it the same way), and a rejection passes only when onError agrees.
+   */
+  const expect_rejected = async (label: string, fn: () => Promise<any>, onError: (e: any) => boolean) => {
+    let rejection: { e: any }
+    try {
+      const unexpected = await fn()
+      record(label, false, `resolved instead of rejecting; result=${describe(unexpected)}`)
+      return
+    } catch (e: any) {
+      rejection = { e }
+    }
+
+    // Evaluated after the error is captured, and caught in its own right: an uncaught throw from
+    // the predicate would escape `run` and, per run_isolated_in_parallel, fail the whole run once
+    // the batch settles instead of failing this one check.
+    const { e } = rejection
+    try {
+      record(label, onError(e), `rejected with ${errorMessage(e)}`)
+    } catch (predicateError: any) {
+      record(label, false, `predicate threw on rejection "${errorMessage(e)}": ${errorMessage(predicateError)}`)
+    }
+  }
+
+  const roleName = `f0006-develop-health-no-access-${RAND()}`
+  const providerRoleName = `f0006-develop-health-provider-${RAND()}`
 
-  const roleName = `f0006-develop-health-no-access-${Date.now()}`
-  let rbapId: string | undefined
-  const originalRoles = sdkNonAdmin.userInfo.roles
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
 
   try {
+    tenant = await setup_isolated_tenant({
+      name: `develop_health benefit verification RBAC ${RAND()}`,
+      users: [{ isAdmin: true }, { roles: ['Non-Admin'] }],
+      apiKeys: 0,
+    })
+    const { sdk, sdkNonAdmin } = tenant
+    const nonAdmin = tenant.users[1]
+
     // 1. Create a role that explicitly denies endusers access AND enduser_eligibility_results
     //    access. This is the realistic configuration the bypass affects: a tenant operator
     //    deliberately restricts a role from reading enduser PHI (e.g. for PHI-restricted
     //    integration/API-key roles).
-    const rbap = await sdk.api.role_based_access_permissions.createOne({
+    await sdk.api.role_based_access_permissions.createOne({
       role: roleName,
       permissions: {
         ...PROVIDER_PERMISSIONS,
@@ -57,22 +112,21 @@ export const develop_health_benefit_verification_rbac_tests = async ({ sdk, sdkN
         enduser_eligibility_results:   { create: null, read: null, update: null, delete: null },
       },
     })
-    rbapId = rbap.id
 
-    // 2. Assign the role to the non-admin user and re-authenticate so the new
+    // 2. Assign the role to this tenant's own non-admin user and re-authenticate so the new
     //    session reflects the role's denied permissions.
     await sdk.api.users.updateOne(
-      sdkNonAdmin.userInfo.id,
+      nonAdmin.id,
       { roles: [roleName] },
       { replaceObjectFields: true },
     )
     await wait(undefined, 1500)
-    await sdkNonAdmin.authenticate(nonAdminEmail!, nonAdminPassword!)
+    await sdkNonAdmin.authenticate(nonAdmin.email, nonAdmin.password)
 
     // 3. develop_health_run_benefit_verification must throw 403 BEFORE any enduser lookup.
     //    Pre-fix: proceeds to DB.endusers.findById and either 400s on validation (fake id) or
     //    succeeds and forwards PHI to Develop Health (real id) — never a 403.
-    await async_test(
+    await expect_rejected(
       "enduser_eligibility_results.develop_health_run_benefit_verification must throw 403 when role denies endusers/enduser_eligibility_results",
       () => sdkNonAdmin.api.enduser_eligibility_results.develop_health_run_benefit_verification({
         enduserId: new ObjectId().toHexString(),       // fake id — access check should fire first
@@ -84,114 +138,88 @@ export const develop_health_benefit_verification_rbac_tests = async ({ sdk, sdkN
         drugs: [{ name: 'Test Drug', dosage: '10mg', quantity: 1 }],
         drug_history: { currently_taking_drugs: [], previously_taken_drugs: [] },
       } as any),
-      {
-        shouldError: true,
-        onError: (e: any) => {
-          // Match the gate's exact message. The SDK error surfaces { message, info } (no top-level
-          // status/code), so we key on the message rather than the HTTP status. This is deliberately
-          // specific: a lapsed subscription ("Your subscription has expired") or an expired token
-          // ("Unauthenticated") also errors BEFORE the handler runs, but neither contains this string,
-          // so the test can't false-pass without the gate executing. Also reject the pre-fix
-          // downstream messages, which would indicate the access check never fired.
-          const msg = (e?.message ?? '').toLowerCase()
-          if (msg.includes('integration not found') || msg.includes('enduser is required')
-            || msg.includes('organization') || msg.includes('provider')) {
-            return false // reached past the access gate — regression
-          }
-          return msg.includes('access to this resource')
-        },
+      (e: any) => {
+        // Match the gate's exact message. The SDK error surfaces { message, info } (no top-level
+        // status/code), so we key on the message rather than the HTTP status. This is deliberately
+        // specific: a lapsed subscription ("Your subscription has expired") or an expired token
+        // ("Unauthenticated") also errors BEFORE the handler runs, but neither contains this string,
+        // so the test can't false-pass without the gate executing. Also reject the pre-fix
+        // downstream messages, which would indicate the access check never fired.
+        const msg = (e?.message ?? '').toLowerCase()
+        if (msg.includes('integration not found') || msg.includes('enduser is required')
+          || msg.includes('organization') || msg.includes('provider')) {
+          return false // reached past the access gate — regression
+        }
+        return msg.includes('access to this resource')
       },
     )
 
     // 4. POSITIVE case: a provider role WITH enduser access must PASS the gate and reach the
-    //    integration stage (this test org has no Develop Health integration, so it 400s with
+    //    integration stage (this tenant has no Develop Health integration, so it 400s with
     //    "Integration not found"). This guards against the gate over-blocking legitimate users —
     //    the failure mode a future tightening (e.g. gating on 'All') would introduce.
-    const providerRoleName = `f0006-develop-health-provider-${Date.now()}`
-    let providerRbapId: string | undefined
-    try {
-      const providerRbap = await sdk.api.role_based_access_permissions.createOne({
-        role: providerRoleName,
-        permissions: { ...PROVIDER_PERMISSIONS }, // endusers read/create non-null, eligibility create non-null
-      })
-      providerRbapId = providerRbap.id
-
-      await sdk.api.users.updateOne(sdkNonAdmin.userInfo.id, { roles: [providerRoleName] }, { replaceObjectFields: true })
-      await wait(undefined, 1500)
-      await sdkNonAdmin.authenticate(nonAdminEmail!, nonAdminPassword!)
-
-      await async_test(
-        "a provider role with enduser access passes the gate (reaches 'Integration not found', not 403)",
-        () => sdkNonAdmin.api.enduser_eligibility_results.develop_health_run_benefit_verification({
-          enduserId: new ObjectId().toHexString(),
-          providerUserId: new ObjectId().toHexString(),
-          insuranceType: 'primary',
-          diagnoses: [],
-          drugs: [{ name: 'Test Drug', dosage: '10mg', quantity: 1 }],
-          drug_history: { currently_taking_drugs: [], previously_taken_drugs: [] },
-        } as any),
-        {
-          shouldError: true,
-          onError: (e: any) => {
-            const msg = (e?.message ?? '').toLowerCase()
-            // Must NOT be the access-denial message (that would mean the gate wrongly blocked a
-            // provider). Reaching "Integration not found" (or org/provider validation) proves the
-            // gate passed and the read-scoped enduser load did not over-restrict a legitimate role.
-            if (msg.includes('access to this resource')) return false
-            return msg.includes('integration not found') || msg.includes('organization') || msg.includes('provider')
-          },
-        },
-      )
-    } finally {
-      if (providerRbapId) {
-        try {
-          await sdk.api.users.updateOne(sdkNonAdmin.userInfo.id, { roles: originalRoles ?? [] }, { replaceObjectFields: true })
-        } catch {}
-        try { await sdk.api.role_based_access_permissions.deleteOne(providerRbapId) } catch {}
-        await wait(undefined, 1500)
-        try { await sdkNonAdmin.authenticate(nonAdminEmail!, nonAdminPassword!) } catch {}
-      }
-    }
+    await sdk.api.role_based_access_permissions.createOne({
+      role: providerRoleName,
+      permissions: { ...PROVIDER_PERMISSIONS }, // endusers read/create non-null, eligibility create non-null
+    })
+
+    await sdk.api.users.updateOne(nonAdmin.id, { roles: [providerRoleName] }, { replaceObjectFields: true })
+    await wait(undefined, 1500)
+    await sdkNonAdmin.authenticate(nonAdmin.email, nonAdmin.password)
+
+    await expect_rejected(
+      "a provider role with enduser access passes the gate (reaches 'Integration not found', not 403)",
+      () => sdkNonAdmin.api.enduser_eligibility_results.develop_health_run_benefit_verification({
+        enduserId: new ObjectId().toHexString(),
+        providerUserId: new ObjectId().toHexString(),
+        insuranceType: 'primary',
+        diagnoses: [],
+        drugs: [{ name: 'Test Drug', dosage: '10mg', quantity: 1 }],
+        drug_history: { currently_taking_drugs: [], previously_taken_drugs: [] },
+      } as any),
+      (e: any) => {
+        const msg = (e?.message ?? '').toLowerCase()
+        // Must NOT be the access-denial message (that would mean the gate wrongly blocked a
+        // provider). Reaching "Integration not found" (or org/provider validation) proves the
+        // gate passed and the read-scoped enduser load did not over-restrict a legitimate role.
+        if (msg.includes('access to this resource')) return false
+        return msg.includes('integration not found') || msg.includes('organization') || msg.includes('provider')
+      },
+    )
 
     // NOTE — the create>read bypass (endusers.create broader than endusers.read) that the 2026-08-19
-    // read-scoping closes is NOT live-testable here: this org has no Develop Health integration, so
+    // read-scoping closes is NOT live-testable here: this tenant has no Develop Health integration, so
     // the handler throws "Integration not found" BEFORE reaching the (now read-scoped) enduser load,
     // and the enduser load is what the create>read fix governs. Exercising it would need either a real
     // Develop Health integration or reordering the handler purely for the test. It is covered by code
     // review + the systemic follow-up. If a Develop Health sandbox integration is ever available
-    // in the test org, add: role { endusers: create 'All', read 'Assigned' } → call with a real
+    // to a provisioned tenant, add: role { endusers: create 'All', read 'Assigned' } → call with a real
     // enduser NOT assigned to the caller → expect the enduser-not-found path, not a successful forward.
   } finally {
-    // Cleanup: restore original roles, delete the test role.
-    try {
-      await sdk.api.users.updateOne(
-        sdkNonAdmin.userInfo.id,
-        { roles: originalRoles ?? [] },
-        { replaceObjectFields: true },
-      )
-    } catch {}
-    if (rbapId) {
-      try { await sdk.api.role_based_access_permissions.deleteOne(rbapId) } catch {}
+    // Teardown BEFORE anything asserts — assert calls process.exit, which would strand this tenant.
+    if (tenant) {
+      try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) }
     }
-    // Re-authenticate the non-admin to drop the no-access role from their JWT
-    // before subsequent tests run.
-    await wait(undefined, 1500)
-    try { await sdkNonAdmin.authenticate(nonAdminEmail!, nonAdminPassword!) } catch {}
   }
+
+  return checks
+}
+
+/** Asserting wrapper, for standalone runs. */
+export const develop_health_benefit_verification_rbac_tests = async () => {
+  assert_checks('develop_health benefit verification RBAC', await develop_health_benefit_verification_rbac_checks())
+}
+
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = {
+  name: 'develop_health benefit verification RBAC',
+  run: develop_health_benefit_verification_rbac_checks,
 }
 
 // Allow running this test file independently
 if (require.main === module) {
   console.log(`🌐 Using API URL: ${host}`)
-  const sdk = new Session({ host })
-  const sdkNonAdmin = new Session({ host })
-
-  const runTests = async () => {
-    await setup_tests(sdk, sdkNonAdmin)
-    await develop_health_benefit_verification_rbac_tests({ sdk, sdkNonAdmin })
-  }
-
-  runTests()
+  develop_health_benefit_verification_rbac_tests()
     .then(() => {
       console.log("✅ develop_health_run_benefit_verification RBAC test suite completed successfully")
       process.exit(0)