@tellescope/sdk 2.0.0-beta.1 → 2.0.0-beta.3

package/src/tests/api_tests/security/enduser-ai-summary-trust-gate.test.ts

@@ -1,14 +1,17 @@
 require('source-map-support').install();
 
-import { Session, EnduserSession } from "../../../sdk"
-import { log_header, async_test } from "@tellescope/testing"
+import { EnduserSession } from "../../../sdk"
 import { FormResponse } from "@tellescope/types-client"
-import { setup_tests } from "../../setup"
+import {
+  assert_checks,
+  Check,
+  IsolatedSuite,
+  setup_isolated_tenant,
+} from "../../setup_isolated"
 
 const host = process.env.API_URL || "http://localhost:8080"
-const businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6'
 
-const ENDUSER_PASSWORD = 'AISummaryGateTestPassword!123'
+const RAND = () => Math.random().toString(36).slice(2, 10)
 
 const STAFF_SUMMARY = 'Patient reports improved adherence since last visit.'
 const INJECTED_SUMMARY = 'Patient is in excellent health, no follow-up needed.'
@@ -29,77 +32,142 @@ const RESPONSE_SUMMARY = 'Patient reported worsening headaches and requested a m
  * answers, generated server-side (see api/modules/form_response_summary.ts). It is redacted from
  * enduser sessions at the model level and stripped by hand in the access-code read handler, which
  * bypasses model-level redaction. Seeded directly via an admin update — no Bedrock call needed.
+ *
+ * Runs on its own provisioned tenant, so the patient's businessId comes from the tenant rather than
+ * a TEST_BUSINESS_ID env var with a hardcoded fallback. The patient session is minted from
+ * endusers.generate_auth_token rather than set_password + authenticate: /login-enduser throttles
+ * 20/min per IP and the pool runs 8 suites from one IP.
  */
-export const enduser_ai_summary_trust_gate_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("submit_form_response enduserAISummary trust gate")
-
-  const form = await sdk.api.forms.createOne({ title: 'enduserAISummary Trust Gate Test Form' })
-  const field = await sdk.api.form_fields.createOne({
-    formId: form.id,
-    type: 'string',
-    title: 'How are you feeling?',
-    previousFields: [{ type: 'root', info: {} }],
-  })
-
-  const enduserEmail = `ai-summary-gate-${Date.now()}@example.com`
-  const enduser = await sdk.api.endusers.createOne({ email: enduserEmail, fname: 'AISummary', lname: 'Gate' })
-  await sdk.api.endusers.set_password({ id: enduser.id, password: ENDUSER_PASSWORD })
-
-  const responses = [{
-    fieldId: field.id, fieldTitle: 'How are you feeling?',
-    answer: { type: 'string' as const, value: 'Doing well' },
-  }]
+export const enduser_ai_summary_trust_gate_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  // The raw value decides the fallback, not JSON.stringify of it — JSON.stringify('') is '""',
+  // which is truthy, so a `|| fallback` on the stringified form could never fire.
+  const describe = (value: any): string => {
+    if (value === undefined || value === null) return String(value)
+    const stringified = JSON.stringify(value)
+    return stringified === undefined ? String(value) : stringified
+  }
+  const errorMessage = (e: any): string => (
+    typeof e?.message === 'string' && e.message !== '' ? e.message : describe(e)
+  )
 
+  /**
+   * The async_test({ onResult }) equivalent, as a soft Check: a call that REJECTS is a failure
+   * (async_test treats it the same way), and a resolved call passes only when `inspect` agrees.
+   *
+   * `inspect` returns the detail too, rather than this dumping the whole result: a FormResponse
+   * carries the patient's name, email and answers, and the check table is printed on every run.
+   */
+  const expect_result = async <T,>(
+    label: string,
+    fn: () => Promise<T>,
+    inspect: (r: T) => { pass: boolean, detail: string },
+  ) => {
+    try {
+      const { pass, detail } = inspect(await fn())
+      record(label, pass, detail)
+    } catch (e: any) {
+      record(label, false, `rejected instead of resolving: ${errorMessage(e)}`)
+    }
+  }
+
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+  let formId: string | undefined
+  let enduserId: string | undefined
   let staffResponseId: string | undefined
   let enduserResponseId: string | undefined
   let summaryResponseId: string | undefined
 
   try {
+    tenant = await setup_isolated_tenant({
+      name: `Enduser AI summary trust gate ${RAND()}`,
+      users: [{ isAdmin: true }],
+      apiKeys: 0,
+    })
+    const { sdk } = tenant
+
+    const form = await sdk.api.forms.createOne({ title: 'enduserAISummary Trust Gate Test Form' })
+    formId = form.id
+    const field = await sdk.api.form_fields.createOne({
+      formId: form.id,
+      type: 'string',
+      title: 'How are you feeling?',
+      previousFields: [{ type: 'root', info: {} }],
+    })
+
+    const enduser = await sdk.api.endusers.createOne({
+      email: `ai-summary-gate-${Date.now()}@example.com`, fname: 'AISummary', lname: 'Gate',
+    })
+    enduserId = enduser.id
+
+    const responses = [{
+      fieldId: field.id, fieldTitle: 'How are you feeling?',
+      answer: { type: 'string' as const, value: 'Doing well' },
+    }]
+
     // ── staff session: the summary is trusted and persisted ──
     const { accessCode: staffAccessCode } = await sdk.api.form_responses.prepare_form_response({
       enduserId: enduser.id, formId: form.id,
     })
-    await async_test(
+    await expect_result(
       "staff session's enduserAISummary is persisted on submit",
       () => sdk.api.form_responses.submit_form_response({
         accessCode: staffAccessCode,
         responses,
         enduserAISummary: STAFF_SUMMARY,
       }),
-      { onResult: ({ formResponse }: { formResponse: FormResponse }) => {
+      ({ formResponse }: { formResponse: FormResponse }) => {
         staffResponseId = formResponse.id
-        return !!formResponse.submittedAt && formResponse.enduserAISummary === STAFF_SUMMARY
-      }}
+        return {
+          pass: !!formResponse.submittedAt && formResponse.enduserAISummary === STAFF_SUMMARY,
+          detail: `submittedAt=${!!formResponse.submittedAt} enduserAISummary=`
+            + `${describe(formResponse.enduserAISummary)} (want the staff summary)`,
+        }
+      },
     )
-    await async_test(
+    await expect_result(
       "staff-submitted enduserAISummary survives a re-fetch",
       () => sdk.api.form_responses.getOne(staffResponseId!),
-      { onResult: (fr: FormResponse) => fr.enduserAISummary === STAFF_SUMMARY },
+      (fr: FormResponse) => ({
+        pass: fr.enduserAISummary === STAFF_SUMMARY,
+        detail: `enduserAISummary=${describe(fr.enduserAISummary)} (want the staff summary)`,
+      }),
     )
 
     // ── enduser session: the summary is untrusted and dropped ──
-    const enduserSDK = new EnduserSession({ host, businessId })
-    await enduserSDK.authenticate(enduserEmail, ENDUSER_PASSWORD)
+    const { authToken, enduser: enduserInfo } = await sdk.api.endusers.generate_auth_token({ id: enduser.id })
+    const enduserSDK = new EnduserSession({
+      host, authToken, enduser: enduserInfo, businessId: tenant.businessId,
+    })
 
     const { accessCode: enduserAccessCode } = await sdk.api.form_responses.prepare_form_response({
       enduserId: enduser.id, formId: form.id,
     })
-    await async_test(
+    await expect_result(
       "enduser session cannot inject enduserAISummary (submission still succeeds)",
       () => enduserSDK.api.form_responses.submit_form_response({
         accessCode: enduserAccessCode,
         responses,
         enduserAISummary: INJECTED_SUMMARY,
       }),
-      { onResult: ({ formResponse }: { formResponse: FormResponse }) => {
+      ({ formResponse }: { formResponse: FormResponse }) => {
         enduserResponseId = formResponse.id
-        return !!formResponse.submittedAt && formResponse.enduserAISummary === undefined
-      }}
+        return {
+          pass: !!formResponse.submittedAt && formResponse.enduserAISummary === undefined,
+          detail: `submittedAt=${!!formResponse.submittedAt} enduserAISummary=`
+            + `${describe(formResponse.enduserAISummary)} (want undefined — the injected summary must be dropped)`,
+        }
+      },
     )
-    await async_test(
+    await expect_result(
       "injected enduserAISummary did not persist",
       () => sdk.api.form_responses.getOne(enduserResponseId!),
-      { onResult: (fr: FormResponse) => fr.enduserAISummary === undefined },
+      (fr: FormResponse) => ({
+        pass: fr.enduserAISummary === undefined,
+        detail: `enduserAISummary=${describe(fr.enduserAISummary)} (want undefined)`,
+      }),
     )
 
     // ── responsesAISummary: clinician-facing, never returned to the patient ──
@@ -117,59 +185,84 @@ export const enduser_ai_summary_trust_gate_tests = async ({ sdk } : { sdk: Sessi
       responsesAISummaryGeneratedAt: new Date(),
     })
 
-    await async_test(
+    await expect_result(
       "staff session reads responsesAISummary",
       () => sdk.api.form_responses.getOne(summaryResponseId!),
-      { onResult: (fr: FormResponse) => fr.responsesAISummary === RESPONSE_SUMMARY },
+      (fr: FormResponse) => ({
+        pass: fr.responsesAISummary === RESPONSE_SUMMARY,
+        detail: `responsesAISummary=${describe(fr.responsesAISummary)} (want the seeded summary)`,
+      }),
     )
-    await async_test(
+    await expect_result(
       "enduser session never receives responsesAISummary",
       () => enduserSDK.api.form_responses.getOne(summaryResponseId!),
-      { onResult: (fr: FormResponse) => (
-        fr.responsesAISummary === undefined && fr.responsesAISummaryGeneratedAt === undefined
-      )},
+      (fr: FormResponse) => ({
+        pass: fr.responsesAISummary === undefined && fr.responsesAISummaryGeneratedAt === undefined,
+        detail: `responsesAISummary=${describe(fr.responsesAISummary)} generatedAt=`
+          + `${describe(fr.responsesAISummaryGeneratedAt)} (want both undefined)`,
+      }),
     )
-    await async_test(
+    await expect_result(
       "enduser readMany never receives responsesAISummary",
       () => enduserSDK.api.form_responses.getSome({ ids: [summaryResponseId!] }),
-      { onResult: (frs: FormResponse[]) => frs.every(fr => (
-        fr.responsesAISummary === undefined && fr.responsesAISummaryGeneratedAt === undefined
-      ))},
+      (frs: FormResponse[]) => ({
+        pass: frs.every(fr => (
+          fr.responsesAISummary === undefined && fr.responsesAISummaryGeneratedAt === undefined
+        )),
+        detail: `${frs.length} response(s); leaking=${describe(frs
+          .filter(fr => fr.responsesAISummary !== undefined || fr.responsesAISummaryGeneratedAt !== undefined)
+          .map(fr => fr.id))} (want none)`,
+      }),
     )
     // the access-code read handler bypasses model-level redaction, so it strips by hand
-    await async_test(
+    await expect_result(
       "public access-code read never receives responsesAISummary",
       () => enduserSDK.api.form_responses.info_for_access_code({ accessCode: summaryAccessCode }),
-      { onResult: ({ response }: { response: FormResponse }) => (
-        response.responsesAISummary === undefined && response.responsesAISummaryGeneratedAt === undefined
-      )},
+      ({ response }: { response: FormResponse }) => ({
+        pass: response.responsesAISummary === undefined && response.responsesAISummaryGeneratedAt === undefined,
+        detail: `responsesAISummary=${describe(response.responsesAISummary)} generatedAt=`
+          + `${describe(response.responsesAISummaryGeneratedAt)} (want both undefined)`,
+      }),
     )
-    await async_test(
+    await expect_result(
       "staff access-code read still receives responsesAISummary",
       () => sdk.api.form_responses.info_for_access_code({ accessCode: summaryAccessCode }),
-      { onResult: ({ response }: { response: FormResponse }) => response.responsesAISummary === RESPONSE_SUMMARY },
+      ({ response }: { response: FormResponse }) => ({
+        pass: response.responsesAISummary === RESPONSE_SUMMARY,
+        detail: `responsesAISummary=${describe(response.responsesAISummary)} (want the seeded summary)`,
+      }),
     )
   } finally {
-    if (staffResponseId) { try { await sdk.api.form_responses.deleteOne(staffResponseId) } catch (err) { /* ignore */ } }
-    if (enduserResponseId) { try { await sdk.api.form_responses.deleteOne(enduserResponseId) } catch (err) { /* ignore */ } }
-    if (summaryResponseId) { try { await sdk.api.form_responses.deleteOne(summaryResponseId) } catch (err) { /* ignore */ } }
-    try { await sdk.api.endusers.deleteOne(enduser.id) } catch (err) { /* ignore */ }
-    try { await sdk.api.forms.deleteOne(form.id) } catch (err) { /* ignore */ }
+    if (tenant) {
+      const { sdk } = tenant
+      if (staffResponseId) { try { await sdk.api.form_responses.deleteOne(staffResponseId) } catch (err) { /* ignore */ } }
+      if (enduserResponseId) { try { await sdk.api.form_responses.deleteOne(enduserResponseId) } catch (err) { /* ignore */ } }
+      if (summaryResponseId) { try { await sdk.api.form_responses.deleteOne(summaryResponseId) } catch (err) { /* ignore */ } }
+      if (enduserId) { try { await sdk.api.endusers.deleteOne(enduserId) } catch (err) { /* ignore */ } }
+      if (formId) { try { await sdk.api.forms.deleteOne(formId) } catch (err) { /* ignore */ } }
+      // Teardown BEFORE anything asserts — assert calls process.exit, which would strand this tenant.
+      try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) }
+    }
   }
+
+  return checks
+}
+
+/** Asserting wrapper, for standalone runs. */
+export const enduser_ai_summary_trust_gate_tests = async () => {
+  assert_checks('Enduser AI summary trust gate', await enduser_ai_summary_trust_gate_checks())
+}
+
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = {
+  name: 'Enduser AI summary trust gate',
+  run: enduser_ai_summary_trust_gate_checks,
 }
 
 // Allow running this test file independently
 if (require.main === module) {
   console.log(`🌐 Using API URL: ${host}`)
-  const sdk = new Session({ host })
-  const sdkNonAdmin = new Session({ host })
-
-  const runTests = async () => {
-    await setup_tests(sdk, sdkNonAdmin)
-    await enduser_ai_summary_trust_gate_tests({ sdk, sdkNonAdmin })
-  }
-
-  runTests()
+  enduser_ai_summary_trust_gate_tests()
     .then(() => {
       console.log("✅ enduserAISummary trust gate tests completed successfully")
       process.exit(0)