@tellescope/sdk 2.0.0-beta.1 → 2.0.0-beta.3

package/src/tests/api_tests/security/enduser-cross-create.test.ts

@@ -1,14 +1,16 @@
 require('source-map-support').install();
 
-import { Session, EnduserSession } from "../../../sdk"
+import { EnduserSession } from "../../../sdk"
 import {
-  async_test,
-  log_header,
-} from "@tellescope/testing"
-import { setup_tests } from "../../setup"
+  assert_checks,
+  Check,
+  IsolatedSuite,
+  setup_isolated_tenant,
+} from "../../setup_isolated"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
-const businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6'
+
+const RAND = () => Math.random().toString(36).slice(2, 10)
 
 const ENDUSER_PASSWORD = 'F0116TestPassword!123'
 
@@ -28,10 +30,80 @@ const CROSS_ENDUSER_MESSAGE = "enduserId does not match creator id for enduser s
  *
  * Methodology: each section asserts BOTH the exploit-is-blocked case AND that the
  * legitimate path (self-create + staff-create) still works.
+ *
+ * Runs on its own provisioned tenant, so the patient session's businessId comes from the tenant
+ * rather than a TEST_BUSINESS_ID env var with a hardcoded shared-org fallback. Checks are collected
+ * and returned rather than asserted inline: `assert` calls process.exit, which would skip this
+ * suite's `finally` cleanup and, in the parallel pool, every other in-flight suite's teardown.
  */
-export const enduser_cross_create_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("enduser cross-enduser create gates")
+export const enduser_cross_create_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  // The raw value decides the fallback, not JSON.stringify of it — JSON.stringify('') is '""',
+  // which is truthy, so a `|| fallback` on the stringified form could never fire.
+  const describe = (value: any): string => {
+    if (value === undefined || value === null) return String(value)
+    const stringified = JSON.stringify(value)
+    return stringified === undefined ? String(value) : stringified
+  }
+  const errorMessage = (e: any): string => (
+    typeof e?.message === 'string' && e.message !== '' ? e.message : describe(e)
+  )
+
+  /** The async_test({ shouldError, onError }) equivalent, as a soft Check. */
+  const expect_rejection = async (
+    label: string,
+    fn: () => Promise<{ id?: string } | any>,
+    expectedMessage: string,
+  ) => {
+    let created: any
+    let error: any
+    let rejected = false
+    try {
+      created = await fn()
+    } catch (e: any) {
+      rejected = true
+      error = e
+    }
+
+    if (!rejected) {
+      // id only — the created record carries the patient linkage this check is about, and the table
+      // prints on every run
+      record(label, false, `NOT REJECTED: created ${describe(created?.id)} (expected "${expectedMessage}")`)
+      return
+    }
+
+    const message = errorMessage(error)
+    record(
+      label,
+      message === expectedMessage,
+      message === expectedMessage
+        ? `rejected: ${message}`
+        : `rejected with the WRONG error: ${message} (expected "${expectedMessage}")`,
+    )
+  }
+
+  /**
+   * The async_test({ onResult }) equivalent, as a soft Check: a call that REJECTS is a failure
+   * (async_test treats it the same way), and a resolved call passes only when `inspect` agrees.
+   * `inspect` runs inside the try so a throw inside it fails this one check rather than escaping
+   * `run` and aborting every other suite in the batch.
+   */
+  const expect_result = async <T,>(
+    label: string,
+    fn: () => Promise<T>,
+    inspect: (r: T) => { pass: boolean, detail: string },
+  ) => {
+    try {
+      const { pass, detail } = inspect(await fn())
+      record(label, pass, detail)
+    } catch (e: any) {
+      record(label, false, `rejected instead of resolving: ${errorMessage(e)}`)
+    }
+  }
 
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
   let attackerId: string | undefined
   let victimId: string | undefined
   const createdObservationIds: string[] = []
@@ -40,6 +112,13 @@ export const enduser_cross_create_tests = async ({ sdk } : { sdk: Session, sdkNo
   const createdRoomIds: string[] = []
 
   try {
+    tenant = await setup_isolated_tenant({
+      name: `Enduser cross-enduser create gates ${RAND()}`,
+      users: [{ isAdmin: true }],
+      apiKeys: 0,
+    })
+    const { sdk } = tenant
+
     // ---- Setup: attacker enduser (with portal session) + victim enduser ----
     const attackerEmail = `f0116-attacker-${Date.now()}@example.com`
     const victimEmail = `f0116-victim-${Date.now()}@example.com`
@@ -49,46 +128,58 @@ export const enduser_cross_create_tests = async ({ sdk } : { sdk: Session, sdkNo
     victimId = victim.id
     await sdk.api.endusers.set_password({ id: attacker.id, password: ENDUSER_PASSWORD })
 
-    const attackerSDK = new EnduserSession({ host, businessId })
+    const attackerSDK = new EnduserSession({ host, businessId: tenant.businessId })
     await attackerSDK.authenticate(attackerEmail, ENDUSER_PASSWORD)
 
     // ============================================================
     // enduser_observations
     // ============================================================
-    await async_test(
+    await expect_rejection(
       `enduser cannot create observation on another enduser (createOne)`,
       () => attackerSDK.api.enduser_observations.createOne({
         enduserId: victimId!, category: 'vital-signs', status: 'final',
         measurement: { unit: 'mmHg', value: 220 },
       } as any),
-      { shouldError: true, onError: e => e.message === CROSS_ENDUSER_MESSAGE },
+      CROSS_ENDUSER_MESSAGE,
     )
-    await async_test(
+    await expect_rejection(
       `enduser cannot create observation on another enduser (createMany)`,
       () => attackerSDK.api.enduser_observations.createSome([{
         enduserId: victimId!, category: 'vital-signs', status: 'final',
         measurement: { unit: 'mmHg', value: 220 },
       }] as any),
-      { shouldError: true, onError: e => e.message === CROSS_ENDUSER_MESSAGE },
+      CROSS_ENDUSER_MESSAGE,
     )
 
     // Positive control: enduser CAN create an observation on their OWN record
-    await async_test(
+    await expect_result(
       `enduser can still create observation on own record`,
       () => attackerSDK.api.enduser_observations.createOne({
         enduserId: attackerId!, category: 'vital-signs', status: 'final',
         measurement: { unit: 'mmHg', value: 120 },
       } as any),
-      { onResult: (o: any) => { if (o?.id) createdObservationIds.push(o.id); return o?.enduserId === attackerId } },
+      (o: any) => {
+        if (o?.id) createdObservationIds.push(o.id)
+        return {
+          pass: o?.enduserId === attackerId,
+          detail: `enduserId=${describe(o?.enduserId)} (self=${attackerId})`,
+        }
+      },
     )
     // Positive control: staff CAN create an observation on any tenant enduser
-    await async_test(
+    await expect_result(
       `staff can still create observation on any enduser`,
       () => sdk.api.enduser_observations.createOne({
         enduserId: victimId!, category: 'vital-signs', status: 'final',
         measurement: { unit: 'mmHg', value: 118 },
       } as any),
-      { onResult: (o: any) => { if (o?.id) createdObservationIds.push(o.id); return o?.enduserId === victimId } },
+      (o: any) => {
+        if (o?.id) createdObservationIds.push(o.id)
+        return {
+          pass: o?.enduserId === victimId,
+          detail: `enduserId=${describe(o?.enduserId)} (target=${victimId})`,
+        }
+      },
     )
 
     // ============================================================
@@ -98,118 +189,166 @@ export const enduser_cross_create_tests = async ({ sdk } : { sdk: Session, sdkNo
       enduserId, externalId: `f0117-${Date.now()}`, source: 'f0117-source',
       title: 'f0117 order', status: 'pending',
     })
-    await async_test(
+    await expect_rejection(
       `enduser cannot create order on another enduser`,
       () => attackerSDK.api.enduser_orders.createOne(orderPayload(victimId!) as any),
-      { shouldError: true, onError: e => e.message === CROSS_ENDUSER_MESSAGE },
+      CROSS_ENDUSER_MESSAGE,
     )
-    await async_test(
+    await expect_result(
       `enduser can still create order on own record`,
       () => attackerSDK.api.enduser_orders.createOne(orderPayload(attackerId!) as any),
-      { onResult: (o: any) => { if (o?.id) createdOrderIds.push(o.id); return o?.enduserId === attackerId } },
+      (o: any) => {
+        if (o?.id) createdOrderIds.push(o.id)
+        return {
+          pass: o?.enduserId === attackerId,
+          detail: `enduserId=${describe(o?.enduserId)} (self=${attackerId})`,
+        }
+      },
     )
-    await async_test(
+    await expect_result(
       `staff can still create order on any enduser`,
       () => sdk.api.enduser_orders.createOne(orderPayload(victimId!) as any),
-      { onResult: (o: any) => { if (o?.id) createdOrderIds.push(o.id); return o?.enduserId === victimId } },
+      (o: any) => {
+        if (o?.id) createdOrderIds.push(o.id)
+        return {
+          pass: o?.enduserId === victimId,
+          detail: `enduserId=${describe(o?.enduserId)} (target=${victimId})`,
+        }
+      },
     )
 
     // ============================================================
     // managed_content_records
     // ============================================================
-    await async_test(
+    await expect_rejection(
       `enduser cannot create content with allowUnauthenticatedAccess`,
       () => attackerSDK.api.managed_content_records.createOne({
         title: 'f0119 phishing', textContent: 'x', allowUnauthenticatedAccess: true,
       } as any),
-      { shouldError: true, onError: e => e.message === "allowUnauthenticatedAccess cannot be set by endusers" },
+      "allowUnauthenticatedAccess cannot be set by endusers",
     )
-    await async_test(
+    await expect_rejection(
       `enduser cannot create content with publicRead`,
       () => attackerSDK.api.managed_content_records.createOne({
         title: 'f0119 broadcast', textContent: 'x', publicRead: true,
       } as any),
-      { shouldError: true, onError: e => e.message === "publicRead cannot be set by endusers" },
+      "publicRead cannot be set by endusers",
     )
-    await async_test(
+    await expect_rejection(
       `enduser cannot create content bound to another enduser`,
       () => attackerSDK.api.managed_content_records.createOne({
         title: 'f0119 cross', textContent: 'x', enduserId: victimId!,
       } as any),
-      { shouldError: true, onError: e => e.message === CROSS_ENDUSER_MESSAGE },
+      CROSS_ENDUSER_MESSAGE,
     )
-    await async_test(
+    await expect_result(
       `enduser can still create ordinary content`,
       () => attackerSDK.api.managed_content_records.createOne({
         title: 'f0119 ok', textContent: 'hello',
       } as any),
-      { onResult: (o: any) => { if (o?.id) createdContentIds.push(o.id); return !o?.publicRead && !o?.allowUnauthenticatedAccess } },
+      (o: any) => {
+        if (o?.id) createdContentIds.push(o.id)
+        return {
+          pass: !o?.publicRead && !o?.allowUnauthenticatedAccess,
+          detail: `publicRead=${describe(o?.publicRead)} `
+            + `allowUnauthenticatedAccess=${describe(o?.allowUnauthenticatedAccess)} (want both unset)`,
+        }
+      },
     )
-    await async_test(
+    await expect_result(
       `staff can still create public content`,
       () => sdk.api.managed_content_records.createOne({
         title: 'f0119 staff public', textContent: 'x', publicRead: true,
       } as any),
-      { onResult: (o: any) => { if (o?.id) createdContentIds.push(o.id); return o?.publicRead === true } },
+      (o: any) => {
+        if (o?.id) createdContentIds.push(o.id)
+        return {
+          pass: o?.publicRead === true,
+          detail: `publicRead=${describe(o?.publicRead)} (want true)`,
+        }
+      },
     )
 
     // ============================================================
     // chat_rooms (enduserIds-only gate; staff userIds targeting is by-design)
     // ============================================================
     const staffId = sdk.userInfo.id
-    await async_test(
+    await expect_rejection(
       `enduser cannot add another patient to a chat room (enduserIds)`,
       () => attackerSDK.api.chat_rooms.createOne({
         type: 'internal', enduserIds: [attackerId!, victimId!], userIds: [staffId],
       } as any),
-      { shouldError: true, onError: e => e.message === "enduserIds may only contain your own id for enduser session" },
+      "enduserIds may only contain your own id for enduser session",
     )
     // Positive control: patient CAN create a room with care-team staff + self (intended feature)
-    await async_test(
+    await expect_result(
       `enduser can still create a room with staff + self`,
       () => attackerSDK.api.chat_rooms.createOne({
         type: 'internal', enduserIds: [attackerId!], userIds: [staffId],
       } as any),
-      { onResult: (o: any) => { if (o?.id) createdRoomIds.push(o.id); return o?.enduserIds?.length === 1 && o?.userIds?.includes(staffId) } },
+      (o: any) => {
+        if (o?.id) createdRoomIds.push(o.id)
+        return {
+          pass: o?.enduserIds?.length === 1 && o?.userIds?.includes(staffId),
+          detail: `enduserIds=${describe(o?.enduserIds?.length)} userIds include staff=`
+            + `${describe(!!o?.userIds?.includes(staffId))} (want 1 and true)`,
+        }
+      },
     )
     // Positive control: staff can still create multi-patient rooms
-    await async_test(
+    await expect_result(
       `staff can still create a room with multiple endusers`,
       () => sdk.api.chat_rooms.createOne({
         type: 'internal', enduserIds: [attackerId!, victimId!], userIds: [staffId],
       } as any),
-      { onResult: (o: any) => { if (o?.id) createdRoomIds.push(o.id); return o?.enduserIds?.length === 2 } },
+      (o: any) => {
+        if (o?.id) createdRoomIds.push(o.id)
+        return {
+          pass: o?.enduserIds?.length === 2,
+          detail: `enduserIds=${describe(o?.enduserIds?.length)} (want 2)`,
+        }
+      },
     )
   } finally {
-    for (const id of createdRoomIds) {
-      try { await sdk.api.chat_rooms.deleteOne(id) } catch {}
-    }
-    for (const id of createdContentIds) {
-      try { await sdk.api.managed_content_records.deleteOne(id) } catch {}
-    }
-    for (const id of createdObservationIds) {
-      try { await sdk.api.enduser_observations.deleteOne(id) } catch {}
+    if (tenant) {
+      const { sdk } = tenant
+      for (const id of createdRoomIds) {
+        try { await sdk.api.chat_rooms.deleteOne(id) } catch {}
+      }
+      for (const id of createdContentIds) {
+        try { await sdk.api.managed_content_records.deleteOne(id) } catch {}
+      }
+      for (const id of createdObservationIds) {
+        try { await sdk.api.enduser_observations.deleteOne(id) } catch {}
+      }
+      for (const id of createdOrderIds) {
+        try { await sdk.api.enduser_orders.deleteOne(id) } catch {}
+      }
+      if (attackerId) { try { await sdk.api.endusers.deleteOne(attackerId) } catch {} }
+      if (victimId) { try { await sdk.api.endusers.deleteOne(victimId) } catch {} }
+      // Teardown BEFORE anything asserts — assert calls process.exit, which would strand this tenant.
+      try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) }
     }
-    for (const id of createdOrderIds) {
-      try { await sdk.api.enduser_orders.deleteOne(id) } catch {}
-    }
-    if (attackerId) { try { await sdk.api.endusers.deleteOne(attackerId) } catch {} }
-    if (victimId) { try { await sdk.api.endusers.deleteOne(victimId) } catch {} }
   }
+
+  return checks
+}
+
+/** Asserting wrapper, for standalone runs. */
+export const enduser_cross_create_tests = async () => {
+  assert_checks('Enduser cross-enduser create gates', await enduser_cross_create_checks())
+}
+
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = {
+  name: 'Enduser cross-enduser create gates',
+  run: enduser_cross_create_checks,
 }
 
 // Allow running this test file independently
 if (require.main === module) {
   console.log(`🌐 Using API URL: ${host}`)
-  const sdk = new Session({ host })
-  const sdkNonAdmin = new Session({ host })
-
-  const runTests = async () => {
-    await setup_tests(sdk, sdkNonAdmin)
-    await enduser_cross_create_tests({ sdk, sdkNonAdmin })
-  }
-
-  runTests()
+  enduser_cross_create_tests()
     .then(() => {
       console.log("✅ enduser cross-create test suite completed successfully")
       process.exit(0)