@tellescope/sdk 2.0.0-beta.1 → 2.0.0-beta.3

package/src/tests/api_tests/security/globalunique-conflict-redaction.test.ts

@@ -1,14 +1,21 @@
 require('source-map-support').install();
 
-import { Session } from "../../../sdk"
 import {
-  async_test,
-  log_header,
-} from "@tellescope/testing"
-import { setup_tests } from "../../setup"
+  assert_checks,
+  Check,
+  setup_isolated_tenant,
+  IsolatedSuite,
+  IsolatedTenant,
+} from "../../setup_isolated"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
+/** The only keys the redacted `existingRecord` may carry. `convert_id_name` never runs on an error
+ *  body, so the raw `_id` is what ships; `id` is tolerated in case that ever changes. */
+const ALLOWED_EXISTING_RECORD_KEYS = ['_id', 'id', 'businessId']
+
 /**
  * Regression test: a globalUnique conflict response must not echo the matched record.
  *
@@ -19,59 +26,171 @@ const host = process.env.API_URL || 'http://localhost:8080' as const
  * (globalUnique: ['email','phone']) the 409 body leaked the full record incl. hashedPass.
  *
  * Fix: redact existingRecord to { _id, businessId } like the safe validateUniquenessConstraints
- * path. This reproduces the leak with a same-tenant collision (same code path) and asserts the
- * 409 body's existingRecord exposes nothing beyond _id + businessId.
+ * path. Both checks below drive that block directly with `_overrideUnique: true`, which is what
+ * skips `validateUniquenessConstraints` (a separate 409 with its own redaction, out of scope here).
+ *
+ *   1. Same-tenant collision — the original coverage, preserved.
+ *   2. Cross-tenant collision — tenant B re-creates tenant A's address. This is the case that
+ *      actually exercises the leak: `findSomeByMatchAny_Global` drops `businessId`, so only a
+ *      foreign match can carry another tenant's data, and the check pins
+ *      `existingRecord.businessId === tenantA.businessId` so a same-tenant match cannot satisfy it.
+ *      Returning the other tenant's `_id` + `businessId` is the accepted fixed behaviour.
+ *
+ * Provisions two throwaway tenants rather than using the shared fixture: the suite creates real
+ * `users` records, and an interrupted run against the shared org would strand staff accounts in it.
  */
-export const globalunique_leak_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("globalUnique conflict response redaction")
+export const globalunique_leak_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  let tenantA: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+  let tenantB: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
 
-  let userId: string | undefined
   try {
-    const email = `f0145-victim-${Date.now()}@example.com`
-    const user = await sdk.api.users.createOne({ email } as any)
-    userId = user.id
-
-    await async_test(
-      'globalUnique 409 existingRecord exposes only _id + businessId (no email/hashedPass)',
-      () => sdk.api.users.createOne({ email, _overrideUnique: true } as any),
-      {
-        shouldError: true,
-        onError: (e: any) => {
-          const rec = e?.info?.[0]?.existingRecord
-          if (!rec || typeof rec !== 'object') return false
-          const keys = Object.keys(rec)
-          return (
-            keys.length > 0
-            && keys.every(k => k === '_id' || k === 'businessId' || k === 'id')
-            && !('email' in rec)
-            && !('hashedPass' in rec)
-            && !('hashedInviteCode' in rec)
-          )
-        },
-      },
+    ;[tenantA, tenantB] = await Promise.all([
+      setup_isolated_tenant({ name: `GlobalUnique A ${RAND()}`, users: [{ isAdmin: true }], apiKeys: 0 }),
+      setup_isolated_tenant({ name: `GlobalUnique B ${RAND()}`, users: [{ isAdmin: true }], apiKeys: 0 }),
+    ])
+
+    // `dontsend...@tellescope.com` is what suppresses outbound mail (api/modules/sqs.ts), so creating
+    // the user cannot deliver an invite. Stamped per run because `users.email` is globalUnique ACROSS
+    // organizations — a fixed address would collide with a concurrently running suite's tenant and
+    // make the 409 point at a record this suite does not own.
+    const email = `dontsend-globalunique-${Date.now()}-${RAND()}@tellescope.com`
+
+    const victim = await tenantA.sdk.api.users.createOne({ email } as any)
+
+    record(
+      'setup: two separate tenants, the colliding user belongs to tenant A',
+      tenantA.businessId !== tenantB.businessId && !!victim.id,
+      `tenantA=${tenantA.businessId} tenantB=${tenantB.businessId} user=${victim.id} email=${email}`,
     )
+
+    /** Drives the globalUnique block and reports what the 409's `existingRecord` exposed. */
+    const probe = async (sdk: IsolatedTenant['sdk']) => {
+      let error: any
+      let accepted: any
+      try {
+        accepted = await sdk.api.users.createOne({ email, _overrideUnique: true } as any)
+      } catch (err) { error = err }
+
+      const violation = error?.info?.[0]
+      return { error, accepted, existingRecord: violation?.existingRecord, conflictingFields: violation?.conflictingFields }
+    }
+
+    /**
+     * Pins WHICH 409 answered. Both uniqueness sites now redact to an identical `{ _id, businessId }`,
+     * so the body alone cannot tell them apart — and `validateUniquenessConstraints` also looks up
+     * cross-tenant. If `_overrideUnique` ever stopped skipping that earlier validation, these checks
+     * would keep passing while covering the wrong site.
+     *
+     * The discriminator is the shape of `conflictingFields`: the globalUnique block passes the raw
+     * constraint ARRAY (`model.constraints.globalUnique`, i.e. ['email','phone']), while
+     * validateUniquenessConstraints passes a `matching_fields` OBJECT (`{ email: '<value>' }`).
+     */
+    const from_globalunique_block = (conflictingFields: any) => Array.isArray(conflictingFields)
+
+    /** The redaction assertion shared by both checks. */
+    const redaction_verdict = (rec: any) => {
+      if (!rec || typeof rec !== 'object') return { pass: false, keys: [] as string[] }
+      const keys = Object.keys(rec)
+      const pass = (
+        keys.length > 0
+        && keys.every(k => ALLOWED_EXISTING_RECORD_KEYS.includes(k))
+        // named explicitly as well as covered by the allow-list above: these are the fields the
+        // unredacted body actually leaked, and the list is what a later edit would widen
+        && !('email' in rec)
+        && !('hashedPass' in rec)
+        && !('hashedInviteCode' in rec)
+      )
+      return { pass, keys }
+    }
+
+    /* ===== 1: same-tenant collision (the original coverage) ===== */
+
+    const sameTenant = await probe(tenantA.sdk)
+
+    if (!sameTenant.error) {
+      record(
+        '1: same-tenant globalUnique 409 existingRecord exposes only _id + businessId',
+        false,
+        `the write was accepted (id=${sameTenant.accepted?.id}) — no 409 was raised, so the redaction was never exercised`,
+      )
+    } else {
+      const { pass, keys } = redaction_verdict(sameTenant.existingRecord)
+      const fromGlobalUnique = from_globalunique_block(sameTenant.conflictingFields)
+      record(
+        '1: same-tenant globalUnique 409 existingRecord exposes only _id + businessId',
+        pass && fromGlobalUnique,
+        `existingRecord keys=${JSON.stringify(keys)} (allowed: ${JSON.stringify(ALLOWED_EXISTING_RECORD_KEYS)});`
+        + ` conflictingFields=${JSON.stringify(sameTenant.conflictingFields)} (must be the globalUnique array,`
+        + ` not a validateUniquenessConstraints object);`
+        + ` error=${sameTenant.error?.message || String(sameTenant.error)}`,
+      )
+    }
+
+    /* ===== 2: cross-tenant collision — the case that can leak another tenant's record ===== */
+
+    const crossTenant = await probe(tenantB.sdk)
+
+    if (!crossTenant.error) {
+      record(
+        '2: cross-tenant globalUnique 409 exposes only tenant A\'s _id + businessId',
+        false,
+        `the write was accepted (id=${crossTenant.accepted?.id}) — tenant B re-created a globalUnique email`
+        + ` without a 409, so the redaction was never exercised`,
+      )
+    } else {
+      const rec = crossTenant.existingRecord
+      const { pass, keys } = redaction_verdict(rec)
+      // pinned so a SAME-tenant match cannot satisfy this check: the 409 must name tenant A, proving
+      // the cross-tenant lookup is the one that ran
+      const namesTenantA = String(rec?.businessId ?? '') === String(tenantA.businessId)
+      // check 1's duplicate create threw, so tenant A's `victim` is the ONLY record anywhere carrying
+      // this address — the matched _id is deterministic, so pin it rather than only reporting it
+      const namesVictim = String(rec?._id ?? rec?.id ?? '') === String(victim.id)
+      const fromGlobalUnique = from_globalunique_block(crossTenant.conflictingFields)
+      record(
+        '2: cross-tenant globalUnique 409 exposes only tenant A\'s _id + businessId',
+        pass && namesTenantA && namesVictim && fromGlobalUnique,
+        `existingRecord keys=${JSON.stringify(keys)} (allowed: ${JSON.stringify(ALLOWED_EXISTING_RECORD_KEYS)});`
+        + ` conflictingFields=${JSON.stringify(crossTenant.conflictingFields)} (must be the globalUnique array,`
+        + ` not a validateUniquenessConstraints object);`
+        + ` businessId=${rec?.businessId ?? '<missing>'} (want tenant A ${tenantA.businessId}, not caller ${tenantB.businessId});`
+        + ` _id=${rec?._id ?? rec?.id ?? '<missing>'} (tenant A user ${victim.id});`
+        + ` error=${crossTenant.error?.message || String(crossTenant.error)}`,
+      )
+    }
   } finally {
-    if (userId) { try { await sdk.api.users.deleteOne(userId) } catch {} }
+    // Teardown happens here, BEFORE anything asserts — assert calls process.exit and would otherwise
+    // strand these tenants permanently (nothing can delete an organization record). It is also the
+    // only cleanup needed: teardown deletes every schema model for the businessId, `users` included.
+    for (const t of [tenantA, tenantB]) {
+      if (t) { try { await t.teardown() } catch (e) { console.error('teardown failed', e) } }
+    }
   }
+
+  return checks
 }
 
-if (require.main === module) {
-  console.log(`🌐 Using API URL: ${host}`)
-  const sdk = new Session({ host })
-  const sdkNonAdmin = new Session({ host })
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+export const globalunique_leak_tests = async () => {
+  assert_checks('globalUnique conflict redaction', await globalunique_leak_checks())
+}
 
-  const runTests = async () => {
-    await setup_tests(sdk, sdkNonAdmin)
-    await globalunique_leak_tests({ sdk, sdkNonAdmin })
-  }
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = { name: 'globalUnique conflict redaction', run: globalunique_leak_checks }
 
-  runTests()
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  globalunique_leak_tests()
     .then(() => {
-      console.log("✅ globalUnique leak test suite completed successfully")
+      console.log("✅ globalUnique conflict redaction test suite completed successfully")
       process.exit(0)
     })
     .catch((error) => {
-      console.error("❌ globalUnique leak test suite failed:", error)
+      console.error("❌ globalUnique conflict redaction test suite failed:", error)
       process.exit(1)
     })
 }

package/src/tests/api_tests/security/handle-incoming-communication-cross-tenant.test.ts

@@ -2,17 +2,17 @@ require('source-map-support').install();
 
 import axios from "axios"
 import { ObjectId } from 'bson'
-import { Session } from "../../../sdk"
+
 import {
-  async_test,
-  log_header,
-} from "@tellescope/testing"
-import { setup_tests } from "../../setup"
+  assert_checks,
+  Check,
+  IsolatedSuite,
+  setup_isolated_tenant,
+} from "../../setup_isolated"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
-const CROSS_ORG_API_KEY = process.env.CROSS_ORG_API_KEY
-const CROSS_ORG_TARGET_BUSINESS_ID = process.env.CROSS_ORG_TARGET_BUSINESS_ID
+const RAND = () => Math.random().toString(36).slice(2, 10)
 
 const post = async (path: string, body: any, headers: Record<string, string> = {}) => {
   try {
@@ -36,89 +36,97 @@ const post = async (path: string, body: any, headers: Record<string, string> = {
  * The fix switches to the standard tenant-scoped `DB.endusers.findById(enduserId)` wrapper, which automatically
  * filters by `req.session.businessId`. Cross-tenant lookups now return null → handler returns 404 → no side effect.
  *
- * Note: the same-tenant happy path is already covered by the existing test at
- * `packages/public/sdk/src/tests/tests.ts:7588` ("handle_incoming_communication test for other enduser") — that
- * test creates endusers in the test tenant, sets up journeys, calls handle_incoming_communication, and asserts
- * journey-step cancellation. This file covers the negative cases only.
+ * Note: the same-tenant happy path is already covered by the existing test in `tests.ts`
+ * ("handle_incoming_communication test for other enduser") — that test creates endusers in the test
+ * tenant, sets up journeys, calls handle_incoming_communication, and asserts journey-step
+ * cancellation. This file covers the negative cases only.
  *
  * **Negative-only by design**: the test never drives `handleIncomingCommunication` against a cross-tenant
  * enduser — the post-fix code returns 404 before any side effects fire, and the assertion confirms that.
+ *
+ * Both tenants are provisioned here (`apiKeys: 0` — the sessions are bearer-token ones, no API key is
+ * used). Previously the second tenant came from the cross-org environment variables, which are unset
+ * on a clean checkout, so the cross-tenant assertion — the whole point of the file — silently skipped
+ * and the suite still passed green.
  */
-export const handle_incoming_communication_cross_tenant_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("handle_incoming_communication cross-tenant rejection")
+export const handle_incoming_communication_cross_tenant_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
 
-  // ====================================================================
-  // Assertion 1: nonexistent enduserId returns 404 (baseline; regression
-  // guard for the not-found path that any cross-tenant call now lands in).
-  // ====================================================================
-  const nonexistentId = new ObjectId().toHexString()
-  const nonexistentRes = await post(
-    '/v1/journeys/handle-incoming-communication',
-    { enduserId: nonexistentId },
-    { Authorization: `Bearer ${sdk.authToken}` },
-  )
-  await async_test(
-    "handle_incoming_communication with nonexistent enduserId returns 404",
-    async () => ({ status: nonexistentRes.status }),
-    { onResult: r => r.status === 404 },
-  )
+  let caller: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+  let victimTenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
 
-  // ====================================================================
-  // Assertion 2: cross-tenant enduserId returns 404 (the actual fix).
-  // Env-gated; skipped when cross-org infra isn't configured.
-  // Safe to run post-fix because the tenant-scoped DB returns null for
-  // cross-tenant lookups — no handleIncomingCommunication side effect fires.
-  // ====================================================================
-  if (!(CROSS_ORG_API_KEY && CROSS_ORG_TARGET_BUSINESS_ID)) {
-    console.log("  Skipping cross-tenant rejection assertion — CROSS_ORG_* env vars not set")
-    return
-  }
+  try {
+    ;[caller, victimTenant] = await Promise.all([
+      setup_isolated_tenant({ name: `F0008 caller ${RAND()}`, users: [{ isAdmin: true }], apiKeys: 0 }),
+      setup_isolated_tenant({ name: `F0008 victim ${RAND()}`, users: [{ isAdmin: true }], apiKeys: 0 }),
+    ])
 
-  const sdkCrossOrg = new Session({
-    host,
-    apiKey: CROSS_ORG_API_KEY,
-    headers: { 'x-tellescope-organization': CROSS_ORG_TARGET_BUSINESS_ID },
-  })
+    // ====================================================================
+    // Assertion 1: nonexistent enduserId returns 404 (baseline; regression
+    // guard for the not-found path that any cross-tenant call now lands in).
+    // ====================================================================
+    const nonexistentId = new ObjectId().toHexString()
+    const nonexistentRes = await post(
+      '/v1/journeys/handle-incoming-communication',
+      { enduserId: nonexistentId },
+      { Authorization: `Bearer ${caller.sdk.authToken}` },
+    )
+    record(
+      "handle_incoming_communication with nonexistent enduserId returns 404",
+      nonexistentRes.status === 404,
+      `enduserId=${nonexistentId} status=${nonexistentRes.status} (want 404) body=${JSON.stringify(nonexistentRes.data)}`,
+    )
 
-  // Create a sentinel enduser in the cross-org tenant. Use a clearly-test email
-  // so any accidental side-effect routing is obvious in logs.
-  const ts = Date.now()
-  const crossEnduser = await sdkCrossOrg.api.endusers.createOne({
-    fname: 'F0008CrossTenant', lname: 'Sentinel',
-    email: `f0008-cross-${ts}@tellescope.com`,
-  } as any)
+    // ====================================================================
+    // Assertion 2: cross-tenant enduserId returns 404 (the actual fix).
+    // Safe to run post-fix because the tenant-scoped DB returns null for
+    // cross-tenant lookups — no handleIncomingCommunication side effect fires.
+    // ====================================================================
+    // Sentinel enduser in the OTHER tenant. Clearly-test naming so any accidental side-effect routing
+    // is obvious in logs.
+    const crossEnduser = await victimTenant.sdk.api.endusers.createOne({
+      fname: 'F0008CrossTenant', lname: 'Sentinel',
+      email: `f0008-cross-${RAND()}@tellescope.com`,
+    } as any)
 
-  try {
+    // the POST keeps the CALLER tenant's bearer token — the enduser id is the other tenant's
     const crossRes = await post(
       '/v1/journeys/handle-incoming-communication',
       { enduserId: crossEnduser.id },
-      { Authorization: `Bearer ${sdk.authToken}` },
+      { Authorization: `Bearer ${caller.sdk.authToken}` },
     )
-
-    await async_test(
+    record(
       "handle_incoming_communication with cross-tenant enduserId returns 404 (no side effect)",
-      async () => ({
-        status: crossRes.status,
-        message: crossRes.data?.message ?? null,
-      }),
-      { onResult: r => r.status === 404 },
+      crossRes.status === 404,
+      `caller tenant=${caller.businessId} enduser tenant=${victimTenant.businessId} enduserId=${crossEnduser.id}`
+        + ` status=${crossRes.status} (want 404) body=${JSON.stringify(crossRes.data)}`,
     )
   } finally {
-    try { await sdkCrossOrg.api.endusers.deleteOne(crossEnduser.id) } catch {}
+    // Teardown BEFORE anything asserts — assert calls process.exit, which would strand these tenants
+    // permanently (nothing in the system can delete an organization record).
+    for (const t of [caller, victimTenant]) {
+      if (t) { try { await t.teardown() } catch (e) { console.error('teardown failed', e) } }
+    }
   }
+
+  return checks
 }
 
-if (require.main === module) {
-  console.log(`🌐 Using API URL: ${host}`)
-  const sdk = new Session({ host })
-  const sdkNonAdmin = new Session({ host })
+/** Asserting wrapper, for standalone runs. */
+export const handle_incoming_communication_cross_tenant_tests = async () => {
+  assert_checks('handle_incoming_communication cross-tenant', await handle_incoming_communication_cross_tenant_checks())
+}
 
-  const runTests = async () => {
-    await setup_tests(sdk, sdkNonAdmin)
-    await handle_incoming_communication_cross_tenant_tests({ sdk, sdkNonAdmin })
-  }
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = {
+  name: 'handle_incoming_communication cross-tenant',
+  run: handle_incoming_communication_cross_tenant_checks,
+}
 
-  runTests()
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  handle_incoming_communication_cross_tenant_tests()
     .then(() => {
       console.log("✅ handle_incoming_communication cross-tenant test suite completed successfully")
       process.exit(0)
@@ -127,4 +135,4 @@ if (require.main === module) {
       console.error("❌ handle_incoming_communication cross-tenant test suite failed:", error)
       process.exit(1)
     })
-}
+}

package/src/tests/api_tests/security/load-inbox-redaction.test.ts

@@ -1,16 +1,18 @@
 require('source-map-support').install();
 
-import { Session } from "../../../sdk"
 import {
-  async_test,
-  log_header,
-} from "@tellescope/testing"
-import { setup_tests } from "../../setup"
+  assert_checks,
+  Check,
+  IsolatedSuite,
+  setup_isolated_tenant,
+} from "../../setup_isolated"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
 const ENDUSER_PASSWORD = 'F0151TestPassword!123'
 
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
 /**
  * Regression test: `load_inbox_data` must apply enduser field redactions.
  *
@@ -21,54 +23,87 @@ const ENDUSER_PASSWORD = 'F0151TestPassword!123'
  * Repro: create an enduser, set their portal password (→ hashedPassword), seed an inbound
  * (logOnly) email so the enduser appears in the inbox join, then load_inbox_data as staff and
  * assert the returned enduser entry has NO hashedPassword.
+ *
+ * Why configure_inbox runs first: emails.createOne is registered `requiresInboxConfiguration`,
+ * which reads username/orgEmail off the JWT, and a provisioned user has neither — so the seed
+ * would 400 without it. The SDK's configure_inbox is a plain POST: it returns a new authToken but
+ * does not install it, hence the refresh_session() that follows.
  */
-export const load_inbox_redaction_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("load_inbox_data enduser redaction")
+export const load_inbox_redaction_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
 
-  let enduserId: string | undefined
-  let emailId: string | undefined
   try {
-    const email = `f0151-enduser-${Date.now()}@example.com`
-    const enduser = await sdk.api.endusers.createOne({ email, fname: 'F0151', lname: 'Inbox' })
-    enduserId = enduser.id
-    await sdk.api.endusers.set_password({ id: enduser.id, password: ENDUSER_PASSWORD })
-
-    // Seed an inbound logOnly email so the enduser is joined into the inbox payload
-    const seeded = await sdk.api.emails.createOne({
-      enduserId: enduser.id, subject: 'F0151 seed', textContent: 'seed',
-      logOnly: true, inbound: true,
-    } as any)
-    emailId = seeded.id
-
-    await async_test(
-      'load_inbox_data does not leak enduser.hashedPassword to staff',
-      () => sdk.api.endusers.load_inbox_data({ enduserIds: [enduser.id] } as any),
-      {
-        onResult: (r: any) => {
-          const returned = (r?.endusers ?? []).find((e: any) => (e.id || e._id)?.toString() === enduserId)
-          // require that the enduser actually came back (so the assertion is meaningful),
-          // and that hashedPassword is absent
-          return !!returned && !('hashedPassword' in returned)
-        },
-      },
-    )
+    tenant = await setup_isolated_tenant({
+      name: `LoadInboxRedaction ${RAND()}`,
+      users: [{ isAdmin: true }],
+      apiKeys: 0,
+    })
+    const { sdk } = tenant
+
+    // username is unique per organization; a fresh random one keeps back-to-back runs independent
+    await sdk.api.users.configure_inbox({ username: `inbox${RAND()}`, fname: 'F0151', lname: 'Staff' })
+    await sdk.refresh_session() // installs the username/orgEmail-bearing token configure_inbox minted
+
+    let enduserId: string | undefined
+    let emailId: string | undefined
+
+    try {
+      const email = `f0151-enduser-${RAND()}@example.com`
+      const enduser = await sdk.api.endusers.createOne({ email, fname: 'F0151', lname: 'Inbox' })
+      enduserId = enduser.id
+      await sdk.api.endusers.set_password({ id: enduser.id, password: ENDUSER_PASSWORD })
+
+      // Seed an inbound logOnly email so the enduser is joined into the inbox payload
+      const seeded = await sdk.api.emails.createOne({
+        enduserId: enduser.id, subject: 'F0151 seed', textContent: 'seed',
+        logOnly: true, inbound: true,
+      } as any)
+      emailId = seeded.id
+
+      const loaded: any = await sdk.api.endusers.load_inbox_data({ enduserIds: [enduser.id] } as any)
+      const returned = (loaded?.endusers ?? []).find((e: any) => (e.id || e._id)?.toString() === enduserId)
+
+      // require that the enduser actually came back (so the assertion is meaningful),
+      // and that hashedPassword is absent
+      record(
+        'load_inbox_data does not leak enduser.hashedPassword to staff',
+        !!returned && !('hashedPassword' in returned),
+        returned
+          ? `enduser ${enduserId} returned; hashedPassword present=${'hashedPassword' in returned}`
+          : `enduser ${enduserId} was NOT returned by load_inbox_data (${(loaded?.endusers ?? []).length} endusers came back)`
+            + ` — the check must not pass vacuously`,
+      )
+    } finally {
+      // per-record cleanup is kept even though teardown subsumes it, so the body stays runnable
+      // against any tenant
+      if (emailId) { try { await sdk.api.emails.deleteOne(emailId) } catch {} }
+      if (enduserId) { try { await sdk.api.endusers.deleteOne(enduserId) } catch {} }
+    }
   } finally {
-    if (emailId) { try { await sdk.api.emails.deleteOne(emailId) } catch {} }
-    if (enduserId) { try { await sdk.api.endusers.deleteOne(enduserId) } catch {} }
+    // Teardown BEFORE anything asserts — assert calls process.exit, which would strand this tenant.
+    if (tenant) { try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) } }
   }
+
+  return checks
 }
 
-if (require.main === module) {
-  console.log(`🌐 Using API URL: ${host}`)
-  const sdk = new Session({ host })
-  const sdkNonAdmin = new Session({ host })
+/** Asserting wrapper, for standalone runs. */
+export const load_inbox_redaction_tests = async () => {
+  assert_checks('Load inbox redaction', await load_inbox_redaction_checks())
+}
 
-  const runTests = async () => {
-    await setup_tests(sdk, sdkNonAdmin)
-    await load_inbox_redaction_tests({ sdk, sdkNonAdmin })
-  }
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = {
+  name: 'Load inbox redaction',
+  run: load_inbox_redaction_checks,
+}
 
-  runTests()
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  load_inbox_redaction_tests()
     .then(() => {
       console.log("✅ load_inbox_data redaction test suite completed successfully")
       process.exit(0)