@tellescope/sdk 2.0.0-beta.1 → 2.0.0-beta.3

package/src/tests/api_tests/security/webhook-timeout.test.ts

@@ -1,18 +1,21 @@
 require('source-map-support').install();
 
 import http from "http"
-import { Session } from "../../../sdk"
+
 import {
-  async_test,
-  log_header,
-} from "@tellescope/testing"
-import { setup_tests } from "../../setup"
+  assert_checks,
+  Check,
+  IsolatedSuite,
+  setup_isolated_tenant,
+} from "../../setup_isolated"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
 // The server-side axios timeout is 15s (the fix under test). We bound our own wait above that.
 const CLIENT_WAIT_MS = 20_000
 
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
 /**
  * Regression test: outbound webhook delivery must time out rather than hang.
  *
@@ -25,54 +28,82 @@ const CLIENT_WAIT_MS = 20_000
  * client timer.
  *   - green (fixed):  server times out at ~15s → handler returns 400 → SDK call rejects < 20s
  *   - red  (unfixed): the call is still pending at 20s → client timer wins
+ *
+ * The loopback receiver only clears assertPublicHttpUrl off PROD/STAGING, so this suite stays
+ * local-only, exactly as it was before it moved onto an isolated tenant.
  */
-export const webhook_timeout_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("outbound webhook timeout")
+export const webhook_timeout_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
 
-  let enduserId: string | undefined
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
   const slowServer = http.createServer(() => { /* accept connection, never respond */ })
 
   try {
+    tenant = await setup_isolated_tenant({
+      name: `WebhookTimeout ${RAND()}`,
+      users: [{ isAdmin: true }],
+      apiKeys: 0,
+    })
+    const { sdk } = tenant
+
     await new Promise<void>(resolve => slowServer.listen(0, '127.0.0.1', () => resolve()))
     const port = (slowServer.address() as any).port
     const blackholeUrl = `http://127.0.0.1:${port}/hook`
 
-    const enduser = await sdk.api.endusers.createOne({ email: `f0155-${Date.now()}@example.com`, fname: 'F0155', lname: 'Webhook' })
-    enduserId = enduser.id
-
-    await async_test(
-      'outbound webhook to a non-responding receiver times out server-side (does not hang)',
-      async () => {
-        const start = Date.now()
-        const outcome = await Promise.race([
-          sdk.api.webhooks.send_automation_webhook({
-            enduserId: enduser.id,
-            action: { info: { url: blackholeUrl } },
-          } as any).then(() => 'completed').catch(() => 'errored'),
-          new Promise<string>(r => setTimeout(() => r('client-timeout'), CLIENT_WAIT_MS)),
-        ])
-        return { outcome, elapsed: Date.now() - start }
-      },
+    let enduserId: string | undefined
+    try {
+      const enduser = await sdk.api.endusers.createOne({ email: `f0155-${RAND()}@example.com`, fname: 'F0155', lname: 'Webhook' })
+      enduserId = enduser.id
+
+      // the loser of the race is cleared rather than left pending: an uncleared 20s timer would hold
+      // the event loop open for the rest of the window after this suite is done
+      let clientTimer: ReturnType<typeof setTimeout> | undefined
+      const start = Date.now()
+      const outcome = await Promise.race([
+        sdk.api.webhooks.send_automation_webhook({
+          enduserId: enduser.id,
+          action: { info: { url: blackholeUrl } },
+        } as any).then(() => 'completed').catch(() => 'errored'),
+        new Promise<string>(r => { clientTimer = setTimeout(() => r('client-timeout'), CLIENT_WAIT_MS) }),
+      ]).finally(() => { if (clientTimer) clearTimeout(clientTimer) })
+      const elapsed = Date.now() - start
+
       // green: the server-side axios timeout fired (call settled) before our 20s client wait
-      { onResult: (r: any) => r.outcome !== 'client-timeout' && r.elapsed < CLIENT_WAIT_MS },
-    )
+      record(
+        'outbound webhook to a non-responding receiver times out server-side (does not hang)',
+        outcome !== 'client-timeout' && elapsed < CLIENT_WAIT_MS,
+        `outcome=${outcome} elapsed=${elapsed}ms (want it settled in under ${CLIENT_WAIT_MS}ms;`
+        + ` "client-timeout" means the server-side timeout never fired)`,
+      )
+    } finally {
+      // per-record cleanup is kept even though teardown subsumes it, so the body stays runnable
+      // against any tenant
+      if (enduserId) { try { await sdk.api.endusers.deleteOne(enduserId) } catch {} }
+    }
   } finally {
     slowServer.close()
-    if (enduserId) { try { await sdk.api.endusers.deleteOne(enduserId) } catch {} }
+    // Teardown BEFORE anything asserts — assert calls process.exit, which would strand this tenant.
+    if (tenant) { try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) } }
   }
+
+  return checks
 }
 
-if (require.main === module) {
-  console.log(`🌐 Using API URL: ${host}`)
-  const sdk = new Session({ host })
-  const sdkNonAdmin = new Session({ host })
+/** Asserting wrapper, for standalone runs. */
+export const webhook_timeout_tests = async () => {
+  assert_checks('Webhook timeout', await webhook_timeout_checks())
+}
 
-  const runTests = async () => {
-    await setup_tests(sdk, sdkNonAdmin)
-    await webhook_timeout_tests({ sdk, sdkNonAdmin })
-  }
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = {
+  name: 'Webhook timeout',
+  run: webhook_timeout_checks,
+}
 
-  runTests()
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  webhook_timeout_tests()
     .then(() => {
       console.log("✅ webhook timeout test suite completed successfully")
       process.exit(0)

package/src/tests/api_tests/session_for_join_link.test.ts

@@ -0,0 +1,99 @@
+require('source-map-support').install();
+
+import {
+  assert_checks,
+  Check,
+  setup_isolated_tenant,
+  IsolatedSuite,
+} from "../setup_isolated"
+import { EnduserSession } from "../../sdk"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
+// the session is confined to the video-join-link paths, so read the identity from the token itself
+const enduserIdFromAuthToken = (authToken: string): string => (
+  JSON.parse(Buffer.from(authToken.split('.')[1], 'base64url').toString()).id
+)
+
+/**
+ * `calendar_events.session_for_join_link` must log in as the attendee who holds the token, not the
+ * first enduser attendee on the event.
+ */
+export const session_for_join_link_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+
+  try {
+    tenant = await setup_isolated_tenant({
+      name: `join link ${RAND()}`,
+      users: [{ isAdmin: true }],
+      apiKeys: 0,
+    })
+    const { sdk, businessId } = tenant
+
+    const [enduserA, enduserB] = await Promise.all([
+      sdk.api.endusers.createOne({ email: `join_a_${RAND()}@test.tellescope.com` }),
+      sdk.api.endusers.createOne({ email: `join_b_${RAND()}@test.tellescope.com` }),
+    ])
+
+    const tokenA = `join-a-${RAND()}${RAND()}`
+    const tokenB = `join-b-${RAND()}${RAND()}`
+    const event = await sdk.api.calendar_events.createOne({
+      title: 'join link', durationInMinutes: 30, startTimeInMS: Date.now() + 3600_000,
+      attendees: [
+        { type: 'enduser', id: enduserA.id, joinLinkToken: tokenA },
+        { type: 'enduser', id: enduserB.id, joinLinkToken: tokenB },
+      ],
+    })
+
+    const sessionFor = (token: string) => (
+      new EnduserSession({ host, businessId }).api.calendar_events.session_for_join_link({ token })
+    )
+
+    const resultB = await sessionFor(tokenB)
+    const idB = enduserIdFromAuthToken(resultB.authToken)
+    record(
+      "second attendee's token logs in as the second attendee",
+      idB === enduserB.id && resultB.eventId === event.id,
+      `expected ${enduserB.id}, got ${idB}${idB === enduserA.id ? ' (the first attendee)' : ''}`,
+    )
+
+    const resultA = await sessionFor(tokenA)
+    const idA = enduserIdFromAuthToken(resultA.authToken)
+    record(
+      "first attendee's token logs in as the first attendee",
+      idA === enduserA.id && resultA.eventId === event.id,
+      `expected ${enduserA.id}, got ${idA}`,
+    )
+  } finally {
+    // teardown before anything asserts — assert calls process.exit, which skips pending finallys
+    if (tenant) { try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) } }
+  }
+
+  return checks
+}
+
+export const session_for_join_link_tests = async () => {
+  assert_checks('session_for_join_link attendee', await session_for_join_link_checks())
+}
+
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = { name: 'session_for_join_link attendee', run: session_for_join_link_checks }
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  session_for_join_link_tests()
+    .then(() => {
+      console.log("✅ session_for_join_link test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ session_for_join_link test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/set_fields_order_templates.test.ts

@@ -22,6 +22,7 @@ const buildSetFieldsAction = (prefix: string) => ({
       { name: `${prefix}_tracking`,   value: '{{order.tracking}}',   type: 'Custom Value' as const },
       { name: `${prefix}_carrier`,    value: '{{order.carrier}}',    type: 'Custom Value' as const },
       { name: `${prefix}_sku`,        value: '{{order.sku}}',        type: 'Custom Value' as const },
+      { name: `${prefix}_bookingLink`, value: '{{order.bookingLink}}', type: 'Custom Value' as const },
       { name: `${prefix}_externalId`, value: '{{order.externalId}}', type: 'Custom Value' as const },
       { name: `${prefix}_id`,         value: '{{order.id}}',         type: 'Custom Value' as const },
       { name: `${prefix}_protocol`,   value: '{{order.protocol}}',   type: 'Custom Value' as const },
@@ -55,6 +56,7 @@ const direct_order_creation_block = async ({ sdk }: { sdk: Session }) => {
       carrier: 'UPS',
       sku: 'SKU-A',
       protocol: 'wl1',
+      bookingLink: 'https://booking.example.com/a-123',
     })
     createdOrderId = order.id
 
@@ -70,6 +72,7 @@ const direct_order_creation_block = async ({ sdk }: { sdk: Session }) => {
         && e.fields?.pharmacy_sku === 'SKU-A'
         && e.fields?.pharmacy_externalId === 'EXT-A-123'
         && e.fields?.pharmacy_protocol === 'wl1'
+        && e.fields?.pharmacy_bookingLink === 'https://booking.example.com/a-123'
         && typeof e.fields?.pharmacy_id === 'string'
         && (e.fields?.pharmacy_id as string).length > 0
         && (e.fields?.pharmacy_id as string) === order.id
@@ -86,6 +89,7 @@ const direct_order_creation_block = async ({ sdk }: { sdk: Session }) => {
       pharmacy_externalId: beforeNonMatch.fields?.pharmacy_externalId,
       pharmacy_id: beforeNonMatch.fields?.pharmacy_id,
       pharmacy_protocol: beforeNonMatch.fields?.pharmacy_protocol,
+      pharmacy_bookingLink: beforeNonMatch.fields?.pharmacy_bookingLink,
     }
 
     const nonMatching = await sdk.api.enduser_orders.createOne({
@@ -114,6 +118,7 @@ const direct_order_creation_block = async ({ sdk }: { sdk: Session }) => {
         && e.fields?.pharmacy_externalId === snapshot.pharmacy_externalId
         && e.fields?.pharmacy_id === snapshot.pharmacy_id
         && e.fields?.pharmacy_protocol === snapshot.pharmacy_protocol
+        && e.fields?.pharmacy_bookingLink === snapshot.pharmacy_bookingLink
       )}
     )
   } finally {
@@ -130,6 +135,8 @@ const beluga_webhook_block = async ({ sdk }: { sdk: Session }) => {
 
   const webhookUrl = `${host}/v1/webhooks/beluga`
   const externalOrderId = `EXT-B-${Date.now()}`
+  const noLinkOrderId = `EXT-B-NOLINK-${Date.now()}`
+  const bookingLink = 'https://booking.example.com/beluga-results'
 
   const enduser = await sdk.api.endusers.createOne({})
   const form = await sdk.api.forms.createOne({ title: 'Order Templates Beluga Form' })
@@ -139,6 +146,16 @@ const beluga_webhook_block = async ({ sdk }: { sdk: Session }) => {
     formTitle: form.title,
   })
 
+  // The no-bookingLink case needs its OWN enduser: a fired trigger is throttled per
+  // (trigger, enduser) for a minute, so a second order for the same enduser would be
+  // silently skipped and the assertion would pass vacuously.
+  const noLinkEnduser = await sdk.api.endusers.createOne({})
+  const noLinkFormResponse = await sdk.api.form_responses.createOne({
+    formId: form.id,
+    enduserId: noLinkEnduser.id,
+    formTitle: form.title,
+  })
+
   const trigger = await sdk.api.automation_triggers.createOne({
     title: TRIGGER_TITLE_BLOCK_B,
     status: 'Active',
@@ -153,6 +170,13 @@ const beluga_webhook_block = async ({ sdk }: { sdk: Session }) => {
     action: buildSetFieldsAction('pharmacy'),
   })
 
+  const resultsTrigger = await sdk.api.automation_triggers.createOne({
+    title: `${TRIGGER_TITLE_BLOCK_B} (Results Available)`,
+    status: 'Active',
+    event: { type: 'Order Status Equals', info: { source: 'Beluga', status: 'Results Available' } },
+    action: buildSetFieldsAction('pharmacy'),
+  })
+
   try {
     // Step 1: PHARMACY_ORDER_SHIPPED
     const shippedRes = await fetch(webhookUrl, {
@@ -179,9 +203,10 @@ const beluga_webhook_block = async ({ sdk }: { sdk: Session }) => {
         && e.fields?.pharmacy_externalId === externalOrderId
         && typeof e.fields?.pharmacy_id === 'string'
         && (e.fields?.pharmacy_id as string).length > 0
-        // Webhook does not set sku/protocol -> default branch in helper -> ''
+        // Webhook does not set sku/protocol/bookingLink -> default branch in helper -> ''
         && e.fields?.pharmacy_sku === ''
         && e.fields?.pharmacy_protocol === ''
+        && e.fields?.pharmacy_bookingLink === ''
       )}
     )
 
@@ -207,24 +232,84 @@ const beluga_webhook_block = async ({ sdk }: { sdk: Session }) => {
         && e.fields?.pharmacy_externalId === externalOrderId
       )}
     )
+
+    // Step 3: LAB_ORDER_RESULTS with a bookingLink -> status 'Results Available'
+    const resultsRes = await fetch(webhookUrl, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        masterId: `tellescope_${formResponse.id}`,
+        event: 'LAB_ORDER_RESULTS',
+        orderId: externalOrderId,
+        bookingLink,
+      }),
+    })
+    assert(resultsRes.status === 200, `Beluga webhook (results) expected 200, got ${resultsRes.status}`)
+
+    await wait(undefined, 250)
+
+    await async_test(
+      "Block B: LAB_ORDER_RESULTS resolves {{order.bookingLink}} into an enduser field",
+      () => sdk.api.endusers.getOne(enduser.id),
+      { onResult: e => !!(
+           e.fields?.pharmacy_status === 'Results Available'
+        && e.fields?.pharmacy_bookingLink === bookingLink
+        && e.fields?.pharmacy_externalId === externalOrderId
+      )}
+    )
+
+    // Step 4: LAB_ORDER_RESULTS for a different enduser/order with NO bookingLink -> resolves to ''
+    const noLinkRes = await fetch(webhookUrl, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        masterId: `tellescope_${noLinkFormResponse.id}`,
+        event: 'LAB_ORDER_RESULTS',
+        orderId: noLinkOrderId,
+      }),
+    })
+    assert(noLinkRes.status === 200, `Beluga webhook (results, no link) expected 200, got ${noLinkRes.status}`)
+
+    await wait(undefined, 250)
+
+    await async_test(
+      "Block B: LAB_ORDER_RESULTS without a bookingLink resolves to ''",
+      () => sdk.api.endusers.getOne(noLinkEnduser.id),
+      { onResult: e => !!(
+           e.fields?.pharmacy_status === 'Results Available' // proves the trigger did fire
+        && e.fields?.pharmacy_externalId === noLinkOrderId
+        && e.fields?.pharmacy_bookingLink === ''
+      )}
+    )
+
+    await async_test(
+      "Block B: the other enduser's bookingLink is untouched by the empty-link order",
+      () => sdk.api.endusers.getOne(enduser.id),
+      { onResult: e => e.fields?.pharmacy_bookingLink === bookingLink }
+    )
   } finally {
     // Clean up the order created by the webhook
-    try {
-      const orders = await sdk.api.enduser_orders.getSome({
-        filter: { source: 'Beluga', externalId: externalOrderId } as any,
-      })
-      for (const o of orders) {
-        await sdk.api.enduser_orders.deleteOne(o.id).catch(console.error)
+    for (const externalId of [externalOrderId, noLinkOrderId]) {
+      try {
+        const orders = await sdk.api.enduser_orders.getSome({
+          filter: { source: 'Beluga', externalId } as any,
+        })
+        for (const o of orders) {
+          await sdk.api.enduser_orders.deleteOne(o.id).catch(console.error)
+        }
+      } catch (err) {
+        console.error(err)
       }
-    } catch (err) {
-      console.error(err)
     }
 
     await sdk.api.automation_triggers.deleteOne(trigger.id).catch(console.error)
     await sdk.api.automation_triggers.deleteOne(deliveredTrigger.id).catch(console.error)
+    await sdk.api.automation_triggers.deleteOne(resultsTrigger.id).catch(console.error)
     await sdk.api.form_responses.deleteOne(formResponse.id).catch(console.error)
+    await sdk.api.form_responses.deleteOne(noLinkFormResponse.id).catch(console.error)
     await sdk.api.forms.deleteOne(form.id).catch(console.error)
     await sdk.api.endusers.deleteOne(enduser.id).catch(console.error)
+    await sdk.api.endusers.deleteOne(noLinkEnduser.id).catch(console.error)
   }
 }