@tellescope/sdk 2.0.0-beta.1 → 2.0.0-beta.3

package/src/tests/api_tests/stedi_approval.test.ts

@@ -1,94 +1,154 @@
 require('source-map-support').install();
 
-import { Session, EnduserSession } from "../../sdk"
-import {
-  async_test,
-  log_header,
-} from "@tellescope/testing"
+import { EnduserSession } from "../../sdk"
 import { STEDI_TITLE } from "@tellescope/constants"
-import { authenticate_enduser_via_token, setup_tests } from "../setup"
+import {
+  assert_checks,
+  Check,
+  IsolatedSuite,
+  setup_isolated_tenant,
+} from "../setup_isolated"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
 // Stedi runs on Tellescope's own platform credentials (zz_secrets) and each eligibility check costs
 // Tellescope $0.10, so an organization must be approved by a Tellescope super admin
 // (Organization.stediAllowed) before any Stedi call is made on its behalf.
 //
 // Every assertion here is a REJECTION assertion, so nothing in this file ever reaches Stedi.
-export const stedi_approval_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("Stedi Pre-Approval (stediAllowed) Tests")
-
-  const orgId = sdk.userInfo.businessId
-  const businessId = orgId
-
-  // A. Super-admin write gate.
-  //
-  // `isa` is only minted by GET /switch-tenant, so this plainly-authenticated admin session never
-  // has it — even when TEST_EMAIL happens to be in the API's SUPER_ADMINS allowlist.
-  log_header("A. stediAllowed is writable by super admins only")
-
-  await async_test(
-    "org admin cannot enable stediAllowed for their own organization",
-    () => sdk.api.organizations.updateOne(orgId, { stediAllowed: true }),
-    { shouldError: true, onError: (e: { message: string }) => /not allowed/i.test(e.message) }
-  )
+//
+// Runs on its own provisioned tenant: section B's whole premise is "this organization is NOT
+// Stedi-approved", which on the shared fixture is whatever the last developer left in their local
+// database. A freshly provisioned tenant is never approved (the provisioner cannot write
+// stediAllowed — it is not in its organization allowlist), so the skip branch that used to report
+// green without asserting anything is now a FAILING check instead.
+export const stedi_approval_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  /**
+   * The async_test({ shouldError: true, onError }) equivalent, as a soft Check: a call that RESOLVES
+   * is a failure (async_test treats it the same way), and a rejection passes only when onError agrees.
+   */
+  const expect_rejected = async (label: string, fn: () => Promise<any>, onError: (e: any) => boolean) => {
+    let rejection: { e: any }
+    try {
+      const unexpected = await fn()
+      record(
+        label,
+        false,
+        `resolved instead of rejecting; result=${unexpected === undefined ? '(none)' : JSON.stringify(unexpected)}`,
+      )
+      return
+    } catch (e: any) {
+      rejection = { e }
+    }
+
+    // Outside the catch on purpose: a predicate that throws here would otherwise escape the suite
+    // and, per run_isolated_in_parallel, abort every remaining batch instead of failing one check.
+    // The raw value decides the fallback, not JSON.stringify of it — JSON.stringify('') is '""',
+    // which is truthy, so a `|| fallback` on the stringified form can never fire.
+    const { e } = rejection
+    const message = typeof e?.message === 'string' && e.message !== ''
+      ? e.message
+      : (e === undefined || e === null ? String(e) : JSON.stringify(e))
+    record(label, onError(e), `rejected with ${message}`)
+  }
 
-  // Regression test for the truthiness hole in the shared super-admin relationship constraint:
-  // it used to test `options.updates?.stediAllowed` (falsy for `false`), so an org admin could
-  // clear super-admin-owned flags even though they could never set them.
-  await async_test(
-    "org admin cannot disable stediAllowed either (guard is key-presence, not truthiness)",
-    () => sdk.api.organizations.updateOne(orgId, { stediAllowed: false }),
-    { shouldError: true, onError: (e: { message: string }) => /not allowed/i.test(e.message) }
+  const rejectedAsNotAllowed = (e: any) => /not allowed/i.test(typeof e?.message === 'string' ? e.message : '')
+  const rejectedAsNotEnabled = (e: any) => (
+    /not enabled for this organization/i.test(typeof e?.message === 'string' ? e.message : '')
   )
 
-  // Same bug, pre-existing field — proves the fix wasn't scoped to the new flag only.
-  await async_test(
-    "org admin cannot disable bedrockAIAllowed",
-    () => sdk.api.organizations.updateOne(orgId, { bedrockAIAllowed: false }),
-    { shouldError: true, onError: (e: { message: string }) => /not allowed/i.test(e.message) }
-  )
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+  let enduserId: string | undefined
 
-  // ...and that it covers the whole gated list, not just the two booleans.
-  await async_test(
-    "org admin cannot disable allowCreateSuborganizations",
-    () => sdk.api.organizations.updateOne(orgId, { allowCreateSuborganizations: false }),
-    { shouldError: true, onError: (e: { message: string }) => /not allowed/i.test(e.message) }
-  )
+  try {
+    tenant = await setup_isolated_tenant({
+      name: `Stedi approval gate ${RAND()}`,
+      users: [{ isAdmin: true }],
+      apiKeys: 0,
+    })
+    const { sdk } = tenant
+    const orgId = tenant.businessId
+
+    // A. Super-admin write gate.
+    //
+    // `isa` is only minted by GET /switch-tenant, so this plainly-authenticated admin session never
+    // has it — and a provisioned tenant's throwaway admin is in no SUPER_ADMINS allowlist either.
+    //
+    // The four updates are deliberately DISTINCT (id, updates) pairs: identical ones throttle at
+    // 3 per 30s and the fourth would be rejected by the throttle rather than by the guard.
+
+    await expect_rejected(
+      "org admin cannot enable stediAllowed for their own organization",
+      () => sdk.api.organizations.updateOne(orgId, { stediAllowed: true }),
+      rejectedAsNotAllowed,
+    )
 
-  // B. An unapproved organization is rejected at every Stedi entry point.
-  log_header("B. Unapproved organizations cannot reach Stedi")
+    // Regression test for the truthiness hole in the shared super-admin relationship constraint:
+    // it used to test `options.updates?.stediAllowed` (falsy for `false`), so an org admin could
+    // clear super-admin-owned flags even though they could never set them.
+    await expect_rejected(
+      "org admin cannot disable stediAllowed either (guard is key-presence, not truthiness)",
+      () => sdk.api.organizations.updateOne(orgId, { stediAllowed: false }),
+      rejectedAsNotAllowed,
+    )
 
-  const organization = await sdk.api.organizations.getOne(orgId)
-  if (organization.stediAllowed) {
-    console.log(
-      "⚠️  SKIPPING section B: the test organization already has stediAllowed=true "
-      + "(hand-toggled in this dev database). Turn it off in the super admin console and re-run — "
-      + "these assertions would otherwise report a false pass."
+    // Same bug, pre-existing field — proves the fix wasn't scoped to the new flag only.
+    await expect_rejected(
+      "org admin cannot disable bedrockAIAllowed",
+      () => sdk.api.organizations.updateOne(orgId, { bedrockAIAllowed: false }),
+      rejectedAsNotAllowed,
     )
-    return
-  }
 
-  const enduser = await sdk.api.endusers.createOne({
-    email: `stedi-approval-${Date.now()}@test.tellescope.com`,
-    fname: 'Stedi',
-    lname: 'Approval',
-  })
+    // ...and that it covers the whole gated list, not just the two booleans.
+    await expect_rejected(
+      "org admin cannot disable allowCreateSuborganizations",
+      () => sdk.api.organizations.updateOne(orgId, { allowCreateSuborganizations: false }),
+      rejectedAsNotAllowed,
+    )
 
-  try {
-    await async_test(
+    // B. An unapproved organization is rejected at every Stedi entry point.
+
+    const organization = await sdk.api.organizations.getOne(orgId)
+    if (organization.stediAllowed) {
+      // Previously a console warning and an early return, which reported green without asserting
+      // anything. On a tenant this suite provisioned seconds ago it is a real defect — the
+      // provisioner has started granting a super-admin-only flag — so it fails loudly and the
+      // section-B checks below are NOT run (they would all pass for the wrong reason).
+      record(
+        'the freshly provisioned organization is not Stedi-approved',
+        false,
+        'stediAllowed=true on a tenant this suite just provisioned, so the five Stedi entry-point '
+        + 'rejections below would report a false pass and were skipped. Nothing in the provisioning '
+        + 'path may set stediAllowed — it is a Tellescope super-admin flag.',
+      )
+      return checks
+    }
+
+    const enduser = await sdk.api.endusers.createOne({
+      email: `stedi-approval-${Date.now()}@test.tellescope.com`,
+      fname: 'Stedi',
+      lname: 'Approval',
+    })
+    enduserId = enduser.id
+
+    await expect_rejected(
       "staff: Stedi payer search (proxy_read) is rejected",
       () => sdk.api.integrations.proxy_read({ integration: STEDI_TITLE, type: 'payers', query: 'aetna' }),
-      { shouldError: true, onError: (e: { message: string }) => /not enabled for this organization/i.test(e.message) }
+      rejectedAsNotEnabled,
     )
 
-    await async_test(
+    await expect_rejected(
       "staff: Stedi payer importer (load_payers) is rejected",
       () => sdk.api.integrations.load_payers({ integration: STEDI_TITLE, query: 'aetna' }),
-      { shouldError: true, onError: (e: { message: string }) => /not enabled for this organization/i.test(e.message) }
+      rejectedAsNotEnabled,
     )
 
-    await async_test(
+    await expect_rejected(
       "staff: Stedi eligibility check is rejected on approval, before the credit checks",
       () => sdk.api.integrations.proxy_read({
         integration: STEDI_TITLE,
@@ -96,66 +156,72 @@ export const stedi_approval_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session
         id: enduser.id,
         query: JSON.stringify({ serviceCode: '30', npi: '1234567890' }),
       }),
-      {
-        shouldError: true,
-        // The absence of /credit/ is the real assertion: it proves the approval gate fires ahead of
-        // the credit gate, so an unapproved org is never told to go buy credits.
-        onError: (e: { message: string }) => (
-          /not enabled for this organization/i.test(e.message) && !/credit/i.test(e.message)
-        ),
-      }
+      // The absence of /credit/ is the real assertion: it proves the approval gate fires ahead of
+      // the credit gate, so an unapproved org is never told to go buy credits.
+      (e: any) => rejectedAsNotEnabled(e) && !/credit/i.test(typeof e?.message === 'string' ? e.message : ''),
     )
 
     // Enduser sessions reach both branches for real: StediEligibilityInput auto-runs the check, and
     // InsuranceInput search-on-types against the payer branch. Approval/billing state must not leak
     // to patients.
-    const enduserSdk = new EnduserSession({ host, businessId })
-    await authenticate_enduser_via_token(sdk, enduserSdk, { id: enduser.id })
+    //
+    // The session is minted from endusers.generate_auth_token rather than imported from setup.ts
+    // (this suite shares nothing with the hand-seeded fixture) and rather than a password login
+    // (/login-enduser throttles 20/min per IP, and the pool runs 8 suites from one IP).
+    const { authToken, enduser: enduserInfo } = await sdk.api.endusers.generate_auth_token({ id: enduser.id })
+    const enduserSdk = new EnduserSession({ host, authToken, enduser: enduserInfo, businessId: tenant.businessId })
 
     // Exact-match on the generic copy: no "Stedi", no "credits", no "contact sales", no mention that
     // approval is the reason. Note this is deliberately the SAME string the enduser-facing credit
     // rejection uses, so it cannot prove which gate fired — the staff assertion above is what pins
     // down the approval-before-credits ordering.
-    const messageIsGenericForEnduser = (e: { message: string }) => (
-      e.message === 'Eligibility check is currently unavailable'
-    )
+    const messageIsGenericForEnduser = (e: any) => e?.message === 'Eligibility check is currently unavailable'
 
-    await async_test(
+    await expect_rejected(
       "enduser: eligibility check rejected with a generic message (no approval/billing leak)",
       () => enduserSdk.api.integrations.proxy_read({
         integration: STEDI_TITLE,
         type: 'stedi-eligibility',
         query: JSON.stringify({ serviceCode: '30', npi: '1234567890' }),
       }),
-      { shouldError: true, onError: messageIsGenericForEnduser }
+      messageIsGenericForEnduser,
     )
 
-    await async_test(
+    await expect_rejected(
       "enduser: payer search rejected with a generic message (no approval/billing leak)",
       () => enduserSdk.api.integrations.proxy_read({
         integration: STEDI_TITLE,
         type: 'payers',
         query: 'aetna',
       }),
-      { shouldError: true, onError: messageIsGenericForEnduser }
+      messageIsGenericForEnduser,
     )
   } finally {
-    await sdk.api.endusers.deleteOne(enduser.id).catch(console.error)
+    if (tenant) {
+      if (enduserId) await tenant.sdk.api.endusers.deleteOne(enduserId).catch(console.error)
+      // Teardown BEFORE anything asserts — assert calls process.exit, which would strand this tenant.
+      try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) }
+    }
   }
+
+  return checks
+}
+
+/** Asserting wrapper, for standalone runs. */
+export const stedi_approval_tests = async () => {
+  assert_checks('Stedi approval gate', await stedi_approval_checks())
+}
+
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = {
+  name: 'Stedi approval gate',
+  run: stedi_approval_checks,
 }
 
 // Allow running this test file independently
 if (require.main === module) {
   console.log(`Using API URL: ${host}`)
-  const sdk = new Session({ host })
-  const sdkNonAdmin = new Session({ host })
-
-  const runTests = async () => {
-    await setup_tests(sdk, sdkNonAdmin)
-    await stedi_approval_tests({ sdk, sdkNonAdmin })
-  }
-
-  runTests()
+  stedi_approval_tests()
     .then(() => {
       console.log("✅ Stedi pre-approval tests completed successfully")
       process.exit(0)

package/src/tests/api_tests/stripe_checkout_items.test.ts

@@ -0,0 +1,186 @@
+require('source-map-support').install();
+
+import {
+  assert_checks,
+  Check,
+  setup_isolated_tenant,
+  IsolatedSuite,
+} from "../setup_isolated"
+import { authenticate_enduser_via_token } from "../setup"
+import { EnduserSession } from "../../sdk"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
+const ENDUSER_RAW_IDS_MESSAGE = "stripePriceId and subscriptionPriceId are not supported for enduser sessions"
+const QUANTITY_MESSAGE = "quantity must be a whole number of at least 1"
+const EXACTLY_ONE_ID_MESSAGE = "Each items entry must specify exactly one of productId, stripePriceId, or subscriptionPriceId"
+// what the handler throws once a request is past every items guard and no Stripe account is
+// configured - the marker for "this cart was accepted, it only ran out of Stripe"
+const NO_STRIPE_MESSAGE = "Stripe Connection not found"
+
+/**
+ * The guards on the `items` parameter of products/prepare-stripe-checkout that run BEFORE any Stripe
+ * integration is resolved, so they are reachable without a Stripe account: the enduser rejection of
+ * raw Stripe price ids, the productIds/items exclusivity, the per-entry shape rules and the quantity
+ * validator.
+ *
+ * The quantity guards themselves (the cap of 99, the two "greater than 1" rejections) sit on the
+ * Stripe Custom branch and are pinned instead by the unit suite in
+ * packages/private/api/api/integrations/payments/stripe_line_items.test.ts, which needs no database
+ * and no Stripe account. Anything that creates or inspects a real Checkout session is manual QA.
+ */
+export const stripe_checkout_items_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+
+  try {
+    tenant = await setup_isolated_tenant({
+      name: `stripe items ${RAND()}`,
+      users: [{ isAdmin: true }],
+      apiKeys: 0,
+    })
+    const { sdk, businessId } = tenant
+
+    const product = await sdk.api.products.createOne({
+      title: `Checkout Item Product ${RAND()}`,
+      cost: { amount: 500, currency: 'USD' },
+      processor: 'Stripe',
+    })
+
+    const enduser = await sdk.api.endusers.createOne({ email: `items_${RAND()}@test.tellescope.com` })
+    const enduserSDK = new EnduserSession({ host, businessId })
+    await authenticate_enduser_via_token(sdk, enduserSDK, { id: enduser.id })
+
+    // returns the error message for a rejected request, or '' when the request succeeded
+    const errorFor = async (session: typeof sdk | typeof enduserSDK, args: any): Promise<string> => {
+      try {
+        await (session.api.products.prepare_stripe_checkout as any)(args)
+        return ''
+      } catch (err: any) {
+        return typeof err === 'string' ? err : (err?.message ?? JSON.stringify(err))
+      }
+    }
+
+    // ---- raw Stripe price ids are staff / API-key only ----
+    const enduserRawPrice = await errorFor(enduserSDK, { items: [{ stripePriceId: 'price_raw', quantity: 1 }] })
+    record(
+      'an enduser naming a raw stripePriceId is rejected',
+      enduserRawPrice === ENDUSER_RAW_IDS_MESSAGE,
+      `expected "${ENDUSER_RAW_IDS_MESSAGE}", got "${enduserRawPrice}"`,
+    )
+
+    const enduserRawSubscription = await errorFor(enduserSDK, { items: [{ subscriptionPriceId: 'price_sub', quantity: 1 }] })
+    record(
+      'an enduser naming a raw subscriptionPriceId is rejected',
+      enduserRawSubscription === ENDUSER_RAW_IDS_MESSAGE,
+      `expected "${ENDUSER_RAW_IDS_MESSAGE}", got "${enduserRawSubscription}"`,
+    )
+
+    // the rejection is about raw Stripe ids, not about items: a patient can still buy a Tellescope
+    // product at a quantity, and only runs out of road at the missing Stripe account
+    const enduserProduct = await errorFor(enduserSDK, { items: [{ productId: product.id, quantity: 2 }] })
+    record(
+      'an enduser naming a Tellescope productId is allowed through the guard',
+      enduserProduct === NO_STRIPE_MESSAGE,
+      `expected "${NO_STRIPE_MESSAGE}", got "${enduserProduct}"`,
+    )
+
+    // the same raw price from a staff session passes the guard
+    const userRawPrice = await errorFor(sdk, { items: [{ stripePriceId: 'price_raw', quantity: 1 }] })
+    record(
+      'a user session naming a raw stripePriceId is allowed through the guard',
+      userRawPrice === NO_STRIPE_MESSAGE,
+      `expected "${NO_STRIPE_MESSAGE}", got "${userRawPrice}"`,
+    )
+
+    // ---- productIds and items are mutually exclusive ----
+    const both = await errorFor(sdk, { productIds: [product.id], items: [{ productId: product.id, quantity: 1 }] })
+    record(
+      'passing both productIds and items is rejected',
+      both === "Pass either productIds or items, not both",
+      `expected the "not both" message, got "${both}"`,
+    )
+
+    const neither = await errorFor(sdk, {})
+    record(
+      'passing neither productIds nor items is rejected',
+      neither === "One of productIds or items is required",
+      `expected the "one of" message, got "${neither}"`,
+    )
+
+    // ---- per-entry shape ----
+    const noId = await errorFor(sdk, { items: [{ quantity: 1 }] })
+    record(
+      'an items entry naming no id is rejected',
+      noId === EXACTLY_ONE_ID_MESSAGE,
+      `expected the "exactly one" message, got "${noId}"`,
+    )
+
+    const twoIds = await errorFor(sdk, { items: [{ productId: product.id, stripePriceId: 'price_raw', quantity: 1 }] })
+    record(
+      'an items entry naming two ids is rejected',
+      twoIds === EXACTLY_ONE_ID_MESSAGE,
+      `expected the "exactly one" message, got "${twoIds}"`,
+    )
+
+    // unlike productIds, which silently drops ids it cannot find, items rejects the whole cart
+    const unknownId = '60398b0231a295e64f084fd9'
+    const unknown = await errorFor(sdk, { items: [{ productId: unknownId, quantity: 1 }] })
+    record(
+      'an items entry naming an unknown productId is rejected, naming the id',
+      unknown.includes(unknownId) && unknown.includes('No product found'),
+      `expected a "No product found for productId ${unknownId}", got "${unknown}"`,
+    )
+
+    // ---- quantity must be a whole number of at least 1 ----
+    // quantity: 0 is the one that nearly got away: build_validator returns 0 early for any isNumber
+    // field, so the schema validator cannot reject it and the guard in resolve_checkout_items is
+    // the only thing between a zero quantity and a Stripe line item
+    for (const quantity of [0, -1, 1.5]) {
+      const message = await errorFor(sdk, { items: [{ productId: product.id, quantity }] })
+      record(
+        `quantity ${quantity} is rejected`,
+        message.includes(QUANTITY_MESSAGE),
+        `expected a message containing "${QUANTITY_MESSAGE}", got "${message}"`,
+      )
+    }
+
+    // a productIds-only request still reaches the Stripe lookup exactly as before
+    const productIdsOnly = await errorFor(sdk, { productIds: [product.id] })
+    record(
+      'a productIds-only request is unaffected',
+      productIdsOnly === NO_STRIPE_MESSAGE,
+      `expected "${NO_STRIPE_MESSAGE}", got "${productIdsOnly}"`,
+    )
+  } finally {
+    // teardown before anything asserts — assert calls process.exit, which skips pending finallys
+    if (tenant) { try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) } }
+  }
+
+  return checks
+}
+
+export const stripe_checkout_items_tests = async () => {
+  assert_checks('prepare_stripe_checkout items guards', await stripe_checkout_items_checks())
+}
+
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = { name: 'prepare_stripe_checkout items guards', run: stripe_checkout_items_checks }
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  stripe_checkout_items_tests()
+    .then(() => {
+      console.log("✅ stripe_checkout_items test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ stripe_checkout_items test suite failed:", error)
+      process.exit(1)
+    })
+}