@tellescope/sdk 2.0.0-beta.1 → 2.0.0-beta.3

package/src/tests/api_tests/user_logs_restore_deleted.test.ts

@@ -5,6 +5,7 @@ import {
   assert_checks,
   Check,
   setup_isolated_tenant,
+  IsolatedSuite,
 } from "../setup_isolated"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
@@ -400,6 +401,9 @@ export const user_logs_restore_deleted_tests = async () => {
   assert_checks('user_logs restore_deleted', await user_logs_restore_deleted_checks())
 }
 
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = { name: 'user_logs restore_deleted', run: user_logs_restore_deleted_checks }
+
 // Allow running this test file independently
 if (require.main === module) {
   console.log(`🌐 Using API URL: ${host}`)

package/src/tests/api_tests/user_preferences.test.ts

@@ -0,0 +1,227 @@
+require('source-map-support').install();
+
+import { EnduserSession } from "../../sdk"
+import {
+  assert_checks,
+  Check,
+  setup_isolated_tenant,
+  IsolatedSuite,
+} from "../setup_isolated"
+import { authenticate_enduser_via_token } from "../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
+/** @tellescope/utilities' decodeJWT uses window.atob and returns null under node, which would make
+ *  the deny-list check below fail for the wrong reason. Decode the payload with Buffer instead. */
+const decode_jwt_payload = (jwt: string): Record<string, any> => (
+  JSON.parse(Buffer.from(jwt.split('.')[1], 'base64').toString('utf8'))
+)
+
+/**
+ * Coverage for `User.preferences`, the generic bag for frontend-only per-user settings
+ * (first key: `silenceNotificationPopups`).
+ *
+ * It shares its validator with `User.portalSettings` (`userPreferencesValidator` aliases
+ * `userPortalSettingsValidator`), so the validator bounds are re-asserted here rather than
+ * assumed: the alias is exactly the kind of thing a later edit splits apart.
+ *
+ * The two cases `user_portal_settings.test.ts` cannot supply, and the reason this suite exists:
+ *   - `preferences` carries `redactions: ['enduser']`, so an enduser reading that user must NOT
+ *     see it — the opposite of `portalSettings`, which is deliberately un-redacted. The check
+ *     asserts both on the same record, so "enduser cannot read the user at all" cannot pass it.
+ *   - `preferences` is deny-listed out of the JWT in `login_user`, while still reaching the
+ *     client on the refresh-session payload (that is what lets the webapp toggle take effect
+ *     without a reload).
+ *
+ * It also pins the write shape the webapp uses: `updateOne` WITHOUT `replaceObjectFields`, which
+ * must merge into the bag. Writing with `replaceObjectFields` would drop every other key, and a
+ * second key is coming in T2.
+ *
+ * Provisions its own throwaway tenant so the enduser it authenticates and the user records it
+ * mutates are nobody else's.
+ */
+export const user_preferences_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  // async_test/handleAnyError call process.exit on failure, which would strand the tenant.
+  // Record the outcome instead, mirroring programs.test.ts.
+  const expect_rejected = async (label: string, write: () => Promise<any>) => {
+    try {
+      await write()
+      record(label, false, 'write was accepted, but the validator should have rejected it')
+    } catch (err) {
+      record(label, true, `rejected: ${(err as any)?.message ?? err}`)
+    }
+  }
+
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+
+  try {
+    tenant = await setup_isolated_tenant({
+      name: `UserPreferences ${RAND()}`,
+      users: [{ isAdmin: true }],
+      apiKeys: 0,
+    })
+    const { sdk, businessId } = tenant
+
+    const testUser = await sdk.api.users.createOne({
+      email: `user_preferences_${RAND()}@test.tellescope.com`,
+    })
+
+    /* ===================== validator bounds ===================== */
+
+    await sdk.api.users.updateOne(testUser.id, {
+      preferences: { silenceNotificationPopups: true, theme: 'dark', dismissed: false },
+    })
+    const mixed = (await sdk.api.users.getOne(testUser.id)).preferences
+    record(
+      'A: string and boolean values round-trip as their real types',
+      mixed?.silenceNotificationPopups === true
+      && typeof mixed?.silenceNotificationPopups === 'boolean'
+      && mixed?.dismissed === false
+      && typeof mixed?.dismissed === 'boolean'
+      && mixed?.theme === 'dark'
+      && typeof mixed?.theme === 'string',
+      `preferences=${JSON.stringify(mixed)}`,
+    )
+
+    // The write the webapp makes: one key, no replaceObjectFields, must not clear the rest.
+    await sdk.api.users.updateOne(testUser.id, { preferences: { silenceNotificationPopups: false } })
+    const merged = (await sdk.api.users.getOne(testUser.id)).preferences
+    record(
+      'B: a single-key write without replaceObjectFields merges, leaving other keys intact',
+      merged?.silenceNotificationPopups === false
+      && merged?.theme === 'dark'
+      && merged?.dismissed === false,
+      `preferences=${JSON.stringify(merged)}`,
+    )
+
+    await expect_rejected(
+      'C: a value string over 250 chars is rejected',
+      () => sdk.api.users.updateOne(testUser.id, { preferences: { tooLong: 'a'.repeat(251) } }),
+    )
+    await expect_rejected(
+      'D: a key over 250 chars is rejected',
+      () => sdk.api.users.updateOne(testUser.id, { preferences: { ['a'.repeat(251)]: 'x' } }),
+    )
+    await expect_rejected(
+      'E: a nested object value is rejected',
+      () => sdk.api.users.updateOne(testUser.id, { preferences: { k: { nested: 1 } as any } }),
+    )
+    await expect_rejected(
+      'F: an array value is rejected',
+      () => sdk.api.users.updateOne(testUser.id, { preferences: { k: [1, 2] as any } }),
+    )
+    await expect_rejected(
+      'G: a number value is rejected',
+      () => sdk.api.users.updateOne(testUser.id, { preferences: { k: 1 as any } }),
+    )
+
+    // the bag survived every rejected write
+    const afterRejections = (await sdk.api.users.getOne(testUser.id)).preferences
+    record(
+      'H: no rejected write mutated the stored bag',
+      afterRejections?.theme === 'dark'
+      && afterRejections?.silenceNotificationPopups === false
+      && Object.keys(afterRejections ?? {}).length === 3,
+      `preferences=${JSON.stringify(afterRejections)}`,
+    )
+
+    /* ===================== enduser redaction ===================== */
+
+    // portalSettings is deliberately un-redacted, so reading it on the same record in the same
+    // request proves the enduser CAN see this user, and that preferences is specifically redacted.
+    await sdk.api.users.updateOne(testUser.id, {
+      preferences: { silenceNotificationPopups: true },
+      portalSettings: { showAvatar: true },
+    })
+
+    const enduser = await sdk.api.endusers.createOne({
+      email: `user_preferences_enduser_${RAND()}@test.tellescope.com`,
+    })
+    const enduserSDK = new EnduserSession({ host, businessId })
+    await authenticate_enduser_via_token(sdk, enduserSDK, { id: enduser.id })
+
+    const asEnduser = await enduserSDK.api.users.getOne(testUser.id)
+    record(
+      'I: an enduser reading that user does NOT see preferences, while portalSettings is still visible',
+      asEnduser.preferences === undefined && asEnduser.portalSettings?.showAvatar === true,
+      `preferences=${JSON.stringify(asEnduser.preferences)},`
+      + ` portalSettings=${JSON.stringify(asEnduser.portalSettings)}`,
+    )
+
+    const asEnduserList = (await enduserSDK.api.users.getSome({ filter: { email: testUser.email } }))
+      .filter(u => u.id === testUser.id)
+    record(
+      'J: the same redaction applies on a list read, not only getOne',
+      asEnduserList.length === 1 && asEnduserList[0].preferences === undefined,
+      `records=${JSON.stringify(asEnduserList.map(u => ({ id: u.id, preferences: u.preferences })))}`,
+    )
+
+    // /v1/bulk-actions/read is mounted with noAccessPermissions and takes an includeFields list that
+    // only ADDS to the projection — the least obvious way a new field could reach a patient.
+    const bulk = await (enduserSDK as any).POST(
+      '/v1/bulk-actions/read',
+      { load: [{ model: 'users', options: { includeFields: ['preferences'], filter: { _id: testUser.id } } }] },
+      true,
+    )
+    const bulkUsers: any[] = (bulk?.results?.[0]?.records ?? []).filter((u: any) => u.id === testUser.id)
+    record(
+      'K: the bulk-read route redacts preferences too, even when it is asked for by name',
+      bulkUsers.length === 1 && bulkUsers[0].preferences === undefined,
+      `records=${JSON.stringify(bulkUsers.map(u => ({ id: u.id, preferences: u.preferences })))}`,
+    )
+
+    await enduserSDK.api.endusers.logout().catch(() => {})
+
+    /* ===================== kept out of the JWT ===================== */
+
+    // on the admin's own record, so refresh_session reloads it
+    await sdk.api.users.updateOne(sdk.userInfo.id, { preferences: { silenceNotificationPopups: true } })
+    const { user: refreshed, authToken } = await sdk.refresh_session()
+
+    record(
+      'L: preferences reaches the client on the refresh-session payload (no reload needed)',
+      (refreshed as any)?.preferences?.silenceNotificationPopups === true,
+      `user.preferences=${JSON.stringify((refreshed as any)?.preferences)}`,
+    )
+
+    const decoded = decode_jwt_payload(authToken)
+    record(
+      'M: preferences is deny-listed out of the JWT, so no backend code can read it from the session',
+      // the id/type guard keeps this from passing merely because the payload failed to decode
+      decoded.id === sdk.userInfo.id && decoded.type === 'user' && decoded.preferences === undefined,
+      `jwt keys=${JSON.stringify(Object.keys(decoded).sort())}`,
+    )
+  } finally {
+    // Teardown BEFORE anything asserts — assert calls process.exit, which would strand this tenant.
+    if (tenant) { try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) } }
+  }
+
+  return checks
+}
+
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+export const user_preferences_tests = async () => {
+  assert_checks('User preferences', await user_preferences_checks())
+}
+
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = { name: 'User preferences', run: user_preferences_checks }
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  user_preferences_tests()
+    .then(() => {
+      console.log("✅ User preferences test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ User preferences test suite failed:", error)
+      process.exit(1)
+    })
+}