@tellescope/sdk 2.0.0-beta.1 → 2.0.0-beta.3

package/src/tests/api_tests/vitl_push.test.ts

@@ -0,0 +1,323 @@
+require('source-map-support').install();
+
+import axios from "axios"
+
+import {
+  assert_checks,
+  Check,
+  setup_isolated_tenant,
+  IsolatedSuite,
+} from "../setup_isolated"
+import { VITL_TITLE } from "@tellescope/constants"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+/**
+ * VITL eRx patient push — endpoint-level coverage (CU-86e3cua4p).
+ *
+ * Everything here is verifiable WITHOUT reaching the real vendor, which matters because the payload is
+ * patient PHI and the only endpoint we have is a live tenant webhook. The connected case points at a
+ * host in the reserved `.invalid` TLD, so DNS never resolves and no data leaves the machine — but the
+ * request is attempted, which is exactly what makes the failure path assertable.
+ *
+ * What this locks:
+ *   A. an org that has NOT connected VITL cannot push at all, and writes no integration_logs row (the
+ *      PHI-egress gate — QA step 12)
+ *   B. a patient missing a required field fails PRE-FLIGHT: the error names the field AND no
+ *      integration_logs row is written, proving no request was sent (QA step 9)
+ *   C. a complete patient produces an Error row whose stored payload has dateOfBirth in YYYY-MM-DD,
+ *      uid == the enduser id, no gender key for an unmappable gender, and no trace of the shared
+ *      secret anywhere in the row (QA steps 5, 6, 8, 10)
+ *   D. a failed push writes nothing to the enduser — no lastVITLSyncAt, no VITL reference (QA step 10)
+ *   E. the pushVITLPatient journey action reaches the same code path (QA step 11) — the automation step
+ *      round-trips through validation, and automated_actions.process runs the VITL branch rather than
+ *      falling through to `unimplemented`
+ *
+ * The 2xx path (QA steps 4 and 7) needs real VITL credentials and stays manual.
+ */
+
+// Reserved TLD (RFC 2606): guaranteed never to resolve, so the push fails at connect time.
+const UNREACHABLE_WEBHOOK_URL = 'https://vitl-push-test.invalid/api/webhooks/test'
+const SHARED_SECRET = 'vitl-shared-secret-must-never-be-logged'
+
+export const vitl_push_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  let provisioned: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+
+  const push = async (enduserId: string) => {
+    try {
+      const result = await provisioned!.sdk.api.endusers.push({ enduserId, destinations: [VITL_TITLE] })
+      return { ok: true, message: JSON.stringify(result) }
+    } catch (err: any) {
+      return { ok: false, message: err?.message || err?.toString() || '' }
+    }
+  }
+
+  const vitlLogs = async () => (
+    (await provisioned!.sdk.api.integration_logs.getSome({ filter: { integration: VITL_TITLE } as any })) ?? []
+  )
+
+  try {
+    provisioned = await setup_isolated_tenant()
+    const { sdk } = provisioned
+
+    const completeEnduser = await sdk.api.endusers.createOne({
+      fname: 'Vitl', lname: 'Push',
+      email: `vitl_push_${Date.now()}@test.tellescope.com`,
+      phone: '+15555550123',
+      dateOfBirth: '12-10-1815',
+      gender: 'Other', // deliberately unmappable — must be omitted rather than forwarded
+      addressLineOne: '1 Analytical Way',
+      city: 'London', state: 'NY',
+      zipCode: '10001-6789', // stored with a +4; only the 5 digits may reach VITL
+    })
+
+    /* ===== A: no VITL connection => no push, no PHI egress ===== */
+
+    const beforeConnect = await push(completeEnduser.id)
+    record(
+      'A1: push is rejected when the org has not connected VITL',
+      !beforeConnect.ok && /not connected/i.test(beforeConnect.message),
+      `ok=${beforeConnect.ok} message=${beforeConnect.message}`,
+    )
+    record(
+      'A2: no integration_logs row is written when VITL is not connected',
+      (await vitlLogs()).length === 0,
+      `rows=${(await vitlLogs()).length}`,
+    )
+
+    /* ===== connect VITL (URL is unreachable by construction) ===== */
+
+    const connectResponse = await sdk.api.integrations.add_api_key_integration({
+      integration: VITL_TITLE,
+      API_KEY: SHARED_SECRET,
+      environment: UNREACHABLE_WEBHOOK_URL,
+    })
+
+    // The connect response is not redacted by the generic read path — insertOne returns the inserted
+    // document verbatim, so the VITL branch runs it through redactIntegration explicitly. Asserted on the whole serialized body, not on a named field.
+    record(
+      'A0: the connect response does not echo the shared secret back to the client',
+      !JSON.stringify(connectResponse ?? {}).includes(SHARED_SECRET),
+      `response=${JSON.stringify(connectResponse)}`,
+    )
+
+    const org = await sdk.api.organizations.getOne(provisioned.businessId)
+    record(
+      'A3: connecting VITL sets hasConnectedVITL on the organization',
+      !!(org as any).hasConnectedVITL,
+      `hasConnectedVITL=${(org as any).hasConnectedVITL}`,
+    )
+
+    // The secret must not be readable back through the integrations model.
+    const redacted = await sdk.api.integrations.load_redacted({})
+    const vitlRedacted = redacted.integrations.find((i: any) => i.title === VITL_TITLE)
+    record(
+      'A4: the shared secret is not returned by load_redacted',
+      !!vitlRedacted && !JSON.stringify(vitlRedacted).includes(SHARED_SECRET),
+      `integration=${JSON.stringify(vitlRedacted)}`,
+    )
+    record(
+      'A5: the webhook URL is stored and readable (it is configuration, not a credential)',
+      vitlRedacted?.environment === UNREACHABLE_WEBHOOK_URL,
+      `environment=${vitlRedacted?.environment}`,
+    )
+
+    /* ===== B: pre-flight failure sends no request ===== */
+
+    const incompleteEnduser = await sdk.api.endusers.createOne({
+      fname: 'Vitl', lname: 'Incomplete',
+      email: `vitl_incomplete_${Date.now()}@test.tellescope.com`,
+      phone: '+15555550124',
+      dateOfBirth: '12-10-1815',
+      addressLineOne: '1 Analytical Way',
+      // city deliberately omitted
+      state: 'NY', zipCode: '10001',
+    })
+
+    const incompleteResult = await push(incompleteEnduser.id)
+    record(
+      'B1: a patient missing a required field fails with a message naming that field',
+      !incompleteResult.ok && incompleteResult.message.includes('City'),
+      `ok=${incompleteResult.ok} message=${incompleteResult.message}`,
+    )
+    record(
+      'B2: a pre-flight failure writes NO integration_logs row (no request was sent)',
+      (await vitlLogs()).length === 0,
+      `rows=${(await vitlLogs()).length} (expected 0)`,
+    )
+
+    // VITL also rejects the whole request on an unusable zip. (The matching email-shape check is
+    // asserted in the unit tests instead: endusers.email is validated by our own schema on both create
+    // and update, so a malformed address cannot be stored through the API to push in the first place.)
+    const badZipEnduser = await sdk.api.endusers.createOne({
+      fname: 'Vitl', lname: 'BadZip',
+      email: `vitl_bad_zip_${Date.now()}@test.tellescope.com`,
+      phone: '+15555550126', dateOfBirth: '12-10-1815',
+      addressLineOne: '1 Analytical Way', city: 'London', state: 'NY',
+      zipCode: 'NW1 6XE', // no 5-digit zip is derivable
+    })
+    const badZipResult = await push(badZipEnduser.id)
+    record(
+      'B3: a zip with no 5 digits fails pre-flight with a message naming ZIP',
+      !badZipResult.ok && /zip/i.test(badZipResult.message),
+      `ok=${badZipResult.ok} message=${badZipResult.message}`,
+    )
+
+    record(
+      'B4: none of the pre-flight failures sent a request',
+      (await vitlLogs()).length === 0,
+      `rows=${(await vitlLogs()).length} (expected 0)`,
+    )
+
+    /* ===== C: a real attempt is logged, correctly and without the secret ===== */
+
+    const completeResult = await push(completeEnduser.id)
+    record(
+      'C1: an unreachable webhook reports a transport failure, not a bogus field rejection',
+      !completeResult.ok && /could not reach vitl/i.test(completeResult.message),
+      `ok=${completeResult.ok} message=${completeResult.message}`,
+    )
+
+    const logs = await vitlLogs()
+    const log: any = logs[0]
+    record(
+      'C2: exactly one integration_logs row is written for the attempt',
+      logs.length === 1,
+      `rows=${logs.length}`,
+    )
+    record(
+      'C3: the row is integration=VITL, type=Create Patient, status=Error, with the enduserId',
+      !!log && log.integration === VITL_TITLE && log.type === 'Create Patient'
+        && log.status === 'Error' && log.enduserId === completeEnduser.id,
+      `row=${JSON.stringify({ integration: log?.integration, type: log?.type, status: log?.status, enduserId: log?.enduserId })}`,
+    )
+    record(
+      'C4: the logged url is the configured webhook URL',
+      log?.url === UNREACHABLE_WEBHOOK_URL,
+      `url=${log?.url}`,
+    )
+
+    let payload: any = undefined
+    try { payload = JSON.parse(log?.payload ?? '{}') } catch {}
+    record(
+      'C5: the logged payload has dateOfBirth in YYYY-MM-DD, not our stored MM-DD-YYYY',
+      payload?.dateOfBirth === '1815-12-10',
+      `dateOfBirth=${payload?.dateOfBirth} (stored value is 12-10-1815)`,
+    )
+    record(
+      'C6: the logged payload uid is the Tellescope enduser id',
+      payload?.uid === completeEnduser.id,
+      `uid=${payload?.uid} enduserId=${completeEnduser.id}`,
+    )
+    record(
+      'C6b: a stored ZIP+4 is narrowed to the 5-digit zipcode',
+      payload?.zipcode === '10001',
+      `zipcode=${payload?.zipcode} (stored zipCode is 10001-6789)`,
+    )
+    record(
+      'C7: an unmappable gender is omitted from the payload, not forwarded',
+      !!payload && !('gender' in payload),
+      `gender=${JSON.stringify(payload?.gender)} (enduser gender is 'Other')`,
+    )
+    record(
+      'C8: the x-vitl-secret value appears NOWHERE in the integration_logs row',
+      !JSON.stringify(log ?? {}).includes(SHARED_SECRET),
+      'searched the whole serialized row for the shared secret',
+    )
+
+    /* ===== D: a failed push leaves the enduser untouched ===== */
+
+    const afterFailure: any = await sdk.api.endusers.getOne(completeEnduser.id)
+    record(
+      'D1: a failed push does not set lastVITLSyncAt',
+      !afterFailure.lastVITLSyncAt,
+      `lastVITLSyncAt=${afterFailure.lastVITLSyncAt}`,
+    )
+    record(
+      'D2: a failed push does not add a VITL reference to the enduser',
+      !afterFailure.references?.find((r: any) => r.type === VITL_TITLE),
+      `references=${JSON.stringify(afterFailure.references ?? [])}`,
+    )
+
+    /* ===== E: the journey action reaches the same code path ===== */
+
+    const journey = await sdk.api.journeys.createOne({ title: 'VITL push journey' })
+    const step = await sdk.api.automation_steps.createOne({
+      journeyId: journey.id,
+      events: [{ type: 'onJourneyStart', info: {} }],
+      action: { type: 'pushVITLPatient', info: {} },
+    })
+    record(
+      'E1: a pushVITLPatient automation step round-trips through validation',
+      step.action.type === 'pushVITLPatient',
+      `action=${JSON.stringify(step.action)}`,
+    )
+
+    // processAfter is an hour out so the live worker cannot claim the row before the explicit call.
+    const automatedAction = await sdk.api.automated_actions.createOne({
+      enduserId: completeEnduser.id,
+      journeyId: journey.id,
+      automationStepId: step.id,
+      event: { type: 'onJourneyStart', info: {} },
+      action: { type: 'pushVITLPatient', info: {} },
+      status: 'active',
+      processAfter: Date.now() + 60 * 60 * 1000,
+    } as any)
+
+    const adminToken = (await sdk.api.users.generate_auth_token({ id: sdk.userInfo.id })).authToken
+    const processed = await axios.request({
+      method: 'post',
+      url: `${host}/v1/automated-actions/process`,
+      data: { automatedActionId: automatedAction.id },
+      headers: { Authorization: `Bearer ${adminToken}` },
+      validateStatus: () => true,
+    })
+
+    // `unimplemented` would mean the action type never reached a branch — i.e. the journey action is
+    // declared but not wired. It must instead fail the same way the manual push does.
+    record(
+      'E2: process runs the VITL branch (not unimplemented) and reports the vendor failure',
+      processed.status === 200
+        && processed.data?.unimplemented !== true
+        && processed.data?.success === false
+        && /VITL/i.test(processed.data?.error ?? ''),
+      `status=${processed.status} body=${JSON.stringify(processed.data)}`,
+    )
+
+    record(
+      'E3: the journey action produced a second integration_logs row, same as the manual push',
+      (await vitlLogs()).length === 2,
+      `rows=${(await vitlLogs()).length} (expected 2)`,
+    )
+
+  } finally {
+    if (provisioned) { try { await provisioned.teardown() } catch (e) { console.error('teardown failed', e) } }
+  }
+
+  return checks
+}
+
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+export const vitl_push_tests = async () => {
+  assert_checks('VITL patient push', await vitl_push_checks())
+}
+
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = { name: 'VITL patient push', run: vitl_push_checks }
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  vitl_push_tests()
+    .then(() => {
+      console.log("✅ VITL patient push test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ VITL patient push test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/webhook_error_handling.test.ts

@@ -6,16 +6,18 @@ import crypto from "crypto"
 import http from "http"
 
 import { Session } from "../../sdk"
+import { wait } from "@tellescope/testing"
 import {
-  assert,
-  async_test,
-  log_header,
-  wait,
-} from "@tellescope/testing"
-import { setup_tests } from "../setup"
+  assert_checks,
+  Check,
+  IsolatedSuite,
+  setup_isolated_tenant,
+} from "../setup_isolated"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
 const TEST_SECRET = "this is a test secret for verifying integrity of web hooks"
 const sha256 = (s: string) => crypto.createHash('sha256').update(s).digest('hex')
 
@@ -53,9 +55,20 @@ const wait_for_failure_count = async (sdk: Session, expected: number) => {
   return count
 }
 
-// Main test function that can be called independently
-export const webhook_error_handling_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("Webhook Error Handling Tests")
+/**
+ * Webhook delivery error handling: what is written to webhook_logs, and how the webhook config's
+ * deliveryFailureCount moves, for an unresolvable host, an HTTP 400, an HTTP 500 and a success.
+ *
+ * Provisions its own throwaway tenant: both observables are org-wide singletons. There is one
+ * webhook configuration per organization, so configuring one on the shared fixture overwrote
+ * whatever was there and left the row behind, and deliveryFailureCount is a counter on that single
+ * row that any concurrent suite's failed delivery also increments. webhook_logs is likewise read
+ * business-wide (the log is found by URL among the 50 most recent), so another suite's traffic can
+ * push the log under test out of the window.
+ */
+export const webhook_error_handling_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
 
   // local receiver: error paths for failure scenarios, a healthy path that verifies integrity
   const app = express()
@@ -77,17 +90,27 @@ export const webhook_error_handling_tests = async ({ sdk, sdkNonAdmin } : { sdk:
   })
   const receiverBase = `http://127.0.0.1:${(server.address() as any).port}`
 
-  const enduserIds: string[] = []
-  const trigger_delivery = async (label: string) => {
-    const enduser = await sdk.api.endusers.createOne({ email: `webhook-error-${label}-${Date.now()}@tellescope.com` })
-    enduserIds.push(enduser.id)
-  }
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
 
   try {
-    await async_test(
+    tenant = await setup_isolated_tenant({
+      name: `Webhook error handling ${RAND()}`,
+      users: [{ isAdmin: true }],
+      apiKeys: 0,
+    })
+    const { sdk } = tenant
+
+    const trigger_delivery = async (label: string) => {
+      await sdk.api.endusers.createOne({ email: `webhook-error-${label}-${Date.now()}@tellescope.com` })
+    }
+
+    const configureError = await sdk.api.webhooks.configure({ url: ENOTFOUND_URL, secret: TEST_SECRET })
+      .then(() => null)
+      .catch((e: any) => e)
+    record(
       'configure webhook',
-      () => sdk.api.webhooks.configure({ url: ENOTFOUND_URL, secret: TEST_SECRET }),
-      { shouldError: false, onResult: () => true },
+      configureError === null,
+      configureError === null ? 'configure resolved' : `configure threw: ${configureError?.message ?? String(configureError)}`,
     )
     await sdk.api.webhooks.update({ subscriptionUpdates: { endusers: { create: true, update: false, delete: false } } })
 
@@ -96,39 +119,58 @@ export const webhook_error_handling_tests = async ({ sdk, sdkNonAdmin } : { sdk:
     // Scenario 1: ENOTFOUND — no HTTP response at all
     await trigger_delivery('enotfound')
     const enotfoundLog = await find_log_for_url(sdk, ENOTFOUND_URL)
-    assert(!!enotfoundLog, 'no webhook_logs entry for ENOTFOUND delivery', 'ENOTFOUND failure logged to webhook_logs')
-    assert(
+    record(
+      'ENOTFOUND failure logged to webhook_logs',
+      !!enotfoundLog,
+      enotfoundLog ? `log id=${enotfoundLog.id}` : 'no webhook_logs entry for ENOTFOUND delivery',
+    )
+    record(
+      'ENOTFOUND log has error message as response',
       typeof enotfoundLog?.response === 'string' && enotfoundLog.response.length > 0,
-      `expected string error message response, got: ${JSON.stringify(enotfoundLog?.response)}`,
-      'ENOTFOUND log has error message as response'
+      `response=${JSON.stringify(enotfoundLog?.response ?? null)}`,
+    )
+    record(
+      'ENOTFOUND log has no responseCode',
+      enotfoundLog?.responseCode === undefined,
+      `responseCode=${JSON.stringify(enotfoundLog?.responseCode ?? null)}`,
     )
-    assert(enotfoundLog?.responseCode === undefined, 'unexpected responseCode for ENOTFOUND', 'ENOTFOUND log has no responseCode')
-    assert(
-      await wait_for_failure_count(sdk, initialCount + 1) === initialCount + 1,
-      'deliveryFailureCount not incremented after ENOTFOUND',
-      'deliveryFailureCount incremented after ENOTFOUND'
+    const afterEnotfound = await wait_for_failure_count(sdk, initialCount + 1)
+    record(
+      'deliveryFailureCount incremented after ENOTFOUND',
+      afterEnotfound === initialCount + 1,
+      `deliveryFailureCount=${afterEnotfound} (want ${initialCount + 1})`,
     )
 
     // Scenario 2a: HTTP 400 from the receiver
     await sdk.api.webhooks.update({ url: `${receiverBase}/fail-400` })
     await trigger_delivery('http400')
     const log400 = await find_log_for_url(sdk, `${receiverBase}/fail-400`)
-    assert(log400?.responseCode === 400, `expected responseCode 400, got ${log400?.responseCode}`, 'HTTP 400 responseCode recorded')
-    assert(
-      await wait_for_failure_count(sdk, initialCount + 2) === initialCount + 2,
-      'deliveryFailureCount not incremented after HTTP 400',
-      'deliveryFailureCount incremented after HTTP 400'
+    record(
+      'HTTP 400 responseCode recorded',
+      log400?.responseCode === 400,
+      `responseCode=${JSON.stringify(log400?.responseCode ?? null)} (want 400)`,
+    )
+    const after400 = await wait_for_failure_count(sdk, initialCount + 2)
+    record(
+      'deliveryFailureCount incremented after HTTP 400',
+      after400 === initialCount + 2,
+      `deliveryFailureCount=${after400} (want ${initialCount + 2})`,
     )
 
     // Scenario 2b: HTTP 500 from the receiver
     await sdk.api.webhooks.update({ url: `${receiverBase}/fail-500` })
     await trigger_delivery('http500')
     const log500 = await find_log_for_url(sdk, `${receiverBase}/fail-500`)
-    assert(log500?.responseCode === 500, `expected responseCode 500, got ${log500?.responseCode}`, 'HTTP 500 responseCode recorded')
-    assert(
-      await wait_for_failure_count(sdk, initialCount + 3) === initialCount + 3,
-      'deliveryFailureCount not incremented after HTTP 500',
-      'deliveryFailureCount incremented after HTTP 500'
+    record(
+      'HTTP 500 responseCode recorded',
+      log500?.responseCode === 500,
+      `responseCode=${JSON.stringify(log500?.responseCode ?? null)} (want 500)`,
+    )
+    const after500 = await wait_for_failure_count(sdk, initialCount + 3)
+    record(
+      'deliveryFailureCount incremented after HTTP 500',
+      after500 === initialCount + 3,
+      `deliveryFailureCount=${after500} (want ${initialCount + 3})`,
     )
 
     // Scenario 3 (timeout): skipped — WEBHOOK_TIMEOUT_MS is a constant (15s), not env-overridable,
@@ -139,46 +181,65 @@ export const webhook_error_handling_tests = async ({ sdk, sdkNonAdmin } : { sdk:
     await sdk.api.webhooks.update({ url: `${receiverBase}/success` })
     await trigger_delivery('success')
     const successLog = await find_log_for_url(sdk, `${receiverBase}/success`)
-    assert(successLog?.responseCode === 200, `expected responseCode 200, got ${successLog?.responseCode}`, 'success responseCode recorded')
-    assert(successIntegrityVerified, 'integrity check failed on success delivery', 'success delivery integrity verified')
+    record(
+      'success responseCode recorded',
+      successLog?.responseCode === 200,
+      `responseCode=${JSON.stringify(successLog?.responseCode ?? null)} (want 200)`,
+    )
+    record(
+      'success delivery integrity verified',
+      successIntegrityVerified,
+      successIntegrityVerified ? 'sha256(ids + timestamp + secret) matched' : 'integrity check failed on success delivery',
+    )
     await wait(undefined, 1000) // allow any (erroneous) counter update to land before checking
-    assert(
-      await get_failure_count(sdk) === initialCount + 3,
-      'deliveryFailureCount changed on successful delivery',
-      'deliveryFailureCount untouched on success'
+    const afterSuccess = await get_failure_count(sdk)
+    record(
+      'deliveryFailureCount untouched on success',
+      afterSuccess === initialCount + 3,
+      `deliveryFailureCount=${afterSuccess} (want ${initialCount + 3})`,
     )
 
     // deliveryFailureCount is server-managed: not settable through the public update endpoint
     const configs = await sdk.api.webhooks.getSome() as Array<any>
     const webhookId = configs[0]?.id
     await sdk.api.webhooks.updateOne(webhookId, { deliveryFailureCount: 9999 } as any).catch(() => {}) // may reject (readonly)
-    assert(
-      await get_failure_count(sdk) === initialCount + 3,
-      'customer was able to overwrite deliveryFailureCount',
-      'deliveryFailureCount not customer-settable'
+    const afterOverwrite = await get_failure_count(sdk)
+    record(
+      'deliveryFailureCount not customer-settable',
+      afterOverwrite === initialCount + 3,
+      `deliveryFailureCount=${afterOverwrite} (want ${initialCount + 3})`,
     )
   } finally {
-    // stop deliveries for subsequent tests and shut down the local receiver
-    await sdk.api.webhooks.update({ subscriptionUpdates: { endusers: { create: false, update: false, delete: false } } }).catch(() => {})
-    server.close()
-    for (const id of enduserIds) {
-      try { await sdk.api.endusers.deleteOne(id) } catch {}
+    // stop deliveries and shut down the local receiver BEFORE the tenant goes away, so no delivery
+    // is in flight against a closed socket while teardown runs
+    if (tenant) {
+      await tenant.sdk.api.webhooks.update({
+        subscriptionUpdates: { endusers: { create: false, update: false, delete: false } },
+      }).catch(() => {})
     }
+    server.close()
+    // Teardown BEFORE anything asserts — assert calls process.exit, which would strand this tenant.
+    if (tenant) { try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) } }
   }
+
+  return checks
+}
+
+/** Asserting wrapper, for standalone runs. */
+export const webhook_error_handling_tests = async () => {
+  assert_checks('Webhook error handling', await webhook_error_handling_checks())
+}
+
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = {
+  name: 'Webhook error handling',
+  run: webhook_error_handling_checks,
 }
 
 // Allow running this test file independently
 if (require.main === module) {
   console.log(`🌐 Using API URL: ${host}`)
-  const sdk = new Session({ host })
-  const sdkNonAdmin = new Session({ host })
-
-  const runTests = async () => {
-    await setup_tests(sdk, sdkNonAdmin)
-    await webhook_error_handling_tests({ sdk, sdkNonAdmin })
-  }
-
-  runTests()
+  webhook_error_handling_tests()
     .then(() => {
       console.log("✅ Webhook error handling test suite completed successfully")
       process.exit(0)