@tellescope/sdk 2.0.0-beta.1 → 2.0.0-beta.3

package/lib/cjs/tests/api_tests/security/ai-conversations-rbac.test.js

@@ -47,15 +47,14 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
     }
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ai_conversations_rbac_tests = void 0;
+exports.ISOLATED_SUITE = exports.ai_conversations_rbac_tests = exports.ai_conversations_rbac_checks = void 0;
 require('source-map-support').install();
 var bson_1 = require("bson");
-var sdk_1 = require("../../../sdk");
 var testing_1 = require("@tellescope/testing");
-var setup_1 = require("../../setup");
+var setup_isolated_1 = require("../../setup_isolated");
 var constants_1 = require("@tellescope/constants");
 var host = process.env.API_URL || 'http://localhost:8080';
-var _a = [process.env.NON_ADMIN_EMAIL, process.env.NON_ADMIN_PASSWORD], nonAdminEmail = _a[0], nonAdminPassword = _a[1];
+var RAND = function () { return Math.random().toString(36).slice(2, 10); };
 /**
  * Regression test: `ai_conversations` RBAC.
  *
@@ -87,297 +86,417 @@ var _a = [process.env.NON_ADMIN_EMAIL, process.env.NON_ADMIN_PASSWORD], nonAdmin
  *   - generate_ai_decision: 200 with `{}` (handler responds early before access check). Test fails.
  *
  * Post-fix: both endpoints throw 403 before any work happens. Test passes.
+ *
+ * Runs on its own provisioned tenant, so the three roles below are assigned to a throwaway
+ * non-admin rather than to the SHARED fixture user, whose permissions were previously arbitrary
+ * for every concurrent suite while this ran (and stayed broken if cleanup crashed).
  */
-var ai_conversations_rbac_tests = function (_a) {
-    var sdk = _a.sdk, sdkNonAdmin = _a.sdkNonAdmin;
-    return __awaiter(void 0, void 0, void 0, function () {
-        var roleName, grantRoleName, assignedRoleName, rbapId, grantRbapId, assignedRbapId, originalRoles, rbap, grantRbap, assignedRbap, _b, _c, _d, _e, _f;
-        return __generator(this, function (_g) {
-            switch (_g.label) {
-                case 0:
-                    (0, testing_1.log_header)("ai_conversations RBAC bypass regression");
-                    roleName = "f0005-ai-conversations-no-access-".concat(Date.now());
-                    grantRoleName = "f0005-ai-conversations-create-granted-".concat(Date.now());
-                    assignedRoleName = "f0005-ai-conversations-assigned-default-".concat(Date.now());
-                    originalRoles = sdkNonAdmin.userInfo.roles;
-                    _g.label = 1;
-                case 1:
-                    _g.trys.push([1, , 19, 40]);
-                    return [4 /*yield*/, sdk.api.role_based_access_permissions.createOne({
-                            role: roleName,
-                            permissions: __assign(__assign({}, constants_1.PROVIDER_PERMISSIONS), { ai_conversations: { create: null, read: null, update: null, delete: null }, endusers: { create: null, read: null, update: null, delete: null } }),
-                        })];
-                case 2:
-                    rbap = _g.sent();
-                    rbapId = rbap.id;
-                    // 2. Assign the role to the non-admin user and re-authenticate so the new
-                    //    session reflects the role's denied permissions.
-                    return [4 /*yield*/, sdk.api.users.updateOne(sdkNonAdmin.userInfo.id, { roles: [roleName] }, { replaceObjectFields: true })];
-                case 3:
-                    // 2. Assign the role to the non-admin user and re-authenticate so the new
+var ai_conversations_rbac_checks = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var checks, record, describe, errorMessage, expect_rejected, isAccessDenial, roleName, grantRoleName, assignedRoleName, tenant, sdk, sdkNonAdmin_1, nonAdmin, label, outcome, e_1, label, outcome, e_2, label, outcome, e_3, e, msg, status_1, isCrash, label, outcome, e_4, e, msg, status_2, isCrash, e_5;
+    var _a, _b, _c, _d;
+    var _e, _f, _g, _h;
+    return __generator(this, function (_j) {
+        switch (_j.label) {
+            case 0:
+                checks = [];
+                record = function (label, pass, detail) { return checks.push({ label: label, pass: pass, detail: detail }); };
+                describe = function (value) {
+                    if (value === undefined || value === null)
+                        return String(value);
+                    var stringified = JSON.stringify(value);
+                    return stringified === undefined ? String(value) : stringified;
+                };
+                errorMessage = function (e) { return (typeof (e === null || e === void 0 ? void 0 : e.message) === 'string' && e.message !== '' ? e.message : describe(e)); };
+                expect_rejected = function (label, fn, onError) { return __awaiter(void 0, void 0, void 0, function () {
+                    var rejection, unexpected, e_6, e;
+                    return __generator(this, function (_a) {
+                        switch (_a.label) {
+                            case 0:
+                                _a.trys.push([0, 2, , 3]);
+                                return [4 /*yield*/, fn()];
+                            case 1:
+                                unexpected = _a.sent();
+                                record(label, false, "resolved instead of rejecting; result=".concat(describe(unexpected)));
+                                return [2 /*return*/];
+                            case 2:
+                                e_6 = _a.sent();
+                                rejection = { e: e_6 };
+                                return [3 /*break*/, 3];
+                            case 3:
+                                e = rejection.e;
+                                try {
+                                    record(label, onError(e), "rejected with ".concat(errorMessage(e)));
+                                }
+                                catch (predicateError) {
+                                    record(label, false, "predicate threw on rejection \"".concat(errorMessage(e), "\": ").concat(errorMessage(predicateError)));
+                                }
+                                return [2 /*return*/];
+                        }
+                    });
+                }); };
+                isAccessDenial = function (e) {
+                    var _a, _b;
+                    var msg = ((_a = e === null || e === void 0 ? void 0 : e.message) !== null && _a !== void 0 ? _a : '').toLowerCase();
+                    var status = (_b = e === null || e === void 0 ? void 0 : e.status) !== null && _b !== void 0 ? _b : e === null || e === void 0 ? void 0 : e.code;
+                    return status === 403 || status === 401
+                        || msg.includes('access') || msg.includes('permission') || msg.includes('forbidden');
+                };
+                roleName = "f0005-ai-conversations-no-access-".concat(RAND());
+                grantRoleName = "f0005-ai-conversations-create-granted-".concat(RAND());
+                assignedRoleName = "f0005-ai-conversations-assigned-default-".concat(RAND());
+                _j.label = 1;
+            case 1:
+                _j.trys.push([1, , 36, 41]);
+                return [4 /*yield*/, (0, setup_isolated_1.setup_isolated_tenant)({
+                        name: "ai_conversations RBAC ".concat(RAND()),
+                        users: [{ isAdmin: true }, { roles: ['Non-Admin'] }],
+                        apiKeys: 0,
+                    })];
+            case 2:
+                tenant = _j.sent();
+                sdk = tenant.sdk, sdkNonAdmin_1 = tenant.sdkNonAdmin;
+                nonAdmin = tenant.users[1];
+                // 1. Create a role that explicitly denies ai_conversations access AND endusers access.
+                //    This is the realistic configuration the bypass affects: a tenant operator
+                //    deliberately restricts a role from reading AI conversations / enduser PHI.
+                return [4 /*yield*/, sdk.api.role_based_access_permissions.createOne({
+                        role: roleName,
+                        permissions: __assign(__assign({}, constants_1.PROVIDER_PERMISSIONS), { ai_conversations: { create: null, read: null, update: null, delete: null }, endusers: { create: null, read: null, update: null, delete: null } }),
+                    })
+                    // 2. Assign the role to this tenant's own non-admin user and re-authenticate so the new
                     //    session reflects the role's denied permissions.
-                    _g.sent();
-                    return [4 /*yield*/, (0, testing_1.wait)(undefined, 1500)];
-                case 4:
-                    _g.sent();
-                    return [4 /*yield*/, sdkNonAdmin.authenticate(nonAdminEmail, nonAdminPassword)
-                        // 3a. send_message must throw 403 (or equivalent access error). Pre-fix: succeeds (or
-                        //     fails downstream in Bedrock without 403). Post-fix: throws before any work.
-                    ];
-                case 5:
-                    _g.sent();
-                    // 3a. send_message must throw 403 (or equivalent access error). Pre-fix: succeeds (or
-                    //     fails downstream in Bedrock without 403). Post-fix: throws before any work.
-                    return [4 /*yield*/, (0, testing_1.async_test)("ai_conversations.send_message must throw 403 when role denies ai_conversations", function () { return sdkNonAdmin.api.ai_conversations.send_message({
-                            message: 'regression test',
-                            type: 'Test',
-                        }); }, {
-                            shouldError: true,
-                            onError: function (e) {
-                                var _a, _b;
-                                // Accept any 4xx access-denial response — handler may use 403 (recommended)
-                                // or 400 with "access" / "permission" in the message.
-                                var msg = ((_a = e === null || e === void 0 ? void 0 : e.message) !== null && _a !== void 0 ? _a : '').toLowerCase();
-                                var status = (_b = e === null || e === void 0 ? void 0 : e.status) !== null && _b !== void 0 ? _b : e === null || e === void 0 ? void 0 : e.code;
-                                return status === 403 || status === 401
-                                    || msg.includes('access') || msg.includes('permission') || msg.includes('forbidden');
-                            },
-                        })
-                        // 3b. generate_ai_decision must throw 403 BEFORE the early res.json({}) response.
-                        //     Pre-fix: handler responds 200 with {} immediately and processes in background.
-                        //     Post-fix: handler throws 403 before res.json({}).
-                    ];
-                case 6:
+                ];
+            case 3:
+                // 1. Create a role that explicitly denies ai_conversations access AND endusers access.
+                //    This is the realistic configuration the bypass affects: a tenant operator
+                //    deliberately restricts a role from reading AI conversations / enduser PHI.
+                _j.sent();
+                // 2. Assign the role to this tenant's own non-admin user and re-authenticate so the new
+                //    session reflects the role's denied permissions.
+                return [4 /*yield*/, sdk.api.users.updateOne(nonAdmin.id, { roles: [roleName] }, { replaceObjectFields: true })];
+            case 4:
+                // 2. Assign the role to this tenant's own non-admin user and re-authenticate so the new
+                //    session reflects the role's denied permissions.
+                _j.sent();
+                return [4 /*yield*/, (0, testing_1.wait)(undefined, 1500)];
+            case 5:
+                _j.sent();
+                return [4 /*yield*/, sdkNonAdmin_1.authenticate(nonAdmin.email, nonAdmin.password)
                     // 3a. send_message must throw 403 (or equivalent access error). Pre-fix: succeeds (or
                     //     fails downstream in Bedrock without 403). Post-fix: throws before any work.
-                    _g.sent();
-                    // 3b. generate_ai_decision must throw 403 BEFORE the early res.json({}) response.
-                    //     Pre-fix: handler responds 200 with {} immediately and processes in background.
-                    //     Post-fix: handler throws 403 before res.json({}).
-                    return [4 /*yield*/, (0, testing_1.async_test)("ai_conversations.generate_ai_decision must throw 403 when role denies endusers/ai_conversations", function () { return sdkNonAdmin.api.ai_conversations.generate_ai_decision({
-                            enduserId: new bson_1.ObjectId().toHexString(),
-                            automationStepId: new bson_1.ObjectId().toHexString(),
-                            outcomes: ['yes', 'no'],
-                            prompt: 'regression test',
-                            sources: [{ type: 'SMS', limit: 1 }], // non-empty so the validator passes; access check then fires
-                        }); }, {
-                            shouldError: true,
-                            onError: function (e) {
-                                var _a, _b;
-                                var msg = ((_a = e === null || e === void 0 ? void 0 : e.message) !== null && _a !== void 0 ? _a : '').toLowerCase();
-                                var status = (_b = e === null || e === void 0 ? void 0 : e.status) !== null && _b !== void 0 ? _b : e === null || e === void 0 ? void 0 : e.code;
-                                return status === 403 || status === 401
-                                    || msg.includes('access') || msg.includes('permission') || msg.includes('forbidden');
-                            },
-                        })
-                        // 4. Positive case: granting only ai_conversations create must pass the RBAC gate.
-                        //    send_message may still fail downstream (e.g. 400 "Organization has not set up credits"),
-                        //    but it must NOT be an access-denial error.
-                    ];
-                case 7:
+                ];
+            case 6:
+                _j.sent();
+                // 3a. send_message must throw 403 (or equivalent access error). Pre-fix: succeeds (or
+                //     fails downstream in Bedrock without 403). Post-fix: throws before any work.
+                return [4 /*yield*/, expect_rejected("ai_conversations.send_message must throw 403 when role denies ai_conversations", function () { return sdkNonAdmin_1.api.ai_conversations.send_message({
+                        message: 'regression test',
+                        type: 'Test',
+                    }); }, function (e) {
+                        var _a, _b;
+                        // Accept any 4xx access-denial response — handler may use 403 (recommended)
+                        // or 400 with "access" / "permission" in the message.
+                        var msg = ((_a = e === null || e === void 0 ? void 0 : e.message) !== null && _a !== void 0 ? _a : '').toLowerCase();
+                        var status = (_b = e === null || e === void 0 ? void 0 : e.status) !== null && _b !== void 0 ? _b : e === null || e === void 0 ? void 0 : e.code;
+                        return status === 403 || status === 401
+                            || msg.includes('access') || msg.includes('permission') || msg.includes('forbidden');
+                    })
                     // 3b. generate_ai_decision must throw 403 BEFORE the early res.json({}) response.
                     //     Pre-fix: handler responds 200 with {} immediately and processes in background.
                     //     Post-fix: handler throws 403 before res.json({}).
-                    _g.sent();
-                    return [4 /*yield*/, sdk.api.role_based_access_permissions.createOne({
-                            role: grantRoleName,
-                            permissions: __assign(__assign({}, constants_1.PROVIDER_PERMISSIONS), { ai_conversations: { create: 'All', read: null, update: null, delete: null } }),
-                        })];
-                case 8:
-                    grantRbap = _g.sent();
-                    grantRbapId = grantRbap.id;
-                    return [4 /*yield*/, sdk.api.users.updateOne(sdkNonAdmin.userInfo.id, { roles: [grantRoleName] }, { replaceObjectFields: true })];
-                case 9:
-                    _g.sent();
-                    return [4 /*yield*/, (0, testing_1.wait)(undefined, 1500)];
-                case 10:
-                    _g.sent();
-                    return [4 /*yield*/, sdkNonAdmin.authenticate(nonAdminEmail, nonAdminPassword)];
-                case 11:
-                    _g.sent();
-                    return [4 /*yield*/, (0, testing_1.async_test)("ai_conversations.send_message must NOT be access-denied when role grants create", function () { return sdkNonAdmin.api.ai_conversations.send_message({
-                            message: 'positive-case test',
-                            type: 'Test',
-                            maxTokens: 1,
-                        })
-                            .then(function () { return 'allowed'; })
-                            .catch(function (e) {
-                            var _a, _b;
-                            var msg = ((_a = e === null || e === void 0 ? void 0 : e.message) !== null && _a !== void 0 ? _a : '').toLowerCase();
-                            var status = (_b = e === null || e === void 0 ? void 0 : e.status) !== null && _b !== void 0 ? _b : e === null || e === void 0 ? void 0 : e.code;
-                            if (status === 403 || status === 401
-                                || msg.includes('access') || msg.includes('permission') || msg.includes('forbidden')) {
-                                throw e; // access denial — the gate incorrectly blocked a create-granted role
-                            }
-                            return 'allowed'; // downstream (e.g. credits) error is fine — the gate passed
-                        }); }, { onResult: function (r) { return r === 'allowed'; } })
-                        // 5. The create-granted (read/update-denied) role must still be blocked from CONTINUING an
-                        //    existing conversation — send_message with conversationId returns the full stored history
-                        //    and appends to it. Fake id is fine: the access check must fire before any lookup.
-                    ];
-                case 12:
-                    _g.sent();
-                    // 5. The create-granted (read/update-denied) role must still be blocked from CONTINUING an
-                    //    existing conversation — send_message with conversationId returns the full stored history
-                    //    and appends to it. Fake id is fine: the access check must fire before any lookup.
-                    return [4 /*yield*/, (0, testing_1.async_test)("ai_conversations.send_message with conversationId must 403 when role denies read/update", function () { return sdkNonAdmin.api.ai_conversations.send_message({
-                            message: 'conversationId bypass test',
-                            type: 'Test',
-                            maxTokens: 1,
-                            conversationId: new bson_1.ObjectId().toHexString(),
-                        }); }, {
-                            shouldError: true,
-                            onError: function (e) {
-                                var _a, _b;
-                                var msg = ((_a = e === null || e === void 0 ? void 0 : e.message) !== null && _a !== void 0 ? _a : '').toLowerCase();
-                                var status = (_b = e === null || e === void 0 ? void 0 : e.status) !== null && _b !== void 0 ? _b : e === null || e === void 0 ? void 0 : e.code;
-                                return status === 403 || status === 401
-                                    || msg.includes('access') || msg.includes('permission') || msg.includes('forbidden');
-                            },
-                        })
-                        // 6. Regression: a role with default provider permissions (ai_conversations = Assigned)
-                        //    must be able to generate a new conversation without a 500. Previously the
-                        //    post-generation $push ran through the access-scoped DB, matched nothing under
-                        //    "Assigned", and crashed the handler with "Cannot read properties of null ('_id')".
-                    ];
-                case 13:
-                    // 5. The create-granted (read/update-denied) role must still be blocked from CONTINUING an
-                    //    existing conversation — send_message with conversationId returns the full stored history
-                    //    and appends to it. Fake id is fine: the access check must fire before any lookup.
-                    _g.sent();
-                    return [4 /*yield*/, sdk.api.role_based_access_permissions.createOne({
-                            role: assignedRoleName,
-                            permissions: __assign({}, constants_1.PROVIDER_PERMISSIONS),
-                        })];
-                case 14:
-                    assignedRbap = _g.sent();
-                    assignedRbapId = assignedRbap.id;
-                    return [4 /*yield*/, sdk.api.users.updateOne(sdkNonAdmin.userInfo.id, { roles: [assignedRoleName] }, { replaceObjectFields: true })];
-                case 15:
-                    _g.sent();
-                    return [4 /*yield*/, (0, testing_1.wait)(undefined, 1500)];
-                case 16:
-                    _g.sent();
-                    return [4 /*yield*/, sdkNonAdmin.authenticate(nonAdminEmail, nonAdminPassword)];
-                case 17:
-                    _g.sent();
-                    return [4 /*yield*/, (0, testing_1.async_test)("ai_conversations.send_message must not 500 for Assigned-access (default provider) role", function () { return sdkNonAdmin.api.ai_conversations.send_message({
-                            message: 'assigned-access regression test',
-                            type: 'Test',
-                            maxTokens: 1,
-                        })
-                            .then(function () { return 'ok'; })
-                            .catch(function (e) {
-                            var _a, _b;
-                            var msg = ((_a = e === null || e === void 0 ? void 0 : e.message) !== null && _a !== void 0 ? _a : '').toLowerCase();
-                            var status = (_b = e === null || e === void 0 ? void 0 : e.status) !== null && _b !== void 0 ? _b : e === null || e === void 0 ? void 0 : e.code;
-                            if (status === 500 || msg.includes('internal error') || msg.includes('cannot read properties')) {
-                                throw e; // the null-update crash — regression
-                            }
-                            if (status === 403 || status === 401
-                                || msg.includes('access') || msg.includes('permission') || msg.includes('forbidden')) {
-                                throw e; // Assigned access must pass the RBAC gate
-                            }
-                            return 'ok'; // downstream (e.g. credits) error is fine
-                        }); }, { onResult: function (r) { return r === 'ok'; } })];
-                case 18:
-                    _g.sent();
-                    return [3 /*break*/, 40];
-                case 19:
-                    _g.trys.push([19, 21, , 22]);
-                    return [4 /*yield*/, sdk.api.users.updateOne(sdkNonAdmin.userInfo.id, { roles: originalRoles !== null && originalRoles !== void 0 ? originalRoles : [] }, { replaceObjectFields: true })];
-                case 20:
-                    _g.sent();
-                    return [3 /*break*/, 22];
-                case 21:
-                    _b = _g.sent();
-                    return [3 /*break*/, 22];
-                case 22:
-                    if (!rbapId) return [3 /*break*/, 26];
-                    _g.label = 23;
-                case 23:
-                    _g.trys.push([23, 25, , 26]);
-                    return [4 /*yield*/, sdk.api.role_based_access_permissions.deleteOne(rbapId)];
-                case 24:
-                    _g.sent();
-                    return [3 /*break*/, 26];
-                case 25:
-                    _c = _g.sent();
-                    return [3 /*break*/, 26];
-                case 26:
-                    if (!grantRbapId) return [3 /*break*/, 30];
-                    _g.label = 27;
-                case 27:
-                    _g.trys.push([27, 29, , 30]);
-                    return [4 /*yield*/, sdk.api.role_based_access_permissions.deleteOne(grantRbapId)];
-                case 28:
-                    _g.sent();
-                    return [3 /*break*/, 30];
-                case 29:
-                    _d = _g.sent();
-                    return [3 /*break*/, 30];
-                case 30:
-                    if (!assignedRbapId) return [3 /*break*/, 34];
-                    _g.label = 31;
-                case 31:
-                    _g.trys.push([31, 33, , 34]);
-                    return [4 /*yield*/, sdk.api.role_based_access_permissions.deleteOne(assignedRbapId)];
-                case 32:
-                    _g.sent();
-                    return [3 /*break*/, 34];
-                case 33:
-                    _e = _g.sent();
-                    return [3 /*break*/, 34];
-                case 34: 
-                // Re-authenticate the non-admin to drop the no-access role from their JWT
-                // before subsequent tests run.
-                // Role restore above re-triggers deauthenticate_user; wait > 1s so the freshly minted
-                // token's (second-floored) iat lands after the deauth timestamp and isn't permanently
-                // rejected by is_logged_in's iat-slack check. Matches the in-test re-auth above.
+                ];
+            case 7:
+                // 3a. send_message must throw 403 (or equivalent access error). Pre-fix: succeeds (or
+                //     fails downstream in Bedrock without 403). Post-fix: throws before any work.
+                _j.sent();
+                // 3b. generate_ai_decision must throw 403 BEFORE the early res.json({}) response.
+                //     Pre-fix: handler responds 200 with {} immediately and processes in background.
+                //     Post-fix: handler throws 403 before res.json({}).
+                return [4 /*yield*/, expect_rejected("ai_conversations.generate_ai_decision must throw 403 when role denies endusers/ai_conversations", function () { return sdkNonAdmin_1.api.ai_conversations.generate_ai_decision({
+                        enduserId: new bson_1.ObjectId().toHexString(),
+                        automationStepId: new bson_1.ObjectId().toHexString(),
+                        outcomes: ['yes', 'no'],
+                        prompt: 'regression test',
+                        sources: [{ type: 'SMS', limit: 1 }], // non-empty so the validator passes; access check then fires
+                    }); }, function (e) {
+                        var _a, _b;
+                        var msg = ((_a = e === null || e === void 0 ? void 0 : e.message) !== null && _a !== void 0 ? _a : '').toLowerCase();
+                        var status = (_b = e === null || e === void 0 ? void 0 : e.status) !== null && _b !== void 0 ? _b : e === null || e === void 0 ? void 0 : e.code;
+                        return status === 403 || status === 401
+                            || msg.includes('access') || msg.includes('permission') || msg.includes('forbidden');
+                    })
+                    // 3c. agent_message carries the SAME gate as send_message and must not be an exception:
+                    //     it is a second way to spend the tenant's credits and to read a stored conversation.
+                    //     The body is deliberately valid, so a 403 here can only come from the access check —
+                    //     an invalid body would 400 in validation before the gate and pass this check vacuously.
+                ];
+            case 8:
+                // 3b. generate_ai_decision must throw 403 BEFORE the early res.json({}) response.
+                //     Pre-fix: handler responds 200 with {} immediately and processes in background.
+                //     Post-fix: handler throws 403 before res.json({}).
+                _j.sent();
+                // 3c. agent_message carries the SAME gate as send_message and must not be an exception:
+                //     it is a second way to spend the tenant's credits and to read a stored conversation.
+                //     The body is deliberately valid, so a 403 here can only come from the access check —
+                //     an invalid body would 400 in validation before the gate and pass this check vacuously.
+                return [4 /*yield*/, expect_rejected("ai_conversations.agent_message must throw 403 when role denies ai_conversations", function () { return sdkNonAdmin_1.api.ai_conversations.agent_message({
+                        messages: [{ role: 'user', content: [{ type: 'text', text: 'regression test' }] }],
+                        maxTokens: 16,
+                    }); }, isAccessDenial)
+                    // 4. Positive case: granting only ai_conversations create must pass the RBAC gate.
+                    //    send_message may still fail downstream (e.g. 400 "Organization has not set up credits"),
+                    //    but it must NOT be an access-denial error.
+                ];
+            case 9:
+                // 3c. agent_message carries the SAME gate as send_message and must not be an exception:
+                //     it is a second way to spend the tenant's credits and to read a stored conversation.
+                //     The body is deliberately valid, so a 403 here can only come from the access check —
+                //     an invalid body would 400 in validation before the gate and pass this check vacuously.
+                _j.sent();
+                // 4. Positive case: granting only ai_conversations create must pass the RBAC gate.
+                //    send_message may still fail downstream (e.g. 400 "Organization has not set up credits"),
+                //    but it must NOT be an access-denial error.
+                return [4 /*yield*/, sdk.api.role_based_access_permissions.createOne({
+                        role: grantRoleName,
+                        permissions: __assign(__assign({}, constants_1.PROVIDER_PERMISSIONS), { ai_conversations: { create: 'All', read: null, update: null, delete: null } }),
+                    })];
+            case 10:
+                // 4. Positive case: granting only ai_conversations create must pass the RBAC gate.
+                //    send_message may still fail downstream (e.g. 400 "Organization has not set up credits"),
+                //    but it must NOT be an access-denial error.
+                _j.sent();
+                return [4 /*yield*/, sdk.api.users.updateOne(nonAdmin.id, { roles: [grantRoleName] }, { replaceObjectFields: true })];
+            case 11:
+                _j.sent();
                 return [4 /*yield*/, (0, testing_1.wait)(undefined, 1500)];
-                case 35:
-                    // Re-authenticate the non-admin to drop the no-access role from their JWT
-                    // before subsequent tests run.
-                    // Role restore above re-triggers deauthenticate_user; wait > 1s so the freshly minted
-                    // token's (second-floored) iat lands after the deauth timestamp and isn't permanently
-                    // rejected by is_logged_in's iat-slack check. Matches the in-test re-auth above.
-                    _g.sent();
-                    _g.label = 36;
-                case 36:
-                    _g.trys.push([36, 38, , 39]);
-                    return [4 /*yield*/, sdkNonAdmin.authenticate(nonAdminEmail, nonAdminPassword)];
-                case 37:
-                    _g.sent();
-                    return [3 /*break*/, 39];
-                case 38:
-                    _f = _g.sent();
-                    return [3 /*break*/, 39];
-                case 39: return [7 /*endfinally*/];
-                case 40: return [2 /*return*/];
-            }
-        });
+            case 12:
+                _j.sent();
+                return [4 /*yield*/, sdkNonAdmin_1.authenticate(nonAdmin.email, nonAdmin.password)];
+            case 13:
+                _j.sent();
+                label = "ai_conversations.send_message must NOT be access-denied when role grants create";
+                outcome = void 0;
+                _j.label = 14;
+            case 14:
+                _j.trys.push([14, 16, , 17]);
+                _a = { resolved: true };
+                return [4 /*yield*/, sdkNonAdmin_1.api.ai_conversations.send_message({
+                        message: 'positive-case test',
+                        type: 'Test',
+                        maxTokens: 1,
+                    })];
+            case 15:
+                outcome = (_a.value = _j.sent(), _a);
+                return [3 /*break*/, 17];
+            case 16:
+                e_1 = _j.sent();
+                outcome = { resolved: false, error: e_1 };
+                return [3 /*break*/, 17];
+            case 17:
+                // A downstream (e.g. credits) error is fine — the gate passed. An access denial is not.
+                record(label, outcome.resolved || !isAccessDenial(outcome.error), outcome.resolved
+                    ? "allowed; result=".concat(describe(outcome.value))
+                    : "gate passed, rejected downstream with ".concat(errorMessage(outcome.error)));
+                label = "ai_conversations.agent_message must NOT be access-denied when role grants create";
+                outcome = void 0;
+                _j.label = 18;
+            case 18:
+                _j.trys.push([18, 20, , 21]);
+                _b = { resolved: true };
+                return [4 /*yield*/, sdkNonAdmin_1.api.ai_conversations.agent_message({
+                        messages: [{ role: 'user', content: [{ type: 'text', text: 'positive-case test' }] }],
+                        maxTokens: 16,
+                    })];
+            case 19:
+                outcome = (_b.value = _j.sent(), _b);
+                return [3 /*break*/, 21];
+            case 20:
+                e_2 = _j.sent();
+                outcome = { resolved: false, error: e_2 };
+                return [3 /*break*/, 21];
+            case 21:
+                // A downstream (e.g. credits) error is fine — the gate passed. An access denial is not.
+                record(label, outcome.resolved || !isAccessDenial(outcome.error), outcome.resolved
+                    ? "allowed; result=".concat(describe(outcome.value))
+                    : "gate passed, rejected downstream with ".concat(errorMessage(outcome.error)));
+                // 5. The create-granted (read/update-denied) role must still be blocked from CONTINUING an
+                //    existing conversation — send_message with conversationId returns the full stored history
+                //    and appends to it. Fake id is fine: the access check must fire before any lookup.
+                return [4 /*yield*/, expect_rejected("ai_conversations.send_message with conversationId must 403 when role denies read/update", function () { return sdkNonAdmin_1.api.ai_conversations.send_message({
+                        message: 'conversationId bypass test',
+                        type: 'Test',
+                        maxTokens: 1,
+                        conversationId: new bson_1.ObjectId().toHexString(),
+                    }); }, function (e) {
+                        var _a, _b;
+                        var msg = ((_a = e === null || e === void 0 ? void 0 : e.message) !== null && _a !== void 0 ? _a : '').toLowerCase();
+                        var status = (_b = e === null || e === void 0 ? void 0 : e.status) !== null && _b !== void 0 ? _b : e === null || e === void 0 ? void 0 : e.code;
+                        return status === 403 || status === 401
+                            || msg.includes('access') || msg.includes('permission') || msg.includes('forbidden');
+                    })];
+            case 22:
+                // 5. The create-granted (read/update-denied) role must still be blocked from CONTINUING an
+                //    existing conversation — send_message with conversationId returns the full stored history
+                //    and appends to it. Fake id is fine: the access check must fire before any lookup.
+                _j.sent();
+                return [4 /*yield*/, expect_rejected("ai_conversations.agent_message with conversationId must 403 when role denies read/update", function () { return sdkNonAdmin_1.api.ai_conversations.agent_message({
+                        messages: [{ role: 'user', content: [{ type: 'text', text: 'conversationId bypass test' }] }],
+                        maxTokens: 16,
+                        conversationId: new bson_1.ObjectId().toHexString(),
+                    }); }, isAccessDenial)
+                    // 6. Regression: a role with default provider permissions (ai_conversations = Assigned)
+                    //    must be able to generate a new conversation without a 500. Previously the
+                    //    post-generation $push ran through the access-scoped DB, matched nothing under
+                    //    "Assigned", and crashed the handler with "Cannot read properties of null ('_id')".
+                    //
+                    //    GATE-ONLY, by construction: organizations.creditCount is readonly in the schema, so a
+                    //    provisioned tenant has no credits and send_message 400s on credits BEFORE it reaches the
+                    //    $push this check guards. What it still proves is that the Assigned role passes the RBAC
+                    //    gate and the handler does not 500 on the way — the observed error is printed in the
+                    //    detail so a change of failure mode is visible in the check table rather than silent.
+                ];
+            case 23:
+                _j.sent();
+                // 6. Regression: a role with default provider permissions (ai_conversations = Assigned)
+                //    must be able to generate a new conversation without a 500. Previously the
+                //    post-generation $push ran through the access-scoped DB, matched nothing under
+                //    "Assigned", and crashed the handler with "Cannot read properties of null ('_id')".
+                //
+                //    GATE-ONLY, by construction: organizations.creditCount is readonly in the schema, so a
+                //    provisioned tenant has no credits and send_message 400s on credits BEFORE it reaches the
+                //    $push this check guards. What it still proves is that the Assigned role passes the RBAC
+                //    gate and the handler does not 500 on the way — the observed error is printed in the
+                //    detail so a change of failure mode is visible in the check table rather than silent.
+                return [4 /*yield*/, sdk.api.role_based_access_permissions.createOne({
+                        role: assignedRoleName,
+                        permissions: __assign({}, constants_1.PROVIDER_PERMISSIONS),
+                    })];
+            case 24:
+                // 6. Regression: a role with default provider permissions (ai_conversations = Assigned)
+                //    must be able to generate a new conversation without a 500. Previously the
+                //    post-generation $push ran through the access-scoped DB, matched nothing under
+                //    "Assigned", and crashed the handler with "Cannot read properties of null ('_id')".
+                //
+                //    GATE-ONLY, by construction: organizations.creditCount is readonly in the schema, so a
+                //    provisioned tenant has no credits and send_message 400s on credits BEFORE it reaches the
+                //    $push this check guards. What it still proves is that the Assigned role passes the RBAC
+                //    gate and the handler does not 500 on the way — the observed error is printed in the
+                //    detail so a change of failure mode is visible in the check table rather than silent.
+                _j.sent();
+                return [4 /*yield*/, sdk.api.users.updateOne(nonAdmin.id, { roles: [assignedRoleName] }, { replaceObjectFields: true })];
+            case 25:
+                _j.sent();
+                return [4 /*yield*/, (0, testing_1.wait)(undefined, 1500)];
+            case 26:
+                _j.sent();
+                return [4 /*yield*/, sdkNonAdmin_1.authenticate(nonAdmin.email, nonAdmin.password)];
+            case 27:
+                _j.sent();
+                label = "ai_conversations.send_message must not 500 for Assigned-access (default provider) role";
+                outcome = void 0;
+                _j.label = 28;
+            case 28:
+                _j.trys.push([28, 30, , 31]);
+                _c = { resolved: true };
+                return [4 /*yield*/, sdkNonAdmin_1.api.ai_conversations.send_message({
+                        message: 'assigned-access regression test',
+                        type: 'Test',
+                        maxTokens: 1,
+                    })];
+            case 29:
+                outcome = (_c.value = _j.sent(), _c);
+                return [3 /*break*/, 31];
+            case 30:
+                e_3 = _j.sent();
+                outcome = { resolved: false, error: e_3 };
+                return [3 /*break*/, 31];
+            case 31:
+                if (outcome.resolved) {
+                    record(label, true, "ok; result=".concat(describe(outcome.value)));
+                }
+                else {
+                    e = outcome.error;
+                    msg = ((_e = e === null || e === void 0 ? void 0 : e.message) !== null && _e !== void 0 ? _e : '').toLowerCase();
+                    status_1 = (_f = e === null || e === void 0 ? void 0 : e.status) !== null && _f !== void 0 ? _f : e === null || e === void 0 ? void 0 : e.code;
+                    isCrash = status_1 === 500 || msg.includes('internal error') || msg.includes('cannot read properties');
+                    record(label, !isCrash && !isAccessDenial(e), // the null-update crash, and an Assigned denial, are both regressions
+                    "".concat(isCrash ? 'CRASHED' : isAccessDenial(e) ? 'ACCESS-DENIED' : 'gate passed, rejected downstream')
+                        + " with ".concat(errorMessage(e)));
+                }
+                label = "ai_conversations.agent_message must not 500 for Assigned-access (default provider) role";
+                outcome = void 0;
+                _j.label = 32;
+            case 32:
+                _j.trys.push([32, 34, , 35]);
+                _d = { resolved: true };
+                return [4 /*yield*/, sdkNonAdmin_1.api.ai_conversations.agent_message({
+                        messages: [{ role: 'user', content: [{ type: 'text', text: 'assigned-access regression test' }] }],
+                        maxTokens: 16,
+                    })];
+            case 33:
+                outcome = (_d.value = _j.sent(), _d);
+                return [3 /*break*/, 35];
+            case 34:
+                e_4 = _j.sent();
+                outcome = { resolved: false, error: e_4 };
+                return [3 /*break*/, 35];
+            case 35:
+                if (outcome.resolved) {
+                    record(label, true, "ok; result=".concat(describe(outcome.value)));
+                }
+                else {
+                    e = outcome.error;
+                    msg = ((_g = e === null || e === void 0 ? void 0 : e.message) !== null && _g !== void 0 ? _g : '').toLowerCase();
+                    status_2 = (_h = e === null || e === void 0 ? void 0 : e.status) !== null && _h !== void 0 ? _h : e === null || e === void 0 ? void 0 : e.code;
+                    isCrash = status_2 === 500 || msg.includes('internal error') || msg.includes('cannot read properties');
+                    record(label, !isCrash && !isAccessDenial(e), "".concat(isCrash ? 'CRASHED' : isAccessDenial(e) ? 'ACCESS-DENIED' : 'gate passed, rejected downstream')
+                        + " with ".concat(errorMessage(e)));
+                }
+                return [3 /*break*/, 41];
+            case 36:
+                if (!tenant) return [3 /*break*/, 40];
+                _j.label = 37;
+            case 37:
+                _j.trys.push([37, 39, , 40]);
+                return [4 /*yield*/, tenant.teardown()];
+            case 38:
+                _j.sent();
+                return [3 /*break*/, 40];
+            case 39:
+                e_5 = _j.sent();
+                console.error('teardown failed', e_5);
+                return [3 /*break*/, 40];
+            case 40: return [7 /*endfinally*/];
+            case 41: return [2 /*return*/, checks];
+        }
     });
-};
+}); };
+exports.ai_conversations_rbac_checks = ai_conversations_rbac_checks;
+/** Asserting wrapper, for standalone runs. */
+var ai_conversations_rbac_tests = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var _a, _b;
+    return __generator(this, function (_c) {
+        switch (_c.label) {
+            case 0:
+                _a = setup_isolated_1.assert_checks;
+                _b = ['ai_conversations RBAC'];
+                return [4 /*yield*/, (0, exports.ai_conversations_rbac_checks)()];
+            case 1:
+                _a.apply(void 0, _b.concat([_c.sent()]));
+                return [2 /*return*/];
+        }
+    });
+}); };
 exports.ai_conversations_rbac_tests = ai_conversations_rbac_tests;
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+exports.ISOLATED_SUITE = {
+    name: 'ai_conversations RBAC',
+    run: exports.ai_conversations_rbac_checks,
+};
 // Allow running this test file independently
 if (require.main === module) {
     console.log("\uD83C\uDF10 Using API URL: ".concat(host));
-    var sdk_2 = new sdk_1.Session({ host: host });
-    var sdkNonAdmin_1 = new sdk_1.Session({ host: host });
-    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
-        return __generator(this, function (_a) {
-            switch (_a.label) {
-                case 0: return [4 /*yield*/, (0, setup_1.setup_tests)(sdk_2, sdkNonAdmin_1)];
-                case 1:
-                    _a.sent();
-                    return [4 /*yield*/, (0, exports.ai_conversations_rbac_tests)({ sdk: sdk_2, sdkNonAdmin: sdkNonAdmin_1 })];
-                case 2:
-                    _a.sent();
-                    return [2 /*return*/];
-            }
-        });
-    }); };
-    runTests()
+    (0, exports.ai_conversations_rbac_tests)()
         .then(function () {
         console.log("✅ ai_conversations RBAC test suite completed successfully");
         process.exit(0);