@tellescope/sdk 2.0.0-beta.1 → 2.0.0-beta.3

package/lib/cjs/tests/api_tests/security/data-sync-redaction-bypass.test.js

@@ -47,14 +47,13 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
     }
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.data_sync_redaction_bypass_tests = void 0;
+exports.ISOLATED_SUITE = exports.data_sync_redaction_bypass_tests = exports.data_sync_redaction_bypass_checks = void 0;
 require('source-map-support').install();
-var sdk_1 = require("../../../sdk");
 var testing_1 = require("@tellescope/testing");
-var setup_1 = require("../../setup");
+var setup_isolated_1 = require("../../setup_isolated");
 var constants_1 = require("@tellescope/constants");
 var host = process.env.API_URL || 'http://localhost:8080';
-var _a = [process.env.NON_ADMIN_EMAIL, process.env.NON_ADMIN_PASSWORD], nonAdminEmail = _a[0], nonAdminPassword = _a[1];
+var RAND = function () { return Math.random().toString(36).slice(2, 10); };
 var FULL_ACCESS = { create: 'All', read: 'All', update: 'All', delete: 'All' };
 // Schema fields tagged `redactions: ['all']` that must never appear in
 // `/v1/data-sync` results. See packages/public/schema/src/schema.ts.
@@ -108,235 +107,311 @@ var collectViolations = function (results) {
  *
  * Pre-fix: assertion fails with leaked records.
  * Post-fix: assertion passes.
+ *
+ * Runs on its own provisioned tenant. It used to overwrite the SHARED non-admin user's roles with
+ * this deliberately over-permissive role and restore them in a finally, so a crash stranded the
+ * fixture user on it; the mutated user is now this tenant's own, and it is thrown away at teardown.
  */
-var data_sync_redaction_bypass_tests = function (_a) {
-    var sdk = _a.sdk, sdkNonAdmin = _a.sdkNonAdmin;
-    return __awaiter(void 0, void 0, void 0, function () {
-        var roleName, testEnduserId, rbapId, originalRoles, rbap, testEnduser, sync_1, violations_1, userRecordsInStream_1, adminSync, adminViolations_1, otherUsersInStream_2, linkedAccountLeaks_1, _i, otherUsersInStream_1, record, parsed, _b, _c, _d, _e;
-        return __generator(this, function (_f) {
-            switch (_f.label) {
-                case 0:
-                    (0, testing_1.log_header)("/v1/data-sync field-redaction bypass regression");
-                    roleName = "f0001-data-sync-bypass-".concat(Date.now());
-                    originalRoles = sdkNonAdmin.userInfo.roles;
-                    _f.label = 1;
-                case 1:
-                    _f.trys.push([1, , 15, 32]);
-                    return [4 /*yield*/, sdk.api.role_based_access_permissions.createOne({
-                            role: roleName,
-                            permissions: __assign(__assign({}, constants_1.PROVIDER_PERMISSIONS), { users: FULL_ACCESS, endusers: FULL_ACCESS }),
-                            // intentionally NO fieldRedactions — this is the exploit condition.
-                        })];
-                case 2:
-                    rbap = _f.sent();
-                    rbapId = rbap.id;
-                    // 2. Assign role to the non-admin user and re-authenticate so the new
-                    //    session reflects the role's permissions.
-                    return [4 /*yield*/, sdk.api.users.updateOne(sdkNonAdmin.userInfo.id, { roles: [roleName] }, { replaceObjectFields: true })];
-                case 3:
-                    // 2. Assign role to the non-admin user and re-authenticate so the new
+var data_sync_redaction_bypass_checks = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var checks, record, describe, errorMessage, expect_result, roleName, tenant, sdk_1, sdkNonAdmin, _a, admin_1, nonAdmin_1, testEnduser, sync_1, violations_1, userRecordsInStream_1, adminSync, adminViolations_1, otherUsersInStream_2, linkedAccountLeaks_1, _i, otherUsersInStream_1, syncRecord, parsed, e_1;
+    return __generator(this, function (_b) {
+        switch (_b.label) {
+            case 0:
+                checks = [];
+                record = function (label, pass, detail) { return checks.push({ label: label, pass: pass, detail: detail }); };
+                describe = function (value) {
+                    if (value === undefined || value === null)
+                        return String(value);
+                    var stringified = JSON.stringify(value);
+                    return stringified === undefined ? String(value) : stringified;
+                };
+                errorMessage = function (e) { return (typeof (e === null || e === void 0 ? void 0 : e.message) === 'string' && e.message !== '' ? e.message : describe(e)); };
+                expect_result = function (label, fn, onResult) { return __awaiter(void 0, void 0, void 0, function () {
+                    var resolved, e_2, value;
+                    var _a;
+                    return __generator(this, function (_b) {
+                        switch (_b.label) {
+                            case 0:
+                                _b.trys.push([0, 2, , 3]);
+                                _a = {};
+                                return [4 /*yield*/, fn()];
+                            case 1:
+                                resolved = (_a.value = _b.sent(), _a);
+                                return [3 /*break*/, 3];
+                            case 2:
+                                e_2 = _b.sent();
+                                record(label, false, "rejected instead of resolving: ".concat(errorMessage(e_2)));
+                                return [2 /*return*/];
+                            case 3:
+                                value = resolved.value;
+                                try {
+                                    record(label, onResult(value), "result=".concat(describe(value)));
+                                }
+                                catch (predicateError) {
+                                    record(label, false, "predicate threw on result=".concat(describe(value), ": ").concat(errorMessage(predicateError)));
+                                }
+                                return [2 /*return*/];
+                        }
+                    });
+                }); };
+                roleName = "f0001-data-sync-bypass-".concat(RAND());
+                _b.label = 1;
+            case 1:
+                _b.trys.push([1, , 20, 25]);
+                return [4 /*yield*/, (0, setup_isolated_1.setup_isolated_tenant)({
+                        name: "Data-sync field redaction ".concat(RAND()),
+                        users: [{ isAdmin: true }, { roles: ['Non-Admin'] }],
+                        apiKeys: 0,
+                    })];
+            case 2:
+                tenant = _b.sent();
+                sdk_1 = tenant.sdk, sdkNonAdmin = tenant.sdkNonAdmin;
+                _a = tenant.users, admin_1 = _a[0], nonAdmin_1 = _a[1];
+                // 1. Create a role with broad read access but NO fieldRedactions.
+                //    This is the realistic "regular user with read access" condition
+                //    that triggers the bypass in the pre-fix handler.
+                return [4 /*yield*/, sdk_1.api.role_based_access_permissions.createOne({
+                        role: roleName,
+                        permissions: __assign(__assign({}, constants_1.PROVIDER_PERMISSIONS), { users: FULL_ACCESS, endusers: FULL_ACCESS }),
+                        // intentionally NO fieldRedactions — this is the exploit condition.
+                    })
+                    // 2. Assign role to this tenant's own non-admin user and re-authenticate so the new
                     //    session reflects the role's permissions.
-                    _f.sent();
-                    return [4 /*yield*/, (0, testing_1.wait)(undefined, 1500)];
-                case 4:
-                    _f.sent();
-                    return [4 /*yield*/, sdkNonAdmin.authenticate(nonAdminEmail, nonAdminPassword)
-                        // 3. Create a test enduser and set a password — this populates
-                        //    `hashedPassword` on the enduser record and writes a data_sync_records
-                        //    row for it.
-                    ];
-                case 5:
-                    _f.sent();
-                    return [4 /*yield*/, sdk.api.endusers.createOne({
-                            fname: 'F0001Target',
-                            lname: 'Patient',
-                            email: "f0001-target-".concat(Date.now(), "@example.com"),
-                        })];
-                case 6:
-                    testEnduser = _f.sent();
-                    testEnduserId = testEnduser.id;
-                    return [4 /*yield*/, sdk.api.endusers.set_password({ id: testEnduser.id, password: 'F0001TestPassword!123' })
-                        // The non-admin user's own `hashedPass` is set from login and refreshed
-                        // on every write to their user record (e.g., the role-assignment update
-                        // above). No extra setup needed for users.hashedPass to be in the stream.
-                    ];
-                case 7:
-                    _f.sent();
-                    // The non-admin user's own `hashedPass` is set from login and refreshed
-                    // on every write to their user record (e.g., the role-assignment update
-                    // above). No extra setup needed for users.hashedPass to be in the stream.
-                    return [4 /*yield*/, (0, testing_1.wait)(undefined, 500)
-                        // 4. As the non-admin, call /v1/data-sync from epoch zero to capture all
-                        //    sync records the role can see.
-                    ];
-                case 8:
+                ];
+            case 3:
+                // 1. Create a role with broad read access but NO fieldRedactions.
+                //    This is the realistic "regular user with read access" condition
+                //    that triggers the bypass in the pre-fix handler.
+                _b.sent();
+                // 2. Assign role to this tenant's own non-admin user and re-authenticate so the new
+                //    session reflects the role's permissions.
+                return [4 /*yield*/, sdk_1.api.users.updateOne(nonAdmin_1.id, { roles: [roleName] }, { replaceObjectFields: true })];
+            case 4:
+                // 2. Assign role to this tenant's own non-admin user and re-authenticate so the new
+                //    session reflects the role's permissions.
+                _b.sent();
+                return [4 /*yield*/, (0, testing_1.wait)(undefined, 1500)];
+            case 5:
+                _b.sent();
+                return [4 /*yield*/, sdkNonAdmin.authenticate(nonAdmin_1.email, nonAdmin_1.password)
+                    // 2b. Seed a real `linkedAccountAccess` entry on the ADMIN's user record, so coverage B below
+                    //     can actually fail. A verbatim port asserted "no other user's record carries the field",
+                    //     which on a fresh tenant no record carries anyway — it passed even with applyRedactions'
+                    //     owner-only branch deleted.
+                    //
+                    //     The entry is written by request_linked_account_access, which needs account switching
+                    //     enabled on both the actor's and the target's org (here, the one tenant org), and lands
+                    //     the requester's snapshot on the TARGET's record — hence the non-admin requesting access
+                    //     to the admin. The handler writes raw through getDB() and leaves no data_sync_record, so
+                    //     the admin then touches its own record through the SDK to produce one.
+                ];
+            case 6:
+                _b.sent();
+                // 2b. Seed a real `linkedAccountAccess` entry on the ADMIN's user record, so coverage B below
+                //     can actually fail. A verbatim port asserted "no other user's record carries the field",
+                //     which on a fresh tenant no record carries anyway — it passed even with applyRedactions'
+                //     owner-only branch deleted.
+                //
+                //     The entry is written by request_linked_account_access, which needs account switching
+                //     enabled on both the actor's and the target's org (here, the one tenant org), and lands
+                //     the requester's snapshot on the TARGET's record — hence the non-admin requesting access
+                //     to the admin. The handler writes raw through getDB() and leaves no data_sync_record, so
+                //     the admin then touches its own record through the SDK to produce one.
+                return [4 /*yield*/, sdk_1.api.organizations.updateOne(tenant.businessId, { accountSwitchingEnabled: true })];
+            case 7:
+                // 2b. Seed a real `linkedAccountAccess` entry on the ADMIN's user record, so coverage B below
+                //     can actually fail. A verbatim port asserted "no other user's record carries the field",
+                //     which on a fresh tenant no record carries anyway — it passed even with applyRedactions'
+                //     owner-only branch deleted.
+                //
+                //     The entry is written by request_linked_account_access, which needs account switching
+                //     enabled on both the actor's and the target's org (here, the one tenant org), and lands
+                //     the requester's snapshot on the TARGET's record — hence the non-admin requesting access
+                //     to the admin. The handler writes raw through getDB() and leaves no data_sync_record, so
+                //     the admin then touches its own record through the SDK to produce one.
+                _b.sent();
+                return [4 /*yield*/, sdkNonAdmin.api.users.request_linked_account_access({ targetEmail: admin_1.email })];
+            case 8:
+                _b.sent();
+                return [4 /*yield*/, sdk_1.api.users.updateOne(admin_1.id, { fname: 'DataSyncAdmin' })
+                    // The handler answers `{}` on every rejection path (enumeration safety), so the only way to
+                    // know the seed landed is to read it back as the record's owner — the one session
+                    // applyRedactions does not strip the field from. Without this the coverage-B check below is
+                    // vacuous, so a missing field is a FAIL here rather than a silent no-op.
+                ];
+            case 9:
+                _b.sent();
+                // The handler answers `{}` on every rejection path (enumeration safety), so the only way to
+                // know the seed landed is to read it back as the record's owner — the one session
+                // applyRedactions does not strip the field from. Without this the coverage-B check below is
+                // vacuous, so a missing field is a FAIL here rather than a silent no-op.
+                return [4 /*yield*/, expect_result("fixture: linkedAccountAccess is seeded on the admin's user record (owner read)", function () { return sdk_1.api.users.getOne(admin_1.id); }, function (u) { var _a; return ((_a = u.linkedAccountAccess) !== null && _a !== void 0 ? _a : []).some(function (e) { return (e === null || e === void 0 ? void 0 : e.userId) === nonAdmin_1.id; }); })
+                    // 3. Create a test enduser and set a password — this populates
+                    //    `hashedPassword` on the enduser record and writes a data_sync_records
+                    //    row for it.
+                ];
+            case 10:
+                // The handler answers `{}` on every rejection path (enumeration safety), so the only way to
+                // know the seed landed is to read it back as the record's owner — the one session
+                // applyRedactions does not strip the field from. Without this the coverage-B check below is
+                // vacuous, so a missing field is a FAIL here rather than a silent no-op.
+                _b.sent();
+                return [4 /*yield*/, sdk_1.api.endusers.createOne({
+                        fname: 'F0001Target',
+                        lname: 'Patient',
+                        email: "f0001-target-".concat(Date.now(), "@example.com"),
+                    })];
+            case 11:
+                testEnduser = _b.sent();
+                return [4 /*yield*/, sdk_1.api.endusers.set_password({ id: testEnduser.id, password: 'F0001TestPassword!123' })
                     // The non-admin user's own `hashedPass` is set from login and refreshed
                     // on every write to their user record (e.g., the role-assignment update
                     // above). No extra setup needed for users.hashedPass to be in the stream.
-                    _f.sent();
-                    return [4 /*yield*/, sdkNonAdmin.sync({ from: new Date(0) })
-                        // 5. Walk every record. Fail if any contains a `redactions: ['all']` field.
-                    ];
-                case 9:
-                    sync_1 = _f.sent();
-                    violations_1 = collectViolations(sync_1.results);
-                    userRecordsInStream_1 = sync_1.results.filter(function (r) { return r.modelName === 'users'; }).length;
-                    return [4 /*yield*/, (0, testing_1.async_test)("guard: /v1/data-sync sync stream contains at least one user record", function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
-                            return [2 /*return*/, ({ userRecords: userRecordsInStream_1, totalRecords: sync_1.results.length })];
-                        }); }); }, { onResult: function (r) { return r.userRecords >= 1; } })];
-                case 10:
-                    _f.sent();
-                    return [4 /*yield*/, (0, testing_1.async_test)("/v1/data-sync must NOT return hashedPass / hashedPassword / hashedInviteCode", function () { return __awaiter(void 0, void 0, void 0, function () {
-                            return __generator(this, function (_a) {
-                                return [2 /*return*/, ({
-                                        violationCount: violations_1.length,
-                                        violations: violations_1.slice(0, 10),
-                                        affectedModels: Array.from(new Set(violations_1.map(function (v) { return v.modelName; }))),
-                                        affectedFields: Array.from(new Set(violations_1.map(function (v) { return v.leakedField; }))),
-                                    })];
-                            });
-                        }); }, { onResult: function (r) { return r.violationCount === 0; } })
-                        // ========================================================================
-                        // Additional coverage for applyRedactions code paths reachable via /v1/data-sync.
-                        // Each of these is a distinct branch in applyRedactions (routing.ts:1165-1238)
-                        // and could regress independently of this fix.
-                        // ========================================================================
-                        // Case A: schema-level `redactions: ['all']` must apply to ADMIN sessions too.
-                        // Admins have no session.fieldRedactions, but `redactions: ['all']` is universal.
-                        // Pre-fix: admin saw hashedPass via data-sync because applyRedactions was skipped entirely.
-                        // Post-fix: applyRedactions always runs and `redactions: ['all']` strips for everyone.
-                    ];
-                case 11:
-                    _f.sent();
-                    return [4 /*yield*/, sdk.sync({ from: new Date(0) })];
-                case 12:
-                    adminSync = _f.sent();
-                    adminViolations_1 = collectViolations(adminSync.results);
-                    return [4 /*yield*/, (0, testing_1.async_test)("coverage A: admin /v1/data-sync also strips redactions:['all'] fields (hashedPass etc.)", function () { return __awaiter(void 0, void 0, void 0, function () {
-                            return __generator(this, function (_a) {
-                                return [2 /*return*/, ({
-                                        violationCount: adminViolations_1.length,
-                                        violations: adminViolations_1.slice(0, 10),
-                                    })];
-                            });
-                        }); }, { onResult: function (r) { return r.violationCount === 0; } })
-                        // Case B: `linkedAccountAccess` on users must be stripped when the caller is NOT
-                        // the record's owner. This is a separate branch in applyRedactions (routing.ts:1220-1225)
-                        // and protects against cross-user enumeration of who-requested-access-to-whom.
-                        // The non-admin user reads other user records via data-sync; if any of those
-                        // records have linkedAccountAccess set, it must be stripped on read.
-                    ];
-                case 13:
-                    _f.sent();
-                    otherUsersInStream_2 = sync_1.results.filter(function (r) { return r.modelName === 'users' && r.recordId !== sdkNonAdmin.userInfo.id; });
-                    linkedAccountLeaks_1 = [];
-                    for (_i = 0, otherUsersInStream_1 = otherUsersInStream_2; _i < otherUsersInStream_1.length; _i++) {
-                        record = otherUsersInStream_1[_i];
-                        if (!record.data || record.data === 'deleted')
-                            continue;
-                        try {
-                            parsed = JSON.parse(record.data);
-                            if ('linkedAccountAccess' in parsed && parsed.linkedAccountAccess !== undefined) {
-                                linkedAccountLeaks_1.push({ recordId: record.recordId });
-                            }
+                ];
+            case 12:
+                _b.sent();
+                // The non-admin user's own `hashedPass` is set from login and refreshed
+                // on every write to their user record (e.g., the role-assignment update
+                // above). No extra setup needed for users.hashedPass to be in the stream.
+                return [4 /*yield*/, (0, testing_1.wait)(undefined, 500)
+                    // 4. As the non-admin, call /v1/data-sync from epoch zero to capture all
+                    //    sync records the role can see.
+                ];
+            case 13:
+                // The non-admin user's own `hashedPass` is set from login and refreshed
+                // on every write to their user record (e.g., the role-assignment update
+                // above). No extra setup needed for users.hashedPass to be in the stream.
+                _b.sent();
+                return [4 /*yield*/, sdkNonAdmin.sync({ from: new Date(0) })
+                    // 5. Walk every record. Fail if any contains a `redactions: ['all']` field.
+                ];
+            case 14:
+                sync_1 = _b.sent();
+                violations_1 = collectViolations(sync_1.results);
+                userRecordsInStream_1 = sync_1.results.filter(function (r) { return r.modelName === 'users'; }).length;
+                return [4 /*yield*/, expect_result("guard: /v1/data-sync sync stream contains at least one user record", function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                        return [2 /*return*/, ({ userRecords: userRecordsInStream_1, totalRecords: sync_1.results.length })];
+                    }); }); }, function (r) { return r.userRecords >= 1; })];
+            case 15:
+                _b.sent();
+                return [4 /*yield*/, expect_result("/v1/data-sync must NOT return hashedPass / hashedPassword / hashedInviteCode", function () { return __awaiter(void 0, void 0, void 0, function () {
+                        return __generator(this, function (_a) {
+                            return [2 /*return*/, ({
+                                    violationCount: violations_1.length,
+                                    violations: violations_1.slice(0, 10),
+                                    affectedModels: Array.from(new Set(violations_1.map(function (v) { return v.modelName; }))),
+                                    affectedFields: Array.from(new Set(violations_1.map(function (v) { return v.leakedField; }))),
+                                })];
+                        });
+                    }); }, function (r) { return r.violationCount === 0; })
+                    // ========================================================================
+                    // Additional coverage for applyRedactions code paths reachable via /v1/data-sync.
+                    // Each of these is a distinct branch in applyRedactions (routing.ts:1165-1238)
+                    // and could regress independently of this fix.
+                    // ========================================================================
+                    // Case A: schema-level `redactions: ['all']` must apply to ADMIN sessions too.
+                    // Admins have no session.fieldRedactions, but `redactions: ['all']` is universal.
+                    // Pre-fix: admin saw hashedPass via data-sync because applyRedactions was skipped entirely.
+                    // Post-fix: applyRedactions always runs and `redactions: ['all']` strips for everyone.
+                ];
+            case 16:
+                _b.sent();
+                return [4 /*yield*/, sdk_1.sync({ from: new Date(0) })];
+            case 17:
+                adminSync = _b.sent();
+                adminViolations_1 = collectViolations(adminSync.results);
+                return [4 /*yield*/, expect_result("coverage A: admin /v1/data-sync also strips redactions:['all'] fields (hashedPass etc.)", function () { return __awaiter(void 0, void 0, void 0, function () {
+                        return __generator(this, function (_a) {
+                            return [2 /*return*/, ({
+                                    violationCount: adminViolations_1.length,
+                                    violations: adminViolations_1.slice(0, 10),
+                                })];
+                        });
+                    }); }, function (r) { return r.violationCount === 0; })
+                    // Case B: `linkedAccountAccess` on users must be stripped when the caller is NOT
+                    // the record's owner. This is a separate branch in applyRedactions (routing.ts:1220-1225)
+                    // and protects against cross-user enumeration of who-requested-access-to-whom.
+                    // The non-admin user reads other user records via data-sync; if any of those
+                    // records have linkedAccountAccess set, it must be stripped on read.
+                    // The admin's record genuinely carries the field (seeded in 2b), so deleting the owner-only
+                    // branch turns this check red.
+                ];
+            case 18:
+                _b.sent();
+                otherUsersInStream_2 = sync_1.results.filter(function (r) { return r.modelName === 'users' && r.recordId !== nonAdmin_1.id; });
+                linkedAccountLeaks_1 = [];
+                for (_i = 0, otherUsersInStream_1 = otherUsersInStream_2; _i < otherUsersInStream_1.length; _i++) {
+                    syncRecord = otherUsersInStream_1[_i];
+                    if (!syncRecord.data || syncRecord.data === 'deleted')
+                        continue;
+                    try {
+                        parsed = JSON.parse(syncRecord.data);
+                        if ('linkedAccountAccess' in parsed && parsed.linkedAccountAccess !== undefined) {
+                            linkedAccountLeaks_1.push({ recordId: syncRecord.recordId });
                         }
-                        catch (_g) { }
                     }
-                    return [4 /*yield*/, (0, testing_1.async_test)("coverage B: /v1/data-sync strips linkedAccountAccess from other users' records", function () { return __awaiter(void 0, void 0, void 0, function () {
-                            return __generator(this, function (_a) {
-                                return [2 /*return*/, ({
-                                        otherUserRecords: otherUsersInStream_2.length,
-                                        leakCount: linkedAccountLeaks_1.length,
-                                        leaks: linkedAccountLeaks_1.slice(0, 5),
-                                    })];
-                            });
-                        }); }, { onResult: function (r) { return r.leakCount === 0; } })];
-                case 14:
-                    _f.sent();
-                    return [3 /*break*/, 32];
-                case 15:
-                    _f.trys.push([15, 17, , 18]);
-                    return [4 /*yield*/, sdk.api.users.updateOne(sdkNonAdmin.userInfo.id, { roles: originalRoles !== null && originalRoles !== void 0 ? originalRoles : [] }, { replaceObjectFields: true })];
-                case 16:
-                    _f.sent();
-                    return [3 /*break*/, 18];
-                case 17:
-                    _b = _f.sent();
-                    return [3 /*break*/, 18];
-                case 18:
-                    if (!rbapId) return [3 /*break*/, 22];
-                    _f.label = 19;
-                case 19:
-                    _f.trys.push([19, 21, , 22]);
-                    return [4 /*yield*/, sdk.api.role_based_access_permissions.deleteOne(rbapId)];
-                case 20:
-                    _f.sent();
-                    return [3 /*break*/, 22];
-                case 21:
-                    _c = _f.sent();
-                    return [3 /*break*/, 22];
-                case 22:
-                    if (!testEnduserId) return [3 /*break*/, 26];
-                    _f.label = 23;
-                case 23:
-                    _f.trys.push([23, 25, , 26]);
-                    return [4 /*yield*/, sdk.api.endusers.deleteOne(testEnduserId)];
-                case 24:
-                    _f.sent();
-                    return [3 /*break*/, 26];
-                case 25:
-                    _d = _f.sent();
-                    return [3 /*break*/, 26];
-                case 26: 
-                // Re-authenticate the non-admin to drop the exploit role from their JWT
-                // before subsequent tests run.
-                // Role restore above re-triggers deauthenticate_user; wait > 1s so the freshly minted
-                // token's (second-floored) iat lands after the deauth timestamp and isn't permanently
-                // rejected by is_logged_in's iat-slack check. Matches the in-test re-auth above.
-                return [4 /*yield*/, (0, testing_1.wait)(undefined, 1500)];
-                case 27:
-                    // Re-authenticate the non-admin to drop the exploit role from their JWT
-                    // before subsequent tests run.
-                    // Role restore above re-triggers deauthenticate_user; wait > 1s so the freshly minted
-                    // token's (second-floored) iat lands after the deauth timestamp and isn't permanently
-                    // rejected by is_logged_in's iat-slack check. Matches the in-test re-auth above.
-                    _f.sent();
-                    _f.label = 28;
-                case 28:
-                    _f.trys.push([28, 30, , 31]);
-                    return [4 /*yield*/, sdkNonAdmin.authenticate(nonAdminEmail, nonAdminPassword)];
-                case 29:
-                    _f.sent();
-                    return [3 /*break*/, 31];
-                case 30:
-                    _e = _f.sent();
-                    return [3 /*break*/, 31];
-                case 31: return [7 /*endfinally*/];
-                case 32: return [2 /*return*/];
-            }
-        });
+                    catch (_c) { }
+                }
+                return [4 /*yield*/, expect_result("coverage B: /v1/data-sync strips linkedAccountAccess from other users' records", function () { return __awaiter(void 0, void 0, void 0, function () {
+                        return __generator(this, function (_a) {
+                            return [2 /*return*/, ({
+                                    otherUserRecords: otherUsersInStream_2.length,
+                                    adminRecordInStream: otherUsersInStream_2.some(function (r) { return r.recordId === admin_1.id; }),
+                                    leakCount: linkedAccountLeaks_1.length,
+                                    leaks: linkedAccountLeaks_1.slice(0, 5),
+                                })];
+                        });
+                    }); }, 
+                    // The seeded admin record must be in the stream, or there is nothing to strip and the check
+                    // proves nothing.
+                    function (r) { return r.adminRecordInStream && r.leakCount === 0; })];
+            case 19:
+                _b.sent();
+                return [3 /*break*/, 25];
+            case 20:
+                if (!tenant) return [3 /*break*/, 24];
+                _b.label = 21;
+            case 21:
+                _b.trys.push([21, 23, , 24]);
+                return [4 /*yield*/, tenant.teardown()];
+            case 22:
+                _b.sent();
+                return [3 /*break*/, 24];
+            case 23:
+                e_1 = _b.sent();
+                console.error('teardown failed', e_1);
+                return [3 /*break*/, 24];
+            case 24: return [7 /*endfinally*/];
+            case 25: return [2 /*return*/, checks];
+        }
     });
-};
+}); };
+exports.data_sync_redaction_bypass_checks = data_sync_redaction_bypass_checks;
+/** Asserting wrapper, for standalone runs. */
+var data_sync_redaction_bypass_tests = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var _a, _b;
+    return __generator(this, function (_c) {
+        switch (_c.label) {
+            case 0:
+                _a = setup_isolated_1.assert_checks;
+                _b = ['data-sync field-redaction bypass'];
+                return [4 /*yield*/, (0, exports.data_sync_redaction_bypass_checks)()];
+            case 1:
+                _a.apply(void 0, _b.concat([_c.sent()]));
+                return [2 /*return*/];
+        }
+    });
+}); };
 exports.data_sync_redaction_bypass_tests = data_sync_redaction_bypass_tests;
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+exports.ISOLATED_SUITE = {
+    name: 'data-sync field-redaction bypass',
+    run: exports.data_sync_redaction_bypass_checks,
+};
 // Allow running this test file independently
 if (require.main === module) {
     console.log("\uD83C\uDF10 Using API URL: ".concat(host));
-    var sdk_2 = new sdk_1.Session({ host: host });
-    var sdkNonAdmin_1 = new sdk_1.Session({ host: host });
-    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
-        return __generator(this, function (_a) {
-            switch (_a.label) {
-                case 0: return [4 /*yield*/, (0, setup_1.setup_tests)(sdk_2, sdkNonAdmin_1)];
-                case 1:
-                    _a.sent();
-                    return [4 /*yield*/, (0, exports.data_sync_redaction_bypass_tests)({ sdk: sdk_2, sdkNonAdmin: sdkNonAdmin_1 })];
-                case 2:
-                    _a.sent();
-                    return [2 /*return*/];
-            }
-        });
-    }); };
-    runTests()
+    (0, exports.data_sync_redaction_bypass_tests)()
         .then(function () {
         console.log("✅ data-sync redaction-bypass test suite completed successfully");
         process.exit(0);