@tellescope/sdk 2.0.0-beta.1 → 2.0.0-beta.3

package/lib/cjs/tests/api_tests/security/schema-adminonly-enforcement.test.js

@@ -50,13 +50,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.schema_adminonly_enforcement_tests = void 0;
+exports.ISOLATED_SUITE = exports.schema_adminonly_enforcement_tests = exports.schema_adminonly_enforcement_checks = void 0;
 require('source-map-support').install();
 var axios_1 = __importDefault(require("axios"));
 var sdk_1 = require("../../../sdk");
-var testing_1 = require("@tellescope/testing");
 var constants_1 = require("@tellescope/constants");
-var setup_1 = require("../../setup");
+var setup_isolated_1 = require("../../setup_isolated");
 var host = process.env.API_URL || 'http://localhost:8080';
 var RAND = function () { return Math.random().toString(36).slice(2, 10); };
 var ALL = 'All';
@@ -99,283 +98,298 @@ var FULL_ACCESS = { create: ALL, read: ALL, update: ALL, delete: ALL };
  *
  * RED (pre-fix): the six group-B rows fail — each reaches its handler and returns a non-401.
  * GREEN (post-fix): all six return 401 "Admin access only"; the group-A controls are unchanged.
+ *
+ * Runs on its own provisioned tenant, which makes the two environment-dependent probes deterministic
+ * rather than a function of whoever's local database the shared org came from: a fresh tenant has no
+ * Athena integration (so sync-athena is probed) and no twilioSID (so link-twilio, which can create a
+ * REAL Twilio subaccount, stays permanently on its skipped-for-safety path).
  */
-var schema_adminonly_enforcement_tests = function (_a) {
-    var sdk = _a.sdk;
-    return __awaiter(void 0, void 0, void 0, function () {
-        var checks, record, request, isAdminDenial, summarize, roleId, attackerId, enduserId, role, rbap, attacker, attackerToken, adminToken, attackerSDK, enduser, doomed, ABSENT_ID, athenaIntegrationExists, existing, _b, orgHasTwilioSID, org, _c, groupB, _i, groupB_1, probe, attackerResult, baseline, badProbe, groupA, _d, groupA_1, probe, r, _e, checks_1, c, _f, checks_2, c, _g, _h, _j;
-        var _k;
-        return __generator(this, function (_l) {
-            switch (_l.label) {
-                case 0:
-                    (0, testing_1.log_header)("schema-declared adminOnly must be enforced on custom actions");
-                    checks = [];
-                    record = function (label, pass, detail) { return checks.push({ label: label, pass: pass, detail: detail }); };
-                    request = function (authToken, method, path, data) { return __awaiter(void 0, void 0, void 0, function () {
-                        var r;
-                        return __generator(this, function (_a) {
-                            switch (_a.label) {
-                                case 0: return [4 /*yield*/, axios_1.default.request(__assign(__assign({ method: method, url: "".concat(host, "/v1").concat(path) }, method === 'get' ? { params: data } : { data: data }), { headers: { Authorization: "Bearer ".concat(authToken) }, validateStatus: function () { return true; } }))];
-                                case 1:
-                                    r = _a.sent();
-                                    return [2 /*return*/, { status: r.status, body: r.data }];
-                            }
-                        });
-                    }); };
-                    isAdminDenial = function (r) {
-                        var _a;
-                        return (r.status === 401 && ((_a = r.body) === null || _a === void 0 ? void 0 : _a.message) === 'Admin access only');
-                    };
-                    summarize = function (r) {
-                        var _a;
-                        return ("".concat(r.status, " ").concat(((_a = JSON.stringify(r.body)) !== null && _a !== void 0 ? _a : '').slice(0, 120)));
-                    };
-                    roleId = '';
-                    attackerId = '';
-                    enduserId = '';
-                    _l.label = 1;
-                case 1:
-                    _l.trys.push([1, , 27, 40]);
-                    role = "f0191-staff-".concat(RAND());
-                    return [4 /*yield*/, sdk.api.role_based_access_permissions.createOne({
-                            role: role,
-                            permissions: __assign(__assign({}, constants_1.PROVIDER_PERMISSIONS), { 
-                                // grant exactly the verbs the actions under test declare, so a rejection proves the ADMIN
-                                // gate fired rather than ordinary RBAC
-                                automation_triggers: FULL_ACCESS, organizations: FULL_ACCESS, availability_blocks: FULL_ACCESS, background_errors: FULL_ACCESS, users: FULL_ACCESS }),
-                        })];
-                case 2:
-                    rbap = _l.sent();
-                    roleId = rbap.id;
-                    return [4 /*yield*/, sdk.api.users.createOne({
-                            email: "f0191-attacker-".concat(RAND(), "@tellescope.example"),
-                            fname: 'F0191', lname: 'Staff',
-                            verifiedEmail: true,
-                            notificationEmailsDisabled: true,
-                            roles: [role],
-                        })];
-                case 3:
-                    attacker = _l.sent();
-                    attackerId = attacker.id;
-                    return [4 /*yield*/, sdk.api.users.generate_auth_token({ id: attackerId })];
-                case 4:
-                    attackerToken = (_l.sent()).authToken;
-                    return [4 /*yield*/, sdk.api.users.generate_auth_token({ id: sdk.userInfo.id })];
-                case 5:
-                    adminToken = (_l.sent()).authToken;
-                    attackerSDK = new sdk_1.Session({ host: host, authToken: attackerToken });
-                    return [4 /*yield*/, attackerSDK.refresh_session()];
-                case 6:
-                    _l.sent();
-                    record('setup: attacker is a non-admin holding every verb under test', attackerSDK.userInfo.id === attackerId && !((_k = attackerSDK.userInfo.roles) !== null && _k !== void 0 ? _k : []).includes('Admin'), "id=".concat(attackerSDK.userInfo.id, " roles=").concat(JSON.stringify(attackerSDK.userInfo.roles)));
-                    return [4 /*yield*/, sdk.api.endusers.createOne({ fname: 'F0191', lname: 'Patient' })];
-                case 7:
-                    enduser = _l.sent();
-                    enduserId = enduser.id;
-                    return [4 /*yield*/, sdk.api.endusers.createOne({ fname: 'F0191', lname: 'Absent' })];
-                case 8:
-                    doomed = _l.sent();
-                    ABSENT_ID = doomed.id;
-                    return [4 /*yield*/, sdk.api.endusers.deleteOne(ABSENT_ID)
-                        /* ===== environment guards for the two probes input alone cannot make safe ===== */
-                    ];
-                case 9:
-                    _l.sent();
-                    athenaIntegrationExists = false;
-                    _l.label = 10;
-                case 10:
-                    _l.trys.push([10, 12, , 13]);
-                    return [4 /*yield*/, sdk.api.integrations.load_redacted({})];
-                case 11:
-                    existing = _l.sent();
-                    athenaIntegrationExists = !!existing.integrations.find(function (i) { var _a; return /athena/i.test((_a = i.title) !== null && _a !== void 0 ? _a : ''); });
-                    return [3 /*break*/, 13];
-                case 12:
-                    _b = _l.sent();
-                    return [3 /*break*/, 13];
-                case 13:
-                    orgHasTwilioSID = false;
-                    _l.label = 14;
-                case 14:
-                    _l.trys.push([14, 16, , 17]);
-                    return [4 /*yield*/, sdk.api.organizations.getOne(sdk.userInfo.businessId)];
-                case 15:
-                    org = _l.sent();
-                    orgHasTwilioSID = !!(org === null || org === void 0 ? void 0 : org.twilioSID);
-                    return [3 /*break*/, 17];
-                case 16:
-                    _c = _l.sent();
-                    return [3 /*break*/, 17];
-                case 17:
-                    groupB = [
-                        {
-                            label: 'automation_triggers.trigger_events',
-                            method: 'post', path: '/automation-triggers/trigger-events',
-                            // no `action` key: stays off the arbitrary-action-execution branch entirely
-                            data: { triggers: [{ enduserId: enduserId, automationTriggerId: ABSENT_ID }] },
-                        },
-                        {
-                            label: 'organizations.add_athena_subscription',
-                            method: 'post', path: '/organizations/athena-subscription',
-                            data: { type: 'patients', frequency: 1 }, // trips `frequency < 5` on the handler's first line
-                        },
-                        {
-                            label: 'organizations.sync_athena_subscription',
-                            method: 'post', path: '/organizations/sync-athena-subscription',
-                            data: { type: 'patients' },
-                            skip: athenaIntegrationExists
-                                ? 'org HAS an Athena integration — probing would call Athena.process_subscription for real'
-                                : undefined,
-                        },
-                        {
-                            label: 'organizations.link_twilio',
-                            method: 'post', path: '/organizations/link-twilio',
-                            data: {},
-                            skip: orgHasTwilioSID
-                                ? undefined
-                                : 'org has no twilioSID — probing would CREATE A REAL TWILIO SUBACCOUNT',
-                        },
-                        {
-                            label: 'organizations.load_twilio_embed',
-                            method: 'get', path: '/organizations/twilio-embed',
-                            data: { type: 'tfn-verification' }, // no phoneNumberSid => rejected before any Twilio call
-                        },
-                        {
-                            label: 'availability_blocks.handle_autoreply',
-                            method: 'post', path: '/handle-out-of-office-autoreply',
-                            data: { channel: 'Email', enduserId: ABSENT_ID }, // communications.ts:42 `if (!enduser) return`
-                        },
-                    ];
-                    _i = 0, groupB_1 = groupB;
-                    _l.label = 18;
-                case 18:
-                    if (!(_i < groupB_1.length)) return [3 /*break*/, 22];
-                    probe = groupB_1[_i];
-                    if (probe.skip) {
-                        record("B: ".concat(probe.label, " rejects a non-admin"), true, "SKIPPED (safety) \u2014 ".concat(probe.skip));
-                        return [3 /*break*/, 21];
-                    }
-                    return [4 /*yield*/, request(attackerToken, probe.method, probe.path, probe.data)
-                        // baseline: an admin must NOT be admin-denied on the same path, so a blanket 401 can't pass
-                    ];
-                case 19:
-                    attackerResult = _l.sent();
-                    return [4 /*yield*/, request(adminToken, probe.method, probe.path, probe.data)];
-                case 20:
-                    baseline = _l.sent();
-                    badProbe = isAdminDenial(baseline);
-                    record("B: ".concat(probe.label, " rejects a non-admin"), !badProbe && isAdminDenial(attackerResult), "attacker=".concat(summarize(attackerResult), " | admin baseline=").concat(baseline.status)
-                        + (badProbe ? ' BAD PROBE: admin was also admin-denied' : ''));
-                    _l.label = 21;
-                case 21:
-                    _i++;
-                    return [3 /*break*/, 18];
-                case 22:
-                    groupA = [
-                        {
-                            label: 'organizations.sync_note_to_canvas',
-                            method: 'post', path: '/organizations/sync-note-to-canvas',
-                            data: { enduserId: ABSENT_ID, note: 'control' }, // 404 Enduser not found
-                        },
-                        {
-                            label: 'background_errors.mark_read',
-                            method: 'post', path: '/background-errors/mark-read', data: {},
-                        },
-                        {
-                            label: 'users.send_invitation_to_existing',
-                            method: 'post', path: '/invite-existing-user-to-organization',
-                            // takes userId (not email); an absent id hits RecordNotFoundError, well short of any invite
-                            data: { userId: ABSENT_ID },
-                        },
-                    ];
-                    _d = 0, groupA_1 = groupA;
-                    _l.label = 23;
-                case 23:
-                    if (!(_d < groupA_1.length)) return [3 /*break*/, 26];
-                    probe = groupA_1[_d];
-                    return [4 /*yield*/, request(attackerToken, probe.method, probe.path, probe.data)];
-                case 24:
-                    r = _l.sent();
-                    record("A: ".concat(probe.label, " stays reachable by a non-admin (flag intentionally dropped)"), !isAdminDenial(r), "".concat(summarize(r), " (expected a handler response, not 401 Admin access only)"));
-                    _l.label = 25;
-                case 25:
-                    _d++;
-                    return [3 /*break*/, 23];
-                case 26:
-                    /* ===== report: print full table first, then assert (harness exits on first failure) ===== */
-                    console.log('\n  check summary:');
-                    for (_e = 0, checks_1 = checks; _e < checks_1.length; _e++) {
-                        c = checks_1[_e];
-                        console.log("    ".concat(c.pass ? 'PASS' : 'FAIL', "  ").concat(c.label, "  \u2014  ").concat(c.detail));
-                    }
-                    console.log('');
-                    for (_f = 0, checks_2 = checks; _f < checks_2.length; _f++) {
-                        c = checks_2[_f];
-                        (0, testing_1.assert)(c.pass, "".concat(c.label, " \u2014 ").concat(c.detail), c.label);
-                    }
-                    return [3 /*break*/, 40];
-                case 27:
-                    if (!enduserId) return [3 /*break*/, 31];
-                    _l.label = 28;
-                case 28:
-                    _l.trys.push([28, 30, , 31]);
-                    return [4 /*yield*/, sdk.api.endusers.deleteOne(enduserId)];
-                case 29:
-                    _l.sent();
-                    return [3 /*break*/, 31];
-                case 30:
-                    _g = _l.sent();
-                    return [3 /*break*/, 31];
-                case 31:
-                    if (!attackerId) return [3 /*break*/, 35];
-                    _l.label = 32;
-                case 32:
-                    _l.trys.push([32, 34, , 35]);
-                    return [4 /*yield*/, sdk.api.users.deleteOne(attackerId)];
-                case 33:
-                    _l.sent();
-                    return [3 /*break*/, 35];
-                case 34:
-                    _h = _l.sent();
-                    return [3 /*break*/, 35];
-                case 35:
-                    if (!roleId) return [3 /*break*/, 39];
-                    _l.label = 36;
-                case 36:
-                    _l.trys.push([36, 38, , 39]);
-                    return [4 /*yield*/, sdk.api.role_based_access_permissions.deleteOne(roleId)];
-                case 37:
-                    _l.sent();
-                    return [3 /*break*/, 39];
-                case 38:
-                    _j = _l.sent();
-                    return [3 /*break*/, 39];
-                case 39: return [7 /*endfinally*/];
-                case 40: return [2 /*return*/];
-            }
-        });
+var schema_adminonly_enforcement_checks = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var checks, record, request, isAdminDenial, summarize, tenant, roleId, attackerId, enduserId, sdk, role, rbap, attacker, attackerToken, adminToken, attackerSDK, enduser, doomed, ABSENT_ID, athenaIntegrationExists, existing, _a, orgHasTwilioSID, org, _b, groupB, _i, groupB_1, probe, attackerResult, baseline, badProbe, groupA, _c, groupA_1, probe, r, sdk, _d, _e, _f, e_1;
+    var _g;
+    return __generator(this, function (_h) {
+        switch (_h.label) {
+            case 0:
+                checks = [];
+                record = function (label, pass, detail) { return checks.push({ label: label, pass: pass, detail: detail }); };
+                request = function (authToken, method, path, data) { return __awaiter(void 0, void 0, void 0, function () {
+                    var r;
+                    return __generator(this, function (_a) {
+                        switch (_a.label) {
+                            case 0: return [4 /*yield*/, axios_1.default.request(__assign(__assign({ method: method, url: "".concat(host, "/v1").concat(path) }, method === 'get' ? { params: data } : { data: data }), { headers: { Authorization: "Bearer ".concat(authToken) }, validateStatus: function () { return true; } }))];
+                            case 1:
+                                r = _a.sent();
+                                return [2 /*return*/, { status: r.status, body: r.data }];
+                        }
+                    });
+                }); };
+                isAdminDenial = function (r) {
+                    var _a;
+                    return (r.status === 401 && ((_a = r.body) === null || _a === void 0 ? void 0 : _a.message) === 'Admin access only');
+                };
+                summarize = function (r) {
+                    var _a;
+                    return ("".concat(r.status, " ").concat(((_a = JSON.stringify(r.body)) !== null && _a !== void 0 ? _a : '').slice(0, 120)));
+                };
+                roleId = '';
+                attackerId = '';
+                enduserId = '';
+                _h.label = 1;
+            case 1:
+                _h.trys.push([1, , 28, 44]);
+                return [4 /*yield*/, (0, setup_isolated_1.setup_isolated_tenant)({
+                        name: "Schema adminOnly enforcement ".concat(RAND()),
+                        users: [{ isAdmin: true }],
+                        apiKeys: 0,
+                    })];
+            case 2:
+                tenant = _h.sent();
+                sdk = tenant.sdk;
+                role = "f0191-staff-".concat(RAND());
+                return [4 /*yield*/, sdk.api.role_based_access_permissions.createOne({
+                        role: role,
+                        permissions: __assign(__assign({}, constants_1.PROVIDER_PERMISSIONS), { 
+                            // grant exactly the verbs the actions under test declare, so a rejection proves the ADMIN
+                            // gate fired rather than ordinary RBAC
+                            automation_triggers: FULL_ACCESS, organizations: FULL_ACCESS, availability_blocks: FULL_ACCESS, background_errors: FULL_ACCESS, users: FULL_ACCESS }),
+                    })];
+            case 3:
+                rbap = _h.sent();
+                roleId = rbap.id;
+                return [4 /*yield*/, sdk.api.users.createOne({
+                        email: "f0191-attacker-".concat(RAND(), "@tellescope.example"),
+                        fname: 'F0191', lname: 'Staff',
+                        verifiedEmail: true,
+                        notificationEmailsDisabled: true,
+                        roles: [role],
+                    })];
+            case 4:
+                attacker = _h.sent();
+                attackerId = attacker.id;
+                return [4 /*yield*/, sdk.api.users.generate_auth_token({ id: attackerId })];
+            case 5:
+                attackerToken = (_h.sent()).authToken;
+                return [4 /*yield*/, sdk.api.users.generate_auth_token({ id: sdk.userInfo.id })];
+            case 6:
+                adminToken = (_h.sent()).authToken;
+                attackerSDK = new sdk_1.Session({ host: host, authToken: attackerToken });
+                return [4 /*yield*/, attackerSDK.refresh_session()];
+            case 7:
+                _h.sent();
+                record('setup: attacker is a non-admin holding every verb under test', attackerSDK.userInfo.id === attackerId && !((_g = attackerSDK.userInfo.roles) !== null && _g !== void 0 ? _g : []).includes('Admin'), "id=".concat(attackerSDK.userInfo.id, " roles=").concat(JSON.stringify(attackerSDK.userInfo.roles)));
+                return [4 /*yield*/, sdk.api.endusers.createOne({ fname: 'F0191', lname: 'Patient' })];
+            case 8:
+                enduser = _h.sent();
+                enduserId = enduser.id;
+                return [4 /*yield*/, sdk.api.endusers.createOne({ fname: 'F0191', lname: 'Absent' })];
+            case 9:
+                doomed = _h.sent();
+                ABSENT_ID = doomed.id;
+                return [4 /*yield*/, sdk.api.endusers.deleteOne(ABSENT_ID)
+                    /* ===== environment guards for the two probes input alone cannot make safe ===== */
+                ];
+            case 10:
+                _h.sent();
+                athenaIntegrationExists = false;
+                _h.label = 11;
+            case 11:
+                _h.trys.push([11, 13, , 14]);
+                return [4 /*yield*/, sdk.api.integrations.load_redacted({})];
+            case 12:
+                existing = _h.sent();
+                athenaIntegrationExists = !!existing.integrations.find(function (i) { var _a; return /athena/i.test((_a = i.title) !== null && _a !== void 0 ? _a : ''); });
+                return [3 /*break*/, 14];
+            case 13:
+                _a = _h.sent();
+                return [3 /*break*/, 14];
+            case 14:
+                orgHasTwilioSID = false;
+                _h.label = 15;
+            case 15:
+                _h.trys.push([15, 17, , 18]);
+                return [4 /*yield*/, sdk.api.organizations.getOne(sdk.userInfo.businessId)];
+            case 16:
+                org = _h.sent();
+                orgHasTwilioSID = !!(org === null || org === void 0 ? void 0 : org.twilioSID);
+                return [3 /*break*/, 18];
+            case 17:
+                _b = _h.sent();
+                return [3 /*break*/, 18];
+            case 18:
+                groupB = [
+                    {
+                        label: 'automation_triggers.trigger_events',
+                        method: 'post', path: '/automation-triggers/trigger-events',
+                        // no `action` key: stays off the arbitrary-action-execution branch entirely
+                        data: { triggers: [{ enduserId: enduserId, automationTriggerId: ABSENT_ID }] },
+                    },
+                    {
+                        label: 'organizations.add_athena_subscription',
+                        method: 'post', path: '/organizations/athena-subscription',
+                        data: { type: 'patients', frequency: 1 }, // trips `frequency < 5` on the handler's first line
+                    },
+                    {
+                        label: 'organizations.sync_athena_subscription',
+                        method: 'post', path: '/organizations/sync-athena-subscription',
+                        data: { type: 'patients' },
+                        skip: athenaIntegrationExists
+                            ? 'org HAS an Athena integration — probing would call Athena.process_subscription for real'
+                            : undefined,
+                    },
+                    {
+                        label: 'organizations.link_twilio',
+                        method: 'post', path: '/organizations/link-twilio',
+                        data: {},
+                        skip: orgHasTwilioSID
+                            ? undefined
+                            : 'org has no twilioSID — probing would CREATE A REAL TWILIO SUBACCOUNT',
+                    },
+                    {
+                        label: 'organizations.load_twilio_embed',
+                        method: 'get', path: '/organizations/twilio-embed',
+                        data: { type: 'tfn-verification' }, // no phoneNumberSid => rejected before any Twilio call
+                    },
+                    {
+                        label: 'availability_blocks.handle_autoreply',
+                        method: 'post', path: '/handle-out-of-office-autoreply',
+                        data: { channel: 'Email', enduserId: ABSENT_ID }, // communications.ts:42 `if (!enduser) return`
+                    },
+                ];
+                _i = 0, groupB_1 = groupB;
+                _h.label = 19;
+            case 19:
+                if (!(_i < groupB_1.length)) return [3 /*break*/, 23];
+                probe = groupB_1[_i];
+                if (probe.skip) {
+                    record("B: ".concat(probe.label, " rejects a non-admin"), true, "SKIPPED (safety) \u2014 ".concat(probe.skip));
+                    return [3 /*break*/, 22];
+                }
+                return [4 /*yield*/, request(attackerToken, probe.method, probe.path, probe.data)
+                    // baseline: an admin must NOT be admin-denied on the same path, so a blanket 401 can't pass
+                ];
+            case 20:
+                attackerResult = _h.sent();
+                return [4 /*yield*/, request(adminToken, probe.method, probe.path, probe.data)];
+            case 21:
+                baseline = _h.sent();
+                badProbe = isAdminDenial(baseline);
+                record("B: ".concat(probe.label, " rejects a non-admin"), !badProbe && isAdminDenial(attackerResult), "attacker=".concat(summarize(attackerResult), " | admin baseline=").concat(baseline.status)
+                    + (badProbe ? ' BAD PROBE: admin was also admin-denied' : ''));
+                _h.label = 22;
+            case 22:
+                _i++;
+                return [3 /*break*/, 19];
+            case 23:
+                groupA = [
+                    {
+                        label: 'organizations.sync_note_to_canvas',
+                        method: 'post', path: '/organizations/sync-note-to-canvas',
+                        data: { enduserId: ABSENT_ID, note: 'control' }, // 404 Enduser not found
+                    },
+                    {
+                        label: 'background_errors.mark_read',
+                        method: 'post', path: '/background-errors/mark-read', data: {},
+                    },
+                    {
+                        label: 'users.send_invitation_to_existing',
+                        method: 'post', path: '/invite-existing-user-to-organization',
+                        // takes userId (not email); an absent id hits RecordNotFoundError, well short of any invite
+                        data: { userId: ABSENT_ID },
+                    },
+                ];
+                _c = 0, groupA_1 = groupA;
+                _h.label = 24;
+            case 24:
+                if (!(_c < groupA_1.length)) return [3 /*break*/, 27];
+                probe = groupA_1[_c];
+                return [4 /*yield*/, request(attackerToken, probe.method, probe.path, probe.data)];
+            case 25:
+                r = _h.sent();
+                record("A: ".concat(probe.label, " stays reachable by a non-admin (flag intentionally dropped)"), !isAdminDenial(r), "".concat(summarize(r), " (expected a handler response, not 401 Admin access only)"));
+                _h.label = 26;
+            case 26:
+                _c++;
+                return [3 /*break*/, 24];
+            case 27: return [3 /*break*/, 44];
+            case 28:
+                if (!tenant) return [3 /*break*/, 43];
+                sdk = tenant.sdk;
+                if (!enduserId) return [3 /*break*/, 32];
+                _h.label = 29;
+            case 29:
+                _h.trys.push([29, 31, , 32]);
+                return [4 /*yield*/, sdk.api.endusers.deleteOne(enduserId)];
+            case 30:
+                _h.sent();
+                return [3 /*break*/, 32];
+            case 31:
+                _d = _h.sent();
+                return [3 /*break*/, 32];
+            case 32:
+                if (!attackerId) return [3 /*break*/, 36];
+                _h.label = 33;
+            case 33:
+                _h.trys.push([33, 35, , 36]);
+                return [4 /*yield*/, sdk.api.users.deleteOne(attackerId)];
+            case 34:
+                _h.sent();
+                return [3 /*break*/, 36];
+            case 35:
+                _e = _h.sent();
+                return [3 /*break*/, 36];
+            case 36:
+                if (!roleId) return [3 /*break*/, 40];
+                _h.label = 37;
+            case 37:
+                _h.trys.push([37, 39, , 40]);
+                return [4 /*yield*/, sdk.api.role_based_access_permissions.deleteOne(roleId)];
+            case 38:
+                _h.sent();
+                return [3 /*break*/, 40];
+            case 39:
+                _f = _h.sent();
+                return [3 /*break*/, 40];
+            case 40:
+                _h.trys.push([40, 42, , 43]);
+                return [4 /*yield*/, tenant.teardown()];
+            case 41:
+                _h.sent();
+                return [3 /*break*/, 43];
+            case 42:
+                e_1 = _h.sent();
+                console.error('teardown failed', e_1);
+                return [3 /*break*/, 43];
+            case 43: return [7 /*endfinally*/];
+            case 44: return [2 /*return*/, checks];
+        }
     });
-};
+}); };
+exports.schema_adminonly_enforcement_checks = schema_adminonly_enforcement_checks;
+/** Asserting wrapper, for standalone runs. */
+var schema_adminonly_enforcement_tests = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var _a, _b;
+    return __generator(this, function (_c) {
+        switch (_c.label) {
+            case 0:
+                _a = setup_isolated_1.assert_checks;
+                _b = ['Schema adminOnly enforcement'];
+                return [4 /*yield*/, (0, exports.schema_adminonly_enforcement_checks)()];
+            case 1:
+                _a.apply(void 0, _b.concat([_c.sent()]));
+                return [2 /*return*/];
+        }
+    });
+}); };
 exports.schema_adminonly_enforcement_tests = schema_adminonly_enforcement_tests;
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+exports.ISOLATED_SUITE = {
+    name: 'Schema adminOnly enforcement',
+    run: exports.schema_adminonly_enforcement_checks,
+};
 // Allow running this test file independently
 if (require.main === module) {
     console.log("\uD83C\uDF10 Using API URL: ".concat(host));
-    var sdk_2 = new sdk_1.Session({ host: host });
-    var sdkNonAdmin_1 = new sdk_1.Session({ host: host });
-    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
-        return __generator(this, function (_a) {
-            switch (_a.label) {
-                case 0: return [4 /*yield*/, (0, setup_1.setup_tests)(sdk_2, sdkNonAdmin_1)];
-                case 1:
-                    _a.sent();
-                    return [4 /*yield*/, (0, exports.schema_adminonly_enforcement_tests)({ sdk: sdk_2, sdkNonAdmin: sdkNonAdmin_1 })];
-                case 2:
-                    _a.sent();
-                    return [2 /*return*/];
-            }
-        });
-    }); };
-    runTests()
+    (0, exports.schema_adminonly_enforcement_tests)()
         .then(function () {
         console.log("✅ schema adminOnly enforcement test suite completed successfully");
         process.exit(0);