@tellescope/sdk 2.0.0-beta.2 → 2.0.0-beta.3

package/lib/esm/tests/api_tests/security/data-sync-redaction-bypass.test.js

@@ -46,12 +46,11 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
     }
 };
 require('source-map-support').install();
-import { Session } from "../../../sdk";
-import { async_test, log_header, wait, } from "@tellescope/testing";
-import { setup_tests } from "../../setup";
+import { wait, } from "@tellescope/testing";
+import { assert_checks, setup_isolated_tenant, } from "../../setup_isolated";
 import { PROVIDER_PERMISSIONS } from "@tellescope/constants";
 var host = process.env.API_URL || 'http://localhost:8080';
-var _a = [process.env.NON_ADMIN_EMAIL, process.env.NON_ADMIN_PASSWORD], nonAdminEmail = _a[0], nonAdminPassword = _a[1];
+var RAND = function () { return Math.random().toString(36).slice(2, 10); };
 var FULL_ACCESS = { create: 'All', read: 'All', update: 'All', delete: 'All' };
 // Schema fields tagged `redactions: ['all']` that must never appear in
 // `/v1/data-sync` results. See packages/public/schema/src/schema.ts.
@@ -105,234 +104,309 @@ var collectViolations = function (results) {
  *
  * Pre-fix: assertion fails with leaked records.
  * Post-fix: assertion passes.
+ *
+ * Runs on its own provisioned tenant. It used to overwrite the SHARED non-admin user's roles with
+ * this deliberately over-permissive role and restore them in a finally, so a crash stranded the
+ * fixture user on it; the mutated user is now this tenant's own, and it is thrown away at teardown.
  */
-export var data_sync_redaction_bypass_tests = function (_a) {
-    var sdk = _a.sdk, sdkNonAdmin = _a.sdkNonAdmin;
-    return __awaiter(void 0, void 0, void 0, function () {
-        var roleName, testEnduserId, rbapId, originalRoles, rbap, testEnduser, sync_1, violations_1, userRecordsInStream_1, adminSync, adminViolations_1, otherUsersInStream_2, linkedAccountLeaks_1, _i, otherUsersInStream_1, record, parsed, _b, _c, _d, _e;
-        return __generator(this, function (_f) {
-            switch (_f.label) {
-                case 0:
-                    log_header("/v1/data-sync field-redaction bypass regression");
-                    roleName = "f0001-data-sync-bypass-".concat(Date.now());
-                    originalRoles = sdkNonAdmin.userInfo.roles;
-                    _f.label = 1;
-                case 1:
-                    _f.trys.push([1, , 15, 32]);
-                    return [4 /*yield*/, sdk.api.role_based_access_permissions.createOne({
-                            role: roleName,
-                            permissions: __assign(__assign({}, PROVIDER_PERMISSIONS), { users: FULL_ACCESS, endusers: FULL_ACCESS }),
-                            // intentionally NO fieldRedactions — this is the exploit condition.
-                        })];
-                case 2:
-                    rbap = _f.sent();
-                    rbapId = rbap.id;
-                    // 2. Assign role to the non-admin user and re-authenticate so the new
-                    //    session reflects the role's permissions.
-                    return [4 /*yield*/, sdk.api.users.updateOne(sdkNonAdmin.userInfo.id, { roles: [roleName] }, { replaceObjectFields: true })];
-                case 3:
-                    // 2. Assign role to the non-admin user and re-authenticate so the new
+export var data_sync_redaction_bypass_checks = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var checks, record, describe, errorMessage, expect_result, roleName, tenant, sdk_1, sdkNonAdmin, _a, admin_1, nonAdmin_1, testEnduser, sync_1, violations_1, userRecordsInStream_1, adminSync, adminViolations_1, otherUsersInStream_2, linkedAccountLeaks_1, _i, otherUsersInStream_1, syncRecord, parsed, e_1;
+    return __generator(this, function (_b) {
+        switch (_b.label) {
+            case 0:
+                checks = [];
+                record = function (label, pass, detail) { return checks.push({ label: label, pass: pass, detail: detail }); };
+                describe = function (value) {
+                    if (value === undefined || value === null)
+                        return String(value);
+                    var stringified = JSON.stringify(value);
+                    return stringified === undefined ? String(value) : stringified;
+                };
+                errorMessage = function (e) { return (typeof (e === null || e === void 0 ? void 0 : e.message) === 'string' && e.message !== '' ? e.message : describe(e)); };
+                expect_result = function (label, fn, onResult) { return __awaiter(void 0, void 0, void 0, function () {
+                    var resolved, e_2, value;
+                    var _a;
+                    return __generator(this, function (_b) {
+                        switch (_b.label) {
+                            case 0:
+                                _b.trys.push([0, 2, , 3]);
+                                _a = {};
+                                return [4 /*yield*/, fn()];
+                            case 1:
+                                resolved = (_a.value = _b.sent(), _a);
+                                return [3 /*break*/, 3];
+                            case 2:
+                                e_2 = _b.sent();
+                                record(label, false, "rejected instead of resolving: ".concat(errorMessage(e_2)));
+                                return [2 /*return*/];
+                            case 3:
+                                value = resolved.value;
+                                try {
+                                    record(label, onResult(value), "result=".concat(describe(value)));
+                                }
+                                catch (predicateError) {
+                                    record(label, false, "predicate threw on result=".concat(describe(value), ": ").concat(errorMessage(predicateError)));
+                                }
+                                return [2 /*return*/];
+                        }
+                    });
+                }); };
+                roleName = "f0001-data-sync-bypass-".concat(RAND());
+                _b.label = 1;
+            case 1:
+                _b.trys.push([1, , 20, 25]);
+                return [4 /*yield*/, setup_isolated_tenant({
+                        name: "Data-sync field redaction ".concat(RAND()),
+                        users: [{ isAdmin: true }, { roles: ['Non-Admin'] }],
+                        apiKeys: 0,
+                    })];
+            case 2:
+                tenant = _b.sent();
+                sdk_1 = tenant.sdk, sdkNonAdmin = tenant.sdkNonAdmin;
+                _a = tenant.users, admin_1 = _a[0], nonAdmin_1 = _a[1];
+                // 1. Create a role with broad read access but NO fieldRedactions.
+                //    This is the realistic "regular user with read access" condition
+                //    that triggers the bypass in the pre-fix handler.
+                return [4 /*yield*/, sdk_1.api.role_based_access_permissions.createOne({
+                        role: roleName,
+                        permissions: __assign(__assign({}, PROVIDER_PERMISSIONS), { users: FULL_ACCESS, endusers: FULL_ACCESS }),
+                        // intentionally NO fieldRedactions — this is the exploit condition.
+                    })
+                    // 2. Assign role to this tenant's own non-admin user and re-authenticate so the new
                     //    session reflects the role's permissions.
-                    _f.sent();
-                    return [4 /*yield*/, wait(undefined, 1500)];
-                case 4:
-                    _f.sent();
-                    return [4 /*yield*/, sdkNonAdmin.authenticate(nonAdminEmail, nonAdminPassword)
-                        // 3. Create a test enduser and set a password — this populates
-                        //    `hashedPassword` on the enduser record and writes a data_sync_records
-                        //    row for it.
-                    ];
-                case 5:
-                    _f.sent();
-                    return [4 /*yield*/, sdk.api.endusers.createOne({
-                            fname: 'F0001Target',
-                            lname: 'Patient',
-                            email: "f0001-target-".concat(Date.now(), "@example.com"),
-                        })];
-                case 6:
-                    testEnduser = _f.sent();
-                    testEnduserId = testEnduser.id;
-                    return [4 /*yield*/, sdk.api.endusers.set_password({ id: testEnduser.id, password: 'F0001TestPassword!123' })
-                        // The non-admin user's own `hashedPass` is set from login and refreshed
-                        // on every write to their user record (e.g., the role-assignment update
-                        // above). No extra setup needed for users.hashedPass to be in the stream.
-                    ];
-                case 7:
-                    _f.sent();
-                    // The non-admin user's own `hashedPass` is set from login and refreshed
-                    // on every write to their user record (e.g., the role-assignment update
-                    // above). No extra setup needed for users.hashedPass to be in the stream.
-                    return [4 /*yield*/, wait(undefined, 500)
-                        // 4. As the non-admin, call /v1/data-sync from epoch zero to capture all
-                        //    sync records the role can see.
-                    ];
-                case 8:
+                ];
+            case 3:
+                // 1. Create a role with broad read access but NO fieldRedactions.
+                //    This is the realistic "regular user with read access" condition
+                //    that triggers the bypass in the pre-fix handler.
+                _b.sent();
+                // 2. Assign role to this tenant's own non-admin user and re-authenticate so the new
+                //    session reflects the role's permissions.
+                return [4 /*yield*/, sdk_1.api.users.updateOne(nonAdmin_1.id, { roles: [roleName] }, { replaceObjectFields: true })];
+            case 4:
+                // 2. Assign role to this tenant's own non-admin user and re-authenticate so the new
+                //    session reflects the role's permissions.
+                _b.sent();
+                return [4 /*yield*/, wait(undefined, 1500)];
+            case 5:
+                _b.sent();
+                return [4 /*yield*/, sdkNonAdmin.authenticate(nonAdmin_1.email, nonAdmin_1.password)
+                    // 2b. Seed a real `linkedAccountAccess` entry on the ADMIN's user record, so coverage B below
+                    //     can actually fail. A verbatim port asserted "no other user's record carries the field",
+                    //     which on a fresh tenant no record carries anyway — it passed even with applyRedactions'
+                    //     owner-only branch deleted.
+                    //
+                    //     The entry is written by request_linked_account_access, which needs account switching
+                    //     enabled on both the actor's and the target's org (here, the one tenant org), and lands
+                    //     the requester's snapshot on the TARGET's record — hence the non-admin requesting access
+                    //     to the admin. The handler writes raw through getDB() and leaves no data_sync_record, so
+                    //     the admin then touches its own record through the SDK to produce one.
+                ];
+            case 6:
+                _b.sent();
+                // 2b. Seed a real `linkedAccountAccess` entry on the ADMIN's user record, so coverage B below
+                //     can actually fail. A verbatim port asserted "no other user's record carries the field",
+                //     which on a fresh tenant no record carries anyway — it passed even with applyRedactions'
+                //     owner-only branch deleted.
+                //
+                //     The entry is written by request_linked_account_access, which needs account switching
+                //     enabled on both the actor's and the target's org (here, the one tenant org), and lands
+                //     the requester's snapshot on the TARGET's record — hence the non-admin requesting access
+                //     to the admin. The handler writes raw through getDB() and leaves no data_sync_record, so
+                //     the admin then touches its own record through the SDK to produce one.
+                return [4 /*yield*/, sdk_1.api.organizations.updateOne(tenant.businessId, { accountSwitchingEnabled: true })];
+            case 7:
+                // 2b. Seed a real `linkedAccountAccess` entry on the ADMIN's user record, so coverage B below
+                //     can actually fail. A verbatim port asserted "no other user's record carries the field",
+                //     which on a fresh tenant no record carries anyway — it passed even with applyRedactions'
+                //     owner-only branch deleted.
+                //
+                //     The entry is written by request_linked_account_access, which needs account switching
+                //     enabled on both the actor's and the target's org (here, the one tenant org), and lands
+                //     the requester's snapshot on the TARGET's record — hence the non-admin requesting access
+                //     to the admin. The handler writes raw through getDB() and leaves no data_sync_record, so
+                //     the admin then touches its own record through the SDK to produce one.
+                _b.sent();
+                return [4 /*yield*/, sdkNonAdmin.api.users.request_linked_account_access({ targetEmail: admin_1.email })];
+            case 8:
+                _b.sent();
+                return [4 /*yield*/, sdk_1.api.users.updateOne(admin_1.id, { fname: 'DataSyncAdmin' })
+                    // The handler answers `{}` on every rejection path (enumeration safety), so the only way to
+                    // know the seed landed is to read it back as the record's owner — the one session
+                    // applyRedactions does not strip the field from. Without this the coverage-B check below is
+                    // vacuous, so a missing field is a FAIL here rather than a silent no-op.
+                ];
+            case 9:
+                _b.sent();
+                // The handler answers `{}` on every rejection path (enumeration safety), so the only way to
+                // know the seed landed is to read it back as the record's owner — the one session
+                // applyRedactions does not strip the field from. Without this the coverage-B check below is
+                // vacuous, so a missing field is a FAIL here rather than a silent no-op.
+                return [4 /*yield*/, expect_result("fixture: linkedAccountAccess is seeded on the admin's user record (owner read)", function () { return sdk_1.api.users.getOne(admin_1.id); }, function (u) { var _a; return ((_a = u.linkedAccountAccess) !== null && _a !== void 0 ? _a : []).some(function (e) { return (e === null || e === void 0 ? void 0 : e.userId) === nonAdmin_1.id; }); })
+                    // 3. Create a test enduser and set a password — this populates
+                    //    `hashedPassword` on the enduser record and writes a data_sync_records
+                    //    row for it.
+                ];
+            case 10:
+                // The handler answers `{}` on every rejection path (enumeration safety), so the only way to
+                // know the seed landed is to read it back as the record's owner — the one session
+                // applyRedactions does not strip the field from. Without this the coverage-B check below is
+                // vacuous, so a missing field is a FAIL here rather than a silent no-op.
+                _b.sent();
+                return [4 /*yield*/, sdk_1.api.endusers.createOne({
+                        fname: 'F0001Target',
+                        lname: 'Patient',
+                        email: "f0001-target-".concat(Date.now(), "@example.com"),
+                    })];
+            case 11:
+                testEnduser = _b.sent();
+                return [4 /*yield*/, sdk_1.api.endusers.set_password({ id: testEnduser.id, password: 'F0001TestPassword!123' })
                     // The non-admin user's own `hashedPass` is set from login and refreshed
                     // on every write to their user record (e.g., the role-assignment update
                     // above). No extra setup needed for users.hashedPass to be in the stream.
-                    _f.sent();
-                    return [4 /*yield*/, sdkNonAdmin.sync({ from: new Date(0) })
-                        // 5. Walk every record. Fail if any contains a `redactions: ['all']` field.
-                    ];
-                case 9:
-                    sync_1 = _f.sent();
-                    violations_1 = collectViolations(sync_1.results);
-                    userRecordsInStream_1 = sync_1.results.filter(function (r) { return r.modelName === 'users'; }).length;
-                    return [4 /*yield*/, async_test("guard: /v1/data-sync sync stream contains at least one user record", function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
-                            return [2 /*return*/, ({ userRecords: userRecordsInStream_1, totalRecords: sync_1.results.length })];
-                        }); }); }, { onResult: function (r) { return r.userRecords >= 1; } })];
-                case 10:
-                    _f.sent();
-                    return [4 /*yield*/, async_test("/v1/data-sync must NOT return hashedPass / hashedPassword / hashedInviteCode", function () { return __awaiter(void 0, void 0, void 0, function () {
-                            return __generator(this, function (_a) {
-                                return [2 /*return*/, ({
-                                        violationCount: violations_1.length,
-                                        violations: violations_1.slice(0, 10),
-                                        affectedModels: Array.from(new Set(violations_1.map(function (v) { return v.modelName; }))),
-                                        affectedFields: Array.from(new Set(violations_1.map(function (v) { return v.leakedField; }))),
-                                    })];
-                            });
-                        }); }, { onResult: function (r) { return r.violationCount === 0; } })
-                        // ========================================================================
-                        // Additional coverage for applyRedactions code paths reachable via /v1/data-sync.
-                        // Each of these is a distinct branch in applyRedactions (routing.ts:1165-1238)
-                        // and could regress independently of this fix.
-                        // ========================================================================
-                        // Case A: schema-level `redactions: ['all']` must apply to ADMIN sessions too.
-                        // Admins have no session.fieldRedactions, but `redactions: ['all']` is universal.
-                        // Pre-fix: admin saw hashedPass via data-sync because applyRedactions was skipped entirely.
-                        // Post-fix: applyRedactions always runs and `redactions: ['all']` strips for everyone.
-                    ];
-                case 11:
-                    _f.sent();
-                    return [4 /*yield*/, sdk.sync({ from: new Date(0) })];
-                case 12:
-                    adminSync = _f.sent();
-                    adminViolations_1 = collectViolations(adminSync.results);
-                    return [4 /*yield*/, async_test("coverage A: admin /v1/data-sync also strips redactions:['all'] fields (hashedPass etc.)", function () { return __awaiter(void 0, void 0, void 0, function () {
-                            return __generator(this, function (_a) {
-                                return [2 /*return*/, ({
-                                        violationCount: adminViolations_1.length,
-                                        violations: adminViolations_1.slice(0, 10),
-                                    })];
-                            });
-                        }); }, { onResult: function (r) { return r.violationCount === 0; } })
-                        // Case B: `linkedAccountAccess` on users must be stripped when the caller is NOT
-                        // the record's owner. This is a separate branch in applyRedactions (routing.ts:1220-1225)
-                        // and protects against cross-user enumeration of who-requested-access-to-whom.
-                        // The non-admin user reads other user records via data-sync; if any of those
-                        // records have linkedAccountAccess set, it must be stripped on read.
-                    ];
-                case 13:
-                    _f.sent();
-                    otherUsersInStream_2 = sync_1.results.filter(function (r) { return r.modelName === 'users' && r.recordId !== sdkNonAdmin.userInfo.id; });
-                    linkedAccountLeaks_1 = [];
-                    for (_i = 0, otherUsersInStream_1 = otherUsersInStream_2; _i < otherUsersInStream_1.length; _i++) {
-                        record = otherUsersInStream_1[_i];
-                        if (!record.data || record.data === 'deleted')
-                            continue;
-                        try {
-                            parsed = JSON.parse(record.data);
-                            if ('linkedAccountAccess' in parsed && parsed.linkedAccountAccess !== undefined) {
-                                linkedAccountLeaks_1.push({ recordId: record.recordId });
-                            }
+                ];
+            case 12:
+                _b.sent();
+                // The non-admin user's own `hashedPass` is set from login and refreshed
+                // on every write to their user record (e.g., the role-assignment update
+                // above). No extra setup needed for users.hashedPass to be in the stream.
+                return [4 /*yield*/, wait(undefined, 500)
+                    // 4. As the non-admin, call /v1/data-sync from epoch zero to capture all
+                    //    sync records the role can see.
+                ];
+            case 13:
+                // The non-admin user's own `hashedPass` is set from login and refreshed
+                // on every write to their user record (e.g., the role-assignment update
+                // above). No extra setup needed for users.hashedPass to be in the stream.
+                _b.sent();
+                return [4 /*yield*/, sdkNonAdmin.sync({ from: new Date(0) })
+                    // 5. Walk every record. Fail if any contains a `redactions: ['all']` field.
+                ];
+            case 14:
+                sync_1 = _b.sent();
+                violations_1 = collectViolations(sync_1.results);
+                userRecordsInStream_1 = sync_1.results.filter(function (r) { return r.modelName === 'users'; }).length;
+                return [4 /*yield*/, expect_result("guard: /v1/data-sync sync stream contains at least one user record", function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+                        return [2 /*return*/, ({ userRecords: userRecordsInStream_1, totalRecords: sync_1.results.length })];
+                    }); }); }, function (r) { return r.userRecords >= 1; })];
+            case 15:
+                _b.sent();
+                return [4 /*yield*/, expect_result("/v1/data-sync must NOT return hashedPass / hashedPassword / hashedInviteCode", function () { return __awaiter(void 0, void 0, void 0, function () {
+                        return __generator(this, function (_a) {
+                            return [2 /*return*/, ({
+                                    violationCount: violations_1.length,
+                                    violations: violations_1.slice(0, 10),
+                                    affectedModels: Array.from(new Set(violations_1.map(function (v) { return v.modelName; }))),
+                                    affectedFields: Array.from(new Set(violations_1.map(function (v) { return v.leakedField; }))),
+                                })];
+                        });
+                    }); }, function (r) { return r.violationCount === 0; })
+                    // ========================================================================
+                    // Additional coverage for applyRedactions code paths reachable via /v1/data-sync.
+                    // Each of these is a distinct branch in applyRedactions (routing.ts:1165-1238)
+                    // and could regress independently of this fix.
+                    // ========================================================================
+                    // Case A: schema-level `redactions: ['all']` must apply to ADMIN sessions too.
+                    // Admins have no session.fieldRedactions, but `redactions: ['all']` is universal.
+                    // Pre-fix: admin saw hashedPass via data-sync because applyRedactions was skipped entirely.
+                    // Post-fix: applyRedactions always runs and `redactions: ['all']` strips for everyone.
+                ];
+            case 16:
+                _b.sent();
+                return [4 /*yield*/, sdk_1.sync({ from: new Date(0) })];
+            case 17:
+                adminSync = _b.sent();
+                adminViolations_1 = collectViolations(adminSync.results);
+                return [4 /*yield*/, expect_result("coverage A: admin /v1/data-sync also strips redactions:['all'] fields (hashedPass etc.)", function () { return __awaiter(void 0, void 0, void 0, function () {
+                        return __generator(this, function (_a) {
+                            return [2 /*return*/, ({
+                                    violationCount: adminViolations_1.length,
+                                    violations: adminViolations_1.slice(0, 10),
+                                })];
+                        });
+                    }); }, function (r) { return r.violationCount === 0; })
+                    // Case B: `linkedAccountAccess` on users must be stripped when the caller is NOT
+                    // the record's owner. This is a separate branch in applyRedactions (routing.ts:1220-1225)
+                    // and protects against cross-user enumeration of who-requested-access-to-whom.
+                    // The non-admin user reads other user records via data-sync; if any of those
+                    // records have linkedAccountAccess set, it must be stripped on read.
+                    // The admin's record genuinely carries the field (seeded in 2b), so deleting the owner-only
+                    // branch turns this check red.
+                ];
+            case 18:
+                _b.sent();
+                otherUsersInStream_2 = sync_1.results.filter(function (r) { return r.modelName === 'users' && r.recordId !== nonAdmin_1.id; });
+                linkedAccountLeaks_1 = [];
+                for (_i = 0, otherUsersInStream_1 = otherUsersInStream_2; _i < otherUsersInStream_1.length; _i++) {
+                    syncRecord = otherUsersInStream_1[_i];
+                    if (!syncRecord.data || syncRecord.data === 'deleted')
+                        continue;
+                    try {
+                        parsed = JSON.parse(syncRecord.data);
+                        if ('linkedAccountAccess' in parsed && parsed.linkedAccountAccess !== undefined) {
+                            linkedAccountLeaks_1.push({ recordId: syncRecord.recordId });
                         }
-                        catch (_g) { }
                     }
-                    return [4 /*yield*/, async_test("coverage B: /v1/data-sync strips linkedAccountAccess from other users' records", function () { return __awaiter(void 0, void 0, void 0, function () {
-                            return __generator(this, function (_a) {
-                                return [2 /*return*/, ({
-                                        otherUserRecords: otherUsersInStream_2.length,
-                                        leakCount: linkedAccountLeaks_1.length,
-                                        leaks: linkedAccountLeaks_1.slice(0, 5),
-                                    })];
-                            });
-                        }); }, { onResult: function (r) { return r.leakCount === 0; } })];
-                case 14:
-                    _f.sent();
-                    return [3 /*break*/, 32];
-                case 15:
-                    _f.trys.push([15, 17, , 18]);
-                    return [4 /*yield*/, sdk.api.users.updateOne(sdkNonAdmin.userInfo.id, { roles: originalRoles !== null && originalRoles !== void 0 ? originalRoles : [] }, { replaceObjectFields: true })];
-                case 16:
-                    _f.sent();
-                    return [3 /*break*/, 18];
-                case 17:
-                    _b = _f.sent();
-                    return [3 /*break*/, 18];
-                case 18:
-                    if (!rbapId) return [3 /*break*/, 22];
-                    _f.label = 19;
-                case 19:
-                    _f.trys.push([19, 21, , 22]);
-                    return [4 /*yield*/, sdk.api.role_based_access_permissions.deleteOne(rbapId)];
-                case 20:
-                    _f.sent();
-                    return [3 /*break*/, 22];
-                case 21:
-                    _c = _f.sent();
-                    return [3 /*break*/, 22];
-                case 22:
-                    if (!testEnduserId) return [3 /*break*/, 26];
-                    _f.label = 23;
-                case 23:
-                    _f.trys.push([23, 25, , 26]);
-                    return [4 /*yield*/, sdk.api.endusers.deleteOne(testEnduserId)];
-                case 24:
-                    _f.sent();
-                    return [3 /*break*/, 26];
-                case 25:
-                    _d = _f.sent();
-                    return [3 /*break*/, 26];
-                case 26: 
-                // Re-authenticate the non-admin to drop the exploit role from their JWT
-                // before subsequent tests run.
-                // Role restore above re-triggers deauthenticate_user; wait > 1s so the freshly minted
-                // token's (second-floored) iat lands after the deauth timestamp and isn't permanently
-                // rejected by is_logged_in's iat-slack check. Matches the in-test re-auth above.
-                return [4 /*yield*/, wait(undefined, 1500)];
-                case 27:
-                    // Re-authenticate the non-admin to drop the exploit role from their JWT
-                    // before subsequent tests run.
-                    // Role restore above re-triggers deauthenticate_user; wait > 1s so the freshly minted
-                    // token's (second-floored) iat lands after the deauth timestamp and isn't permanently
-                    // rejected by is_logged_in's iat-slack check. Matches the in-test re-auth above.
-                    _f.sent();
-                    _f.label = 28;
-                case 28:
-                    _f.trys.push([28, 30, , 31]);
-                    return [4 /*yield*/, sdkNonAdmin.authenticate(nonAdminEmail, nonAdminPassword)];
-                case 29:
-                    _f.sent();
-                    return [3 /*break*/, 31];
-                case 30:
-                    _e = _f.sent();
-                    return [3 /*break*/, 31];
-                case 31: return [7 /*endfinally*/];
-                case 32: return [2 /*return*/];
-            }
-        });
+                    catch (_c) { }
+                }
+                return [4 /*yield*/, expect_result("coverage B: /v1/data-sync strips linkedAccountAccess from other users' records", function () { return __awaiter(void 0, void 0, void 0, function () {
+                        return __generator(this, function (_a) {
+                            return [2 /*return*/, ({
+                                    otherUserRecords: otherUsersInStream_2.length,
+                                    adminRecordInStream: otherUsersInStream_2.some(function (r) { return r.recordId === admin_1.id; }),
+                                    leakCount: linkedAccountLeaks_1.length,
+                                    leaks: linkedAccountLeaks_1.slice(0, 5),
+                                })];
+                        });
+                    }); }, 
+                    // The seeded admin record must be in the stream, or there is nothing to strip and the check
+                    // proves nothing.
+                    function (r) { return r.adminRecordInStream && r.leakCount === 0; })];
+            case 19:
+                _b.sent();
+                return [3 /*break*/, 25];
+            case 20:
+                if (!tenant) return [3 /*break*/, 24];
+                _b.label = 21;
+            case 21:
+                _b.trys.push([21, 23, , 24]);
+                return [4 /*yield*/, tenant.teardown()];
+            case 22:
+                _b.sent();
+                return [3 /*break*/, 24];
+            case 23:
+                e_1 = _b.sent();
+                console.error('teardown failed', e_1);
+                return [3 /*break*/, 24];
+            case 24: return [7 /*endfinally*/];
+            case 25: return [2 /*return*/, checks];
+        }
     });
+}); };
+/** Asserting wrapper, for standalone runs. */
+export var data_sync_redaction_bypass_tests = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var _a, _b;
+    return __generator(this, function (_c) {
+        switch (_c.label) {
+            case 0:
+                _a = assert_checks;
+                _b = ['data-sync field-redaction bypass'];
+                return [4 /*yield*/, data_sync_redaction_bypass_checks()];
+            case 1:
+                _a.apply(void 0, _b.concat([_c.sent()]));
+                return [2 /*return*/];
+        }
+    });
+}); };
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export var ISOLATED_SUITE = {
+    name: 'data-sync field-redaction bypass',
+    run: data_sync_redaction_bypass_checks,
 };
 // Allow running this test file independently
 if (require.main === module) {
     console.log("\uD83C\uDF10 Using API URL: ".concat(host));
-    var sdk_1 = new Session({ host: host });
-    var sdkNonAdmin_1 = new Session({ host: host });
-    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
-        return __generator(this, function (_a) {
-            switch (_a.label) {
-                case 0: return [4 /*yield*/, setup_tests(sdk_1, sdkNonAdmin_1)];
-                case 1:
-                    _a.sent();
-                    return [4 /*yield*/, data_sync_redaction_bypass_tests({ sdk: sdk_1, sdkNonAdmin: sdkNonAdmin_1 })];
-                case 2:
-                    _a.sent();
-                    return [2 /*return*/];
-            }
-        });
-    }); };
-    runTests()
+    data_sync_redaction_bypass_tests()
         .then(function () {
         console.log("✅ data-sync redaction-bypass test suite completed successfully");
         process.exit(0);

package/lib/esm/tests/api_tests/security/data-sync-redaction-bypass.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"data-sync-redaction-bypass.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/data-sync-redaction-bypass.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EACL,UAAU,EACV,UAAU,EACV,IAAI,GACL,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AAE5D,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAC9D,IAAA,KAAoC,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAhG,aAAa,QAAA,EAAE,gBAAgB,QAAiE,CAAA;AAEvG,IAAM,WAAW,GAAG,EAAE,MAAM,EAAE,KAAc,EAAE,IAAI,EAAE,KAAc,EAAE,MAAM,EAAE,KAAc,EAAE,MAAM,EAAE,KAAc,EAAE,CAAA;AAEpH,uEAAuE;AACvE,qEAAqE;AACrE,IAAM,0BAA0B,GAA6B;IAC3D,KAAK,EAAK,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAC5C,QAAQ,EAAE,CAAC,gBAAgB,CAAC;CAC7B,CAAA;AAID,IAAM,iBAAiB,GAAG,UAAC,OAAgE;IACzF,IAAM,UAAU,GAAgB,EAAE,CAAA;IAClC,KAAqB,UAAO,EAAP,mBAAO,EAAP,qBAAO,EAAP,IAAO,EAAE;QAAzB,IAAM,MAAM,gBAAA;QACf,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;YAAE,SAAQ;QACvD,IAAM,MAAM,GAAG,0BAA0B,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC3D,IAAI,CAAC,MAAM;YAAE,SAAQ;QACrB,IAAI,MAAM,SAAK,CAAA;QACf,IAAI;YAAE,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;SAAE;QAAC,WAAM;YAAE,SAAQ;SAAE;QAC3D,KAAgB,UAAM,EAAN,iBAAM,EAAN,oBAAM,EAAN,IAAM,EAAE;YAAnB,IAAM,CAAC,eAAA;YACV,IAAI,CAAC,IAAI,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE;gBACpF,UAAU,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAA;aAC5F;SACF;KACF;IACD,OAAO,UAAU,CAAA;AACnB,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,IAAM,gCAAgC,GAAG,UAAO,EAA6D;QAA3D,GAAG,SAAA,EAAE,WAAW,iBAAA;;;;;;oBACvE,UAAU,CAAC,iDAAiD,CAAC,CAAA;oBAEvD,QAAQ,GAAG,iCAA0B,IAAI,CAAC,GAAG,EAAE,CAAE,CAAA;oBAGjD,aAAa,GAAG,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAA;;;;oBAMjC,qBAAM,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,SAAS,CAAC;4BACjE,IAAI,EAAE,QAAQ;4BACd,WAAW,wBACN,oBAAoB,KACvB,KAAK,EAAE,WAAW,EAClB,QAAQ,EAAE,WAAW,GACtB;4BACD,oEAAoE;yBACrE,CAAC,EAAA;;oBARI,IAAI,GAAG,SAQX;oBACF,MAAM,GAAG,IAAI,CAAC,EAAE,CAAA;oBAEhB,sEAAsE;oBACtE,8CAA8C;oBAC9C,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAC3B,WAAW,CAAC,QAAQ,CAAC,EAAE,EACvB,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,EACrB,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAC9B,EAAA;;oBAND,sEAAsE;oBACtE,8CAA8C;oBAC9C,SAIC,CAAA;oBACD,qBAAM,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAA;;oBAA3B,SAA2B,CAAA;oBAC3B,qBAAM,WAAW,CAAC,YAAY,CAAC,aAAc,EAAE,gBAAiB,CAAC;wBAEjE,+DAA+D;wBAC/D,2EAA2E;wBAC3E,iBAAiB;sBAJgD;;oBAAjE,SAAiE,CAAA;oBAK7C,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;4BACnD,KAAK,EAAE,aAAa;4BACpB,KAAK,EAAE,SAAS;4BAChB,KAAK,EAAE,uBAAgB,IAAI,CAAC,GAAG,EAAE,iBAAc;yBAChD,CAAC,EAAA;;oBAJI,WAAW,GAAG,SAIlB;oBACF,aAAa,GAAG,WAAW,CAAC,EAAE,CAAA;oBAC9B,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,uBAAuB,EAAE,CAAC;wBAE9F,wEAAwE;wBACxE,wEAAwE;wBACxE,0EAA0E;sBAJoB;;oBAA9F,SAA8F,CAAA;oBAE9F,wEAAwE;oBACxE,wEAAwE;oBACxE,0EAA0E;oBAE1E,qBAAM,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC;wBAE1B,yEAAyE;wBACzE,oCAAoC;sBAHV;;oBAJ1B,wEAAwE;oBACxE,wEAAwE;oBACxE,0EAA0E;oBAE1E,SAA0B,CAAA;oBAIb,qBAAM,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;wBAE1D,4EAA4E;sBAFlB;;oBAApD,SAAO,SAA6C;oBAGpD,eAAa,iBAAiB,CAAC,MAAI,CAAC,OAAO,CAAC,CAAA;oBAK5C,wBAAsB,MAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,SAAS,KAAK,OAAO,EAAvB,CAAuB,CAAC,CAAC,MAAM,CAAA;oBACpF,qBAAM,UAAU,CACd,oEAAoE,EACpE;4BAAY,sBAAA,CAAC,EAAE,WAAW,EAAE,qBAAmB,EAAE,YAAY,EAAE,MAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAA;iCAAA,EACrF,EAAE,QAAQ,EAAE,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,WAAW,IAAI,CAAC,EAAlB,CAAkB,EAAE,CACtC,EAAA;;oBAJD,SAIC,CAAA;oBAED,qBAAM,UAAU,CACd,8EAA8E,EAC9E;;gCAAY,sBAAA,CAAC;wCACX,cAAc,EAAE,YAAU,CAAC,MAAM;wCACjC,UAAU,EAAE,YAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;wCACnC,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,YAAU,CAAC,GAAG,CAAC,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,SAAS,EAAX,CAAW,CAAC,CAAC,CAAC;wCACrE,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,YAAU,CAAC,GAAG,CAAC,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,WAAW,EAAb,CAAa,CAAC,CAAC,CAAC;qCACxE,CAAC,EAAA;;6BAAA,EACF,EAAE,QAAQ,EAAE,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,cAAc,KAAK,CAAC,EAAtB,CAAsB,EAAE,CAC1C;wBAED,2EAA2E;wBAC3E,kFAAkF;wBAClF,+EAA+E;wBAC/E,+CAA+C;wBAC/C,2EAA2E;wBAE3E,+EAA+E;wBAC/E,kFAAkF;wBAClF,4FAA4F;wBAC5F,uFAAuF;sBAXtF;;oBATD,SASC,CAAA;oBAYiB,qBAAM,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAA;;oBAAjD,SAAS,GAAG,SAAqC;oBACjD,oBAAkB,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;oBAC5D,qBAAM,UAAU,CACd,yFAAyF,EACzF;;gCAAY,sBAAA,CAAC;wCACX,cAAc,EAAE,iBAAe,CAAC,MAAM;wCACtC,UAAU,EAAE,iBAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;qCACzC,CAAC,EAAA;;6BAAA,EACF,EAAE,QAAQ,EAAE,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,cAAc,KAAK,CAAC,EAAtB,CAAsB,EAAE,CAC1C;wBAED,iFAAiF;wBACjF,0FAA0F;wBAC1F,+EAA+E;wBAC/E,6EAA6E;wBAC7E,qEAAqE;sBANpE;;oBAPD,SAOC,CAAA;oBAOK,uBAAqB,MAAI,CAAC,OAAO,CAAC,MAAM,CAC5C,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,SAAS,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAjE,CAAiE,CACvE,CAAA;oBACK,uBAA6C,EAAE,CAAA;oBACrD,WAAuC,EAAlB,uBAAA,oBAAkB,EAAlB,gCAAkB,EAAlB,IAAkB,EAAE;wBAA9B,MAAM;wBACf,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;4BAAE,SAAQ;wBACvD,IAAI;4BACI,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;4BACtC,IAAI,qBAAqB,IAAI,MAAM,IAAI,MAAM,CAAC,mBAAmB,KAAK,SAAS,EAAE;gCAC/E,oBAAkB,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAA;6BACvD;yBACF;wBAAC,WAAM,GAAE;qBACX;oBACD,qBAAM,UAAU,CACd,gFAAgF,EAChF;;gCAAY,sBAAA,CAAC;wCACX,gBAAgB,EAAE,oBAAkB,CAAC,MAAM;wCAC3C,SAAS,EAAE,oBAAkB,CAAC,MAAM;wCACpC,KAAK,EAAE,oBAAkB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;qCACtC,CAAC,EAAA;;6BAAA,EACF,EAAE,QAAQ,EAAE,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,SAAS,KAAK,CAAC,EAAjB,CAAiB,EAAE,CACrC,EAAA;;oBARD,SAQC,CAAA;;;;oBAIC,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAC3B,WAAW,CAAC,QAAQ,CAAC,EAAE,EACvB,EAAE,KAAK,EAAE,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,EAAE,EAAE,EAC9B,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAC9B,EAAA;;oBAJD,SAIC,CAAA;;;;;;yBAEC,MAAM,EAAN,yBAAM;;;;oBACF,qBAAM,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,SAAS,CAAC,MAAM,CAAC,EAAA;;oBAA7D,SAA6D,CAAA;;;;;;yBAEjE,aAAa,EAAb,yBAAa;;;;oBACT,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,aAAa,CAAC,EAAA;;oBAA/C,SAA+C,CAAA;;;;;;gBAEvD,wEAAwE;gBACxE,+BAA+B;gBAC/B,sFAAsF;gBACtF,sFAAsF;gBACtF,iFAAiF;gBACjF,qBAAM,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAA;;oBAL3B,wEAAwE;oBACxE,+BAA+B;oBAC/B,sFAAsF;oBACtF,sFAAsF;oBACtF,iFAAiF;oBACjF,SAA2B,CAAA;;;;oBACrB,qBAAM,WAAW,CAAC,YAAY,CAAC,aAAc,EAAE,gBAAiB,CAAC,EAAA;;oBAAjE,SAAiE,CAAA;;;;;;;;;;CAE1E,CAAA;AAED,6CAA6C;AAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAM,KAAG,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACjC,IAAM,aAAW,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IAEzC,IAAM,QAAQ,GAAG;;;wBACf,qBAAM,WAAW,CAAC,KAAG,EAAE,aAAW,CAAC,EAAA;;oBAAnC,SAAmC,CAAA;oBACnC,qBAAM,gCAAgC,CAAC,EAAE,GAAG,OAAA,EAAE,WAAW,eAAA,EAAE,CAAC,EAAA;;oBAA5D,SAA4D,CAAA;;;;SAC7D,CAAA;IAED,QAAQ,EAAE;SACP,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAA;QAC7E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,iDAAiD,EAAE,KAAK,CAAC,CAAA;QACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}
+{"version":3,"file":"data-sync-redaction-bypass.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/data-sync-redaction-bypass.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,OAAO,EACL,IAAI,GACL,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,aAAa,EAGb,qBAAqB,GACtB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AAE5D,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE,IAAM,IAAI,GAAG,cAAM,OAAA,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAvC,CAAuC,CAAA;AAE1D,IAAM,WAAW,GAAG,EAAE,MAAM,EAAE,KAAc,EAAE,IAAI,EAAE,KAAc,EAAE,MAAM,EAAE,KAAc,EAAE,MAAM,EAAE,KAAc,EAAE,CAAA;AAEpH,uEAAuE;AACvE,qEAAqE;AACrE,IAAM,0BAA0B,GAA6B;IAC3D,KAAK,EAAK,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAC5C,QAAQ,EAAE,CAAC,gBAAgB,CAAC;CAC7B,CAAA;AAID,IAAM,iBAAiB,GAAG,UAAC,OAAgE;IACzF,IAAM,UAAU,GAAgB,EAAE,CAAA;IAClC,KAAqB,UAAO,EAAP,mBAAO,EAAP,qBAAO,EAAP,IAAO,EAAE;QAAzB,IAAM,MAAM,gBAAA;QACf,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;YAAE,SAAQ;QACvD,IAAM,MAAM,GAAG,0BAA0B,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC3D,IAAI,CAAC,MAAM;YAAE,SAAQ;QACrB,IAAI,MAAM,SAAK,CAAA;QACf,IAAI;YAAE,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;SAAE;QAAC,WAAM;YAAE,SAAQ;SAAE;QAC3D,KAAgB,UAAM,EAAN,iBAAM,EAAN,oBAAM,EAAN,IAAM,EAAE;YAAnB,IAAM,CAAC,eAAA;YACV,IAAI,CAAC,IAAI,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE;gBACpF,UAAU,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAA;aAC5F;SACF;KACF;IACD,OAAO,UAAU,CAAA;AACnB,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,IAAM,iCAAiC,GAAG;;;;;gBACzC,MAAM,GAAY,EAAE,CAAA;gBACpB,MAAM,GAAG,UAAC,KAAa,EAAE,IAAa,EAAE,MAAc,IAAK,OAAA,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,OAAA,EAAE,IAAI,MAAA,EAAE,MAAM,QAAA,EAAE,CAAC,EAApC,CAAoC,CAAA;gBAI/F,QAAQ,GAAG,UAAC,KAAU;oBAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;wBAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;oBAC/D,IAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;oBACzC,OAAO,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAA;gBAChE,CAAC,CAAA;gBACK,YAAY,GAAG,UAAC,CAAM,IAAa,OAAA,CACvC,OAAO,CAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,CAAA,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAC7E,EAFwC,CAExC,CAAA;gBAUK,aAAa,GAAG,UAAW,KAAa,EAAE,EAAoB,EAAE,QAA2B;;;;;;;;gCAGzE,qBAAM,EAAE,EAAE,EAAA;;gCAA9B,QAAQ,IAAK,QAAK,GAAE,SAAU,KAAE,CAAA;;;;gCAEhC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,yCAAkC,YAAY,CAAC,GAAC,CAAC,CAAE,CAAC,CAAA;gCACzE,sBAAM;;gCAGA,KAAK,GAAK,QAAQ,MAAb,CAAa;gCAC1B,IAAI;oCACF,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,iBAAU,QAAQ,CAAC,KAAK,CAAC,CAAE,CAAC,CAAA;iCAC5D;gCAAC,OAAO,cAAmB,EAAE;oCAC5B,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,oCAA6B,QAAQ,CAAC,KAAK,CAAC,eAAK,YAAY,CAAC,cAAc,CAAC,CAAE,CAAC,CAAA;iCACtG;;;;qBACF,CAAA;gBAEK,QAAQ,GAAG,iCAA0B,IAAI,EAAE,CAAE,CAAA;;;;gBAKxC,qBAAM,qBAAqB,CAAC;wBACnC,IAAI,EAAE,oCAA6B,IAAI,EAAE,CAAE;wBAC3C,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;wBACpD,OAAO,EAAE,CAAC;qBACX,CAAC,EAAA;;gBAJF,MAAM,GAAG,SAIP,CAAA;gBACM,QAAqB,MAAM,IAAxB,EAAE,WAAW,GAAK,MAAM,YAAX,CAAW;gBAC7B,KAAoB,MAAM,CAAC,KAAK,EAA/B,eAAK,EAAE,kBAAQ,CAAgB;gBAEtC,kEAAkE;gBAClE,qEAAqE;gBACrE,sDAAsD;gBACtD,qBAAM,KAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,SAAS,CAAC;wBACpD,IAAI,EAAE,QAAQ;wBACd,WAAW,wBACN,oBAAoB,KACvB,KAAK,EAAE,WAAW,EAClB,QAAQ,EAAE,WAAW,GACtB;wBACD,oEAAoE;qBACrE,CAAC;oBAEF,oFAAoF;oBACpF,8CAA8C;kBAH5C;;gBAXF,kEAAkE;gBAClE,qEAAqE;gBACrE,sDAAsD;gBACtD,SAQE,CAAA;gBAEF,oFAAoF;gBACpF,8CAA8C;gBAC9C,qBAAM,KAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAC3B,UAAQ,CAAC,EAAE,EACX,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,EACrB,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAC9B,EAAA;;gBAND,oFAAoF;gBACpF,8CAA8C;gBAC9C,SAIC,CAAA;gBACD,qBAAM,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAA;;gBAA3B,SAA2B,CAAA;gBAC3B,qBAAM,WAAW,CAAC,YAAY,CAAC,UAAQ,CAAC,KAAK,EAAE,UAAQ,CAAC,QAAQ,CAAC;oBAEjE,8FAA8F;oBAC9F,8FAA8F;oBAC9F,8FAA8F;oBAC9F,iCAAiC;oBACjC,EAAE;oBACF,2FAA2F;oBAC3F,6FAA6F;oBAC7F,8FAA8F;oBAC9F,8FAA8F;oBAC9F,4EAA4E;kBAXX;;gBAAjE,SAAiE,CAAA;gBAEjE,8FAA8F;gBAC9F,8FAA8F;gBAC9F,8FAA8F;gBAC9F,iCAAiC;gBACjC,EAAE;gBACF,2FAA2F;gBAC3F,6FAA6F;gBAC7F,8FAA8F;gBAC9F,8FAA8F;gBAC9F,4EAA4E;gBAC5E,qBAAM,KAAG,CAAC,GAAG,CAAC,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,EAAA;;gBAV3F,8FAA8F;gBAC9F,8FAA8F;gBAC9F,8FAA8F;gBAC9F,iCAAiC;gBACjC,EAAE;gBACF,2FAA2F;gBAC3F,6FAA6F;gBAC7F,8FAA8F;gBAC9F,8FAA8F;gBAC9F,4EAA4E;gBAC5E,SAA2F,CAAA;gBAC3F,qBAAM,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,6BAA6B,CAAC,EAAE,WAAW,EAAE,OAAK,CAAC,KAAK,EAAE,CAAC,EAAA;;gBAAvF,SAAuF,CAAA;gBACvF,qBAAM,KAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,OAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;oBAEnE,4FAA4F;oBAC5F,kFAAkF;oBAClF,4FAA4F;oBAC5F,yEAAyE;kBALN;;gBAAnE,SAAmE,CAAA;gBAEnE,4FAA4F;gBAC5F,kFAAkF;gBAClF,4FAA4F;gBAC5F,yEAAyE;gBACzE,qBAAM,aAAa,CACjB,gFAAgF,EAChF,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,OAAK,CAAC,EAAE,CAAC,EAA9B,CAA8B,EACpC,UAAA,CAAC,YAAI,OAAA,CAAC,MAAC,CAAS,CAAC,mBAAmB,mCAAI,EAAE,CAAC,CAAC,IAAI,CAAC,UAAC,CAAM,IAAK,OAAA,CAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,MAAM,MAAK,UAAQ,CAAC,EAAE,EAAzB,CAAyB,CAAC,CAAA,EAAA,CACxF;oBAED,+DAA+D;oBAC/D,2EAA2E;oBAC3E,iBAAiB;kBAJhB;;gBARD,4FAA4F;gBAC5F,kFAAkF;gBAClF,4FAA4F;gBAC5F,yEAAyE;gBACzE,SAIC,CAAA;gBAKmB,qBAAM,KAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;wBACnD,KAAK,EAAE,aAAa;wBACpB,KAAK,EAAE,SAAS;wBAChB,KAAK,EAAE,uBAAgB,IAAI,CAAC,GAAG,EAAE,iBAAc;qBAChD,CAAC,EAAA;;gBAJI,WAAW,GAAG,SAIlB;gBACF,qBAAM,KAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,uBAAuB,EAAE,CAAC;oBAE9F,wEAAwE;oBACxE,wEAAwE;oBACxE,0EAA0E;kBAJoB;;gBAA9F,SAA8F,CAAA;gBAE9F,wEAAwE;gBACxE,wEAAwE;gBACxE,0EAA0E;gBAE1E,qBAAM,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC;oBAE1B,yEAAyE;oBACzE,oCAAoC;kBAHV;;gBAJ1B,wEAAwE;gBACxE,wEAAwE;gBACxE,0EAA0E;gBAE1E,SAA0B,CAAA;gBAIb,qBAAM,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;oBAE1D,4EAA4E;kBAFlB;;gBAApD,SAAO,SAA6C;gBAGpD,eAAa,iBAAiB,CAAC,MAAI,CAAC,OAAO,CAAC,CAAA;gBAK5C,wBAAsB,MAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,SAAS,KAAK,OAAO,EAAvB,CAAuB,CAAC,CAAC,MAAM,CAAA;gBACpF,qBAAM,aAAa,CACjB,oEAAoE,EACpE;wBAAY,sBAAA,CAAC,EAAE,WAAW,EAAE,qBAAmB,EAAE,YAAY,EAAE,MAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAA;6BAAA,EACrF,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,WAAW,IAAI,CAAC,EAAlB,CAAkB,CACxB,EAAA;;gBAJD,SAIC,CAAA;gBAED,qBAAM,aAAa,CACjB,8EAA8E,EAC9E;;4BAAY,sBAAA,CAAC;oCACX,cAAc,EAAE,YAAU,CAAC,MAAM;oCACjC,UAAU,EAAE,YAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;oCACnC,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,YAAU,CAAC,GAAG,CAAC,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,SAAS,EAAX,CAAW,CAAC,CAAC,CAAC;oCACrE,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,YAAU,CAAC,GAAG,CAAC,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,WAAW,EAAb,CAAa,CAAC,CAAC,CAAC;iCACxE,CAAC,EAAA;;yBAAA,EACF,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,cAAc,KAAK,CAAC,EAAtB,CAAsB,CAC5B;oBAED,2EAA2E;oBAC3E,kFAAkF;oBAClF,+EAA+E;oBAC/E,+CAA+C;oBAC/C,2EAA2E;oBAE3E,+EAA+E;oBAC/E,kFAAkF;oBAClF,4FAA4F;oBAC5F,uFAAuF;kBAXtF;;gBATD,SASC,CAAA;gBAYiB,qBAAM,KAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAA;;gBAAjD,SAAS,GAAG,SAAqC;gBACjD,oBAAkB,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;gBAC5D,qBAAM,aAAa,CACjB,yFAAyF,EACzF;;4BAAY,sBAAA,CAAC;oCACX,cAAc,EAAE,iBAAe,CAAC,MAAM;oCACtC,UAAU,EAAE,iBAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;iCACzC,CAAC,EAAA;;yBAAA,EACF,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,cAAc,KAAK,CAAC,EAAtB,CAAsB,CAC5B;oBAED,iFAAiF;oBACjF,0FAA0F;oBAC1F,+EAA+E;oBAC/E,6EAA6E;oBAC7E,qEAAqE;oBACrE,4FAA4F;oBAC5F,+BAA+B;kBAR9B;;gBAPD,SAOC,CAAA;gBASK,uBAAqB,MAAI,CAAC,OAAO,CAAC,MAAM,CAC5C,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,SAAS,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAQ,CAAC,EAAE,EAArD,CAAqD,CAC3D,CAAA;gBACK,uBAA6C,EAAE,CAAA;gBACrD,WAA2C,EAAlB,uBAAA,oBAAkB,EAAlB,gCAAkB,EAAlB,IAAkB,EAAE;oBAAlC,UAAU;oBACnB,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS;wBAAE,SAAQ;oBAC/D,IAAI;wBACI,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;wBAC1C,IAAI,qBAAqB,IAAI,MAAM,IAAI,MAAM,CAAC,mBAAmB,KAAK,SAAS,EAAE;4BAC/E,oBAAkB,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAA;yBAC3D;qBACF;oBAAC,WAAM,GAAE;iBACX;gBACD,qBAAM,aAAa,CACjB,gFAAgF,EAChF;;4BAAY,sBAAA,CAAC;oCACX,gBAAgB,EAAE,oBAAkB,CAAC,MAAM;oCAC3C,mBAAmB,EAAE,oBAAkB,CAAC,IAAI,CAAC,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,QAAQ,KAAK,OAAK,CAAC,EAAE,EAAvB,CAAuB,CAAC;oCAC1E,SAAS,EAAE,oBAAkB,CAAC,MAAM;oCACpC,KAAK,EAAE,oBAAkB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;iCACtC,CAAC,EAAA;;yBAAA;oBACF,4FAA4F;oBAC5F,kBAAkB;oBAClB,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,mBAAmB,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC,EAA1C,CAA0C,CAChD,EAAA;;gBAXD,SAWC,CAAA;;;qBAGG,MAAM,EAAN,yBAAM;;;;gBACF,qBAAM,MAAM,CAAC,QAAQ,EAAE,EAAA;;gBAAvB,SAAuB,CAAA;;;;gBAAe,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,GAAC,CAAC,CAAA;;;qBAInF,sBAAO,MAAM,EAAA;;;KACd,CAAA;AAED,8CAA8C;AAC9C,MAAM,CAAC,IAAM,gCAAgC,GAAG;;;;;gBAC9C,KAAA,aAAa,CAAA;sBAAC,kCAAkC;gBAAE,qBAAM,iCAAiC,EAAE,EAAA;;gBAA3F,4BAAkD,SAAyC,GAAC,CAAA;;;;KAC7F,CAAA;AAED,oGAAoG;AACpG,MAAM,CAAC,IAAM,cAAc,GAAkB;IAC3C,IAAI,EAAE,kCAAkC;IACxC,GAAG,EAAE,iCAAiC;CACvC,CAAA;AAED,6CAA6C;AAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,gCAAgC,EAAE;SAC/B,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAA;QAC7E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,iDAAiD,EAAE,KAAK,CAAC,CAAA;QACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}