@tellescope/sdk 2.0.0-beta.2 → 2.0.0-beta.3

package/lib/esm/tests/api_tests/security/handle-incoming-communication-cross-tenant.test.js

@@ -37,12 +37,9 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
 require('source-map-support').install();
 import axios from "axios";
 import { ObjectId } from 'bson';
-import { Session } from "../../../sdk";
-import { async_test, log_header, } from "@tellescope/testing";
-import { setup_tests } from "../../setup";
+import { assert_checks, setup_isolated_tenant, } from "../../setup_isolated";
 var host = process.env.API_URL || 'http://localhost:8080';
-var CROSS_ORG_API_KEY = process.env.CROSS_ORG_API_KEY;
-var CROSS_ORG_TARGET_BUSINESS_ID = process.env.CROSS_ORG_TARGET_BUSINESS_ID;
+var RAND = function () { return Math.random().toString(36).slice(2, 10); };
 var post = function (path, body, headers) {
     if (headers === void 0) { headers = {}; }
     return __awaiter(void 0, void 0, void 0, function () {
@@ -77,111 +74,110 @@ var post = function (path, body, headers) {
  * The fix switches to the standard tenant-scoped `DB.endusers.findById(enduserId)` wrapper, which automatically
  * filters by `req.session.businessId`. Cross-tenant lookups now return null → handler returns 404 → no side effect.
  *
- * Note: the same-tenant happy path is already covered by the existing test at
- * `packages/public/sdk/src/tests/tests.ts:7588` ("handle_incoming_communication test for other enduser") — that
- * test creates endusers in the test tenant, sets up journeys, calls handle_incoming_communication, and asserts
- * journey-step cancellation. This file covers the negative cases only.
+ * Note: the same-tenant happy path is already covered by the existing test in `tests.ts`
+ * ("handle_incoming_communication test for other enduser") — that test creates endusers in the test
+ * tenant, sets up journeys, calls handle_incoming_communication, and asserts journey-step
+ * cancellation. This file covers the negative cases only.
  *
  * **Negative-only by design**: the test never drives `handleIncomingCommunication` against a cross-tenant
  * enduser — the post-fix code returns 404 before any side effects fire, and the assertion confirms that.
+ *
+ * Both tenants are provisioned here (`apiKeys: 0` — the sessions are bearer-token ones, no API key is
+ * used). Previously the second tenant came from the cross-org environment variables, which are unset
+ * on a clean checkout, so the cross-tenant assertion — the whole point of the file — silently skipped
+ * and the suite still passed green.
  */
-export var handle_incoming_communication_cross_tenant_tests = function (_a) {
-    var sdk = _a.sdk, sdkNonAdmin = _a.sdkNonAdmin;
-    return __awaiter(void 0, void 0, void 0, function () {
-        var nonexistentId, nonexistentRes, sdkCrossOrg, ts, crossEnduser, crossRes_1, _b;
-        return __generator(this, function (_c) {
-            switch (_c.label) {
-                case 0:
-                    log_header("handle_incoming_communication cross-tenant rejection");
-                    nonexistentId = new ObjectId().toHexString();
-                    return [4 /*yield*/, post('/v1/journeys/handle-incoming-communication', { enduserId: nonexistentId }, { Authorization: "Bearer ".concat(sdk.authToken) })];
-                case 1:
-                    nonexistentRes = _c.sent();
-                    return [4 /*yield*/, async_test("handle_incoming_communication with nonexistent enduserId returns 404", function () { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
-                            return [2 /*return*/, ({ status: nonexistentRes.status })];
-                        }); }); }, { onResult: function (r) { return r.status === 404; } })
-                        // ====================================================================
-                        // Assertion 2: cross-tenant enduserId returns 404 (the actual fix).
-                        // Env-gated; skipped when cross-org infra isn't configured.
-                        // Safe to run post-fix because the tenant-scoped DB returns null for
-                        // cross-tenant lookups — no handleIncomingCommunication side effect fires.
-                        // ====================================================================
-                    ];
-                case 2:
-                    _c.sent();
+export var handle_incoming_communication_cross_tenant_checks = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var checks, record, caller, victimTenant, nonexistentId, nonexistentRes, crossEnduser, crossRes, _i, _a, t, e_1;
+    var _b;
+    return __generator(this, function (_c) {
+        switch (_c.label) {
+            case 0:
+                checks = [];
+                record = function (label, pass, detail) { return checks.push({ label: label, pass: pass, detail: detail }); };
+                _c.label = 1;
+            case 1:
+                _c.trys.push([1, , 6, 13]);
+                ;
+                return [4 /*yield*/, Promise.all([
+                        setup_isolated_tenant({ name: "F0008 caller ".concat(RAND()), users: [{ isAdmin: true }], apiKeys: 0 }),
+                        setup_isolated_tenant({ name: "F0008 victim ".concat(RAND()), users: [{ isAdmin: true }], apiKeys: 0 }),
+                    ])
                     // ====================================================================
-                    // Assertion 2: cross-tenant enduserId returns 404 (the actual fix).
-                    // Env-gated; skipped when cross-org infra isn't configured.
-                    // Safe to run post-fix because the tenant-scoped DB returns null for
-                    // cross-tenant lookups — no handleIncomingCommunication side effect fires.
+                    // Assertion 1: nonexistent enduserId returns 404 (baseline; regression
+                    // guard for the not-found path that any cross-tenant call now lands in).
                     // ====================================================================
-                    if (!(CROSS_ORG_API_KEY && CROSS_ORG_TARGET_BUSINESS_ID)) {
-                        console.log("  Skipping cross-tenant rejection assertion — CROSS_ORG_* env vars not set");
-                        return [2 /*return*/];
-                    }
-                    sdkCrossOrg = new Session({
-                        host: host,
-                        apiKey: CROSS_ORG_API_KEY,
-                        headers: { 'x-tellescope-organization': CROSS_ORG_TARGET_BUSINESS_ID },
-                    });
-                    ts = Date.now();
-                    return [4 /*yield*/, sdkCrossOrg.api.endusers.createOne({
-                            fname: 'F0008CrossTenant', lname: 'Sentinel',
-                            email: "f0008-cross-".concat(ts, "@tellescope.com"),
-                        })];
-                case 3:
-                    crossEnduser = _c.sent();
-                    _c.label = 4;
-                case 4:
-                    _c.trys.push([4, , 7, 11]);
-                    return [4 /*yield*/, post('/v1/journeys/handle-incoming-communication', { enduserId: crossEnduser.id }, { Authorization: "Bearer ".concat(sdk.authToken) })];
-                case 5:
-                    crossRes_1 = _c.sent();
-                    return [4 /*yield*/, async_test("handle_incoming_communication with cross-tenant enduserId returns 404 (no side effect)", function () { return __awaiter(void 0, void 0, void 0, function () {
-                            var _a, _b;
-                            return __generator(this, function (_c) {
-                                return [2 /*return*/, ({
-                                        status: crossRes_1.status,
-                                        message: (_b = (_a = crossRes_1.data) === null || _a === void 0 ? void 0 : _a.message) !== null && _b !== void 0 ? _b : null,
-                                    })];
-                            });
-                        }); }, { onResult: function (r) { return r.status === 404; } })];
-                case 6:
-                    _c.sent();
-                    return [3 /*break*/, 11];
-                case 7:
-                    _c.trys.push([7, 9, , 10]);
-                    return [4 /*yield*/, sdkCrossOrg.api.endusers.deleteOne(crossEnduser.id)];
-                case 8:
-                    _c.sent();
-                    return [3 /*break*/, 10];
-                case 9:
-                    _b = _c.sent();
-                    return [3 /*break*/, 10];
-                case 10: return [7 /*endfinally*/];
-                case 11: return [2 /*return*/];
-            }
-        });
+                ];
+            case 2:
+                _b = _c.sent(), caller = _b[0], victimTenant = _b[1];
+                nonexistentId = new ObjectId().toHexString();
+                return [4 /*yield*/, post('/v1/journeys/handle-incoming-communication', { enduserId: nonexistentId }, { Authorization: "Bearer ".concat(caller.sdk.authToken) })];
+            case 3:
+                nonexistentRes = _c.sent();
+                record("handle_incoming_communication with nonexistent enduserId returns 404", nonexistentRes.status === 404, "enduserId=".concat(nonexistentId, " status=").concat(nonexistentRes.status, " (want 404) body=").concat(JSON.stringify(nonexistentRes.data)));
+                return [4 /*yield*/, victimTenant.sdk.api.endusers.createOne({
+                        fname: 'F0008CrossTenant', lname: 'Sentinel',
+                        email: "f0008-cross-".concat(RAND(), "@tellescope.com"),
+                    })
+                    // the POST keeps the CALLER tenant's bearer token — the enduser id is the other tenant's
+                ];
+            case 4:
+                crossEnduser = _c.sent();
+                return [4 /*yield*/, post('/v1/journeys/handle-incoming-communication', { enduserId: crossEnduser.id }, { Authorization: "Bearer ".concat(caller.sdk.authToken) })];
+            case 5:
+                crossRes = _c.sent();
+                record("handle_incoming_communication with cross-tenant enduserId returns 404 (no side effect)", crossRes.status === 404, "caller tenant=".concat(caller.businessId, " enduser tenant=").concat(victimTenant.businessId, " enduserId=").concat(crossEnduser.id)
+                    + " status=".concat(crossRes.status, " (want 404) body=").concat(JSON.stringify(crossRes.data)));
+                return [3 /*break*/, 13];
+            case 6:
+                _i = 0, _a = [caller, victimTenant];
+                _c.label = 7;
+            case 7:
+                if (!(_i < _a.length)) return [3 /*break*/, 12];
+                t = _a[_i];
+                if (!t) return [3 /*break*/, 11];
+                _c.label = 8;
+            case 8:
+                _c.trys.push([8, 10, , 11]);
+                return [4 /*yield*/, t.teardown()];
+            case 9:
+                _c.sent();
+                return [3 /*break*/, 11];
+            case 10:
+                e_1 = _c.sent();
+                console.error('teardown failed', e_1);
+                return [3 /*break*/, 11];
+            case 11:
+                _i++;
+                return [3 /*break*/, 7];
+            case 12: return [7 /*endfinally*/];
+            case 13: return [2 /*return*/, checks];
+        }
     });
+}); };
+/** Asserting wrapper, for standalone runs. */
+export var handle_incoming_communication_cross_tenant_tests = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var _a, _b;
+    return __generator(this, function (_c) {
+        switch (_c.label) {
+            case 0:
+                _a = assert_checks;
+                _b = ['handle_incoming_communication cross-tenant'];
+                return [4 /*yield*/, handle_incoming_communication_cross_tenant_checks()];
+            case 1:
+                _a.apply(void 0, _b.concat([_c.sent()]));
+                return [2 /*return*/];
+        }
+    });
+}); };
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export var ISOLATED_SUITE = {
+    name: 'handle_incoming_communication cross-tenant',
+    run: handle_incoming_communication_cross_tenant_checks,
 };
 if (require.main === module) {
     console.log("\uD83C\uDF10 Using API URL: ".concat(host));
-    var sdk_1 = new Session({ host: host });
-    var sdkNonAdmin_1 = new Session({ host: host });
-    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
-        return __generator(this, function (_a) {
-            switch (_a.label) {
-                case 0: return [4 /*yield*/, setup_tests(sdk_1, sdkNonAdmin_1)];
-                case 1:
-                    _a.sent();
-                    return [4 /*yield*/, handle_incoming_communication_cross_tenant_tests({ sdk: sdk_1, sdkNonAdmin: sdkNonAdmin_1 })];
-                case 2:
-                    _a.sent();
-                    return [2 /*return*/];
-            }
-        });
-    }); };
-    runTests()
+    handle_incoming_communication_cross_tenant_tests()
         .then(function () {
         console.log("✅ handle_incoming_communication cross-tenant test suite completed successfully");
         process.exit(0);

package/lib/esm/tests/api_tests/security/handle-incoming-communication-cross-tenant.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"handle-incoming-communication-cross-tenant.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/handle-incoming-communication-cross-tenant.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,OAAO,KAAK,MAAM,OAAO,CAAA;AACzB,OAAO,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAA;AAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EACL,UAAU,EACV,UAAU,GACX,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEzC,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE,IAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAA;AACvD,IAAM,4BAA4B,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAA;AAE7E,IAAM,IAAI,GAAG,UAAO,IAAY,EAAE,IAAS,EAAE,OAAoC;IAApC,wBAAA,EAAA,YAAoC;;;;;;;;oBAEjE,qBAAM,KAAK,CAAC,IAAI,CAAC,UAAG,IAAI,SAAG,IAAI,CAAE,EAAE,IAAI,EAAE;4BACnD,cAAc,EAAE,cAAM,OAAA,IAAI,EAAJ,CAAI;4BAC1B,OAAO,SAAA;yBACR,CAAC,EAAA;;oBAHI,GAAG,GAAG,SAGV;oBACF,sBAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAA;;;oBAE7C,sBAAO,EAAE,MAAM,EAAE,MAAA,KAAG,aAAH,KAAG,uBAAH,KAAG,CAAE,QAAQ,0CAAE,MAAM,EAAE,IAAI,EAAE,MAAA,KAAG,aAAH,KAAG,uBAAH,KAAG,CAAE,QAAQ,0CAAE,IAAI,EAAE,EAAA;;;;;CAEtE,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,IAAM,gDAAgD,GAAG,UAAO,EAA6D;QAA3D,GAAG,SAAA,EAAE,WAAW,iBAAA;;;;;;oBACvF,UAAU,CAAC,sDAAsD,CAAC,CAAA;oBAM5D,aAAa,GAAG,IAAI,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAA;oBAC3B,qBAAM,IAAI,CAC/B,4CAA4C,EAC5C,EAAE,SAAS,EAAE,aAAa,EAAE,EAC5B,EAAE,aAAa,EAAE,iBAAU,GAAG,CAAC,SAAS,CAAE,EAAE,CAC7C,EAAA;;oBAJK,cAAc,GAAG,SAItB;oBACD,qBAAM,UAAU,CACd,sEAAsE,EACtE;4BAAY,sBAAA,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,CAAC,EAAA;iCAAA,EAC/C,EAAE,QAAQ,EAAE,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,MAAM,KAAK,GAAG,EAAhB,CAAgB,EAAE,CACpC;wBAED,uEAAuE;wBACvE,oEAAoE;wBACpE,4DAA4D;wBAC5D,qEAAqE;wBACrE,2EAA2E;wBAC3E,uEAAuE;sBAPtE;;oBAJD,SAIC,CAAA;oBAED,uEAAuE;oBACvE,oEAAoE;oBACpE,4DAA4D;oBAC5D,qEAAqE;oBACrE,2EAA2E;oBAC3E,uEAAuE;oBACvE,IAAI,CAAC,CAAC,iBAAiB,IAAI,4BAA4B,CAAC,EAAE;wBACxD,OAAO,CAAC,GAAG,CAAC,4EAA4E,CAAC,CAAA;wBACzF,sBAAM;qBACP;oBAEK,WAAW,GAAG,IAAI,OAAO,CAAC;wBAC9B,IAAI,MAAA;wBACJ,MAAM,EAAE,iBAAiB;wBACzB,OAAO,EAAE,EAAE,2BAA2B,EAAE,4BAA4B,EAAE;qBACvE,CAAC,CAAA;oBAII,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;oBACA,qBAAM,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;4BAC5D,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,UAAU;4BAC5C,KAAK,EAAE,sBAAe,EAAE,oBAAiB;yBACnC,CAAC,EAAA;;oBAHH,YAAY,GAAG,SAGZ;;;;oBAGU,qBAAM,IAAI,CACzB,4CAA4C,EAC5C,EAAE,SAAS,EAAE,YAAY,CAAC,EAAE,EAAE,EAC9B,EAAE,aAAa,EAAE,iBAAU,GAAG,CAAC,SAAS,CAAE,EAAE,CAC7C,EAAA;;oBAJK,aAAW,SAIhB;oBAED,qBAAM,UAAU,CACd,wFAAwF,EACxF;;;gCAAY,sBAAA,CAAC;wCACX,MAAM,EAAE,UAAQ,CAAC,MAAM;wCACvB,OAAO,EAAE,MAAA,MAAA,UAAQ,CAAC,IAAI,0CAAE,OAAO,mCAAI,IAAI;qCACxC,CAAC,EAAA;;6BAAA,EACF,EAAE,QAAQ,EAAE,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,MAAM,KAAK,GAAG,EAAhB,CAAgB,EAAE,CACpC,EAAA;;oBAPD,SAOC,CAAA;;;;oBAEK,qBAAM,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC,EAAA;;oBAAzD,SAAyD,CAAA;;;;;;;;;;CAElE,CAAA;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAM,KAAG,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACjC,IAAM,aAAW,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IAEzC,IAAM,QAAQ,GAAG;;;wBACf,qBAAM,WAAW,CAAC,KAAG,EAAE,aAAW,CAAC,EAAA;;oBAAnC,SAAmC,CAAA;oBACnC,qBAAM,gDAAgD,CAAC,EAAE,GAAG,OAAA,EAAE,WAAW,eAAA,EAAE,CAAC,EAAA;;oBAA5E,SAA4E,CAAA;;;;SAC7E,CAAA;IAED,QAAQ,EAAE;SACP,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAA;QAC7F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,iEAAiE,EAAE,KAAK,CAAC,CAAA;QACvF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}
+{"version":3,"file":"handle-incoming-communication-cross-tenant.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/handle-incoming-communication-cross-tenant.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,OAAO,KAAK,MAAM,OAAO,CAAA;AACzB,OAAO,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAA;AAE/B,OAAO,EACL,aAAa,EAGb,qBAAqB,GACtB,MAAM,sBAAsB,CAAA;AAE7B,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE,IAAM,IAAI,GAAG,cAAM,OAAA,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAvC,CAAuC,CAAA;AAE1D,IAAM,IAAI,GAAG,UAAO,IAAY,EAAE,IAAS,EAAE,OAAoC;IAApC,wBAAA,EAAA,YAAoC;;;;;;;;oBAEjE,qBAAM,KAAK,CAAC,IAAI,CAAC,UAAG,IAAI,SAAG,IAAI,CAAE,EAAE,IAAI,EAAE;4BACnD,cAAc,EAAE,cAAM,OAAA,IAAI,EAAJ,CAAI;4BAC1B,OAAO,SAAA;yBACR,CAAC,EAAA;;oBAHI,GAAG,GAAG,SAGV;oBACF,sBAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAA;;;oBAE7C,sBAAO,EAAE,MAAM,EAAE,MAAA,KAAG,aAAH,KAAG,uBAAH,KAAG,CAAE,QAAQ,0CAAE,MAAM,EAAE,IAAI,EAAE,MAAA,KAAG,aAAH,KAAG,uBAAH,KAAG,CAAE,QAAQ,0CAAE,IAAI,EAAE,EAAA;;;;;CAEtE,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,IAAM,iDAAiD,GAAG;;;;;;gBACzD,MAAM,GAAY,EAAE,CAAA;gBACpB,MAAM,GAAG,UAAC,KAAa,EAAE,IAAa,EAAE,MAAc,IAAK,OAAA,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,OAAA,EAAE,IAAI,MAAA,EAAE,MAAM,QAAA,EAAE,CAAC,EAApC,CAAoC,CAAA;;;;gBAMnG,CAAC;gBAAyB,qBAAM,OAAO,CAAC,GAAG,CAAC;wBAC1C,qBAAqB,CAAC,EAAE,IAAI,EAAE,uBAAgB,IAAI,EAAE,CAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;wBACjG,qBAAqB,CAAC,EAAE,IAAI,EAAE,uBAAgB,IAAI,EAAE,CAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;qBAClG,CAAC;oBAEF,uEAAuE;oBACvE,uEAAuE;oBACvE,yEAAyE;oBACzE,uEAAuE;kBALrE;;gBAHD,KAAyB,SAGxB,EAHA,MAAM,QAAA,EAAE,YAAY,QAAA,CAGpB;gBAMI,aAAa,GAAG,IAAI,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAA;gBAC3B,qBAAM,IAAI,CAC/B,4CAA4C,EAC5C,EAAE,SAAS,EAAE,aAAa,EAAE,EAC5B,EAAE,aAAa,EAAE,iBAAU,MAAM,CAAC,GAAG,CAAC,SAAS,CAAE,EAAE,CACpD,EAAA;;gBAJK,cAAc,GAAG,SAItB;gBACD,MAAM,CACJ,sEAAsE,EACtE,cAAc,CAAC,MAAM,KAAK,GAAG,EAC7B,oBAAa,aAAa,qBAAW,cAAc,CAAC,MAAM,8BAAoB,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAE,CACpH,CAAA;gBASoB,qBAAM,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;wBACjE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,UAAU;wBAC5C,KAAK,EAAE,sBAAe,IAAI,EAAE,oBAAiB;qBACvC,CAAC;oBAET,yFAAyF;kBAFhF;;gBAHH,YAAY,GAAG,SAGZ;gBAGQ,qBAAM,IAAI,CACzB,4CAA4C,EAC5C,EAAE,SAAS,EAAE,YAAY,CAAC,EAAE,EAAE,EAC9B,EAAE,aAAa,EAAE,iBAAU,MAAM,CAAC,GAAG,CAAC,SAAS,CAAE,EAAE,CACpD,EAAA;;gBAJK,QAAQ,GAAG,SAIhB;gBACD,MAAM,CACJ,wFAAwF,EACxF,QAAQ,CAAC,MAAM,KAAK,GAAG,EACvB,wBAAiB,MAAM,CAAC,UAAU,6BAAmB,YAAY,CAAC,UAAU,wBAAc,YAAY,CAAC,EAAE,CAAE;sBACvG,kBAAW,QAAQ,CAAC,MAAM,8BAAoB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAE,CAClF,CAAA;;;sBAIqC,EAAtB,MAAC,MAAM,EAAE,YAAY,CAAC;;;qBAAtB,CAAA,cAAsB,CAAA;gBAA3B,CAAC;qBACN,CAAC,EAAD,yBAAC;;;;gBAAU,qBAAM,CAAC,CAAC,QAAQ,EAAE,EAAA;;gBAAlB,SAAkB,CAAA;;;;gBAAe,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,GAAC,CAAC,CAAA;;;gBADrE,IAAsB,CAAA;;;qBAKxC,sBAAO,MAAM,EAAA;;;KACd,CAAA;AAED,8CAA8C;AAC9C,MAAM,CAAC,IAAM,gDAAgD,GAAG;;;;;gBAC9D,KAAA,aAAa,CAAA;sBAAC,4CAA4C;gBAAE,qBAAM,iDAAiD,EAAE,EAAA;;gBAArH,4BAA4D,SAAyD,GAAC,CAAA;;;;KACvH,CAAA;AAED,oGAAoG;AACpG,MAAM,CAAC,IAAM,cAAc,GAAkB;IAC3C,IAAI,EAAE,4CAA4C;IAClD,GAAG,EAAE,iDAAiD;CACvD,CAAA;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,gDAAgD,EAAE;SAC/C,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAA;QAC7F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,iEAAiE,EAAE,KAAK,CAAC,CAAA;QACvF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}

package/lib/esm/tests/api_tests/security/load-inbox-redaction.test.d.ts

@@ -1,4 +1,4 @@
-import { Session } from "../../../sdk";
+import { Check, IsolatedSuite } from "../../setup_isolated";
 /**
  * Regression test: `load_inbox_data` must apply enduser field redactions.
  *
@@ -9,9 +9,15 @@ import { Session } from "../../../sdk";
  * Repro: create an enduser, set their portal password (→ hashedPassword), seed an inbound
  * (logOnly) email so the enduser appears in the inbox join, then load_inbox_data as staff and
  * assert the returned enduser entry has NO hashedPassword.
+ *
+ * Why configure_inbox runs first: emails.createOne is registered `requiresInboxConfiguration`,
+ * which reads username/orgEmail off the JWT, and a provisioned user has neither — so the seed
+ * would 400 without it. The SDK's configure_inbox is a plain POST: it returns a new authToken but
+ * does not install it, hence the refresh_session() that follows.
  */
-export declare const load_inbox_redaction_tests: ({ sdk }: {
-    sdk: Session;
-    sdkNonAdmin: Session;
-}) => Promise<void>;
+export declare const load_inbox_redaction_checks: () => Promise<Check[]>;
+/** Asserting wrapper, for standalone runs. */
+export declare const load_inbox_redaction_tests: () => Promise<void>;
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export declare const ISOLATED_SUITE: IsolatedSuite;
 //# sourceMappingURL=load-inbox-redaction.test.d.ts.map

package/lib/esm/tests/api_tests/security/load-inbox-redaction.test.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"load-inbox-redaction.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/load-inbox-redaction.test.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAWtC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,0BAA0B;SAA2B,OAAO;iBAAe,OAAO;mBAkC9F,CAAA"}
+{"version":3,"file":"load-inbox-redaction.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/load-inbox-redaction.test.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,EACL,aAAa,EAEd,MAAM,sBAAsB,CAAA;AAQ7B;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,2BAA2B,QAAa,QAAQ,KAAK,EAAE,CA2DnE,CAAA;AAED,8CAA8C;AAC9C,eAAO,MAAM,0BAA0B,qBAEtC,CAAA;AAED,oGAAoG;AACpG,eAAO,MAAM,cAAc,EAAE,aAG5B,CAAA"}

package/lib/esm/tests/api_tests/security/load-inbox-redaction.test.js

@@ -35,11 +35,10 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
     }
 };
 require('source-map-support').install();
-import { Session } from "../../../sdk";
-import { async_test, log_header, } from "@tellescope/testing";
-import { setup_tests } from "../../setup";
+import { assert_checks, setup_isolated_tenant, } from "../../setup_isolated";
 var host = process.env.API_URL || 'http://localhost:8080';
 var ENDUSER_PASSWORD = 'F0151TestPassword!123';
+var RAND = function () { return Math.random().toString(36).slice(2, 10); };
 /**
  * Regression test: `load_inbox_data` must apply enduser field redactions.
  *
@@ -50,95 +49,138 @@ var ENDUSER_PASSWORD = 'F0151TestPassword!123';
  * Repro: create an enduser, set their portal password (→ hashedPassword), seed an inbound
  * (logOnly) email so the enduser appears in the inbox join, then load_inbox_data as staff and
  * assert the returned enduser entry has NO hashedPassword.
+ *
+ * Why configure_inbox runs first: emails.createOne is registered `requiresInboxConfiguration`,
+ * which reads username/orgEmail off the JWT, and a provisioned user has neither — so the seed
+ * would 400 without it. The SDK's configure_inbox is a plain POST: it returns a new authToken but
+ * does not install it, hence the refresh_session() that follows.
  */
-export var load_inbox_redaction_tests = function (_a) {
-    var sdk = _a.sdk;
-    return __awaiter(void 0, void 0, void 0, function () {
-        var enduserId, emailId, email, enduser_1, seeded, _b, _c;
-        return __generator(this, function (_d) {
-            switch (_d.label) {
-                case 0:
-                    log_header("load_inbox_data enduser redaction");
-                    _d.label = 1;
-                case 1:
-                    _d.trys.push([1, , 6, 15]);
-                    email = "f0151-enduser-".concat(Date.now(), "@example.com");
-                    return [4 /*yield*/, sdk.api.endusers.createOne({ email: email, fname: 'F0151', lname: 'Inbox' })];
-                case 2:
-                    enduser_1 = _d.sent();
-                    enduserId = enduser_1.id;
-                    return [4 /*yield*/, sdk.api.endusers.set_password({ id: enduser_1.id, password: ENDUSER_PASSWORD })
-                        // Seed an inbound logOnly email so the enduser is joined into the inbox payload
-                    ];
-                case 3:
-                    _d.sent();
-                    return [4 /*yield*/, sdk.api.emails.createOne({
-                            enduserId: enduser_1.id, subject: 'F0151 seed', textContent: 'seed',
-                            logOnly: true, inbound: true,
-                        })];
-                case 4:
-                    seeded = _d.sent();
-                    emailId = seeded.id;
-                    return [4 /*yield*/, async_test('load_inbox_data does not leak enduser.hashedPassword to staff', function () { return sdk.api.endusers.load_inbox_data({ enduserIds: [enduser_1.id] }); }, {
-                            onResult: function (r) {
-                                var _a;
-                                var returned = ((_a = r === null || r === void 0 ? void 0 : r.endusers) !== null && _a !== void 0 ? _a : []).find(function (e) { var _a; return ((_a = (e.id || e._id)) === null || _a === void 0 ? void 0 : _a.toString()) === enduserId; });
-                                // require that the enduser actually came back (so the assertion is meaningful),
-                                // and that hashedPassword is absent
-                                return !!returned && !('hashedPassword' in returned);
-                            },
-                        })];
-                case 5:
-                    _d.sent();
-                    return [3 /*break*/, 15];
-                case 6:
-                    if (!emailId) return [3 /*break*/, 10];
-                    _d.label = 7;
-                case 7:
-                    _d.trys.push([7, 9, , 10]);
-                    return [4 /*yield*/, sdk.api.emails.deleteOne(emailId)];
-                case 8:
-                    _d.sent();
-                    return [3 /*break*/, 10];
-                case 9:
-                    _b = _d.sent();
-                    return [3 /*break*/, 10];
-                case 10:
-                    if (!enduserId) return [3 /*break*/, 14];
-                    _d.label = 11;
-                case 11:
-                    _d.trys.push([11, 13, , 14]);
-                    return [4 /*yield*/, sdk.api.endusers.deleteOne(enduserId)];
-                case 12:
-                    _d.sent();
-                    return [3 /*break*/, 14];
-                case 13:
-                    _c = _d.sent();
-                    return [3 /*break*/, 14];
-                case 14: return [7 /*endfinally*/];
-                case 15: return [2 /*return*/];
-            }
-        });
+export var load_inbox_redaction_checks = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var checks, record, tenant, sdk, enduserId_1, emailId, email, enduser, seeded, loaded, returned, _a, _b, e_1;
+    var _c, _d;
+    return __generator(this, function (_e) {
+        switch (_e.label) {
+            case 0:
+                checks = [];
+                record = function (label, pass, detail) { return checks.push({ label: label, pass: pass, detail: detail }); };
+                _e.label = 1;
+            case 1:
+                _e.trys.push([1, , 20, 25]);
+                return [4 /*yield*/, setup_isolated_tenant({
+                        name: "LoadInboxRedaction ".concat(RAND()),
+                        users: [{ isAdmin: true }],
+                        apiKeys: 0,
+                    })];
+            case 2:
+                tenant = _e.sent();
+                sdk = tenant.sdk;
+                // username is unique per organization; a fresh random one keeps back-to-back runs independent
+                return [4 /*yield*/, sdk.api.users.configure_inbox({ username: "inbox".concat(RAND()), fname: 'F0151', lname: 'Staff' })];
+            case 3:
+                // username is unique per organization; a fresh random one keeps back-to-back runs independent
+                _e.sent();
+                return [4 /*yield*/, sdk.refresh_session()]; // installs the username/orgEmail-bearing token configure_inbox minted
+            case 4:
+                _e.sent(); // installs the username/orgEmail-bearing token configure_inbox minted
+                emailId = void 0;
+                _e.label = 5;
+            case 5:
+                _e.trys.push([5, , 10, 19]);
+                email = "f0151-enduser-".concat(RAND(), "@example.com");
+                return [4 /*yield*/, sdk.api.endusers.createOne({ email: email, fname: 'F0151', lname: 'Inbox' })];
+            case 6:
+                enduser = _e.sent();
+                enduserId_1 = enduser.id;
+                return [4 /*yield*/, sdk.api.endusers.set_password({ id: enduser.id, password: ENDUSER_PASSWORD })
+                    // Seed an inbound logOnly email so the enduser is joined into the inbox payload
+                ];
+            case 7:
+                _e.sent();
+                return [4 /*yield*/, sdk.api.emails.createOne({
+                        enduserId: enduser.id, subject: 'F0151 seed', textContent: 'seed',
+                        logOnly: true, inbound: true,
+                    })];
+            case 8:
+                seeded = _e.sent();
+                emailId = seeded.id;
+                return [4 /*yield*/, sdk.api.endusers.load_inbox_data({ enduserIds: [enduser.id] })];
+            case 9:
+                loaded = _e.sent();
+                returned = ((_c = loaded === null || loaded === void 0 ? void 0 : loaded.endusers) !== null && _c !== void 0 ? _c : []).find(function (e) { var _a; return ((_a = (e.id || e._id)) === null || _a === void 0 ? void 0 : _a.toString()) === enduserId_1; });
+                // require that the enduser actually came back (so the assertion is meaningful),
+                // and that hashedPassword is absent
+                record('load_inbox_data does not leak enduser.hashedPassword to staff', !!returned && !('hashedPassword' in returned), returned
+                    ? "enduser ".concat(enduserId_1, " returned; hashedPassword present=").concat('hashedPassword' in returned)
+                    : "enduser ".concat(enduserId_1, " was NOT returned by load_inbox_data (").concat(((_d = loaded === null || loaded === void 0 ? void 0 : loaded.endusers) !== null && _d !== void 0 ? _d : []).length, " endusers came back)")
+                        + " \u2014 the check must not pass vacuously");
+                return [3 /*break*/, 19];
+            case 10:
+                if (!emailId) return [3 /*break*/, 14];
+                _e.label = 11;
+            case 11:
+                _e.trys.push([11, 13, , 14]);
+                return [4 /*yield*/, sdk.api.emails.deleteOne(emailId)];
+            case 12:
+                _e.sent();
+                return [3 /*break*/, 14];
+            case 13:
+                _a = _e.sent();
+                return [3 /*break*/, 14];
+            case 14:
+                if (!enduserId_1) return [3 /*break*/, 18];
+                _e.label = 15;
+            case 15:
+                _e.trys.push([15, 17, , 18]);
+                return [4 /*yield*/, sdk.api.endusers.deleteOne(enduserId_1)];
+            case 16:
+                _e.sent();
+                return [3 /*break*/, 18];
+            case 17:
+                _b = _e.sent();
+                return [3 /*break*/, 18];
+            case 18: return [7 /*endfinally*/];
+            case 19: return [3 /*break*/, 25];
+            case 20:
+                if (!tenant) return [3 /*break*/, 24];
+                _e.label = 21;
+            case 21:
+                _e.trys.push([21, 23, , 24]);
+                return [4 /*yield*/, tenant.teardown()];
+            case 22:
+                _e.sent();
+                return [3 /*break*/, 24];
+            case 23:
+                e_1 = _e.sent();
+                console.error('teardown failed', e_1);
+                return [3 /*break*/, 24];
+            case 24: return [7 /*endfinally*/];
+            case 25: return [2 /*return*/, checks];
+        }
     });
+}); };
+/** Asserting wrapper, for standalone runs. */
+export var load_inbox_redaction_tests = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var _a, _b;
+    return __generator(this, function (_c) {
+        switch (_c.label) {
+            case 0:
+                _a = assert_checks;
+                _b = ['Load inbox redaction'];
+                return [4 /*yield*/, load_inbox_redaction_checks()];
+            case 1:
+                _a.apply(void 0, _b.concat([_c.sent()]));
+                return [2 /*return*/];
+        }
+    });
+}); };
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export var ISOLATED_SUITE = {
+    name: 'Load inbox redaction',
+    run: load_inbox_redaction_checks,
 };
 if (require.main === module) {
     console.log("\uD83C\uDF10 Using API URL: ".concat(host));
-    var sdk_1 = new Session({ host: host });
-    var sdkNonAdmin_1 = new Session({ host: host });
-    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
-        return __generator(this, function (_a) {
-            switch (_a.label) {
-                case 0: return [4 /*yield*/, setup_tests(sdk_1, sdkNonAdmin_1)];
-                case 1:
-                    _a.sent();
-                    return [4 /*yield*/, load_inbox_redaction_tests({ sdk: sdk_1, sdkNonAdmin: sdkNonAdmin_1 })];
-                case 2:
-                    _a.sent();
-                    return [2 /*return*/];
-            }
-        });
-    }); };
-    runTests()
+    load_inbox_redaction_tests()
         .then(function () {
         console.log("✅ load_inbox_data redaction test suite completed successfully");
         process.exit(0);

package/lib/esm/tests/api_tests/security/load-inbox-redaction.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"load-inbox-redaction.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/load-inbox-redaction.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EACL,UAAU,EACV,UAAU,GACX,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEzC,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE,IAAM,gBAAgB,GAAG,uBAAuB,CAAA;AAEhD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,IAAM,0BAA0B,GAAG,UAAO,EAAgD;QAA9C,GAAG,SAAA;;;;;;oBACpD,UAAU,CAAC,mCAAmC,CAAC,CAAA;;;;oBAKvC,KAAK,GAAG,wBAAiB,IAAI,CAAC,GAAG,EAAE,iBAAc,CAAA;oBACvC,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,OAAA,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAA;;oBAArF,YAAU,SAA2E;oBAC3F,SAAS,GAAG,SAAO,CAAC,EAAE,CAAA;oBACtB,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,SAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;wBAEnF,gFAAgF;sBAFG;;oBAAnF,SAAmF,CAAA;oBAGpE,qBAAM,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC;4BAC5C,SAAS,EAAE,SAAO,CAAC,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM;4BACjE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI;yBACtB,CAAC,EAAA;;oBAHH,MAAM,GAAG,SAGN;oBACT,OAAO,GAAG,MAAM,CAAC,EAAE,CAAA;oBAEnB,qBAAM,UAAU,CACd,+DAA+D,EAC/D,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,CAAC,SAAO,CAAC,EAAE,CAAC,EAAS,CAAC,EAArE,CAAqE,EAC3E;4BACE,QAAQ,EAAE,UAAC,CAAM;;gCACf,IAAM,QAAQ,GAAG,CAAC,MAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,QAAQ,mCAAI,EAAE,CAAC,CAAC,IAAI,CAAC,UAAC,CAAM,YAAK,OAAA,CAAA,MAAA,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,0CAAE,QAAQ,EAAE,MAAK,SAAS,CAAA,EAAA,CAAC,CAAA;gCAChG,gFAAgF;gCAChF,oCAAoC;gCACpC,OAAO,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,gBAAgB,IAAI,QAAQ,CAAC,CAAA;4BACtD,CAAC;yBACF,CACF,EAAA;;oBAXD,SAWC,CAAA;;;yBAEG,OAAO,EAAP,yBAAO;;;;oBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EAAA;;oBAAvC,SAAuC,CAAA;;;;;;yBACxD,SAAS,EAAT,yBAAS;;;;oBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,EAAA;;oBAA3C,SAA2C,CAAA;;;;;;;;;;CAErE,CAAA;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAM,KAAG,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACjC,IAAM,aAAW,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IAEzC,IAAM,QAAQ,GAAG;;;wBACf,qBAAM,WAAW,CAAC,KAAG,EAAE,aAAW,CAAC,EAAA;;oBAAnC,SAAmC,CAAA;oBACnC,qBAAM,0BAA0B,CAAC,EAAE,GAAG,OAAA,EAAE,WAAW,eAAA,EAAE,CAAC,EAAA;;oBAAtD,SAAsD,CAAA;;;;SACvD,CAAA;IAED,QAAQ,EAAE;SACP,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAA;QAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,gDAAgD,EAAE,KAAK,CAAC,CAAA;QACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}
+{"version":3,"file":"load-inbox-redaction.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/load-inbox-redaction.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,OAAO,EACL,aAAa,EAGb,qBAAqB,GACtB,MAAM,sBAAsB,CAAA;AAE7B,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE,IAAM,gBAAgB,GAAG,uBAAuB,CAAA;AAEhD,IAAM,IAAI,GAAG,cAAM,OAAA,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAvC,CAAuC,CAAA;AAE1D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,IAAM,2BAA2B,GAAG;;;;;;gBACnC,MAAM,GAAY,EAAE,CAAA;gBACpB,MAAM,GAAG,UAAC,KAAa,EAAE,IAAa,EAAE,MAAc,IAAK,OAAA,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,OAAA,EAAE,IAAI,MAAA,EAAE,MAAM,QAAA,EAAE,CAAC,EAApC,CAAoC,CAAA;;;;gBAK1F,qBAAM,qBAAqB,CAAC;wBACnC,IAAI,EAAE,6BAAsB,IAAI,EAAE,CAAE;wBACpC,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;wBAC1B,OAAO,EAAE,CAAC;qBACX,CAAC,EAAA;;gBAJF,MAAM,GAAG,SAIP,CAAA;gBACM,GAAG,GAAK,MAAM,IAAX,CAAW;gBAEtB,8FAA8F;gBAC9F,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,eAAQ,IAAI,EAAE,CAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAA;;gBADnG,8FAA8F;gBAC9F,SAAmG,CAAA;gBACnG,qBAAM,GAAG,CAAC,eAAe,EAAE,EAAA,CAAC,sEAAsE;;gBAAlG,SAA2B,CAAA,CAAC,sEAAsE;gBAG9F,OAAO,SAAoB,CAAA;;;;gBAGvB,KAAK,GAAG,wBAAiB,IAAI,EAAE,iBAAc,CAAA;gBACnC,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,OAAA,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAA;;gBAArF,OAAO,GAAG,SAA2E;gBAC3F,WAAS,GAAG,OAAO,CAAC,EAAE,CAAA;gBACtB,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;oBAEnF,gFAAgF;kBAFG;;gBAAnF,SAAmF,CAAA;gBAGpE,qBAAM,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC;wBAC5C,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM;wBACjE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI;qBACtB,CAAC,EAAA;;gBAHH,MAAM,GAAG,SAGN;gBACT,OAAO,GAAG,MAAM,CAAC,EAAE,CAAA;gBAEC,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAS,CAAC,EAAA;;gBAAzF,MAAM,GAAQ,SAA2E;gBACzF,QAAQ,GAAG,CAAC,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,QAAQ,mCAAI,EAAE,CAAC,CAAC,IAAI,CAAC,UAAC,CAAM,YAAK,OAAA,CAAA,MAAA,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,0CAAE,QAAQ,EAAE,MAAK,WAAS,CAAA,EAAA,CAAC,CAAA;gBAErG,gFAAgF;gBAChF,oCAAoC;gBACpC,MAAM,CACJ,+DAA+D,EAC/D,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,gBAAgB,IAAI,QAAQ,CAAC,EAC7C,QAAQ;oBACN,CAAC,CAAC,kBAAW,WAAS,+CAAqC,gBAAgB,IAAI,QAAQ,CAAE;oBACzF,CAAC,CAAC,kBAAW,WAAS,mDAAyC,CAAC,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,QAAQ,mCAAI,EAAE,CAAC,CAAC,MAAM,yBAAsB;0BAChH,2CAAsC,CAC7C,CAAA;;;qBAIG,OAAO,EAAP,yBAAO;;;;gBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EAAA;;gBAAvC,SAAuC,CAAA;;;;;;qBACxD,WAAS,EAAT,yBAAS;;;;gBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAS,CAAC,EAAA;;gBAA3C,SAA2C,CAAA;;;;;;;;qBAIhE,MAAM,EAAN,yBAAM;;;;gBAAU,qBAAM,MAAM,CAAC,QAAQ,EAAE,EAAA;;gBAAvB,SAAuB,CAAA;;;;gBAAe,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,GAAC,CAAC,CAAA;;;qBAG/F,sBAAO,MAAM,EAAA;;;KACd,CAAA;AAED,8CAA8C;AAC9C,MAAM,CAAC,IAAM,0BAA0B,GAAG;;;;;gBACxC,KAAA,aAAa,CAAA;sBAAC,sBAAsB;gBAAE,qBAAM,2BAA2B,EAAE,EAAA;;gBAAzE,4BAAsC,SAAmC,GAAC,CAAA;;;;KAC3E,CAAA;AAED,oGAAoG;AACpG,MAAM,CAAC,IAAM,cAAc,GAAkB;IAC3C,IAAI,EAAE,sBAAsB;IAC5B,GAAG,EAAE,2BAA2B;CACjC,CAAA;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,0BAA0B,EAAE;SACzB,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAA;QAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,gDAAgD,EAAE,KAAK,CAAC,CAAA;QACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}

package/lib/esm/tests/api_tests/security/proxy-image-unauth-ssrf.test.d.ts

@@ -1,4 +1,4 @@
-import { Session } from "../../../sdk";
+import { Check, IsolatedSuite } from "../../setup_isolated";
 /**
  * Regression tests: `/v1/proxy-image` must refuse internal and non-image destinations.
  *
@@ -26,9 +26,16 @@ import { Session } from "../../../sdk";
  * The authenticated happy-path test lives with the Phase 2 endpoint change — it cannot exist here
  * because the POST route does not yet exist, and a test that fails for "not implemented" would muddy
  * the vulnerability proof.
+ *
+ * 127.0.0.1 only means "the machine running this test" when the API is also local. Against staging or
+ * prod it is the API server itself — the sentinel below would never be contacted and every check here
+ * would pass for the wrong reason. So a non-local API_URL records ONE FAILING check and returns: this
+ * suite goes deliberately red rather than skipping, because a skipped SSRF proof rots silently. It
+ * must not throw: a throw propagates out of run_isolated_in_parallel and aborts every remaining batch.
  */
-export declare const proxy_image_ssrf_tests: ({ sdk }: {
-    sdk: Session;
-    sdkNonAdmin: Session;
-}) => Promise<void>;
+export declare const proxy_image_ssrf_checks: () => Promise<Check[]>;
+/** Asserting wrapper, for standalone runs. */
+export declare const proxy_image_ssrf_tests: () => Promise<void>;
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export declare const ISOLATED_SUITE: IsolatedSuite;
 //# sourceMappingURL=proxy-image-unauth-ssrf.test.d.ts.map

package/lib/esm/tests/api_tests/security/proxy-image-unauth-ssrf.test.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxy-image-unauth-ssrf.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/proxy-image-unauth-ssrf.test.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AA0BtC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,sBAAsB;SAA2B,OAAO;iBAAe,OAAO;mBAkG1F,CAAA"}
+{"version":3,"file":"proxy-image-unauth-ssrf.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/proxy-image-unauth-ssrf.test.ts"],"names":[],"mappings":"AAIA,OAAO,EAEL,KAAK,EACL,aAAa,EAEd,MAAM,sBAAsB,CAAA;AAQ7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,uBAAuB,QAAa,QAAQ,KAAK,EAAE,CAiJ/D,CAAA;AAED,8CAA8C;AAC9C,eAAO,MAAM,sBAAsB,qBAElC,CAAA;AAED,oGAAoG;AACpG,eAAO,MAAM,cAAc,EAAE,aAG5B,CAAA"}