@tellescope/sdk 2.0.0-beta.2 → 2.0.0-beta.3

package/src/tests/api_tests/configurations_public_read.test.ts

@@ -1,110 +1,197 @@
 require('source-map-support').install();
 
-import { Session, EnduserSession } from "../../sdk"
+import { EnduserSession } from "../../enduser"
 import {
-  assert,
-  async_test,
-  handleAnyError,
-  log_header,
-} from "@tellescope/testing"
-import { setup_tests } from "../setup"
+  assert_checks,
+  Check,
+  setup_isolated_tenant,
+  IsolatedSuite,
+} from "../setup_isolated"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
-// Modular test for the configurations publicRead flag (added for AI form translation maps).
-//
-// The critical security property: configurations hold sensitive integration settings (API keys etc.),
-// so enduser read access is opt-in PER RECORD via publicRead: true. A configuration without the flag
-// must remain completely invisible to enduser sessions, and endusers must never be able to write
-// configurations at all.
-export const configurations_public_read_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("Configurations publicRead Tests")
+const RAND = () => Math.random().toString(36).slice(2, 10)
 
-  const createdConfigurationIds: string[] = []
-  let enduserId: string | undefined
+/** A rejection carries no status and no consistent shape: parseError throws the raw response body, so
+ *  a 404 arrives as `{ message, info }` while a 401 arrives as the plain string 'Unauthenticated'
+ *  (`res.status(401).end(...)`, not JSON). Without this normalization the write checks would match
+ *  nothing and pass vacuously. */
+const error_text = (err: any): string => (
+  typeof err === 'string' ? err : err?.message ?? String(err)
+)
+
+/**
+ * Coverage for the `configurations` publicRead flag (added for AI form translation maps).
+ *
+ * The critical security property: configurations hold sensitive integration settings (API keys etc.),
+ * so enduser read access is opt-in PER RECORD via `publicRead: true` — `enduserActions` on the model is
+ * `{ read, readMany }` only, and `build_enduser_filter` (api database.ts) reduces those reads to
+ * records carrying the flag. A configuration without the flag must remain completely invisible to
+ * enduser sessions, and endusers must never be able to write configurations at all.
+ *
+ * This suite provisions its own throwaway tenant, so it needs no environment fixture. That also makes
+ * the `getSome` result determinate — the provisioner inserts no configurations, so the only records in
+ * the business are the two created here, and the check can assert on an exact result rather than
+ * "contains". It never calls `sdk.reset_db()`, which clears global throttle namespaces shared with
+ * other concurrently running suites.
+ */
+export const configurations_public_read_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
 
   try {
+    tenant = await setup_isolated_tenant({
+      name: `ConfigurationsPublicRead ${RAND()}`,
+      users: [{ isAdmin: true }],
+      apiKeys: 0,
+    })
+    const { sdk } = tenant
+
     // config A simulates an integration config (no flag); config B is a flagged translation-map-style record
     const configA = await sdk.api.configurations.createOne({
       type: 'test-private-configuration',
       value: JSON.stringify({ apiKey: 'super-secret' }),
     })
-    createdConfigurationIds.push(configA.id)
-
     const configB = await sdk.api.configurations.createOne({
       type: 'test-public-configuration',
       value: JSON.stringify({ Hello: 'Hola' }),
       publicRead: true,
     })
-    createdConfigurationIds.push(configB.id)
 
     const enduser = await sdk.api.endusers.createOne({
-      email: `configurations_public_read_${Date.now()}@test.tellescope.com`,
+      email: `configurations-public-read-${RAND()}@tellescope.example`,
     })
-    enduserId = enduser.id
 
-    const { authToken, enduser: authEnduser } = await sdk.api.endusers.generate_auth_token({ id: enduser.id })
-    const enduserSDK = new EnduserSession({ host, authToken, enduser: authEnduser, businessId: sdk.userInfo.businessId })
+    /** Session.errorHandler calls clearState() whenever the parsed error is exactly 'Unauthenticated',
+     *  wiping authToken. So every check that expects a 401 gets a freshly minted token and session —
+     *  a shared one would be unauthenticated for the 2nd and 3rd write checks, which would then pass
+     *  even with the access boundary deleted. */
+    const enduser_session = async () => {
+      const { authToken } = await sdk.api.endusers.generate_auth_token({ id: enduser.id })
+      const session = new EnduserSession({ host, authToken, businessId: tenant!.businessId })
+      await session.refresh_session()
+      return session
+    }
+
+    /* ===================== reads (no 401 expected, so one session is safe) ===================== */
+
+    const readSession = await enduser_session()
 
-    // --- reads ---
-    await async_test(
-      'enduser CAN read a publicRead configuration by id',
-      () => enduserSDK.api.configurations.getOne(configB.id),
-      { onResult: c => c?.id === configB.id && c.value === configB.value },
+    let publicReadConfig: any
+    let publicReadError = ''
+    try {
+      publicReadConfig = await readSession.api.configurations.getOne(configB.id)
+    } catch (err: any) { publicReadError = error_text(err) }
+    record(
+      'A: enduser CAN read a publicRead configuration by id',
+      publicReadConfig?.id === configB.id && publicReadConfig?.value === configB.value,
+      `read=${JSON.stringify(publicReadConfig)}`
+      + (publicReadError ? ` error=${JSON.stringify(publicReadError)}` : ''),
     )
-    await async_test(
-      'enduser CANNOT read an unflagged configuration by id (key security assertion)',
-      () => enduserSDK.api.configurations.getOne(configA.id),
-      handleAnyError,
+
+    let unflaggedReadError = ''
+    let unflaggedRead: any
+    try {
+      unflaggedRead = await readSession.api.configurations.getOne(configA.id)
+    } catch (err: any) { unflaggedReadError = error_text(err) }
+    record(
+      'B: enduser CANNOT read an unflagged configuration by id (key security assertion)',
+      unflaggedReadError === 'Could not find a record for the given id',
+      unflaggedReadError
+        ? `error=${JSON.stringify(unflaggedReadError)}`
+        : `(none — the read RETURNED ${JSON.stringify(unflaggedRead)})`,
     )
-    await async_test(
-      'enduser getSome returns only publicRead configurations',
-      () => enduserSDK.api.configurations.getSome({}),
-      { onResult: configurations => (
-        configurations.some(c => c.id === configB.id)
-        && !configurations.some(c => c.id === configA.id)
-      )},
+
+    const someConfigurations = await readSession.api.configurations.getSome({})
+    record(
+      'C: enduser getSome returns exactly one configuration — the publicRead one',
+      someConfigurations.length === 1 && someConfigurations[0].id === configB.id,
+      `ids=${JSON.stringify(someConfigurations.map(c => c.id))} (publicRead=${configB.id}, unflagged=${configA.id})`,
     )
 
-    // --- writes: endusers have no create/update/delete on configurations ---
-    await async_test(
-      'enduser CANNOT create a configuration',
-      () => enduserSDK.api.configurations.createOne({ type: 'test-enduser-create', value: '{}', publicRead: true }),
-      handleAnyError,
+    /* ============ writes: endusers have no create/update/delete on configurations ============ */
+
+    /** A write session, proven authenticated at the moment of the write.
+     *
+     *  Both steps guard against the same vacuous pass. These checks match on the literal string
+     *  'Unauthenticated', which is also what an invalid or cleared token rejects with — so a session
+     *  that simply failed to authenticate would satisfy them with the access boundary deleted. The
+     *  publicRead read is the proof that it did authenticate, and running it (and refresh_session)
+     *  OUTSIDE each check's try means a failure throws out of the suite instead of being recorded as
+     *  the expected rejection. */
+    const authenticated_write_session = async () => {
+      const session = await enduser_session()
+      await session.api.configurations.getOne(configB.id)
+      return session
+    }
+
+    const createSession = await authenticated_write_session()
+    let createError = ''
+    let created: any
+    try {
+      created = await createSession.api.configurations.createOne({
+        type: 'test-enduser-create', value: '{}', publicRead: true,
+      })
+    } catch (err: any) { createError = error_text(err) }
+    record(
+      'D: enduser CANNOT create a configuration',
+      createError === 'Unauthenticated',
+      createError
+        ? `error=${JSON.stringify(createError)}`
+        : `(none — the write was ACCEPTED as ${JSON.stringify(created?.id)})`,
     )
-    await async_test(
-      'enduser CANNOT update a configuration (even a publicRead one)',
-      () => enduserSDK.api.configurations.updateOne(configB.id, { value: '{}' }),
-      handleAnyError,
+
+    const updateSession = await authenticated_write_session()
+    let updateError = ''
+    try {
+      await updateSession.api.configurations.updateOne(configB.id, { value: '{}' })
+    } catch (err: any) { updateError = error_text(err) }
+    record(
+      'E: enduser CANNOT update a configuration (even a publicRead one)',
+      updateError === 'Unauthenticated',
+      updateError ? `error=${JSON.stringify(updateError)}` : '(none — the write was ACCEPTED)',
     )
-    await async_test(
-      'enduser CANNOT delete a configuration',
-      () => enduserSDK.api.configurations.deleteOne(configB.id),
-      handleAnyError,
+
+    const deleteSession = await authenticated_write_session()
+    let deleteError = ''
+    try {
+      await deleteSession.api.configurations.deleteOne(configB.id)
+    } catch (err: any) { deleteError = error_text(err) }
+    record(
+      'F: enduser CANNOT delete a configuration',
+      deleteError === 'Unauthenticated',
+      deleteError ? `error=${JSON.stringify(deleteError)}` : '(none — the write was ACCEPTED)',
     )
 
     // staff access is unchanged by the flag
     const staffRead = await sdk.api.configurations.getOne(configA.id)
-    assert(staffRead?.id === configA.id, 'staff could not read unflagged configuration', 'staff reads unflagged configuration')
+    record(
+      'G: staff reads an unflagged configuration',
+      staffRead?.id === configA.id,
+      `read=${JSON.stringify(staffRead?.id)} (expected ${configA.id})`,
+    )
   } finally {
-    for (const id of createdConfigurationIds) {
-      await sdk.api.configurations.deleteOne(id).catch(() => {})
-    }
-    if (enduserId) await sdk.api.endusers.deleteOne(enduserId).catch(() => {})
+    // Teardown BEFORE anything asserts — assert calls process.exit, which would strand this tenant.
+    if (tenant) { try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) } }
   }
+
+  return checks
 }
 
-// Allow running this test file independently
-if (require.main === module) {
-  const sdk = new Session({ host })
-  const sdkNonAdmin = new Session({ host })
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+export const configurations_public_read_tests = async () => {
+  assert_checks('Configurations publicRead', await configurations_public_read_checks())
+}
 
-  const runTests = async () => {
-    await setup_tests(sdk, sdkNonAdmin)
-    await configurations_public_read_tests({ sdk, sdkNonAdmin })
-  }
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = { name: 'Configurations publicRead', run: configurations_public_read_checks }
 
-  runTests()
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  configurations_public_read_tests()
     .then(() => {
       console.log("✅ Configurations publicRead test suite completed successfully")
       process.exit(0)

package/src/tests/api_tests/copied_form_response_no_enduser_sync.test.ts

@@ -0,0 +1,307 @@
+require('source-map-support').install();
+
+import { EnduserSession, Session } from "../../sdk"
+import {
+  assert_checks,
+  Check,
+  setup_isolated_tenant,
+  IsolatedSuite,
+} from "../setup_isolated"
+import { Enduser, FormResponse } from "@tellescope/types-client"
+import { FormResponseValue } from "@tellescope/types-models"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
+/**
+ * Coverage for CU-86dzm9g7e: a form response COPIED onto another patient's profile (Save Copy to
+ * Related Contact(s), the submit_form_response fan-out, the Tickets card — all stamp `copiedFrom`)
+ * must never write its answers into the holding patient's profile fields.
+ *
+ * The guard is a single early return in `save_enduser_updates_for_form_response`
+ * (api/modules/forms.ts), keyed on `copiedFrom` alone and placed above every write in that function.
+ * The side effect runs AFTER the update response returns (handle_enduser_updates_for_form_response
+ * fires it without awaiting), so every assertion here polls.
+ *
+ * Proving a negative needs both a barrier and a control, or the suite passes vacuously whenever the
+ * sync pipeline is simply slow or dead:
+ *   - barrier + control: patient B also owns a NON-copied response answering its own distinct intake
+ *     field. It is edited after the copy, and the suite waits until THAT field lands on B. So the
+ *     sync pipeline is proven live for B, and the copy's edit has had at least as long to land.
+ *   - positive control: editing patient A's own (original) response still writes A's profile fields.
+ * Each intake field is answered by exactly one response, so a blocked write cannot be masked by a
+ * later allowed one.
+ *
+ * `setup_isolated` rather than `setup_tests`: these checks assert on the exact field values of two
+ * contacts over time, which needs a tenant no concurrently running suite writes to.
+ *
+ * Runs standalone or as part of the main suite:
+ *   npm run test:modular -- api_tests/copied_form_response_no_enduser_sync
+ */
+
+const sleep = (ms: number) => new Promise(resolve => setTimeout(resolve, ms))
+
+/** Re-reads until `done`, or gives up and returns the last value read (the caller asserts on it). */
+const poll_until = async <T>(read: () => Promise<T>, done: (value: T) => boolean, {
+  attempts = 30,
+  intervalMS = 500,
+} = {}): Promise<T> => {
+  let latest = await read()
+  for (let i = 0; i < attempts && !done(latest); i++) {
+    await sleep(intervalMS)
+    latest = await read()
+  }
+  return latest
+}
+
+const answer = (fieldId: string, fieldTitle: string, value: string | number) => ({
+  fieldId,
+  fieldTitle,
+  answer: { type: typeof value === 'number' ? 'number' : 'string', value } as FormResponseValue['answer'],
+})
+
+export const copied_form_response_no_enduser_sync_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+
+  try {
+    tenant = await setup_isolated_tenant({
+      name: `CopiedFormResponseSync ${RAND()}`,
+      users: [{ isAdmin: true }],
+      apiKeys: 0,
+    })
+    const { sdk } = tenant as { sdk: Session }
+
+    // one intake field per response, so no write can mask another
+    const COPY_KEY = `copiedAnswer${RAND()}`   // answered by the original on A, and by the copy on B
+    const OWN_KEY = `ownAnswer${RAND()}`       // answered only by B's own, non-copied response
+
+    const form = await sdk.api.forms.createOne({ title: `Copied Response Sync ${RAND()}` })
+    const genderField = await sdk.api.form_fields.createOne({
+      formId: form.id, title: 'Gender', type: 'string', intakeField: 'gender',
+      previousFields: [{ type: 'root', info: {} }],
+    })
+    const copyField = await sdk.api.form_fields.createOne({
+      formId: form.id, title: 'Copied Answer', type: 'string', intakeField: COPY_KEY,
+      previousFields: [{ type: 'after', info: { fieldId: genderField.id } }],
+    })
+    const ownField = await sdk.api.form_fields.createOne({
+      formId: form.id, title: 'Own Answer', type: 'string', intakeField: OWN_KEY,
+      previousFields: [{ type: 'after', info: { fieldId: copyField.id } }],
+    })
+    // no intakeField — only feeds the score, which must still be recalculated on a copy
+    const scoreField = await sdk.api.form_fields.createOne({
+      formId: form.id, title: 'Score Me', type: 'number',
+      previousFields: [{ type: 'after', info: { fieldId: ownField.id } }],
+    })
+    await sdk.api.forms.updateOne(form.id, {
+      scoring: [{ title: 'Total', fieldId: scoreField.id, score: 'value' }],
+    }, { replaceObjectFields: true })
+
+    const patientA = await sdk.api.endusers.createOne({ fname: 'Copied', lname: `SourceA${RAND()}` })
+    const patientB = await sdk.api.endusers.createOne({ fname: 'Copied', lname: `RelatedB${RAND()}` })
+
+    const readA = () => sdk.api.endusers.getOne(patientA.id)
+    const readB = () => sdk.api.endusers.getOne(patientB.id)
+
+    /* ===== 1. positive control: editing A's OWN response writes A's profile fields ===== */
+    const { response: originalPlaceholder } = await sdk.api.form_responses.prepare_form_response({
+      formId: form.id,
+      enduserId: patientA.id,
+    })
+    const original = await sdk.api.form_responses.updateOne(originalPlaceholder.id, {
+      responses: [
+        answer(genderField.id, 'Gender', 'Male'),
+        answer(copyField.id, 'Copied Answer', 'FROM_A'),
+      ],
+    }, { replaceObjectFields: true })
+
+    const afterOriginalEdit = await poll_until(
+      readA,
+      (a: Enduser) => a.gender === 'Male' && a.fields?.[COPY_KEY] === 'FROM_A',
+    )
+    record(
+      'positive control: editing a patient\'s OWN response still writes their profile fields',
+      afterOriginalEdit.gender === 'Male' && afterOriginalEdit.fields?.[COPY_KEY] === 'FROM_A',
+      `patient A after the edit: gender=${JSON.stringify(afterOriginalEdit.gender)},`
+      + ` fields.${COPY_KEY}=${JSON.stringify(afterOriginalEdit.fields?.[COPY_KEY])};`
+      + ` expected "Male" / "FROM_A" (if this fails, every negative check below is vacuous)`,
+    )
+
+    /* ===== 2. the copy itself, as the webapp creates it: same answers, stamped copiedFrom ===== */
+    const copy = await sdk.api.form_responses.createOne({
+      formId: form.id,
+      formTitle: form.title,
+      enduserId: patientB.id,
+      copiedFrom: original.id,
+      copiedFromEnduserId: patientA.id,
+    })
+    record(
+      'fixture: the copy carries copiedFrom and copiedFromEnduserId',
+      copy.copiedFrom === original.id && copy.copiedFromEnduserId === patientA.id,
+      `copy ${copy.id}: copiedFrom=${copy.copiedFrom} (expected ${original.id}),`
+      + ` copiedFromEnduserId=${copy.copiedFromEnduserId} (expected ${patientA.id})`,
+    )
+
+    /* ===== 3. editing the copy must not touch B's profile fields ===== */
+    await sdk.api.form_responses.updateOne(copy.id, {
+      responses: [
+        answer(genderField.id, 'Gender', 'Female'),
+        answer(copyField.id, 'Copied Answer', 'FROM_COPY'),
+        answer(scoreField.id, 'Score Me', 7),
+      ],
+    }, { replaceObjectFields: true })
+
+    // BARRIER + CONTROL: B's own, non-copied response is edited after the copy and waited on, so the
+    // copy's side effect has had at least as long to run, on a pipeline proven live for this patient
+    const { response: ownPlaceholder } = await sdk.api.form_responses.prepare_form_response({
+      formId: form.id,
+      enduserId: patientB.id,
+    })
+    await sdk.api.form_responses.updateOne(ownPlaceholder.id, {
+      responses: [answer(ownField.id, 'Own Answer', 'FROM_OWN')],
+    }, { replaceObjectFields: true })
+
+    const afterCopyEdit = await poll_until(
+      readB,
+      (b: Enduser) => b.fields?.[OWN_KEY] === 'FROM_OWN',
+    )
+    record(
+      'barrier: B\'s own (non-copied) response DOES write B\'s profile fields',
+      afterCopyEdit.fields?.[OWN_KEY] === 'FROM_OWN',
+      `patient B fields.${OWN_KEY}=${JSON.stringify(afterCopyEdit.fields?.[OWN_KEY])}, expected "FROM_OWN"`
+      + ` (if this fails the sync pipeline never ran and the checks below prove nothing)`,
+    )
+    record(
+      'editing a COPIED response does not write the custom profile field',
+      afterCopyEdit.fields?.[COPY_KEY] === undefined,
+      `patient B fields.${COPY_KEY}=${JSON.stringify(afterCopyEdit.fields?.[COPY_KEY])}, expected undefined`
+      + ` (the copy answered it "FROM_COPY")`,
+    )
+    record(
+      'editing a COPIED response does not write a built-in profile field (gender)',
+      !afterCopyEdit.gender,
+      `patient B gender=${JSON.stringify(afterCopyEdit.gender)}, expected empty (the copy answered "Female")`,
+    )
+
+    /* ===== 4. everything other than the profile-field sync is unchanged on a copy ===== */
+    const savedCopy = await poll_until(
+      () => sdk.api.form_responses.getOne(copy.id),
+      (r: FormResponse) => (r.scores ?? []).some(s => s.title === 'Total' && s.value === 7),
+    )
+    record(
+      'editing a copy still saves its own responses',
+      savedCopy.responses?.find(r => r.fieldId === copyField.id)?.answer?.value === 'FROM_COPY',
+      `copy responses: ${JSON.stringify(savedCopy.responses?.map(r => r.answer?.value))}, expected to include "FROM_COPY"`,
+    )
+    record(
+      'editing a copy still recalculates its scores',
+      (savedCopy.scores ?? []).some(s => s.title === 'Total' && s.value === 7),
+      `copy scores: ${JSON.stringify(savedCopy.scores)}, expected Total=7`,
+    )
+
+    /* ===== 5. an enduser may not stamp copiedFrom on their own response ===== */
+    // copiedFrom is now a control field: it decides whether the intake sync runs at all. Endusers may
+    // update their own in-progress response (form_responses.enduserActions.update, for partial
+    // saves), so the schema marks both copy fields enduserUpdatesDisabled — otherwise a portal
+    // patient could suppress the sync of everything they answer, or point the staff-facing "View
+    // original patient" link at an arbitrary patient id.
+    {
+      const { response: portalResponse } = await sdk.api.form_responses.prepare_form_response({
+        formId: form.id,
+        enduserId: patientB.id,
+      })
+
+      const enduserSDK = new EnduserSession({ host, businessId: tenant.businessId })
+      const { authToken, enduser } = await sdk.api.endusers.generate_auth_token({ id: patientB.id })
+      await enduserSDK.handle_new_session({ authToken, enduser })
+
+      // control: the enduser session CAN update its own response (so a rejection below is about the
+      // field, not about access). A partial answer save is the enduserActions.update use case; the
+      // score field carries no intakeField, so this control writes no profile field of its own.
+      let selfUpdateWorked = false
+      let selfUpdateError: any
+      try {
+        await enduserSDK.api.form_responses.updateOne(portalResponse.id, {
+          responses: [answer(scoreField.id, 'Score Me', 3)],
+        }, { replaceObjectFields: true })
+        selfUpdateWorked = true
+      } catch (err: any) { selfUpdateError = err }
+
+      let copiedFromError: any
+      try {
+        await enduserSDK.api.form_responses.updateOne(portalResponse.id, { copiedFrom: original.id })
+      } catch (err: any) {
+        copiedFromError = err
+      }
+      let copiedFromEnduserIdError: any
+      try {
+        await enduserSDK.api.form_responses.updateOne(portalResponse.id, { copiedFromEnduserId: patientA.id })
+      } catch (err: any) {
+        copiedFromEnduserIdError = err
+      }
+
+      record(
+        'control: an enduser session can update an ordinary field on its own response',
+        selfUpdateWorked,
+        `self-update of the response's own answers ${selfUpdateWorked ? 'succeeded' : `failed: ${JSON.stringify(selfUpdateError?.message ?? selfUpdateError ?? null)}`}`
+        + ' (if this fails, the two rejections below prove nothing about the field lock)',
+      )
+      record(
+        'an enduser cannot set copiedFrom on their own response',
+        /cannot be updated by endusers/.test(copiedFromError?.message ?? ''),
+        `error=${JSON.stringify(copiedFromError?.message ?? copiedFromError ?? null)}`
+        + ` (status ${copiedFromError?.status ?? copiedFromError?.code ?? 'unknown'});`
+        + ` expected a rejection naming the field`,
+      )
+      record(
+        'an enduser cannot set copiedFromEnduserId on their own response',
+        /cannot be updated by endusers/.test(copiedFromEnduserIdError?.message ?? ''),
+        `error=${JSON.stringify(copiedFromEnduserIdError?.message ?? copiedFromEnduserIdError ?? null)}`
+        + ` (status ${copiedFromEnduserIdError?.status ?? copiedFromEnduserIdError?.code ?? 'unknown'});`
+        + ` expected a rejection naming the field`,
+      )
+    }
+
+    /* ===== 6. the source patient is untouched by the edit made on the copy ===== */
+    const sourceAfter = await readA()
+    record(
+      'editing the copy leaves the SOURCE patient\'s fields as the original submission left them',
+      sourceAfter.gender === 'Male' && sourceAfter.fields?.[COPY_KEY] === 'FROM_A',
+      `patient A: gender=${JSON.stringify(sourceAfter.gender)},`
+      + ` fields.${COPY_KEY}=${JSON.stringify(sourceAfter.fields?.[COPY_KEY])}; expected "Male" / "FROM_A"`,
+    )
+
+    return checks
+  } finally {
+    await tenant?.teardown()
+  }
+}
+
+/** Asserting wrapper, for standalone runs. */
+export const copied_form_response_no_enduser_sync_tests = async () => {
+  assert_checks('Copied form response does not sync enduser fields', await copied_form_response_no_enduser_sync_checks())
+}
+
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = {
+  name: 'Copied form response does not sync enduser fields',
+  run: copied_form_response_no_enduser_sync_checks,
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`Using API URL: ${host}`)
+  copied_form_response_no_enduser_sync_tests()
+  .then(() => {
+    console.log("Copied form response enduser sync test suite completed successfully")
+    process.exit(0)
+  })
+  .catch((error) => {
+    console.error("Copied form response enduser sync test suite failed:", error)
+    process.exit(1)
+  })
+}