@tellescope/sdk 2.0.0-beta.2 → 2.0.0-beta.3

package/src/tests/api_tests/custom_aggregation.test.ts

@@ -1,37 +1,119 @@
 require('source-map-support').install();
 
-import { Session } from "../../sdk"
 import {
-  async_test,
-  log_header,
   wait,
 } from "@tellescope/testing"
-import { setup_tests } from "../setup"
+import {
+  assert_checks,
+  Check,
+  IsolatedSuite,
+  setup_isolated_tenant,
+} from "../setup_isolated"
 import { PROVIDER_PERMISSIONS } from "@tellescope/constants"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
-const [nonAdminEmail, nonAdminPassword] = [process.env.NON_ADMIN_EMAIL, process.env.NON_ADMIN_PASSWORD]
 
-// Main test function that can be called independently
-export const custom_aggregation_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("Custom Aggregation Tests")
+const RAND = () => Math.random().toString(36).slice(2, 10)
 
-  // Create test data: an enduser with a password to ensure hashedPassword gets set
-  const testEnduser = await sdk.api.endusers.createOne({
-    fname: 'CustomAgg',
-    lname: 'TestUser',
-    email: 'custom-agg-test@example.com',
-  })
+/**
+ * custom_aggregation redaction + RBAC coverage.
+ *
+ * Runs on its own provisioned tenant. It used to run on the shared fixture org and, for the
+ * role-based section, overwrote the SHARED non-admin user's roles with a deliberately restricted
+ * role before restoring them in a finally — so every other suite on that org saw arbitrary
+ * permissions while this ran, and a crashed cleanup stranded the fixture user on a broken role.
+ * The tenant's own non-admin (users[1]) is the one mutated now, and it is thrown away at teardown.
+ */
+export const custom_aggregation_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
 
-  // Set a password on the enduser (this creates a hashedPassword field)
-  await sdk.api.endusers.set_password({
-    id: testEnduser.id,
-    password: 'TestPassword123!',
-  })
+  // The raw value decides the fallback, not JSON.stringify of it — JSON.stringify('') is '""',
+  // which is truthy, so a `|| fallback` on the stringified form could never fire.
+  const describe = (value: any): string => {
+    if (value === undefined || value === null) return String(value)
+    const stringified = JSON.stringify(value)
+    return stringified === undefined ? String(value) : stringified
+  }
+  const errorMessage = (e: any): string => (
+    typeof e?.message === 'string' && e.message !== '' ? e.message : describe(e)
+  )
+
+  /**
+   * The async_test({ onResult }) equivalent, as a soft Check: a call that REJECTS is a failure
+   * (async_test treats it the same way), and a resolved call passes only when onResult agrees.
+   *
+   * The call and the predicate are caught separately, so a predicate that throws fails THIS check
+   * with its own detail instead of being misreported as an API rejection — and never escapes `run`,
+   * which would fail the whole run once the batch settles rather than failing one check.
+   */
+  const expect_result = async <T,>(label: string, fn: () => Promise<T>, onResult: (r: T) => boolean) => {
+    let resolved: { value: T }
+    try {
+      resolved = { value: await fn() }
+    } catch (e: any) {
+      record(label, false, `rejected instead of resolving: ${errorMessage(e)}`)
+      return
+    }
+
+    const { value } = resolved
+    try {
+      record(label, onResult(value), `result=${describe(value)}`)
+    } catch (predicateError: any) {
+      record(label, false, `predicate threw on result=${describe(value)}: ${errorMessage(predicateError)}`)
+    }
+  }
+
+  /**
+   * The async_test({ shouldError: true, onError }) equivalent: a call that RESOLVES is a failure,
+   * and a rejection passes only when onError agrees.
+   */
+  const expect_rejected = async (label: string, fn: () => Promise<any>, onError: (e: any) => boolean) => {
+    let rejection: { e: any }
+    try {
+      const unexpected = await fn()
+      record(label, false, `resolved instead of rejecting; result=${describe(unexpected)}`)
+      return
+    } catch (e: any) {
+      rejection = { e }
+    }
+
+    // Evaluated after the error is captured, and caught in its own right: an uncaught throw from
+    // the predicate would escape `run` and, per run_isolated_in_parallel, fail the whole run once
+    // the batch settles instead of failing this one check.
+    const { e } = rejection
+    try {
+      record(label, onError(e), `rejected with ${errorMessage(e)}`)
+    } catch (predicateError: any) {
+      record(label, false, `predicate threw on rejection "${errorMessage(e)}": ${errorMessage(predicateError)}`)
+    }
+  }
+
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
 
   try {
+    tenant = await setup_isolated_tenant({
+      name: `Custom aggregation ${RAND()}`,
+      users: [{ isAdmin: true }, { roles: ['Non-Admin'] }],
+      apiKeys: 0,
+    })
+    const { sdk, sdkNonAdmin } = tenant
+
+    // Create test data: an enduser with a password to ensure hashedPassword gets set
+    const testEnduser = await sdk.api.endusers.createOne({
+      fname: 'CustomAgg',
+      lname: 'TestUser',
+      email: 'custom-agg-test@example.com',
+    })
+
+    // Set a password on the enduser (this creates a hashedPassword field)
+    await sdk.api.endusers.set_password({
+      id: testEnduser.id,
+      password: 'TestPassword123!',
+    })
+
     // Test 1: Basic aggregation works
-    await async_test(
+    await expect_result(
       "Custom aggregation - basic query works",
       () => sdk.api.analytics_frames.custom_aggregation({
         modelName: 'endusers',
@@ -40,11 +122,11 @@ export const custom_aggregation_tests = async ({ sdk, sdkNonAdmin } : { sdk: Ses
           { $count: 'total' }
         ]
       }),
-      { onResult: r => r.result[0]?.total === 1 }
+      r => r.result[0]?.total === 1,
     )
 
     // Test 2: Aggregation returns enduser data
-    await async_test(
+    await expect_result(
       "Custom aggregation - returns enduser fields",
       () => sdk.api.analytics_frames.custom_aggregation({
         modelName: 'endusers',
@@ -53,16 +135,16 @@ export const custom_aggregation_tests = async ({ sdk, sdkNonAdmin } : { sdk: Ses
           { $project: { fname: 1, lname: 1, email: 1 } }
         ]
       }),
-      { onResult: r => {
+      r => {
         const user = r.result[0]
         return user.fname === 'CustomAgg'
           && user.lname === 'TestUser'
           && user.email === 'custom-agg-test@example.com'
-      }}
+      },
     )
 
     // Test 3: CRITICAL - hashedPassword is redacted even if requested
-    await async_test(
+    await expect_result(
       "Custom aggregation - hashedPassword is redacted (explicit project)",
       () => sdk.api.analytics_frames.custom_aggregation({
         modelName: 'endusers',
@@ -71,15 +153,15 @@ export const custom_aggregation_tests = async ({ sdk, sdkNonAdmin } : { sdk: Ses
           { $project: { fname: 1, hashedPassword: 1 } } // Explicitly request password
         ]
       }),
-      { onResult: r => {
+      r => {
         const user = r.result[0]
         // Should have fname but NOT hashedPassword
         return user.fname === 'CustomAgg' && user.hashedPassword === undefined
-      }}
+      },
     )
 
     // Test 4: hashedPassword is redacted even without explicit project
-    await async_test(
+    await expect_result(
       "Custom aggregation - hashedPassword is redacted (no project)",
       () => sdk.api.analytics_frames.custom_aggregation({
         modelName: 'endusers',
@@ -88,15 +170,15 @@ export const custom_aggregation_tests = async ({ sdk, sdkNonAdmin } : { sdk: Ses
           { $limit: 1 }
         ]
       }),
-      { onResult: r => {
+      r => {
         const user = r.result[0]
         // Should return user data but NOT hashedPassword
         return user.fname === 'CustomAgg' && user.hashedPassword === undefined
-      }}
+      },
     )
 
     // Test 5: Aggregation with grouping doesn't leak hashedPassword
-    await async_test(
+    await expect_result(
       "Custom aggregation - hashedPassword redacted in grouped results",
       () => sdk.api.analytics_frames.custom_aggregation({
         modelName: 'endusers',
@@ -105,20 +187,19 @@ export const custom_aggregation_tests = async ({ sdk, sdkNonAdmin } : { sdk: Ses
           { $group: { _id: '$fname', count: { $sum: 1 }, data: { $push: '$$ROOT' } } }
         ]
       }),
-      { onResult: r => {
+      r => {
         const group = r.result[0]
         const user = group.data[0]
         // Even in grouped results, hashedPassword should not be present
         return group.count === 1 && user.hashedPassword === undefined
-      }}
+      },
     )
 
     // ===== Role-Based Access Permission Tests =====
-    log_header("Custom Aggregation - Role-Based Access Tests")
 
     // Create a role with No Access for engagement_events but full access for endusers
-    const noEngagementAccessRole = 'no-engagement-access-test'
-    const rbap = await sdk.api.role_based_access_permissions.createOne({
+    const noEngagementAccessRole = `no-engagement-access-test-${RAND()}`
+    await sdk.api.role_based_access_permissions.createOne({
       role: noEngagementAccessRole,
       permissions: {
         ...PROVIDER_PERMISSIONS,
@@ -138,71 +219,61 @@ export const custom_aggregation_tests = async ({ sdk, sdkNonAdmin } : { sdk: Ses
       },
     })
 
-    // Save original role to restore later
-    const originalRoles = sdkNonAdmin.userInfo.roles
+    // Assign the restricted role to this tenant's own non-admin user
+    await sdk.api.users.updateOne(tenant.users[1].id, { roles: [noEngagementAccessRole] }, { replaceObjectFields: true })
+    await wait(undefined, 1500) // wait for role change to propagate
+    await sdkNonAdmin.authenticate(tenant.users[1].email, tenant.users[1].password)
 
-    try {
-      // Assign the restricted role to non-admin user
-      await sdk.api.users.updateOne(sdkNonAdmin.userInfo.id, { roles: [noEngagementAccessRole] }, { replaceObjectFields: true })
-      await wait(undefined, 1500) // wait for role change to propagate
-      await sdkNonAdmin.authenticate(nonAdminEmail!, nonAdminPassword!)
-
-      // Test 6: Non-admin can still aggregate models they have access to (endusers)
-      await async_test(
-        "Custom aggregation - non-admin can access permitted models",
-        () => sdkNonAdmin.api.analytics_frames.custom_aggregation({
-          modelName: 'endusers',
-          aggregation: [
-            { $match: { fname: 'CustomAgg' } },
-            { $count: 'total' }
-          ]
-        }),
-        { onResult: r => r.result[0]?.total === 1 }
-      )
-
-      // Test 7: Non-admin is blocked from aggregating models with No Access
-      await async_test(
-        "Custom aggregation - non-admin blocked from No Access models",
-        () => sdkNonAdmin.api.analytics_frames.custom_aggregation({
-          modelName: 'engagement_events',
-          aggregation: [
-            { $match: {} },
-            { $count: 'total' }
-          ]
-        }),
-        { shouldError: true, onError: (e: any) => e.message === "You do not have access to this resource" }
-      )
-
-      console.log("✅ All custom aggregation role-based access tests passed")
-    } finally {
-      // Restore original role
-      await sdk.api.users.updateOne(sdkNonAdmin.userInfo.id, { roles: originalRoles }, { replaceObjectFields: true })
-      await wait(undefined, 1000)
-      await sdkNonAdmin.authenticate(nonAdminEmail!, nonAdminPassword!)
-
-      // Cleanup role
-      await sdk.api.role_based_access_permissions.deleteOne(rbap.id)
-    }
+    // Test 6: Non-admin can still aggregate models they have access to (endusers)
+    await expect_result(
+      "Custom aggregation - non-admin can access permitted models",
+      () => sdkNonAdmin.api.analytics_frames.custom_aggregation({
+        modelName: 'endusers',
+        aggregation: [
+          { $match: { fname: 'CustomAgg' } },
+          { $count: 'total' }
+        ]
+      }),
+      r => r.result[0]?.total === 1,
+    )
 
-    console.log("✅ All custom aggregation tests passed")
+    // Test 7: Non-admin is blocked from aggregating models with No Access
+    await expect_rejected(
+      "Custom aggregation - non-admin blocked from No Access models",
+      () => sdkNonAdmin.api.analytics_frames.custom_aggregation({
+        modelName: 'engagement_events',
+        aggregation: [
+          { $match: {} },
+          { $count: 'total' }
+        ]
+      }),
+      (e: any) => e.message === "You do not have access to this resource",
+    )
   } finally {
-    // Cleanup
-    await sdk.api.endusers.deleteOne(testEnduser.id)
+    // Teardown BEFORE anything asserts — assert calls process.exit, which would strand this tenant.
+    if (tenant) {
+      try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) }
+    }
   }
+
+  return checks
+}
+
+/** Asserting wrapper, for standalone runs. */
+export const custom_aggregation_tests = async () => {
+  assert_checks('Custom aggregation', await custom_aggregation_checks())
+}
+
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = {
+  name: 'Custom aggregation',
+  run: custom_aggregation_checks,
 }
 
 // Allow running this test file independently
 if (require.main === module) {
   console.log(`🌐 Using API URL: ${host}`)
-  const sdk = new Session({ host })
-  const sdkNonAdmin = new Session({ host })
-
-  const runTests = async () => {
-    await setup_tests(sdk, sdkNonAdmin)
-    await custom_aggregation_tests({ sdk, sdkNonAdmin })
-  }
-
-  runTests()
+  custom_aggregation_tests()
     .then(() => {
       console.log("✅ Custom aggregation test suite completed successfully")
       process.exit(0)

package/src/tests/api_tests/database_cascade_delete.test.ts

@@ -1,25 +1,42 @@
 require('source-map-support').install();
 
-import { Session } from "../../sdk"
+import { wait } from "@tellescope/testing"
 import {
-  async_test,
-  handleAnyError,
-  log_header,
-  wait,
-} from "@tellescope/testing"
-import { setup_tests } from "../setup"
+  assert_checks,
+  Check,
+  IsolatedSuite,
+  setup_isolated_tenant,
+} from "../setup_isolated"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
-// Main test function that can be called independently or from main test suite
-export const database_cascade_delete_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("Database Cascade Delete Tests")
+const RAND = () => Math.random().toString(36).slice(2, 10)
 
-  // Test 1: Create database and records, then delete database and verify records are cascade deleted
-  await async_test(
-    'cascade delete - deleting database deletes all database_records',
-    async () => {
-      // Create a test database
+const is_not_found = (err: any) => !!err?.message?.includes('Could not find') || !!err?.message?.includes('404')
+
+/**
+ * Cascade delete on databases: deleting a database deletes its database_records, an empty database
+ * deletes cleanly, and another database's records are untouched.
+ *
+ * Provisions its own throwaway tenant. The deletes in the body are the assertions, not cleanup —
+ * the tenant teardown in the finally is the only cleanup.
+ */
+export const database_cascade_delete_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+
+  try {
+    tenant = await setup_isolated_tenant({
+      name: `Database cascade delete ${RAND()}`,
+      users: [{ isAdmin: true }],
+      apiKeys: 0,
+    })
+    const { sdk } = tenant
+
+    // Test 1: Create database and records, then delete database and verify records are cascade deleted
+    {
       const database = await sdk.api.databases.createOne({
         title: `__Test__CascadeDelete_${Date.now()}`,
         fields: [
@@ -54,81 +71,74 @@ export const database_cascade_delete_tests = async ({ sdk, sdkNonAdmin } : { sdk
       ])
 
       const recordIds = records.created.map(r => r.id)
-      console.log(`Created database ${database.id} with ${recordIds.length} records`)
 
       // Verify records exist before deletion
       const recordsBefore = await sdk.api.database_records.getSome({ filter: { databaseId: database.id } })
-      if (recordsBefore.length !== 3) {
-        throw new Error(`Expected 3 records before delete, got ${recordsBefore.length}`)
-      }
-      console.log(`Verified ${recordsBefore.length} records exist before deletion`)
+      record(
+        'cascade delete - 3 records exist before the database is deleted',
+        recordsBefore.length === 3,
+        `records before delete: ${recordsBefore.length} (want 3)`,
+      )
 
       // Delete the database
       await sdk.api.databases.deleteOne(database.id)
-      console.log(`Deleted database ${database.id}`)
 
       // Wait a moment for cascade delete to propagate
       await wait(undefined, 500)
 
       // Verify all records were cascade deleted
       const recordsAfter = await sdk.api.database_records.getSome({ filter: { databaseId: database.id } })
-
-      if (recordsAfter.length !== 0) {
-        throw new Error(`Expected 0 records after cascade delete, got ${recordsAfter.length}`)
-      }
-      console.log(`✓ Verified all records were cascade deleted`)
+      record(
+        'cascade delete - deleting database deletes all database_records',
+        recordsAfter.length === 0,
+        `records after cascade delete: ${recordsAfter.length} (want 0)`,
+      )
 
       // Also verify individual record fetches return 404
+      const stillFound: string[] = []
+      const unexpectedErrors: string[] = []
       for (const recordId of recordIds) {
-        try {
-          await sdk.api.database_records.getOne(recordId)
-          throw new Error(`Record ${recordId} should have been deleted but was still found`)
-        } catch (err: any) {
-          if (!err.message?.includes('Could not find') && !err.message?.includes('404')) {
-            throw new Error(`Unexpected error fetching deleted record: ${err.message}`)
-          }
-          // Expected: record not found
-        }
+        const err = await sdk.api.database_records.getOne(recordId).then(() => null).catch((e: any) => e)
+        if (err === null) { stillFound.push(recordId); continue }
+        if (!is_not_found(err)) unexpectedErrors.push(`${recordId}: ${err?.message ?? String(err)}`)
       }
-      console.log(`✓ Verified individual record fetches return not found`)
-
-      return true
-    },
-    { onResult: (result) => result === true }
-  )
-
-  // Test 2: Verify database with no records can be deleted without error
-  await async_test(
-    'cascade delete - deleting empty database works',
-    async () => {
+      record(
+        'cascade delete - individual fetches of the deleted records return not found',
+        stillFound.length === 0 && unexpectedErrors.length === 0,
+        stillFound.length || unexpectedErrors.length
+          ? `still found: ${JSON.stringify(stillFound)}; unexpected errors: ${JSON.stringify(unexpectedErrors)}`
+          : `all ${recordIds.length} record fetches rejected as not found`,
+      )
+    }
+
+    // Test 2: Verify database with no records can be deleted without error
+    {
       const database = await sdk.api.databases.createOne({
         title: `__Test__EmptyDB_${Date.now()}`,
         fields: [{ type: 'Text', label: "Field" }],
       })
 
       // Delete immediately without adding records
-      await sdk.api.databases.deleteOne(database.id)
+      const deleteError = await sdk.api.databases.deleteOne(database.id).then(() => null).catch((e: any) => e)
+      record(
+        'cascade delete - deleting empty database works',
+        deleteError === null,
+        deleteError === null ? 'delete resolved' : `delete threw: ${deleteError?.message ?? String(deleteError)}`,
+      )
 
       // Verify database is gone
-      try {
-        await sdk.api.databases.getOne(database.id)
-        throw new Error('Database should have been deleted')
-      } catch (err: any) {
-        if (!err.message?.includes('Could not find') && !err.message?.includes('404')) {
-          throw new Error(`Unexpected error: ${err.message}`)
-        }
-      }
-
-      return true
-    },
-    { onResult: (result) => result === true }
-  )
-
-  // Test 3: Verify records from other databases are not affected
-  await async_test(
-    'cascade delete - only affects records from deleted database',
-    async () => {
-      // Create two databases
+      const fetchError = await sdk.api.databases.getOne(database.id).then(() => null).catch((e: any) => e)
+      record(
+        'cascade delete - the deleted empty database is no longer fetchable',
+        fetchError !== null && is_not_found(fetchError),
+        fetchError === null
+          ? 'getOne resolved — database should have been deleted'
+          : `getOne rejected with: ${fetchError?.message ?? String(fetchError)}`,
+      )
+    }
+
+    // Test 3: Verify records from other databases are not affected
+    {
       const database1 = await sdk.api.databases.createOne({
         title: `__Test__DB1_${Date.now()}`,
         fields: [{ type: 'Text', label: "Value" }],
@@ -153,35 +163,39 @@ export const database_cascade_delete_tests = async ({ sdk, sdkNonAdmin } : { sdk
       await wait(undefined, 500)
 
       // Verify database2's record still exists
-      const db2RecordAfter = await sdk.api.database_records.getOne(db2Record.id)
-      if (!db2RecordAfter) {
-        throw new Error('Database2 record should still exist')
-      }
-      console.log(`✓ Verified database2 record was not affected by database1 deletion`)
+      const db2RecordAfter = await sdk.api.database_records.getOne(db2Record.id).catch((e: any) => ({ error: e }) as any)
+      record(
+        'cascade delete - only affects records from deleted database',
+        !!db2RecordAfter?.id && db2RecordAfter.id === db2Record.id,
+        db2RecordAfter?.id
+          ? `database2 record ${db2RecordAfter.id} still present`
+          : `database2 record ${db2Record.id} missing after database1 was deleted: `
+            + `${db2RecordAfter?.error?.message ?? String(db2RecordAfter?.error ?? 'no record returned')}`,
+      )
+    }
+  } finally {
+    // Teardown BEFORE anything asserts — assert calls process.exit, which would strand this tenant.
+    if (tenant) { try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) } }
+  }
 
-      // Cleanup database2
-      await sdk.api.databases.deleteOne(database2.id)
+  return checks
+}
 
-      return true
-    },
-    { onResult: (result) => result === true }
-  )
+/** Asserting wrapper, for standalone runs. */
+export const database_cascade_delete_tests = async () => {
+  assert_checks('Database cascade delete', await database_cascade_delete_checks())
+}
 
-  console.log("✅ All Database Cascade Delete tests passed!")
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = {
+  name: 'Database cascade delete',
+  run: database_cascade_delete_checks,
 }
 
 // Allow running this test file independently
 if (require.main === module) {
   console.log(`🌐 Using API URL: ${host}`)
-  const sdk = new Session({ host })
-  const sdkNonAdmin = new Session({ host })
-
-  const runTests = async () => {
-    await setup_tests(sdk, sdkNonAdmin)
-    await database_cascade_delete_tests({ sdk, sdkNonAdmin })
-  }
-
-  runTests()
+  database_cascade_delete_tests()
     .then(() => {
       console.log("✅ Database cascade delete test suite completed successfully")
       process.exit(0)