@tellescope/sdk 2.0.0-beta.2 → 2.0.0-beta.3

package/src/tests/api_tests/organization_signup.test.ts

@@ -17,9 +17,41 @@ const host = process.env.API_URL || 'http://localhost:8080' as const
 
 const RAND = () => Math.random().toString(36).slice(2, 10)
 
+/**
+ * POSTs to the real register endpoint, retrying a 429.
+ *
+ * `users.register` is IP-rate-limited to ~1/sec and every isolated suite in the parallel pool shares
+ * one IP, so a 429 here is contention between suites rather than a result worth asserting on.
+ */
+const register_request = async (data: Record<string, any>) => {
+  const send = () => axios.request({
+    method: 'post', url: `${host}/v1/users/register`,
+    data,
+    validateStatus: () => true,
+  })
+
+  let result = await send()
+  for (let attempt = 0; attempt < 5 && result.status === 429; attempt++) {
+    await wait(undefined, 1200)
+    result = await send()
+  }
+  return result
+}
+
 // legacy shared fixture — teardown must refuse it
 const SEEDED_TEST_BUSINESS_ID = '60398b1131a295e64f084ff6'
 
+/** Decodes a JWT payload without verifying it — enough to assert on what the API put in the token. */
+const decode_jwt_payload = (token?: string): { [key: string]: any } | null => {
+  const payload = (token ?? '').split('.')[1]
+  if (!payload) return null
+  try {
+    return JSON.parse(Buffer.from(payload.replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString('utf8'))
+  } catch {
+    return null
+  }
+}
+
 /**
  * Covers the self-service organization signup chain, which had ZERO test coverage:
  * `users.register` -> `users.submit_email_verification` -> `organizations.create_and_join`.
@@ -42,6 +74,8 @@ export const organization_signup_checks = async (): Promise<Check[]> => {
   let bootstrapUserId = ''
   let createdBusinessId = ''
   let provisioned: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+  let suborgParent: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+  const createdSuborganizationIds: string[] = []
 
   try {
     /* ===== A: provisioning works with no seeded database ===== */
@@ -84,11 +118,7 @@ export const organization_signup_checks = async (): Promise<Check[]> => {
     const email = `dontsend-signup-${RAND()}@tellescope.com`
     const password = `Signup-${RAND()}-A1!`
 
-    const registerResult = await axios.request({
-      method: 'post', url: `${host}/v1/users/register`,
-      data: { email, password, termsVersion: '1' },
-      validateStatus: () => true,
-    })
+    const registerResult = await register_request({ email, password, termsVersion: '1' })
     record(
       'C1: register accepts a new org-less user',
       registerResult.status === 204,
@@ -175,6 +205,41 @@ export const organization_signup_checks = async (): Promise<Check[]> => {
       `status=${second.status} ${JSON.stringify(second.data ?? '')}`,
     )
 
+    /* ===== D(security defaults): the new organization is born with MFA + portal OTP on ===== */
+
+    const createdOrg = joined.data?.organization ?? {}
+    record(
+      'D5: the new organization is born with enforceMFA on',
+      createdOrg.enforceMFA === true,
+      `enforceMFA=${JSON.stringify(createdOrg.enforceMFA)}`,
+    )
+    record(
+      'D6: the new organization is born with portal OTP on, for magic links AND after a password',
+      createdOrg.portalSettings?.authentication?.requireOTP === true
+        && createdOrg.portalSettings?.authentication?.requireOTPAfterPassword === true,
+      `portalSettings.authentication=${JSON.stringify(createdOrg.portalSettings?.authentication)}`,
+    )
+
+    // the webapp gates on session.userInfo.requiresMFAConfiguration, which login_user derives from
+    // enforceMFA; it exists on no raw user record, so returning the raw document would let the first
+    // admin reach the dashboard un-gated until the next page load
+    record(
+      'D7: the returned user carries requiresMFAConfiguration (the webapp MFA gate)',
+      joined.data?.user?.requiresMFAConfiguration === true,
+      `requiresMFAConfiguration=${JSON.stringify(joined.data?.user?.requiresMFAConfiguration)}`,
+    )
+    const joinedTokenPayload = decode_jwt_payload(joined.data?.authToken)
+    record(
+      'D8: the returned authToken also carries requiresMFAConfiguration',
+      joinedTokenPayload?.requiresMFAConfiguration === true,
+      `token requiresMFAConfiguration=${JSON.stringify(joinedTokenPayload?.requiresMFAConfiguration)}`,
+    )
+    record(
+      'D9: the response does not leak the password hash',
+      joined.data?.user?.hashedPass === undefined,
+      `user keys with "hashed": ${JSON.stringify(Object.keys(joined.data?.user ?? {}).filter(k => k.toLowerCase().includes('hashed')))}`,
+    )
+
     /* ===== E: teardown actually removes the tenant ===== */
 
     // a second, disposable tenant so the assertions above keep their fixture
@@ -204,8 +269,103 @@ export const organization_signup_checks = async (): Promise<Check[]> => {
       revokedDetail,
     )
 
+    /* ===== F: the self-service registration gate ===== */
+
+    // The gate's accept/reject decision cannot be exercised from here: this API runs with LOCAL/TEST
+    // set, where the gate is bypassed by design, and nothing in the test environment can seed the
+    // zz_secrets document that holds the code (that privileged write path was deliberately not
+    // built). Enforcement is covered directly, in api/modules/registration_code.test.ts.
+    //
+    // What IS covered here is everything the gate could break in an environment that bypasses it or
+    // is carved out of it - which is every path below.
+    //
+    // Self-contained like G: a throw must not discard A-E.
+    try {
+      await wait(undefined, 1200)
+
+      // The parameter has to be declared on the action's schema: validateInput 400s on any body
+      // field the schema does not know ("X is not valid for /v1/users/register"), so an unwired
+      // parameter would reject every registration the webapp sends, gate or no gate.
+      //
+      // Re-using the address registered in C leaves no residue, and doubles as the
+      // already-registered-plus-a-code case: still the deliberate silent 204, never an account oracle.
+      const withCode = await register_request({ email, password, termsVersion: '1', registrationCode: `code-${RAND()}` })
+      record(
+        'F1: register accepts the registrationCode parameter (and an existing email still 204s)',
+        withCode.status === 204,
+        `status=${withCode.status} ${JSON.stringify(withCode.data ?? '')}`,
+      )
+      await wait(undefined, 1200)
+
+      // An inviteCode request still gets the invite branch's own pre-existing response, unchanged.
+      //
+      // Read this for what it is: a REGRESSION check on the invite branch, not a test of the
+      // `if (!inviteCode)` carve-out. The gate is bypassed in this environment, so this assertion
+      // passes identically with that guard deleted. The carve-out itself is covered by review, by
+      // the webapp spec (an invited user is never shown the field) and by manual QA steps 8-10.
+      const invitedEmail = `dontsend-invite-${RAND()}@tellescope.com`
+      const uninvited = await register_request({
+        email: invitedEmail, password, termsVersion: '1', inviteCode: `not-a-real-invite-${RAND()}`,
+      })
+      record(
+        'F2: an inviteCode request still gets the invite branch\'s own pre-existing response',
+        uninvited.status === 400 && `${uninvited.data ?? ''}`.includes('has not been invited'),
+        `status=${uninvited.status} ${JSON.stringify(uninvited.data ?? '')} (expected the pre-existing 400)`,
+      )
+      await wait(undefined, 1200)
+
+      // An oversized value is a clean validation 4xx, never a 500 - the code is attacker-controlled.
+      const oversized = await register_request({
+        email: `dontsend-long-${RAND()}@tellescope.com`, password, termsVersion: '1',
+        registrationCode: 'x'.repeat(5000),
+      })
+      record(
+        'F3: an oversized registrationCode is a clean 4xx, never a 500',
+        oversized.status >= 400 && oversized.status < 500,
+        `status=${oversized.status} ${JSON.stringify(oversized.data ?? '')}`,
+      )
+    } catch (e: any) {
+      record('F: registration gate checks ran', false, `threw: ${e?.message || e?.toString()}`)
+    }
+
+    /* ===== G: a suborganization MIRRORS its parent, it is not forced on ===== */
+
+    // Last, and self-contained: a throw in here must not remove A-F from the asserted set, so every
+    // call is inside the try below and a failure is recorded as a failed Check rather than raised.
+    try {
+      // create_suborganization is requiresSubscription: true, so it needs a provisioned tenant (which
+      // carries a year-long subscription); a create_and_join organization is born already expired.
+      suborgParent = await setup_isolated_tenant()
+
+      await suborgParent.sdk.api.organizations.updateOne(suborgParent.businessId, { enforceMFA: true })
+      const enforcedChild = await suborgParent.sdk.api.organizations.create_suborganization({
+        name: `Suborg Enforced ${RAND()}`, subdomain: `suborg-on-${RAND()}`,
+      })
+      if (enforcedChild?.created?.id) createdSuborganizationIds.push(enforcedChild.created.id)
+      record(
+        'G1: a suborganization of an MFA-enforcing parent inherits enforceMFA',
+        enforcedChild?.created?.enforceMFA === true,
+        `enforceMFA=${JSON.stringify(enforcedChild?.created?.enforceMFA)}`,
+      )
+
+      await suborgParent.sdk.api.organizations.updateOne(suborgParent.businessId, { enforceMFA: false })
+      const unenforcedChild = await suborgParent.sdk.api.organizations.create_suborganization({
+        name: `Suborg Unenforced ${RAND()}`, subdomain: `suborg-off-${RAND()}`,
+      })
+      if (unenforcedChild?.created?.id) createdSuborganizationIds.push(unenforcedChild.created.id)
+      record(
+        'G2: a suborganization of a non-enforcing parent is NOT forced on (it mirrors, not defaults)',
+        // negative control: F1 carries the regression weight, since undefined is falsy here too
+        !unenforcedChild?.created?.enforceMFA,
+        `enforceMFA=${JSON.stringify(unenforcedChild?.created?.enforceMFA)}`,
+      )
+    } catch (e: any) {
+      record('G: suborganization inheritance checks ran', false, `threw: ${e?.message || e?.toString()}`)
+    }
+
   } finally {
     if (provisioned) { try { await provisioned.teardown() } catch (e) { console.error('teardown failed', e) } }
+    if (suborgParent) { try { await suborgParent.teardown() } catch (e) { console.error('suborg parent teardown failed', e) } }
     // The signup-created org is NOT test-seeded, so teardown-tenant correctly refuses it; the org row
     // is documented residue. The bootstrap user IS removable via test-support (the
     // /tellescope-admin/delete-user route needs a staff session an isolated test deliberately lacks —
@@ -216,6 +376,11 @@ export const organization_signup_checks = async (): Promise<Check[]> => {
     if (createdBusinessId) {
       console.log(`  note: organization ${createdBusinessId} was created by the signup flow and is left behind (nothing can delete an org record)`)
     }
+    // teardown_tenant deletes only the organization it was given by id, so a suborganization of a
+    // provisioned parent is the same documented residue as the signup organization above
+    for (const id of createdSuborganizationIds) {
+      console.log(`  note: suborganization ${id} is left behind (nothing can delete an org record)`)
+    }
   }
 
   return checks

package/src/tests/api_tests/out_of_office_endpoint.test.ts

@@ -137,6 +137,104 @@ export const out_of_office_endpoint_tests = async ({ sdk, sdkNonAdmin } : { sdk:
       sdk.api.calendar_events.deleteOne(nonAdminOwn.id),
     ])
   }
+
+  await out_of_office_long_absence_tests({ sdk, sdkNonAdmin })
+}
+
+// The ticket (CU-86e36vkv9): a team member can be out of office for far longer than 7 days. A long
+// absence is saved by the webapp as a SERIES of consecutive blocks of at most MAX_OUT_OF_OFFICE_DAYS
+// (see split_out_of_office_range), each short enough to keep blocking appointment availability for
+// its whole span — the 15 day reach of get_events_for_user is what makes one long event unsafe.
+//
+// The endpoint is deliberately NOT part of that: it never reads copiedFrom and knows nothing about
+// series. It answers one question — is this person out of office right now — and that stays true for
+// a two-hour block and for day 100 of a six-month leave alike. The assertions below pin both halves:
+// the person IS flagged mid-absence, and the endpoint does NOT hand back a window spanning the whole
+// absence, because no stored row knows where the absence ends.
+const out_of_office_long_absence_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("Out of Office Endpoint (long absence saved as a series)")
+
+  const adminId = sdk.userInfo.id
+  const now = Date.now()
+  const MS_PER_DAY = 24 * 60 * MS_PER_MINUTE
+  const CHUNK_DAYS = 7
+
+  // Day 14 of a 35 day absence: two blocks already over, the third covering now, two still ahead.
+  // The series root is the first block, exactly as the editor creates it.
+  const seriesStart = now - 2 * CHUNK_DAYS * MS_PER_DAY - 2 * MS_PER_HOUR
+  const root = await sdk.api.calendar_events.createOne({
+    title: 'Out of Office',
+    outOfOffice: true,
+    startTimeInMS: seriesStart,
+    durationInMinutes: CHUNK_DAYS * 24 * 60,
+    attendees: [{ id: adminId, type: 'user' }],
+  })
+  const rest = await Promise.all([1, 2, 3, 4].map(i => (
+    sdk.api.calendar_events.createOne({
+      title: 'Out of Office',
+      outOfOffice: true,
+      copiedFrom: root.id, // what the editor's "Delete all blocks in this absence" resolves
+      startTimeInMS: seriesStart + i * CHUNK_DAYS * MS_PER_DAY,
+      durationInMinutes: CHUNK_DAYS * 24 * 60,
+      attendees: [{ id: adminId, type: 'user' }],
+    })
+  )))
+  const liveBlock = rest[1] // the third block: started 2 hours ago, runs another 7 days
+
+  try {
+    const { outOfOffice } = await sdkNonAdmin.api.calendar_events.out_of_office({ userIds: [adminId] })
+
+    // assert(assertion, failureMessage, successTitle)
+    assert(
+      outOfOffice.some(o => o.startTimeInMS <= now && now < o.endTimeInMS),
+      `nobody reported out of office on day 14 of a 35 day absence: ${JSON.stringify(outOfOffice)}`,
+      'a team member is out of office well past the 7 day per-block limit',
+    )
+
+    const covering = outOfOffice.find(o => o.startTimeInMS <= now && now < o.endTimeInMS)
+    assert(
+      covering?.startTimeInMS === liveBlock.startTimeInMS
+      && covering?.endTimeInMS === liveBlock.startTimeInMS + liveBlock.durationInMinutes * MS_PER_MINUTE,
+      `covering window was ${JSON.stringify(covering)}, expected exactly the live block ${liveBlock.startTimeInMS}`,
+      'the covering window is the live BLOCK, not a merged absence',
+    )
+    assert(
+      outOfOffice.every(o => o.endTimeInMS <= now + 10 * MS_PER_DAY),
+      `a window reaches past the whole series — the endpoint must not span blocks: ${JSON.stringify(outOfOffice)}`,
+      'no window spans the series, so no caller can derive a return date from one',
+    )
+
+    // The editor's "Delete all blocks in this absence": one request, resolved server-side, so a
+    // 26 block range is one action rather than 26.
+    //
+    // Deliberately anchored on a row that is NOT the root, with the root already deleted on its
+    // own — which is what the per-block trash icon does. The handler derives the root from the
+    // anchor's copiedFrom and matches every sibling, so the sweep still clears the absence;
+    // sending the root's id instead would 404 here and strand the remaining blocks.
+    await sdk.api.calendar_events.deleteOne(root.id)
+
+    const { deleted } = await sdk.api.calendar_events.bulk_update({
+      recurringEventId: liveBlock.id, scope: 'all', action: 'delete',
+    })
+    assert(
+      (deleted?.length ?? 0) === rest.length,
+      `bulk_update deleted ${deleted?.length} events, expected the ${rest.length} surviving blocks`,
+      'the whole absence is swept from a non-root block, with the root already gone',
+    )
+
+    const { outOfOffice: afterDelete } = (
+      await sdkNonAdmin.api.calendar_events.out_of_office({ userIds: [adminId] })
+    )
+    assert(
+      afterDelete.length === 0,
+      `expected no windows after deleting the absence, got ${JSON.stringify(afterDelete)}`,
+      'deleting the series clears the out of office status',
+    )
+  } finally {
+    await Promise.all(
+      [root, ...rest].map(e => sdk.api.calendar_events.deleteOne(e.id).catch(() => {}))
+    )
+  }
 }
 
 // Allow running this test file independently