@tellescope/sdk 2.0.0-beta.2 → 2.0.0-beta.3

package/src/tests/api_tests/security/booking-info-idor-token-mint.test.ts

@@ -1,26 +1,20 @@
 require('source-map-support').install();
 
-import { Session, EnduserSession } from "../../../sdk"
+import { EnduserSession } from "../../../sdk"
 import {
-  assert,
-  log_header,
-} from "@tellescope/testing"
-import { authenticate_enduser_via_token, setup_tests } from "../../setup"
+  assert_checks,
+  Check,
+  IsolatedSuite,
+  setup_isolated_tenant,
+} from "../../setup_isolated"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
-const businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6'
 
 const RAND = () => Math.random().toString(36).slice(2, 10)
 
 const VICTIM_STATE = 'CA'
 const ATTACKER_STATE_WRITE = 'NY'
 
-type Check = {
-  label: string,
-  pass: boolean,
-  detail: string,
-}
-
 /**
  * Regression test: `form_fields.booking_info` must not mint a booking token for another patient.
  *
@@ -40,13 +34,15 @@ type Check = {
  * the VICTIM's id, and the victim's `state` is overwritten. B/C (positive controls) pass pre-fix.
  * GREEN (post-fix): all six checks pass.
  *
- * Checks are collected and printed before any assert runs: the testing harness has
- * EXIT_ON_FIRST_ERROR, so asserting inline would kill the process before the evidence table and
- * before `finally` cleanup.
+ * Checks are collected and returned rather than asserted inline: the testing harness's `assert`
+ * calls process.exit, which would kill the process before the evidence table, before `finally`
+ * cleanup, and — in the parallel pool — before every other in-flight suite's teardown.
+ *
+ * Runs on its own provisioned tenant, so the patient's businessId comes from the tenant rather than
+ * a TEST_BUSINESS_ID env var with a hardcoded fallback, and the "oldest contact" the staff preview
+ * branch (C2) resolves is this suite's own fixture.
  */
-export const booking_info_idor_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("booking_info must not mint an appointment-booking token for another enduser")
-
+export const booking_info_idor_checks = async (): Promise<Check[]> => {
   const checks: Check[] = []
   const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
 
@@ -63,11 +59,19 @@ export const booking_info_idor_tests = async ({ sdk } : { sdk: Session, sdkNonAd
     }
   }
 
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
   let templateId = ''
   let bookingPageId = ''
   const enduserIds: string[] = []
 
   try {
+    tenant = await setup_isolated_tenant({
+      name: `Booking info IDOR token mint ${RAND()}`,
+      users: [{ isAdmin: true }],
+      apiKeys: 0,
+    })
+    const { sdk } = tenant
+
     /* ================= fixtures ================= */
 
     const template = await sdk.api.calendar_event_templates.createOne({
@@ -93,10 +97,15 @@ export const booking_info_idor_tests = async ({ sdk } : { sdk: Session, sdkNonAd
     })
     enduserIds.push(victim.id)
 
-    // Token mint, NOT enduserSDK.authenticate — /login-enduser is IP rate-limited and the suite
-    // shares one IP.
-    const attackerSDK = new EnduserSession({ host, businessId })
-    await authenticate_enduser_via_token(sdk, attackerSDK, { id: attacker.id })
+    // Token mint, NOT enduserSDK.authenticate — /login-enduser is IP rate-limited (20/min per IP)
+    // and the parallel pool runs 8 suites from one IP. Inlined rather than imported from setup.ts:
+    // that module process.exit(1)s at import time without the legacy shared-org credentials, and
+    // discovery require()s every compiled test file.
+    const attackerSDK = new EnduserSession({ host, businessId: tenant.businessId })
+    const { authToken: attackerAuthToken, enduser: attackerInfo } = (
+      await sdk.api.endusers.generate_auth_token({ id: attacker.id })
+    )
+    await attackerSDK.handle_new_session({ authToken: attackerAuthToken, enduser: attackerInfo })
 
     /* ===== A: the exploit — enduser mints a booking session as another patient ===== */
 
@@ -183,36 +192,35 @@ export const booking_info_idor_tests = async ({ sdk } : { sdk: Session, sdkNonAd
       c2Detail = `unexpectedly rejected: ${e?.message || e?.toString()}`
     }
     record('C2: staff test-contact preview branch still works', c2Pass, c2Detail)
-
-    /* ===== report: print full table first, then assert (harness exits on first failure) ===== */
-    console.log('\n  check summary:')
-    for (const c of checks) {
-      console.log(`    ${c.pass ? 'PASS' : 'FAIL'}  ${c.label}  —  ${c.detail}`)
-    }
-    console.log('')
-
-    for (const c of checks) {
-      assert(c.pass, `${c.label} — ${c.detail}`, c.label)
-    }
   } finally {
-    for (const id of enduserIds) { try { await sdk.api.endusers.deleteOne(id) } catch {} }
-    if (bookingPageId) { try { await sdk.api.appointment_booking_pages.deleteOne(bookingPageId) } catch {} }
-    if (templateId) { try { await sdk.api.calendar_event_templates.deleteOne(templateId) } catch {} }
+    if (tenant) {
+      const { sdk } = tenant
+      for (const id of enduserIds) { try { await sdk.api.endusers.deleteOne(id) } catch {} }
+      if (bookingPageId) { try { await sdk.api.appointment_booking_pages.deleteOne(bookingPageId) } catch {} }
+      if (templateId) { try { await sdk.api.calendar_event_templates.deleteOne(templateId) } catch {} }
+      // Teardown BEFORE anything asserts — assert calls process.exit, which would strand this tenant.
+      try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) }
+    }
   }
+
+  return checks
+}
+
+/** Asserting wrapper, for standalone runs. */
+export const booking_info_idor_tests = async () => {
+  assert_checks('Booking info IDOR token mint', await booking_info_idor_checks())
+}
+
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = {
+  name: 'Booking info IDOR token mint',
+  run: booking_info_idor_checks,
 }
 
 // Allow running this test file independently
 if (require.main === module) {
   console.log(`🌐 Using API URL: ${host}`)
-  const sdk = new Session({ host })
-  const sdkNonAdmin = new Session({ host })
-
-  const runTests = async () => {
-    await setup_tests(sdk, sdkNonAdmin)
-    await booking_info_idor_tests({ sdk, sdkNonAdmin })
-  }
-
-  runTests()
+  booking_info_idor_tests()
     .then(() => {
       console.log("✅ booking_info IDOR test suite completed successfully")
       process.exit(0)

package/src/tests/api_tests/security/cascade-role-rename-cross-tenant.test.ts

@@ -1,19 +1,18 @@
 require('source-map-support').install();
 
-import { Session } from "../../../sdk"
-import {
-  assert,
-  log_header,
-  wait,
-} from "@tellescope/testing"
-import { setup_tests } from "../../setup"
+import { poll_for_results } from "@tellescope/testing"
 import { PROVIDER_PERMISSIONS } from "@tellescope/constants"
 
+import {
+  assert_checks,
+  Check,
+  IsolatedSuite,
+  setup_isolated_tenant,
+} from "../../setup_isolated"
+
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
-// Separate tenant (different businessId), reusing the same hardcoded apiKey that
-// multi_tenant_tests relies on in tests.ts.
-const OTHER_TENANT_API_KEY = "ba745e25162bb95a795c5fa1af70df188d93c4d3aac9c48b34a5c8c9dd7b80f7"
+const RAND = () => Math.random().toString(36).slice(2, 10)
 
 /**
  * Tenant-boundary guard for cascade_role_rename (relates to a prior internal review,
@@ -39,117 +38,145 @@ const OTHER_TENANT_API_KEY = "ba745e25162bb95a795c5fa1af70df188d93c4d3aac9c48b34
  * Expected on current (correct) code: BOTH assertions pass. A regression that drops the
  * `businessId` scoping would flip assertion #4 to red (Tenant B user becomes `[ROLE_NEW]`).
  *
- * A collision-proof unique role name (timestamped) is used so the test never touches real roles.
+ * Both tenants are provisioned (`apiKeys: 0` — both sessions are bearer-token admin ones). Tenant B
+ * used to be a hardcoded seeded API key, which tied the file to one developer's database.
+ *
+ * SEQUENCING: the cascade is a fire-and-forget side effect, so the negative assertion must not be
+ * read before it has had its chance to run — otherwise "Tenant B is unchanged" is vacuously true
+ * because NOTHING has happened yet. The positive control (Tenant A's user showing `[ROLE_NEW]`) is
+ * the signal that the cascade has run, so we poll for THAT first and read Tenant B afterwards. A
+ * fixed sleep cannot do this job under an 8-wide parallel pool.
+ *
+ * A collision-proof unique role name is used so the test never touches real roles.
  */
-export const cascade_role_rename_cross_tenant_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("cascade role rename cross-tenant regression")
+export const cascade_role_rename_cross_tenant_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
 
-  const stamp = Date.now()
+  const stamp = `${Date.now()}_${RAND()}`
   const ROLE_OLD = `XTenantRename_${stamp}`
   const ROLE_NEW = `${ROLE_OLD}_renamed`
 
-  // Tenant B = a genuinely separate businessId (the apiKey's org). admin is required to create /
-  // set roles on users, so the apiKey user must be an Admin in its org.
-  const sdkOther = new Session({ host, apiKey: OTHER_TENANT_API_KEY })
-
-  let rbapId: string | undefined
-  // We create dedicated throwaway users in BOTH tenants and delete them in `finally`. We never
-  // mutate any pre-existing user (an earlier version of this test clobbered the apiKey's own
-  // admin user via getSome+replaceObjectFields). controlUser lives in
-  // Tenant A and SHOULD be renamed by the same-tenant cascade; victimUser lives in Tenant B and
-  // must be UNTOUCHED.
-  let controlUserId: string | undefined
-  let victimUserId: string | undefined
+  let tenantA: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+  let tenantB: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
 
   try {
-    const tenantABusinessId = sdk.userInfo.businessId
+    // Tenant B is a genuinely separate businessId. Admin is required to create / set roles on users,
+    // so both provisioned sessions are admins.
+    ;[tenantA, tenantB] = await Promise.all([
+      setup_isolated_tenant({ name: `F0053 tenant A ${RAND()}`, users: [{ isAdmin: true }], apiKeys: 0 }),
+      setup_isolated_tenant({ name: `F0053 tenant B ${RAND()}`, users: [{ isAdmin: true }], apiKeys: 0 }),
+    ])
+    const sdk = tenantA.sdk
+    const sdkOther = tenantB.sdk
 
     // 1. Tenant A: create the role to be renamed.
     const rbap = await sdk.api.role_based_access_permissions.createOne({
       role: ROLE_OLD,
       permissions: { ...PROVIDER_PERMISSIONS },
     })
-    rbapId = rbap.id
 
     // 2. Tenant A: create a throwaway control user holding ROLE_OLD (notification emails off).
+    //    We never mutate a pre-existing user, in either tenant. controlUser lives in Tenant A and
+    //    SHOULD be renamed by the same-tenant cascade; victimUser lives in Tenant B and must be
+    //    UNTOUCHED.
     const controlUser = await sdk.api.users.createOne({
       email: `f0053-control-${stamp}@example.com`,
       notificationEmailsDisabled: true,
     } as any)
-    controlUserId = controlUser.id
-    await sdk.api.users.updateOne(controlUserId, { roles: [ROLE_OLD] }, { replaceObjectFields: true })
+    await sdk.api.users.updateOne(controlUser.id, { roles: [ROLE_OLD] }, { replaceObjectFields: true })
 
     // 3. Tenant B: create a throwaway victim user holding the SAME ROLE_OLD.
     const victimUser = await sdkOther.api.users.createOne({
       email: `f0053-victim-${stamp}@example.com`,
       notificationEmailsDisabled: true,
     } as any)
-    victimUserId = victimUser.id
-    await sdkOther.api.users.updateOne(victimUserId, { roles: [ROLE_OLD] }, { replaceObjectFields: true })
+    await sdkOther.api.users.updateOne(victimUser.id, { roles: [ROLE_OLD] }, { replaceObjectFields: true })
 
     // 4. Setup sanity: tenants are distinct and both users actually hold ROLE_OLD before the rename.
     //    (Distinguishes a setup failure from the security assertion below.)
-    assert(
-      victimUser.businessId !== tenantABusinessId,
-      `Victim user shares businessId with Tenant A (${victimUser.businessId}) — not a cross-tenant scenario`,
+    // Positively pinned to tenant B rather than merely `!== tenantA`, which would pass vacuously if
+    // businessId were ever absent from the create response — and this row is what licenses reading
+    // the security assertion below as a cross-tenant result at all.
+    record(
       'setup: tenants are distinct',
+      victimUser.businessId === tenantB.businessId && tenantA.businessId !== tenantB.businessId,
+      `tenant A=${tenantA.businessId} tenant B=${tenantB.businessId}`
+        + ` victim user businessId=${victimUser.businessId} (must equal tenant B, and the two tenants must differ)`,
     )
-    const victimBefore = await sdkOther.api.users.getOne(victimUserId)
-    const controlBefore = await sdk.api.users.getOne(controlUserId)
-    assert(
+
+    const victimBefore = await sdkOther.api.users.getOne(victimUser.id)
+    const controlBefore = await sdk.api.users.getOne(controlUser.id)
+    record(
+      'setup: both users hold ROLE_OLD',
       JSON.stringify(victimBefore.roles) === JSON.stringify([ROLE_OLD])
         && JSON.stringify(controlBefore.roles) === JSON.stringify([ROLE_OLD]),
-      `Setup failed: expected both users to hold [${ROLE_OLD}] (victim=${JSON.stringify(victimBefore.roles)}, control=${JSON.stringify(controlBefore.roles)})`,
-      'setup: both users hold ROLE_OLD',
+      `expected both to hold [${ROLE_OLD}] — victim=${JSON.stringify(victimBefore.roles)}`
+        + ` control=${JSON.stringify(controlBefore.roles)}`,
     )
 
-    // 5. Tenant A renames the role. This triggers cascade_role_rename.
-    await sdk.api.role_based_access_permissions.updateOne(rbapId, { role: ROLE_NEW })
-    await wait(undefined, 1500) // let the side effect run
+    // 5. Tenant A renames the role. This triggers cascade_role_rename, which is fire-and-forget.
+    await sdk.api.role_based_access_permissions.updateOne(rbap.id, { role: ROLE_NEW })
+
+    // 6. Wait for the cascade to have actually run, by polling the SAME-TENANT control user. Reading
+    //    Tenant B before this point would make the negative assertion vacuous: the cascade would
+    //    simply not have happened yet. (A fixed wait was what this file did before; under an 8-wide
+    //    pool it is not long enough to mean anything.)
+    const controlAfter = await poll_for_results(
+      () => sdk.api.users.getOne(controlUser.id),
+      u => JSON.stringify(u.roles) === JSON.stringify([ROLE_NEW]),
+      // 20s cap rather than the 10s default: this returns the moment the cascade lands, so the only
+      // cost of a generous cap is paid when the test is about to fail anyway. On timeout
+      // poll_for_results returns the last read, which step 8 then reports as a FAIL row with evidence
+      // — the negative assertion below is explicitly cross-referenced to it so a timeout can never
+      // read as a quiet pass.
+      { iterations: 40 },
+    )
 
-    // 6. SECURITY ASSERTION — the Tenant B victim must be untouched by Tenant A's rename.
-    const victimAfter = await sdkOther.api.users.getOne(victimUserId)
-    assert(
-      JSON.stringify(victimAfter.roles) === JSON.stringify([ROLE_OLD]),
-      `CROSS-TENANT LEAK: Tenant B victim roles changed to ${JSON.stringify(victimAfter.roles)} `
-        + `after Tenant A renamed its role. Expected [${ROLE_OLD}].`,
+    // 7. SECURITY ASSERTION — the Tenant B victim must be untouched by Tenant A's rename.
+    const victimAfter = await sdkOther.api.users.getOne(victimUser.id)
+    record(
       'Tenant B user roles unaffected by other-tenant role rename',
+      JSON.stringify(victimAfter.roles) === JSON.stringify([ROLE_OLD]),
+      `Tenant B victim roles=${JSON.stringify(victimAfter.roles)}, expected [${ROLE_OLD}]`
+        + ` (read after Tenant A's cascade was observed to complete — control=${JSON.stringify(controlAfter.roles)})`,
     )
 
-    // 7. POSITIVE CONTROL — the Tenant A control user SHOULD be renamed (same-tenant cascade intact).
-    const controlAfter = await sdk.api.users.getOne(controlUserId)
-    assert(
-      JSON.stringify(controlAfter.roles) === JSON.stringify([ROLE_NEW]),
-      `Same-tenant cascade broken: Tenant A control roles are ${JSON.stringify(controlAfter.roles)}, `
-        + `expected [${ROLE_NEW}].`,
+    // 8. POSITIVE CONTROL — the Tenant A control user SHOULD be renamed (same-tenant cascade intact).
+    //    This is also what makes step 7 meaningful, so it is recorded as its own row rather than
+    //    being left implicit in the poll.
+    record(
       'Tenant A user roles renamed by same-tenant cascade',
+      JSON.stringify(controlAfter.roles) === JSON.stringify([ROLE_NEW]),
+      `Tenant A control roles=${JSON.stringify(controlAfter.roles)}, expected [${ROLE_NEW}]`,
     )
   } finally {
-    // Cleanup: delete both throwaway users and the role doc. Never touches pre-existing users.
-    if (victimUserId) {
-      try { await sdkOther.api.users.deleteOne(victimUserId) } catch {}
-    }
-    if (controlUserId) {
-      try { await sdk.api.users.deleteOne(controlUserId) } catch {}
-    }
-    if (rbapId) {
-      try { await sdk.api.role_based_access_permissions.deleteOne(rbapId) } catch {}
+    // Teardown BEFORE anything asserts — assert calls process.exit, which would strand these tenants
+    // permanently (nothing in the system can delete an organization record). Tearing the tenants down
+    // removes the throwaway users and the role doc with them.
+    for (const t of [tenantA, tenantB]) {
+      if (t) { try { await t.teardown() } catch (e) { console.error('teardown failed', e) } }
     }
   }
+
+  return checks
+}
+
+/** Asserting wrapper, for standalone runs. */
+export const cascade_role_rename_cross_tenant_tests = async () => {
+  assert_checks('cascade role rename cross-tenant', await cascade_role_rename_cross_tenant_checks())
+}
+
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = {
+  name: 'cascade role rename cross-tenant',
+  run: cascade_role_rename_cross_tenant_checks,
 }
 
 // Allow running this test file independently
 if (require.main === module) {
   console.log(`🌐 Using API URL: ${host}`)
-  const sdk = new Session({ host })
-  const sdkNonAdmin = new Session({ host })
-
-  const runTests = async () => {
-    await setup_tests(sdk, sdkNonAdmin)
-    await cascade_role_rename_cross_tenant_tests({ sdk, sdkNonAdmin })
-  }
-
-  runTests()
+  cascade_role_rename_cross_tenant_tests()
     .then(() => {
       console.log("✅ cascade role rename cross-tenant test suite completed successfully")
       process.exit(0)