@tellescope/sdk 2.0.0-beta.2 → 2.0.0-beta.3

package/src/tests/api_tests/security/enduser-write-restrictions.test.ts

@@ -1,14 +1,16 @@
 require('source-map-support').install();
 
-import { Session, EnduserSession } from "../../../sdk"
+import { EnduserSession } from "../../../sdk"
 import {
-  async_test,
-  log_header,
-} from "@tellescope/testing"
-import { setup_tests } from "../../setup"
+  assert_checks,
+  Check,
+  IsolatedSuite,
+  setup_isolated_tenant,
+} from "../../setup_isolated"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
-const businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6'
+
+const RAND = () => Math.random().toString(36).slice(2, 10)
 
 const ENDUSER_PASSWORD = 'F0106TestPassword!123'
 
@@ -84,16 +86,93 @@ const restrictedFormResponseUpdates = (staffId: string, otherEnduserId: string):
  *   - nothing persists (spot-checked on assignedTo, the highest-impact field)
  *   - enduser self-updates of allowed fields still work (fname, hideFromEnduserPortal)
  *   - staff sessions can still update the restricted fields
+ *
+ * Runs on its own provisioned tenant, so the patient session's businessId comes from the tenant
+ * rather than a TEST_BUSINESS_ID env var with a hardcoded shared-org fallback. Checks are collected
+ * and returned rather than asserted inline: `assert` calls process.exit, which would skip this
+ * suite's `finally` cleanup and, in the parallel pool, every other in-flight suite's teardown.
  */
-export const enduser_write_restrictions_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("enduser write restrictions (enduserUpdatesDisabled)")
+export const enduser_write_restrictions_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  // The raw value decides the fallback, not JSON.stringify of it — JSON.stringify('') is '""',
+  // which is truthy, so a `|| fallback` on the stringified form could never fire.
+  const describe = (value: any): string => {
+    if (value === undefined || value === null) return String(value)
+    const stringified = JSON.stringify(value)
+    return stringified === undefined ? String(value) : stringified
+  }
+  const errorMessage = (e: any): string => (
+    typeof e?.message === 'string' && e.message !== '' ? e.message : describe(e)
+  )
+
+  /** The async_test({ shouldError, onError }) equivalent, as a soft Check. */
+  const expect_rejection = async (
+    label: string,
+    fn: () => Promise<any>,
+    expectedMessage: string,
+  ) => {
+    let error: any
+    let rejected = false
+    try {
+      await fn()
+    } catch (e: any) {
+      rejected = true
+      error = e
+    }
+
+    if (!rejected) {
+      // deliberately does NOT print the record: it is a patient profile / form response
+      record(label, false, `NOT REJECTED: the update succeeded (expected "${expectedMessage}")`)
+      return
+    }
+
+    const message = errorMessage(error)
+    record(
+      label,
+      message === expectedMessage,
+      message === expectedMessage
+        ? `rejected: ${message}`
+        : `rejected with the WRONG error: ${message} (expected "${expectedMessage}")`,
+    )
+  }
+
+  /**
+   * The async_test({ onResult }) equivalent, as a soft Check: a call that REJECTS is a failure
+   * (async_test treats it the same way), and a resolved call passes only when `inspect` agrees.
+   * `inspect` runs inside the try so a throw inside it fails this one check rather than escaping
+   * `run` and aborting every other suite in the batch. It returns the detail too, rather than this
+   * dumping the whole record — an enduser and a FormResponse carry the patient's name, email and
+   * answers, and the check table prints on every run.
+   */
+  const expect_result = async <T,>(
+    label: string,
+    fn: () => Promise<T>,
+    inspect: (r: T) => { pass: boolean, detail: string },
+  ) => {
+    try {
+      const { pass, detail } = inspect(await fn())
+      record(label, pass, detail)
+    } catch (e: any) {
+      record(label, false, `rejected instead of resolving: ${errorMessage(e)}`)
+    }
+  }
 
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
   let enduserId: string | undefined
   let otherEnduserId: string | undefined
   let formId: string | undefined
   let formResponseId: string | undefined
 
   try {
+    tenant = await setup_isolated_tenant({
+      name: `Enduser write restrictions ${RAND()}`,
+      users: [{ isAdmin: true }],
+      apiKeys: 0,
+    })
+    const { sdk } = tenant
+
     // Setup: throwaway enduser with portal credentials, plus a form_response they own
     const enduserEmail = `f0106-enduser-${Date.now()}@example.com`
     const enduser = await sdk.api.endusers.createOne({ email: enduserEmail, fname: 'F0106', lname: 'Restricted' })
@@ -106,7 +185,7 @@ export const enduser_write_restrictions_tests = async ({ sdk } : { sdk: Session,
     otherEnduserId = otherEnduser.id
     await sdk.api.endusers.set_password({ id: enduser.id, password: ENDUSER_PASSWORD })
 
-    const enduserSDK = new EnduserSession({ host, businessId })
+    const enduserSDK = new EnduserSession({ host, businessId: tenant.businessId })
     await enduserSDK.authenticate(enduserEmail, ENDUSER_PASSWORD)
 
     const form = await sdk.api.forms.createOne({ title: 'Write Restriction Test Form' })
@@ -119,54 +198,69 @@ export const enduser_write_restrictions_tests = async ({ sdk } : { sdk: Session,
 
     // ---- enduser self-update of restricted endusers fields must 400 ----
     for (const [field, value] of Object.entries(restrictedEnduserUpdates(sdk.userInfo.id, enduser.id))) {
-      await async_test(
+      await expect_rejection(
         `enduser cannot self-update endusers.${field}`,
         () => enduserSDK.api.endusers.updateOne(enduser.id, { [field]: value } as any),
-        { shouldError: true, onError: e => e.message === `${field} cannot be updated by endusers` },
+        `${field} cannot be updated by endusers`,
       )
     }
 
     // Variant A persistence check: the rejected assignedTo write must not
     // have granted the staff read-filter match.
-    await async_test(
+    await expect_result(
       'rejected assignedTo write did not persist',
       () => sdk.api.endusers.getOne(enduser.id),
-      { onResult: e => !e.assignedTo?.length && !e.tags?.length && e.externalId === undefined },
+      e => ({
+        pass: !e.assignedTo?.length && !e.tags?.length && e.externalId === undefined,
+        detail: `assignedTo=${describe(e.assignedTo)} tags=${describe(e.tags)} `
+          + `externalId=${describe(e.externalId)} (want none of them set)`,
+      }),
     )
 
     // ---- enduser self-update of restricted form_responses fields must 400 ----
     for (const [field, value] of Object.entries(restrictedFormResponseUpdates(sdk.userInfo.id, otherEnduser.id))) {
-      await async_test(
+      await expect_rejection(
         `enduser cannot self-update form_responses.${field}`,
         () => enduserSDK.api.form_responses.updateOne(formResponse.id, { [field]: value } as any),
-        { shouldError: true, onError: e => e.message === `${field} cannot be updated by endusers` },
+        `${field} cannot be updated by endusers`,
       )
     }
 
-    await async_test(
+    await expect_result(
       'rejected writes did not persist (markedAsSubmitted, procedureCodes, submittedBy, enduserId)',
       () => sdk.api.form_responses.getOne(formResponse.id),
-      { onResult: fr => (
-        !fr.markedAsSubmitted && !fr.procedureCodes?.length && fr.submittedBy === undefined
-        // still points at its own patient: a successful repoint is what redirects the intake write
-        && fr.enduserId === enduser.id
-      ) },
+      fr => ({
+        pass: (
+          !fr.markedAsSubmitted && !fr.procedureCodes?.length && fr.submittedBy === undefined
+          // still points at its own patient: a successful repoint is what redirects the intake write
+          && fr.enduserId === enduser.id
+        ),
+        detail: `markedAsSubmitted=${describe(fr.markedAsSubmitted)} `
+          + `procedureCodes=${describe(fr.procedureCodes?.length)} submittedBy=${describe(fr.submittedBy)} `
+          + `enduserId matches own=${describe(fr.enduserId === enduser.id)}`,
+      }),
     )
 
     // ---- Positive controls: intended enduser self-updates still work ----
-    await async_test(
+    await expect_result(
       'enduser can still update own profile fields (fname/lname)',
       () => enduserSDK.api.endusers.updateOne(enduser.id, { fname: 'StillAllowed', lname: 'Patient' }),
-      { onResult: e => e.fname === 'StillAllowed' && e.lname === 'Patient' },
+      e => ({
+        pass: e.fname === 'StillAllowed' && e.lname === 'Patient',
+        detail: `fname set=${describe(e.fname === 'StillAllowed')} lname set=${describe(e.lname === 'Patient')}`,
+      }),
     )
-    await async_test(
+    await expect_result(
       'enduser can still update own form_response (hideFromEnduserPortal — intended per schema)',
       () => enduserSDK.api.form_responses.updateOne(formResponse.id, { hideFromEnduserPortal: true }),
-      { onResult: fr => fr.hideFromEnduserPortal === true },
+      fr => ({
+        pass: fr.hideFromEnduserPortal === true,
+        detail: `hideFromEnduserPortal=${describe(fr.hideFromEnduserPortal)} (want true)`,
+      }),
     )
 
     // ---- Positive controls: staff sessions are unaffected by enduserUpdatesDisabled ----
-    await async_test(
+    await expect_result(
       'staff can still update restricted endusers fields (tags, assignedTo, externalId, note, source)',
       () => sdk.api.endusers.updateOne(enduser.id, {
         tags: ['staff-set-tag'],
@@ -175,66 +269,90 @@ export const enduser_write_restrictions_tests = async ({ sdk } : { sdk: Session,
         note: 'staff-set note',
         source: 'staff-set-source',
       }),
-      { onResult: e => (
-        !!e.tags?.includes('staff-set-tag')
-        && !!e.assignedTo?.includes(sdk.userInfo.id)
-        && e.externalId === 'staff-set-external-id'
-      ) },
+      e => ({
+        pass: (
+          !!e.tags?.includes('staff-set-tag')
+          && !!e.assignedTo?.includes(sdk.userInfo.id)
+          && e.externalId === 'staff-set-external-id'
+        ),
+        detail: `tags=${describe(e.tags)} assignedTo includes staff=`
+          + `${describe(!!e.assignedTo?.includes(sdk.userInfo.id))} externalId=${describe(e.externalId)}`,
+      }),
     )
-    await async_test(
+    await expect_result(
       'staff can still update restricted form_responses fields (procedureCodes, diagnosisCodes, tags)',
       () => sdk.api.form_responses.updateOne(formResponse.id, {
         procedureCodes: [{ code: 'G0019', units: 1 }],
         diagnosisCodes: [{ code: 'Z71.3', description: 'Dietary counseling and surveillance' }],
         tags: ['staff-set-tag'],
       }),
-      { onResult: fr => (
-        fr.procedureCodes?.[0]?.code === 'G0019'
-        && fr.diagnosisCodes?.[0]?.code === 'Z71.3'
-        && !!fr.tags?.includes('staff-set-tag')
-      ) },
+      fr => ({
+        pass: (
+          fr.procedureCodes?.[0]?.code === 'G0019'
+          && fr.diagnosisCodes?.[0]?.code === 'Z71.3'
+          && !!fr.tags?.includes('staff-set-tag')
+        ),
+        detail: `procedureCodes[0].code=${describe(fr.procedureCodes?.[0]?.code)} `
+          + `diagnosisCodes[0].code=${describe(fr.diagnosisCodes?.[0]?.code)} tags=${describe(fr.tags)}`,
+      }),
     )
 
     // enduserId is enduserUpdatesDisabled rather than updatesDisabled specifically so this keeps
     // working: staff sometimes need to move a response to the correct profile to fix a mistake.
-    await async_test(
+    await expect_result(
       'staff can still repoint form_responses.enduserId to another patient',
       () => sdk.api.form_responses.updateOne(formResponse.id, { enduserId: otherEnduser.id }),
-      { onResult: fr => fr.enduserId === otherEnduser.id },
+      fr => ({
+        pass: fr.enduserId === otherEnduser.id,
+        detail: `repointed to the other patient=${describe(fr.enduserId === otherEnduser.id)}`,
+      }),
     )
-    await async_test(
+    await expect_result(
       'staff can repoint form_responses.enduserId back',
       () => sdk.api.form_responses.updateOne(formResponse.id, { enduserId: enduser.id }),
-      { onResult: fr => fr.enduserId === enduser.id },
+      fr => ({
+        pass: fr.enduserId === enduser.id,
+        detail: `repointed back to the owner=${describe(fr.enduserId === enduser.id)}`,
+      }),
     )
   } finally {
-    if (formResponseId) {
-      try { await sdk.api.form_responses.deleteOne(formResponseId) } catch {}
-    }
-    if (formId) {
-      try { await sdk.api.forms.deleteOne(formId) } catch {}
-    }
-    if (enduserId) {
-      try { await sdk.api.endusers.deleteOne(enduserId) } catch {}
-    }
-    if (otherEnduserId) {
-      try { await sdk.api.endusers.deleteOne(otherEnduserId) } catch {}
+    if (tenant) {
+      const { sdk } = tenant
+      if (formResponseId) {
+        try { await sdk.api.form_responses.deleteOne(formResponseId) } catch {}
+      }
+      if (formId) {
+        try { await sdk.api.forms.deleteOne(formId) } catch {}
+      }
+      if (enduserId) {
+        try { await sdk.api.endusers.deleteOne(enduserId) } catch {}
+      }
+      if (otherEnduserId) {
+        try { await sdk.api.endusers.deleteOne(otherEnduserId) } catch {}
+      }
+      // Teardown BEFORE anything asserts — assert calls process.exit, which would strand this tenant.
+      try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) }
     }
   }
+
+  return checks
+}
+
+/** Asserting wrapper, for standalone runs. */
+export const enduser_write_restrictions_tests = async () => {
+  assert_checks('Enduser write restrictions', await enduser_write_restrictions_checks())
+}
+
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = {
+  name: 'Enduser write restrictions',
+  run: enduser_write_restrictions_checks,
 }
 
 // Allow running this test file independently
 if (require.main === module) {
   console.log(`🌐 Using API URL: ${host}`)
-  const sdk = new Session({ host })
-  const sdkNonAdmin = new Session({ host })
-
-  const runTests = async () => {
-    await setup_tests(sdk, sdkNonAdmin)
-    await enduser_write_restrictions_tests({ sdk, sdkNonAdmin })
-  }
-
-  runTests()
+  enduser_write_restrictions_tests()
     .then(() => {
       console.log("✅ enduser write-restriction test suite completed successfully")
       process.exit(0)

package/src/tests/api_tests/security/globalunique-conflict-redaction.test.ts

@@ -1,14 +1,21 @@
 require('source-map-support').install();
 
-import { Session } from "../../../sdk"
 import {
-  async_test,
-  log_header,
-} from "@tellescope/testing"
-import { setup_tests } from "../../setup"
+  assert_checks,
+  Check,
+  setup_isolated_tenant,
+  IsolatedSuite,
+  IsolatedTenant,
+} from "../../setup_isolated"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
+/** The only keys the redacted `existingRecord` may carry. `convert_id_name` never runs on an error
+ *  body, so the raw `_id` is what ships; `id` is tolerated in case that ever changes. */
+const ALLOWED_EXISTING_RECORD_KEYS = ['_id', 'id', 'businessId']
+
 /**
  * Regression test: a globalUnique conflict response must not echo the matched record.
  *
@@ -19,59 +26,171 @@ const host = process.env.API_URL || 'http://localhost:8080' as const
  * (globalUnique: ['email','phone']) the 409 body leaked the full record incl. hashedPass.
  *
  * Fix: redact existingRecord to { _id, businessId } like the safe validateUniquenessConstraints
- * path. This reproduces the leak with a same-tenant collision (same code path) and asserts the
- * 409 body's existingRecord exposes nothing beyond _id + businessId.
+ * path. Both checks below drive that block directly with `_overrideUnique: true`, which is what
+ * skips `validateUniquenessConstraints` (a separate 409 with its own redaction, out of scope here).
+ *
+ *   1. Same-tenant collision — the original coverage, preserved.
+ *   2. Cross-tenant collision — tenant B re-creates tenant A's address. This is the case that
+ *      actually exercises the leak: `findSomeByMatchAny_Global` drops `businessId`, so only a
+ *      foreign match can carry another tenant's data, and the check pins
+ *      `existingRecord.businessId === tenantA.businessId` so a same-tenant match cannot satisfy it.
+ *      Returning the other tenant's `_id` + `businessId` is the accepted fixed behaviour.
+ *
+ * Provisions two throwaway tenants rather than using the shared fixture: the suite creates real
+ * `users` records, and an interrupted run against the shared org would strand staff accounts in it.
  */
-export const globalunique_leak_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("globalUnique conflict response redaction")
+export const globalunique_leak_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  let tenantA: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+  let tenantB: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
 
-  let userId: string | undefined
   try {
-    const email = `f0145-victim-${Date.now()}@example.com`
-    const user = await sdk.api.users.createOne({ email } as any)
-    userId = user.id
-
-    await async_test(
-      'globalUnique 409 existingRecord exposes only _id + businessId (no email/hashedPass)',
-      () => sdk.api.users.createOne({ email, _overrideUnique: true } as any),
-      {
-        shouldError: true,
-        onError: (e: any) => {
-          const rec = e?.info?.[0]?.existingRecord
-          if (!rec || typeof rec !== 'object') return false
-          const keys = Object.keys(rec)
-          return (
-            keys.length > 0
-            && keys.every(k => k === '_id' || k === 'businessId' || k === 'id')
-            && !('email' in rec)
-            && !('hashedPass' in rec)
-            && !('hashedInviteCode' in rec)
-          )
-        },
-      },
+    ;[tenantA, tenantB] = await Promise.all([
+      setup_isolated_tenant({ name: `GlobalUnique A ${RAND()}`, users: [{ isAdmin: true }], apiKeys: 0 }),
+      setup_isolated_tenant({ name: `GlobalUnique B ${RAND()}`, users: [{ isAdmin: true }], apiKeys: 0 }),
+    ])
+
+    // `dontsend...@tellescope.com` is what suppresses outbound mail (api/modules/sqs.ts), so creating
+    // the user cannot deliver an invite. Stamped per run because `users.email` is globalUnique ACROSS
+    // organizations — a fixed address would collide with a concurrently running suite's tenant and
+    // make the 409 point at a record this suite does not own.
+    const email = `dontsend-globalunique-${Date.now()}-${RAND()}@tellescope.com`
+
+    const victim = await tenantA.sdk.api.users.createOne({ email } as any)
+
+    record(
+      'setup: two separate tenants, the colliding user belongs to tenant A',
+      tenantA.businessId !== tenantB.businessId && !!victim.id,
+      `tenantA=${tenantA.businessId} tenantB=${tenantB.businessId} user=${victim.id} email=${email}`,
     )
+
+    /** Drives the globalUnique block and reports what the 409's `existingRecord` exposed. */
+    const probe = async (sdk: IsolatedTenant['sdk']) => {
+      let error: any
+      let accepted: any
+      try {
+        accepted = await sdk.api.users.createOne({ email, _overrideUnique: true } as any)
+      } catch (err) { error = err }
+
+      const violation = error?.info?.[0]
+      return { error, accepted, existingRecord: violation?.existingRecord, conflictingFields: violation?.conflictingFields }
+    }
+
+    /**
+     * Pins WHICH 409 answered. Both uniqueness sites now redact to an identical `{ _id, businessId }`,
+     * so the body alone cannot tell them apart — and `validateUniquenessConstraints` also looks up
+     * cross-tenant. If `_overrideUnique` ever stopped skipping that earlier validation, these checks
+     * would keep passing while covering the wrong site.
+     *
+     * The discriminator is the shape of `conflictingFields`: the globalUnique block passes the raw
+     * constraint ARRAY (`model.constraints.globalUnique`, i.e. ['email','phone']), while
+     * validateUniquenessConstraints passes a `matching_fields` OBJECT (`{ email: '<value>' }`).
+     */
+    const from_globalunique_block = (conflictingFields: any) => Array.isArray(conflictingFields)
+
+    /** The redaction assertion shared by both checks. */
+    const redaction_verdict = (rec: any) => {
+      if (!rec || typeof rec !== 'object') return { pass: false, keys: [] as string[] }
+      const keys = Object.keys(rec)
+      const pass = (
+        keys.length > 0
+        && keys.every(k => ALLOWED_EXISTING_RECORD_KEYS.includes(k))
+        // named explicitly as well as covered by the allow-list above: these are the fields the
+        // unredacted body actually leaked, and the list is what a later edit would widen
+        && !('email' in rec)
+        && !('hashedPass' in rec)
+        && !('hashedInviteCode' in rec)
+      )
+      return { pass, keys }
+    }
+
+    /* ===== 1: same-tenant collision (the original coverage) ===== */
+
+    const sameTenant = await probe(tenantA.sdk)
+
+    if (!sameTenant.error) {
+      record(
+        '1: same-tenant globalUnique 409 existingRecord exposes only _id + businessId',
+        false,
+        `the write was accepted (id=${sameTenant.accepted?.id}) — no 409 was raised, so the redaction was never exercised`,
+      )
+    } else {
+      const { pass, keys } = redaction_verdict(sameTenant.existingRecord)
+      const fromGlobalUnique = from_globalunique_block(sameTenant.conflictingFields)
+      record(
+        '1: same-tenant globalUnique 409 existingRecord exposes only _id + businessId',
+        pass && fromGlobalUnique,
+        `existingRecord keys=${JSON.stringify(keys)} (allowed: ${JSON.stringify(ALLOWED_EXISTING_RECORD_KEYS)});`
+        + ` conflictingFields=${JSON.stringify(sameTenant.conflictingFields)} (must be the globalUnique array,`
+        + ` not a validateUniquenessConstraints object);`
+        + ` error=${sameTenant.error?.message || String(sameTenant.error)}`,
+      )
+    }
+
+    /* ===== 2: cross-tenant collision — the case that can leak another tenant's record ===== */
+
+    const crossTenant = await probe(tenantB.sdk)
+
+    if (!crossTenant.error) {
+      record(
+        '2: cross-tenant globalUnique 409 exposes only tenant A\'s _id + businessId',
+        false,
+        `the write was accepted (id=${crossTenant.accepted?.id}) — tenant B re-created a globalUnique email`
+        + ` without a 409, so the redaction was never exercised`,
+      )
+    } else {
+      const rec = crossTenant.existingRecord
+      const { pass, keys } = redaction_verdict(rec)
+      // pinned so a SAME-tenant match cannot satisfy this check: the 409 must name tenant A, proving
+      // the cross-tenant lookup is the one that ran
+      const namesTenantA = String(rec?.businessId ?? '') === String(tenantA.businessId)
+      // check 1's duplicate create threw, so tenant A's `victim` is the ONLY record anywhere carrying
+      // this address — the matched _id is deterministic, so pin it rather than only reporting it
+      const namesVictim = String(rec?._id ?? rec?.id ?? '') === String(victim.id)
+      const fromGlobalUnique = from_globalunique_block(crossTenant.conflictingFields)
+      record(
+        '2: cross-tenant globalUnique 409 exposes only tenant A\'s _id + businessId',
+        pass && namesTenantA && namesVictim && fromGlobalUnique,
+        `existingRecord keys=${JSON.stringify(keys)} (allowed: ${JSON.stringify(ALLOWED_EXISTING_RECORD_KEYS)});`
+        + ` conflictingFields=${JSON.stringify(crossTenant.conflictingFields)} (must be the globalUnique array,`
+        + ` not a validateUniquenessConstraints object);`
+        + ` businessId=${rec?.businessId ?? '<missing>'} (want tenant A ${tenantA.businessId}, not caller ${tenantB.businessId});`
+        + ` _id=${rec?._id ?? rec?.id ?? '<missing>'} (tenant A user ${victim.id});`
+        + ` error=${crossTenant.error?.message || String(crossTenant.error)}`,
+      )
+    }
   } finally {
-    if (userId) { try { await sdk.api.users.deleteOne(userId) } catch {} }
+    // Teardown happens here, BEFORE anything asserts — assert calls process.exit and would otherwise
+    // strand these tenants permanently (nothing can delete an organization record). It is also the
+    // only cleanup needed: teardown deletes every schema model for the businessId, `users` included.
+    for (const t of [tenantA, tenantB]) {
+      if (t) { try { await t.teardown() } catch (e) { console.error('teardown failed', e) } }
+    }
   }
+
+  return checks
 }
 
-if (require.main === module) {
-  console.log(`🌐 Using API URL: ${host}`)
-  const sdk = new Session({ host })
-  const sdkNonAdmin = new Session({ host })
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+export const globalunique_leak_tests = async () => {
+  assert_checks('globalUnique conflict redaction', await globalunique_leak_checks())
+}
 
-  const runTests = async () => {
-    await setup_tests(sdk, sdkNonAdmin)
-    await globalunique_leak_tests({ sdk, sdkNonAdmin })
-  }
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = { name: 'globalUnique conflict redaction', run: globalunique_leak_checks }
 
-  runTests()
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  globalunique_leak_tests()
     .then(() => {
-      console.log("✅ globalUnique leak test suite completed successfully")
+      console.log("✅ globalUnique conflict redaction test suite completed successfully")
       process.exit(0)
     })
     .catch((error) => {
-      console.error("❌ globalUnique leak test suite failed:", error)
+      console.error("❌ globalUnique conflict redaction test suite failed:", error)
       process.exit(1)
     })
 }