@tellescope/sdk 2.0.0-beta.2 → 2.0.0-beta.3

package/src/tests/api_tests/security/handle-incoming-communication-cross-tenant.test.ts

@@ -2,17 +2,17 @@ require('source-map-support').install();
 
 import axios from "axios"
 import { ObjectId } from 'bson'
-import { Session } from "../../../sdk"
+
 import {
-  async_test,
-  log_header,
-} from "@tellescope/testing"
-import { setup_tests } from "../../setup"
+  assert_checks,
+  Check,
+  IsolatedSuite,
+  setup_isolated_tenant,
+} from "../../setup_isolated"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
-const CROSS_ORG_API_KEY = process.env.CROSS_ORG_API_KEY
-const CROSS_ORG_TARGET_BUSINESS_ID = process.env.CROSS_ORG_TARGET_BUSINESS_ID
+const RAND = () => Math.random().toString(36).slice(2, 10)
 
 const post = async (path: string, body: any, headers: Record<string, string> = {}) => {
   try {
@@ -36,89 +36,97 @@ const post = async (path: string, body: any, headers: Record<string, string> = {
  * The fix switches to the standard tenant-scoped `DB.endusers.findById(enduserId)` wrapper, which automatically
  * filters by `req.session.businessId`. Cross-tenant lookups now return null → handler returns 404 → no side effect.
  *
- * Note: the same-tenant happy path is already covered by the existing test at
- * `packages/public/sdk/src/tests/tests.ts:7588` ("handle_incoming_communication test for other enduser") — that
- * test creates endusers in the test tenant, sets up journeys, calls handle_incoming_communication, and asserts
- * journey-step cancellation. This file covers the negative cases only.
+ * Note: the same-tenant happy path is already covered by the existing test in `tests.ts`
+ * ("handle_incoming_communication test for other enduser") — that test creates endusers in the test
+ * tenant, sets up journeys, calls handle_incoming_communication, and asserts journey-step
+ * cancellation. This file covers the negative cases only.
  *
  * **Negative-only by design**: the test never drives `handleIncomingCommunication` against a cross-tenant
  * enduser — the post-fix code returns 404 before any side effects fire, and the assertion confirms that.
+ *
+ * Both tenants are provisioned here (`apiKeys: 0` — the sessions are bearer-token ones, no API key is
+ * used). Previously the second tenant came from the cross-org environment variables, which are unset
+ * on a clean checkout, so the cross-tenant assertion — the whole point of the file — silently skipped
+ * and the suite still passed green.
  */
-export const handle_incoming_communication_cross_tenant_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("handle_incoming_communication cross-tenant rejection")
+export const handle_incoming_communication_cross_tenant_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
 
-  // ====================================================================
-  // Assertion 1: nonexistent enduserId returns 404 (baseline; regression
-  // guard for the not-found path that any cross-tenant call now lands in).
-  // ====================================================================
-  const nonexistentId = new ObjectId().toHexString()
-  const nonexistentRes = await post(
-    '/v1/journeys/handle-incoming-communication',
-    { enduserId: nonexistentId },
-    { Authorization: `Bearer ${sdk.authToken}` },
-  )
-  await async_test(
-    "handle_incoming_communication with nonexistent enduserId returns 404",
-    async () => ({ status: nonexistentRes.status }),
-    { onResult: r => r.status === 404 },
-  )
+  let caller: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+  let victimTenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
 
-  // ====================================================================
-  // Assertion 2: cross-tenant enduserId returns 404 (the actual fix).
-  // Env-gated; skipped when cross-org infra isn't configured.
-  // Safe to run post-fix because the tenant-scoped DB returns null for
-  // cross-tenant lookups — no handleIncomingCommunication side effect fires.
-  // ====================================================================
-  if (!(CROSS_ORG_API_KEY && CROSS_ORG_TARGET_BUSINESS_ID)) {
-    console.log("  Skipping cross-tenant rejection assertion — CROSS_ORG_* env vars not set")
-    return
-  }
+  try {
+    ;[caller, victimTenant] = await Promise.all([
+      setup_isolated_tenant({ name: `F0008 caller ${RAND()}`, users: [{ isAdmin: true }], apiKeys: 0 }),
+      setup_isolated_tenant({ name: `F0008 victim ${RAND()}`, users: [{ isAdmin: true }], apiKeys: 0 }),
+    ])
 
-  const sdkCrossOrg = new Session({
-    host,
-    apiKey: CROSS_ORG_API_KEY,
-    headers: { 'x-tellescope-organization': CROSS_ORG_TARGET_BUSINESS_ID },
-  })
+    // ====================================================================
+    // Assertion 1: nonexistent enduserId returns 404 (baseline; regression
+    // guard for the not-found path that any cross-tenant call now lands in).
+    // ====================================================================
+    const nonexistentId = new ObjectId().toHexString()
+    const nonexistentRes = await post(
+      '/v1/journeys/handle-incoming-communication',
+      { enduserId: nonexistentId },
+      { Authorization: `Bearer ${caller.sdk.authToken}` },
+    )
+    record(
+      "handle_incoming_communication with nonexistent enduserId returns 404",
+      nonexistentRes.status === 404,
+      `enduserId=${nonexistentId} status=${nonexistentRes.status} (want 404) body=${JSON.stringify(nonexistentRes.data)}`,
+    )
 
-  // Create a sentinel enduser in the cross-org tenant. Use a clearly-test email
-  // so any accidental side-effect routing is obvious in logs.
-  const ts = Date.now()
-  const crossEnduser = await sdkCrossOrg.api.endusers.createOne({
-    fname: 'F0008CrossTenant', lname: 'Sentinel',
-    email: `f0008-cross-${ts}@tellescope.com`,
-  } as any)
+    // ====================================================================
+    // Assertion 2: cross-tenant enduserId returns 404 (the actual fix).
+    // Safe to run post-fix because the tenant-scoped DB returns null for
+    // cross-tenant lookups — no handleIncomingCommunication side effect fires.
+    // ====================================================================
+    // Sentinel enduser in the OTHER tenant. Clearly-test naming so any accidental side-effect routing
+    // is obvious in logs.
+    const crossEnduser = await victimTenant.sdk.api.endusers.createOne({
+      fname: 'F0008CrossTenant', lname: 'Sentinel',
+      email: `f0008-cross-${RAND()}@tellescope.com`,
+    } as any)
 
-  try {
+    // the POST keeps the CALLER tenant's bearer token — the enduser id is the other tenant's
     const crossRes = await post(
       '/v1/journeys/handle-incoming-communication',
       { enduserId: crossEnduser.id },
-      { Authorization: `Bearer ${sdk.authToken}` },
+      { Authorization: `Bearer ${caller.sdk.authToken}` },
     )
-
-    await async_test(
+    record(
       "handle_incoming_communication with cross-tenant enduserId returns 404 (no side effect)",
-      async () => ({
-        status: crossRes.status,
-        message: crossRes.data?.message ?? null,
-      }),
-      { onResult: r => r.status === 404 },
+      crossRes.status === 404,
+      `caller tenant=${caller.businessId} enduser tenant=${victimTenant.businessId} enduserId=${crossEnduser.id}`
+        + ` status=${crossRes.status} (want 404) body=${JSON.stringify(crossRes.data)}`,
     )
   } finally {
-    try { await sdkCrossOrg.api.endusers.deleteOne(crossEnduser.id) } catch {}
+    // Teardown BEFORE anything asserts — assert calls process.exit, which would strand these tenants
+    // permanently (nothing in the system can delete an organization record).
+    for (const t of [caller, victimTenant]) {
+      if (t) { try { await t.teardown() } catch (e) { console.error('teardown failed', e) } }
+    }
   }
+
+  return checks
 }
 
-if (require.main === module) {
-  console.log(`🌐 Using API URL: ${host}`)
-  const sdk = new Session({ host })
-  const sdkNonAdmin = new Session({ host })
+/** Asserting wrapper, for standalone runs. */
+export const handle_incoming_communication_cross_tenant_tests = async () => {
+  assert_checks('handle_incoming_communication cross-tenant', await handle_incoming_communication_cross_tenant_checks())
+}
 
-  const runTests = async () => {
-    await setup_tests(sdk, sdkNonAdmin)
-    await handle_incoming_communication_cross_tenant_tests({ sdk, sdkNonAdmin })
-  }
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = {
+  name: 'handle_incoming_communication cross-tenant',
+  run: handle_incoming_communication_cross_tenant_checks,
+}
 
-  runTests()
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  handle_incoming_communication_cross_tenant_tests()
     .then(() => {
       console.log("✅ handle_incoming_communication cross-tenant test suite completed successfully")
       process.exit(0)
@@ -127,4 +135,4 @@ if (require.main === module) {
       console.error("❌ handle_incoming_communication cross-tenant test suite failed:", error)
       process.exit(1)
     })
-}
+}

package/src/tests/api_tests/security/load-inbox-redaction.test.ts

@@ -1,16 +1,18 @@
 require('source-map-support').install();
 
-import { Session } from "../../../sdk"
 import {
-  async_test,
-  log_header,
-} from "@tellescope/testing"
-import { setup_tests } from "../../setup"
+  assert_checks,
+  Check,
+  IsolatedSuite,
+  setup_isolated_tenant,
+} from "../../setup_isolated"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
 const ENDUSER_PASSWORD = 'F0151TestPassword!123'
 
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
 /**
  * Regression test: `load_inbox_data` must apply enduser field redactions.
  *
@@ -21,54 +23,87 @@ const ENDUSER_PASSWORD = 'F0151TestPassword!123'
  * Repro: create an enduser, set their portal password (→ hashedPassword), seed an inbound
  * (logOnly) email so the enduser appears in the inbox join, then load_inbox_data as staff and
  * assert the returned enduser entry has NO hashedPassword.
+ *
+ * Why configure_inbox runs first: emails.createOne is registered `requiresInboxConfiguration`,
+ * which reads username/orgEmail off the JWT, and a provisioned user has neither — so the seed
+ * would 400 without it. The SDK's configure_inbox is a plain POST: it returns a new authToken but
+ * does not install it, hence the refresh_session() that follows.
  */
-export const load_inbox_redaction_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("load_inbox_data enduser redaction")
+export const load_inbox_redaction_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
 
-  let enduserId: string | undefined
-  let emailId: string | undefined
   try {
-    const email = `f0151-enduser-${Date.now()}@example.com`
-    const enduser = await sdk.api.endusers.createOne({ email, fname: 'F0151', lname: 'Inbox' })
-    enduserId = enduser.id
-    await sdk.api.endusers.set_password({ id: enduser.id, password: ENDUSER_PASSWORD })
-
-    // Seed an inbound logOnly email so the enduser is joined into the inbox payload
-    const seeded = await sdk.api.emails.createOne({
-      enduserId: enduser.id, subject: 'F0151 seed', textContent: 'seed',
-      logOnly: true, inbound: true,
-    } as any)
-    emailId = seeded.id
-
-    await async_test(
-      'load_inbox_data does not leak enduser.hashedPassword to staff',
-      () => sdk.api.endusers.load_inbox_data({ enduserIds: [enduser.id] } as any),
-      {
-        onResult: (r: any) => {
-          const returned = (r?.endusers ?? []).find((e: any) => (e.id || e._id)?.toString() === enduserId)
-          // require that the enduser actually came back (so the assertion is meaningful),
-          // and that hashedPassword is absent
-          return !!returned && !('hashedPassword' in returned)
-        },
-      },
-    )
+    tenant = await setup_isolated_tenant({
+      name: `LoadInboxRedaction ${RAND()}`,
+      users: [{ isAdmin: true }],
+      apiKeys: 0,
+    })
+    const { sdk } = tenant
+
+    // username is unique per organization; a fresh random one keeps back-to-back runs independent
+    await sdk.api.users.configure_inbox({ username: `inbox${RAND()}`, fname: 'F0151', lname: 'Staff' })
+    await sdk.refresh_session() // installs the username/orgEmail-bearing token configure_inbox minted
+
+    let enduserId: string | undefined
+    let emailId: string | undefined
+
+    try {
+      const email = `f0151-enduser-${RAND()}@example.com`
+      const enduser = await sdk.api.endusers.createOne({ email, fname: 'F0151', lname: 'Inbox' })
+      enduserId = enduser.id
+      await sdk.api.endusers.set_password({ id: enduser.id, password: ENDUSER_PASSWORD })
+
+      // Seed an inbound logOnly email so the enduser is joined into the inbox payload
+      const seeded = await sdk.api.emails.createOne({
+        enduserId: enduser.id, subject: 'F0151 seed', textContent: 'seed',
+        logOnly: true, inbound: true,
+      } as any)
+      emailId = seeded.id
+
+      const loaded: any = await sdk.api.endusers.load_inbox_data({ enduserIds: [enduser.id] } as any)
+      const returned = (loaded?.endusers ?? []).find((e: any) => (e.id || e._id)?.toString() === enduserId)
+
+      // require that the enduser actually came back (so the assertion is meaningful),
+      // and that hashedPassword is absent
+      record(
+        'load_inbox_data does not leak enduser.hashedPassword to staff',
+        !!returned && !('hashedPassword' in returned),
+        returned
+          ? `enduser ${enduserId} returned; hashedPassword present=${'hashedPassword' in returned}`
+          : `enduser ${enduserId} was NOT returned by load_inbox_data (${(loaded?.endusers ?? []).length} endusers came back)`
+            + ` — the check must not pass vacuously`,
+      )
+    } finally {
+      // per-record cleanup is kept even though teardown subsumes it, so the body stays runnable
+      // against any tenant
+      if (emailId) { try { await sdk.api.emails.deleteOne(emailId) } catch {} }
+      if (enduserId) { try { await sdk.api.endusers.deleteOne(enduserId) } catch {} }
+    }
   } finally {
-    if (emailId) { try { await sdk.api.emails.deleteOne(emailId) } catch {} }
-    if (enduserId) { try { await sdk.api.endusers.deleteOne(enduserId) } catch {} }
+    // Teardown BEFORE anything asserts — assert calls process.exit, which would strand this tenant.
+    if (tenant) { try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) } }
   }
+
+  return checks
 }
 
-if (require.main === module) {
-  console.log(`🌐 Using API URL: ${host}`)
-  const sdk = new Session({ host })
-  const sdkNonAdmin = new Session({ host })
+/** Asserting wrapper, for standalone runs. */
+export const load_inbox_redaction_tests = async () => {
+  assert_checks('Load inbox redaction', await load_inbox_redaction_checks())
+}
 
-  const runTests = async () => {
-    await setup_tests(sdk, sdkNonAdmin)
-    await load_inbox_redaction_tests({ sdk, sdkNonAdmin })
-  }
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = {
+  name: 'Load inbox redaction',
+  run: load_inbox_redaction_checks,
+}
 
-  runTests()
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  load_inbox_redaction_tests()
     .then(() => {
       console.log("✅ load_inbox_data redaction test suite completed successfully")
       process.exit(0)

package/src/tests/api_tests/security/proxy-image-unauth-ssrf.test.ts

@@ -2,31 +2,18 @@ require('source-map-support').install();
 
 import http from "http"
 import axios from "axios"
-import { Session } from "../../../sdk"
 import {
-  async_test,
-  log_header,
-} from "@tellescope/testing"
-import { setup_tests } from "../../setup"
+  assert_checks,
+  Check,
+  IsolatedSuite,
+  setup_isolated_tenant,
+} from "../../setup_isolated"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
-const LOCAL_HOSTNAMES = ['localhost', '127.0.0.1', '::1']
+const RAND = () => Math.random().toString(36).slice(2, 10)
 
-/**
- * 127.0.0.1 only means "the machine running this test" when the API is also local. Against staging or
- * prod it is the API server itself — the sentinel below would never be contacted, every assertion
- * here would pass for the wrong reason, and we would be probing a live environment. Fail loudly.
- */
-const assert_local_api = () => {
-  const hostname = new URL(host).hostname
-  if (!LOCAL_HOSTNAMES.includes(hostname)) {
-    throw new Error(
-      `SSRF tests must run against a local API (got ${host}). `
-      + `127.0.0.1 would resolve to the API server rather than this machine, so the tests would be meaningless.`
-    )
-  }
-}
+const LOCAL_HOSTNAMES = ['localhost', '127.0.0.1', '::1']
 
 /**
  * Regression tests: `/v1/proxy-image` must refuse internal and non-image destinations.
@@ -55,10 +42,30 @@ const assert_local_api = () => {
  * The authenticated happy-path test lives with the Phase 2 endpoint change — it cannot exist here
  * because the POST route does not yet exist, and a test that fails for "not implemented" would muddy
  * the vulnerability proof.
+ *
+ * 127.0.0.1 only means "the machine running this test" when the API is also local. Against staging or
+ * prod it is the API server itself — the sentinel below would never be contacted and every check here
+ * would pass for the wrong reason. So a non-local API_URL records ONE FAILING check and returns: this
+ * suite goes deliberately red rather than skipping, because a skipped SSRF proof rots silently. It
+ * must not throw: a throw propagates out of run_isolated_in_parallel and aborts every remaining batch.
  */
-export const proxy_image_ssrf_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("proxy-image unauthenticated SSRF")
-  assert_local_api()
+export const proxy_image_ssrf_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  // Before provisioning, deliberately: an early return after setup_isolated_tenant but outside the
+  // try/finally would strand a tenant that nothing in the system can delete.
+  const hostname = new URL(host).hostname
+  if (!LOCAL_HOSTNAMES.includes(hostname)) {
+    record(
+      'SSRF proof runs against a local API',
+      false,
+      `API_URL is ${host}, which is not local. 127.0.0.1 would resolve to the API server rather than `
+      + `this machine, so the sentinel could never be contacted and every check below would pass for `
+      + `the wrong reason. Re-run against a local API; this suite is red, not skipped, on purpose.`,
+    )
+    return checks
+  }
 
   const SENTINEL = `f0025-sentinel-${Date.now()}-${Math.random().toString(36).slice(2)}`
   let sentinelHits = 0
@@ -71,7 +78,34 @@ export const proxy_image_ssrf_tests = async ({ sdk } : { sdk: Session, sdkNonAdm
     res.end(JSON.stringify({ sentinel: SENTINEL, credentials: 'internal-only' }))
   })
 
+  /**
+   * The async_test({ onResult }) equivalent, as a soft Check: a call that REJECTS is a failure
+   * (async_test treats it the same way), and a resolved call passes only when onResult agrees.
+   */
+  const expect_result = async <T,>(label: string, fn: () => Promise<T>, onResult: (r: T) => boolean) => {
+    try {
+      const result = await fn()
+      // The raw value decides the fallback, not JSON.stringify of it.
+      const stringified = JSON.stringify(result)
+      record(label, onResult(result), `result=${stringified === undefined ? String(result) : stringified}`)
+    } catch (e: any) {
+      const message = typeof e?.message === 'string' && e.message !== ''
+        ? e.message
+        : (e === undefined || e === null ? String(e) : JSON.stringify(e))
+      record(label, false, `rejected instead of resolving: ${message}`)
+    }
+  }
+
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+
   try {
+    tenant = await setup_isolated_tenant({
+      name: `Proxy-image unauthenticated SSRF ${RAND()}`,
+      users: [{ isAdmin: true }],
+      apiKeys: 0,
+    })
+    const { sdk } = tenant
+
     await new Promise<void>(resolve => sentinel.listen(0, '127.0.0.1', () => resolve()))
     const sentinelPort = (sentinel.address() as any).port
     const sentinelURL = `http://127.0.0.1:${sentinelPort}/latest/meta-data/iam/security-credentials/`
@@ -93,26 +127,28 @@ export const proxy_image_ssrf_tests = async ({ sdk } : { sdk: Session, sdkNonAdm
     }
 
     // T1 — the core SSRF: an unauthenticated caller must not be able to read an internal resource.
-    await async_test(
+    await expect_result(
       'proxy-image does not stream an internal non-image resource to an unauthenticated caller',
       call_unauthenticated,
-      {
-        // Positive control: a numeric status proves we actually reached our API rather than failing to
-        // connect (a connection error would make "nothing leaked" true for the wrong reason).
-        onResult: (r: any) => (
-          typeof r.status === 'number'
-          && r.leaked === false
-          && r.sentinelHits === 0
-        ),
-      },
+      // Positive control: a numeric status proves we actually reached our API rather than failing to
+      // connect (a connection error would make "nothing leaked" true for the wrong reason).
+      (r: any) => (
+        typeof r.status === 'number'
+        && r.leaked === false
+        && r.sentinelHits === 0
+      ),
     )
 
     // T2 — the unauthenticated surface itself: the request must be refused outright, and the
     // destination must never be contacted (no SSRF-as-a-side-effect even when the body is withheld).
-    await async_test(
+    await expect_result(
       'proxy-image refuses an unauthenticated request without contacting the destination',
       call_unauthenticated,
-      { onResult: (r: any) => r.status >= 400 && r.status < 500 && r.sentinelHits === 0 },
+      // 429 is excluded explicitly: this suite now runs inside the 8-wide isolated pool, where a
+      // shared per-IP throttle could return one and satisfy "some 4xx" without the auth gate ever
+      // having fired. Any other 4xx (401 on the authenticated shape, 404/405 on the retired GET)
+      // is still accepted, as the comment above describes.
+      (r: any) => r.status >= 400 && r.status < 500 && r.status !== 429 && r.sentinelHits === 0,
     )
 
     // Authenticating is not enough on its own — a staff session must not be able to reach an internal
@@ -127,46 +163,53 @@ export const proxy_image_ssrf_tests = async ({ sdk } : { sdk: Session, sdkNonAdm
       return { status: res.status, sentinelHits }
     }
 
-    await async_test(
+    await expect_result(
       'proxy-image refuses a private destination even for an authenticated staff session',
       () => call_authenticated(sentinelURL),
-      { onResult: (r: any) => r.status === 400 && r.sentinelHits === 0 },
+      (r: any) => r.status === 400 && r.sentinelHits === 0,
     )
 
-    await async_test(
+    await expect_result(
       'proxy-image refuses cloud metadata for an authenticated staff session',
       () => call_authenticated('https://169.254.169.254/latest/meta-data/'),
-      { onResult: (r: any) => r.status === 400 },
+      (r: any) => r.status === 400,
     )
 
     // Scheme and port are pinned: only https on 443, which is all the PDF export ever needs.
-    await async_test(
+    await expect_result(
       'proxy-image refuses a plain http destination',
       () => call_authenticated('http://example.com/logo.png'),
-      { onResult: (r: any) => r.status === 400 },
+      (r: any) => r.status === 400,
     )
 
-    await async_test(
+    await expect_result(
       'proxy-image refuses a non-443 port',
       () => call_authenticated('https://example.com:8443/logo.png'),
-      { onResult: (r: any) => r.status === 400 },
+      (r: any) => r.status === 400,
     )
   } finally {
     sentinel.close()
+    // Teardown BEFORE anything asserts — assert calls process.exit, which would strand this tenant.
+    if (tenant) { try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) } }
   }
+
+  return checks
 }
 
-if (require.main === module) {
-  console.log(`🌐 Using API URL: ${host}`)
-  const sdk = new Session({ host })
-  const sdkNonAdmin = new Session({ host })
+/** Asserting wrapper, for standalone runs. */
+export const proxy_image_ssrf_tests = async () => {
+  assert_checks('Proxy-image unauthenticated SSRF', await proxy_image_ssrf_checks())
+}
 
-  const runTests = async () => {
-    await setup_tests(sdk, sdkNonAdmin)
-    await proxy_image_ssrf_tests({ sdk, sdkNonAdmin })
-  }
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = {
+  name: 'Proxy-image unauthenticated SSRF',
+  run: proxy_image_ssrf_checks,
+}
 
-  runTests()
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  proxy_image_ssrf_tests()
     .then(() => {
       console.log("✅ proxy-image SSRF test suite completed successfully")
       process.exit(0)