@tellescope/sdk 2.0.0-beta.2 → 2.0.0-beta.3

package/src/tests/api_tests/security/register_business_id_injection.test.ts

@@ -1,26 +1,39 @@
 require('source-map-support').install();
 
 import axios from "axios"
-import { Session } from "../../../sdk"
+import { wait } from "@tellescope/testing"
 import {
-  assert,
-  log_header,
-  wait,
-} from "@tellescope/testing"
-import { setup_tests } from "../../setup"
+  assert_checks,
+  Check,
+  IsolatedSuite,
+  setup_isolated_tenant,
+} from "../../setup_isolated"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
-const post = async (path: string, body: any, headers: Record<string, string> = {}) => {
-  try {
-    const res = await axios.post(`${host}${path}`, body, {
-      validateStatus: () => true,
-      headers,
-    })
-    return { status: res.status, data: res.data }
-  } catch (err: any) {
-    return { status: err?.response?.status, data: err?.response?.data }
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
+/**
+ * POST /v1/users/register, retrying a 429.
+ *
+ * The endpoint is throttled at roughly 1/sec on a `user-register-<ip>` namespace that no tenant
+ * teardown clears and that every concurrently running suite shares, so a 429 here is contention
+ * between suites, not a result. (Deliberately a local copy of organization_signup.test.ts's helper
+ * rather than a shared export: the two suites stay uncoupled.)
+ */
+const register_request = async (data: Record<string, any>) => {
+  const send = () => axios.request({
+    method: 'post', url: `${host}/v1/users/register`,
+    data,
+    validateStatus: () => true,
+  })
+
+  let result = await send()
+  for (let attempt = 0; attempt < 5 && result.status === 429; attempt++) {
+    await wait(undefined, 1200)
+    result = await send()
   }
+  return result
 }
 
 /**
@@ -36,99 +49,125 @@ const post = async (path: string, body: any, headers: Record<string, string> = {
  * caller-supplied businessId onto a new `accountType: 'Business'` user — bypassing the
  * globalUnique: ['email'] enforcement that only runs in the generic create route.
  *
- * The "victim org" here is the test admin's own org (sdk.userInfo.businessId): an org the
- * anonymous caller was never invited to. The admin is used purely to OBSERVE whether an
- * uninvited user record materialized inside their org (getOne({ email }) is org-scoped and
- * throws when the email is absent from the caller's tenant).
+ * The "victim org" is this suite's OWN provisioned tenant (tenant.businessId): an org the
+ * anonymous caller was never invited to. Its admin is used purely to OBSERVE whether an uninvited
+ * user record materialized inside the org (getOne({ email }) is org-scoped and throws when the
+ * email is absent from the caller's tenant). Running on a throwaway tenant rather than the shared
+ * fixture means a failing (vulnerable) run plants its user in an org that is then torn down.
  *
  * Expected results:
- *   - VULNERABLE code: the assertions FAIL — the planted user appears inside the victim org,
- *     proving the exploit ("EXPLOIT CONFIRMED" in the failure message).
+ *   - VULNERABLE code: the checks FAIL — the planted user appears inside the victim org,
+ *     proving the exploit ("EXPLOIT CONFIRMED" in the failure detail).
  *   - FIXED code: register ignores the caller-supplied businessId (self-signups are created
  *     org-less and duplicates are rejected globally), so nothing appears in the victim org and
- *     the assertions PASS.
+ *     the checks PASS.
  *
- * Uses unique emails per run (Date.now()) so re-runs never collide on the platform-wide unique
- * email constraint. NOTE: on the FIXED path these registrations create org-less user records
- * that an org-scoped admin cannot delete — harmless residue (unique emails), inherent to the
- * legitimate "root register, no org" signup behavior.
+ * Uses unique emails per run so re-runs never collide on the platform-wide unique email
+ * constraint. NOTE: on the FIXED path these registrations create org-less user records that
+ * neither an org-scoped admin nor the tenant teardown (which deletes by businessId) can remove —
+ * harmless residue (unique emails), inherent to the legitimate "root register, no org" signup.
  */
-export const register_business_id_injection_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("register businessId injection")
-
-  const victimBusinessId = sdk.userInfo.businessId
-  const password = 'testpassword123!'
-  const termsVersion = '1'
-
-  // ==================================================================================
-  // Scenario 1 — uninvited org join
-  // An anonymous caller registers with businessId set to the victim org. On vulnerable
-  // code this creates a Business user INSIDE the victim org that no one invited.
-  // ==================================================================================
-  const email1 = `dontsend+reg-inject-${Date.now()}@tellescope.com`
-
-  const before = await sdk.api.users.getOne({ email: email1 }).catch(() => null)
-  assert(before === null, `precondition failed: ${email1} already present in victim org`, 'precondition: victim org has no such user')
-
-  const res1 = await post('/v1/users/register', { email: email1, password, termsVersion, businessId: victimBusinessId })
-  console.log(`   register(businessId=victim) -> HTTP ${res1.status}`)
-
-  const planted1: any = await sdk.api.users.getOne({ email: email1 }).catch(() => null)
-  const injectedIntoVictimOrg = !!planted1 && planted1.businessId === victimBusinessId
-
-  // Clean up BEFORE asserting (a failed assert calls process.exit(1) and would skip cleanup).
-  if (planted1?.id) await sdk.api.users.deleteOne(planted1.id).catch(() => {})
+export const register_business_id_injection_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
 
-  assert(
-    !injectedIntoVictimOrg,
-    `❌ EXPLOIT CONFIRMED: anonymous POST /v1/users/register with businessId=${victimBusinessId} created user `
-      + `${email1} (accountType=${planted1?.accountType}) inside the victim org — no invite required`,
-    '✅ register ignores caller-supplied businessId — no user injected into victim org',
-  )
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
 
-  await wait(undefined, 1200) // register endpoint rate-limits ~1/sec per IP
-
-  // ==================================================================================
-  // Scenario 2 — cross-org duplicate for the same email
-  // First register with NO businessId (the legitimate "root register, no org" record —
-  // the "oldest" account in the report). Then register the SAME email WITH the victim
-  // businessId. On vulnerable code the scoped duplicate check misses the org-less record,
-  // so a SECOND user record for the same email is created inside the victim org.
-  // ==================================================================================
-  const email2 = `dontsend+reg-dup-${Date.now()}@tellescope.com`
-
-  const resRoot = await post('/v1/users/register', { email: email2, password, termsVersion })
-  console.log(`   register(no businessId) -> HTTP ${resRoot.status}`)
-
-  await wait(undefined, 1200)
-
-  const resDup = await post('/v1/users/register', { email: email2, password, termsVersion, businessId: victimBusinessId })
-  console.log(`   register(same email, businessId=victim) -> HTTP ${resDup.status}`)
+  try {
+    tenant = await setup_isolated_tenant({
+      name: `register businessId injection ${RAND()}`,
+      users: [{ isAdmin: true }],
+      apiKeys: 0,
+    })
+    const { sdk } = tenant
+
+    const victimBusinessId = tenant.businessId
+    const password = 'testpassword123!'
+    const termsVersion = '1'
+
+    // ==================================================================================
+    // Scenario 1 — uninvited org join
+    // An anonymous caller registers with businessId set to the victim org. On vulnerable
+    // code this creates a Business user INSIDE the victim org that no one invited.
+    // ==================================================================================
+    const email1 = `dontsend+reg-inject-${Date.now()}-${RAND()}@tellescope.com`
+
+    const before = await sdk.api.users.getOne({ email: email1 }).catch(() => null)
+    record(
+      'precondition: victim org has no such user',
+      before === null,
+      before === null ? `${email1} absent from the victim org` : `precondition failed: ${email1} already present in victim org`,
+    )
+
+    const res1 = await register_request({ email: email1, password, termsVersion, businessId: victimBusinessId })
+    console.log(`   register(businessId=victim) -> HTTP ${res1.status}`)
+
+    const planted1: any = await sdk.api.users.getOne({ email: email1 }).catch(() => null)
+    const injectedIntoVictimOrg = !!planted1 && planted1.businessId === victimBusinessId
+
+    record(
+      '✅ register ignores caller-supplied businessId — no user injected into victim org',
+      !injectedIntoVictimOrg,
+      injectedIntoVictimOrg
+        ? `❌ EXPLOIT CONFIRMED: anonymous POST /v1/users/register with businessId=${victimBusinessId} created user `
+          + `${email1} (accountType=${planted1?.accountType}) inside the victim org — no invite required`
+        : `register -> HTTP ${res1.status}; no ${email1} user inside the victim org`,
+    )
+
+    await wait(undefined, 1200) // register endpoint rate-limits ~1/sec per IP
+
+    // ==================================================================================
+    // Scenario 2 — cross-org duplicate for the same email
+    // First register with NO businessId (the legitimate "root register, no org" record —
+    // the "oldest" account in the report). Then register the SAME email WITH the victim
+    // businessId. On vulnerable code the scoped duplicate check misses the org-less record,
+    // so a SECOND user record for the same email is created inside the victim org.
+    // ==================================================================================
+    const email2 = `dontsend+reg-dup-${Date.now()}-${RAND()}@tellescope.com`
+
+    const resRoot = await register_request({ email: email2, password, termsVersion })
+    console.log(`   register(no businessId) -> HTTP ${resRoot.status}`)
+
+    await wait(undefined, 1200)
+
+    const resDup = await register_request({ email: email2, password, termsVersion, businessId: victimBusinessId })
+    console.log(`   register(same email, businessId=victim) -> HTTP ${resDup.status}`)
+
+    const planted2: any = await sdk.api.users.getOne({ email: email2 }).catch(() => null)
+    const duplicateInVictimOrg = !!planted2 && planted2.businessId === victimBusinessId
+
+    record(
+      '✅ register enforces global email uniqueness — no cross-org duplicate created',
+      !duplicateInVictimOrg,
+      duplicateInVictimOrg
+        ? `❌ EXPLOIT CONFIRMED: same email ${email2} registered into a second org — duplicate user `
+          + `(accountType=${planted2?.accountType}) created in victim org ${victimBusinessId}`
+        : `register(no org) -> HTTP ${resRoot.status}, register(businessId=victim) -> HTTP ${resDup.status}; `
+          + `no ${email2} user inside the victim org`,
+    )
+  } finally {
+    // Teardown BEFORE anything asserts — assert calls process.exit, which would strand this tenant.
+    if (tenant) { try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) } }
+  }
 
-  const planted2: any = await sdk.api.users.getOne({ email: email2 }).catch(() => null)
-  const duplicateInVictimOrg = !!planted2 && planted2.businessId === victimBusinessId
+  return checks
+}
 
-  if (planted2?.id) await sdk.api.users.deleteOne(planted2.id).catch(() => {})
+/** Asserting wrapper, for standalone runs. */
+export const register_business_id_injection_tests = async () => {
+  assert_checks('register businessId injection', await register_business_id_injection_checks())
+}
 
-  assert(
-    !duplicateInVictimOrg,
-    `❌ EXPLOIT CONFIRMED: same email ${email2} registered into a second org — duplicate user `
-      + `(accountType=${planted2?.accountType}) created in victim org ${victimBusinessId}`,
-    '✅ register enforces global email uniqueness — no cross-org duplicate created',
-  )
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = {
+  name: 'register businessId injection',
+  run: register_business_id_injection_checks,
 }
 
 // Allow running this test file independently
 if (require.main === module) {
-  const sdk = new Session({ host })
-  const sdkNonAdmin = new Session({ host })
-
-  const runTests = async () => {
-    await setup_tests(sdk, sdkNonAdmin)
-    await register_business_id_injection_tests({ sdk, sdkNonAdmin })
-  }
-
-  runTests()
+  console.log(`🌐 Using API URL: ${host}`)
+  register_business_id_injection_tests()
     .then(() => {
       console.log("✅ register businessId injection test suite completed successfully")
       process.exit(0)

package/src/tests/api_tests/security/sanitize-user-html-with-iframes.test.ts

@@ -208,6 +208,133 @@ export const sanitize_user_html_with_iframes_tests = async () => {
   if (!endToEnd.includes('<iframe')) fail(`patient markup not escaped to inert text: ${endToEnd}`)
   if ((endToEnd.toLowerCase().match(/<iframe/g) || []).length !== 1) fail(`patient-injected iframe became a live frame: ${endToEnd}`)
 
+  // ---------------------------------------------------------------------------------------------
+  // 7. sanitize-html 2.18.0 behaviour pins
+  //
+  // Added with the 2.17.7 -> 2.18.0 bump. 2.18.0 changes how markup *inside a disallowed tag* is
+  // emitted: where 2.17.7 entity-escaped it into visible literal text, 2.18.0 parses it and runs it
+  // back through the allowlist. That is a rendering change on every surface, so the vectors it
+  // could plausibly reopen are pinned here rather than left to a future release to rediscover.
+  // ---------------------------------------------------------------------------------------------
+
+  // --- meta refresh -------------------------------------------------------------------------
+  // <meta> is not allowlisted by either shared sanitizer, so an http-equiv="refresh" redirect must
+  // never survive. The portal's custom-page sanitizer allowlists <meta> for charset/name/content
+  // and deliberately omits http-equiv for exactly this reason (CustomPage.tsx), which is why this
+  // vector is worth pinning on the shared pair too.
+  const metaRefreshCases: [string, string][] = [
+    ['lowercase', `<meta http-equiv="refresh" content="0;url=https://evil.example">`],
+    ['uppercase', `<META HTTP-EQUIV="REFRESH" CONTENT="0;url=https://evil.example">`],
+    ['nested in allowed block', `<div><meta http-equiv="refresh" content="0;url=https://evil.example"><p>after</p></div>`],
+  ]
+  for (const [name, payload] of metaRefreshCases) {
+    for (const [fnName, fn] of [['with_iframes', sanitize_user_html_with_iframes], ['base', sanitize_user_html]] as const) {
+      const out = fn(payload).toLowerCase()
+      if (out.includes('<meta')) fail(`meta survived [${fnName}/${name}] -> ${out}`)
+      if (out.includes('http-equiv')) fail(`http-equiv survived [${fnName}/${name}] -> ${out}`)
+      if (out.includes('evil.example')) fail(`meta refresh target survived [${fnName}/${name}] -> ${out}`)
+    }
+  }
+  // the redirect is dropped without taking the surrounding content with it
+  const metaSibling = sanitize_user_html_with_iframes(`<div><meta http-equiv="refresh" content="0;url=https://evil.example"><p>after</p></div>`)
+  if (!metaSibling.includes('<p>after</p>')) fail(`content after a dropped meta refresh was lost: ${metaSibling}`)
+
+  // --- svg:animate --------------------------------------------------------------------------
+  // SMIL animation can rewrite an attribute after sanitization: <animate attributeName="href"
+  // values="javascript:..."> turns an inert <a> into a javascript: link at render time, which no
+  // amount of href filtering catches. <svg> is not allowlisted, so animate must never survive —
+  // and with 2.18.0 now re-parsing disallowed-tag contents, "the parent is dropped" is no longer
+  // on its own enough to assume the child went with it.
+  const svgAnimateCases: [string, string][] = [
+    ['animate onbegin', `<svg><animate onbegin="alert(1)" attributeName="x" dur="1s"></svg>`],
+    ['animate href values', `<svg><a><animate attributeName="href" values="javascript:alert(1)"/><text>x</text></a></svg>`],
+    ['set href to', `<svg><a><set attributeName="href" to="javascript:alert(1)"/><text>x</text></a></svg>`],
+    ['animate onrepeat', `<svg><animate attributeName="x" begin="0s" onrepeat="alert(1)"/></svg>`],
+    ['animate inside dropped iframe', `<iframe><svg><a><animate attributeName="href" values="javascript:alert(1)"/><text>x</text></a></svg></iframe>`],
+  ]
+  for (const [name, payload] of svgAnimateCases) {
+    for (const [fnName, fn] of [['with_iframes', sanitize_user_html_with_iframes], ['base', sanitize_user_html]] as const) {
+      const out = fn(payload).toLowerCase()
+      if (out.includes('<animate') || out.includes('<set')) fail(`SMIL animation element survived [${fnName}/${name}] -> ${out}`)
+      if (out.includes('<svg')) fail(`svg survived [${fnName}/${name}] -> ${out}`)
+      if (out.includes('attributename')) fail(`attributeName survived [${fnName}/${name}] -> ${out}`)
+      if (out.includes('javascript:')) fail(`javascript: payload survived [${fnName}/${name}] -> ${out}`)
+      if (/\son[a-z]+\s*=/.test(out.replace(/"[^"]*"/g, '""'))) fail(`SMIL event handler survived [${fnName}/${name}] -> ${out}`)
+    }
+  }
+
+  // --- noscript (the nonTextTags vector) ------------------------------------------------------
+  // The classic noscript context-confusion payload: a browser parses <noscript> contents as raw
+  // text when scripting is enabled and as markup when it isn't, so a sanitizer that disagrees with
+  // the renderer can be walked out of the attribute it thinks it is inside. Neither shared
+  // sanitizer sets nonTextTags, but the portal's custom-page sanitizer lists 'noscript' there
+  // (CustomPage.tsx), so the dependency's handling of the tag is pinned here.
+  const noscriptCases: [string, string][] = [
+    ['attribute break-out', `<noscript><p title="</noscript><img src=x onerror=alert(1)>">`],
+    ['style comment mXSS', `<noscript><style><!--</style><img src=x onerror=alert(1)>`],
+    ['plain content', `<noscript>hidden</noscript><p>after</p>`],
+    ['markup content', `<noscript><b>bold</b></noscript><p>after</p>`],
+    ['inside dropped iframe', `<iframe><noscript><p title="</noscript><img src=x onerror=alert(1)>"></iframe>`],
+  ]
+  for (const [name, payload] of noscriptCases) {
+    for (const [fnName, fn] of [['with_iframes', sanitize_user_html_with_iframes], ['base', sanitize_user_html]] as const) {
+      const out = fn(payload)
+      if (out.toLowerCase().includes('<noscript')) fail(`noscript survived [${fnName}/${name}] -> ${out}`)
+      // The breakout payload may legitimately remain as inert escaped text inside an attribute
+      // value; what must never happen is it coming back as a live handler. Values are blanked
+      // before the handler check for exactly that reason.
+      if (/\son[a-z]+\s*=/.test(out.toLowerCase().replace(/"[^"]*"/g, '""').replace(/'[^']*'/g, "''"))) {
+        fail(`live event handler escaped the noscript context [${fnName}/${name}] -> ${out}`)
+      }
+      if (out.toLowerCase().includes('<script')) fail(`script escaped the noscript context [${fnName}/${name}] -> ${out}`)
+    }
+  }
+  // content after a noscript block is not swallowed (the "page ends early" regression)
+  const afterNoscript = sanitize_user_html(`<noscript>a</noscript><p>para1</p><div>para2</div><span>tail</span>`)
+  for (const frag of ['<p>para1</p>', '<div>para2</div>', '<span>tail</span>']) {
+    if (!afterNoscript.includes(frag)) fail(`content after noscript was swallowed (missing ${frag}): ${afterNoscript}`)
+  }
+
+  // --- disallowed-iframe fallback content (the actual 2.18.0 delta) ---------------------------
+  // This is what changed. In sanitize_user_html (no iframe in allowedTags) the markup inside a
+  // dropped <iframe> used to be emitted as escaped literal text; from 2.18.0 it is parsed and
+  // allowlisted instead, so a patient reading a form answer now sees bold text where they used to
+  // see "<b>FB</b>". Safe — the allowlist still applies — but it is a visible change, so both the
+  // containment and the rendering are pinned.
+  const baseFallback = sanitize_user_html(`<iframe src="http://evil.example"><b>FB</b></iframe>`)
+  if (baseFallback.toLowerCase().includes('<iframe')) fail(`base sanitizer kept the frame: ${baseFallback}`)
+  if (baseFallback.toLowerCase().includes('evil.example')) fail(`base sanitizer kept the frame src: ${baseFallback}`)
+  // The markup form, not just the characters "FB": on 2.17.7 this came back as the escaped text
+  // &lt;b&gt;FB&lt;/b&gt;, which also contains "FB". Asserting the live tag is what makes this pin
+  // the 2.18.0 behaviour rather than pass identically on either version.
+  if (!baseFallback.includes('<b>FB</b>')) fail(`fallback markup was not parsed back into live markup: ${baseFallback}`)
+  if (baseFallback.includes('&lt;b&gt;')) fail(`fallback markup is still escaped (pre-2.18.0 behaviour): ${baseFallback}`)
+
+  // The hostile versions of the same shape must still come out inert, by the allowlist rather
+  // than by escaping.
+  const fallbackAttacks: [string, string][] = [
+    ['img onerror', `<iframe><img src=x onerror=alert(1)></iframe>`],
+    ['script', `<iframe><script>alert(1)</script></iframe>`],
+    ['nested iframe', `<iframe><iframe src="https://evil.example"></iframe></iframe>`],
+    ['javascript link', `<iframe><a href="javascript:alert(1)">x</a></iframe>`],
+    ['object', `<iframe><object data="javascript:alert(1)"></object></iframe>`],
+    ['base href', `<iframe><base href="https://evil.example"></iframe>`],
+  ]
+  for (const [name, payload] of fallbackAttacks) {
+    const out = sanitize_user_html(payload)
+    if (!has_no_executable_vector_allowing_iframe(out) || out.toLowerCase().includes('<iframe')) {
+      fail(`iframe fallback content reopened a vector [${name}] -> ${out}`)
+    }
+  }
+
+  // sanitize_user_html_with_iframes is unaffected: exclusiveFilter removes a disallowed frame AND
+  // its children, so fallback markup never reaches the escaping path at all. Asserted explicitly
+  // so the two functions' different handling stays deliberate.
+  for (const [name, payload] of [...fallbackAttacks, ['bold fallback', `<iframe src="http://evil.example"><b>FB</b></iframe>`] as [string, string]]) {
+    const out = sanitize_user_html_with_iframes(payload)
+    if (out !== '') fail(`with_iframes should drop a disallowed frame and all its content [${name}] -> ${out}`)
+  }
+
   console.log("✅ sanitize_user_html_with_iframes XSS regression tests passed")
 }
 

package/src/tests/api_tests/security/schema-adminonly-enforcement.test.ts

@@ -3,12 +3,13 @@ require('source-map-support').install();
 import axios from "axios"
 
 import { Session } from "../../../sdk"
-import {
-  assert,
-  log_header,
-} from "@tellescope/testing"
 import { PROVIDER_PERMISSIONS } from "@tellescope/constants"
-import { setup_tests } from "../../setup"
+import {
+  assert_checks,
+  Check,
+  IsolatedSuite,
+  setup_isolated_tenant,
+} from "../../setup_isolated"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
@@ -17,12 +18,6 @@ const RAND = () => Math.random().toString(36).slice(2, 10)
 const ALL = 'All' as const
 const FULL_ACCESS = { create: ALL, read: ALL, update: ALL, delete: ALL }
 
-type Check = {
-  label: string,
-  pass: boolean,
-  detail: string,
-}
-
 /**
  * Regression test: `adminOnly` custom actions must be enforced at runtime, not merely declared.
  *
@@ -61,10 +56,13 @@ type Check = {
  *
  * RED (pre-fix): the six group-B rows fail — each reaches its handler and returns a non-401.
  * GREEN (post-fix): all six return 401 "Admin access only"; the group-A controls are unchanged.
+ *
+ * Runs on its own provisioned tenant, which makes the two environment-dependent probes deterministic
+ * rather than a function of whoever's local database the shared org came from: a fresh tenant has no
+ * Athena integration (so sync-athena is probed) and no twilioSID (so link-twilio, which can create a
+ * REAL Twilio subaccount, stays permanently on its skipped-for-safety path).
  */
-export const schema_adminonly_enforcement_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("schema-declared adminOnly must be enforced on custom actions")
-
+export const schema_adminonly_enforcement_checks = async (): Promise<Check[]> => {
   const checks: Check[] = []
   const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
 
@@ -89,11 +87,19 @@ export const schema_adminonly_enforcement_tests = async ({ sdk } : { sdk: Sessio
     `${r.status} ${(JSON.stringify(r.body) ?? '').slice(0, 120)}`
   )
 
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
   let roleId = ''
   let attackerId = ''
   let enduserId = ''
 
   try {
+    tenant = await setup_isolated_tenant({
+      name: `Schema adminOnly enforcement ${RAND()}`,
+      users: [{ isAdmin: true }],
+      apiKeys: 0,
+    })
+    const { sdk } = tenant
+
     /* ================= fixtures ================= */
 
     const role = `f0191-staff-${RAND()}`
@@ -246,36 +252,35 @@ export const schema_adminonly_enforcement_tests = async ({ sdk } : { sdk: Sessio
         `${summarize(r)} (expected a handler response, not 401 Admin access only)`,
       )
     }
-
-    /* ===== report: print full table first, then assert (harness exits on first failure) ===== */
-    console.log('\n  check summary:')
-    for (const c of checks) {
-      console.log(`    ${c.pass ? 'PASS' : 'FAIL'}  ${c.label}  —  ${c.detail}`)
-    }
-    console.log('')
-
-    for (const c of checks) {
-      assert(c.pass, `${c.label} — ${c.detail}`, c.label)
-    }
   } finally {
-    if (enduserId) { try { await sdk.api.endusers.deleteOne(enduserId) } catch {} }
-    if (attackerId) { try { await sdk.api.users.deleteOne(attackerId) } catch {} }
-    if (roleId) { try { await sdk.api.role_based_access_permissions.deleteOne(roleId) } catch {} }
+    if (tenant) {
+      const { sdk } = tenant
+      if (enduserId) { try { await sdk.api.endusers.deleteOne(enduserId) } catch {} }
+      if (attackerId) { try { await sdk.api.users.deleteOne(attackerId) } catch {} }
+      if (roleId) { try { await sdk.api.role_based_access_permissions.deleteOne(roleId) } catch {} }
+      // Teardown BEFORE anything asserts — assert calls process.exit, which would strand this tenant.
+      try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) }
+    }
   }
+
+  return checks
+}
+
+/** Asserting wrapper, for standalone runs. */
+export const schema_adminonly_enforcement_tests = async () => {
+  assert_checks('Schema adminOnly enforcement', await schema_adminonly_enforcement_checks())
+}
+
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = {
+  name: 'Schema adminOnly enforcement',
+  run: schema_adminonly_enforcement_checks,
 }
 
 // Allow running this test file independently
 if (require.main === module) {
   console.log(`🌐 Using API URL: ${host}`)
-  const sdk = new Session({ host })
-  const sdkNonAdmin = new Session({ host })
-
-  const runTests = async () => {
-    await setup_tests(sdk, sdkNonAdmin)
-    await schema_adminonly_enforcement_tests({ sdk, sdkNonAdmin })
-  }
-
-  runTests()
+  schema_adminonly_enforcement_tests()
     .then(() => {
       console.log("✅ schema adminOnly enforcement test suite completed successfully")
       process.exit(0)