@tellescope/sdk 2.0.0-beta.2 → 2.0.0-beta.3

package/lib/cjs/tests/api_tests/managed_content_file_access.test.js

@@ -10,29 +10,6 @@ var __assign = (this && this.__assign) || function () {
     };
     return __assign.apply(this, arguments);
 };
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
     return new (P || (P = Promise))(function (resolve, reject) {
@@ -70,309 +47,306 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
     }
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.managed_content_file_access_tests = void 0;
+exports.ISOLATED_SUITE = exports.managed_content_file_access_tests = exports.managed_content_file_access_checks = void 0;
 require('source-map-support').install();
-var buffer = __importStar(require("buffer"));
 var sdk_1 = require("../../sdk");
-var testing_1 = require("@tellescope/testing");
-var setup_1 = require("../setup");
+var setup_isolated_1 = require("../setup_isolated");
 var host = process.env.API_URL || 'http://localhost:8080';
-var businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6';
+var RAND = function () { return Math.random().toString(36).slice(2, 10); };
 /**
  * Tests for file_download_URL enduser access via managed content fallback.
  *
  * Verifies the backend fallback logic that allows endusers to access files
  * attached to managed content records they have access to, even when the
  * file itself does not have enduserId set or publicRead: true.
+ *
+ * Runs on its own provisioned tenant: the patient sessions are pointed at `tenant.businessId`
+ * instead of a TEST_BUSINESS_ID env var with a hardcoded organization-id fallback, which tied the
+ * suite to one person's seeded database.
+ *
+ * File records are created with prepare_file_upload alone — no S3 round-trip. file_download_URL
+ * only signs a GET against the secureName and never checks that the object exists, so the upload
+ * added nothing to what is being asserted (same approach as
+ * security/file-link-session-confinement.test.ts).
  */
-var managed_content_file_access_tests = function (_a) {
-    var sdk = _a.sdk, sdkNonAdmin = _a.sdkNonAdmin;
-    return __awaiter(void 0, void 0, void 0, function () {
-        var contentRecordIds, assignmentIds, fileIds, testEnduserId, otherEnduserId, enduserSDK, otherEnduserSDK, uploadFile, testEnduser, otherEnduser, fileForAll_1, contentAll, fileForIndividual_1, contentIndividual, fileNoContent_1, fileWithEnduser_1, filePublic_1, _i, assignmentIds_1, assignmentId, _b, contentRecordIds_1, recordId, _c, fileIds_1, fileId, error_1;
-        return __generator(this, function (_d) {
-            switch (_d.label) {
-                case 0:
-                    (0, testing_1.log_header)("Managed Content File Access Tests");
-                    contentRecordIds = [];
-                    assignmentIds = [];
-                    fileIds = [];
-                    uploadFile = function (name, opts) {
-                        if (opts === void 0) { opts = {}; }
-                        return __awaiter(void 0, void 0, void 0, function () {
-                            var buff, _a, presignedUpload, file;
-                            return __generator(this, function (_b) {
-                                switch (_b.label) {
-                                    case 0:
-                                        buff = buffer.Buffer.from("test file content for ".concat(name));
-                                        return [4 /*yield*/, sdk.api.files.prepare_file_upload(__assign({ name: name, type: 'text/plain', size: buff.byteLength }, opts))];
-                                    case 1:
-                                        _a = _b.sent(), presignedUpload = _a.presignedUpload, file = _a.file;
-                                        return [4 /*yield*/, sdk.UPLOAD(presignedUpload, buff)];
-                                    case 2:
-                                        _b.sent();
-                                        return [4 /*yield*/, sdk.api.files.confirm_file_upload({ id: file.id })];
-                                    case 3:
-                                        _b.sent();
-                                        fileIds.push(file.id);
-                                        return [2 /*return*/, file];
-                                }
-                            });
+var managed_content_file_access_checks = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var checks, record, describe, errorMessage, tenant, contentRecordIds, assignmentIds, fileIds, testEnduserId, otherEnduserId, enduserSDK, otherEnduserSDK, sdk_2, createFileRecord, expect_download_allowed, expect_download_denied, testEnduser, otherEnduser, fileForAll, contentAll, fileForIndividual, contentIndividual, fileNoContent, fileWithEnduser, filePublic, sdk, _i, assignmentIds_1, assignmentId, _a, contentRecordIds_1, recordId, _b, fileIds_1, fileId, error_1, e_1;
+    return __generator(this, function (_c) {
+        switch (_c.label) {
+            case 0:
+                checks = [];
+                record = function (label, pass, detail) { return checks.push({ label: label, pass: pass, detail: detail }); };
+                describe = function (value) {
+                    if (value === undefined || value === null)
+                        return String(value);
+                    var stringified = JSON.stringify(value);
+                    return stringified === undefined ? String(value) : stringified;
+                };
+                errorMessage = function (e) { return (typeof (e === null || e === void 0 ? void 0 : e.message) === 'string' && e.message !== '' ? e.message : describe(e)); };
+                contentRecordIds = [];
+                assignmentIds = [];
+                fileIds = [];
+                _c.label = 1;
+            case 1:
+                _c.trys.push([1, , 22, 45]);
+                return [4 /*yield*/, (0, setup_isolated_1.setup_isolated_tenant)({
+                        name: "Managed content file access ".concat(RAND()),
+                        users: [{ isAdmin: true }],
+                        apiKeys: 0,
+                    })];
+            case 2:
+                tenant = _c.sent();
+                sdk_2 = tenant.sdk;
+                createFileRecord = function (name, opts) {
+                    if (opts === void 0) { opts = {}; }
+                    return __awaiter(void 0, void 0, void 0, function () {
+                        var file;
+                        return __generator(this, function (_a) {
+                            switch (_a.label) {
+                                case 0: return [4 /*yield*/, sdk_2.api.files.prepare_file_upload(__assign({ name: name, type: 'text/plain', 
+                                        // byteLength, not .length: a non-ASCII fixture name would otherwise mis-size the record
+                                        size: Buffer.byteLength("test file content for ".concat(name)) }, opts))];
+                                case 1:
+                                    file = (_a.sent()).file;
+                                    fileIds.push(file.id);
+                                    return [2 /*return*/, file];
+                            }
                         });
-                    };
-                    _d.label = 1;
-                case 1:
-                    _d.trys.push([1, , 21, 41]);
-                    console.log("Setting up test data...");
-                    return [4 /*yield*/, sdk.api.endusers.createOne({
-                            email: "mcr_file_access_test_".concat(Date.now(), "@test.tellescope.com"),
-                        })];
-                case 2:
-                    testEnduser = _d.sent();
-                    testEnduserId = testEnduser.id;
-                    return [4 /*yield*/, sdk.api.endusers.set_password({ id: testEnduser.id, password: 'TestPassword123!' })];
-                case 3:
-                    _d.sent();
-                    return [4 /*yield*/, sdk.api.endusers.createOne({
-                            email: "mcr_file_access_other_".concat(Date.now(), "@test.tellescope.com"),
-                        })];
-                case 4:
-                    otherEnduser = _d.sent();
-                    otherEnduserId = otherEnduser.id;
-                    return [4 /*yield*/, sdk.api.endusers.set_password({ id: otherEnduser.id, password: 'TestPassword123!' })];
-                case 5:
-                    _d.sent();
-                    enduserSDK = new sdk_1.EnduserSession({ host: host, businessId: businessId });
-                    return [4 /*yield*/, enduserSDK.authenticate(testEnduser.email, 'TestPassword123!')];
-                case 6:
-                    _d.sent();
-                    otherEnduserSDK = new sdk_1.EnduserSession({ host: host, businessId: businessId });
-                    return [4 /*yield*/, otherEnduserSDK.authenticate(otherEnduser.email, 'TestPassword123!')
-                        // ===== Test 1: File attached to assignmentType: 'All' content - enduser CAN access =====
-                    ];
-                case 7:
-                    _d.sent();
-                    return [4 /*yield*/, uploadFile('mcr-file-all.txt')];
-                case 8:
-                    fileForAll_1 = _d.sent();
-                    return [4 /*yield*/, sdk.api.managed_content_records.createOne({
-                            title: 'MCR File Access - All',
-                            htmlContent: '<p>All</p>',
-                            textContent: 'All',
-                            assignmentType: 'All',
-                            attachments: [{ secureName: fileForAll_1.secureName, type: 'file', name: fileForAll_1.name }],
-                        })];
-                case 9:
-                    contentAll = _d.sent();
-                    contentRecordIds.push(contentAll.id);
-                    return [4 /*yield*/, (0, testing_1.async_test)('staff-uploaded file in assignmentType:All content - enduser CAN access', function () { return __awaiter(void 0, void 0, void 0, function () {
-                            var result;
-                            return __generator(this, function (_a) {
-                                switch (_a.label) {
-                                    case 0: return [4 /*yield*/, enduserSDK.api.files.file_download_URL({ secureName: fileForAll_1.secureName })];
-                                    case 1:
-                                        result = _a.sent();
-                                        return [2 /*return*/, !!(result === null || result === void 0 ? void 0 : result.downloadURL)];
-                                }
-                            });
-                        }); }, { onResult: function (r) { return r === true; } })
-                        // ===== Test 2: File attached to Individual content for enduser A - enduser B CANNOT access =====
-                    ];
-                case 10:
-                    _d.sent();
-                    return [4 /*yield*/, uploadFile('mcr-file-individual.txt')];
-                case 11:
-                    fileForIndividual_1 = _d.sent();
-                    return [4 /*yield*/, sdk.api.managed_content_records.createOne({
-                            title: 'MCR File Access - Individual',
-                            htmlContent: '<p>Individual</p>',
-                            textContent: 'Individual',
-                            enduserId: testEnduser.id,
-                            attachments: [{ secureName: fileForIndividual_1.secureName, type: 'file', name: fileForIndividual_1.name }],
-                        })];
-                case 12:
-                    contentIndividual = _d.sent();
-                    contentRecordIds.push(contentIndividual.id);
-                    return [4 /*yield*/, (0, testing_1.async_test)('file attached to Individual content - assigned enduser CAN access', function () { return __awaiter(void 0, void 0, void 0, function () {
-                            var result;
-                            return __generator(this, function (_a) {
-                                switch (_a.label) {
-                                    case 0: return [4 /*yield*/, enduserSDK.api.files.file_download_URL({ secureName: fileForIndividual_1.secureName })];
-                                    case 1:
-                                        result = _a.sent();
-                                        return [2 /*return*/, !!(result === null || result === void 0 ? void 0 : result.downloadURL)];
-                                }
-                            });
-                        }); }, { onResult: function (r) { return r === true; } })];
-                case 13:
-                    _d.sent();
-                    return [4 /*yield*/, (0, testing_1.async_test)('file attached to Individual content - unassigned enduser CANNOT access', function () { return __awaiter(void 0, void 0, void 0, function () {
-                            var err_1;
-                            return __generator(this, function (_a) {
-                                switch (_a.label) {
-                                    case 0:
-                                        _a.trys.push([0, 2, , 3]);
-                                        return [4 /*yield*/, otherEnduserSDK.api.files.file_download_URL({ secureName: fileForIndividual_1.secureName })];
-                                    case 1:
-                                        _a.sent();
-                                        return [2 /*return*/, false];
-                                    case 2:
-                                        err_1 = _a.sent();
-                                        return [2 /*return*/, true];
-                                    case 3: return [2 /*return*/];
-                                }
-                            });
-                        }); }, { onResult: function (r) { return r === true; } })
-                        // ===== Test 3: File not attached to any managed content - enduser CANNOT access =====
-                    ];
-                case 14:
-                    _d.sent();
-                    return [4 /*yield*/, uploadFile('mcr-file-no-content.txt')];
-                case 15:
-                    fileNoContent_1 = _d.sent();
-                    return [4 /*yield*/, (0, testing_1.async_test)('file not attached to any managed content - enduser CANNOT access', function () { return __awaiter(void 0, void 0, void 0, function () {
-                            var err_2;
-                            return __generator(this, function (_a) {
-                                switch (_a.label) {
-                                    case 0:
-                                        _a.trys.push([0, 2, , 3]);
-                                        return [4 /*yield*/, enduserSDK.api.files.file_download_URL({ secureName: fileNoContent_1.secureName })];
-                                    case 1:
-                                        _a.sent();
-                                        return [2 /*return*/, false];
-                                    case 2:
-                                        err_2 = _a.sent();
-                                        return [2 /*return*/, true];
-                                    case 3: return [2 /*return*/];
-                                }
-                            });
-                        }); }, { onResult: function (r) { return r === true; } })
-                        // ===== Test 4: File with enduserId set - existing behavior preserved =====
-                    ];
-                case 16:
-                    _d.sent();
-                    return [4 /*yield*/, uploadFile('mcr-file-with-enduser.txt', { enduserId: testEnduser.id })];
-                case 17:
-                    fileWithEnduser_1 = _d.sent();
-                    return [4 /*yield*/, (0, testing_1.async_test)('file with enduserId set - enduser CAN access (no fallback needed)', function () { return __awaiter(void 0, void 0, void 0, function () {
-                            var result;
-                            return __generator(this, function (_a) {
-                                switch (_a.label) {
-                                    case 0: return [4 /*yield*/, enduserSDK.api.files.file_download_URL({ secureName: fileWithEnduser_1.secureName })];
-                                    case 1:
-                                        result = _a.sent();
-                                        return [2 /*return*/, !!(result === null || result === void 0 ? void 0 : result.downloadURL)];
-                                }
-                            });
-                        }); }, { onResult: function (r) { return r === true; } })
-                        // ===== Test 5: File with publicRead: true - existing behavior preserved =====
-                    ];
-                case 18:
-                    _d.sent();
-                    return [4 /*yield*/, uploadFile('mcr-file-public.txt', { publicRead: true })];
-                case 19:
-                    filePublic_1 = _d.sent();
-                    return [4 /*yield*/, (0, testing_1.async_test)('file with publicRead - enduser CAN access', function () { return __awaiter(void 0, void 0, void 0, function () {
-                            var result;
-                            return __generator(this, function (_a) {
-                                switch (_a.label) {
-                                    case 0: return [4 /*yield*/, enduserSDK.api.files.file_download_URL({ secureName: filePublic_1.secureName })];
-                                    case 1:
-                                        result = _a.sent();
-                                        return [2 /*return*/, !!(result === null || result === void 0 ? void 0 : result.downloadURL)];
-                                }
-                            });
-                        }); }, { onResult: function (r) { return r === true; } })];
-                case 20:
-                    _d.sent();
-                    console.log("All Managed Content File Access tests passed!");
-                    return [3 /*break*/, 41];
-                case 21:
-                    console.log("Cleaning up test data...");
-                    _d.label = 22;
-                case 22:
-                    _d.trys.push([22, 39, , 40]);
-                    _i = 0, assignmentIds_1 = assignmentIds;
-                    _d.label = 23;
-                case 23:
-                    if (!(_i < assignmentIds_1.length)) return [3 /*break*/, 26];
-                    assignmentId = assignmentIds_1[_i];
-                    return [4 /*yield*/, sdk.api.managed_content_record_assignments.deleteOne(assignmentId).catch(function () { })];
-                case 24:
-                    _d.sent();
-                    _d.label = 25;
-                case 25:
-                    _i++;
-                    return [3 /*break*/, 23];
-                case 26:
-                    _b = 0, contentRecordIds_1 = contentRecordIds;
-                    _d.label = 27;
-                case 27:
-                    if (!(_b < contentRecordIds_1.length)) return [3 /*break*/, 30];
-                    recordId = contentRecordIds_1[_b];
-                    return [4 /*yield*/, sdk.api.managed_content_records.deleteOne(recordId).catch(function () { })];
-                case 28:
-                    _d.sent();
-                    _d.label = 29;
-                case 29:
-                    _b++;
-                    return [3 /*break*/, 27];
-                case 30:
-                    _c = 0, fileIds_1 = fileIds;
-                    _d.label = 31;
-                case 31:
-                    if (!(_c < fileIds_1.length)) return [3 /*break*/, 34];
-                    fileId = fileIds_1[_c];
-                    return [4 /*yield*/, sdk.api.files.deleteOne(fileId).catch(function () { })];
-                case 32:
-                    _d.sent();
-                    _d.label = 33;
-                case 33:
-                    _c++;
-                    return [3 /*break*/, 31];
-                case 34:
-                    if (!testEnduserId) return [3 /*break*/, 36];
-                    return [4 /*yield*/, sdk.api.endusers.deleteOne(testEnduserId).catch(function () { })];
-                case 35:
-                    _d.sent();
-                    _d.label = 36;
-                case 36:
-                    if (!otherEnduserId) return [3 /*break*/, 38];
-                    return [4 /*yield*/, sdk.api.endusers.deleteOne(otherEnduserId).catch(function () { })];
-                case 37:
-                    _d.sent();
-                    _d.label = 38;
-                case 38:
-                    console.log("Cleanup completed");
-                    return [3 /*break*/, 40];
-                case 39:
-                    error_1 = _d.sent();
-                    console.error('Cleanup error:', error_1);
-                    return [3 /*break*/, 40];
-                case 40: return [7 /*endfinally*/];
-                case 41: return [2 /*return*/];
-            }
-        });
+                    });
+                };
+                expect_download_allowed = function (label, session, secureName) { return __awaiter(void 0, void 0, void 0, function () {
+                    var result, e_2;
+                    return __generator(this, function (_a) {
+                        switch (_a.label) {
+                            case 0:
+                                _a.trys.push([0, 2, , 3]);
+                                return [4 /*yield*/, session.api.files.file_download_URL({ secureName: secureName })];
+                            case 1:
+                                result = _a.sent();
+                                record(label, !!(result === null || result === void 0 ? void 0 : result.downloadURL), "downloadURL=".concat((result === null || result === void 0 ? void 0 : result.downloadURL) ? 'present' : 'missing'));
+                                return [3 /*break*/, 3];
+                            case 2:
+                                e_2 = _a.sent();
+                                record(label, false, "rejected instead of signing a URL: ".concat(errorMessage(e_2)));
+                                return [3 /*break*/, 3];
+                            case 3: return [2 /*return*/];
+                        }
+                    });
+                }); };
+                expect_download_denied = function (label, session, secureName) { return __awaiter(void 0, void 0, void 0, function () {
+                    var unexpected, e_3;
+                    return __generator(this, function (_a) {
+                        switch (_a.label) {
+                            case 0:
+                                _a.trys.push([0, 2, , 3]);
+                                return [4 /*yield*/, session.api.files.file_download_URL({ secureName: secureName })];
+                            case 1:
+                                unexpected = _a.sent();
+                                record(label, false, "resolved instead of rejecting; result=".concat(describe(unexpected)));
+                                return [3 /*break*/, 3];
+                            case 2:
+                                e_3 = _a.sent();
+                                record(label, true, "rejected with ".concat(errorMessage(e_3)));
+                                return [3 /*break*/, 3];
+                            case 3: return [2 /*return*/];
+                        }
+                    });
+                }); };
+                console.log("Setting up test data...");
+                return [4 /*yield*/, sdk_2.api.endusers.createOne({
+                        email: "mcr_file_access_test_".concat(Date.now(), "_").concat(RAND(), "@test.tellescope.com"),
+                    })];
+            case 3:
+                testEnduser = _c.sent();
+                testEnduserId = testEnduser.id;
+                return [4 /*yield*/, sdk_2.api.endusers.set_password({ id: testEnduser.id, password: 'TestPassword123!' })];
+            case 4:
+                _c.sent();
+                return [4 /*yield*/, sdk_2.api.endusers.createOne({
+                        email: "mcr_file_access_other_".concat(Date.now(), "_").concat(RAND(), "@test.tellescope.com"),
+                    })];
+            case 5:
+                otherEnduser = _c.sent();
+                otherEnduserId = otherEnduser.id;
+                return [4 /*yield*/, sdk_2.api.endusers.set_password({ id: otherEnduser.id, password: 'TestPassword123!' })];
+            case 6:
+                _c.sent();
+                enduserSDK = new sdk_1.EnduserSession({ host: host, businessId: tenant.businessId });
+                return [4 /*yield*/, enduserSDK.authenticate(testEnduser.email, 'TestPassword123!')];
+            case 7:
+                _c.sent();
+                otherEnduserSDK = new sdk_1.EnduserSession({ host: host, businessId: tenant.businessId });
+                return [4 /*yield*/, otherEnduserSDK.authenticate(otherEnduser.email, 'TestPassword123!')
+                    // ===== Test 1: File attached to assignmentType: 'All' content - enduser CAN access =====
+                ];
+            case 8:
+                _c.sent();
+                return [4 /*yield*/, createFileRecord('mcr-file-all.txt')];
+            case 9:
+                fileForAll = _c.sent();
+                return [4 /*yield*/, sdk_2.api.managed_content_records.createOne({
+                        title: 'MCR File Access - All',
+                        htmlContent: '<p>All</p>',
+                        textContent: 'All',
+                        assignmentType: 'All',
+                        attachments: [{ secureName: fileForAll.secureName, type: 'file', name: fileForAll.name }],
+                    })];
+            case 10:
+                contentAll = _c.sent();
+                contentRecordIds.push(contentAll.id);
+                return [4 /*yield*/, expect_download_allowed('staff-uploaded file in assignmentType:All content - enduser CAN access', enduserSDK, fileForAll.secureName)
+                    // ===== Test 2: File attached to Individual content for enduser A - enduser B CANNOT access =====
+                ];
+            case 11:
+                _c.sent();
+                return [4 /*yield*/, createFileRecord('mcr-file-individual.txt')];
+            case 12:
+                fileForIndividual = _c.sent();
+                return [4 /*yield*/, sdk_2.api.managed_content_records.createOne({
+                        title: 'MCR File Access - Individual',
+                        htmlContent: '<p>Individual</p>',
+                        textContent: 'Individual',
+                        enduserId: testEnduser.id,
+                        attachments: [{ secureName: fileForIndividual.secureName, type: 'file', name: fileForIndividual.name }],
+                    })];
+            case 13:
+                contentIndividual = _c.sent();
+                contentRecordIds.push(contentIndividual.id);
+                return [4 /*yield*/, expect_download_allowed('file attached to Individual content - assigned enduser CAN access', enduserSDK, fileForIndividual.secureName)];
+            case 14:
+                _c.sent();
+                return [4 /*yield*/, expect_download_denied('file attached to Individual content - unassigned enduser CANNOT access', otherEnduserSDK, fileForIndividual.secureName)
+                    // ===== Test 3: File not attached to any managed content - enduser CANNOT access =====
+                ];
+            case 15:
+                _c.sent();
+                return [4 /*yield*/, createFileRecord('mcr-file-no-content.txt')];
+            case 16:
+                fileNoContent = _c.sent();
+                return [4 /*yield*/, expect_download_denied('file not attached to any managed content - enduser CANNOT access', enduserSDK, fileNoContent.secureName)
+                    // ===== Test 4: File with enduserId set - existing behavior preserved =====
+                ];
+            case 17:
+                _c.sent();
+                return [4 /*yield*/, createFileRecord('mcr-file-with-enduser.txt', { enduserId: testEnduser.id })];
+            case 18:
+                fileWithEnduser = _c.sent();
+                return [4 /*yield*/, expect_download_allowed('file with enduserId set - enduser CAN access (no fallback needed)', enduserSDK, fileWithEnduser.secureName)
+                    // ===== Test 5: File with publicRead: true - existing behavior preserved =====
+                ];
+            case 19:
+                _c.sent();
+                return [4 /*yield*/, createFileRecord('mcr-file-public.txt', { publicRead: true })];
+            case 20:
+                filePublic = _c.sent();
+                return [4 /*yield*/, expect_download_allowed('file with publicRead - enduser CAN access', enduserSDK, filePublic.secureName)];
+            case 21:
+                _c.sent();
+                return [3 /*break*/, 45];
+            case 22:
+                console.log("Cleaning up test data...");
+                if (!tenant) return [3 /*break*/, 44];
+                sdk = tenant.sdk;
+                _c.label = 23;
+            case 23:
+                _c.trys.push([23, 40, , 41]);
+                _i = 0, assignmentIds_1 = assignmentIds;
+                _c.label = 24;
+            case 24:
+                if (!(_i < assignmentIds_1.length)) return [3 /*break*/, 27];
+                assignmentId = assignmentIds_1[_i];
+                return [4 /*yield*/, sdk.api.managed_content_record_assignments.deleteOne(assignmentId).catch(function () { })];
+            case 25:
+                _c.sent();
+                _c.label = 26;
+            case 26:
+                _i++;
+                return [3 /*break*/, 24];
+            case 27:
+                _a = 0, contentRecordIds_1 = contentRecordIds;
+                _c.label = 28;
+            case 28:
+                if (!(_a < contentRecordIds_1.length)) return [3 /*break*/, 31];
+                recordId = contentRecordIds_1[_a];
+                return [4 /*yield*/, sdk.api.managed_content_records.deleteOne(recordId).catch(function () { })];
+            case 29:
+                _c.sent();
+                _c.label = 30;
+            case 30:
+                _a++;
+                return [3 /*break*/, 28];
+            case 31:
+                _b = 0, fileIds_1 = fileIds;
+                _c.label = 32;
+            case 32:
+                if (!(_b < fileIds_1.length)) return [3 /*break*/, 35];
+                fileId = fileIds_1[_b];
+                return [4 /*yield*/, sdk.api.files.deleteOne(fileId).catch(function () { })];
+            case 33:
+                _c.sent();
+                _c.label = 34;
+            case 34:
+                _b++;
+                return [3 /*break*/, 32];
+            case 35:
+                if (!testEnduserId) return [3 /*break*/, 37];
+                return [4 /*yield*/, sdk.api.endusers.deleteOne(testEnduserId).catch(function () { })];
+            case 36:
+                _c.sent();
+                _c.label = 37;
+            case 37:
+                if (!otherEnduserId) return [3 /*break*/, 39];
+                return [4 /*yield*/, sdk.api.endusers.deleteOne(otherEnduserId).catch(function () { })];
+            case 38:
+                _c.sent();
+                _c.label = 39;
+            case 39:
+                console.log("Cleanup completed");
+                return [3 /*break*/, 41];
+            case 40:
+                error_1 = _c.sent();
+                console.error('Cleanup error:', error_1);
+                return [3 /*break*/, 41];
+            case 41:
+                _c.trys.push([41, 43, , 44]);
+                return [4 /*yield*/, tenant.teardown()];
+            case 42:
+                _c.sent();
+                return [3 /*break*/, 44];
+            case 43:
+                e_1 = _c.sent();
+                console.error('teardown failed', e_1);
+                return [3 /*break*/, 44];
+            case 44: return [7 /*endfinally*/];
+            case 45: return [2 /*return*/, checks];
+        }
     });
-};
+}); };
+exports.managed_content_file_access_checks = managed_content_file_access_checks;
+/** Asserting wrapper, for standalone runs. */
+var managed_content_file_access_tests = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var _a, _b;
+    return __generator(this, function (_c) {
+        switch (_c.label) {
+            case 0:
+                _a = setup_isolated_1.assert_checks;
+                _b = ['Managed content file access'];
+                return [4 /*yield*/, (0, exports.managed_content_file_access_checks)()];
+            case 1:
+                _a.apply(void 0, _b.concat([_c.sent()]));
+                return [2 /*return*/];
+        }
+    });
+}); };
 exports.managed_content_file_access_tests = managed_content_file_access_tests;
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+exports.ISOLATED_SUITE = {
+    name: 'Managed content file access',
+    run: exports.managed_content_file_access_checks,
+};
 if (require.main === module) {
     console.log("Using API URL: ".concat(host));
-    var sdk_2 = new sdk_1.Session({ host: host });
-    var sdkNonAdmin_1 = new sdk_1.Session({ host: host });
-    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
-        return __generator(this, function (_a) {
-            switch (_a.label) {
-                case 0: return [4 /*yield*/, (0, setup_1.setup_tests)(sdk_2, sdkNonAdmin_1)];
-                case 1:
-                    _a.sent();
-                    return [4 /*yield*/, (0, exports.managed_content_file_access_tests)({ sdk: sdk_2, sdkNonAdmin: sdkNonAdmin_1 })];
-                case 2:
-                    _a.sent();
-                    return [2 /*return*/];
-            }
-        });
-    }); };
-    runTests()
+    (0, exports.managed_content_file_access_tests)()
         .then(function () {
         console.log("Managed content file access test suite completed successfully");
         process.exit(0);