@tellescope/sdk 2.0.0-beta.2 → 2.0.0-beta.3

package/lib/cjs/tests/api_tests/security/booking-info-idor-token-mint.test.d.ts

@@ -1,4 +1,4 @@
-import { Session } from "../../../sdk";
+import { Check, IsolatedSuite } from "../../setup_isolated";
 /**
  * Regression test: `form_fields.booking_info` must not mint a booking token for another patient.
  *
@@ -18,12 +18,17 @@ import { Session } from "../../../sdk";
  * the VICTIM's id, and the victim's `state` is overwritten. B/C (positive controls) pass pre-fix.
  * GREEN (post-fix): all six checks pass.
  *
- * Checks are collected and printed before any assert runs: the testing harness has
- * EXIT_ON_FIRST_ERROR, so asserting inline would kill the process before the evidence table and
- * before `finally` cleanup.
+ * Checks are collected and returned rather than asserted inline: the testing harness's `assert`
+ * calls process.exit, which would kill the process before the evidence table, before `finally`
+ * cleanup, and — in the parallel pool — before every other in-flight suite's teardown.
+ *
+ * Runs on its own provisioned tenant, so the patient's businessId comes from the tenant rather than
+ * a TEST_BUSINESS_ID env var with a hardcoded fallback, and the "oldest contact" the staff preview
+ * branch (C2) resolves is this suite's own fixture.
  */
-export declare const booking_info_idor_tests: ({ sdk }: {
-    sdk: Session;
-    sdkNonAdmin: Session;
-}) => Promise<void>;
+export declare const booking_info_idor_checks: () => Promise<Check[]>;
+/** Asserting wrapper, for standalone runs. */
+export declare const booking_info_idor_tests: () => Promise<void>;
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export declare const ISOLATED_SUITE: IsolatedSuite;
 //# sourceMappingURL=booking-info-idor-token-mint.test.d.ts.map

package/lib/cjs/tests/api_tests/security/booking-info-idor-token-mint.test.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"booking-info-idor-token-mint.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/booking-info-idor-token-mint.test.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAkB,MAAM,cAAc,CAAA;AAqBtD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,uBAAuB;SAA2B,OAAO;iBAAe,OAAO;mBA2J3F,CAAA"}
+{"version":3,"file":"booking-info-idor-token-mint.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/booking-info-idor-token-mint.test.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,EACL,aAAa,EAEd,MAAM,sBAAsB,CAAA;AAS7B;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,wBAAwB,QAAa,QAAQ,KAAK,EAAE,CAkKhE,CAAA;AAED,8CAA8C;AAC9C,eAAO,MAAM,uBAAuB,qBAEnC,CAAA;AAED,oGAAoG;AACpG,eAAO,MAAM,cAAc,EAAE,aAG5B,CAAA"}

package/lib/cjs/tests/api_tests/security/booking-info-idor-token-mint.test.js

@@ -36,13 +36,11 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
     }
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.booking_info_idor_tests = void 0;
+exports.ISOLATED_SUITE = exports.booking_info_idor_tests = exports.booking_info_idor_checks = void 0;
 require('source-map-support').install();
 var sdk_1 = require("../../../sdk");
-var testing_1 = require("@tellescope/testing");
-var setup_1 = require("../../setup");
+var setup_isolated_1 = require("../../setup_isolated");
 var host = process.env.API_URL || 'http://localhost:8080';
-var businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6';
 var RAND = function () { return Math.random().toString(36).slice(2, 10); };
 var VICTIM_STATE = 'CA';
 var ATTACKER_STATE_WRITE = 'NY';
@@ -65,264 +63,282 @@ var ATTACKER_STATE_WRITE = 'NY';
  * the VICTIM's id, and the victim's `state` is overwritten. B/C (positive controls) pass pre-fix.
  * GREEN (post-fix): all six checks pass.
  *
- * Checks are collected and printed before any assert runs: the testing harness has
- * EXIT_ON_FIRST_ERROR, so asserting inline would kill the process before the evidence table and
- * before `finally` cleanup.
+ * Checks are collected and returned rather than asserted inline: the testing harness's `assert`
+ * calls process.exit, which would kill the process before the evidence table, before `finally`
+ * cleanup, and — in the parallel pool — before every other in-flight suite's teardown.
+ *
+ * Runs on its own provisioned tenant, so the patient's businessId comes from the tenant rather than
+ * a TEST_BUSINESS_ID env var with a hardcoded fallback, and the "oldest contact" the staff preview
+ * branch (C2) resolves is this suite's own fixture.
  */
-var booking_info_idor_tests = function (_a) {
-    var sdk = _a.sdk;
-    return __awaiter(void 0, void 0, void 0, function () {
-        var checks, record, token_enduser_id, templateId, bookingPageId, enduserIds, template, bookingPage, attacker, victim, attackerSDK, a1Detail, a1Pass, r, mintedFor, e_1, a2Attempt, e_2, victimAfter, b1Detail, b1Pass, r, mintedFor, e_3, b2Detail, b2Pass, r, mintedFor, e_4, c1Detail, c1Pass, r, mintedFor, e_5, c2Detail, c2Pass, r, e_6, _i, checks_1, c, _b, checks_2, c, _c, enduserIds_1, id, _d, _e, _f;
-        return __generator(this, function (_g) {
-            switch (_g.label) {
-                case 0:
-                    (0, testing_1.log_header)("booking_info must not mint an appointment-booking token for another enduser");
-                    checks = [];
-                    record = function (label, pass, detail) { return checks.push({ label: label, pass: pass, detail: detail }); };
-                    token_enduser_id = function (bookingURL) {
-                        var _a;
-                        var token = (_a = /[?&]token=([^&]+)/.exec(bookingURL || '')) === null || _a === void 0 ? void 0 : _a[1];
-                        var payload = token === null || token === void 0 ? void 0 : token.split('.')[1];
-                        if (!payload)
-                            return '';
-                        try {
-                            return JSON.parse(Buffer.from(payload, 'base64').toString()).id;
-                        }
-                        catch (_b) {
-                            return '';
-                        }
-                    };
-                    templateId = '';
-                    bookingPageId = '';
-                    enduserIds = [];
-                    _g.label = 1;
-                case 1:
-                    _g.trys.push([1, , 32, 47]);
-                    return [4 /*yield*/, sdk.api.calendar_event_templates.createOne({
-                            title: "F0179 template ".concat(RAND()), durationInMinutes: 30,
-                        })];
-                case 2:
-                    template = _g.sent();
-                    templateId = template.id;
-                    return [4 /*yield*/, sdk.api.appointment_booking_pages.createOne({
-                            title: "F0179 booking page ".concat(RAND()),
-                            calendarEventTemplateIds: [templateId],
-                            locationIds: [],
-                        })];
-                case 3:
-                    bookingPage = _g.sent();
-                    bookingPageId = bookingPage.id;
-                    return [4 /*yield*/, sdk.api.endusers.createOne({
-                            email: "f0179-attacker-".concat(RAND(), "@tellescope.example"), fname: 'F0179', lname: 'Attacker',
-                        })];
-                case 4:
-                    attacker = _g.sent();
-                    enduserIds.push(attacker.id);
-                    return [4 /*yield*/, sdk.api.endusers.createOne({
-                            email: "f0179-victim-".concat(RAND(), "@tellescope.example"), fname: 'F0179', lname: 'Victim',
-                            state: VICTIM_STATE,
-                        })];
-                case 5:
-                    victim = _g.sent();
-                    enduserIds.push(victim.id);
-                    attackerSDK = new sdk_1.EnduserSession({ host: host, businessId: businessId });
-                    return [4 /*yield*/, (0, setup_1.authenticate_enduser_via_token)(sdk, attackerSDK, { id: attacker.id })
-                        /* ===== A: the exploit — enduser mints a booking session as another patient ===== */
-                    ];
-                case 6:
-                    _g.sent();
-                    a1Detail = '';
-                    a1Pass = false;
-                    _g.label = 7;
-                case 7:
-                    _g.trys.push([7, 9, , 10]);
-                    return [4 /*yield*/, attackerSDK.api.form_fields.booking_info({ bookingPageId: bookingPageId, enduserId: victim.id })];
-                case 8:
-                    r = _g.sent();
-                    mintedFor = token_enduser_id(r.bookingURL);
-                    a1Detail = ("EXPLOITED: 200 with a bookingURL; token subject=".concat(mintedFor, " ")
-                        + "(victim=".concat(victim.id, ", attacker=").concat(attacker.id, ")")
-                        + (mintedFor === victim.id ? ' — a live appointment-booking session AS THE VICTIM' : ''));
-                    return [3 /*break*/, 10];
-                case 9:
-                    e_1 = _g.sent();
-                    a1Pass = true;
-                    a1Detail = "rejected: ".concat((e_1 === null || e_1 === void 0 ? void 0 : e_1.message) || (e_1 === null || e_1 === void 0 ? void 0 : e_1.toString()));
-                    return [3 /*break*/, 10];
-                case 10:
-                    record('A1: enduser cannot mint a booking token for another enduser', a1Pass, a1Detail);
-                    a2Attempt = '';
-                    _g.label = 11;
-                case 11:
-                    _g.trys.push([11, 13, , 14]);
-                    return [4 /*yield*/, attackerSDK.api.form_fields.booking_info({
-                            bookingPageId: bookingPageId,
-                            enduserId: victim.id, enduserFields: { state: ATTACKER_STATE_WRITE },
-                        })];
-                case 12:
-                    _g.sent();
-                    a2Attempt = 'call returned 200';
-                    return [3 /*break*/, 14];
-                case 13:
-                    e_2 = _g.sent();
-                    a2Attempt = "call rejected: ".concat((e_2 === null || e_2 === void 0 ? void 0 : e_2.message) || (e_2 === null || e_2 === void 0 ? void 0 : e_2.toString()));
-                    return [3 /*break*/, 14];
-                case 14: return [4 /*yield*/, sdk.api.endusers.getOne(victim.id)];
-                case 15:
-                    victimAfter = _g.sent();
-                    record('A2: enduser cannot write `state` onto another enduser via enduserFields', victimAfter.state === VICTIM_STATE, "".concat(a2Attempt, "; victim.state=").concat(victimAfter.state, " (expected ").concat(VICTIM_STATE, ")"));
-                    b1Detail = '';
-                    b1Pass = false;
-                    _g.label = 16;
-                case 16:
-                    _g.trys.push([16, 18, , 19]);
-                    return [4 /*yield*/, attackerSDK.api.form_fields.booking_info({ bookingPageId: bookingPageId })];
-                case 17:
-                    r = _g.sent();
-                    mintedFor = token_enduser_id(r.bookingURL);
-                    b1Pass = mintedFor === attacker.id;
-                    b1Detail = "token subject=".concat(mintedFor, " (self=").concat(attacker.id, ")");
-                    return [3 /*break*/, 19];
-                case 18:
-                    e_3 = _g.sent();
-                    b1Detail = "unexpectedly rejected: ".concat((e_3 === null || e_3 === void 0 ? void 0 : e_3.message) || (e_3 === null || e_3 === void 0 ? void 0 : e_3.toString()));
-                    return [3 /*break*/, 19];
-                case 19:
-                    record('B1: enduser can still load booking info with no enduserId', b1Pass, b1Detail);
-                    b2Detail = '';
-                    b2Pass = false;
-                    _g.label = 20;
-                case 20:
-                    _g.trys.push([20, 22, , 23]);
-                    return [4 /*yield*/, attackerSDK.api.form_fields.booking_info({ bookingPageId: bookingPageId, enduserId: attacker.id })];
-                case 21:
-                    r = _g.sent();
-                    mintedFor = token_enduser_id(r.bookingURL);
-                    b2Pass = mintedFor === attacker.id;
-                    b2Detail = "token subject=".concat(mintedFor, " (self=").concat(attacker.id, ")");
-                    return [3 /*break*/, 23];
-                case 22:
-                    e_4 = _g.sent();
-                    b2Detail = "unexpectedly rejected: ".concat((e_4 === null || e_4 === void 0 ? void 0 : e_4.message) || (e_4 === null || e_4 === void 0 ? void 0 : e_4.toString()));
-                    return [3 /*break*/, 23];
-                case 23:
-                    record('B2: enduser can still load booking info for its OWN enduserId', b2Pass, b2Detail);
-                    c1Detail = '';
-                    c1Pass = false;
-                    _g.label = 24;
-                case 24:
-                    _g.trys.push([24, 26, , 27]);
-                    return [4 /*yield*/, sdk.api.form_fields.booking_info({ bookingPageId: bookingPageId, enduserId: victim.id })];
-                case 25:
-                    r = _g.sent();
-                    mintedFor = token_enduser_id(r.bookingURL);
-                    c1Pass = mintedFor === victim.id;
-                    c1Detail = "token subject=".concat(mintedFor, " (target=").concat(victim.id, ")");
-                    return [3 /*break*/, 27];
-                case 26:
-                    e_5 = _g.sent();
-                    c1Detail = "unexpectedly rejected: ".concat((e_5 === null || e_5 === void 0 ? void 0 : e_5.message) || (e_5 === null || e_5 === void 0 ? void 0 : e_5.toString()));
-                    return [3 /*break*/, 27];
-                case 27:
-                    record('C1: staff can still load booking info for a specific enduser', c1Pass, c1Detail);
-                    c2Detail = '';
-                    c2Pass = false;
-                    _g.label = 28;
-                case 28:
-                    _g.trys.push([28, 30, , 31]);
-                    return [4 /*yield*/, sdk.api.form_fields.booking_info({ bookingPageId: bookingPageId })];
-                case 29:
-                    r = _g.sent();
-                    c2Pass = !!r.bookingURL && !!r.warningMessage;
-                    c2Detail = "warningMessage=".concat(JSON.stringify(r.warningMessage), " bookingURL=").concat(!!r.bookingURL);
-                    return [3 /*break*/, 31];
-                case 30:
-                    e_6 = _g.sent();
-                    c2Detail = "unexpectedly rejected: ".concat((e_6 === null || e_6 === void 0 ? void 0 : e_6.message) || (e_6 === null || e_6 === void 0 ? void 0 : e_6.toString()));
-                    return [3 /*break*/, 31];
-                case 31:
-                    record('C2: staff test-contact preview branch still works', c2Pass, c2Detail);
-                    /* ===== report: print full table first, then assert (harness exits on first failure) ===== */
-                    console.log('\n  check summary:');
-                    for (_i = 0, checks_1 = checks; _i < checks_1.length; _i++) {
-                        c = checks_1[_i];
-                        console.log("    ".concat(c.pass ? 'PASS' : 'FAIL', "  ").concat(c.label, "  \u2014  ").concat(c.detail));
+var booking_info_idor_checks = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var checks, record, token_enduser_id, tenant, templateId, bookingPageId, enduserIds, sdk, template, bookingPage, attacker, victim, attackerSDK, _a, attackerAuthToken, attackerInfo, a1Detail, a1Pass, r, mintedFor, e_1, a2Attempt, e_2, victimAfter, b1Detail, b1Pass, r, mintedFor, e_3, b2Detail, b2Pass, r, mintedFor, e_4, c1Detail, c1Pass, r, mintedFor, e_5, c2Detail, c2Pass, r, e_6, sdk, _i, enduserIds_1, id, _b, _c, _d, e_7;
+    return __generator(this, function (_e) {
+        switch (_e.label) {
+            case 0:
+                checks = [];
+                record = function (label, pass, detail) { return checks.push({ label: label, pass: pass, detail: detail }); };
+                token_enduser_id = function (bookingURL) {
+                    var _a;
+                    var token = (_a = /[?&]token=([^&]+)/.exec(bookingURL || '')) === null || _a === void 0 ? void 0 : _a[1];
+                    var payload = token === null || token === void 0 ? void 0 : token.split('.')[1];
+                    if (!payload)
+                        return '';
+                    try {
+                        return JSON.parse(Buffer.from(payload, 'base64').toString()).id;
                     }
-                    console.log('');
-                    for (_b = 0, checks_2 = checks; _b < checks_2.length; _b++) {
-                        c = checks_2[_b];
-                        (0, testing_1.assert)(c.pass, "".concat(c.label, " \u2014 ").concat(c.detail), c.label);
+                    catch (_b) {
+                        return '';
                     }
-                    return [3 /*break*/, 47];
-                case 32:
-                    _c = 0, enduserIds_1 = enduserIds;
-                    _g.label = 33;
-                case 33:
-                    if (!(_c < enduserIds_1.length)) return [3 /*break*/, 38];
-                    id = enduserIds_1[_c];
-                    _g.label = 34;
-                case 34:
-                    _g.trys.push([34, 36, , 37]);
-                    return [4 /*yield*/, sdk.api.endusers.deleteOne(id)];
-                case 35:
-                    _g.sent();
-                    return [3 /*break*/, 37];
-                case 36:
-                    _d = _g.sent();
-                    return [3 /*break*/, 37];
-                case 37:
-                    _c++;
-                    return [3 /*break*/, 33];
-                case 38:
-                    if (!bookingPageId) return [3 /*break*/, 42];
-                    _g.label = 39;
-                case 39:
-                    _g.trys.push([39, 41, , 42]);
-                    return [4 /*yield*/, sdk.api.appointment_booking_pages.deleteOne(bookingPageId)];
-                case 40:
-                    _g.sent();
-                    return [3 /*break*/, 42];
-                case 41:
-                    _e = _g.sent();
-                    return [3 /*break*/, 42];
-                case 42:
-                    if (!templateId) return [3 /*break*/, 46];
-                    _g.label = 43;
-                case 43:
-                    _g.trys.push([43, 45, , 46]);
-                    return [4 /*yield*/, sdk.api.calendar_event_templates.deleteOne(templateId)];
-                case 44:
-                    _g.sent();
-                    return [3 /*break*/, 46];
-                case 45:
-                    _f = _g.sent();
-                    return [3 /*break*/, 46];
-                case 46: return [7 /*endfinally*/];
-                case 47: return [2 /*return*/];
-            }
-        });
+                };
+                templateId = '';
+                bookingPageId = '';
+                enduserIds = [];
+                _e.label = 1;
+            case 1:
+                _e.trys.push([1, , 34, 52]);
+                return [4 /*yield*/, (0, setup_isolated_1.setup_isolated_tenant)({
+                        name: "Booking info IDOR token mint ".concat(RAND()),
+                        users: [{ isAdmin: true }],
+                        apiKeys: 0,
+                    })];
+            case 2:
+                tenant = _e.sent();
+                sdk = tenant.sdk;
+                return [4 /*yield*/, sdk.api.calendar_event_templates.createOne({
+                        title: "F0179 template ".concat(RAND()), durationInMinutes: 30,
+                    })];
+            case 3:
+                template = _e.sent();
+                templateId = template.id;
+                return [4 /*yield*/, sdk.api.appointment_booking_pages.createOne({
+                        title: "F0179 booking page ".concat(RAND()),
+                        calendarEventTemplateIds: [templateId],
+                        locationIds: [],
+                    })];
+            case 4:
+                bookingPage = _e.sent();
+                bookingPageId = bookingPage.id;
+                return [4 /*yield*/, sdk.api.endusers.createOne({
+                        email: "f0179-attacker-".concat(RAND(), "@tellescope.example"), fname: 'F0179', lname: 'Attacker',
+                    })];
+            case 5:
+                attacker = _e.sent();
+                enduserIds.push(attacker.id);
+                return [4 /*yield*/, sdk.api.endusers.createOne({
+                        email: "f0179-victim-".concat(RAND(), "@tellescope.example"), fname: 'F0179', lname: 'Victim',
+                        state: VICTIM_STATE,
+                    })];
+            case 6:
+                victim = _e.sent();
+                enduserIds.push(victim.id);
+                attackerSDK = new sdk_1.EnduserSession({ host: host, businessId: tenant.businessId });
+                return [4 /*yield*/, sdk.api.endusers.generate_auth_token({ id: attacker.id })];
+            case 7:
+                _a = (_e.sent()), attackerAuthToken = _a.authToken, attackerInfo = _a.enduser;
+                return [4 /*yield*/, attackerSDK.handle_new_session({ authToken: attackerAuthToken, enduser: attackerInfo })
+                    /* ===== A: the exploit — enduser mints a booking session as another patient ===== */
+                ];
+            case 8:
+                _e.sent();
+                a1Detail = '';
+                a1Pass = false;
+                _e.label = 9;
+            case 9:
+                _e.trys.push([9, 11, , 12]);
+                return [4 /*yield*/, attackerSDK.api.form_fields.booking_info({ bookingPageId: bookingPageId, enduserId: victim.id })];
+            case 10:
+                r = _e.sent();
+                mintedFor = token_enduser_id(r.bookingURL);
+                a1Detail = ("EXPLOITED: 200 with a bookingURL; token subject=".concat(mintedFor, " ")
+                    + "(victim=".concat(victim.id, ", attacker=").concat(attacker.id, ")")
+                    + (mintedFor === victim.id ? ' — a live appointment-booking session AS THE VICTIM' : ''));
+                return [3 /*break*/, 12];
+            case 11:
+                e_1 = _e.sent();
+                a1Pass = true;
+                a1Detail = "rejected: ".concat((e_1 === null || e_1 === void 0 ? void 0 : e_1.message) || (e_1 === null || e_1 === void 0 ? void 0 : e_1.toString()));
+                return [3 /*break*/, 12];
+            case 12:
+                record('A1: enduser cannot mint a booking token for another enduser', a1Pass, a1Detail);
+                a2Attempt = '';
+                _e.label = 13;
+            case 13:
+                _e.trys.push([13, 15, , 16]);
+                return [4 /*yield*/, attackerSDK.api.form_fields.booking_info({
+                        bookingPageId: bookingPageId,
+                        enduserId: victim.id, enduserFields: { state: ATTACKER_STATE_WRITE },
+                    })];
+            case 14:
+                _e.sent();
+                a2Attempt = 'call returned 200';
+                return [3 /*break*/, 16];
+            case 15:
+                e_2 = _e.sent();
+                a2Attempt = "call rejected: ".concat((e_2 === null || e_2 === void 0 ? void 0 : e_2.message) || (e_2 === null || e_2 === void 0 ? void 0 : e_2.toString()));
+                return [3 /*break*/, 16];
+            case 16: return [4 /*yield*/, sdk.api.endusers.getOne(victim.id)];
+            case 17:
+                victimAfter = _e.sent();
+                record('A2: enduser cannot write `state` onto another enduser via enduserFields', victimAfter.state === VICTIM_STATE, "".concat(a2Attempt, "; victim.state=").concat(victimAfter.state, " (expected ").concat(VICTIM_STATE, ")"));
+                b1Detail = '';
+                b1Pass = false;
+                _e.label = 18;
+            case 18:
+                _e.trys.push([18, 20, , 21]);
+                return [4 /*yield*/, attackerSDK.api.form_fields.booking_info({ bookingPageId: bookingPageId })];
+            case 19:
+                r = _e.sent();
+                mintedFor = token_enduser_id(r.bookingURL);
+                b1Pass = mintedFor === attacker.id;
+                b1Detail = "token subject=".concat(mintedFor, " (self=").concat(attacker.id, ")");
+                return [3 /*break*/, 21];
+            case 20:
+                e_3 = _e.sent();
+                b1Detail = "unexpectedly rejected: ".concat((e_3 === null || e_3 === void 0 ? void 0 : e_3.message) || (e_3 === null || e_3 === void 0 ? void 0 : e_3.toString()));
+                return [3 /*break*/, 21];
+            case 21:
+                record('B1: enduser can still load booking info with no enduserId', b1Pass, b1Detail);
+                b2Detail = '';
+                b2Pass = false;
+                _e.label = 22;
+            case 22:
+                _e.trys.push([22, 24, , 25]);
+                return [4 /*yield*/, attackerSDK.api.form_fields.booking_info({ bookingPageId: bookingPageId, enduserId: attacker.id })];
+            case 23:
+                r = _e.sent();
+                mintedFor = token_enduser_id(r.bookingURL);
+                b2Pass = mintedFor === attacker.id;
+                b2Detail = "token subject=".concat(mintedFor, " (self=").concat(attacker.id, ")");
+                return [3 /*break*/, 25];
+            case 24:
+                e_4 = _e.sent();
+                b2Detail = "unexpectedly rejected: ".concat((e_4 === null || e_4 === void 0 ? void 0 : e_4.message) || (e_4 === null || e_4 === void 0 ? void 0 : e_4.toString()));
+                return [3 /*break*/, 25];
+            case 25:
+                record('B2: enduser can still load booking info for its OWN enduserId', b2Pass, b2Detail);
+                c1Detail = '';
+                c1Pass = false;
+                _e.label = 26;
+            case 26:
+                _e.trys.push([26, 28, , 29]);
+                return [4 /*yield*/, sdk.api.form_fields.booking_info({ bookingPageId: bookingPageId, enduserId: victim.id })];
+            case 27:
+                r = _e.sent();
+                mintedFor = token_enduser_id(r.bookingURL);
+                c1Pass = mintedFor === victim.id;
+                c1Detail = "token subject=".concat(mintedFor, " (target=").concat(victim.id, ")");
+                return [3 /*break*/, 29];
+            case 28:
+                e_5 = _e.sent();
+                c1Detail = "unexpectedly rejected: ".concat((e_5 === null || e_5 === void 0 ? void 0 : e_5.message) || (e_5 === null || e_5 === void 0 ? void 0 : e_5.toString()));
+                return [3 /*break*/, 29];
+            case 29:
+                record('C1: staff can still load booking info for a specific enduser', c1Pass, c1Detail);
+                c2Detail = '';
+                c2Pass = false;
+                _e.label = 30;
+            case 30:
+                _e.trys.push([30, 32, , 33]);
+                return [4 /*yield*/, sdk.api.form_fields.booking_info({ bookingPageId: bookingPageId })];
+            case 31:
+                r = _e.sent();
+                c2Pass = !!r.bookingURL && !!r.warningMessage;
+                c2Detail = "warningMessage=".concat(JSON.stringify(r.warningMessage), " bookingURL=").concat(!!r.bookingURL);
+                return [3 /*break*/, 33];
+            case 32:
+                e_6 = _e.sent();
+                c2Detail = "unexpectedly rejected: ".concat((e_6 === null || e_6 === void 0 ? void 0 : e_6.message) || (e_6 === null || e_6 === void 0 ? void 0 : e_6.toString()));
+                return [3 /*break*/, 33];
+            case 33:
+                record('C2: staff test-contact preview branch still works', c2Pass, c2Detail);
+                return [3 /*break*/, 52];
+            case 34:
+                if (!tenant) return [3 /*break*/, 51];
+                sdk = tenant.sdk;
+                _i = 0, enduserIds_1 = enduserIds;
+                _e.label = 35;
+            case 35:
+                if (!(_i < enduserIds_1.length)) return [3 /*break*/, 40];
+                id = enduserIds_1[_i];
+                _e.label = 36;
+            case 36:
+                _e.trys.push([36, 38, , 39]);
+                return [4 /*yield*/, sdk.api.endusers.deleteOne(id)];
+            case 37:
+                _e.sent();
+                return [3 /*break*/, 39];
+            case 38:
+                _b = _e.sent();
+                return [3 /*break*/, 39];
+            case 39:
+                _i++;
+                return [3 /*break*/, 35];
+            case 40:
+                if (!bookingPageId) return [3 /*break*/, 44];
+                _e.label = 41;
+            case 41:
+                _e.trys.push([41, 43, , 44]);
+                return [4 /*yield*/, sdk.api.appointment_booking_pages.deleteOne(bookingPageId)];
+            case 42:
+                _e.sent();
+                return [3 /*break*/, 44];
+            case 43:
+                _c = _e.sent();
+                return [3 /*break*/, 44];
+            case 44:
+                if (!templateId) return [3 /*break*/, 48];
+                _e.label = 45;
+            case 45:
+                _e.trys.push([45, 47, , 48]);
+                return [4 /*yield*/, sdk.api.calendar_event_templates.deleteOne(templateId)];
+            case 46:
+                _e.sent();
+                return [3 /*break*/, 48];
+            case 47:
+                _d = _e.sent();
+                return [3 /*break*/, 48];
+            case 48:
+                _e.trys.push([48, 50, , 51]);
+                return [4 /*yield*/, tenant.teardown()];
+            case 49:
+                _e.sent();
+                return [3 /*break*/, 51];
+            case 50:
+                e_7 = _e.sent();
+                console.error('teardown failed', e_7);
+                return [3 /*break*/, 51];
+            case 51: return [7 /*endfinally*/];
+            case 52: return [2 /*return*/, checks];
+        }
     });
-};
+}); };
+exports.booking_info_idor_checks = booking_info_idor_checks;
+/** Asserting wrapper, for standalone runs. */
+var booking_info_idor_tests = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var _a, _b;
+    return __generator(this, function (_c) {
+        switch (_c.label) {
+            case 0:
+                _a = setup_isolated_1.assert_checks;
+                _b = ['Booking info IDOR token mint'];
+                return [4 /*yield*/, (0, exports.booking_info_idor_checks)()];
+            case 1:
+                _a.apply(void 0, _b.concat([_c.sent()]));
+                return [2 /*return*/];
+        }
+    });
+}); };
 exports.booking_info_idor_tests = booking_info_idor_tests;
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+exports.ISOLATED_SUITE = {
+    name: 'Booking info IDOR token mint',
+    run: exports.booking_info_idor_checks,
+};
 // Allow running this test file independently
 if (require.main === module) {
     console.log("\uD83C\uDF10 Using API URL: ".concat(host));
-    var sdk_2 = new sdk_1.Session({ host: host });
-    var sdkNonAdmin_1 = new sdk_1.Session({ host: host });
-    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
-        return __generator(this, function (_a) {
-            switch (_a.label) {
-                case 0: return [4 /*yield*/, (0, setup_1.setup_tests)(sdk_2, sdkNonAdmin_1)];
-                case 1:
-                    _a.sent();
-                    return [4 /*yield*/, (0, exports.booking_info_idor_tests)({ sdk: sdk_2, sdkNonAdmin: sdkNonAdmin_1 })];
-                case 2:
-                    _a.sent();
-                    return [2 /*return*/];
-            }
-        });
-    }); };
-    runTests()
+    (0, exports.booking_info_idor_tests)()
         .then(function () {
         console.log("✅ booking_info IDOR test suite completed successfully");
         process.exit(0);

package/lib/cjs/tests/api_tests/security/booking-info-idor-token-mint.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"booking-info-idor-token-mint.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/booking-info-idor-token-mint.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,oCAAsD;AACtD,+CAG4B;AAC5B,qCAAyE;AAEzE,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AACpE,IAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,0BAA0B,CAAA;AAE7E,IAAM,IAAI,GAAG,cAAM,OAAA,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAvC,CAAuC,CAAA;AAE1D,IAAM,YAAY,GAAG,IAAI,CAAA;AACzB,IAAM,oBAAoB,GAAG,IAAI,CAAA;AAQjC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACI,IAAM,uBAAuB,GAAG,UAAO,EAAgD;QAA9C,GAAG,SAAA;;;;;;oBACjD,IAAA,oBAAU,EAAC,6EAA6E,CAAC,CAAA;oBAEnF,MAAM,GAAY,EAAE,CAAA;oBACpB,MAAM,GAAG,UAAC,KAAa,EAAE,IAAa,EAAE,MAAc,IAAK,OAAA,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,OAAA,EAAE,IAAI,MAAA,EAAE,MAAM,QAAA,EAAE,CAAC,EAApC,CAAoC,CAAA;oBAI/F,gBAAgB,GAAG,UAAC,UAAkB;;wBAC1C,IAAM,KAAK,GAAG,MAAA,mBAAmB,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,0CAAG,CAAC,CAAC,CAAA;wBAC7D,IAAM,OAAO,GAAG,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;wBACpC,IAAI,CAAC,OAAO;4BAAE,OAAO,EAAE,CAAA;wBACvB,IAAI;4BACF,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAY,CAAA;yBAC1E;wBAAC,WAAM;4BACN,OAAO,EAAE,CAAA;yBACV;oBACH,CAAC,CAAA;oBAEG,UAAU,GAAG,EAAE,CAAA;oBACf,aAAa,GAAG,EAAE,CAAA;oBAChB,UAAU,GAAa,EAAE,CAAA;;;;oBAKZ,qBAAM,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,SAAS,CAAC;4BAChE,KAAK,EAAE,yBAAkB,IAAI,EAAE,CAAE,EAAE,iBAAiB,EAAE,EAAE;yBAClD,CAAC,EAAA;;oBAFH,QAAQ,GAAG,SAER;oBACT,UAAU,GAAG,QAAQ,CAAC,EAAE,CAAA;oBAEJ,qBAAM,GAAG,CAAC,GAAG,CAAC,yBAAyB,CAAC,SAAS,CAAC;4BACpE,KAAK,EAAE,6BAAsB,IAAI,EAAE,CAAE;4BACrC,wBAAwB,EAAE,CAAC,UAAU,CAAC;4BACtC,WAAW,EAAE,EAAE;yBACT,CAAC,EAAA;;oBAJH,WAAW,GAAG,SAIX;oBACT,aAAa,GAAG,WAAW,CAAC,EAAE,CAAA;oBAEb,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;4BAChD,KAAK,EAAE,yBAAkB,IAAI,EAAE,wBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU;yBACxF,CAAC,EAAA;;oBAFI,QAAQ,GAAG,SAEf;oBACF,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;oBAEb,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;4BAC9C,KAAK,EAAE,uBAAgB,IAAI,EAAE,wBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ;4BACnF,KAAK,EAAE,YAAY;yBACpB,CAAC,EAAA;;oBAHI,MAAM,GAAG,SAGb;oBACF,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;oBAIpB,WAAW,GAAG,IAAI,oBAAc,CAAC,EAAE,IAAI,MAAA,EAAE,UAAU,YAAA,EAAE,CAAC,CAAA;oBAC5D,qBAAM,IAAA,sCAA8B,EAAC,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;wBAE3E,qFAAqF;sBAFV;;oBAA3E,SAA2E,CAAA;oBAIvE,QAAQ,GAAG,EAAE,CAAA;oBACb,MAAM,GAAG,KAAK,CAAA;;;;oBAEN,qBAAM,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,aAAa,eAAA,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,EAAA;;oBAA3F,CAAC,GAAG,SAAuF;oBAC3F,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;oBAChD,QAAQ,GAAG,CACT,0DAAmD,SAAS,MAAG;0BAC7D,kBAAW,MAAM,CAAC,EAAE,wBAAc,QAAQ,CAAC,EAAE,MAAG;0BAChD,CAAC,SAAS,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,qDAAqD,CAAC,CAAC,CAAC,EAAE,CAAC,CACzF,CAAA;;;;oBAED,MAAM,GAAG,IAAI,CAAA;oBACb,QAAQ,GAAG,oBAAa,CAAA,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,OAAO,MAAI,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,QAAQ,EAAE,CAAA,CAAE,CAAA;;;oBAEvD,MAAM,CAAC,6DAA6D,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;oBAGnF,SAAS,GAAG,EAAE,CAAA;;;;oBAEhB,qBAAM,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC;4BAC7C,aAAa,eAAA;4BAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE;yBACpF,CAAC,EAAA;;oBAFF,SAEE,CAAA;oBACF,SAAS,GAAG,mBAAmB,CAAA;;;;oBAE/B,SAAS,GAAG,yBAAkB,CAAA,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,OAAO,MAAI,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,QAAQ,EAAE,CAAA,CAAE,CAAA;;yBAEzC,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAA;;oBAAtD,WAAW,GAAG,SAAwC;oBAC5D,MAAM,CACJ,yEAAyE,EACzE,WAAW,CAAC,KAAK,KAAK,YAAY,EAClC,UAAG,SAAS,4BAAkB,WAAW,CAAC,KAAK,wBAAc,YAAY,MAAG,CAC7E,CAAA;oBAIG,QAAQ,GAAG,EAAE,CAAA;oBACb,MAAM,GAAG,KAAK,CAAA;;;;oBAEN,qBAAM,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,aAAa,eAAA,EAAE,CAAC,EAAA;;oBAArE,CAAC,GAAG,SAAiE;oBACrE,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;oBAChD,MAAM,GAAG,SAAS,KAAK,QAAQ,CAAC,EAAE,CAAA;oBAClC,QAAQ,GAAG,wBAAiB,SAAS,oBAAU,QAAQ,CAAC,EAAE,MAAG,CAAA;;;;oBAE7D,QAAQ,GAAG,iCAA0B,CAAA,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,OAAO,MAAI,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,QAAQ,EAAE,CAAA,CAAE,CAAA;;;oBAEpE,MAAM,CAAC,2DAA2D,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;oBAEjF,QAAQ,GAAG,EAAE,CAAA;oBACb,MAAM,GAAG,KAAK,CAAA;;;;oBAEN,qBAAM,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,aAAa,eAAA,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,EAAA;;oBAA7F,CAAC,GAAG,SAAyF;oBAC7F,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;oBAChD,MAAM,GAAG,SAAS,KAAK,QAAQ,CAAC,EAAE,CAAA;oBAClC,QAAQ,GAAG,wBAAiB,SAAS,oBAAU,QAAQ,CAAC,EAAE,MAAG,CAAA;;;;oBAE7D,QAAQ,GAAG,iCAA0B,CAAA,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,OAAO,MAAI,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,QAAQ,EAAE,CAAA,CAAE,CAAA;;;oBAEpE,MAAM,CAAC,+DAA+D,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;oBAIrF,QAAQ,GAAG,EAAE,CAAA;oBACb,MAAM,GAAG,KAAK,CAAA;;;;oBAEN,qBAAM,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,aAAa,eAAA,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,EAAA;;oBAAnF,CAAC,GAAG,SAA+E;oBACnF,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;oBAChD,MAAM,GAAG,SAAS,KAAK,MAAM,CAAC,EAAE,CAAA;oBAChC,QAAQ,GAAG,wBAAiB,SAAS,sBAAY,MAAM,CAAC,EAAE,MAAG,CAAA;;;;oBAE7D,QAAQ,GAAG,iCAA0B,CAAA,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,OAAO,MAAI,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,QAAQ,EAAE,CAAA,CAAE,CAAA;;;oBAEpE,MAAM,CAAC,8DAA8D,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;oBAEpF,QAAQ,GAAG,EAAE,CAAA;oBACb,MAAM,GAAG,KAAK,CAAA;;;;oBAEN,qBAAM,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,aAAa,eAAA,EAAE,CAAC,EAAA;;oBAA7D,CAAC,GAAG,SAAyD;oBACnE,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAA;oBAC7C,QAAQ,GAAG,yBAAkB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,yBAAe,CAAC,CAAC,CAAC,CAAC,UAAU,CAAE,CAAA;;;;oBAE5F,QAAQ,GAAG,iCAA0B,CAAA,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,OAAO,MAAI,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,QAAQ,EAAE,CAAA,CAAE,CAAA;;;oBAEpE,MAAM,CAAC,mDAAmD,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;oBAE7E,8FAA8F;oBAC9F,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;oBACjC,WAAsB,EAAN,iBAAM,EAAN,oBAAM,EAAN,IAAM,EAAE;wBAAb,CAAC;wBACV,OAAO,CAAC,GAAG,CAAC,cAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,eAAK,CAAC,CAAC,KAAK,uBAAQ,CAAC,CAAC,MAAM,CAAE,CAAC,CAAA;qBAC3E;oBACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;oBAEf,WAAsB,EAAN,iBAAM,EAAN,oBAAM,EAAN,IAAM,EAAE;wBAAb,CAAC;wBACV,IAAA,gBAAM,EAAC,CAAC,CAAC,IAAI,EAAE,UAAG,CAAC,CAAC,KAAK,qBAAM,CAAC,CAAC,MAAM,CAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAA;qBACpD;;;0BAE0B,EAAV,yBAAU;;;yBAAV,CAAA,wBAAU,CAAA;oBAAhB,EAAE;;;;oBAAwB,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,EAAA;;oBAApC,SAAoC,CAAA;;;;;;oBAAxD,IAAU,CAAA;;;yBACvB,aAAa,EAAb,yBAAa;;;;oBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,yBAAyB,CAAC,SAAS,CAAC,aAAa,CAAC,EAAA;;oBAAhE,SAAgE,CAAA;;;;;;yBACvF,UAAU,EAAV,yBAAU;;;;oBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,SAAS,CAAC,UAAU,CAAC,EAAA;;oBAA5D,SAA4D,CAAA;;;;;;;;;;CAEvF,CAAA;AA3JY,QAAA,uBAAuB,2BA2JnC;AAED,6CAA6C;AAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAM,KAAG,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACjC,IAAM,aAAW,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IAEzC,IAAM,QAAQ,GAAG;;;wBACf,qBAAM,IAAA,mBAAW,EAAC,KAAG,EAAE,aAAW,CAAC,EAAA;;oBAAnC,SAAmC,CAAA;oBACnC,qBAAM,IAAA,+BAAuB,EAAC,EAAE,GAAG,OAAA,EAAE,WAAW,eAAA,EAAE,CAAC,EAAA;;oBAAnD,SAAmD,CAAA;;;;SACpD,CAAA;IAED,QAAQ,EAAE;SACP,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAA;QACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAA;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}
+{"version":3,"file":"booking-info-idor-token-mint.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/booking-info-idor-token-mint.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,oCAA6C;AAC7C,uDAK6B;AAE7B,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE,IAAM,IAAI,GAAG,cAAM,OAAA,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAvC,CAAuC,CAAA;AAE1D,IAAM,YAAY,GAAG,IAAI,CAAA;AACzB,IAAM,oBAAoB,GAAG,IAAI,CAAA;AAEjC;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACI,IAAM,wBAAwB,GAAG;;;;;gBAChC,MAAM,GAAY,EAAE,CAAA;gBACpB,MAAM,GAAG,UAAC,KAAa,EAAE,IAAa,EAAE,MAAc,IAAK,OAAA,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,OAAA,EAAE,IAAI,MAAA,EAAE,MAAM,QAAA,EAAE,CAAC,EAApC,CAAoC,CAAA;gBAI/F,gBAAgB,GAAG,UAAC,UAAkB;;oBAC1C,IAAM,KAAK,GAAG,MAAA,mBAAmB,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,0CAAG,CAAC,CAAC,CAAA;oBAC7D,IAAM,OAAO,GAAG,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;oBACpC,IAAI,CAAC,OAAO;wBAAE,OAAO,EAAE,CAAA;oBACvB,IAAI;wBACF,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAY,CAAA;qBAC1E;oBAAC,WAAM;wBACN,OAAO,EAAE,CAAA;qBACV;gBACH,CAAC,CAAA;gBAGG,UAAU,GAAG,EAAE,CAAA;gBACf,aAAa,GAAG,EAAE,CAAA;gBAChB,UAAU,GAAa,EAAE,CAAA;;;;gBAGpB,qBAAM,IAAA,sCAAqB,EAAC;wBACnC,IAAI,EAAE,uCAAgC,IAAI,EAAE,CAAE;wBAC9C,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;wBAC1B,OAAO,EAAE,CAAC;qBACX,CAAC,EAAA;;gBAJF,MAAM,GAAG,SAIP,CAAA;gBACM,GAAG,GAAK,MAAM,IAAX,CAAW;gBAIL,qBAAM,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,SAAS,CAAC;wBAChE,KAAK,EAAE,yBAAkB,IAAI,EAAE,CAAE,EAAE,iBAAiB,EAAE,EAAE;qBAClD,CAAC,EAAA;;gBAFH,QAAQ,GAAG,SAER;gBACT,UAAU,GAAG,QAAQ,CAAC,EAAE,CAAA;gBAEJ,qBAAM,GAAG,CAAC,GAAG,CAAC,yBAAyB,CAAC,SAAS,CAAC;wBACpE,KAAK,EAAE,6BAAsB,IAAI,EAAE,CAAE;wBACrC,wBAAwB,EAAE,CAAC,UAAU,CAAC;wBACtC,WAAW,EAAE,EAAE;qBACT,CAAC,EAAA;;gBAJH,WAAW,GAAG,SAIX;gBACT,aAAa,GAAG,WAAW,CAAC,EAAE,CAAA;gBAEb,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;wBAChD,KAAK,EAAE,yBAAkB,IAAI,EAAE,wBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU;qBACxF,CAAC,EAAA;;gBAFI,QAAQ,GAAG,SAEf;gBACF,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;gBAEb,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;wBAC9C,KAAK,EAAE,uBAAgB,IAAI,EAAE,wBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ;wBACnF,KAAK,EAAE,YAAY;qBACpB,CAAC,EAAA;;gBAHI,MAAM,GAAG,SAGb;gBACF,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;gBAMpB,WAAW,GAAG,IAAI,oBAAc,CAAC,EAAE,IAAI,MAAA,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAA;gBAE7E,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,EAAA;;gBAD3D,KAA0D,CAC9D,SAA+D,CAChE,EAFkB,iBAAiB,eAAA,EAAW,YAAY,aAAA;gBAG3D,qBAAM,WAAW,CAAC,kBAAkB,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;oBAE7F,qFAAqF;kBAFQ;;gBAA7F,SAA6F,CAAA;gBAIzF,QAAQ,GAAG,EAAE,CAAA;gBACb,MAAM,GAAG,KAAK,CAAA;;;;gBAEN,qBAAM,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,aAAa,eAAA,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,EAAA;;gBAA3F,CAAC,GAAG,SAAuF;gBAC3F,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;gBAChD,QAAQ,GAAG,CACT,0DAAmD,SAAS,MAAG;sBAC7D,kBAAW,MAAM,CAAC,EAAE,wBAAc,QAAQ,CAAC,EAAE,MAAG;sBAChD,CAAC,SAAS,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,qDAAqD,CAAC,CAAC,CAAC,EAAE,CAAC,CACzF,CAAA;;;;gBAED,MAAM,GAAG,IAAI,CAAA;gBACb,QAAQ,GAAG,oBAAa,CAAA,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,OAAO,MAAI,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,QAAQ,EAAE,CAAA,CAAE,CAAA;;;gBAEvD,MAAM,CAAC,6DAA6D,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;gBAGnF,SAAS,GAAG,EAAE,CAAA;;;;gBAEhB,qBAAM,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC;wBAC7C,aAAa,eAAA;wBAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE;qBACpF,CAAC,EAAA;;gBAFF,SAEE,CAAA;gBACF,SAAS,GAAG,mBAAmB,CAAA;;;;gBAE/B,SAAS,GAAG,yBAAkB,CAAA,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,OAAO,MAAI,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,QAAQ,EAAE,CAAA,CAAE,CAAA;;qBAEzC,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAA;;gBAAtD,WAAW,GAAG,SAAwC;gBAC5D,MAAM,CACJ,yEAAyE,EACzE,WAAW,CAAC,KAAK,KAAK,YAAY,EAClC,UAAG,SAAS,4BAAkB,WAAW,CAAC,KAAK,wBAAc,YAAY,MAAG,CAC7E,CAAA;gBAIG,QAAQ,GAAG,EAAE,CAAA;gBACb,MAAM,GAAG,KAAK,CAAA;;;;gBAEN,qBAAM,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,aAAa,eAAA,EAAE,CAAC,EAAA;;gBAArE,CAAC,GAAG,SAAiE;gBACrE,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;gBAChD,MAAM,GAAG,SAAS,KAAK,QAAQ,CAAC,EAAE,CAAA;gBAClC,QAAQ,GAAG,wBAAiB,SAAS,oBAAU,QAAQ,CAAC,EAAE,MAAG,CAAA;;;;gBAE7D,QAAQ,GAAG,iCAA0B,CAAA,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,OAAO,MAAI,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,QAAQ,EAAE,CAAA,CAAE,CAAA;;;gBAEpE,MAAM,CAAC,2DAA2D,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;gBAEjF,QAAQ,GAAG,EAAE,CAAA;gBACb,MAAM,GAAG,KAAK,CAAA;;;;gBAEN,qBAAM,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,aAAa,eAAA,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,EAAA;;gBAA7F,CAAC,GAAG,SAAyF;gBAC7F,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;gBAChD,MAAM,GAAG,SAAS,KAAK,QAAQ,CAAC,EAAE,CAAA;gBAClC,QAAQ,GAAG,wBAAiB,SAAS,oBAAU,QAAQ,CAAC,EAAE,MAAG,CAAA;;;;gBAE7D,QAAQ,GAAG,iCAA0B,CAAA,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,OAAO,MAAI,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,QAAQ,EAAE,CAAA,CAAE,CAAA;;;gBAEpE,MAAM,CAAC,+DAA+D,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;gBAIrF,QAAQ,GAAG,EAAE,CAAA;gBACb,MAAM,GAAG,KAAK,CAAA;;;;gBAEN,qBAAM,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,aAAa,eAAA,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,EAAA;;gBAAnF,CAAC,GAAG,SAA+E;gBACnF,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;gBAChD,MAAM,GAAG,SAAS,KAAK,MAAM,CAAC,EAAE,CAAA;gBAChC,QAAQ,GAAG,wBAAiB,SAAS,sBAAY,MAAM,CAAC,EAAE,MAAG,CAAA;;;;gBAE7D,QAAQ,GAAG,iCAA0B,CAAA,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,OAAO,MAAI,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,QAAQ,EAAE,CAAA,CAAE,CAAA;;;gBAEpE,MAAM,CAAC,8DAA8D,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;gBAEpF,QAAQ,GAAG,EAAE,CAAA;gBACb,MAAM,GAAG,KAAK,CAAA;;;;gBAEN,qBAAM,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,aAAa,eAAA,EAAE,CAAC,EAAA;;gBAA7D,CAAC,GAAG,SAAyD;gBACnE,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAA;gBAC7C,QAAQ,GAAG,yBAAkB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,yBAAe,CAAC,CAAC,CAAC,CAAC,UAAU,CAAE,CAAA;;;;gBAE5F,QAAQ,GAAG,iCAA0B,CAAA,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,OAAO,MAAI,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,QAAQ,EAAE,CAAA,CAAE,CAAA;;;gBAEpE,MAAM,CAAC,mDAAmD,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;;;qBAEzE,MAAM,EAAN,yBAAM;gBACA,GAAG,GAAK,MAAM,IAAX,CAAW;sBACK,EAAV,yBAAU;;;qBAAV,CAAA,wBAAU,CAAA;gBAAhB,EAAE;;;;gBAAwB,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,EAAA;;gBAApC,SAAoC,CAAA;;;;;;gBAAxD,IAAU,CAAA;;;qBACvB,aAAa,EAAb,yBAAa;;;;gBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,yBAAyB,CAAC,SAAS,CAAC,aAAa,CAAC,EAAA;;gBAAhE,SAAgE,CAAA;;;;;;qBACvF,UAAU,EAAV,yBAAU;;;;gBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,SAAS,CAAC,UAAU,CAAC,EAAA;;gBAA5D,SAA4D,CAAA;;;;;;;gBAE9E,qBAAM,MAAM,CAAC,QAAQ,EAAE,EAAA;;gBAAvB,SAAuB,CAAA;;;;gBAAe,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,GAAC,CAAC,CAAA;;;qBAInF,sBAAO,MAAM,EAAA;;;KACd,CAAA;AAlKY,QAAA,wBAAwB,4BAkKpC;AAED,8CAA8C;AACvC,IAAM,uBAAuB,GAAG;;;;;gBACrC,KAAA,8BAAa,CAAA;sBAAC,8BAA8B;gBAAE,qBAAM,IAAA,gCAAwB,GAAE,EAAA;;gBAA9E,4BAA8C,SAAgC,GAAC,CAAA;;;;KAChF,CAAA;AAFY,QAAA,uBAAuB,2BAEnC;AAED,oGAAoG;AACvF,QAAA,cAAc,GAAkB;IAC3C,IAAI,EAAE,8BAA8B;IACpC,GAAG,EAAE,gCAAwB;CAC9B,CAAA;AAED,6CAA6C;AAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAA,+BAAuB,GAAE;SACtB,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAA;QACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAA;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}