@tellescope/sdk 2.0.0-beta.2 → 2.0.0-beta.3

package/lib/cjs/tests/api_tests/security/register_business_id_injection.test.js

@@ -39,37 +39,52 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.register_business_id_injection_tests = void 0;
+exports.ISOLATED_SUITE = exports.register_business_id_injection_tests = exports.register_business_id_injection_checks = void 0;
 require('source-map-support').install();
 var axios_1 = __importDefault(require("axios"));
-var sdk_1 = require("../../../sdk");
 var testing_1 = require("@tellescope/testing");
-var setup_1 = require("../../setup");
+var setup_isolated_1 = require("../../setup_isolated");
 var host = process.env.API_URL || 'http://localhost:8080';
-var post = function (path, body, headers) {
-    if (headers === void 0) { headers = {}; }
-    return __awaiter(void 0, void 0, void 0, function () {
-        var res, err_1;
-        var _a, _b;
-        return __generator(this, function (_c) {
-            switch (_c.label) {
-                case 0:
-                    _c.trys.push([0, 2, , 3]);
-                    return [4 /*yield*/, axios_1.default.post("".concat(host).concat(path), body, {
-                            validateStatus: function () { return true; },
-                            headers: headers,
-                        })];
-                case 1:
-                    res = _c.sent();
-                    return [2 /*return*/, { status: res.status, data: res.data }];
-                case 2:
-                    err_1 = _c.sent();
-                    return [2 /*return*/, { status: (_a = err_1 === null || err_1 === void 0 ? void 0 : err_1.response) === null || _a === void 0 ? void 0 : _a.status, data: (_b = err_1 === null || err_1 === void 0 ? void 0 : err_1.response) === null || _b === void 0 ? void 0 : _b.data }];
-                case 3: return [2 /*return*/];
-            }
-        });
+var RAND = function () { return Math.random().toString(36).slice(2, 10); };
+/**
+ * POST /v1/users/register, retrying a 429.
+ *
+ * The endpoint is throttled at roughly 1/sec on a `user-register-<ip>` namespace that no tenant
+ * teardown clears and that every concurrently running suite shares, so a 429 here is contention
+ * between suites, not a result. (Deliberately a local copy of organization_signup.test.ts's helper
+ * rather than a shared export: the two suites stay uncoupled.)
+ */
+var register_request = function (data) { return __awaiter(void 0, void 0, void 0, function () {
+    var send, result, attempt;
+    return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0:
+                send = function () { return axios_1.default.request({
+                    method: 'post', url: "".concat(host, "/v1/users/register"),
+                    data: data,
+                    validateStatus: function () { return true; },
+                }); };
+                return [4 /*yield*/, send()];
+            case 1:
+                result = _a.sent();
+                attempt = 0;
+                _a.label = 2;
+            case 2:
+                if (!(attempt < 5 && result.status === 429)) return [3 /*break*/, 6];
+                return [4 /*yield*/, (0, testing_1.wait)(undefined, 1200)];
+            case 3:
+                _a.sent();
+                return [4 /*yield*/, send()];
+            case 4:
+                result = _a.sent();
+                _a.label = 5;
+            case 5:
+                attempt++;
+                return [3 /*break*/, 2];
+            case 6: return [2 /*return*/, result];
+        }
     });
-};
+}); };
 /**
  * Reproduction + regression test for the reported vulnerability:
  *
@@ -83,114 +98,139 @@ var post = function (path, body, headers) {
  * caller-supplied businessId onto a new `accountType: 'Business'` user — bypassing the
  * globalUnique: ['email'] enforcement that only runs in the generic create route.
  *
- * The "victim org" here is the test admin's own org (sdk.userInfo.businessId): an org the
- * anonymous caller was never invited to. The admin is used purely to OBSERVE whether an
- * uninvited user record materialized inside their org (getOne({ email }) is org-scoped and
- * throws when the email is absent from the caller's tenant).
+ * The "victim org" is this suite's OWN provisioned tenant (tenant.businessId): an org the
+ * anonymous caller was never invited to. Its admin is used purely to OBSERVE whether an uninvited
+ * user record materialized inside the org (getOne({ email }) is org-scoped and throws when the
+ * email is absent from the caller's tenant). Running on a throwaway tenant rather than the shared
+ * fixture means a failing (vulnerable) run plants its user in an org that is then torn down.
  *
  * Expected results:
- *   - VULNERABLE code: the assertions FAIL — the planted user appears inside the victim org,
- *     proving the exploit ("EXPLOIT CONFIRMED" in the failure message).
+ *   - VULNERABLE code: the checks FAIL — the planted user appears inside the victim org,
+ *     proving the exploit ("EXPLOIT CONFIRMED" in the failure detail).
  *   - FIXED code: register ignores the caller-supplied businessId (self-signups are created
  *     org-less and duplicates are rejected globally), so nothing appears in the victim org and
- *     the assertions PASS.
+ *     the checks PASS.
  *
- * Uses unique emails per run (Date.now()) so re-runs never collide on the platform-wide unique
- * email constraint. NOTE: on the FIXED path these registrations create org-less user records
- * that an org-scoped admin cannot delete — harmless residue (unique emails), inherent to the
- * legitimate "root register, no org" signup behavior.
+ * Uses unique emails per run so re-runs never collide on the platform-wide unique email
+ * constraint. NOTE: on the FIXED path these registrations create org-less user records that
+ * neither an org-scoped admin nor the tenant teardown (which deletes by businessId) can remove —
+ * harmless residue (unique emails), inherent to the legitimate "root register, no org" signup.
  */
-var register_business_id_injection_tests = function (_a) {
-    var sdk = _a.sdk;
-    return __awaiter(void 0, void 0, void 0, function () {
-        var victimBusinessId, password, termsVersion, email1, before, res1, planted1, injectedIntoVictimOrg, email2, resRoot, resDup, planted2, duplicateInVictimOrg;
-        return __generator(this, function (_b) {
-            switch (_b.label) {
-                case 0:
-                    (0, testing_1.log_header)("register businessId injection");
-                    victimBusinessId = sdk.userInfo.businessId;
-                    password = 'testpassword123!';
-                    termsVersion = '1';
-                    email1 = "dontsend+reg-inject-".concat(Date.now(), "@tellescope.com");
-                    return [4 /*yield*/, sdk.api.users.getOne({ email: email1 }).catch(function () { return null; })];
-                case 1:
-                    before = _b.sent();
-                    (0, testing_1.assert)(before === null, "precondition failed: ".concat(email1, " already present in victim org"), 'precondition: victim org has no such user');
-                    return [4 /*yield*/, post('/v1/users/register', { email: email1, password: password, termsVersion: termsVersion, businessId: victimBusinessId })];
-                case 2:
-                    res1 = _b.sent();
-                    console.log("   register(businessId=victim) -> HTTP ".concat(res1.status));
-                    return [4 /*yield*/, sdk.api.users.getOne({ email: email1 }).catch(function () { return null; })];
-                case 3:
-                    planted1 = _b.sent();
-                    injectedIntoVictimOrg = !!planted1 && planted1.businessId === victimBusinessId;
-                    if (!(planted1 === null || planted1 === void 0 ? void 0 : planted1.id)) return [3 /*break*/, 5];
-                    return [4 /*yield*/, sdk.api.users.deleteOne(planted1.id).catch(function () { })];
-                case 4:
-                    _b.sent();
-                    _b.label = 5;
-                case 5:
-                    (0, testing_1.assert)(!injectedIntoVictimOrg, "\u274C EXPLOIT CONFIRMED: anonymous POST /v1/users/register with businessId=".concat(victimBusinessId, " created user ")
-                        + "".concat(email1, " (accountType=").concat(planted1 === null || planted1 === void 0 ? void 0 : planted1.accountType, ") inside the victim org \u2014 no invite required"), '✅ register ignores caller-supplied businessId — no user injected into victim org');
-                    return [4 /*yield*/, (0, testing_1.wait)(undefined, 1200)
-                        // ==================================================================================
-                        // Scenario 2 — cross-org duplicate for the same email
-                        // First register with NO businessId (the legitimate "root register, no org" record —
-                        // the "oldest" account in the report). Then register the SAME email WITH the victim
-                        // businessId. On vulnerable code the scoped duplicate check misses the org-less record,
-                        // so a SECOND user record for the same email is created inside the victim org.
-                        // ==================================================================================
-                    ]; // register endpoint rate-limits ~1/sec per IP
-                case 6:
-                    _b.sent(); // register endpoint rate-limits ~1/sec per IP
-                    email2 = "dontsend+reg-dup-".concat(Date.now(), "@tellescope.com");
-                    return [4 /*yield*/, post('/v1/users/register', { email: email2, password: password, termsVersion: termsVersion })];
-                case 7:
-                    resRoot = _b.sent();
-                    console.log("   register(no businessId) -> HTTP ".concat(resRoot.status));
-                    return [4 /*yield*/, (0, testing_1.wait)(undefined, 1200)];
-                case 8:
-                    _b.sent();
-                    return [4 /*yield*/, post('/v1/users/register', { email: email2, password: password, termsVersion: termsVersion, businessId: victimBusinessId })];
-                case 9:
-                    resDup = _b.sent();
-                    console.log("   register(same email, businessId=victim) -> HTTP ".concat(resDup.status));
-                    return [4 /*yield*/, sdk.api.users.getOne({ email: email2 }).catch(function () { return null; })];
-                case 10:
-                    planted2 = _b.sent();
-                    duplicateInVictimOrg = !!planted2 && planted2.businessId === victimBusinessId;
-                    if (!(planted2 === null || planted2 === void 0 ? void 0 : planted2.id)) return [3 /*break*/, 12];
-                    return [4 /*yield*/, sdk.api.users.deleteOne(planted2.id).catch(function () { })];
-                case 11:
-                    _b.sent();
-                    _b.label = 12;
-                case 12:
-                    (0, testing_1.assert)(!duplicateInVictimOrg, "\u274C EXPLOIT CONFIRMED: same email ".concat(email2, " registered into a second org \u2014 duplicate user ")
-                        + "(accountType=".concat(planted2 === null || planted2 === void 0 ? void 0 : planted2.accountType, ") created in victim org ").concat(victimBusinessId), '✅ register enforces global email uniqueness — no cross-org duplicate created');
-                    return [2 /*return*/];
-            }
-        });
+var register_business_id_injection_checks = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var checks, record, tenant, sdk, victimBusinessId, password, termsVersion, email1, before, res1, planted1, injectedIntoVictimOrg, email2, resRoot, resDup, planted2, duplicateInVictimOrg, e_1;
+    return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0:
+                checks = [];
+                record = function (label, pass, detail) { return checks.push({ label: label, pass: pass, detail: detail }); };
+                _a.label = 1;
+            case 1:
+                _a.trys.push([1, , 11, 16]);
+                return [4 /*yield*/, (0, setup_isolated_1.setup_isolated_tenant)({
+                        name: "register businessId injection ".concat(RAND()),
+                        users: [{ isAdmin: true }],
+                        apiKeys: 0,
+                    })];
+            case 2:
+                tenant = _a.sent();
+                sdk = tenant.sdk;
+                victimBusinessId = tenant.businessId;
+                password = 'testpassword123!';
+                termsVersion = '1';
+                email1 = "dontsend+reg-inject-".concat(Date.now(), "-").concat(RAND(), "@tellescope.com");
+                return [4 /*yield*/, sdk.api.users.getOne({ email: email1 }).catch(function () { return null; })];
+            case 3:
+                before = _a.sent();
+                record('precondition: victim org has no such user', before === null, before === null ? "".concat(email1, " absent from the victim org") : "precondition failed: ".concat(email1, " already present in victim org"));
+                return [4 /*yield*/, register_request({ email: email1, password: password, termsVersion: termsVersion, businessId: victimBusinessId })];
+            case 4:
+                res1 = _a.sent();
+                console.log("   register(businessId=victim) -> HTTP ".concat(res1.status));
+                return [4 /*yield*/, sdk.api.users.getOne({ email: email1 }).catch(function () { return null; })];
+            case 5:
+                planted1 = _a.sent();
+                injectedIntoVictimOrg = !!planted1 && planted1.businessId === victimBusinessId;
+                record('✅ register ignores caller-supplied businessId — no user injected into victim org', !injectedIntoVictimOrg, injectedIntoVictimOrg
+                    ? "\u274C EXPLOIT CONFIRMED: anonymous POST /v1/users/register with businessId=".concat(victimBusinessId, " created user ")
+                        + "".concat(email1, " (accountType=").concat(planted1 === null || planted1 === void 0 ? void 0 : planted1.accountType, ") inside the victim org \u2014 no invite required")
+                    : "register -> HTTP ".concat(res1.status, "; no ").concat(email1, " user inside the victim org"));
+                return [4 /*yield*/, (0, testing_1.wait)(undefined, 1200)
+                    // ==================================================================================
+                    // Scenario 2 — cross-org duplicate for the same email
+                    // First register with NO businessId (the legitimate "root register, no org" record —
+                    // the "oldest" account in the report). Then register the SAME email WITH the victim
+                    // businessId. On vulnerable code the scoped duplicate check misses the org-less record,
+                    // so a SECOND user record for the same email is created inside the victim org.
+                    // ==================================================================================
+                ]; // register endpoint rate-limits ~1/sec per IP
+            case 6:
+                _a.sent(); // register endpoint rate-limits ~1/sec per IP
+                email2 = "dontsend+reg-dup-".concat(Date.now(), "-").concat(RAND(), "@tellescope.com");
+                return [4 /*yield*/, register_request({ email: email2, password: password, termsVersion: termsVersion })];
+            case 7:
+                resRoot = _a.sent();
+                console.log("   register(no businessId) -> HTTP ".concat(resRoot.status));
+                return [4 /*yield*/, (0, testing_1.wait)(undefined, 1200)];
+            case 8:
+                _a.sent();
+                return [4 /*yield*/, register_request({ email: email2, password: password, termsVersion: termsVersion, businessId: victimBusinessId })];
+            case 9:
+                resDup = _a.sent();
+                console.log("   register(same email, businessId=victim) -> HTTP ".concat(resDup.status));
+                return [4 /*yield*/, sdk.api.users.getOne({ email: email2 }).catch(function () { return null; })];
+            case 10:
+                planted2 = _a.sent();
+                duplicateInVictimOrg = !!planted2 && planted2.businessId === victimBusinessId;
+                record('✅ register enforces global email uniqueness — no cross-org duplicate created', !duplicateInVictimOrg, duplicateInVictimOrg
+                    ? "\u274C EXPLOIT CONFIRMED: same email ".concat(email2, " registered into a second org \u2014 duplicate user ")
+                        + "(accountType=".concat(planted2 === null || planted2 === void 0 ? void 0 : planted2.accountType, ") created in victim org ").concat(victimBusinessId)
+                    : "register(no org) -> HTTP ".concat(resRoot.status, ", register(businessId=victim) -> HTTP ").concat(resDup.status, "; ")
+                        + "no ".concat(email2, " user inside the victim org"));
+                return [3 /*break*/, 16];
+            case 11:
+                if (!tenant) return [3 /*break*/, 15];
+                _a.label = 12;
+            case 12:
+                _a.trys.push([12, 14, , 15]);
+                return [4 /*yield*/, tenant.teardown()];
+            case 13:
+                _a.sent();
+                return [3 /*break*/, 15];
+            case 14:
+                e_1 = _a.sent();
+                console.error('teardown failed', e_1);
+                return [3 /*break*/, 15];
+            case 15: return [7 /*endfinally*/];
+            case 16: return [2 /*return*/, checks];
+        }
     });
-};
+}); };
+exports.register_business_id_injection_checks = register_business_id_injection_checks;
+/** Asserting wrapper, for standalone runs. */
+var register_business_id_injection_tests = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var _a, _b;
+    return __generator(this, function (_c) {
+        switch (_c.label) {
+            case 0:
+                _a = setup_isolated_1.assert_checks;
+                _b = ['register businessId injection'];
+                return [4 /*yield*/, (0, exports.register_business_id_injection_checks)()];
+            case 1:
+                _a.apply(void 0, _b.concat([_c.sent()]));
+                return [2 /*return*/];
+        }
+    });
+}); };
 exports.register_business_id_injection_tests = register_business_id_injection_tests;
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+exports.ISOLATED_SUITE = {
+    name: 'register businessId injection',
+    run: exports.register_business_id_injection_checks,
+};
 // Allow running this test file independently
 if (require.main === module) {
-    var sdk_2 = new sdk_1.Session({ host: host });
-    var sdkNonAdmin_1 = new sdk_1.Session({ host: host });
-    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
-        return __generator(this, function (_a) {
-            switch (_a.label) {
-                case 0: return [4 /*yield*/, (0, setup_1.setup_tests)(sdk_2, sdkNonAdmin_1)];
-                case 1:
-                    _a.sent();
-                    return [4 /*yield*/, (0, exports.register_business_id_injection_tests)({ sdk: sdk_2, sdkNonAdmin: sdkNonAdmin_1 })];
-                case 2:
-                    _a.sent();
-                    return [2 /*return*/];
-            }
-        });
-    }); };
-    runTests()
+    console.log("\uD83C\uDF10 Using API URL: ".concat(host));
+    (0, exports.register_business_id_injection_tests)()
         .then(function () {
         console.log("✅ register businessId injection test suite completed successfully");
         process.exit(0);

package/lib/cjs/tests/api_tests/security/register_business_id_injection.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"register_business_id_injection.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/register_business_id_injection.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,gDAAyB;AACzB,oCAAsC;AACtC,+CAI4B;AAC5B,qCAAyC;AAEzC,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE,IAAM,IAAI,GAAG,UAAO,IAAY,EAAE,IAAS,EAAE,OAAoC;IAApC,wBAAA,EAAA,YAAoC;;;;;;;;oBAEjE,qBAAM,eAAK,CAAC,IAAI,CAAC,UAAG,IAAI,SAAG,IAAI,CAAE,EAAE,IAAI,EAAE;4BACnD,cAAc,EAAE,cAAM,OAAA,IAAI,EAAJ,CAAI;4BAC1B,OAAO,SAAA;yBACR,CAAC,EAAA;;oBAHI,GAAG,GAAG,SAGV;oBACF,sBAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAA;;;oBAE7C,sBAAO,EAAE,MAAM,EAAE,MAAA,KAAG,aAAH,KAAG,uBAAH,KAAG,CAAE,QAAQ,0CAAE,MAAM,EAAE,IAAI,EAAE,MAAA,KAAG,aAAH,KAAG,uBAAH,KAAG,CAAE,QAAQ,0CAAE,IAAI,EAAE,EAAA;;;;;CAEtE,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACI,IAAM,oCAAoC,GAAG,UAAO,EAAgD;QAA9C,GAAG,SAAA;;;;;;oBAC9D,IAAA,oBAAU,EAAC,+BAA+B,CAAC,CAAA;oBAErC,gBAAgB,GAAG,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAA;oBAC1C,QAAQ,GAAG,kBAAkB,CAAA;oBAC7B,YAAY,GAAG,GAAG,CAAA;oBAOlB,MAAM,GAAG,8BAAuB,IAAI,CAAC,GAAG,EAAE,oBAAiB,CAAA;oBAElD,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,cAAM,OAAA,IAAI,EAAJ,CAAI,CAAC,EAAA;;oBAAxE,MAAM,GAAG,SAA+D;oBAC9E,IAAA,gBAAM,EAAC,MAAM,KAAK,IAAI,EAAE,+BAAwB,MAAM,mCAAgC,EAAE,2CAA2C,CAAC,CAAA;oBAEvH,qBAAM,IAAI,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,UAAA,EAAE,YAAY,cAAA,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC,EAAA;;oBAAhH,IAAI,GAAG,SAAyG;oBACtH,OAAO,CAAC,GAAG,CAAC,iDAA0C,IAAI,CAAC,MAAM,CAAE,CAAC,CAAA;oBAE9C,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,cAAM,OAAA,IAAI,EAAJ,CAAI,CAAC,EAAA;;oBAA/E,QAAQ,GAAQ,SAA+D;oBAC/E,qBAAqB,GAAG,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,KAAK,gBAAgB,CAAA;yBAGhF,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,EAAE,CAAA,EAAZ,wBAAY;oBAAE,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,cAAO,CAAC,CAAC,EAAA;;oBAA1D,SAA0D,CAAA;;;oBAE5E,IAAA,gBAAM,EACJ,CAAC,qBAAqB,EACtB,sFAA0E,gBAAgB,mBAAgB;0BACtG,UAAG,MAAM,2BAAiB,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,WAAW,sDAA8C,EACjG,kFAAkF,CACnF,CAAA;oBAED,qBAAM,IAAA,cAAI,EAAC,SAAS,EAAE,IAAI,CAAC;wBAE3B,qFAAqF;wBACrF,sDAAsD;wBACtD,qFAAqF;wBACrF,oFAAoF;wBACpF,wFAAwF;wBACxF,+EAA+E;wBAC/E,qFAAqF;sBAR1D,CAAC,8CAA8C;;oBAA1E,SAA2B,CAAA,CAAC,8CAA8C;oBASpE,MAAM,GAAG,2BAAoB,IAAI,CAAC,GAAG,EAAE,oBAAiB,CAAA;oBAE9C,qBAAM,IAAI,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,UAAA,EAAE,YAAY,cAAA,EAAE,CAAC,EAAA;;oBAArF,OAAO,GAAG,SAA2E;oBAC3F,OAAO,CAAC,GAAG,CAAC,6CAAsC,OAAO,CAAC,MAAM,CAAE,CAAC,CAAA;oBAEnE,qBAAM,IAAA,cAAI,EAAC,SAAS,EAAE,IAAI,CAAC,EAAA;;oBAA3B,SAA2B,CAAA;oBAEZ,qBAAM,IAAI,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,UAAA,EAAE,YAAY,cAAA,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC,EAAA;;oBAAlH,MAAM,GAAG,SAAyG;oBACxH,OAAO,CAAC,GAAG,CAAC,6DAAsD,MAAM,CAAC,MAAM,CAAE,CAAC,CAAA;oBAE5D,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,cAAM,OAAA,IAAI,EAAJ,CAAI,CAAC,EAAA;;oBAA/E,QAAQ,GAAQ,SAA+D;oBAC/E,oBAAoB,GAAG,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,KAAK,gBAAgB,CAAA;yBAE/E,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,EAAE,CAAA,EAAZ,yBAAY;oBAAE,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,cAAO,CAAC,CAAC,EAAA;;oBAA1D,SAA0D,CAAA;;;oBAE5E,IAAA,gBAAM,EACJ,CAAC,oBAAoB,EACrB,+CAAmC,MAAM,yDAAiD;0BACtF,uBAAgB,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,WAAW,qCAA2B,gBAAgB,CAAE,EACtF,8EAA8E,CAC/E,CAAA;;;;;CACF,CAAA;AA/DY,QAAA,oCAAoC,wCA+DhD;AAED,6CAA6C;AAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,IAAM,KAAG,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACjC,IAAM,aAAW,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IAEzC,IAAM,QAAQ,GAAG;;;wBACf,qBAAM,IAAA,mBAAW,EAAC,KAAG,EAAE,aAAW,CAAC,EAAA;;oBAAnC,SAAmC,CAAA;oBACnC,qBAAM,IAAA,4CAAoC,EAAC,EAAE,GAAG,OAAA,EAAE,WAAW,eAAA,EAAE,CAAC,EAAA;;oBAAhE,SAAgE,CAAA;;;;SACjE,CAAA;IAED,QAAQ,EAAE;SACP,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAA;QAChF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,oDAAoD,EAAE,KAAK,CAAC,CAAA;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}
+{"version":3,"file":"register_business_id_injection.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/register_business_id_injection.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,gDAAyB;AACzB,+CAA0C;AAC1C,uDAK6B;AAE7B,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE,IAAM,IAAI,GAAG,cAAM,OAAA,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAvC,CAAuC,CAAA;AAE1D;;;;;;;GAOG;AACH,IAAM,gBAAgB,GAAG,UAAO,IAAyB;;;;;gBACjD,IAAI,GAAG,cAAM,OAAA,eAAK,CAAC,OAAO,CAAC;oBAC/B,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAG,IAAI,uBAAoB;oBAChD,IAAI,MAAA;oBACJ,cAAc,EAAE,cAAM,OAAA,IAAI,EAAJ,CAAI;iBAC3B,CAAC,EAJiB,CAIjB,CAAA;gBAEW,qBAAM,IAAI,EAAE,EAAA;;gBAArB,MAAM,GAAG,SAAY;gBAChB,OAAO,GAAG,CAAC;;;qBAAE,CAAA,OAAO,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,CAAA;gBACxD,qBAAM,IAAA,cAAI,EAAC,SAAS,EAAE,IAAI,CAAC,EAAA;;gBAA3B,SAA2B,CAAA;gBAClB,qBAAM,IAAI,EAAE,EAAA;;gBAArB,MAAM,GAAG,SAAY,CAAA;;;gBAFqC,OAAO,EAAE,CAAA;;oBAIrE,sBAAO,MAAM,EAAA;;;KACd,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACI,IAAM,qCAAqC,GAAG;;;;;gBAC7C,MAAM,GAAY,EAAE,CAAA;gBACpB,MAAM,GAAG,UAAC,KAAa,EAAE,IAAa,EAAE,MAAc,IAAK,OAAA,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,OAAA,EAAE,IAAI,MAAA,EAAE,MAAM,QAAA,EAAE,CAAC,EAApC,CAAoC,CAAA;;;;gBAK1F,qBAAM,IAAA,sCAAqB,EAAC;wBACnC,IAAI,EAAE,wCAAiC,IAAI,EAAE,CAAE;wBAC/C,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;wBAC1B,OAAO,EAAE,CAAC;qBACX,CAAC,EAAA;;gBAJF,MAAM,GAAG,SAIP,CAAA;gBACM,GAAG,GAAK,MAAM,IAAX,CAAW;gBAEhB,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAA;gBACpC,QAAQ,GAAG,kBAAkB,CAAA;gBAC7B,YAAY,GAAG,GAAG,CAAA;gBAOlB,MAAM,GAAG,8BAAuB,IAAI,CAAC,GAAG,EAAE,cAAI,IAAI,EAAE,oBAAiB,CAAA;gBAE5D,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,cAAM,OAAA,IAAI,EAAJ,CAAI,CAAC,EAAA;;gBAAxE,MAAM,GAAG,SAA+D;gBAC9E,MAAM,CACJ,2CAA2C,EAC3C,MAAM,KAAK,IAAI,EACf,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,UAAG,MAAM,gCAA6B,CAAC,CAAC,CAAC,+BAAwB,MAAM,mCAAgC,CAC1H,CAAA;gBAEY,qBAAM,gBAAgB,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,UAAA,EAAE,YAAY,cAAA,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC,EAAA;;gBAAtG,IAAI,GAAG,SAA+F;gBAC5G,OAAO,CAAC,GAAG,CAAC,iDAA0C,IAAI,CAAC,MAAM,CAAE,CAAC,CAAA;gBAE9C,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,cAAM,OAAA,IAAI,EAAJ,CAAI,CAAC,EAAA;;gBAA/E,QAAQ,GAAQ,SAA+D;gBAC/E,qBAAqB,GAAG,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,KAAK,gBAAgB,CAAA;gBAEpF,MAAM,CACJ,kFAAkF,EAClF,CAAC,qBAAqB,EACtB,qBAAqB;oBACnB,CAAC,CAAC,sFAA0E,gBAAgB,mBAAgB;0BACxG,UAAG,MAAM,2BAAiB,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,WAAW,sDAA8C;oBACjG,CAAC,CAAC,2BAAoB,IAAI,CAAC,MAAM,kBAAQ,MAAM,gCAA6B,CAC/E,CAAA;gBAED,qBAAM,IAAA,cAAI,EAAC,SAAS,EAAE,IAAI,CAAC;oBAE3B,qFAAqF;oBACrF,sDAAsD;oBACtD,qFAAqF;oBACrF,oFAAoF;oBACpF,wFAAwF;oBACxF,+EAA+E;oBAC/E,qFAAqF;kBAR1D,CAAC,8CAA8C;;gBAA1E,SAA2B,CAAA,CAAC,8CAA8C;gBASpE,MAAM,GAAG,2BAAoB,IAAI,CAAC,GAAG,EAAE,cAAI,IAAI,EAAE,oBAAiB,CAAA;gBAExD,qBAAM,gBAAgB,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,UAAA,EAAE,YAAY,cAAA,EAAE,CAAC,EAAA;;gBAA3E,OAAO,GAAG,SAAiE;gBACjF,OAAO,CAAC,GAAG,CAAC,6CAAsC,OAAO,CAAC,MAAM,CAAE,CAAC,CAAA;gBAEnE,qBAAM,IAAA,cAAI,EAAC,SAAS,EAAE,IAAI,CAAC,EAAA;;gBAA3B,SAA2B,CAAA;gBAEZ,qBAAM,gBAAgB,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,UAAA,EAAE,YAAY,cAAA,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC,EAAA;;gBAAxG,MAAM,GAAG,SAA+F;gBAC9G,OAAO,CAAC,GAAG,CAAC,6DAAsD,MAAM,CAAC,MAAM,CAAE,CAAC,CAAA;gBAE5D,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,cAAM,OAAA,IAAI,EAAJ,CAAI,CAAC,EAAA;;gBAA/E,QAAQ,GAAQ,SAA+D;gBAC/E,oBAAoB,GAAG,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,KAAK,gBAAgB,CAAA;gBAEnF,MAAM,CACJ,8EAA8E,EAC9E,CAAC,oBAAoB,EACrB,oBAAoB;oBAClB,CAAC,CAAC,+CAAmC,MAAM,yDAAiD;0BACxF,uBAAgB,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,WAAW,qCAA2B,gBAAgB,CAAE;oBACtF,CAAC,CAAC,mCAA4B,OAAO,CAAC,MAAM,mDAAyC,MAAM,CAAC,MAAM,OAAI;0BAClG,aAAM,MAAM,gCAA6B,CAChD,CAAA;;;qBAGG,MAAM,EAAN,yBAAM;;;;gBAAU,qBAAM,MAAM,CAAC,QAAQ,EAAE,EAAA;;gBAAvB,SAAuB,CAAA;;;;gBAAe,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,GAAC,CAAC,CAAA;;;qBAG/F,sBAAO,MAAM,EAAA;;;KACd,CAAA;AApFY,QAAA,qCAAqC,yCAoFjD;AAED,8CAA8C;AACvC,IAAM,oCAAoC,GAAG;;;;;gBAClD,KAAA,8BAAa,CAAA;sBAAC,+BAA+B;gBAAE,qBAAM,IAAA,6CAAqC,GAAE,EAAA;;gBAA5F,4BAA+C,SAA6C,GAAC,CAAA;;;;KAC9F,CAAA;AAFY,QAAA,oCAAoC,wCAEhD;AAED,oGAAoG;AACvF,QAAA,cAAc,GAAkB;IAC3C,IAAI,EAAE,+BAA+B;IACrC,GAAG,EAAE,6CAAqC;CAC3C,CAAA;AAED,6CAA6C;AAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAA,4CAAoC,GAAE;SACnC,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAA;QAChF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,oDAAoD,EAAE,KAAK,CAAC,CAAA;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}

package/lib/cjs/tests/api_tests/security/sanitize-user-html-with-iframes.test.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitize-user-html-with-iframes.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/sanitize-user-html-with-iframes.test.ts"],"names":[],"mappings":"AA+CA,eAAO,MAAM,qCAAqC,qBAoKjD,CAAA"}
+{"version":3,"file":"sanitize-user-html-with-iframes.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/sanitize-user-html-with-iframes.test.ts"],"names":[],"mappings":"AA+CA,eAAO,MAAM,qCAAqC,qBAmSjD,CAAA"}

package/lib/cjs/tests/api_tests/security/sanitize-user-html-with-iframes.test.js

@@ -35,6 +35,15 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
         if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
     }
 };
+var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
+    if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
+        if (ar || !(i in from)) {
+            if (!ar) ar = Array.prototype.slice.call(from, 0, i);
+            ar[i] = from[i];
+        }
+    }
+    return to.concat(ar || Array.prototype.slice.call(from));
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.sanitize_user_html_with_iframes_tests = void 0;
 var utilities_1 = require("@tellescope/utilities");
@@ -80,8 +89,8 @@ var FORBIDDEN_SANDBOX_TOKENS = [
     'allow-orientation-lock',
 ];
 var sanitize_user_html_with_iframes_tests = function () { return __awaiter(void 0, void 0, void 0, function () {
-    var xssPayloads, _i, xssPayloads_1, _a, name_1, payload, out, badSrcs, _b, badSrcs_1, _c, name_2, src, out, fallback, srcdoc, handlers, yt, _d, FORBIDDEN_SANDBOX_TOKENS_1, token, authorSandbox, emptySandbox, noref, allowAttr, heading, table, list, link, img, dataimg, fmt, shared, adminTemplate, templated, endToEnd;
-    return __generator(this, function (_e) {
+    var xssPayloads, _i, xssPayloads_1, _a, name_1, payload, out, badSrcs, _b, badSrcs_1, _c, name_2, src, out, fallback, srcdoc, handlers, yt, _d, FORBIDDEN_SANDBOX_TOKENS_1, token, authorSandbox, emptySandbox, noref, allowAttr, heading, table, list, link, img, dataimg, fmt, shared, adminTemplate, templated, endToEnd, metaRefreshCases, _e, metaRefreshCases_1, _f, name_3, payload, _g, _h, _j, fnName, fn, out, metaSibling, svgAnimateCases, _k, svgAnimateCases_1, _l, name_4, payload, _m, _o, _p, fnName, fn, out, noscriptCases, _q, noscriptCases_1, _r, name_5, payload, _s, _t, _u, fnName, fn, out, afterNoscript, _v, _w, frag, baseFallback, fallbackAttacks, _x, fallbackAttacks_1, _y, name_6, payload, out, _z, _0, _1, name_7, payload, out;
+    return __generator(this, function (_2) {
         console.log("Running sanitize_user_html_with_iframes XSS regression tests");
         xssPayloads = [
             ['img onerror', "<img src=x onerror=\"alert(document.domain)\">"],
@@ -232,6 +241,117 @@ var sanitize_user_html_with_iframes_tests = function () { return __awaiter(void
             fail("patient markup not escaped to inert text: ".concat(endToEnd));
         if ((endToEnd.toLowerCase().match(/<iframe/g) || []).length !== 1)
             fail("patient-injected iframe became a live frame: ".concat(endToEnd));
+        metaRefreshCases = [
+            ['lowercase', "<meta http-equiv=\"refresh\" content=\"0;url=https://evil.example\">"],
+            ['uppercase', "<META HTTP-EQUIV=\"REFRESH\" CONTENT=\"0;url=https://evil.example\">"],
+            ['nested in allowed block', "<div><meta http-equiv=\"refresh\" content=\"0;url=https://evil.example\"><p>after</p></div>"],
+        ];
+        for (_e = 0, metaRefreshCases_1 = metaRefreshCases; _e < metaRefreshCases_1.length; _e++) {
+            _f = metaRefreshCases_1[_e], name_3 = _f[0], payload = _f[1];
+            for (_g = 0, _h = [['with_iframes', utilities_1.sanitize_user_html_with_iframes], ['base', utilities_1.sanitize_user_html]]; _g < _h.length; _g++) {
+                _j = _h[_g], fnName = _j[0], fn = _j[1];
+                out = fn(payload).toLowerCase();
+                if (out.includes('<meta'))
+                    fail("meta survived [".concat(fnName, "/").concat(name_3, "] -> ").concat(out));
+                if (out.includes('http-equiv'))
+                    fail("http-equiv survived [".concat(fnName, "/").concat(name_3, "] -> ").concat(out));
+                if (out.includes('evil.example'))
+                    fail("meta refresh target survived [".concat(fnName, "/").concat(name_3, "] -> ").concat(out));
+            }
+        }
+        metaSibling = (0, utilities_1.sanitize_user_html_with_iframes)("<div><meta http-equiv=\"refresh\" content=\"0;url=https://evil.example\"><p>after</p></div>");
+        if (!metaSibling.includes('<p>after</p>'))
+            fail("content after a dropped meta refresh was lost: ".concat(metaSibling));
+        svgAnimateCases = [
+            ['animate onbegin', "<svg><animate onbegin=\"alert(1)\" attributeName=\"x\" dur=\"1s\"></svg>"],
+            ['animate href values', "<svg><a><animate attributeName=\"href\" values=\"javascript:alert(1)\"/><text>x</text></a></svg>"],
+            ['set href to', "<svg><a><set attributeName=\"href\" to=\"javascript:alert(1)\"/><text>x</text></a></svg>"],
+            ['animate onrepeat', "<svg><animate attributeName=\"x\" begin=\"0s\" onrepeat=\"alert(1)\"/></svg>"],
+            ['animate inside dropped iframe', "<iframe><svg><a><animate attributeName=\"href\" values=\"javascript:alert(1)\"/><text>x</text></a></svg></iframe>"],
+        ];
+        for (_k = 0, svgAnimateCases_1 = svgAnimateCases; _k < svgAnimateCases_1.length; _k++) {
+            _l = svgAnimateCases_1[_k], name_4 = _l[0], payload = _l[1];
+            for (_m = 0, _o = [['with_iframes', utilities_1.sanitize_user_html_with_iframes], ['base', utilities_1.sanitize_user_html]]; _m < _o.length; _m++) {
+                _p = _o[_m], fnName = _p[0], fn = _p[1];
+                out = fn(payload).toLowerCase();
+                if (out.includes('<animate') || out.includes('<set'))
+                    fail("SMIL animation element survived [".concat(fnName, "/").concat(name_4, "] -> ").concat(out));
+                if (out.includes('<svg'))
+                    fail("svg survived [".concat(fnName, "/").concat(name_4, "] -> ").concat(out));
+                if (out.includes('attributename'))
+                    fail("attributeName survived [".concat(fnName, "/").concat(name_4, "] -> ").concat(out));
+                if (out.includes('javascript:'))
+                    fail("javascript: payload survived [".concat(fnName, "/").concat(name_4, "] -> ").concat(out));
+                if (/\son[a-z]+\s*=/.test(out.replace(/"[^"]*"/g, '""')))
+                    fail("SMIL event handler survived [".concat(fnName, "/").concat(name_4, "] -> ").concat(out));
+            }
+        }
+        noscriptCases = [
+            ['attribute break-out', "<noscript><p title=\"</noscript><img src=x onerror=alert(1)>\">"],
+            ['style comment mXSS', "<noscript><style><!--</style><img src=x onerror=alert(1)>"],
+            ['plain content', "<noscript>hidden</noscript><p>after</p>"],
+            ['markup content', "<noscript><b>bold</b></noscript><p>after</p>"],
+            ['inside dropped iframe', "<iframe><noscript><p title=\"</noscript><img src=x onerror=alert(1)>\"></iframe>"],
+        ];
+        for (_q = 0, noscriptCases_1 = noscriptCases; _q < noscriptCases_1.length; _q++) {
+            _r = noscriptCases_1[_q], name_5 = _r[0], payload = _r[1];
+            for (_s = 0, _t = [['with_iframes', utilities_1.sanitize_user_html_with_iframes], ['base', utilities_1.sanitize_user_html]]; _s < _t.length; _s++) {
+                _u = _t[_s], fnName = _u[0], fn = _u[1];
+                out = fn(payload);
+                if (out.toLowerCase().includes('<noscript'))
+                    fail("noscript survived [".concat(fnName, "/").concat(name_5, "] -> ").concat(out));
+                // The breakout payload may legitimately remain as inert escaped text inside an attribute
+                // value; what must never happen is it coming back as a live handler. Values are blanked
+                // before the handler check for exactly that reason.
+                if (/\son[a-z]+\s*=/.test(out.toLowerCase().replace(/"[^"]*"/g, '""').replace(/'[^']*'/g, "''"))) {
+                    fail("live event handler escaped the noscript context [".concat(fnName, "/").concat(name_5, "] -> ").concat(out));
+                }
+                if (out.toLowerCase().includes('<script'))
+                    fail("script escaped the noscript context [".concat(fnName, "/").concat(name_5, "] -> ").concat(out));
+            }
+        }
+        afterNoscript = (0, utilities_1.sanitize_user_html)("<noscript>a</noscript><p>para1</p><div>para2</div><span>tail</span>");
+        for (_v = 0, _w = ['<p>para1</p>', '<div>para2</div>', '<span>tail</span>']; _v < _w.length; _v++) {
+            frag = _w[_v];
+            if (!afterNoscript.includes(frag))
+                fail("content after noscript was swallowed (missing ".concat(frag, "): ").concat(afterNoscript));
+        }
+        baseFallback = (0, utilities_1.sanitize_user_html)("<iframe src=\"http://evil.example\"><b>FB</b></iframe>");
+        if (baseFallback.toLowerCase().includes('<iframe'))
+            fail("base sanitizer kept the frame: ".concat(baseFallback));
+        if (baseFallback.toLowerCase().includes('evil.example'))
+            fail("base sanitizer kept the frame src: ".concat(baseFallback));
+        // The markup form, not just the characters "FB": on 2.17.7 this came back as the escaped text
+        // &lt;b&gt;FB&lt;/b&gt;, which also contains "FB". Asserting the live tag is what makes this pin
+        // the 2.18.0 behaviour rather than pass identically on either version.
+        if (!baseFallback.includes('<b>FB</b>'))
+            fail("fallback markup was not parsed back into live markup: ".concat(baseFallback));
+        if (baseFallback.includes('&lt;b&gt;'))
+            fail("fallback markup is still escaped (pre-2.18.0 behaviour): ".concat(baseFallback));
+        fallbackAttacks = [
+            ['img onerror', "<iframe><img src=x onerror=alert(1)></iframe>"],
+            ['script', "<iframe><script>alert(1)</script></iframe>"],
+            ['nested iframe', "<iframe><iframe src=\"https://evil.example\"></iframe></iframe>"],
+            ['javascript link', "<iframe><a href=\"javascript:alert(1)\">x</a></iframe>"],
+            ['object', "<iframe><object data=\"javascript:alert(1)\"></object></iframe>"],
+            ['base href', "<iframe><base href=\"https://evil.example\"></iframe>"],
+        ];
+        for (_x = 0, fallbackAttacks_1 = fallbackAttacks; _x < fallbackAttacks_1.length; _x++) {
+            _y = fallbackAttacks_1[_x], name_6 = _y[0], payload = _y[1];
+            out = (0, utilities_1.sanitize_user_html)(payload);
+            if (!has_no_executable_vector_allowing_iframe(out) || out.toLowerCase().includes('<iframe')) {
+                fail("iframe fallback content reopened a vector [".concat(name_6, "] -> ").concat(out));
+            }
+        }
+        // sanitize_user_html_with_iframes is unaffected: exclusiveFilter removes a disallowed frame AND
+        // its children, so fallback markup never reaches the escaping path at all. Asserted explicitly
+        // so the two functions' different handling stays deliberate.
+        for (_z = 0, _0 = __spreadArray(__spreadArray([], fallbackAttacks, true), [['bold fallback', "<iframe src=\"http://evil.example\"><b>FB</b></iframe>"]], false); _z < _0.length; _z++) {
+            _1 = _0[_z], name_7 = _1[0], payload = _1[1];
+            out = (0, utilities_1.sanitize_user_html_with_iframes)(payload);
+            if (out !== '')
+                fail("with_iframes should drop a disallowed frame and all its content [".concat(name_7, "] -> ").concat(out));
+        }
         console.log("✅ sanitize_user_html_with_iframes XSS regression tests passed");
         return [2 /*return*/];
     });

package/lib/cjs/tests/api_tests/security/sanitize-user-html-with-iframes.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"sanitize-user-html-with-iframes.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/sanitize-user-html-with-iframes.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,mDAAuJ;AAEvJ,0FAA0F;AAC1F,EAAE;AACF,+FAA+F;AAC/F,gGAAgG;AAChG,2CAA2C;AAC3C,kGAAkG;AAClG,mGAAmG;AACnG,wEAAwE;AACxE,oFAAoF;AACpF,+FAA+F;AAC/F,EAAE;AACF,yFAAyF;AACzF,+IAA+I;AAE/I,IAAM,IAAI,GAAG,UAAC,GAAW,IAAO,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAA,CAAC,CAAC,CAAA;AAEtD,uGAAuG;AACvG,kFAAkF;AAClF,IAAM,wCAAwC,GAAG,UAAC,GAAW;IAC3D,IAAM,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAA;IAC3B,IAAM,aAAa,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;IAC3E,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAG,uCAAuC;WAC/E,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;WAC1B,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;WACxB,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;WACtB,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;WACnB,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;WACpB,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;WACtB,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;WACrB,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;WACpB,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;WACxB,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;WACxB,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA,CAAmB,yCAAyC;AAC1F,CAAC,CAAA;AAED,kGAAkG;AAClG,gGAAgG;AAChG,IAAM,wBAAwB,GAAG;IAC/B,sBAAsB;IACtB,iBAAiB;IACjB,cAAc;IACd,oBAAoB;IACpB,wBAAwB;CACzB,CAAA;AAEM,IAAM,qCAAqC,GAAG;;;QACnD,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAA;QAKrE,WAAW,GAAuB;YACtC,CAAC,aAAa,EAAE,gDAA8C,CAAC;YAC/D,CAAC,YAAY,EAAE,iCAA+B,CAAC;YAC/C,CAAC,qBAAqB,EAAE,0EAAoE,CAAC;YAC7F,CAAC,kBAAkB,EAAE,gDAA8C,CAAC;YACpE,CAAC,yBAAyB,EAAE,wCAAsC,CAAC;YACnE,CAAC,iBAAiB,EAAE,gCAA8B,CAAC;YACnD,CAAC,qBAAqB,EAAE,uCAAqC,CAAC;YAC9D,CAAC,6BAA6B,EAAE,6CAA2C,CAAC;YAC5E,CAAC,YAAY,EAAE,2BAA2B,CAAC;YAC3C,CAAC,0BAA0B,EAAE,oCAAkC,CAAC;YAChE,CAAC,oBAAoB,EAAE,kCAAgC,CAAC;YACxD,CAAC,iBAAiB,EAAE,2CAAyC,CAAC;YAC9D,CAAC,0BAA0B,EAAE,6EAA6E,CAAC;YAC3G,CAAC,mBAAmB,EAAE,wEAAwE,CAAC;YAC/F,CAAC,4BAA4B,EAAE,iEAA+D,CAAC;YAC/F,CAAC,kBAAkB,EAAE,mDAAmD,CAAC;YACzE,CAAC,mBAAmB,EAAE,sCAAsC,CAAC;YAC7D,CAAC,iBAAiB,EAAE,0CAA0C,CAAC;YAC/D,CAAC,0BAA0B,EAAE,mDAA+C,CAAC;YAC7E,CAAC,iBAAiB,EAAE,sCAAoC,CAAC;YACzD,CAAC,qBAAqB,EAAE,4DAA0D,CAAC;YACnF,CAAC,2BAA2B,EAAE,2CAAyC,CAAC;YACxE,CAAC,2BAA2B,EAAE,6CAA2C,CAAC;SAC3E,CAAA;QACD,WAAyC,EAAX,2BAAW,EAAX,yBAAW,EAAX,IAAW,EAAE;YAAhC,sBAAe,EAAd,cAAI,EAAE,OAAO,QAAA;YACjB,GAAG,GAAG,IAAA,2CAA+B,EAAC,OAAO,CAAC,CAAA;YACpD,IAAI,CAAC,wCAAwC,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,+BAAwB,MAAI,kBAAQ,GAAG,CAAE,CAAC,CAAA;SACpG;QAKK,OAAO,GAAuB;YAClC,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;YAC5C,CAAC,gBAAgB,EAAE,0CAA0C,CAAC;YAC9D,CAAC,kBAAkB,EAAE,qBAAqB,CAAC;YAC3C,8EAA8E;YAC9E,2FAA2F;YAC3F,+CAA+C;YAC/C,CAAC,mBAAmB,EAAE,uBAAuB,CAAC;YAC9C,CAAC,eAAe,EAAE,kBAAkB,CAAC;YACrC,CAAC,eAAe,EAAE,UAAU,CAAC;YAC7B,CAAC,uBAAuB,EAAE,oBAAoB,CAAC;YAC/C,CAAC,uBAAuB,EAAE,2BAA2B,CAAC;YACtD,CAAC,aAAa,EAAE,UAAU,CAAC;YAC3B,CAAC,OAAO,EAAE,EAAE,CAAC;SACd,CAAA;QACD,WAAiC,EAAP,mBAAO,EAAP,qBAAO,EAAP,IAAO,EAAE;YAAxB,kBAAW,EAAV,cAAI,EAAE,GAAG,QAAA;YACb,GAAG,GAAG,IAAA,2CAA+B,EAAC,wBAAgB,GAAG,iBAAa,CAAC,CAAA;YAC7E,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,IAAI,CAAC,mCAA4B,MAAI,kBAAQ,GAAG,CAAE,CAAC,CAAA;SAC/F;QAGK,QAAQ,GAAG,IAAA,2CAA+B,EAAC,2CAAyC,CAAC,CAAA;QAC3F,IAAI,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC;YAAE,IAAI,CAAC,mDAA4C,QAAQ,CAAE,CAAC,CAAA;QACpG,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,mCAA4B,QAAQ,CAAE,CAAC,CAAA;QAGtF,MAAM,GAAG,IAAA,2CAA+B,EAAC,sFAAkF,CAAC,CAAA;QAClI,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,IAAI,CAAC,+BAAwB,MAAM,CAAE,CAAC,CAAA;QACnF,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,iDAA0C,MAAM,CAAE,CAAC,CAAA;QAGjG,QAAQ,GAAG,IAAA,2CAA+B,EAAC,mGAA2F,CAAC,CAAA;QAC7I,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,gCAAyB,QAAQ,CAAE,CAAC,CAAA;QAC1F,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAAE,IAAI,CAAC,yCAAkC,QAAQ,CAAE,CAAC,CAAA;QACrG,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,IAAI,CAAC,wDAAiD,QAAQ,CAAE,CAAC,CAAA;QAMjG,EAAE,GAAG,IAAA,2CAA+B,EAAC,4GAAoG,CAAC,CAAA;QAChJ,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;YAAE,IAAI,CAAC,sCAA+B,EAAE,CAAE,CAAC,CAAA;QACtG,IAAI,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;YAAE,IAAI,CAAC,sCAA+B,EAAE,CAAE,CAAC,CAAA;QAC3G,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,IAAI,CAAC,gCAAyB,EAAE,CAAE,CAAC,CAAA;QAElF,qBAAqB;QACrB,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,oBAAY,kCAAsB,OAAG,CAAC;YAAE,IAAI,CAAC,8BAAuB,EAAE,CAAE,CAAC,CAAA;QAC1F,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YAAE,IAAI,CAAC,kCAA2B,EAAE,CAAE,CAAC,CAAA;QACxF,WAA4C,EAAxB,qDAAwB,EAAxB,sCAAwB,EAAxB,IAAwB,EAAE;YAAnC,KAAK;YACd,IAAI,kCAAsB,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,IAAI,CAAC,wCAAiC,KAAK,eAAK,kCAAsB,CAAE,CAAC,CAAA;SACtH;QACD,kGAAkG;QAClG,uFAAuF;QACvF,IAAI,CAAC,kCAAsB,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YAAE,IAAI,CAAC,6EAAsE,kCAAsB,CAAE,CAAC,CAAA;QAIzJ,aAAa,GAAG,IAAA,2CAA+B,EAAC,wEAAoE,CAAC,CAAA;QAC3H,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,yBAAyB,CAAC;YAAE,IAAI,CAAC,sCAA+B,aAAa,CAAE,CAAC,CAAA;QAGtG,YAAY,GAAG,IAAA,2CAA+B,EAAC,2DAAuD,CAAC,CAAA;QAC7G,IAAI,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,IAAI,CAAC,kEAA2D,YAAY,CAAE,CAAC,CAAA;QACpH,+FAA+F;QAC/F,gGAAgG;QAChG,yEAAyE;QACzE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,IAAI,CAAC,iDAA0C,YAAY,CAAE,CAAC,CAAA;QAGvG,KAAK,GAAG,IAAA,2CAA+B,EAAC,6EAAyE,CAAC,CAAA;QACxH,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,8BAA8B,CAAC;YAAE,IAAI,CAAC,6CAAsC,KAAK,CAAE,CAAC,CAAA;QAGlG,SAAS,GAAG,IAAA,2CAA+B,EAAC,kGAA8F,CAAC,CAAA;QACjJ,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,mCAAmC,CAAC;YAAE,IAAI,CAAC,oCAA6B,SAAS,CAAE,CAAC,CAAA;QAKtG,OAAO,GAAG,IAAA,2CAA+B,EAAC,mDAAiD,CAAC,CAAA;QAClG,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAAE,IAAI,CAAC,mCAA4B,OAAO,CAAE,CAAC,CAAA;QAE5I,KAAK,GAAG,IAAA,2CAA+B,EAAC,4HAAwH,CAAC,CAAA;QACvK,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAAE,IAAI,CAAC,0BAAmB,KAAK,CAAE,CAAC,CAAA;QAEjH,IAAI,GAAG,IAAA,2CAA+B,EAAC,oDAAkD,CAAC,CAAA;QAChG,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAAE,IAAI,CAAC,yBAAkB,IAAI,CAAE,CAAC,CAAA;QAErG,IAAI,GAAG,IAAA,2CAA+B,EAAC,0CAAwC,CAAC,CAAA;QACtF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC;YAAE,IAAI,CAAC,8BAAuB,IAAI,CAAE,CAAC,CAAA;QACrF,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,IAAI,CAAC,sCAA+B,IAAI,CAAE,CAAC,CAAA;QAEnF,GAAG,GAAG,IAAA,2CAA+B,EAAC,uEAAiE,CAAC,CAAA;QAC9G,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,qCAAqC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAAE,IAAI,CAAC,0BAAmB,GAAG,CAAE,CAAC,CAAA;QAEjH,OAAO,GAAG,IAAA,2CAA+B,EAAC,kDAAgD,CAAC,CAAA;QACjG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAAE,IAAI,CAAC,gCAAyB,OAAO,CAAE,CAAC,CAAA;QAE3E,GAAG,GAAG,IAAA,2CAA+B,EAAC,wGAAsG,CAAC,CAAA;QACnJ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAAE,IAAI,CAAC,+BAAwB,GAAG,CAAE,CAAC,CAAA;QAKlI,MAAM,GAAG,IAAA,8BAAkB,EAAC,6DAA2D,CAAC,CAAA;QAC9F,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,uDAAgD,MAAM,CAAE,CAAC,CAAA;QAKtG,aAAa,GAAG,qGAAmG,CAAA;QACnH,SAAS,GAAG,IAAA,8CAAkC,EAAC,aAAa,EAAE;YAClE,OAAO,EAAE,EAAE,KAAK,EAAE,sDAAoD,EAAS;YAC/E,SAAS,EAAE,EAAE;YACb,0BAA0B,EAAE,IAAI;YAChC,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QACI,QAAQ,GAAG,IAAA,2CAA+B,EAAC,SAAS,CAAC,CAAA;QAC3D,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,yCAAyC,CAAC;YAAE,IAAI,CAAC,8CAAuC,QAAQ,CAAE,CAAC,CAAA;QAC1H,6FAA6F;QAC7F,wFAAwF;QACxF,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;YAAE,IAAI,CAAC,oDAA6C,QAAQ,CAAE,CAAC,CAAA;QACnG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,IAAI,CAAC,uDAAgD,QAAQ,CAAE,CAAC,CAAA;QAEnI,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAA;;;KAC7E,CAAA;AApKY,QAAA,qCAAqC,yCAoKjD;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,IAAA,6CAAqC,GAAE;SACpC,IAAI,CAAC,cAAQ,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC;SACjE,KAAK,CAAC,UAAC,GAAG,IAAO,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;CAC9E"}
+{"version":3,"file":"sanitize-user-html-with-iframes.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/sanitize-user-html-with-iframes.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,mDAAuJ;AAEvJ,0FAA0F;AAC1F,EAAE;AACF,+FAA+F;AAC/F,gGAAgG;AAChG,2CAA2C;AAC3C,kGAAkG;AAClG,mGAAmG;AACnG,wEAAwE;AACxE,oFAAoF;AACpF,+FAA+F;AAC/F,EAAE;AACF,yFAAyF;AACzF,+IAA+I;AAE/I,IAAM,IAAI,GAAG,UAAC,GAAW,IAAO,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAA,CAAC,CAAC,CAAA;AAEtD,uGAAuG;AACvG,kFAAkF;AAClF,IAAM,wCAAwC,GAAG,UAAC,GAAW;IAC3D,IAAM,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAA;IAC3B,IAAM,aAAa,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;IAC3E,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAG,uCAAuC;WAC/E,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;WAC1B,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;WACxB,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;WACtB,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;WACnB,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;WACpB,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;WACtB,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;WACrB,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;WACpB,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;WACxB,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;WACxB,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA,CAAmB,yCAAyC;AAC1F,CAAC,CAAA;AAED,kGAAkG;AAClG,gGAAgG;AAChG,IAAM,wBAAwB,GAAG;IAC/B,sBAAsB;IACtB,iBAAiB;IACjB,cAAc;IACd,oBAAoB;IACpB,wBAAwB;CACzB,CAAA;AAEM,IAAM,qCAAqC,GAAG;;;QACnD,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAA;QAKrE,WAAW,GAAuB;YACtC,CAAC,aAAa,EAAE,gDAA8C,CAAC;YAC/D,CAAC,YAAY,EAAE,iCAA+B,CAAC;YAC/C,CAAC,qBAAqB,EAAE,0EAAoE,CAAC;YAC7F,CAAC,kBAAkB,EAAE,gDAA8C,CAAC;YACpE,CAAC,yBAAyB,EAAE,wCAAsC,CAAC;YACnE,CAAC,iBAAiB,EAAE,gCAA8B,CAAC;YACnD,CAAC,qBAAqB,EAAE,uCAAqC,CAAC;YAC9D,CAAC,6BAA6B,EAAE,6CAA2C,CAAC;YAC5E,CAAC,YAAY,EAAE,2BAA2B,CAAC;YAC3C,CAAC,0BAA0B,EAAE,oCAAkC,CAAC;YAChE,CAAC,oBAAoB,EAAE,kCAAgC,CAAC;YACxD,CAAC,iBAAiB,EAAE,2CAAyC,CAAC;YAC9D,CAAC,0BAA0B,EAAE,6EAA6E,CAAC;YAC3G,CAAC,mBAAmB,EAAE,wEAAwE,CAAC;YAC/F,CAAC,4BAA4B,EAAE,iEAA+D,CAAC;YAC/F,CAAC,kBAAkB,EAAE,mDAAmD,CAAC;YACzE,CAAC,mBAAmB,EAAE,sCAAsC,CAAC;YAC7D,CAAC,iBAAiB,EAAE,0CAA0C,CAAC;YAC/D,CAAC,0BAA0B,EAAE,mDAA+C,CAAC;YAC7E,CAAC,iBAAiB,EAAE,sCAAoC,CAAC;YACzD,CAAC,qBAAqB,EAAE,4DAA0D,CAAC;YACnF,CAAC,2BAA2B,EAAE,2CAAyC,CAAC;YACxE,CAAC,2BAA2B,EAAE,6CAA2C,CAAC;SAC3E,CAAA;QACD,WAAyC,EAAX,2BAAW,EAAX,yBAAW,EAAX,IAAW,EAAE;YAAhC,sBAAe,EAAd,cAAI,EAAE,OAAO,QAAA;YACjB,GAAG,GAAG,IAAA,2CAA+B,EAAC,OAAO,CAAC,CAAA;YACpD,IAAI,CAAC,wCAAwC,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,+BAAwB,MAAI,kBAAQ,GAAG,CAAE,CAAC,CAAA;SACpG;QAKK,OAAO,GAAuB;YAClC,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;YAC5C,CAAC,gBAAgB,EAAE,0CAA0C,CAAC;YAC9D,CAAC,kBAAkB,EAAE,qBAAqB,CAAC;YAC3C,8EAA8E;YAC9E,2FAA2F;YAC3F,+CAA+C;YAC/C,CAAC,mBAAmB,EAAE,uBAAuB,CAAC;YAC9C,CAAC,eAAe,EAAE,kBAAkB,CAAC;YACrC,CAAC,eAAe,EAAE,UAAU,CAAC;YAC7B,CAAC,uBAAuB,EAAE,oBAAoB,CAAC;YAC/C,CAAC,uBAAuB,EAAE,2BAA2B,CAAC;YACtD,CAAC,aAAa,EAAE,UAAU,CAAC;YAC3B,CAAC,OAAO,EAAE,EAAE,CAAC;SACd,CAAA;QACD,WAAiC,EAAP,mBAAO,EAAP,qBAAO,EAAP,IAAO,EAAE;YAAxB,kBAAW,EAAV,cAAI,EAAE,GAAG,QAAA;YACb,GAAG,GAAG,IAAA,2CAA+B,EAAC,wBAAgB,GAAG,iBAAa,CAAC,CAAA;YAC7E,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,IAAI,CAAC,mCAA4B,MAAI,kBAAQ,GAAG,CAAE,CAAC,CAAA;SAC/F;QAGK,QAAQ,GAAG,IAAA,2CAA+B,EAAC,2CAAyC,CAAC,CAAA;QAC3F,IAAI,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC;YAAE,IAAI,CAAC,mDAA4C,QAAQ,CAAE,CAAC,CAAA;QACpG,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,mCAA4B,QAAQ,CAAE,CAAC,CAAA;QAGtF,MAAM,GAAG,IAAA,2CAA+B,EAAC,sFAAkF,CAAC,CAAA;QAClI,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,IAAI,CAAC,+BAAwB,MAAM,CAAE,CAAC,CAAA;QACnF,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,iDAA0C,MAAM,CAAE,CAAC,CAAA;QAGjG,QAAQ,GAAG,IAAA,2CAA+B,EAAC,mGAA2F,CAAC,CAAA;QAC7I,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,gCAAyB,QAAQ,CAAE,CAAC,CAAA;QAC1F,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAAE,IAAI,CAAC,yCAAkC,QAAQ,CAAE,CAAC,CAAA;QACrG,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,IAAI,CAAC,wDAAiD,QAAQ,CAAE,CAAC,CAAA;QAMjG,EAAE,GAAG,IAAA,2CAA+B,EAAC,4GAAoG,CAAC,CAAA;QAChJ,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;YAAE,IAAI,CAAC,sCAA+B,EAAE,CAAE,CAAC,CAAA;QACtG,IAAI,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;YAAE,IAAI,CAAC,sCAA+B,EAAE,CAAE,CAAC,CAAA;QAC3G,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,IAAI,CAAC,gCAAyB,EAAE,CAAE,CAAC,CAAA;QAElF,qBAAqB;QACrB,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,oBAAY,kCAAsB,OAAG,CAAC;YAAE,IAAI,CAAC,8BAAuB,EAAE,CAAE,CAAC,CAAA;QAC1F,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YAAE,IAAI,CAAC,kCAA2B,EAAE,CAAE,CAAC,CAAA;QACxF,WAA4C,EAAxB,qDAAwB,EAAxB,sCAAwB,EAAxB,IAAwB,EAAE;YAAnC,KAAK;YACd,IAAI,kCAAsB,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,IAAI,CAAC,wCAAiC,KAAK,eAAK,kCAAsB,CAAE,CAAC,CAAA;SACtH;QACD,kGAAkG;QAClG,uFAAuF;QACvF,IAAI,CAAC,kCAAsB,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YAAE,IAAI,CAAC,6EAAsE,kCAAsB,CAAE,CAAC,CAAA;QAIzJ,aAAa,GAAG,IAAA,2CAA+B,EAAC,wEAAoE,CAAC,CAAA;QAC3H,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,yBAAyB,CAAC;YAAE,IAAI,CAAC,sCAA+B,aAAa,CAAE,CAAC,CAAA;QAGtG,YAAY,GAAG,IAAA,2CAA+B,EAAC,2DAAuD,CAAC,CAAA;QAC7G,IAAI,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,IAAI,CAAC,kEAA2D,YAAY,CAAE,CAAC,CAAA;QACpH,+FAA+F;QAC/F,gGAAgG;QAChG,yEAAyE;QACzE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,IAAI,CAAC,iDAA0C,YAAY,CAAE,CAAC,CAAA;QAGvG,KAAK,GAAG,IAAA,2CAA+B,EAAC,6EAAyE,CAAC,CAAA;QACxH,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,8BAA8B,CAAC;YAAE,IAAI,CAAC,6CAAsC,KAAK,CAAE,CAAC,CAAA;QAGlG,SAAS,GAAG,IAAA,2CAA+B,EAAC,kGAA8F,CAAC,CAAA;QACjJ,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,mCAAmC,CAAC;YAAE,IAAI,CAAC,oCAA6B,SAAS,CAAE,CAAC,CAAA;QAKtG,OAAO,GAAG,IAAA,2CAA+B,EAAC,mDAAiD,CAAC,CAAA;QAClG,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAAE,IAAI,CAAC,mCAA4B,OAAO,CAAE,CAAC,CAAA;QAE5I,KAAK,GAAG,IAAA,2CAA+B,EAAC,4HAAwH,CAAC,CAAA;QACvK,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAAE,IAAI,CAAC,0BAAmB,KAAK,CAAE,CAAC,CAAA;QAEjH,IAAI,GAAG,IAAA,2CAA+B,EAAC,oDAAkD,CAAC,CAAA;QAChG,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAAE,IAAI,CAAC,yBAAkB,IAAI,CAAE,CAAC,CAAA;QAErG,IAAI,GAAG,IAAA,2CAA+B,EAAC,0CAAwC,CAAC,CAAA;QACtF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC;YAAE,IAAI,CAAC,8BAAuB,IAAI,CAAE,CAAC,CAAA;QACrF,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,IAAI,CAAC,sCAA+B,IAAI,CAAE,CAAC,CAAA;QAEnF,GAAG,GAAG,IAAA,2CAA+B,EAAC,uEAAiE,CAAC,CAAA;QAC9G,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,qCAAqC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAAE,IAAI,CAAC,0BAAmB,GAAG,CAAE,CAAC,CAAA;QAEjH,OAAO,GAAG,IAAA,2CAA+B,EAAC,kDAAgD,CAAC,CAAA;QACjG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAAE,IAAI,CAAC,gCAAyB,OAAO,CAAE,CAAC,CAAA;QAE3E,GAAG,GAAG,IAAA,2CAA+B,EAAC,wGAAsG,CAAC,CAAA;QACnJ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAAE,IAAI,CAAC,+BAAwB,GAAG,CAAE,CAAC,CAAA;QAKlI,MAAM,GAAG,IAAA,8BAAkB,EAAC,6DAA2D,CAAC,CAAA;QAC9F,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,uDAAgD,MAAM,CAAE,CAAC,CAAA;QAKtG,aAAa,GAAG,qGAAmG,CAAA;QACnH,SAAS,GAAG,IAAA,8CAAkC,EAAC,aAAa,EAAE;YAClE,OAAO,EAAE,EAAE,KAAK,EAAE,sDAAoD,EAAS;YAC/E,SAAS,EAAE,EAAE;YACb,0BAA0B,EAAE,IAAI;YAChC,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QACI,QAAQ,GAAG,IAAA,2CAA+B,EAAC,SAAS,CAAC,CAAA;QAC3D,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,yCAAyC,CAAC;YAAE,IAAI,CAAC,8CAAuC,QAAQ,CAAE,CAAC,CAAA;QAC1H,6FAA6F;QAC7F,wFAAwF;QACxF,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;YAAE,IAAI,CAAC,oDAA6C,QAAQ,CAAE,CAAC,CAAA;QACnG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,IAAI,CAAC,uDAAgD,QAAQ,CAAE,CAAC,CAAA;QAgB7H,gBAAgB,GAAuB;YAC3C,CAAC,WAAW,EAAE,sEAAkE,CAAC;YACjF,CAAC,WAAW,EAAE,sEAAkE,CAAC;YACjF,CAAC,yBAAyB,EAAE,6FAAyF,CAAC;SACvH,CAAA;QACD,WAA8C,EAAhB,qCAAgB,EAAhB,8BAAgB,EAAhB,IAAgB,EAAE;YAArC,2BAAe,EAAd,cAAI,EAAE,OAAO,QAAA;YACvB,WAAqH,EAA1F,KAAA,CAAC,CAAC,cAAc,EAAE,2CAA+B,CAAC,EAAE,CAAC,MAAM,EAAE,8BAAkB,CAAC,CAAU,EAA1F,cAA0F,EAA1F,IAA0F,EAAE;gBAA5G,WAAY,EAAX,MAAM,QAAA,EAAE,EAAE,QAAA;gBACd,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAA;gBACrC,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;oBAAE,IAAI,CAAC,yBAAkB,MAAM,cAAI,MAAI,kBAAQ,GAAG,CAAE,CAAC,CAAA;gBAC9E,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC;oBAAE,IAAI,CAAC,+BAAwB,MAAM,cAAI,MAAI,kBAAQ,GAAG,CAAE,CAAC,CAAA;gBACzF,IAAI,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC;oBAAE,IAAI,CAAC,wCAAiC,MAAM,cAAI,MAAI,kBAAQ,GAAG,CAAE,CAAC,CAAA;aACrG;SACF;QAEK,WAAW,GAAG,IAAA,2CAA+B,EAAC,6FAAyF,CAAC,CAAA;QAC9I,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,cAAc,CAAC;YAAE,IAAI,CAAC,yDAAkD,WAAW,CAAE,CAAC,CAAA;QAQ1G,eAAe,GAAuB;YAC1C,CAAC,iBAAiB,EAAE,0EAAoE,CAAC;YACzF,CAAC,qBAAqB,EAAE,kGAA8F,CAAC;YACvH,CAAC,aAAa,EAAE,0FAAsF,CAAC;YACvG,CAAC,kBAAkB,EAAE,8EAAwE,CAAC;YAC9F,CAAC,+BAA+B,EAAE,mHAA+G,CAAC;SACnJ,CAAA;QACD,WAA6C,EAAf,mCAAe,EAAf,6BAAe,EAAf,IAAe,EAAE;YAApC,0BAAe,EAAd,cAAI,EAAE,OAAO,QAAA;YACvB,WAAqH,EAA1F,KAAA,CAAC,CAAC,cAAc,EAAE,2CAA+B,CAAC,EAAE,CAAC,MAAM,EAAE,8BAAkB,CAAC,CAAU,EAA1F,cAA0F,EAA1F,IAA0F,EAAE;gBAA5G,WAAY,EAAX,MAAM,QAAA,EAAE,EAAE,QAAA;gBACd,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAA;gBACrC,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAAE,IAAI,CAAC,2CAAoC,MAAM,cAAI,MAAI,kBAAQ,GAAG,CAAE,CAAC,CAAA;gBAC3H,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAAE,IAAI,CAAC,wBAAiB,MAAM,cAAI,MAAI,kBAAQ,GAAG,CAAE,CAAC,CAAA;gBAC5E,IAAI,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC;oBAAE,IAAI,CAAC,kCAA2B,MAAM,cAAI,MAAI,kBAAQ,GAAG,CAAE,CAAC,CAAA;gBAC/F,IAAI,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC;oBAAE,IAAI,CAAC,wCAAiC,MAAM,cAAI,MAAI,kBAAQ,GAAG,CAAE,CAAC,CAAA;gBACnG,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;oBAAE,IAAI,CAAC,uCAAgC,MAAM,cAAI,MAAI,kBAAQ,GAAG,CAAE,CAAC,CAAA;aAC5H;SACF;QAQK,aAAa,GAAuB;YACxC,CAAC,qBAAqB,EAAE,iEAA+D,CAAC;YACxF,CAAC,oBAAoB,EAAE,2DAA2D,CAAC;YACnF,CAAC,eAAe,EAAE,yCAAyC,CAAC;YAC5D,CAAC,gBAAgB,EAAE,8CAA8C,CAAC;YAClE,CAAC,uBAAuB,EAAE,kFAAgF,CAAC;SAC5G,CAAA;QACD,WAA2C,EAAb,+BAAa,EAAb,2BAAa,EAAb,IAAa,EAAE;YAAlC,wBAAe,EAAd,cAAI,EAAE,OAAO,QAAA;YACvB,WAAqH,EAA1F,KAAA,CAAC,CAAC,cAAc,EAAE,2CAA+B,CAAC,EAAE,CAAC,MAAM,EAAE,8BAAkB,CAAC,CAAU,EAA1F,cAA0F,EAA1F,IAA0F,EAAE;gBAA5G,WAAY,EAAX,MAAM,QAAA,EAAE,EAAE,QAAA;gBACd,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,CAAA;gBACvB,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;oBAAE,IAAI,CAAC,6BAAsB,MAAM,cAAI,MAAI,kBAAQ,GAAG,CAAE,CAAC,CAAA;gBACpG,yFAAyF;gBACzF,wFAAwF;gBACxF,oDAAoD;gBACpD,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,EAAE;oBAChG,IAAI,CAAC,2DAAoD,MAAM,cAAI,MAAI,kBAAQ,GAAG,CAAE,CAAC,CAAA;iBACtF;gBACD,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;oBAAE,IAAI,CAAC,+CAAwC,MAAM,cAAI,MAAI,kBAAQ,GAAG,CAAE,CAAC,CAAA;aACrH;SACF;QAEK,aAAa,GAAG,IAAA,8BAAkB,EAAC,qEAAqE,CAAC,CAAA;QAC/G,WAA4E,EAAzD,MAAC,cAAc,EAAE,kBAAkB,EAAE,mBAAmB,CAAC,EAAzD,cAAyD,EAAzD,IAAyD,EAAE;YAAnE,IAAI;YACb,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,wDAAiD,IAAI,gBAAM,aAAa,CAAE,CAAC,CAAA;SACpH;QAQK,YAAY,GAAG,IAAA,8BAAkB,EAAC,wDAAsD,CAAC,CAAA;QAC/F,IAAI,YAAY,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,yCAAkC,YAAY,CAAE,CAAC,CAAA;QAC1G,IAAI,YAAY,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC;YAAE,IAAI,CAAC,6CAAsC,YAAY,CAAE,CAAC,CAAA;QACnH,8FAA8F;QAC9F,iGAAiG;QACjG,uEAAuE;QACvE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,IAAI,CAAC,gEAAyD,YAAY,CAAE,CAAC,CAAA;QACtH,IAAI,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,IAAI,CAAC,mEAA4D,YAAY,CAAE,CAAC,CAAA;QAIlH,eAAe,GAAuB;YAC1C,CAAC,aAAa,EAAE,+CAA+C,CAAC;YAChE,CAAC,QAAQ,EAAE,4CAA4C,CAAC;YACxD,CAAC,eAAe,EAAE,iEAA+D,CAAC;YAClF,CAAC,iBAAiB,EAAE,wDAAsD,CAAC;YAC3E,CAAC,QAAQ,EAAE,iEAA+D,CAAC;YAC3E,CAAC,WAAW,EAAE,uDAAqD,CAAC;SACrE,CAAA;QACD,WAA6C,EAAf,mCAAe,EAAf,6BAAe,EAAf,IAAe,EAAE;YAApC,0BAAe,EAAd,cAAI,EAAE,OAAO,QAAA;YACjB,GAAG,GAAG,IAAA,8BAAkB,EAAC,OAAO,CAAC,CAAA;YACvC,IAAI,CAAC,wCAAwC,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE;gBAC3F,IAAI,CAAC,qDAA8C,MAAI,kBAAQ,GAAG,CAAE,CAAC,CAAA;aACtE;SACF;QAED,gGAAgG;QAChG,+FAA+F;QAC/F,6DAA6D;QAC7D,WAAiJ,EAAnH,qCAAI,eAAe,UAAE,CAAC,eAAe,EAAE,wDAAsD,CAAqB,SAAC,EAAnH,cAAmH,EAAnH,IAAmH,EAAE;YAAxI,WAAe,EAAd,cAAI,EAAE,OAAO,QAAA;YACjB,GAAG,GAAG,IAAA,2CAA+B,EAAC,OAAO,CAAC,CAAA;YACpD,IAAI,GAAG,KAAK,EAAE;gBAAE,IAAI,CAAC,2EAAoE,MAAI,kBAAQ,GAAG,CAAE,CAAC,CAAA;SAC5G;QAED,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAA;;;KAC7E,CAAA;AAnSY,QAAA,qCAAqC,yCAmSjD;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,IAAA,6CAAqC,GAAE;SACpC,IAAI,CAAC,cAAQ,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC;SACjE,KAAK,CAAC,UAAC,GAAG,IAAO,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;CAC9E"}

package/lib/cjs/tests/api_tests/security/schema-adminonly-enforcement.test.d.ts

@@ -1,4 +1,4 @@
-import { Session } from "../../../sdk";
+import { Check, IsolatedSuite } from "../../setup_isolated";
 /**
  * Regression test: `adminOnly` custom actions must be enforced at runtime, not merely declared.
  *
@@ -37,9 +37,15 @@ import { Session } from "../../../sdk";
  *
  * RED (pre-fix): the six group-B rows fail — each reaches its handler and returns a non-401.
  * GREEN (post-fix): all six return 401 "Admin access only"; the group-A controls are unchanged.
+ *
+ * Runs on its own provisioned tenant, which makes the two environment-dependent probes deterministic
+ * rather than a function of whoever's local database the shared org came from: a fresh tenant has no
+ * Athena integration (so sync-athena is probed) and no twilioSID (so link-twilio, which can create a
+ * REAL Twilio subaccount, stays permanently on its skipped-for-safety path).
  */
-export declare const schema_adminonly_enforcement_tests: ({ sdk }: {
-    sdk: Session;
-    sdkNonAdmin: Session;
-}) => Promise<void>;
+export declare const schema_adminonly_enforcement_checks: () => Promise<Check[]>;
+/** Asserting wrapper, for standalone runs. */
+export declare const schema_adminonly_enforcement_tests: () => Promise<void>;
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export declare const ISOLATED_SUITE: IsolatedSuite;
 //# sourceMappingURL=schema-adminonly-enforcement.test.d.ts.map

package/lib/cjs/tests/api_tests/security/schema-adminonly-enforcement.test.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-adminonly-enforcement.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/schema-adminonly-enforcement.test.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAqBtC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,eAAO,MAAM,kCAAkC;SAA2B,OAAO;iBAAe,OAAO;mBAwMtG,CAAA"}
+{"version":3,"file":"schema-adminonly-enforcement.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/schema-adminonly-enforcement.test.ts"],"names":[],"mappings":"AAMA,OAAO,EAEL,KAAK,EACL,aAAa,EAEd,MAAM,sBAAsB,CAAA;AAS7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,eAAO,MAAM,mCAAmC,QAAa,QAAQ,KAAK,EAAE,CA0M3E,CAAA;AAED,8CAA8C;AAC9C,eAAO,MAAM,kCAAkC,qBAE9C,CAAA;AAED,oGAAoG;AACpG,eAAO,MAAM,cAAc,EAAE,aAG5B,CAAA"}