@tellescope/sdk 2.0.0-beta.2 → 2.0.0-beta.3

package/lib/cjs/tests/api_tests/security/startlinktoken-enduser-staff-escalation.test.js

@@ -47,12 +47,11 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
     }
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.startlinktoken_escalation_tests = void 0;
+exports.ISOLATED_SUITE = exports.startlinktoken_escalation_tests = exports.startlinktoken_escalation_checks = void 0;
 require('source-map-support').install();
 var sdk_1 = require("../../../sdk");
-var testing_1 = require("@tellescope/testing");
-var setup_1 = require("../../setup");
 var constants_1 = require("@tellescope/constants");
+var setup_isolated_1 = require("../../setup_isolated");
 var host = process.env.API_URL || 'http://localhost:8080';
 /**
  * Regression test — `calendar_events.startLinkToken` privilege escalation.
@@ -75,279 +74,325 @@ var host = process.env.API_URL || 'http://localhost:8080';
  *   redactions: ['all']            (closes READ for endusers AND non-admin users; safe — nothing reads
  *                                   the value back). NOT `readonly` (would break the staff write — A2).
  *
- * Checks (collected, then asserted, so a RED run shows every failing vector):
+ * Checks (collected, never asserted here, so a RED run shows every failing vector):
  *   A1  enduser attendee PATCH of startLinkToken is REJECTED                (WRITE gate)
  *   A2  a staff-set token still redeems for the host's session             (feature preserved)
  *   A3  an enduser-set token (if the write lands) does NOT redeem          (defence-in-depth)
  *   A4  an enduser attendee does NOT receive startLinkToken on read        (READ gate, endusers)
  *   A5  a non-admin staff user does NOT receive startLinkToken on read     (READ gate, users)
  *
- * No vendor, no Bedrock; the "host" is a throwaway user. Cleans up every created record.
+ * No vendor, no Bedrock; the "host" is a throwaway user. Runs on its own provisioned tenant and
+ * cleans up every created record before tearing it down. The patient session is minted inline from
+ * endusers.generate_auth_token — this file imports nothing from the shared setup.ts fixture.
  */
 var RAND = function () { return Math.random().toString(36).slice(2, 10); };
-var startlinktoken_escalation_tests = function (_a) {
-    var sdk = _a.sdk;
-    return __awaiter(void 0, void 0, void 0, function () {
-        var businessId, userIds, enduserIds, eventIds, roleIds, checks, record, host_user, patient, event_1, patientSDK, attackerToken, wrote, writeErr, err_1, adminView, redeemed, _b, staffToken, staffWriteErr, e_1, legit, e_2, enduserRead, _c, rbap, nonAdmin, authToken, nonAdminSDK, staffRead, _d, _i, checks_1, c, _e, checks_2, c, _f, eventIds_1, id, _g, _h, enduserIds_1, id, _j, _k, userIds_1, id, _l, _m, roleIds_1, id, _o;
-        var _p, _q, _r, _s, _t;
-        return __generator(this, function (_u) {
-            switch (_u.label) {
-                case 0:
-                    (0, testing_1.log_header)("startLinkToken enduser-writable / readable → staff session escalation");
-                    businessId = sdk.userInfo.businessId;
-                    userIds = [];
-                    enduserIds = [];
-                    eventIds = [];
-                    roleIds = [];
-                    checks = [];
-                    record = function (label, pass, detail) { return checks.push({ label: label, pass: pass, detail: detail }); };
-                    _u.label = 1;
-                case 1:
-                    _u.trys.push([1, , 38, 63]);
-                    return [4 /*yield*/, sdk.api.users.createOne({
-                            email: "f0185-host-".concat(RAND(), "@tellescope.example"), fname: 'F0185', lname: 'Host',
-                            verifiedEmail: true, notificationEmailsDisabled: true,
-                        })];
-                case 2:
-                    host_user = _u.sent();
-                    userIds.push(host_user.id);
-                    return [4 /*yield*/, sdk.api.endusers.createOne({
-                            email: "f0185-patient-".concat(RAND(), "@tellescope.example"), fname: 'F0185', lname: 'Patient',
-                        })];
-                case 3:
-                    patient = _u.sent();
-                    enduserIds.push(patient.id);
-                    return [4 /*yield*/, sdk.api.calendar_events.createOne({
-                            title: 'appointment', durationInMinutes: 30, startTimeInMS: Date.now() + 3600000,
-                            attendees: [{ type: 'user', id: host_user.id }, { type: 'enduser', id: patient.id }],
-                        })];
-                case 4:
-                    event_1 = _u.sent();
-                    eventIds.push(event_1.id);
-                    patientSDK = new sdk_1.EnduserSession({ host: host, businessId: businessId });
-                    return [4 /*yield*/, (0, setup_1.authenticate_enduser_via_token)(sdk, patientSDK, { id: patient.id })
-                        // ---- A1: WRITE gate — enduser attendee cannot PATCH startLinkToken ----
-                    ];
-                case 5:
-                    _u.sent();
-                    attackerToken = "f0185-attacker-".concat(RAND()).concat(RAND());
-                    wrote = false, writeErr = '';
-                    _u.label = 6;
-                case 6:
-                    _u.trys.push([6, 8, , 9]);
-                    return [4 /*yield*/, patientSDK.api.calendar_events.updateOne(event_1.id, { startLinkToken: attackerToken })];
-                case 7:
-                    _u.sent();
-                    wrote = true;
-                    return [3 /*break*/, 9];
-                case 8:
-                    err_1 = _u.sent();
-                    writeErr = (_p = err_1 === null || err_1 === void 0 ? void 0 : err_1.message) !== null && _p !== void 0 ? _p : String(err_1);
-                    return [3 /*break*/, 9];
-                case 9:
-                    record('A1: enduser cannot write startLinkToken', !wrote, wrote ? 'PATCH ACCEPTED — patient set a staff start-link token' : "rejected (".concat(writeErr, ")"));
-                    return [4 /*yield*/, sdk.api.calendar_events.getOne(event_1.id)];
-                case 10:
-                    adminView = _u.sent();
-                    if (!(adminView.startLinkToken === attackerToken)) return [3 /*break*/, 15];
-                    redeemed = null;
-                    _u.label = 11;
-                case 11:
-                    _u.trys.push([11, 13, , 14]);
-                    return [4 /*yield*/, new sdk_1.Session({ host: host }).api.calendar_events.session_for_start_link({ token: attackerToken })];
-                case 12:
-                    redeemed = _u.sent();
-                    return [3 /*break*/, 14];
-                case 13:
-                    _b = _u.sent();
-                    return [3 /*break*/, 14];
-                case 14:
-                    record('A3: enduser-set token does not mint a staff session', !(redeemed === null || redeemed === void 0 ? void 0 : redeemed.authToken), (redeemed === null || redeemed === void 0 ? void 0 : redeemed.authToken) ? "minted a STAFF authToken for host ".concat(host_user.id) : 'not redeemable');
-                    return [3 /*break*/, 16];
-                case 15:
-                    record('A3: enduser-set token does not mint a staff session', true, '(n/a — write blocked, value never landed)');
-                    _u.label = 16;
-                case 16:
-                    staffToken = "f0185-staff-".concat(RAND()).concat(RAND());
-                    staffWriteErr = '';
-                    _u.label = 17;
-                case 17:
-                    _u.trys.push([17, 19, , 20]);
-                    return [4 /*yield*/, sdk.api.calendar_events.updateOne(event_1.id, { startLinkToken: staffToken })];
-                case 18:
-                    _u.sent();
-                    return [3 /*break*/, 20];
-                case 19:
-                    e_1 = _u.sent();
-                    staffWriteErr = (_q = e_1 === null || e_1 === void 0 ? void 0 : e_1.message) !== null && _q !== void 0 ? _q : String(e_1);
-                    return [3 /*break*/, 20];
-                case 20:
-                    legit = null;
-                    _u.label = 21;
-                case 21:
-                    _u.trys.push([21, 23, , 24]);
-                    return [4 /*yield*/, new sdk_1.Session({ host: host }).api.calendar_events.session_for_start_link({ token: staffToken })];
-                case 22:
-                    legit = _u.sent();
-                    return [3 /*break*/, 24];
-                case 23:
-                    e_2 = _u.sent();
-                    legit = { error: (_r = e_2 === null || e_2 === void 0 ? void 0 : e_2.message) !== null && _r !== void 0 ? _r : String(e_2) };
-                    return [3 /*break*/, 24];
-                case 24:
-                    record('A2: staff-set start link still works', !!(legit === null || legit === void 0 ? void 0 : legit.authToken) && legit.eventId === event_1.id, "staffWrite=".concat(staffWriteErr ? 'REJECTED(' + staffWriteErr + ')' : 'ok', " authToken=").concat(!!(legit === null || legit === void 0 ? void 0 : legit.authToken), " eventId=").concat(legit === null || legit === void 0 ? void 0 : legit.eventId, " ").concat((legit === null || legit === void 0 ? void 0 : legit.error) ? '(' + legit.error + ')' : ''));
-                    enduserRead = null;
-                    _u.label = 25;
-                case 25:
-                    _u.trys.push([25, 27, , 28]);
-                    return [4 /*yield*/, patientSDK.api.calendar_events.getOne(event_1.id)];
-                case 26:
-                    enduserRead = _u.sent();
-                    return [3 /*break*/, 28];
-                case 27:
-                    _c = _u.sent();
-                    return [3 /*break*/, 28];
-                case 28:
-                    record('A4: startLinkToken redacted from enduser reads', !enduserRead || enduserRead.startLinkToken === undefined, "enduser read startLinkToken=".concat((_s = enduserRead === null || enduserRead === void 0 ? void 0 : enduserRead.startLinkToken) !== null && _s !== void 0 ? _s : '(absent)', " \u2014 could redeem a staff-set token"));
-                    return [4 /*yield*/, sdk.api.role_based_access_permissions.createOne({
-                            role: "F0185NonAdmin-".concat(RAND()),
-                            // Non-admin (non-Admin-role) staff with tenant-wide calendar READ — enough to load the event,
-                            // so the assertion isolates redaction (not access). Spread a valid full permissions shape.
-                            permissions: __assign(__assign({}, constants_1.PROVIDER_PERMISSIONS), { calendar_events: __assign(__assign({}, constants_1.PROVIDER_PERMISSIONS.calendar_events), { read: 'All', readMany: 'All' }) }),
-                        }).catch(function (e) { var _a; console.warn('A5 role create failed:', (_a = e === null || e === void 0 ? void 0 : e.message) !== null && _a !== void 0 ? _a : e); return null; })];
-                case 29:
-                    rbap = _u.sent();
-                    if (!rbap) return [3 /*break*/, 36];
-                    roleIds.push(rbap.id);
-                    return [4 /*yield*/, sdk.api.users.createOne({
-                            email: "f0185-nonadmin-".concat(RAND(), "@tellescope.example"), fname: 'F0185', lname: 'NonAdmin',
-                            verifiedEmail: true, notificationEmailsDisabled: true, roles: [rbap.role],
-                        })];
-                case 30:
-                    nonAdmin = _u.sent();
-                    userIds.push(nonAdmin.id);
-                    return [4 /*yield*/, sdk.api.users.generate_auth_token({ id: nonAdmin.id })];
-                case 31:
-                    authToken = (_u.sent()).authToken;
-                    nonAdminSDK = new sdk_1.Session({ host: host, authToken: authToken });
-                    staffRead = null;
-                    _u.label = 32;
-                case 32:
-                    _u.trys.push([32, 34, , 35]);
-                    return [4 /*yield*/, nonAdminSDK.api.calendar_events.getOne(event_1.id)];
-                case 33:
-                    staffRead = _u.sent();
-                    return [3 /*break*/, 35];
-                case 34:
-                    _d = _u.sent();
-                    return [3 /*break*/, 35];
-                case 35:
-                    record('A5: startLinkToken redacted from non-admin user reads', !staffRead || staffRead.startLinkToken === undefined, "non-admin user read startLinkToken=".concat((_t = staffRead === null || staffRead === void 0 ? void 0 : staffRead.startLinkToken) !== null && _t !== void 0 ? _t : '(absent)', " \u2014 staff\u2192host escalation via read"));
-                    return [3 /*break*/, 37];
-                case 36:
-                    record('A5: startLinkToken redacted from non-admin user reads', true, '(n/a — could not create a non-admin role in this env)');
-                    _u.label = 37;
-                case 37:
-                    // Report the full table before asserting (the harness exits on the first failed assert).
-                    console.log('\n  check summary:');
-                    for (_i = 0, checks_1 = checks; _i < checks_1.length; _i++) {
-                        c = checks_1[_i];
-                        console.log("    ".concat(c.pass ? 'PASS' : 'FAIL', "  ").concat(c.label, "  \u2014  ").concat(c.detail));
-                    }
-                    console.log('');
-                    for (_e = 0, checks_2 = checks; _e < checks_2.length; _e++) {
-                        c = checks_2[_e];
-                        (0, testing_1.assert)(c.pass, "".concat(c.label, " \u2014 ").concat(c.detail), c.label);
-                    }
-                    return [3 /*break*/, 63];
-                case 38:
-                    _f = 0, eventIds_1 = eventIds;
-                    _u.label = 39;
-                case 39:
-                    if (!(_f < eventIds_1.length)) return [3 /*break*/, 44];
-                    id = eventIds_1[_f];
-                    _u.label = 40;
-                case 40:
-                    _u.trys.push([40, 42, , 43]);
-                    return [4 /*yield*/, sdk.api.calendar_events.deleteOne(id)];
-                case 41:
-                    _u.sent();
-                    return [3 /*break*/, 43];
-                case 42:
-                    _g = _u.sent();
-                    return [3 /*break*/, 43];
-                case 43:
-                    _f++;
-                    return [3 /*break*/, 39];
-                case 44:
-                    _h = 0, enduserIds_1 = enduserIds;
-                    _u.label = 45;
-                case 45:
-                    if (!(_h < enduserIds_1.length)) return [3 /*break*/, 50];
-                    id = enduserIds_1[_h];
-                    _u.label = 46;
-                case 46:
-                    _u.trys.push([46, 48, , 49]);
-                    return [4 /*yield*/, sdk.api.endusers.deleteOne(id)];
-                case 47:
-                    _u.sent();
-                    return [3 /*break*/, 49];
-                case 48:
-                    _j = _u.sent();
-                    return [3 /*break*/, 49];
-                case 49:
-                    _h++;
-                    return [3 /*break*/, 45];
-                case 50:
-                    _k = 0, userIds_1 = userIds;
-                    _u.label = 51;
-                case 51:
-                    if (!(_k < userIds_1.length)) return [3 /*break*/, 56];
-                    id = userIds_1[_k];
-                    _u.label = 52;
-                case 52:
-                    _u.trys.push([52, 54, , 55]);
-                    return [4 /*yield*/, sdk.api.users.deleteOne(id)];
-                case 53:
-                    _u.sent();
-                    return [3 /*break*/, 55];
-                case 54:
-                    _l = _u.sent();
-                    return [3 /*break*/, 55];
-                case 55:
-                    _k++;
-                    return [3 /*break*/, 51];
-                case 56:
-                    _m = 0, roleIds_1 = roleIds;
-                    _u.label = 57;
-                case 57:
-                    if (!(_m < roleIds_1.length)) return [3 /*break*/, 62];
-                    id = roleIds_1[_m];
-                    _u.label = 58;
-                case 58:
-                    _u.trys.push([58, 60, , 61]);
-                    return [4 /*yield*/, sdk.api.role_based_access_permissions.deleteOne(id)];
-                case 59:
-                    _u.sent();
-                    return [3 /*break*/, 61];
-                case 60:
-                    _o = _u.sent();
-                    return [3 /*break*/, 61];
-                case 61:
-                    _m++;
-                    return [3 /*break*/, 57];
-                case 62: return [7 /*endfinally*/];
-                case 63: return [2 /*return*/];
-            }
-        });
+var startlinktoken_escalation_checks = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var checks, record, tenant, userIds, enduserIds, eventIds, roleIds, sdk, businessId, host_user, patient, event_1, _a, patientAuthToken, patientInfo, patientSDK, attackerToken, wrote, writeErr, err_1, adminView, redeemed, _b, staffToken, staffWriteErr, e_1, legit, e_2, enduserRead, enduserReadErr, e_3, roleCreateErr_1, rbap, nonAdmin, authToken, nonAdminSDK, staffRead, staffReadErr, e_4, sdk, _i, eventIds_1, id, _c, _d, enduserIds_1, id, _e, _f, userIds_1, id, _g, _h, roleIds_1, id, _j, e_5;
+    var _k, _l, _m, _o, _p, _q, _r;
+    return __generator(this, function (_s) {
+        switch (_s.label) {
+            case 0:
+                checks = [];
+                record = function (label, pass, detail) { return checks.push({ label: label, pass: pass, detail: detail }); };
+                userIds = [];
+                enduserIds = [];
+                eventIds = [];
+                roleIds = [];
+                _s.label = 1;
+            case 1:
+                _s.trys.push([1, , 39, 67]);
+                return [4 /*yield*/, (0, setup_isolated_1.setup_isolated_tenant)({
+                        name: "startLinkToken escalation ".concat(RAND()),
+                        users: [{ isAdmin: true }],
+                        apiKeys: 0,
+                    })];
+            case 2:
+                tenant = _s.sent();
+                sdk = tenant.sdk;
+                businessId = tenant.businessId;
+                return [4 /*yield*/, sdk.api.users.createOne({
+                        email: "f0185-host-".concat(RAND(), "@tellescope.example"), fname: 'F0185', lname: 'Host',
+                        verifiedEmail: true, notificationEmailsDisabled: true,
+                    })];
+            case 3:
+                host_user = _s.sent();
+                userIds.push(host_user.id);
+                return [4 /*yield*/, sdk.api.endusers.createOne({
+                        email: "f0185-patient-".concat(RAND(), "@tellescope.example"), fname: 'F0185', lname: 'Patient',
+                    })];
+            case 4:
+                patient = _s.sent();
+                enduserIds.push(patient.id);
+                return [4 /*yield*/, sdk.api.calendar_events.createOne({
+                        title: 'appointment', durationInMinutes: 30, startTimeInMS: Date.now() + 3600000,
+                        attendees: [{ type: 'user', id: host_user.id }, { type: 'enduser', id: patient.id }],
+                    })];
+            case 5:
+                event_1 = _s.sent();
+                eventIds.push(event_1.id);
+                return [4 /*yield*/, sdk.api.endusers.generate_auth_token({ id: patient.id })];
+            case 6:
+                _a = (_s.sent()), patientAuthToken = _a.authToken, patientInfo = _a.enduser;
+                patientSDK = new sdk_1.EnduserSession({
+                    host: host,
+                    authToken: patientAuthToken, enduser: patientInfo,
+                    businessId: businessId,
+                });
+                attackerToken = "f0185-attacker-".concat(RAND()).concat(RAND());
+                wrote = false, writeErr = '';
+                _s.label = 7;
+            case 7:
+                _s.trys.push([7, 9, , 10]);
+                return [4 /*yield*/, patientSDK.api.calendar_events.updateOne(event_1.id, { startLinkToken: attackerToken })];
+            case 8:
+                _s.sent();
+                wrote = true;
+                return [3 /*break*/, 10];
+            case 9:
+                err_1 = _s.sent();
+                writeErr = (_k = err_1 === null || err_1 === void 0 ? void 0 : err_1.message) !== null && _k !== void 0 ? _k : String(err_1);
+                return [3 /*break*/, 10];
+            case 10:
+                record('A1: enduser cannot write startLinkToken', !wrote, wrote ? 'PATCH ACCEPTED — patient set a staff start-link token' : "rejected (".concat(writeErr, ")"));
+                return [4 /*yield*/, sdk.api.calendar_events.getOne(event_1.id)];
+            case 11:
+                adminView = _s.sent();
+                if (!(adminView.startLinkToken === attackerToken)) return [3 /*break*/, 16];
+                redeemed = null;
+                _s.label = 12;
+            case 12:
+                _s.trys.push([12, 14, , 15]);
+                return [4 /*yield*/, new sdk_1.Session({ host: host }).api.calendar_events.session_for_start_link({ token: attackerToken })];
+            case 13:
+                redeemed = _s.sent();
+                return [3 /*break*/, 15];
+            case 14:
+                _b = _s.sent();
+                return [3 /*break*/, 15];
+            case 15:
+                record('A3: enduser-set token does not mint a staff session', !(redeemed === null || redeemed === void 0 ? void 0 : redeemed.authToken), (redeemed === null || redeemed === void 0 ? void 0 : redeemed.authToken) ? "minted a STAFF authToken for host ".concat(host_user.id) : 'not redeemable');
+                return [3 /*break*/, 17];
+            case 16:
+                // A genuine conditional vector, not a skip: the value never landed because A1 blocked the
+                // write, which is exactly the fixed behaviour this check is defence-in-depth for.
+                record('A3: enduser-set token does not mint a staff session', true, '(n/a — write blocked, value never landed)');
+                _s.label = 17;
+            case 17:
+                staffToken = "f0185-staff-".concat(RAND()).concat(RAND());
+                staffWriteErr = '';
+                _s.label = 18;
+            case 18:
+                _s.trys.push([18, 20, , 21]);
+                return [4 /*yield*/, sdk.api.calendar_events.updateOne(event_1.id, { startLinkToken: staffToken })];
+            case 19:
+                _s.sent();
+                return [3 /*break*/, 21];
+            case 20:
+                e_1 = _s.sent();
+                staffWriteErr = (_l = e_1 === null || e_1 === void 0 ? void 0 : e_1.message) !== null && _l !== void 0 ? _l : String(e_1);
+                return [3 /*break*/, 21];
+            case 21:
+                legit = null;
+                _s.label = 22;
+            case 22:
+                _s.trys.push([22, 24, , 25]);
+                return [4 /*yield*/, new sdk_1.Session({ host: host }).api.calendar_events.session_for_start_link({ token: staffToken })];
+            case 23:
+                legit = _s.sent();
+                return [3 /*break*/, 25];
+            case 24:
+                e_2 = _s.sent();
+                legit = { error: (_m = e_2 === null || e_2 === void 0 ? void 0 : e_2.message) !== null && _m !== void 0 ? _m : String(e_2) };
+                return [3 /*break*/, 25];
+            case 25:
+                record('A2: staff-set start link still works', !!(legit === null || legit === void 0 ? void 0 : legit.authToken) && legit.eventId === event_1.id, "staffWrite=".concat(staffWriteErr ? 'REJECTED(' + staffWriteErr + ')' : 'ok', " authToken=").concat(!!(legit === null || legit === void 0 ? void 0 : legit.authToken), " eventId=").concat(legit === null || legit === void 0 ? void 0 : legit.eventId, " ").concat((legit === null || legit === void 0 ? void 0 : legit.error) ? '(' + legit.error + ')' : ''));
+                enduserRead = null, enduserReadErr = '';
+                _s.label = 26;
+            case 26:
+                _s.trys.push([26, 28, , 29]);
+                return [4 /*yield*/, patientSDK.api.calendar_events.getOne(event_1.id)];
+            case 27:
+                enduserRead = _s.sent();
+                return [3 /*break*/, 29];
+            case 28:
+                e_3 = _s.sent();
+                enduserReadErr = (_o = e_3 === null || e_3 === void 0 ? void 0 : e_3.message) !== null && _o !== void 0 ? _o : String(e_3);
+                return [3 /*break*/, 29];
+            case 29:
+                record('A4: startLinkToken redacted from enduser reads', !enduserRead || enduserRead.startLinkToken === undefined, 
+                // The detail distinguishes "read succeeded, token absent" from "read failed", which both
+                // satisfy the predicate: a blocked read proves nothing about redaction.
+                "enduser read startLinkToken=".concat((_p = enduserRead === null || enduserRead === void 0 ? void 0 : enduserRead.startLinkToken) !== null && _p !== void 0 ? _p : '(absent)')
+                    + "".concat(enduserRead ? '' : " \u2014 READ FAILED (".concat(enduserReadErr !== '' ? enduserReadErr : 'no error message', "), so the READ gate was not probed"))
+                    + " \u2014 could redeem a staff-set token");
+                roleCreateErr_1 = '';
+                return [4 /*yield*/, sdk.api.role_based_access_permissions.createOne({
+                        role: "F0185NonAdmin-".concat(RAND()),
+                        // Non-admin (non-Admin-role) staff with tenant-wide calendar READ — enough to load the event,
+                        // so the assertion isolates redaction (not access). Spread a valid full permissions shape.
+                        permissions: __assign(__assign({}, constants_1.PROVIDER_PERMISSIONS), { calendar_events: __assign(__assign({}, constants_1.PROVIDER_PERMISSIONS.calendar_events), { read: 'All', readMany: 'All' }) }),
+                    }).catch(function (e) { var _a; roleCreateErr_1 = (_a = e === null || e === void 0 ? void 0 : e.message) !== null && _a !== void 0 ? _a : String(e); return null; })];
+            case 30:
+                rbap = _s.sent();
+                if (!rbap) return [3 /*break*/, 37];
+                roleIds.push(rbap.id);
+                return [4 /*yield*/, sdk.api.users.createOne({
+                        email: "f0185-nonadmin-".concat(RAND(), "@tellescope.example"), fname: 'F0185', lname: 'NonAdmin',
+                        verifiedEmail: true, notificationEmailsDisabled: true, roles: [rbap.role],
+                    })];
+            case 31:
+                nonAdmin = _s.sent();
+                userIds.push(nonAdmin.id);
+                return [4 /*yield*/, sdk.api.users.generate_auth_token({ id: nonAdmin.id })];
+            case 32:
+                authToken = (_s.sent()).authToken;
+                nonAdminSDK = new sdk_1.Session({ host: host, authToken: authToken });
+                staffRead = null, staffReadErr = '';
+                _s.label = 33;
+            case 33:
+                _s.trys.push([33, 35, , 36]);
+                return [4 /*yield*/, nonAdminSDK.api.calendar_events.getOne(event_1.id)];
+            case 34:
+                staffRead = _s.sent();
+                return [3 /*break*/, 36];
+            case 35:
+                e_4 = _s.sent();
+                staffReadErr = (_q = e_4 === null || e_4 === void 0 ? void 0 : e_4.message) !== null && _q !== void 0 ? _q : String(e_4);
+                return [3 /*break*/, 36];
+            case 36:
+                record('A5: startLinkToken redacted from non-admin user reads', !staffRead || staffRead.startLinkToken === undefined, 
+                // Same as A4: a read this low-privilege user could not perform at all also satisfies the
+                // predicate, so the detail says which of the two happened.
+                "non-admin user read startLinkToken=".concat((_r = staffRead === null || staffRead === void 0 ? void 0 : staffRead.startLinkToken) !== null && _r !== void 0 ? _r : '(absent)')
+                    + "".concat(staffRead ? '' : " \u2014 READ FAILED (".concat(staffReadErr !== '' ? staffReadErr : 'no error message', "), so the READ gate was not probed"))
+                    + " \u2014 staff\u2192host escalation via read");
+                return [3 /*break*/, 38];
+            case 37:
+                // Previously a PASSING "(n/a)" check, which reported green without probing the READ gate at
+                // all. On a tenant this suite provisioned, the admin can always create a role — a failure here
+                // is a real defect, so it fails and carries the error.
+                record('A5: startLinkToken redacted from non-admin user reads', false, "could not create a non-admin role on this freshly provisioned tenant, so the staff READ gate "
+                    + "was never probed: ".concat(roleCreateErr_1 !== '' ? roleCreateErr_1 : '(no error message)'));
+                _s.label = 38;
+            case 38: return [3 /*break*/, 67];
+            case 39:
+                if (!tenant) return [3 /*break*/, 66];
+                sdk = tenant.sdk;
+                _i = 0, eventIds_1 = eventIds;
+                _s.label = 40;
+            case 40:
+                if (!(_i < eventIds_1.length)) return [3 /*break*/, 45];
+                id = eventIds_1[_i];
+                _s.label = 41;
+            case 41:
+                _s.trys.push([41, 43, , 44]);
+                return [4 /*yield*/, sdk.api.calendar_events.deleteOne(id)];
+            case 42:
+                _s.sent();
+                return [3 /*break*/, 44];
+            case 43:
+                _c = _s.sent();
+                return [3 /*break*/, 44];
+            case 44:
+                _i++;
+                return [3 /*break*/, 40];
+            case 45:
+                _d = 0, enduserIds_1 = enduserIds;
+                _s.label = 46;
+            case 46:
+                if (!(_d < enduserIds_1.length)) return [3 /*break*/, 51];
+                id = enduserIds_1[_d];
+                _s.label = 47;
+            case 47:
+                _s.trys.push([47, 49, , 50]);
+                return [4 /*yield*/, sdk.api.endusers.deleteOne(id)];
+            case 48:
+                _s.sent();
+                return [3 /*break*/, 50];
+            case 49:
+                _e = _s.sent();
+                return [3 /*break*/, 50];
+            case 50:
+                _d++;
+                return [3 /*break*/, 46];
+            case 51:
+                _f = 0, userIds_1 = userIds;
+                _s.label = 52;
+            case 52:
+                if (!(_f < userIds_1.length)) return [3 /*break*/, 57];
+                id = userIds_1[_f];
+                _s.label = 53;
+            case 53:
+                _s.trys.push([53, 55, , 56]);
+                return [4 /*yield*/, sdk.api.users.deleteOne(id)];
+            case 54:
+                _s.sent();
+                return [3 /*break*/, 56];
+            case 55:
+                _g = _s.sent();
+                return [3 /*break*/, 56];
+            case 56:
+                _f++;
+                return [3 /*break*/, 52];
+            case 57:
+                _h = 0, roleIds_1 = roleIds;
+                _s.label = 58;
+            case 58:
+                if (!(_h < roleIds_1.length)) return [3 /*break*/, 63];
+                id = roleIds_1[_h];
+                _s.label = 59;
+            case 59:
+                _s.trys.push([59, 61, , 62]);
+                return [4 /*yield*/, sdk.api.role_based_access_permissions.deleteOne(id)];
+            case 60:
+                _s.sent();
+                return [3 /*break*/, 62];
+            case 61:
+                _j = _s.sent();
+                return [3 /*break*/, 62];
+            case 62:
+                _h++;
+                return [3 /*break*/, 58];
+            case 63:
+                _s.trys.push([63, 65, , 66]);
+                return [4 /*yield*/, tenant.teardown()];
+            case 64:
+                _s.sent();
+                return [3 /*break*/, 66];
+            case 65:
+                e_5 = _s.sent();
+                console.error('teardown failed', e_5);
+                return [3 /*break*/, 66];
+            case 66: return [7 /*endfinally*/];
+            case 67: return [2 /*return*/, checks];
+        }
     });
-};
+}); };
+exports.startlinktoken_escalation_checks = startlinktoken_escalation_checks;
+/** Asserting wrapper, for standalone runs. */
+var startlinktoken_escalation_tests = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var _a, _b;
+    return __generator(this, function (_c) {
+        switch (_c.label) {
+            case 0:
+                _a = setup_isolated_1.assert_checks;
+                _b = ['startLinkToken escalation'];
+                return [4 /*yield*/, (0, exports.startlinktoken_escalation_checks)()];
+            case 1:
+                _a.apply(void 0, _b.concat([_c.sent()]));
+                return [2 /*return*/];
+        }
+    });
+}); };
 exports.startlinktoken_escalation_tests = startlinktoken_escalation_tests;
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+exports.ISOLATED_SUITE = {
+    name: 'startLinkToken escalation',
+    run: exports.startlinktoken_escalation_checks,
+};
 if (require.main === module) {
-    var sdk_2 = new sdk_1.Session({ host: host });
-    var sdkNonAdmin_1 = new sdk_1.Session({ host: host });
-    (0, setup_1.setup_tests)(sdk_2, sdkNonAdmin_1)
-        .then(function () { return (0, exports.startlinktoken_escalation_tests)({ sdk: sdk_2, sdkNonAdmin: sdkNonAdmin_1 }); })
+    console.log("\uD83C\uDF10 Using API URL: ".concat(host));
+    (0, exports.startlinktoken_escalation_tests)()
         .then(function () { console.log("✅ startLinkToken escalation test suite completed successfully"); process.exit(0); })
         .catch(function (error) { console.error("❌ startLinkToken escalation test suite failed:", error); process.exit(1); });
 }