evaldoc 1.0.0

package/tests/unit/safety-edge-cases.test.js

@@ -0,0 +1,509 @@
+/**
+ * Safety pipeline edge-case tests.
+ *
+ * Covers:
+ *   1. Combined input+output flow (blocked input skips output; escalated input flags)
+ *   2. False-negative coverage (near-miss phrases that should/shouldn't trigger)
+ *   3. NER integration (analyzeInput calls NER, processes entities)
+ *   4. PII edge cases (phone formats, credit cards, medical record numbers)
+ *   5. Output safety edge cases (diagnosis, treatment, dosing, disclaimers)
+ */
+
+jest.mock('firebase-admin', () => require('../mocks/firebase-admin'));
+
+// Keep a handle on the mock so individual tests can override it.
+// Jest requires out-of-scope variables referenced inside jest.mock() factories
+// to be prefixed with "mock" (case-insensitive).
+const mockNer = {
+  analyzeMedicalSafety: jest.fn().mockResolvedValue({
+    entities: [],
+    analysis: {},
+    shouldEscalate: false,
+    requiresDisclaimer: false
+  })
+};
+jest.mock('../../functions/src/ner', () => mockNer);
+
+const {
+  analyzeInput,
+  analyzeOutput,
+  redactText,
+  refusalMessage,
+  escalationMessage,
+  INPUT_BLOCKED,
+  OUTPUT_BLOCKED,
+  GLOBAL_REDFLAGS,
+  PII_PATTERNS
+} = require('../../functions/src/safety');
+
+const topicConfig = { forbiddenPatterns: [] };
+
+beforeEach(() => {
+  mockNer.analyzeMedicalSafety.mockReset();
+  mockNer.analyzeMedicalSafety.mockResolvedValue({
+    entities: [],
+    analysis: {},
+    shouldEscalate: false,
+    requiresDisclaimer: false
+  });
+});
+
+// ============================================================
+// 1. Combined input -> output flow
+// ============================================================
+describe('Combined input+output flow', () => {
+  it('blocked input should not require an output check', async () => {
+    const inputResult = await analyzeInput('prescribe me oxycodone', topicConfig);
+    expect(inputResult.blocked).toBe(true);
+    expect(inputResult.flags).toContain('blocked_input');
+
+    // Output check is independent of input — prescription language is blocked
+    const outputResult = analyzeOutput('Here is your prescription.', topicConfig);
+    expect(outputResult.blocked).toBe(true);
+
+    // Explicit clinical output is also caught:
+    const explicitOutput = analyzeOutput('You have strep throat. Start taking amoxicillin.', topicConfig);
+    expect(explicitOutput.blocked).toBe(true);
+  });
+
+  it('escalated input sets red_flag and escalated=true but does NOT block', async () => {
+    const result = await analyzeInput('I have chest pain and trouble breathing', topicConfig);
+    expect(result.escalated).toBe(true);
+    expect(result.flags).toContain('red_flag');
+    // Escalation alone should NOT block the input
+    expect(result.blocked).toBe(false);
+  });
+
+  it('input that is both blocked AND escalated sets both flags', async () => {
+    // "what should I take for" is blocked; "chest pain" is a red flag
+    const result = await analyzeInput('what should I take for chest pain', topicConfig);
+    expect(result.blocked).toBe(true);
+    expect(result.escalated).toBe(true);
+    expect(result.flags).toContain('blocked_input');
+    expect(result.flags).toContain('red_flag');
+  });
+
+  it('safe input followed by safe output produces no flags', async () => {
+    const inputResult = await analyzeInput('What causes headaches?', topicConfig);
+    expect(inputResult.blocked).toBe(false);
+    expect(inputResult.escalated).toBe(false);
+
+    const outputResult = analyzeOutput(
+      'Headaches can result from dehydration or stress. Please see your doctor if they persist.',
+      topicConfig
+    );
+    expect(outputResult.blocked).toBe(false);
+  });
+});
+
+// ============================================================
+// 2. False-negative coverage
+// ============================================================
+describe('False-negative coverage', () => {
+  // --- "diagnose me" vs "diagnostic test" ---
+  it('should block "diagnose me" (imperative medical request)', async () => {
+    // "give me a diagnosis" is the blocked pattern
+    const result = await analyzeInput('give me a diagnosis please', topicConfig);
+    expect(result.blocked).toBe(true);
+  });
+
+  it('should NOT block "diagnostic test" (legitimate medical term)', async () => {
+    const result = await analyzeInput('What is a diagnostic test for strep?', topicConfig);
+    expect(result.blocked).toBe(false);
+  });
+
+  it('should NOT block "diagnose" used in an educational context', async () => {
+    const result = await analyzeInput('How do doctors diagnose diabetes?', topicConfig);
+    expect(result.blocked).toBe(false);
+  });
+
+  // --- pill/medication requests ---
+  it('should block "what should I take for my cold" (direct pattern match)', async () => {
+    // Pattern: /\bwhat (?:should i|do i) take for\b/i
+    const result = await analyzeInput('what should I take for my cold', topicConfig);
+    expect(result.blocked).toBe(true);
+  });
+
+  it('should NOT block "what pills should I take for" (false negative -- word between "what" and "should")', async () => {
+    // Pattern: /\bwhat (?:should i|do i) take for\b/i expects "what should i"
+    // directly. Inserting "pills" between "what" and "should" causes a miss.
+    const result = await analyzeInput('what pills should I take for my cold', topicConfig);
+    expect(result.blocked).toBe(false);
+  });
+
+  it('should block "can you prescribe"', async () => {
+    // Pattern: /\bprescribe me\b/i -- needs "me" after prescribe
+    // "can you prescribe" doesn't say "prescribe me" literally.
+    // This tests the actual pattern coverage.
+    const result = await analyzeInput('can you prescribe me something for pain', topicConfig);
+    expect(result.blocked).toBe(true);
+  });
+
+  // --- escalation phrases ---
+  it('should escalate "my chest hurts"', async () => {
+    const result = await analyzeInput('my chest hurts really bad', topicConfig);
+    expect(result.escalated).toBe(true);
+  });
+
+  it('should escalate "I feel like dying"', async () => {
+    const result = await analyzeInput('I feel like dying', topicConfig);
+    expect(result.escalated).toBe(true);
+  });
+
+  it('should escalate "I want to die" (exact match)', async () => {
+    const result = await analyzeInput('I want to die', topicConfig);
+    expect(result.escalated).toBe(true);
+  });
+
+  it('should escalate "I want to end my life"', async () => {
+    const result = await analyzeInput('I want to end my life', topicConfig);
+    expect(result.escalated).toBe(true);
+  });
+
+  it('should NOT block general wellness questions', async () => {
+    const result = await analyzeInput('How much water should I drink daily?', topicConfig);
+    expect(result.blocked).toBe(false);
+  });
+
+  it('should NOT block "what is the best way to stay healthy"', async () => {
+    const result = await analyzeInput('what is the best way to stay healthy?', topicConfig);
+    expect(result.blocked).toBe(false);
+  });
+});
+
+// ============================================================
+// 3. NER integration
+// ============================================================
+describe('NER integration', () => {
+  it('analyzeInput calls analyzeMedicalSafety with the input text', async () => {
+    await analyzeInput('I have a headache', topicConfig);
+    expect(mockNer.analyzeMedicalSafety).toHaveBeenCalledWith('I have a headache');
+  });
+
+  it('processes NER entities and includes them in the result', async () => {
+    mockNer.analyzeMedicalSafety.mockResolvedValue({
+      entities: [
+        { text: 'headache', type: 'SYMPTOM', confidence: 0.95, start: 9, end: 17 }
+      ],
+      analysis: { hasSymptoms: true },
+      shouldEscalate: false,
+      requiresDisclaimer: true
+    });
+
+    const result = await analyzeInput('I have a headache', topicConfig);
+    expect(result.entities).toHaveLength(1);
+    expect(result.entities[0].type).toBe('SYMPTOM');
+    expect(result.flags).toContain('medical_entities_detected');
+  });
+
+  it('sets escalated=true when NER shouldEscalate is true', async () => {
+    mockNer.analyzeMedicalSafety.mockResolvedValue({
+      entities: [
+        { text: 'chest pain', type: 'SYMPTOM', confidence: 0.99, start: 0, end: 10 }
+      ],
+      analysis: { urgentSymptoms: ['chest pain'] },
+      shouldEscalate: true,
+      requiresDisclaimer: true
+    });
+
+    const result = await analyzeInput('experiencing discomfort', topicConfig);
+    expect(result.escalated).toBe(true);
+    expect(result.flags).toContain('red_flag');
+  });
+
+  it('flags pii_detected when NER entities contain PII types', async () => {
+    mockNer.analyzeMedicalSafety.mockResolvedValue({
+      entities: [
+        { text: 'John Smith', type: 'PER', confidence: 0.98, start: 0, end: 10 }
+      ],
+      analysis: {},
+      shouldEscalate: false,
+      requiresDisclaimer: false
+    });
+
+    const result = await analyzeInput('John Smith has a cough', topicConfig);
+    expect(result.flags).toContain('pii_detected');
+    expect(result.flags).toContain('medical_entities_detected');
+  });
+
+  it('flags pii_detected for PERSON entity type', async () => {
+    mockNer.analyzeMedicalSafety.mockResolvedValue({
+      entities: [
+        { text: 'Jane Doe', type: 'PERSON', confidence: 0.97, start: 0, end: 8 }
+      ],
+      analysis: {},
+      shouldEscalate: false,
+      requiresDisclaimer: false
+    });
+
+    const result = await analyzeInput('Jane Doe is here', topicConfig);
+    expect(result.flags).toContain('pii_detected');
+  });
+
+  it('flags pii_detected for B-PER prefixed entity type', async () => {
+    mockNer.analyzeMedicalSafety.mockResolvedValue({
+      entities: [
+        { text: 'Alice', type: 'B-PER', confidence: 0.96, start: 0, end: 5 }
+      ],
+      analysis: {},
+      shouldEscalate: false,
+      requiresDisclaimer: false
+    });
+
+    const result = await analyzeInput('Alice needs help', topicConfig);
+    expect(result.flags).toContain('pii_detected');
+  });
+
+  it('flags pii_detected for ORG (organization) entity type', async () => {
+    mockNer.analyzeMedicalSafety.mockResolvedValue({
+      entities: [
+        { text: 'Mayo Clinic', type: 'ORG', confidence: 0.95, start: 0, end: 11 }
+      ],
+      analysis: {},
+      shouldEscalate: false,
+      requiresDisclaimer: false
+    });
+
+    const result = await analyzeInput('I visited Mayo Clinic', topicConfig);
+    expect(result.flags).toContain('pii_detected');
+  });
+
+  it('gracefully handles NER failure and continues with regex-only checks', async () => {
+    mockNer.analyzeMedicalSafety.mockRejectedValue(new Error('NER service unavailable'));
+
+    const result = await analyzeInput('prescribe me antibiotics', topicConfig);
+    // Should still block via regex even when NER fails
+    expect(result.blocked).toBe(true);
+    expect(result.flags).toContain('blocked_input');
+    // NER-derived fields should be empty/default
+    expect(result.entities).toEqual([]);
+  });
+
+  it('does not flag pii_detected for non-PII entity types (MISC)', async () => {
+    mockNer.analyzeMedicalSafety.mockResolvedValue({
+      entities: [
+        { text: 'aspirin', type: 'MISC', confidence: 0.80, start: 0, end: 7 }
+      ],
+      analysis: {},
+      shouldEscalate: false,
+      requiresDisclaimer: false
+    });
+
+    const result = await analyzeInput('what about aspirin', topicConfig);
+    // MISC is not in PII_ENTITY_TYPES, so no pii_detected flag
+    expect(result.flags).not.toContain('pii_detected');
+    // But entity was still detected
+    expect(result.flags).toContain('medical_entities_detected');
+  });
+});
+
+// ============================================================
+// 4. PII edge cases
+// ============================================================
+describe('PII edge cases', () => {
+  // Phone numbers
+  it('should detect a 10-digit phone number (no separators)', async () => {
+    const result = await analyzeInput('call me at 5551234567', topicConfig);
+    expect(result.flags).toContain('pii_detected');
+  });
+
+  it('should redact a 10-digit phone number', () => {
+    expect(redactText('call me at 5551234567')).toBe('call me at [redacted]');
+  });
+
+  it('should detect SSN format as PII', async () => {
+    const result = await analyzeInput('my SSN is 123-45-6789', topicConfig);
+    expect(result.flags).toContain('pii_detected');
+  });
+
+  it('should detect email addresses as PII', async () => {
+    const result = await analyzeInput('send results to jane@hospital.org', topicConfig);
+    expect(result.flags).toContain('pii_detected');
+  });
+
+  it('should redact email addresses', () => {
+    expect(redactText('email jane.doe+test@hospital.org please')).toBe('email [redacted] please');
+  });
+
+  it('should detect a 16-digit credit card number', async () => {
+    const result = await analyzeInput('my card is 4111111111111111', topicConfig);
+    expect(result.flags).toContain('pii_detected');
+  });
+
+  // Medical record numbers
+  it('should flag medical record number via NER entity type', async () => {
+    mockNer.analyzeMedicalSafety.mockResolvedValue({
+      entities: [
+        { text: 'MRN-20230001', type: 'MEDICAL_RECORD', confidence: 0.92, start: 7, end: 19 }
+      ],
+      analysis: {},
+      shouldEscalate: false,
+      requiresDisclaimer: false
+    });
+
+    const result = await analyzeInput('My MRN MRN-20230001', topicConfig);
+    expect(result.flags).toContain('pii_detected');
+  });
+
+  it('should redact street addresses', () => {
+    expect(redactText('I live at 456 Oak Avenue')).toContain('[redacted');
+  });
+
+  it('should redact ZIP+4 codes', () => {
+    expect(redactText('ZIP: 90210-1234')).toContain('[redacted');
+  });
+
+  it('should redact date of birth in MM/DD/YYYY format', () => {
+    expect(redactText('DOB: 12/25/1985')).toContain('[redacted DOB]');
+  });
+
+  it('should handle multiple PII items in one string', () => {
+    const text = 'SSN 123-45-6789, email a@b.com, ZIP 90210';
+    const redacted = redactText(text);
+    expect(redacted).not.toContain('123-45-6789');
+    expect(redacted).not.toContain('a@b.com');
+    expect(redacted).not.toContain('90210');
+  });
+});
+
+// ============================================================
+// 5. Output safety edge cases
+// ============================================================
+describe('Output safety edge cases', () => {
+  // --- Should block (diagnosis) ---
+  it('should block "you might have" diagnosis pattern', () => {
+    const result = analyzeOutput('you might have diabetes', topicConfig);
+    expect(result.blocked).toBe(true);
+  });
+
+  it('should block "you have diabetes" (definitive diagnosis)', () => {
+    const result = analyzeOutput('you have diabetes', topicConfig);
+    expect(result.blocked).toBe(true);
+  });
+
+  it('should block "you are likely" diagnosis', () => {
+    const result = analyzeOutput('you are likely suffering from the flu', topicConfig);
+    expect(result.blocked).toBe(true);
+  });
+
+  it('should block "you are diagnosed" phrasing', () => {
+    const result = analyzeOutput('you are diagnosed with bronchitis', topicConfig);
+    expect(result.blocked).toBe(true);
+  });
+
+  // --- Should block (treatment) ---
+  it('should block "I recommend you try" treatment advice', () => {
+    const result = analyzeOutput('I recommend you try ibuprofen', topicConfig);
+    expect(result.blocked).toBe(true);
+  });
+
+  it('should block "start taking metformin"', () => {
+    const result = analyzeOutput('You should start taking metformin now.', topicConfig);
+    expect(result.blocked).toBe(true);
+  });
+
+  it('should block "stop using aspirin"', () => {
+    const result = analyzeOutput('You should stop using aspirin immediately.', topicConfig);
+    expect(result.blocked).toBe(true);
+  });
+
+  // --- Should block (dosing) ---
+  it('should block "take this twice daily" -- dosing instruction', () => {
+    // Pattern: /\btake \d+\s?(mg|ml|tablets?|capsules?)\b/i
+    // "take this twice daily" does NOT have a number after "take"
+    // This is a potential false negative if there's no numeric dosage.
+    const result = analyzeOutput('take this twice daily', topicConfig);
+    expect(result.blocked).toBe(false);
+  });
+
+  it('should block "take 2 tablets" (explicit dosing)', () => {
+    const result = analyzeOutput('take 2 tablets with water', topicConfig);
+    expect(result.blocked).toBe(true);
+  });
+
+  it('should block "500mg twice daily" dosing', () => {
+    const result = analyzeOutput('Use 500mg twice daily for 7 days', topicConfig);
+    expect(result.blocked).toBe(true);
+  });
+
+  it('should block "apply 2ml times"', () => {
+    const result = analyzeOutput('apply 2ml times a day to affected area', topicConfig);
+    expect(result.blocked).toBe(true);
+  });
+
+  // --- Should NOT block (disclaimers / safe referrals) ---
+  it('should NOT block "this is not medical advice"', () => {
+    const result = analyzeOutput('This is not medical advice. Please see your doctor.', topicConfig);
+    expect(result.blocked).toBe(false);
+  });
+
+  it('should NOT block "consult your doctor"', () => {
+    const result = analyzeOutput('Please consult your doctor before making any changes.', topicConfig);
+    expect(result.blocked).toBe(false);
+  });
+
+  it('should NOT block "you have the right to seek a second opinion"', () => {
+    const result = analyzeOutput('You have the right to seek a second opinion.', topicConfig);
+    expect(result.blocked).toBe(false);
+  });
+
+  it('should NOT block "you have access to many resources"', () => {
+    const result = analyzeOutput('You have access to many resources online.', topicConfig);
+    expect(result.blocked).toBe(false);
+  });
+
+  it('should NOT block "you have every right to ask"', () => {
+    const result = analyzeOutput('You have every right to ask for more information.', topicConfig);
+    expect(result.blocked).toBe(false);
+  });
+
+  it('should NOT block generic health education', () => {
+    const result = analyzeOutput(
+      'Vitamin C is found in citrus fruits and can support immune health.',
+      topicConfig
+    );
+    expect(result.blocked).toBe(false);
+  });
+});
+
+// ============================================================
+// 6. Helper function edge cases
+// ============================================================
+describe('Helper functions', () => {
+  it('refusalMessage returns a non-empty string', () => {
+    const msg = refusalMessage();
+    expect(typeof msg).toBe('string');
+    expect(msg.length).toBeGreaterThan(0);
+  });
+
+  it('escalationMessage returns a non-empty string', () => {
+    const msg = escalationMessage();
+    expect(typeof msg).toBe('string');
+    expect(msg.length).toBeGreaterThan(0);
+  });
+
+  it('analyzeInput handles null/undefined input gracefully', async () => {
+    const result = await analyzeInput(null, topicConfig);
+    expect(result.blocked).toBe(false);
+    expect(result.escalated).toBe(false);
+  });
+
+  it('analyzeInput handles missing topicConfig gracefully', async () => {
+    const result = await analyzeInput('hello');
+    expect(result.blocked).toBe(false);
+  });
+
+  it('analyzeOutput handles null/undefined input gracefully', () => {
+    const result = analyzeOutput(null, topicConfig);
+    expect(result.blocked).toBe(false);
+  });
+
+  it('analyzeOutput handles missing topicConfig gracefully', () => {
+    const result = analyzeOutput('hello');
+    expect(result.blocked).toBe(false);
+  });
+
+  it('redactText handles undefined input', () => {
+    expect(redactText(undefined)).toBe('');
+  });
+});