@xenon-device-management/xenon 1.29.0 → 2.0.0

package/lib/src/app/routers/dashboard.js

@@ -61,11 +61,26 @@ const roleGuard_1 = require("../../middleware/roleGuard");
 const build_export_1 = __importDefault(require("./build-export"));
 const NotificationService_1 = require("../../services/NotificationService");
 const SelectorStateService_1 = require("../../services/SelectorStateService");
-const device_service_1 = require("../../data-service/device-service");
+const path_1 = __importDefault(require("path"));
+const config_1 = require("../../config");
+const sessionVisibility_1 = require("../../services/device-access/sessionVisibility");
 const HealEtalonService_1 = require("../../services/healing/HealEtalonService");
 const logger_1 = __importDefault(require("../../logger"));
 const MJPEG_PROXY_CACHE = new Map();
-//session guard
+const authOf = (request) => request.auth;
+/**
+ * Only the healed logs of sessions the caller may see (visibleSessionWhere),
+ * as a SessionLog `where` fragment; empty for an admin.
+ */
+function visibleLogScope(request) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const where = yield (0, sessionVisibility_1.visibleSessionWhere)(authOf(request));
+        return where ? { session: { is: where } } : {};
+    });
+}
+// Session guard, on every /session/:sessionId route: the session must exist
+// and be one the caller may see (canSeeSession). Another team's session gets
+// exactly the unknown-id answer, so it can't be told apart from none.
 function isValidSession(request, response, next) {
     return __awaiter(this, void 0, void 0, function* () {
         const sessionId = request.params.sessionId;
@@ -74,7 +89,7 @@ function isValidSession(request, response, next) {
                 id: sessionId,
             },
         });
-        if (!session) {
+        if (!session || !(yield (0, sessionVisibility_1.canSeeSession)(session, authOf(request)))) {
             return response.status(404).send({
                 error: true,
                 message: `Session with id ${sessionId} not found`,
@@ -108,50 +123,38 @@ function getSessions(request, response) {
                 { tags: { contains: query } },
             ];
         }
+        // The team rule is part of the query, so `take` counts the caller's sessions.
+        const visible = yield (0, sessionVisibility_1.visibleSessionWhere)(authOf(request));
         const sessions = yield prisma_1.prisma.session.findMany({
             orderBy: {
                 createdAt: 'desc',
             },
-            where,
+            where: visible ? { AND: [where, visible] } : where,
             take: 500,
         });
-        // Phase 4A: filter to sessions whose underlying device is visible.
-        const auth = request.auth;
-        const visible = yield (0, device_service_1.filterRowsByVisibleDevice)(sessions, auth === null || auth === void 0 ? void 0 : auth.teamIds, 'device_udid');
-        return response.status(200).json(visible);
+        return response.status(200).json(sessions);
     });
 }
 function getBuilds(request, response) {
     return __awaiter(this, void 0, void 0, function* () {
+        // A build is listed if the caller may see at least one of its sessions, and
+        // its counts are over those sessions only: builds are shared by name, so
+        // one build can hold several teams' sessions. Admins get every session.
+        const visible = yield (0, sessionVisibility_1.visibleSessionWhere)(authOf(request));
         const builds = yield prisma_1.prisma.build.findMany({
             orderBy: {
                 createdAt: 'desc',
             },
             include: {
-                _count: {
-                    select: { sessions: true },
-                },
-                sessions: {
-                    select: {
+                sessions: Object.assign(Object.assign({}, (visible ? { where: visible } : {})), { select: {
                         status: true,
                         device_udid: true,
-                    },
-                },
+                    } }),
             },
         });
-        // Phase 4A: a build is visible if at least one of its sessions runs on a
-        // device the caller can see. Admins (teamIds undefined) skip the filter.
-        const auth = request.auth;
-        let visibleBuilds = builds;
-        if ((auth === null || auth === void 0 ? void 0 : auth.teamIds) !== undefined) {
-            const filtered = yield Promise.all(builds.map((b) => __awaiter(this, void 0, void 0, function* () {
-                const visibleSessions = yield (0, device_service_1.filterRowsByVisibleDevice)(b.sessions, auth.teamIds, 'device_udid');
-                return { build: b, hasVisible: visibleSessions.length > 0 };
-            })));
-            visibleBuilds = filtered.filter((x) => x.hasVisible).map((x) => x.build);
-        }
+        const visibleBuilds = visible ? builds.filter((b) => b.sessions.length > 0) : builds;
         // Principal formatting: Add a flat summary object for the frontend
-        const formattedBuilds = visibleBuilds.map((b) => (Object.assign(Object.assign({}, b), { sessionCount: b._count.sessions, passedCount: b.sessions.filter((s) => ['success', 'passed'].includes(s.status)).length, failedCount: b.sessions.filter((s) => s.status === 'failed').length, runningCount: b.sessions.filter((s) => s.status === 'running').length, sessions: undefined })));
+        const formattedBuilds = visibleBuilds.map((b) => (Object.assign(Object.assign({}, b), { _count: { sessions: b.sessions.length }, sessionCount: b.sessions.length, passedCount: b.sessions.filter((s) => ['success', 'passed'].includes(s.status)).length, failedCount: b.sessions.filter((s) => s.status === 'failed').length, runningCount: b.sessions.filter((s) => s.status === 'running').length, sessions: undefined })));
         return response.status(200).json(formattedBuilds);
     });
 }
@@ -161,21 +164,10 @@ function getSessionById(request, response) {
         const session = yield prisma_1.prisma.session.findUnique({
             where: { id: sessionId },
         });
+        // isValidSession has already refused an unknown or hidden session.
         if (!session) {
             return response.status(404).json({ error: true, message: 'Session not found' });
         }
-        // Phase 4A: 404 if the session's device is not visible to the caller.
-        const auth = request.auth;
-        if ((auth === null || auth === void 0 ? void 0 : auth.teamIds) !== undefined) {
-            const dev = yield prisma_1.prisma.device.findFirst({
-                where: { udid: session.device_udid },
-                select: { teamId: true },
-            });
-            const visible = dev && (dev.teamId === null || auth.teamIds.includes(dev.teamId));
-            if (!visible) {
-                return response.status(404).json({ error: true, message: 'Session not found' });
-            }
-        }
         return response.status(200).json(session);
     });
 }
@@ -233,9 +225,11 @@ function getRecentHealingEvents(request, response) {
         const limitRaw = parseInt(request.query.limit || '50', 10);
         const limit = Number.isFinite(limitRaw) ? Math.min(Math.max(limitRaw, 1), 200) : 50;
         const sessionId = request.query.sessionId || undefined;
+        // Another team's session, even by ?sessionId=, reads as one with no heals.
+        const scope = yield visibleLogScope(request);
         const [rows, todayCount] = yield Promise.all([
             prisma_1.prisma.sessionLog.findMany({
-                where: Object.assign({ is_healed: true }, (sessionId ? { session_id: sessionId } : {})),
+                where: Object.assign(Object.assign({ is_healed: true }, (sessionId ? { session_id: sessionId } : {})), scope),
                 orderBy: { createdAt: 'desc' },
                 take: limit,
                 include: {
@@ -250,7 +244,7 @@ function getRecentHealingEvents(request, response) {
                 },
             }),
             prisma_1.prisma.sessionLog.count({
-                where: { is_healed: true, createdAt: { gte: startOfTodayUtc() } },
+                where: Object.assign({ is_healed: true, createdAt: { gte: startOfTodayUtc() } }, scope),
             }),
         ]);
         const events = rows.map((r) => {
@@ -309,13 +303,12 @@ function getHealingSummary(request, response) {
         since.setDate(since.getDate() - windowDays);
         const priorSince = new Date(since);
         priorSince.setDate(priorSince.getDate() - windowDays);
+        // Heal counts are over the caller's sessions. resolvedCount and pendingCount
+        // come from SelectorState, which has no team, so they stay fleet-wide.
+        const scope = yield visibleLogScope(request);
         const [currentRows, priorRows] = yield Promise.all([
             prisma_1.prisma.sessionLog.findMany({
-                where: {
-                    is_healed: true,
-                    createdAt: { gte: since, lte: now },
-                    original_selector: { not: null },
-                },
+                where: Object.assign({ is_healed: true, createdAt: { gte: since, lte: now }, original_selector: { not: null } }, scope),
                 select: {
                     session_id: true,
                     original_selector: true,
@@ -323,11 +316,7 @@ function getHealingSummary(request, response) {
                 },
             }),
             prisma_1.prisma.sessionLog.findMany({
-                where: {
-                    is_healed: true,
-                    createdAt: { gte: priorSince, lt: since },
-                    original_selector: { not: null },
-                },
+                where: Object.assign({ is_healed: true, createdAt: { gte: priorSince, lt: since }, original_selector: { not: null } }, scope),
                 select: {
                     session_id: true,
                     original_selector: true,
@@ -385,7 +374,14 @@ function getHealingHotspots(request, response) {
             ? request.query.platform
             : null;
         const status = (_a = request.query.status) !== null && _a !== void 0 ? _a : 'active';
-        const agg = yield aggregateHotspots({ windowDays, limit, tier, platform, status });
+        const agg = yield aggregateHotspots({
+            windowDays,
+            limit,
+            tier,
+            platform,
+            status,
+            sessionWhere: yield (0, sessionVisibility_1.visibleSessionWhere)(authOf(request)),
+        });
         return response.status(200).json({
             windowDays,
             totalScanned: agg.totalScanned,
@@ -428,9 +424,18 @@ function aggregateHotspots(opts) {
         };
         if (opts.tier)
             where.healing_tier = opts.tier;
+        // The platform and build filter, and the caller's sessions, under AND: the
+        // caller's rule is an OR, and a spread would let one OR overwrite another.
+        const sessionFilters = [];
         if (opts.platform || opts.buildId) {
-            where.session = Object.assign(Object.assign({}, (opts.platform ? { device_platform: opts.platform } : {})), (opts.buildId ? { build_id: opts.buildId } : {}));
+            sessionFilters.push(Object.assign(Object.assign({}, (opts.platform ? { device_platform: opts.platform } : {})), (opts.buildId ? { build_id: opts.buildId } : {})));
         }
+        if (opts.sessionWhere)
+            sessionFilters.push(opts.sessionWhere);
+        if (sessionFilters.length === 1)
+            where.session = sessionFilters[0];
+        else if (sessionFilters.length > 1)
+            where.session = { AND: sessionFilters };
         const rows = yield prisma_1.prisma.sessionLog.findMany({
             where,
             select: {
@@ -529,6 +534,11 @@ function aggregateHotspots(opts) {
         // then merge them into each hotspot. The default `status=active` filter
         // hides muted/pending/resolved selectors so the live list, CI gate, and
         // webhook digest all see only "still actively breaking" selectors.
+        //
+        // The state is looked up only for selectors already in this (scoped) list,
+        // but the row is lab-wide and not scoped: `status`, `regression_count`,
+        // `clean_builds_count`, `last_event_at`, `resolved_at` and the
+        // `*_by_api_key` ids move with any team's heals, builds and admin actions.
         let stateMap = new Map();
         if (topHotspots.length > 0) {
             const states = yield prisma_1.prisma.selectorState.findMany({
@@ -584,6 +594,7 @@ function getHealingViolations(request, response) {
             platform,
             buildId,
             minHealCount,
+            sessionWhere: yield (0, sessionVisibility_1.visibleSessionWhere)(authOf(request)),
         });
         return response.status(200).json({
             windowDays,
@@ -610,6 +621,8 @@ function sendHealingDigest(request, response) {
         const minHealCount = Number.isFinite(minHealCountRaw)
             ? Math.min(Math.max(minHealCountRaw, 1), 1000)
             : 2;
+        // Every team's heals, on purpose: admin-only, and the digest goes to the
+        // lab's webhooks rather than back to one caller.
         const agg = yield aggregateHotspots({ windowDays, limit, minHealCount });
         const payload = {
             windowDays,
@@ -652,12 +665,10 @@ function getHealingSelectorDetail(request, response) {
         const windowDays = parseWindowDays(request.query.windowDays);
         const since = new Date();
         since.setDate(since.getDate() - windowDays);
+        // Only the caller's sessions: a selector healed only on phones they can't
+        // see reads as one with no heals.
         const rows = yield prisma_1.prisma.sessionLog.findMany({
-            where: {
-                is_healed: true,
-                original_selector: value,
-                createdAt: { gte: since },
-            },
+            where: Object.assign({ is_healed: true, original_selector: value, createdAt: { gte: since } }, (yield visibleLogScope(request))),
             orderBy: { createdAt: 'desc' },
             take: 1000,
             include: {
@@ -774,6 +785,7 @@ function getSelectorHealth(request, response) {
             windowDays: 365,
             limit: 1000,
             status: 'all',
+            sessionWhere: yield (0, sessionVisibility_1.visibleSessionWhere)(authOf(request)),
         });
         let rows = agg.hotspots;
         if (selectorFilter) {
@@ -796,7 +808,8 @@ function getSelectorHealth(request, response) {
             // LocatorEtalon.selector is unique, so a lookup by selector alone
             // already pins the row; the strategy check guards against treating a
             // stale/unrelated etalon (selector reused under a different strategy)
-            // as a match for this hotspot's (selector, strategy) tuple.
+            // as a match for this hotspot's (selector, strategy) tuple. Shared, not
+            // scoped: one etalon per selector, refreshed by any team's session.
             const etalon = yield etalonService.getSignature(h.originalSelector);
             if (etalon && etalon.strategy === h.originalStrategy) {
                 out.etalonAge = now - etalon.lastSeen;
@@ -859,6 +872,11 @@ function postSelectorStateAction(request, response) {
 // hotspot aggregator) so muted-but-no-recent-heal entries still surface.
 // Each row is enriched with `last_healed_at` from the most recent healed
 // SessionLog row for that tuple (null if never healed).
+//
+// The mute is lab-wide state, so every caller gets the same rows and
+// `muted_at`, `muted_by_api_key` and `regression_count`. `last_healed_at` is
+// heal data, so it is the latest heal among the sessions the caller may see:
+// null for a selector only another team has healed.
 function getMutedSelectors(request, response) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a, _b;
@@ -871,13 +889,10 @@ function getMutedSelectors(request, response) {
             skip: offset,
         });
         const total = yield prisma_1.prisma.selectorState.count({ where: { status: 'muted' } });
+        const scope = yield visibleLogScope(request);
         const enriched = yield Promise.all(muted.map((s) => __awaiter(this, void 0, void 0, function* () {
             const last = yield prisma_1.prisma.sessionLog.findFirst({
-                where: {
-                    original_strategy: s.original_strategy,
-                    original_selector: s.original_selector,
-                    is_healed: true,
-                },
+                where: Object.assign({ original_strategy: s.original_strategy, original_selector: s.original_selector, is_healed: true }, scope),
                 orderBy: { createdAt: 'desc' },
                 select: { createdAt: true },
             });
@@ -896,7 +911,8 @@ function getMutedSelectors(request, response) {
 // Single-tuple state lookup. Strategy and value arrive URL-encoded since
 // XPath selectors contain `/` and `[`. Returns `{ state: null }` when no
 // row exists (intentional — null is meaningful: the selector is implicitly
-// active).
+// active). The raw SelectorState row only, with no heal-derived field, so it
+// answers the same for every caller: the row is lab-wide state.
 function getSelectorStateByTuple(request, response) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a, _b;
@@ -913,6 +929,34 @@ function getSelectorStateByTuple(request, response) {
         return response.json({ state: row });
     });
 }
+/** The session folders the dashboard shows (asset-manager.ts). Interceptor captures and recordings have their own rules. */
+const SESSION_ASSET_KINDS = new Set(['screenshots', 'video', 'performance']);
+/** One file name, no path and no leading dot. */
+const SESSION_ASSET_FILE = /^[A-Za-z0-9_-][A-Za-z0-9._-]*$/;
+/**
+ * A session's stored screenshot, video or performance trace, stored as
+ * `<sessionId>/<kind>/<file>` under sessionAssetsPath. Behind isValidSession,
+ * so the caller must be able to see the session. Supports Range, for video
+ * seeking. This replaced an express.static mount outside the API's login.
+ */
+function getSessionAsset(request, response) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const { sessionId, kind, file } = request.params;
+        const notFound = () => response.status(404).json({ error: true, message: 'Session asset not found' });
+        if (!SESSION_ASSET_KINDS.has(kind) || !SESSION_ASSET_FILE.test(file))
+            return notFound();
+        response.sendFile(file, {
+            root: path_1.default.join(config_1.config.sessionAssetsPath, sessionId, kind),
+            headers: { 'Cache-Control': 'private, max-age=300' },
+        }, (err) => {
+            if (!err || response.headersSent)
+                return;
+            if (err.status === 416 || err.statusCode === 416)
+                return response.status(416).end();
+            notFound();
+        });
+    });
+}
 function getProfilingData(request, response) {
     return __awaiter(this, void 0, void 0, function* () {
         const sessionId = request.params.sessionId;
@@ -1038,6 +1082,9 @@ function register(router) {
     router.get('/session/:sessionId/logs/device', getDeviceLogs);
     router.get('/session/:sessionId/logs/debug', getDebugLogs);
     router.get('/session/:sessionId/profiling', getProfilingData);
+    router.get('/session/:sessionId/asset/:kind/:file', getSessionAsset);
+    // The healing reads count only heals from sessions the caller may see
+    // (visibleSessionWhere); the digest below counts every team's.
     router.get('/healing/events', getRecentHealingEvents);
     router.get('/healing/summary', getHealingSummary);
     router.get('/healing/hotspots', getHealingHotspots);
@@ -1049,7 +1096,10 @@ function register(router) {
     router.post('/healing/digest/send', (0, roleGuard_1.roleGuard)('ADMIN'), (0, scopeGuard_1.scopeGuard)(['admin']), sendHealingDigest);
     // SelectorState lifecycle: state mutations require admin (they affect what
     // shows up in the live hotspot list, the CI gate, and the digest); the two
-    // reads inherit the existing dashboard auth.
+    // reads inherit the existing dashboard auth. Both reads stay global, not
+    // team-scoped: a selector's mute or fix is one lab-wide row with no team
+    // column, shared by every team whose tests use that selector. The one
+    // heal-derived field, the muted list's `last_healed_at`, is the caller's.
     router.post('/healing/selector/state', (0, roleGuard_1.roleGuard)('ADMIN'), (0, scopeGuard_1.scopeGuard)(['admin']), postSelectorStateAction);
     router.get('/healing/state/muted', getMutedSelectors);
     router.get('/healing/state/:strategy/:value', getSelectorStateByTuple);

package/lib/src/app/routers/grid.js

@@ -50,9 +50,10 @@ const queue_service_1 = require("../../data-service/queue-service");
 const InternalHttpClient_1 = require("../../InternalHttpClient");
 const lodash_1 = __importDefault(require("lodash"));
 const device_service_1 = require("../../data-service/device-service");
+const queueVisibility_1 = require("../../services/device-access/queueVisibility");
 const scopeGuard_1 = require("../../middleware/scopeGuard");
 const roleGuard_1 = require("../../middleware/roleGuard");
-const logger_1 = __importDefault(require("../../logger"));
+const logger_1 = __importStar(require("../../logger"));
 const device_managers_1 = require("../../device-managers");
 const typedi_1 = require("typedi");
 const prisma_1 = require("../../prisma");
@@ -204,38 +205,22 @@ function unBlockDevice(request, response) {
         response.status(200).send({ success: true });
     });
 }
-// Phase 4A: Pending sessions hold a JSON-decoded capability bag, not a row
-// from the Session model — they may carry `appium:udid` if the test runner
-// targeted a specific device, but most queue items are platform-only.
-// Strategy: rows with `appium:udid` get visibility-filtered against that
-// udid; rows without one pass through (the capability could still match any
-// device the caller can see, and there's no row-level ownership to enforce).
-function filterPendingByVisibleDevice(rows, teamIds) {
-    return __awaiter(this, void 0, void 0, function* () {
-        if (teamIds === undefined)
-            return rows;
-        const targeted = rows.filter((r) => typeof r['appium:udid'] === 'string' && r['appium:udid']);
-        const untargeted = rows.filter((r) => !(typeof r['appium:udid'] === 'string' && r['appium:udid']));
-        if (targeted.length === 0)
-            return untargeted;
-        const visibleTargeted = yield (0, device_service_1.filterRowsByVisibleDevice)(targeted, teamIds, 'appium:udid');
-        return [...untargeted, ...visibleTargeted];
-    });
-}
+const queueCaller = (request) => request.auth;
 function getQueuedSessionLength(request, response) {
     return __awaiter(this, void 0, void 0, function* () {
-        const auth = request.auth;
         const all = yield pendingStore.getAllPendingSessions();
-        const visible = yield filterPendingByVisibleDevice(all, auth === null || auth === void 0 ? void 0 : auth.teamIds);
-        response.json(visible.length);
+        response.json(all.length);
     });
 }
 function getQueuedSessionRequests(request, response) {
     return __awaiter(this, void 0, void 0, function* () {
-        const auth = request.auth;
         const all = yield pendingStore.getAllPendingSessions();
-        const visible = yield filterPendingByVisibleDevice(all, auth === null || auth === void 0 ? void 0 : auth.teamIds);
-        response.json(visible);
+        const { visible } = yield (0, queueVisibility_1.partitionPendingForCaller)(all, queueCaller(request));
+        // A row is the capabilities the client sent. createSession takes the
+        // credentials out of xe:options before writing it, but a row queued by an
+        // older server can still hold the key and token that signed it. Those are
+        // nobody else's to read, a teammate's or an admin's.
+        response.json(visible.map((row) => (0, logger_1.redactSecrets)((0, queueVisibility_1.withoutRequester)(row))));
     });
 }
 function getNodes(request, response) {
@@ -260,39 +245,32 @@ function getNodes(request, response) {
 }
 function getQueueStatusById(request, response) {
     return __awaiter(this, void 0, void 0, function* () {
-        const status = yield typedi_1.Container.get(queue_service_1.QueueService).getQueueStatus(request.params.capability_id);
-        if (!status) {
-            return response.status(404).json({ error: 'Pending session not found' });
-        }
-        // 404 the row if the underlying pending capability targets a device the
-        // caller can't see. Capability-only (no `appium:udid`) requests stay
-        // visible — there's no per-device ownership on them.
-        const auth = request.auth;
-        if ((auth === null || auth === void 0 ? void 0 : auth.teamIds) !== undefined) {
-            const allPending = yield pendingStore.getAllPendingSessions();
-            const target = allPending.find((s) => s.capability_id === request.params.capability_id);
-            const targetUdid = target && typeof target['appium:udid'] === 'string' ? target['appium:udid'] : undefined;
-            if (targetUdid) {
-                const dev = yield prisma_1.prisma.device.findFirst({
-                    where: { udid: targetUdid },
-                    select: { teamId: true },
-                });
-                const visible = dev && (dev.teamId === null || auth.teamIds.includes(dev.teamId));
-                if (!visible) {
-                    return response.status(404).json({ error: 'Pending session not found' });
-                }
-            }
+        const notFound = () => response.status(404).json({ error: 'Pending session not found' });
+        // A request the caller may not see answers exactly as an unknown id.
+        const caller = queueCaller(request);
+        if ((caller === null || caller === void 0 ? void 0 : caller.teamIds) !== undefined) {
+            const all = yield pendingStore.getAllPendingSessions();
+            const target = all.find((s) => s.capability_id === request.params.capability_id);
+            if (!target)
+                return notFound();
+            const { visible } = yield (0, queueVisibility_1.partitionPendingForCaller)([target], caller);
+            if (visible.length === 0)
+                return notFound();
         }
+        const status = yield typedi_1.Container.get(queue_service_1.QueueService).getQueueStatus(request.params.capability_id);
+        if (!status)
+            return notFound();
         response.json(status);
     });
 }
 function getQueueSummary(request, response) {
     return __awaiter(this, void 0, void 0, function* () {
-        // Global counters / per-platform aggregates only — no per-device or
-        // per-host breakdown. Admins and members see the same number; the team
-        // filter doesn't apply directly.
-        const summary = yield typedi_1.Container.get(queue_service_1.QueueService).getQueueSummary();
-        response.json(summary);
+        // Counts only. `total` is the whole queue, like /queue/length; `otherCount`
+        // is how many of those the caller doesn't get in detail from /queue.
+        const all = yield pendingStore.getAllPendingSessions();
+        const { otherCount } = yield (0, queueVisibility_1.partitionPendingForCaller)(all, queueCaller(request));
+        const summary = yield typedi_1.Container.get(queue_service_1.QueueService).getQueueSummary(all);
+        response.json(Object.assign(Object.assign({}, summary), { otherCount }));
     });
 }
 function nodeAdbStatusOnOtherHost(currentHost, request, response) {
@@ -478,12 +456,15 @@ function register(router, pluginArgs) {
     router.get('/queue/status/:capability_id', getQueueStatusById);
     router.get('/queue/summary', getQueueSummary);
     router.get('/sessions/active', getActiveSessions);
-    // debugging / observability
-    router.get('/logs/requests', getRequestLogs);
-    // node related routes
+    // debugging / observability. Admin-only, like /processes: the log holds
+    // every internal HTTP call, including control proxied to other nodes'
+    // phones (with what was typed) and forwarded new sessions (their ids).
+    router.get('/logs/requests', (0, roleGuard_1.roleGuard)('ADMIN'), (0, scopeGuard_1.scopeGuard)(['admin']), getRequestLogs);
+    // node related routes. The status reads list every attached phone, so
+    // they are admin-only too.
     router.get('/node', getNodes);
-    router.get('/node/status', nodeAdbStatusOnThisHost);
-    router.get('/node/:host/status', lodash_1.default.curry(nodeAdbStatusOnOtherHost)(pluginArgs.bindHostOrIp));
+    router.get('/node/status', (0, roleGuard_1.roleGuard)('ADMIN'), (0, scopeGuard_1.scopeGuard)(['admin']), nodeAdbStatusOnThisHost);
+    router.get('/node/:host/status', (0, roleGuard_1.roleGuard)('ADMIN'), (0, scopeGuard_1.scopeGuard)(['admin']), lodash_1.default.curry(nodeAdbStatusOnOtherHost)(pluginArgs.bindHostOrIp));
     // node status
     router.get('/status', (request, response) => {
         response.json({

package/lib/src/app/routers/recordings.js

@@ -464,7 +464,9 @@ router.get('/recordings/active', (req, res) => __awaiter(void 0, void 0, void 0,
     var _a;
     try {
         const actor = (0, actor_1.resolveActor)(req);
-        const rows = yield typedi_1.Container.get(recording_store_1.RecordingStore).listActiveWithMarks();
+        // A group the caller holds a phone of can hold phones they can't see (an
+        // admin added them, or a phone moved team): leave those out, and their marks.
+        const rows = yield visibleRows(req, yield typedi_1.Container.get(recording_store_1.RecordingStore).listActiveWithMarks());
         const locks = new Map();
         for (const udid of new Set(rows.map((r) => r.device_udid))) {
             const d = yield device_store_1.DeviceStoreFactory.getStore().findDevice({ udid });

package/lib/src/app/swagger-docs.js

@@ -414,9 +414,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
  *     summary: Read the plugin CLI arguments in effect
  *     description: |
  *       Returns the resolved plugin arguments (host, hub URL, platform, intervals, etc.)
- *       this process was started with. Sensitive fields (database URLs) are
- *       redacted by the logger but the raw object is returned over the wire to
- *       authenticated callers — do not expose this endpoint to untrusted networks.
+ *       this process was started with. Requires the ADMIN role and `admin` scope.
+ *       Values are redacted the way the logger redacts them: any key that looks
+ *       secret (database URL, API key, token, password, auth…) reads
+ *       `***REDACTED***`, and so do provider-key-shaped strings.
  *     tags: [Health & Ops]
  *     responses:
  *       200:
@@ -425,6 +426,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
  *           application/json:
  *             schema: { type: object, additionalProperties: true }
  *       401: { $ref: '#/components/responses/Unauthorized' }
+ *       403: { $ref: '#/components/responses/Forbidden' }
  *       429: { $ref: '#/components/responses/RateLimited' }
  */
 // =============================================================================
@@ -1107,7 +1109,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
  *     description: |
  *       Returns the queue position and ETA for a pending session keyed by the
  *       capability id you submitted. 404 if the request has already been
- *       allocated or expired.
+ *       allocated or expired, or is one the caller can't see in
+ *       `GET /api/queue`: the same answer as for an unknown id.
  *     tags: [Grid]
  *     parameters:
  *       - in: path

package/lib/src/app/swagger.js

@@ -34,6 +34,9 @@ Xenon's high-performance API provides programmatic access to the core orchestrat
 ### Authentication
 Every endpoint authenticates with the per-user \`(x-xenon-access-key, x-xenon-token)\` pair. Each token carries one or more scopes — \`read\`, \`sessions\`, \`devices\`, or \`admin\` (admin always satisfies any scope check). Mint tokens at \`/profile\` → **API Tokens**; the access key is shown at the top of that page and is rotatable. Browser dashboards may use the \`xenon_dashboard_session\` cookie set by \`POST /api/auth/login\`.
 
+### Appium sessions
+Appium's own \`POST /session\` is not under this API. A session authenticates with capabilities in \`xe:options\`, Xenon's capability namespace: \`accessKey\` + \`token\` (a token with the \`sessions\` scope), or a \`sessionToken\` minted by \`POST /api/auth/token\`. A leased device is named by \`leaseId\` + \`leaseToken\`, which the lease-create response's \`appiumCapabilities\` already carry. \`xenon:options\` is read as an alias (\`xe:options\` wins field by field); \`df:options\` is not read. Xenon removes the credentials before the driver or any stored record sees them.
+
 ### Rate limiting
 Every authenticated response carries \`X-RateLimit-Limit\`, \`X-RateLimit-Remaining\`, and \`X-RateLimit-Reset\` headers. Requests beyond the configured budget receive \`429 Too Many Requests\`.
         `,

package/lib/src/dashboard/event-manager.js

@@ -52,9 +52,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DASHBORD_EVENT_MANAGER = exports.DashboardEventManager = void 0;
+exports.storedSessionCapabilities = storedSessionCapabilities;
 const SessionManager_1 = require("../sessions/SessionManager");
 const prisma_1 = require("../prisma");
-const logger_1 = __importDefault(require("../logger"));
+const logger_1 = __importStar(require("../logger"));
 const session_service_1 = require("./services/session-service");
 const XenonCapabilityManager_1 = require("../XenonCapabilityManager");
 const lodash_1 = __importDefault(require("lodash"));
@@ -80,6 +81,21 @@ const types_1 = require("../services/healing/types");
 const SelectorStateService_1 = require("../services/SelectorStateService");
 const recording_store_1 = require("../services/recording/recording-store");
 const typedi_2 = require("typedi");
+/**
+ * What a Session row keeps of the capabilities the driver returned. The row
+ * is served to the dashboard and the session API, so any secret-named value
+ * is redacted. createSession already takes Xenon's own credentials out of
+ * xe:options and xenon:options before the driver sees them; this also covers
+ * a token a client put where Xenon doesn't read it, which the driver hands
+ * back in its response. The response itself is not changed.
+ */
+function storedSessionCapabilities(sessionResponse) {
+    const redacted = (0, logger_1.redactSecrets)(sessionResponse);
+    return {
+        desired_capabilities: JSON.stringify(redacted.desired || {}),
+        session_capabilities: JSON.stringify(lodash_1.default.omit(redacted, 'desired')),
+    };
+}
 let DashboardEventManager = class DashboardEventManager {
     constructor() {
         // private SCREENSHOT_FOR_COMMANDS = ['click', 'setUrl', 'setValue', 'performActions'];
@@ -133,26 +149,7 @@ let DashboardEventManager = class DashboardEventManager {
             const sessionResponse = lodash_1.default.assign({}, session.getCapabilities());
             const tracingService = typedi_1.Container.get(TracingService_1.TracingService);
             const traceId = tracingService.getTraceId(session.getId());
-            const createData = {
-                id: session.getId(),
-                build: build.id ? { connect: { id: build.id } } : undefined,
-                name: capabilities[XenonCapabilityManager_1.XENON_CAPABILITIES.SESSION_NAME] || undefined,
-                desired_capabilities: JSON.stringify(sessionResponse.desired || {}),
-                session_capabilities: JSON.stringify(lodash_1.default.omit(sessionResponse, 'desired')),
-                node_id: device.nodeId || '',
-                has_live_video: session.getLiveVideoUrl() !== null,
-                video_recording_enabled: capabilities[XenonCapabilityManager_1.XENON_CAPABILITIES.VIDEO_RECORDING] === true,
-                is_profiling_available: is_profiling_available || isIosProfilingStarted,
-                device_info: device_info ? JSON.stringify(device_info) : null,
-                device_udid: device.udid || '',
-                device_platform: device.platform || '',
-                device_version: device.sdk || '',
-                device_name: device.name,
-                trace_id: traceId,
-                status: 'running', // Principal Polish: Set status explicitly
-                api_key_id: (_a = session.apiKeyId) !== null && _a !== void 0 ? _a : null,
-                user_id: (_b = session.userId) !== null && _b !== void 0 ? _b : null,
-            };
+            const createData = Object.assign(Object.assign({ id: session.getId(), build: build.id ? { connect: { id: build.id } } : undefined, name: capabilities[XenonCapabilityManager_1.XENON_CAPABILITIES.SESSION_NAME] || undefined }, storedSessionCapabilities(sessionResponse)), { node_id: device.nodeId || '', has_live_video: session.getLiveVideoUrl() !== null, video_recording_enabled: capabilities[XenonCapabilityManager_1.XENON_CAPABILITIES.VIDEO_RECORDING] === true, is_profiling_available: is_profiling_available || isIosProfilingStarted, device_info: device_info ? JSON.stringify(device_info) : null, device_udid: device.udid || '', device_platform: device.platform || '', device_version: device.sdk || '', device_name: device.name, trace_id: traceId, status: 'running', api_key_id: (_a = session.apiKeyId) !== null && _a !== void 0 ? _a : null, user_id: (_b = session.userId) !== null && _b !== void 0 ? _b : null });
             yield prisma_1.prisma.session.create({
                 data: createData,
             });