@xenon-device-management/xenon 1.29.1 → 2.0.0

package/lib/src/XenonCapabilityManager.js

@@ -49,7 +49,6 @@ exports.XENON_CAPABILITIES = void 0;
 exports.androidCapabilities = androidCapabilities;
 exports.iOSCapabilities = iOSCapabilities;
 exports.extractTeamCap = extractTeamCap;
-exports.extractAccessKeyCap = extractAccessKeyCap;
 exports.extractAccessKeyTokenPair = extractAccessKeyTokenPair;
 exports.extractSessionToken = extractSessionToken;
 exports.getXenonCapabilities = getXenonCapabilities;
@@ -58,6 +57,7 @@ const lodash_1 = __importDefault(require("lodash"));
 const typedi_1 = require("typedi");
 const PortAllocator_1 = require("./services/PortAllocator");
 const logger_1 = __importDefault(require("./logger"));
+const xenonOptions_1 = require("./services/session/xenonOptions");
 var XENON_CAPABILITIES;
 (function (XENON_CAPABILITIES) {
     XENON_CAPABILITIES["BUILD_NAME"] = "build";
@@ -68,7 +68,6 @@ var XENON_CAPABILITIES;
     XENON_CAPABILITIES["LIVE_VIDEO"] = "live_video";
     XENON_CAPABILITIES["SCREENSHOT_ON_FAILURE"] = "screenshot_on_failure";
     XENON_CAPABILITIES["SCREENSHOT_ON_FAIL"] = "screenshotOnFailure";
-    XENON_CAPABILITIES["XENON_OPTIONS"] = "xenon:options";
     XENON_CAPABILITIES["SAVE_DEVICE_LOGS"] = "saveDeviceLogs";
     XENON_CAPABILITIES["SAVE_LOGS"] = "save_device_logs";
     XENON_CAPABILITIES["SCREENSHOT_ON_EVERY_COMMAND"] = "screenshot_on_every_command";
@@ -221,58 +220,33 @@ function extractTeamCap(caps) {
     }
     return undefined;
 }
-function extractAccessKeyCap(caps) {
-    var _a;
-    const merged = Object.assign({}, ((_a = caps.firstMatch) === null || _a === void 0 ? void 0 : _a[0]) || {}, caps.alwaysMatch || {});
-    const prefixes = ['xenon:', 'xe:', 'appium:', ''];
-    const names = ['accessKey', 'access_key'];
-    for (const prefix of prefixes) {
-        for (const name of names) {
-            const v = merged[prefix ? `${prefix}${name}` : name];
-            if (typeof v === 'string' && v.length > 0)
-                return v;
-        }
-    }
-    return undefined;
-}
-// Returns the (accessKey, token) pair from df:options.{accessKey,token} or
-// equivalently df:options.{access_key,token}. Returns undefined if either
-// piece is missing — callers fall back to extractAccessKeyCap (legacy).
+// Returns the API-key pair from xe:options.{accessKey,token} (or the
+// xenon:options alias; xe:options wins field by field). Returns undefined if
+// either piece is missing. This is the only key-pair credential a session can
+// present; there is no flat `xenon:accessKey`.
 function extractAccessKeyTokenPair(caps) {
-    var _a, _b, _c, _d;
-    const merged = Object.assign({}, ((_a = caps.firstMatch) === null || _a === void 0 ? void 0 : _a[0]) || {}, caps.alwaysMatch || {});
-    const dfOptions = (_c = (_b = merged['df:options']) !== null && _b !== void 0 ? _b : merged['xenon:df:options']) !== null && _c !== void 0 ? _c : merged['appium:df:options'];
-    if (!dfOptions || typeof dfOptions !== 'object')
-        return undefined;
-    const accessKey = (_d = dfOptions.accessKey) !== null && _d !== void 0 ? _d : dfOptions.access_key;
-    const token = dfOptions.token;
-    if (typeof accessKey !== 'string' || typeof token !== 'string')
-        return undefined;
-    if (!accessKey || !token)
-        return undefined;
-    return { accessKey, token };
+    const options = (0, xenonOptions_1.xenonOptionsOf)(caps);
+    const accessKey = (0, xenonOptions_1.stringOption)(options, 'accessKey');
+    const token = (0, xenonOptions_1.stringOption)(options, 'token');
+    return accessKey && token ? { accessKey, token } : undefined;
 }
-// Returns the xenon:options.sessionToken JWT (hub-minted, aud 'xenon-session'),
-// used by the opt-in session-token gate (spec §3 item 6, risk R9). Returns
-// null if absent — callers combine this with the df:options access-key/token
-// pair to decide whether createSession is authorized.
+// Returns the xe:options.sessionToken JWT (hub-minted, aud 'xenon-session'),
+// or the xenon:options alias's, used by the opt-in session-token gate (spec
+// §3 item 6, risk R9). Returns null if absent — callers combine this with the
+// access-key/token pair to decide whether createSession is authorized.
 function extractSessionToken(caps) {
     var _a;
-    const read = (obj) => {
-        const xo = obj === null || obj === void 0 ? void 0 : obj['xenon:options'];
-        const t = xo && typeof xo === 'object' ? xo.sessionToken : undefined;
-        return typeof t === 'string' && t.length > 0 ? t : null;
-    };
-    const fm = Array.isArray(caps === null || caps === void 0 ? void 0 : caps.firstMatch) ? caps.firstMatch[0] : undefined;
-    return (_a = read(caps === null || caps === void 0 ? void 0 : caps.alwaysMatch)) !== null && _a !== void 0 ? _a : read(fm);
+    return (_a = (0, xenonOptions_1.stringOption)((0, xenonOptions_1.xenonOptionsOf)(caps), 'sessionToken')) !== null && _a !== void 0 ? _a : null;
 }
 function getXenonCapabilities(caps) {
     var _a, _b;
     const mergedCapabilites = Object.assign({}, (_b = (_a = caps.firstMatch) === null || _a === void 0 ? void 0 : _a[0]) !== null && _b !== void 0 ? _b : {}, caps.alwaysMatch);
+    const xenonOptions = (0, xenonOptions_1.xenonOptionsIn)(mergedCapabilites);
     const getAnyCap = (snake, camel) => {
         // Strict prefix resolution: xe:, appium:, no-prefix — snake_case + camelCase fallbacks.
-        // Also accept the namespaced `xenon:options.<name>` form, which is how other Appium
-        // plugins document nested options and what most users naturally try first.
+        // Also accept the namespaced `xe:options.<name>` form (or its `xenon:options` alias),
+        // which is how other Appium plugins document nested options and what most users
+        // naturally try first.
         const prefixes = ['xe:', 'appium:', ''];
         const names = [snake, camel];
         for (const prefix of prefixes) {
@@ -282,12 +256,9 @@ function getXenonCapabilities(caps) {
                     return mergedCapabilites[key];
             }
         }
-        const xenonOptions = mergedCapabilites[XENON_CAPABILITIES.XENON_OPTIONS];
-        if (xenonOptions && typeof xenonOptions === 'object') {
-            for (const name of names) {
-                if (xenonOptions[name] !== undefined)
-                    return xenonOptions[name];
-            }
+        for (const name of names) {
+            if (xenonOptions[name] !== undefined)
+                return xenonOptions[name];
         }
         return undefined;
     };

package/lib/src/app/index.js

@@ -55,7 +55,7 @@ const cors_1 = __importDefault(require("cors"));
 const async_lock_1 = __importDefault(require("async-lock"));
 const crypto_1 = __importDefault(require("crypto"));
 const InternalHttpClient_1 = require("../InternalHttpClient");
-const logger_1 = __importDefault(require("../logger"));
+const logger_1 = __importStar(require("../logger"));
 const sessionContext_1 = require("../logging/sessionContext");
 const dashboard_1 = __importDefault(require("./routers/dashboard"));
 const grid_1 = __importDefault(require("./routers/grid"));
@@ -80,6 +80,8 @@ const capabilities_1 = require("./routers/capabilities");
 const projects_1 = require("./routers/projects");
 const audit_1 = require("./routers/audit");
 const authMiddleware_1 = require("../middleware/authMiddleware");
+const roleGuard_1 = require("../middleware/roleGuard");
+const scopeGuard_1 = require("../middleware/scopeGuard");
 const rateLimitMiddleware_1 = require("../middleware/rateLimitMiddleware");
 const csrfMiddleware_1 = require("../middleware/csrfMiddleware");
 const swagger_1 = require("./swagger");
@@ -254,9 +256,11 @@ function createRouter(pluginArgs) {
     // MCP audit ingest: the 2b gateway ships batched tool-call audit JSONL here,
     // authenticated as a service identity (roleGuard(MEMBER) + admin scope).
     apiRouter.use('/audit', (0, audit_1.auditRouter)());
-    // Exposes plugin CLI args (may include host, hub URL, etc.) — auth-gated.
-    apiRouter.get('/cliArgs', (_req, res) => __awaiter(this, void 0, void 0, function* () {
-        res.json(yield (0, pluginArgs_1.getCLIArgs)());
+    // The stored Appium arguments: a database URL with its password, AI and
+    // cloud provider keys, the hub URL. Admin-only, like /processes, and
+    // redacted the way the startup log redacts them.
+    apiRouter.get('/cliArgs', (0, roleGuard_1.roleGuard)('ADMIN'), (0, scopeGuard_1.scopeGuard)(['admin']), (_req, res) => __awaiter(this, void 0, void 0, function* () {
+        res.json((0, logger_1.redactSecrets)(yield (0, pluginArgs_1.getCLIArgs)()));
     }));
     // Prometheus-style metrics — auth-gated to avoid operational recon.
     apiRouter.get('/metrics', (_req, res) => __awaiter(this, void 0, void 0, function* () {

package/lib/src/app/insertBeforeRoutes.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.routerStackOf = routerStackOf;
+exports.insertBeforeRoutes = insertBeforeRoutes;
+function isRouter(candidate) {
+    return !!candidate && Array.isArray(candidate.stack);
+}
+function findRouter(app) {
+    if (!app)
+        return undefined;
+    if (isRouter(app._router))
+        return { router: app._router, shape: 'express4' };
+    let router;
+    try {
+        // Express 4 defines `app.router` as a getter that throws a deprecation
+        // error. Express 5 defines it as the router itself.
+        router = app.router;
+    }
+    catch (_a) {
+        router = undefined;
+    }
+    if (isRouter(router))
+        return { router, shape: 'express5' };
+    return undefined;
+}
+/** The app's router stack, or undefined when neither Express shape has one. */
+function routerStackOf(app) {
+    var _a;
+    return (_a = findRouter(app)) === null || _a === void 0 ? void 0 : _a.router.stack;
+}
+function insertBeforeRoutes(app, path, handler) {
+    const found = findRouter(app);
+    if (!found) {
+        return {
+            placed: false,
+            reason: 'no Express router found (neither app._router nor app.router has a stack)',
+        };
+    }
+    const { stack } = found.router;
+    const lengthBefore = stack.length;
+    app.use(path, handler);
+    const added = stack.splice(lengthBefore);
+    if (added.length !== 1) {
+        // app.use() added its layer somewhere other than the stack we found, or
+        // added more than one. Put back whatever it added and refuse to guess.
+        stack.push(...added);
+        return {
+            placed: false,
+            shape: found.shape,
+            reason: `app.use() added ${added.length} layers to the router stack, expected 1`,
+        };
+    }
+    const firstRoute = stack.findIndex((layer) => !!layer.route);
+    const index = firstRoute === -1 ? stack.length : firstRoute;
+    stack.splice(index, 0, added[0]);
+    return { placed: true, shape: found.shape, index };
+}

package/lib/src/app/registerCommandAuth.js

@@ -0,0 +1,67 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeBasePath = normalizeBasePath;
+exports.sessionCommandPath = sessionCommandPath;
+exports.registerCommandAuth = registerCommandAuth;
+const typedi_1 = require("typedi");
+const logger_1 = __importDefault(require("../logger"));
+const config_1 = require("../config");
+const SessionOwnerResolver_1 = require("../services/device-access/SessionOwnerResolver");
+const commandAuth_1 = require("../middleware/commandAuth");
+const commandCaller_1 = require("../middleware/commandCaller");
+const insertBeforeRoutes_1 = require("./insertBeforeRoutes");
+/**
+ * Appium's base-path rule (base-driver `normalizeBasePath`): drop one trailing
+ * '/', and add a leading '/' unless the path is empty. `cliArgs.basePath`
+ * reaches a plugin as the operator wrote it, while Appium normalises its own
+ * copy before building routes, so the guard must normalise the same way or it
+ * would miss the routes it is meant to sit in front of.
+ */
+function normalizeBasePath(basePath) {
+    let normalized = typeof basePath === 'string' ? basePath : '';
+    normalized = normalized.replace(/\/$/, '');
+    if (normalized !== '' && !normalized.startsWith('/'))
+        normalized = `/${normalized}`;
+    return normalized;
+}
+/**
+ * Everything under `<basePath>/session/:sessionId`, every method. The create
+ * route (`POST <basePath>/session`) has no id segment and does not match.
+ */
+function sessionCommandPath(basePath) {
+    return `${normalizeBasePath(basePath)}/session/:sessionId`;
+}
+/**
+ * Install per-command auth (commandAuth.ts) ahead of Appium's routes. Called
+ * from ServerManager.registerRoutes, which Appium runs after adding them.
+ *
+ * The middleware is always installed and reads the setting per request, so a
+ * server with the setting off pays one env check per session command and does
+ * no lookups. If it cannot be placed ahead of the routes the error is logged,
+ * and with the setting on (and auth enabled) the server refuses to start:
+ * an operator who asked for the check must not get a server that silently
+ * serves session commands without it.
+ */
+function registerCommandAuth(app, cliArgs, overrides = {}) {
+    const deps = Object.assign({ enabled: () => (0, commandAuth_1.commandAuthEnabled)(), authDisabled: () => config_1.config.authDisabled === true, verifier: new commandCaller_1.CommandCallerVerifier(), ownerOf: (sessionId) => typedi_1.Container.get(SessionOwnerResolver_1.SessionOwnerResolver).ownerOf(sessionId), logger: logger_1.default.scope('CommandAuth') }, overrides);
+    const path = sessionCommandPath(cliArgs === null || cliArgs === void 0 ? void 0 : cliArgs.basePath);
+    const result = (0, insertBeforeRoutes_1.insertBeforeRoutes)(app, path, (0, commandAuth_1.createCommandAuthMiddleware)(deps));
+    const active = deps.enabled() && !deps.authDisabled();
+    if (!result.placed) {
+        deps.logger.error(`Per-command auth could not be placed ahead of Appium's routes for ${path}: ${result.reason}.`);
+        if (active) {
+            throw new Error('XENON_REQUIRE_COMMAND_AUTH is on, but the per-command check could not be placed ahead ' +
+                "of Appium's WebDriver routes, so it would never run. Refusing to start rather than " +
+                'serve session commands unchecked.');
+        }
+        return result;
+    }
+    deps.logger.info(active
+        ? `Per-command auth is ON: every request under ${path} needs the session owner's ` +
+            'credentials or an override admin (XENON_REQUIRE_COMMAND_AUTH).'
+        : `Per-command auth is off for ${path} (XENON_REQUIRE_COMMAND_AUTH not set, or auth disabled).`);
+    return result;
+}

package/lib/src/app/routers/apps.js

@@ -20,15 +20,22 @@ const logger_1 = __importDefault(require("../../logger"));
 const fs_extra_1 = __importDefault(require("fs-extra"));
 const scopeGuard_1 = require("../../middleware/scopeGuard");
 const roleGuard_1 = require("../../middleware/roleGuard");
+const appVisibility_1 = require("../../services/device-access/appVisibility");
+const prisma_1 = require("../../prisma");
 const router = (0, express_1.Router)();
 // MEMBER-tier baseline: device app visibility requires authenticated user
 router.use((0, roleGuard_1.roleGuard)('MEMBER'));
 // Uploading an APK/IPA or deleting one from the fleet requires devices scope.
 // App listings stay readable to any authenticated key.
 router.use((0, scopeGuard_1.mutationScopeGuard)(['devices']));
+// Uploaded apps follow the device team rule on the app's team (canSeeApp):
+// admins see every app, members shared apps and their teams'. An app the
+// caller can't see answers every route exactly as an unknown id.
+const UNKNOWN_APP = { error: 'App not found' };
 router.get('/', (req, res) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
     try {
-        const apps = yield app_service_1.APP_SERVICE.getApps();
+        const apps = yield app_service_1.APP_SERVICE.getApps((_a = req.auth) === null || _a === void 0 ? void 0 : _a.teamIds);
         res.json(apps);
     }
     catch (err) {
@@ -57,15 +64,29 @@ router.get('/', (req, res) => __awaiter(void 0, void 0, void 0, function* () {
  * is not joined onto a path.
  */
 exports.DOWNLOAD_OPTIONS = { dotfiles: 'allow' };
+/**
+ * Whether this request may see the app. A download ticket (authMiddleware's
+ * app-ticket path) was team-checked when it was minted and is bound to one
+ * app, so it sees that app and nothing else; everyone else by the team rule.
+ */
+function canRequestSeeApp(req, app) {
+    var _a, _b;
+    if (!app)
+        return false;
+    if (((_a = req.auth) === null || _a === void 0 ? void 0 : _a.kind) === 'app-ticket')
+        return req.auth.appId === app.id;
+    return (0, appVisibility_1.canSeeApp)(app, (_b = req.auth) === null || _b === void 0 ? void 0 : _b.teamIds);
+}
 function downloadApp(req, res) {
     return __awaiter(this, void 0, void 0, function* () {
         try {
             const app = yield app_service_1.APP_SERVICE.getAppById(req.params.id);
-            if (app && (yield fs_extra_1.default.exists(app.filepath))) {
+            // The ticket path sends with DOWNLOAD_OPTIONS too: it is this same call.
+            if (app && canRequestSeeApp(req, app) && (yield fs_extra_1.default.exists(app.filepath))) {
                 res.download(app.filepath, app.filename, exports.DOWNLOAD_OPTIONS);
             }
             else {
-                res.status(404).json({ error: 'App not found' });
+                res.status(404).json(UNKNOWN_APP);
             }
         }
         catch (err) {
@@ -75,7 +96,26 @@ function downloadApp(req, res) {
     });
 }
 router.get('/:id/download', downloadApp);
+/**
+ * The team an upload or a move names: a string id, or null for the shared
+ * pool. Undefined, null and '' all mean shared; anything else that is not a
+ * string is refused.
+ */
+function parseTeamId(value) {
+    if (value === undefined || value === null || value === '')
+        return { ok: true, teamId: null };
+    if (typeof value === 'string')
+        return { ok: true, teamId: value };
+    return { ok: false };
+}
+function teamExists(teamId) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const team = yield prisma_1.prisma.team.findUnique({ where: { id: teamId }, select: { id: true } });
+        return !!team;
+    });
+}
 router.post('/upload', (0, roleGuard_1.roleGuard)('ADMIN'), (req, res) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
     if (!req.files || Object.keys(req.files).length === 0) {
         return res.status(400).json({ error: 'No files were uploaded.' });
     }
@@ -83,9 +123,18 @@ router.post('/upload', (0, roleGuard_1.roleGuard)('ADMIN'), (req, res) => __awai
     if (!appFile) {
         return res.status(400).json({ error: 'Field "app" is required.' });
     }
+    // Optional multipart field. Checked before anything is written, so a bad
+    // team stores nothing.
+    const team = parseTeamId((_a = req.body) === null || _a === void 0 ? void 0 : _a.teamId);
+    if (!team.ok)
+        return res.status(400).json({ error: 'teamId must be a string' });
     try {
-        const app = yield app_service_1.APP_SERVICE.uploadApp(appFile);
-        logger_1.default.audit('APP_UPLOAD', req.ip, { appId: app.id, name: app.name });
+        if (team.teamId && !(yield teamExists(team.teamId))) {
+            return res.status(400).json({ error: 'team not found' });
+        }
+        // An upload of bytes already stored returns that app, in its own team.
+        const app = yield app_service_1.APP_SERVICE.uploadApp(appFile, team.teamId);
+        logger_1.default.audit('APP_UPLOAD', req.ip, { appId: app.id, name: app.name, teamId: app.teamId });
         res.json(app);
     }
     catch (err) {
@@ -93,8 +142,37 @@ router.post('/upload', (0, roleGuard_1.roleGuard)('ADMIN'), (req, res) => __awai
         res.status(500).json({ error: err.message });
     }
 }));
+/**
+ * Moves an app to a team, or back to the shared pool with `{ teamId: null }`.
+ * Shaped like PUT /grid/device/:udid/team: admin role and scope, 404 for an
+ * unknown team or app, `{ ok, updated }`.
+ */
+router.put('/:id/team', (0, roleGuard_1.roleGuard)('ADMIN'), (0, scopeGuard_1.scopeGuard)(['admin']), (req, res) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
+    const team = parseTeamId((_a = req.body) === null || _a === void 0 ? void 0 : _a.teamId);
+    if (!team.ok)
+        return res.status(400).json({ error: 'teamId must be a string or null' });
+    try {
+        if (team.teamId && !(yield teamExists(team.teamId))) {
+            return res.status(404).json({ error: 'team not found' });
+        }
+        const updated = yield app_service_1.APP_SERVICE.setAppTeam(req.params.id, team.teamId);
+        if (updated === 0)
+            return res.status(404).json(UNKNOWN_APP);
+        logger_1.default.audit('APP_TEAM', req.ip, { appId: req.params.id, teamId: team.teamId });
+        res.json({ ok: true, updated });
+    }
+    catch (err) {
+        logger_1.default.error(`Failed to move app ${req.params.id}: ${err.message}`);
+        res.status(500).json({ error: err.message });
+    }
+}));
 router.delete('/:id', (0, roleGuard_1.roleGuard)('ADMIN'), (req, res) => __awaiter(void 0, void 0, void 0, function* () {
     try {
+        // Unknown and hidden alike: 404 with the unknown body, nothing deleted.
+        const app = yield app_service_1.APP_SERVICE.getAppById(req.params.id);
+        if (!canRequestSeeApp(req, app))
+            return res.status(404).json(UNKNOWN_APP);
         yield app_service_1.APP_SERVICE.deleteApp(req.params.id);
         logger_1.default.audit('APP_DELETE', req.ip, { appId: req.params.id });
         res.sendStatus(204);

package/lib/src/app/routers/auth.js

@@ -64,7 +64,7 @@ function issueToken(auth, body) {
                 roles: grant.roles,
             }, { audience, ttlSeconds: expiresIn });
             // Session-token capability (spec §3 item 6 / R9): a sibling credential the
-            // client injects as `xenon:options.sessionToken` so the Appium createSession
+            // client injects as `xe:options.sessionToken` so the Appium createSession
             // interceptor can refuse tokenless direct-connect sessions when the gate is on.
             const sessionToken = yield svc.sign({ sub: auth.userId, teamId: (_c = auth.teamId) !== null && _c !== void 0 ? _c : null }, { audience: 'xenon-session', ttlSeconds: expiresIn });
             return { token, expiresIn, audience, scopes: grant.granular, sessionToken };

package/lib/src/app/routers/capabilities.js

@@ -4,6 +4,7 @@ exports.buildCapabilities = buildCapabilities;
 exports.capabilitiesRouter = capabilitiesRouter;
 const express_1 = require("express");
 const sessionTokenGate_1 = require("../../services/sessionTokenGate");
+const commandAuth_1 = require("../../middleware/commandAuth");
 // eslint-disable-next-line @typescript-eslint/no-var-requires
 const pkg = require('../../../package.json');
 function buildCapabilities() {
@@ -18,6 +19,9 @@ function buildCapabilities() {
             projects: true, // Task 8
             mcpScopedTokens: true, // Tasks 1-3: granular-claim minting available
             sessionTokenGate: (0, sessionTokenGate_1.sessionTokenGateEnabled)(), // Task 4: live XENON_REQUIRE_SESSION_TOKEN value
+            // Live XENON_REQUIRE_COMMAND_AUTH value: when true, every WebDriver
+            // session command must carry the x-xenon-* pair or a Bearer token.
+            commandAuth: (0, commandAuth_1.commandAuthEnabled)(),
         },
     };
 }

package/lib/src/app/routers/control.js

@@ -66,6 +66,7 @@ const fs_extra_1 = __importDefault(require("fs-extra"));
 const OmniVisionService_1 = require("../../services/omni-vision/OmniVisionService");
 const InspectorService_1 = require("../../services/InspectorService");
 const StreamTicketService_1 = require("../../services/token/StreamTicketService");
+const appVisibility_1 = require("../../services/device-access/appVisibility");
 const PluginContext_1 = require("../../PluginContext");
 const streamType_1 = require("./streamType");
 const iosStreamPort_1 = require("./iosStreamPort");
@@ -496,6 +497,7 @@ router.post('/:udid/install', (req, res) => __awaiter(void 0, void 0, void 0, fu
     res.status(400).send('Manager not found or installApp not supported');
 }));
 router.post('/:udid/install-repository-app', (req, res) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
     const { udid } = req.params;
     const { appId } = req.body;
     const device = yield getDeviceInfo(udid);
@@ -504,8 +506,11 @@ router.post('/:udid/install-repository-app', (req, res) => __awaiter(void 0, voi
     try {
         const { APP_SERVICE } = yield Promise.resolve().then(() => __importStar(require('../../dashboard/services/app-service')));
         const app = yield APP_SERVICE.getAppById(appId);
-        if (!app)
+        // Installing hands over the binary as a download does: another team's
+        // app answers as an unknown one.
+        if (!(0, appVisibility_1.canSeeApp)(app, (_a = req.auth) === null || _a === void 0 ? void 0 : _a.teamIds)) {
             return res.status(404).send('App not found in repository');
+        }
         const manager = yield getDeviceManagerForPlatform(device.platform);
         if (manager && manager.installApp) {
             // If it's a local file, pass the path.

package/lib/src/app/routers/dashboard.js

@@ -374,7 +374,14 @@ function getHealingHotspots(request, response) {
             ? request.query.platform
             : null;
         const status = (_a = request.query.status) !== null && _a !== void 0 ? _a : 'active';
-        const agg = yield aggregateHotspots({ windowDays, limit, tier, platform, status });
+        const agg = yield aggregateHotspots({
+            windowDays,
+            limit,
+            tier,
+            platform,
+            status,
+            sessionWhere: yield (0, sessionVisibility_1.visibleSessionWhere)(authOf(request)),
+        });
         return response.status(200).json({
             windowDays,
             totalScanned: agg.totalScanned,
@@ -417,9 +424,18 @@ function aggregateHotspots(opts) {
         };
         if (opts.tier)
             where.healing_tier = opts.tier;
+        // The platform and build filter, and the caller's sessions, under AND: the
+        // caller's rule is an OR, and a spread would let one OR overwrite another.
+        const sessionFilters = [];
         if (opts.platform || opts.buildId) {
-            where.session = Object.assign(Object.assign({}, (opts.platform ? { device_platform: opts.platform } : {})), (opts.buildId ? { build_id: opts.buildId } : {}));
+            sessionFilters.push(Object.assign(Object.assign({}, (opts.platform ? { device_platform: opts.platform } : {})), (opts.buildId ? { build_id: opts.buildId } : {})));
         }
+        if (opts.sessionWhere)
+            sessionFilters.push(opts.sessionWhere);
+        if (sessionFilters.length === 1)
+            where.session = sessionFilters[0];
+        else if (sessionFilters.length > 1)
+            where.session = { AND: sessionFilters };
         const rows = yield prisma_1.prisma.sessionLog.findMany({
             where,
             select: {
@@ -518,6 +534,11 @@ function aggregateHotspots(opts) {
         // then merge them into each hotspot. The default `status=active` filter
         // hides muted/pending/resolved selectors so the live list, CI gate, and
         // webhook digest all see only "still actively breaking" selectors.
+        //
+        // The state is looked up only for selectors already in this (scoped) list,
+        // but the row is lab-wide and not scoped: `status`, `regression_count`,
+        // `clean_builds_count`, `last_event_at`, `resolved_at` and the
+        // `*_by_api_key` ids move with any team's heals, builds and admin actions.
         let stateMap = new Map();
         if (topHotspots.length > 0) {
             const states = yield prisma_1.prisma.selectorState.findMany({
@@ -573,6 +594,7 @@ function getHealingViolations(request, response) {
             platform,
             buildId,
             minHealCount,
+            sessionWhere: yield (0, sessionVisibility_1.visibleSessionWhere)(authOf(request)),
         });
         return response.status(200).json({
             windowDays,
@@ -599,6 +621,8 @@ function sendHealingDigest(request, response) {
         const minHealCount = Number.isFinite(minHealCountRaw)
             ? Math.min(Math.max(minHealCountRaw, 1), 1000)
             : 2;
+        // Every team's heals, on purpose: admin-only, and the digest goes to the
+        // lab's webhooks rather than back to one caller.
         const agg = yield aggregateHotspots({ windowDays, limit, minHealCount });
         const payload = {
             windowDays,
@@ -761,6 +785,7 @@ function getSelectorHealth(request, response) {
             windowDays: 365,
             limit: 1000,
             status: 'all',
+            sessionWhere: yield (0, sessionVisibility_1.visibleSessionWhere)(authOf(request)),
         });
         let rows = agg.hotspots;
         if (selectorFilter) {
@@ -783,7 +808,8 @@ function getSelectorHealth(request, response) {
             // LocatorEtalon.selector is unique, so a lookup by selector alone
             // already pins the row; the strategy check guards against treating a
             // stale/unrelated etalon (selector reused under a different strategy)
-            // as a match for this hotspot's (selector, strategy) tuple.
+            // as a match for this hotspot's (selector, strategy) tuple. Shared, not
+            // scoped: one etalon per selector, refreshed by any team's session.
             const etalon = yield etalonService.getSignature(h.originalSelector);
             if (etalon && etalon.strategy === h.originalStrategy) {
                 out.etalonAge = now - etalon.lastSeen;
@@ -846,6 +872,11 @@ function postSelectorStateAction(request, response) {
 // hotspot aggregator) so muted-but-no-recent-heal entries still surface.
 // Each row is enriched with `last_healed_at` from the most recent healed
 // SessionLog row for that tuple (null if never healed).
+//
+// The mute is lab-wide state, so every caller gets the same rows and
+// `muted_at`, `muted_by_api_key` and `regression_count`. `last_healed_at` is
+// heal data, so it is the latest heal among the sessions the caller may see:
+// null for a selector only another team has healed.
 function getMutedSelectors(request, response) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a, _b;
@@ -858,13 +889,10 @@ function getMutedSelectors(request, response) {
             skip: offset,
         });
         const total = yield prisma_1.prisma.selectorState.count({ where: { status: 'muted' } });
+        const scope = yield visibleLogScope(request);
         const enriched = yield Promise.all(muted.map((s) => __awaiter(this, void 0, void 0, function* () {
             const last = yield prisma_1.prisma.sessionLog.findFirst({
-                where: {
-                    original_strategy: s.original_strategy,
-                    original_selector: s.original_selector,
-                    is_healed: true,
-                },
+                where: Object.assign({ original_strategy: s.original_strategy, original_selector: s.original_selector, is_healed: true }, scope),
                 orderBy: { createdAt: 'desc' },
                 select: { createdAt: true },
             });
@@ -883,7 +911,8 @@ function getMutedSelectors(request, response) {
 // Single-tuple state lookup. Strategy and value arrive URL-encoded since
 // XPath selectors contain `/` and `[`. Returns `{ state: null }` when no
 // row exists (intentional — null is meaningful: the selector is implicitly
-// active).
+// active). The raw SelectorState row only, with no heal-derived field, so it
+// answers the same for every caller: the row is lab-wide state.
 function getSelectorStateByTuple(request, response) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a, _b;
@@ -1054,6 +1083,8 @@ function register(router) {
     router.get('/session/:sessionId/logs/debug', getDebugLogs);
     router.get('/session/:sessionId/profiling', getProfilingData);
     router.get('/session/:sessionId/asset/:kind/:file', getSessionAsset);
+    // The healing reads count only heals from sessions the caller may see
+    // (visibleSessionWhere); the digest below counts every team's.
     router.get('/healing/events', getRecentHealingEvents);
     router.get('/healing/summary', getHealingSummary);
     router.get('/healing/hotspots', getHealingHotspots);
@@ -1065,7 +1096,10 @@ function register(router) {
     router.post('/healing/digest/send', (0, roleGuard_1.roleGuard)('ADMIN'), (0, scopeGuard_1.scopeGuard)(['admin']), sendHealingDigest);
     // SelectorState lifecycle: state mutations require admin (they affect what
     // shows up in the live hotspot list, the CI gate, and the digest); the two
-    // reads inherit the existing dashboard auth.
+    // reads inherit the existing dashboard auth. Both reads stay global, not
+    // team-scoped: a selector's mute or fix is one lab-wide row with no team
+    // column, shared by every team whose tests use that selector. The one
+    // heal-derived field, the muted list's `last_healed_at`, is the caller's.
     router.post('/healing/selector/state', (0, roleGuard_1.roleGuard)('ADMIN'), (0, scopeGuard_1.scopeGuard)(['admin']), postSelectorStateAction);
     router.get('/healing/state/muted', getMutedSelectors);
     router.get('/healing/state/:strategy/:value', getSelectorStateByTuple);