@xenon-device-management/xenon 1.7.2 → 1.7.3

package/lib/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@xenon-device-management/xenon",
-    "version": "1.7.2",
+    "version": "1.7.3",
     "description": "Xenon - Intelligent Mobile Infrastructure. A self-healing device orchestration platform for Appium.",
     "main": "./lib/src/index.js",
     "exports": {
@@ -92,6 +92,7 @@
         "http-proxy-middleware": "^3.0.0-beta.1",
         "https-proxy-agent": "7.0.2",
         "ip": "^1.1.8",
+        "jose": "^5.10.0",
         "jsonschema": "1.4.1",
         "lodash": "^4.17.21",
         "lokijs": "^1.5.12",

package/lib/src/app/index.js

@@ -77,6 +77,8 @@ const auth_1 = require("./routers/auth");
 const processes_1 = require("./routers/processes");
 const profile_1 = require("./routers/profile");
 const users_1 = require("./routers/users");
+const capabilities_1 = require("./routers/capabilities");
+const projects_1 = require("./routers/projects");
 const authMiddleware_1 = require("../middleware/authMiddleware");
 const rateLimitMiddleware_1 = require("../middleware/rateLimitMiddleware");
 const csrfMiddleware_1 = require("../middleware/csrfMiddleware");
@@ -243,6 +245,10 @@ function createRouter(pluginArgs) {
     apiRouter.use('/teams', (0, teams_1.teamsRouter)());
     // Admin: running process snapshot (ops debugging)
     apiRouter.use('/processes', (0, processes_1.processesRouter)());
+    // Feature detection endpoint
+    apiRouter.use('/capabilities', (0, capabilities_1.capabilitiesRouter)());
+    // Project entity skeleton — container for later runs/flows/secrets (ARB guard #4)
+    apiRouter.use('/projects', (0, projects_1.projectsRouter)());
     // Exposes plugin CLI args (may include host, hub URL, etc.) — auth-gated.
     apiRouter.get('/cliArgs', (_req, res) => __awaiter(this, void 0, void 0, function* () {
         res.json(yield (0, pluginArgs_1.getCLIArgs)());

package/lib/src/app/routers/auth.js

@@ -9,6 +9,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.issueToken = issueToken;
 exports.authPublicRouter = authPublicRouter;
 exports.authAuthedRouter = authAuthedRouter;
 exports.authRouter = authRouter;
@@ -23,8 +24,24 @@ const EmailService_1 = require("../../services/EmailService");
 const loginRateLimiter_1 = require("../../middleware/loginRateLimiter");
 const config_1 = require("../../config");
 const prisma_1 = require("../../prisma");
+const JwtKeyService_1 = require("../../services/token/JwtKeyService");
 const SESSION_COOKIE = 'xenon_dashboard_session';
 const isSecureFromReq = (req) => req.secure || req.headers['x-forwarded-proto'] === 'https';
+const MCP_TTL_SEC = Number(process.env.XENON_MCP_TOKEN_TTL_SEC || 86400);
+const REST_TTL_SEC = 3600;
+const MINTABLE_AUDIENCES = ['xenon-rest', 'xenon-mcp'];
+function issueToken(auth, body) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b;
+        const audience = (_a = body.audience) !== null && _a !== void 0 ? _a : 'xenon-rest';
+        if (!MINTABLE_AUDIENCES.includes(audience)) {
+            throw new Error(`unsupported audience: ${audience}`);
+        }
+        const expiresIn = audience === 'xenon-mcp' ? MCP_TTL_SEC : REST_TTL_SEC;
+        const token = yield typedi_1.Container.get(JwtKeyService_1.JwtKeyService).sign({ sub: auth.userId, role: auth.role, scopes: auth.scopes, teamId: (_b = auth.teamId) !== null && _b !== void 0 ? _b : null }, { audience, ttlSeconds: expiresIn });
+        return { token, expiresIn, audience };
+    });
+}
 // Public — anonymous-callable. Mounted before authMiddleware.
 function authPublicRouter() {
     var _a, _b;
@@ -108,6 +125,9 @@ function authPublicRouter() {
         if (elapsed < 50)
             yield new Promise((res2) => setTimeout(res2, 50 - elapsed));
     }));
+    r.get('/jwks.json', (_req, res) => {
+        res.json(typedi_1.Container.get(JwtKeyService_1.JwtKeyService).jwks());
+    });
     r.get('/reset-password/check/:token', (req, res) => __awaiter(this, void 0, void 0, function* () {
         const resetSvc = typedi_1.Container.get(PasswordResetService_1.PasswordResetService);
         const row = yield resetSvc.verifyToken(req.params.token);
@@ -213,6 +233,16 @@ function authAuthedRouter() {
             teams,
         });
     }));
+    r.post('/token', (req, res) => __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        try {
+            const out = yield issueToken(req.auth, (_a = req.body) !== null && _a !== void 0 ? _a : {});
+            res.json(out);
+        }
+        catch (e) {
+            res.status(400).json({ error: e.message });
+        }
+    }));
     r.post('/dashboard-session', (req, res) => __awaiter(this, void 0, void 0, function* () {
         const { apiKey } = req.body;
         if (!apiKey)

package/lib/src/app/routers/capabilities.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildCapabilities = buildCapabilities;
+exports.capabilitiesRouter = capabilitiesRouter;
+const express_1 = require("express");
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+const pkg = require('../../../package.json');
+function buildCapabilities() {
+    return {
+        version: String(pkg.version),
+        features: {
+            bearerAuth: true,
+            tokenIssuance: true,
+            streamTickets: true,
+            leases: true, // pre-existing: /sdk/leases
+            eventLog: true, // Task 6
+            projects: true, // Task 8
+        },
+    };
+}
+function capabilitiesRouter() {
+    const r = (0, express_1.Router)();
+    r.get('/', (_req, res) => res.json(buildCapabilities()));
+    return r;
+}

package/lib/src/app/routers/control.js

@@ -60,6 +60,7 @@ const os_1 = __importDefault(require("os"));
 const fs_extra_1 = __importDefault(require("fs-extra"));
 const OmniVisionService_1 = require("../../services/omni-vision/OmniVisionService");
 const InspectorService_1 = require("../../services/InspectorService");
+const StreamTicketService_1 = require("../../services/token/StreamTicketService");
 const scopeGuard_1 = require("../../middleware/scopeGuard");
 const roleGuard_1 = require("../../middleware/roleGuard");
 const manualLock_1 = require("../../services/recording/manualLock");
@@ -607,6 +608,19 @@ router.post('/:udid/stream/start', (req, res) => __awaiter(void 0, void 0, void
         });
     }
 }));
+/**
+ * Mint a single-use, udid-bound stream ticket for the webview <img> MJPEG
+ * path (spec §2.3/§7.1) — a raw <img src> can carry neither auth headers nor
+ * the SameSite=strict dashboard cookie, so it authenticates via ?ticket=.
+ */
+router.post('/:udid/stream/ticket', (req, res) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a, _b, _c;
+    const actorId = (_b = (_a = req.apiKey) === null || _a === void 0 ? void 0 : _a.id) !== null && _b !== void 0 ? _b : (_c = req.auth) === null || _c === void 0 ? void 0 : _c.userId;
+    if (!actorId)
+        return res.status(401).json({ error: 'unauthenticated' });
+    const ticket = yield typedi_1.Container.get(StreamTicketService_1.StreamTicketService).mint(req.params.udid, actorId);
+    res.json({ ticket, expiresIn: 60 });
+}));
 /**
  * Stop stream endpoint
  */

package/lib/src/app/routers/projects.js

@@ -0,0 +1,55 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listProjects = listProjects;
+exports.createProject = createProject;
+exports.projectsRouter = projectsRouter;
+const express_1 = require("express");
+const prisma_1 = require("../../prisma");
+const scopeGuard_1 = require("../../middleware/scopeGuard");
+function listProjects(client, teamIds) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const where = teamIds ? { where: { OR: [{ teamId: { in: teamIds } }, { teamId: null }] } } : {};
+        return client.project.findMany(where);
+    });
+}
+function createProject(client, body) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        if (!body.name || !body.name.trim())
+            throw new Error('name is required');
+        return client.project.create({
+            data: { name: body.name.trim(), teamId: ((_a = body.teamId) === null || _a === void 0 ? void 0 : _a.trim()) || null },
+        });
+    });
+}
+function projectsRouter() {
+    const r = (0, express_1.Router)();
+    r.get('/', (req, res) => __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        try {
+            res.json(yield listProjects(prisma_1.prisma, (_a = req.auth) === null || _a === void 0 ? void 0 : _a.teamIds));
+        }
+        catch (e) {
+            res.status(500).json({ error: e.message });
+        }
+    }));
+    r.post('/', (0, scopeGuard_1.scopeGuard)(['admin']), (req, res) => __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        try {
+            res.status(201).json(yield createProject(prisma_1.prisma, (_a = req.body) !== null && _a !== void 0 ? _a : {}));
+        }
+        catch (e) {
+            res.status(400).json({ error: e.message });
+        }
+    }));
+    return r;
+}