@xenon-device-management/xenon 2.0.0 → 2.1.0

package/lib/src/gateway/hubSessionToken.js

@@ -0,0 +1,356 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HubSessionTokenVerifier = exports.HubTokenUnavailableError = exports.HubSessionTokenIssuer = exports.HUB_CONTROL_TTL_SECONDS = exports.HUB_CONTROL_AUDIENCE = exports.HUB_CREATE_TTL_SECONDS = exports.HUB_CREATE_AUDIENCE = exports.HUB_TOKEN_TTL_SECONDS = exports.HUB_TOKEN_AUDIENCE = exports.HUB_TOKEN_HEADER = void 0;
+exports.hubJwksUrl = hubJwksUrl;
+const crypto_1 = require("crypto");
+const typedi_1 = require("typedi");
+const jose = __importStar(require("jose"));
+const logger_1 = __importDefault(require("../logger"));
+const JwtKeyService_1 = require("../services/token/JwtKeyService");
+const singleUseLedger_1 = require("../services/token/singleUseLedger");
+/**
+ * The credential a hub's calls to a node carry.
+ *
+ * Auth is enforced at the hub: it checks the client's credentials, then
+ * forwards the command to the node that runs the session. Each instance has
+ * its own database, so the node cannot check the client's key itself. It
+ * trusts the hub instead: every call the hub makes about a session (forwarded
+ * commands, and its own screenshot, source, recording and heartbeat calls)
+ * carries a short-lived RS256 token the hub signs for that one session. The
+ * node verifies it against the hub's public keys (`/xenon/api/auth/jwks.json`)
+ * when its own per-command auth is on.
+ *
+ * The audience is `xenon-node`, which /auth/token will not mint, and the token
+ * names its session (`sid`), so a token for one session opens no other.
+ *
+ * A create has no session yet, so it carries a token of its own kind:
+ * audience `xenon-node-create`, naming the owner the hub verified (`sub`,
+ * absent when the create is unattributed), the phone the hub allocated
+ * (`udid`) and that phone's node (`host`, the phone row's host). A separate
+ * audience rather than a claim on the `xenon-node` token, so neither kind can
+ * be taken for the other whatever claims a verifier reads: jose refuses the
+ * other kind's audience before any claim is looked at. The node treats a valid
+ * one as the session's credential (sessionCreate.ts).
+ *
+ * A hub's own device-control call to a node's phone (`/xenon/api/control/
+ * <udid>/tap`, swipe, text, keyevent, touchAndHold, which the hub forwards to
+ * the phone's node) carries a third kind: audience `xenon-node-control`, one
+ * minute, naming the hub user it acts for (`sub`), whether they are an admin
+ * (`adm`), the phone (`udid`) and its node (`host`). The hub checked the
+ * caller, the team rule and ownership before forwarding. The node accepts it
+ * only for `/control` on that phone (authMiddleware), then runs its own
+ * ownership guard with that user.
+ *
+ * A create token is single-use. The hub sends a create once (it is not safe
+ * to repeat), and each token has its own id (`jti`), which the node's
+ * verifier remembers until the token expires: the same token again is
+ * refused. A token with no id, from a hub before this rule, is accepted as
+ * before, without that check.
+ */
+exports.HUB_TOKEN_HEADER = 'x-xenon-hub-token';
+exports.HUB_TOKEN_AUDIENCE = 'xenon-node';
+exports.HUB_TOKEN_TTL_SECONDS = 300;
+exports.HUB_CREATE_AUDIENCE = 'xenon-node-create';
+/**
+ * Long enough for the create to reach the node, which checks the token as the
+ * request arrives; short enough that a copied token is soon worthless. It
+ * opens one phone, on one node, once.
+ */
+exports.HUB_CREATE_TTL_SECONDS = 120;
+exports.HUB_CONTROL_AUDIENCE = 'xenon-node-control';
+/** A forwarded tap is sent at once; a minute covers clock skew and a slow node. */
+exports.HUB_CONTROL_TTL_SECONDS = 60;
+/** A cached token is re-minted once it has less than this left. */
+const RENEW_BEFORE_EXPIRY_MS = 60000;
+const MAX_CACHED_TOKENS = 1000;
+/** Clock skew tolerated between hub and node, as JwtKeyService.verify allows. */
+const CLOCK_TOLERANCE_SECONDS = 60;
+/** Hub side: mints a session's token (reused while it lasts), a create's and a control call's (fresh each time). */
+let HubSessionTokenIssuer = class HubSessionTokenIssuer {
+    constructor() {
+        this.logger = logger_1.default.scope('HubSessionToken');
+        this.cache = new Map();
+        this.signer = () => typedi_1.Container.get(JwtKeyService_1.JwtKeyService);
+        this.warned = false;
+    }
+    /** For tests: sign with this instead of the server's JwtKeyService. */
+    useSigner(signer) {
+        this.signer = () => signer;
+        this.cache.clear();
+    }
+    /**
+     * The token for a session, or null when this server cannot sign (its JWT
+     * key failed to load). A node with per-command auth off needs none, so the
+     * call still goes out; one with it on refuses it, and the warning says why.
+     */
+    tokenFor(sessionId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!sessionId)
+                return null;
+            const now = Date.now();
+            const hit = this.cache.get(sessionId);
+            if (hit && hit.renewAt > now)
+                return hit.token;
+            let token;
+            try {
+                token = yield this.signer().sign({ sid: sessionId }, { audience: exports.HUB_TOKEN_AUDIENCE, ttlSeconds: exports.HUB_TOKEN_TTL_SECONDS });
+            }
+            catch (err) {
+                this.warnCannotSign(err);
+                return null;
+            }
+            this.cache.delete(sessionId);
+            if (this.cache.size >= MAX_CACHED_TOKENS) {
+                const oldest = this.cache.keys().next().value;
+                this.cache.delete(oldest);
+            }
+            this.cache.set(sessionId, {
+                token,
+                renewAt: now + exports.HUB_TOKEN_TTL_SECONDS * 1000 - RENEW_BEFORE_EXPIRY_MS,
+            });
+            return token;
+        });
+    }
+    forget(sessionId) {
+        this.cache.delete(sessionId);
+    }
+    /**
+     * The token for a create the hub forwards to the phone's node, or null when
+     * this server cannot sign. Minted fresh for each create, never cached, with
+     * an id of its own: the node takes it once.
+     */
+    createTokenFor(grant) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const claims = { udid: grant.udid, host: grant.host };
+            if (grant.userId)
+                claims.sub = grant.userId;
+            try {
+                return yield this.signer().sign(claims, {
+                    audience: exports.HUB_CREATE_AUDIENCE,
+                    ttlSeconds: exports.HUB_CREATE_TTL_SECONDS,
+                    jti: (0, crypto_1.randomUUID)(),
+                });
+            }
+            catch (err) {
+                this.warnCannotSign(err);
+                return null;
+            }
+        });
+    }
+    /**
+     * The token for a device-control call the hub forwards to the phone's
+     * node, or null when this server cannot sign. Fresh for each call.
+     */
+    controlTokenFor(grant) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                return yield this.signer().sign({ sub: grant.userId, adm: grant.isAdmin, udid: grant.udid, host: grant.host }, { audience: exports.HUB_CONTROL_AUDIENCE, ttlSeconds: exports.HUB_CONTROL_TTL_SECONDS });
+            }
+            catch (err) {
+                this.warnCannotSign(err);
+                return null;
+            }
+        });
+    }
+    warnCannotSign(err) {
+        var _a;
+        if (this.warned)
+            return;
+        this.warned = true;
+        this.logger.warn(`Cannot sign session tokens for nodes (${(_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : err}). Calls to nodes go ` +
+            'without one, and a node with XENON_REQUIRE_COMMAND_AUTH or ' +
+            'XENON_REQUIRE_SESSION_TOKEN on will refuse them.');
+    }
+};
+exports.HubSessionTokenIssuer = HubSessionTokenIssuer;
+exports.HubSessionTokenIssuer = HubSessionTokenIssuer = __decorate([
+    (0, typedi_1.Service)()
+], HubSessionTokenIssuer);
+/** The hub's public keys, which JwtKeyService serves without a login. */
+function hubJwksUrl(hub) {
+    return new URL('/xenon/api/auth/jwks.json', hub);
+}
+/** The node could not check a hub token (the hub's keys could not be fetched). */
+class HubTokenUnavailableError extends Error {
+}
+exports.HubTokenUnavailableError = HubTokenUnavailableError;
+// jose's codes for a token that was checked and is not good: forged, expired,
+// for another audience, malformed, or signed by a key the hub does not have.
+// Anything else (the key set could not be fetched, or was not a key set) means
+// the check did not run.
+const VERDICT_CODES = new Set([
+    'ERR_JWKS_NO_MATCHING_KEY',
+    'ERR_JWKS_MULTIPLE_MATCHING_KEYS',
+    'ERR_JOSE_ALG_NOT_ALLOWED',
+    'ERR_JOSE_NOT_SUPPORTED',
+]);
+function isVerdict(err) {
+    const code = err === null || err === void 0 ? void 0 : err.code;
+    if (typeof code !== 'string')
+        return false;
+    return code.startsWith('ERR_JWT_') || code.startsWith('ERR_JWS_') || VERDICT_CODES.has(code);
+}
+/**
+ * Node side: is this a token the hub signed for this session?
+ *
+ * Resolves false for any token that is not (forged, expired, another
+ * session's, another audience's), and throws HubTokenUnavailableError when
+ * the hub's keys cannot be fetched, so the caller can answer 503 rather than
+ * pretend the token was checked. jose caches the key set, refetching it when
+ * a token names a key it does not have (a hub that rotated its key).
+ */
+class HubSessionTokenVerifier {
+    constructor(hubUrl, keys) {
+        /** The create tokens already taken, by id, until each one expires. */
+        this.usedCreates = new singleUseLedger_1.SingleUseLedger(exports.HUB_CREATE_TTL_SECONDS);
+        this.keys =
+            keys !== null && keys !== void 0 ? keys : jose.createRemoteJWKSet(hubJwksUrl(hubUrl), {
+                timeoutDuration: 5000,
+                cooldownDuration: 30000,
+                cacheMaxAge: 10 * 60000,
+            });
+    }
+    verify(token, sessionId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            try {
+                const { payload } = yield jose.jwtVerify(token, this.keys, {
+                    audience: exports.HUB_TOKEN_AUDIENCE,
+                    algorithms: ['RS256'],
+                    clockTolerance: CLOCK_TOLERANCE_SECONDS,
+                });
+                return typeof payload.sid === 'string' && payload.sid === sessionId;
+            }
+            catch (err) {
+                if (isVerdict(err))
+                    return false;
+                throw new HubTokenUnavailableError((_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : String(err));
+            }
+        });
+    }
+    /**
+     * The grant in a hub's create token, or null for any token that is not one
+     * (forged, expired, another audience's, missing the phone or its node, or
+     * already taken: a create token is taken once). Throws
+     * HubTokenUnavailableError when the hub's keys cannot be fetched.
+     */
+    verifyCreate(token) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            let payload;
+            try {
+                ({ payload } = yield jose.jwtVerify(token, this.keys, {
+                    audience: exports.HUB_CREATE_AUDIENCE,
+                    algorithms: ['RS256'],
+                    clockTolerance: CLOCK_TOLERANCE_SECONDS,
+                }));
+            }
+            catch (err) {
+                if (isVerdict(err))
+                    return null;
+                throw new HubTokenUnavailableError((_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : String(err));
+            }
+            const nonEmpty = (value) => typeof value === 'string' && value.length > 0;
+            if (!nonEmpty(payload.udid) || !nonEmpty(payload.host))
+                return null;
+            if (nonEmpty(payload.jti)) {
+                try {
+                    this.usedCreates.consume(payload);
+                }
+                catch (_b) {
+                    return null;
+                }
+            }
+            return {
+                userId: nonEmpty(payload.sub) ? payload.sub : null,
+                udid: payload.udid,
+                host: payload.host,
+            };
+        });
+    }
+    /**
+     * The grant in a hub's control token, or null for any token that is not
+     * one (forged, expired, another audience's, missing the user, the phone or
+     * its node). Throws HubTokenUnavailableError when the hub's keys cannot be
+     * fetched.
+     */
+    verifyControl(token) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            let payload;
+            try {
+                ({ payload } = yield jose.jwtVerify(token, this.keys, {
+                    audience: exports.HUB_CONTROL_AUDIENCE,
+                    algorithms: ['RS256'],
+                    clockTolerance: CLOCK_TOLERANCE_SECONDS,
+                }));
+            }
+            catch (err) {
+                if (isVerdict(err))
+                    return null;
+                throw new HubTokenUnavailableError((_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : String(err));
+            }
+            const nonEmpty = (value) => typeof value === 'string' && value.length > 0;
+            if (!nonEmpty(payload.sub) || !nonEmpty(payload.udid) || !nonEmpty(payload.host))
+                return null;
+            return {
+                userId: payload.sub,
+                isAdmin: payload.adm === true,
+                udid: payload.udid,
+                host: payload.host,
+            };
+        });
+    }
+}
+exports.HubSessionTokenVerifier = HubSessionTokenVerifier;

package/lib/src/gateway/internalCall.js

@@ -0,0 +1,90 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.INTERNAL_CALL_MARKER = exports.INTERNAL_CALL_HEADER = void 0;
+exports.internalCallHeaders = internalCallHeaders;
+exports.hasInternalCallSecret = hasInternalCallSecret;
+exports.isInternalCall = isInternalCall;
+exports.internalCallBaseUrl = internalCallBaseUrl;
+exports.createInternalCallLayer = createInternalCallLayer;
+const crypto_1 = require("crypto");
+const appiumBasePath_1 = require("../app/appiumBasePath");
+/**
+ * Xenon's own loopback calls to its Appium server.
+ *
+ * A LocalSession asks its own server for a few things over HTTP (a page
+ * source or a screen recording when the in-process driver call fails). Those
+ * go to `<basePath>/wd-internal/session/<id>/...`, carrying this header with
+ * a secret made once per process. The session gateway recognises such a call
+ * only when both are present: it strips `/wd-internal` so Appium's own route
+ * answers, and lets the call skip per-command auth, since it is Xenon asking
+ * about a session it already runs.
+ *
+ * The path proves nothing on its own. Without the secret a `/wd-internal`
+ * request is left exactly as it came, matches no route, and gets Appium's
+ * unknown-route answer. Before this, the path alone was the marker, which on a
+ * server with per-command auth on was a way around it.
+ *
+ * The secret never leaves the process: it is sent only to this server's own
+ * address, with any HTTP proxy bypassed, and the gateway removes the header
+ * before anything after it sees the request.
+ */
+exports.INTERNAL_CALL_HEADER = 'x-xenon-internal';
+exports.INTERNAL_CALL_MARKER = '/wd-internal';
+const SECRET = Buffer.from((0, crypto_1.randomBytes)(32).toString('base64url'));
+const INTERNAL = Symbol('xenon.internalCall');
+/** The headers a loopback call to this process's own server carries. */
+function internalCallHeaders() {
+    return { [exports.INTERNAL_CALL_HEADER]: SECRET.toString() };
+}
+/** Whether these headers carry this process's secret. Constant-time. */
+function hasInternalCallSecret(headers) {
+    const presented = headers[exports.INTERNAL_CALL_HEADER];
+    if (typeof presented !== 'string')
+        return false;
+    const candidate = Buffer.from(presented);
+    return candidate.length === SECRET.length && (0, crypto_1.timingSafeEqual)(candidate, SECRET);
+}
+/** Whether the internal-call layer accepted this request as Xenon's own. */
+function isInternalCall(req) {
+    return !!req && req[INTERNAL] === true;
+}
+/**
+ * Where a local session's loopback calls go: this server, under its base
+ * path, marked `/wd-internal`. A wildcard bind address is reached on 127.0.0.1.
+ */
+function internalCallBaseUrl(address, port, basePath) {
+    const wildcard = !address || address === '0.0.0.0' || address === '::';
+    const host = wildcard ? '127.0.0.1' : address.includes(':') ? `[${address}]` : address;
+    return `http://${host}:${port}${(0, appiumBasePath_1.normalizeBasePath)(basePath)}${exports.INTERNAL_CALL_MARKER}`;
+}
+/**
+ * The layer that recognises internal calls. Path-less, because Express puts a
+ * mount path back onto `req.url` when a mounted layer calls `next()`, which
+ * would undo the strip. The marker is compared exactly as Xenon writes it:
+ * any other spelling is not an internal call and falls through untouched.
+ */
+function createInternalCallLayer(basePath) {
+    const base = (0, appiumBasePath_1.normalizeBasePath)(basePath);
+    const prefix = `${base}${exports.INTERNAL_CALL_MARKER}`;
+    /** Accept the call as Xenon's own, rewriting it in place; false leaves it untouched. */
+    function accept(req) {
+        const url = req.url;
+        const rest = url.startsWith(prefix) ? url.slice(prefix.length) : undefined;
+        if (rest === undefined || (rest !== '' && rest[0] !== '/' && rest[0] !== '?'))
+            return false;
+        if (!hasInternalCallSecret(req.headers))
+            return false;
+        delete req.headers[exports.INTERNAL_CALL_HEADER];
+        req[INTERNAL] = true;
+        req.url = `${base}${rest}` || '/';
+        req.originalUrl = req.url;
+        return true;
+    }
+    // One call to next() for every outcome: Appium's 404 carries a stack trace,
+    // and a second call site would make a refused /wd-internal request's answer
+    // differ from any other unknown route's by that one frame.
+    return function xenonInternalCalls(req, _res, next) {
+        accept(req);
+        next();
+    };
+}

package/lib/src/gateway/nodeSessionStatus.js

@@ -0,0 +1,140 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NodeSessionProbeSupport = exports.UNSUPPORTED_RECHECK_MS = exports.NODE_SESSION_STATUS_HEADER = exports.NODE_SESSION_STATUS_PATH = exports.NODE_SESSION_STATUS_ROUTE = void 0;
+exports.nodeSessionStatusHandler = nodeSessionStatusHandler;
+exports.registerNodeSessionStatus = registerNodeSessionStatus;
+const typedi_1 = require("typedi");
+const logger_1 = __importDefault(require("../logger"));
+const config_1 = require("../config");
+const commandAuth_1 = require("../middleware/commandAuth");
+const appiumUmbrella_1 = require("../sessions/appiumUmbrella");
+const hubSessionToken_1 = require("./hubSessionToken");
+/**
+ * "Does session X still exist?", asked by a hub of a node without touching it.
+ *
+ * A hub checks each session it routes to a node every ~30 s
+ * (SessionHeartbeatService, RemoteSession.checkHealth). It used to ask with a
+ * WebDriver command (`GET <basePath>/session/<id>/timeouts`), and any command
+ * restarts the node driver's new-command timeout and Xenon's idle clock there,
+ * so a session its client had abandoned, and its phone, stayed alive for as
+ * long as the hub did. A node's own sessions were fixed the same way in 2.1
+ * (LocalSession.checkHealth asks the umbrella).
+ *
+ * A node answers `GET /xenon/api/node/sessions/<id>` from Appium's umbrella
+ * (`sessionExists`), which runs no command: `200 { value: { sessionId,
+ * exists } }`. It is outside the login, like `/xenon/api/webdriver`: the hub
+ * holds no credentials for the node. It asks what a command to that session
+ * asks, never more, so it is never stricter than the probe it replaces. With
+ * per-command auth on (XENON_REQUIRE_COMMAND_AUTH, auth enabled) it needs the
+ * hub's session token for that session (`x-xenon-hub-token`, audience
+ * `xenon-node`, claim `sid`), the one the hub sends with every call about it:
+ * any other caller gets the unknown-session answer, and a JWKS that can't be
+ * fetched is `503`. With it off a command needs no credential, so neither does
+ * this. Otherwise a hub that can't sign (its JWT key failed to load) would
+ * see every node session as gone, and end them, where its command probe
+ * worked.
+ *
+ * Every answer carries NODE_SESSION_STATUS_HEADER, so a hub can tell a node
+ * that has this route from one that doesn't (an older Xenon, whose answer is a
+ * 404 or a 401 from its login). For those the hub keeps the old WebDriver
+ * probe and says so once per node (NodeSessionProbeSupport).
+ */
+exports.NODE_SESSION_STATUS_ROUTE = '/node/sessions/:sessionId';
+/** The route under a server's origin, for a hub building the URL. */
+exports.NODE_SESSION_STATUS_PATH = '/xenon/api/node/sessions';
+exports.NODE_SESSION_STATUS_HEADER = 'x-xenon-node-sessions';
+/** How long a hub keeps using the old probe for a node without the route before asking again. */
+exports.UNSUPPORTED_RECHECK_MS = 10 * 60000;
+function nodeSessionStatusHandler(deps) {
+    return (req, res) => {
+        var _a, _b;
+        res.setHeader(exports.NODE_SESSION_STATUS_HEADER, '1');
+        const sessionId = String((_b = (_a = req.params) === null || _a === void 0 ? void 0 : _a.sessionId) !== null && _b !== void 0 ? _b : '');
+        const answer = () => res.status(200).json({ value: { sessionId, exists: deps.hasSession(sessionId) } });
+        if (!deps.enforced())
+            return answer();
+        const presented = req.headers[hubSessionToken_1.HUB_TOKEN_HEADER];
+        const token = typeof presented === 'string' ? presented : undefined;
+        if (token === undefined) {
+            res.status(commandAuth_1.UNKNOWN_SESSION_STATUS).json(commandAuth_1.UNKNOWN_SESSION_BODY);
+            return;
+        }
+        deps.hubTokens
+            .verify(token, sessionId)
+            .then((valid) => {
+            if (valid)
+                return answer();
+            deps.logger.warn(`Session status for ${sessionId} refused: the hub token is not valid for it`);
+            res.status(commandAuth_1.UNKNOWN_SESSION_STATUS).json(commandAuth_1.UNKNOWN_SESSION_BODY);
+        })
+            .catch((error) => {
+            deps.logger.error(`Session status for ${sessionId} unavailable: hub token check failed: ${(0, commandAuth_1.summarize)(error)}`);
+            if (!res.headersSent) {
+                res.status(commandAuth_1.COMMAND_AUTH_UNAVAILABLE_STATUS).json(commandAuth_1.COMMAND_AUTH_UNAVAILABLE_BODY);
+            }
+        });
+    };
+}
+/**
+ * A node's route, on the `/xenon/api` router ahead of its login. Only a node
+ * (a server with `hub`) has it; a hub or a standalone server answers it as an
+ * unknown API route.
+ */
+function registerNodeSessionStatus(router, pluginArgs) {
+    if (pluginArgs.hub === undefined)
+        return;
+    router.get(exports.NODE_SESSION_STATUS_ROUTE, nodeSessionStatusHandler({
+        hubTokens: new hubSessionToken_1.HubSessionTokenVerifier(pluginArgs.hub),
+        enforced: () => (0, commandAuth_1.commandAuthEnabled)() && config_1.config.authDisabled !== true,
+        hasSession: (sessionId) => typedi_1.Container.get(appiumUmbrella_1.AppiumUmbrella).hasSession(sessionId),
+        logger: logger_1.default.scope('NodeSessionStatus'),
+    }));
+}
+/**
+ * Hub side: which nodes don't have the route. Such a node is probed the old
+ * way, with a WebDriver command, and the hub logs that once for it. It is
+ * asked again after UNSUPPORTED_RECHECK_MS, so a node upgraded in place is
+ * picked up without restarting the hub.
+ */
+let NodeSessionProbeSupport = class NodeSessionProbeSupport {
+    constructor() {
+        this.logger = logger_1.default.scope('RemoteSession');
+        this.now = () => Date.now();
+        this.unsupportedUntil = new Map();
+        this.warned = new Set();
+    }
+    /** Whether to ask this node its route (true unless it recently had none). */
+    shouldAsk(origin) {
+        const until = this.unsupportedUntil.get(origin);
+        if (until === undefined)
+            return true;
+        if (until > this.now())
+            return false;
+        this.unsupportedUntil.delete(origin);
+        return true;
+    }
+    /** The node answered without the route: use the WebDriver probe for it for a while. */
+    unsupported(origin, status) {
+        this.unsupportedUntil.set(origin, this.now() + exports.UNSUPPORTED_RECHECK_MS);
+        if (this.warned.has(origin))
+            return;
+        this.warned.add(origin);
+        this.logger.warn(`Node ${origin} has no ${exports.NODE_SESSION_STATUS_PATH} route (answered ${status !== null && status !== void 0 ? status : 'nothing'}); ` +
+            'an older Xenon. Its sessions are checked with a WebDriver command, which restarts ' +
+            'their new-command timeout and idle clock there, so an abandoned session is kept ' +
+            'alive. Upgrade the node.');
+    }
+};
+exports.NodeSessionProbeSupport = NodeSessionProbeSupport;
+exports.NodeSessionProbeSupport = NodeSessionProbeSupport = __decorate([
+    (0, typedi_1.Service)()
+], NodeSessionProbeSupport);