@xenon-device-management/xenon 2.0.0 → 2.1.0

package/lib/test/unit/SessionHeartbeatWrite.test.js

@@ -15,18 +15,19 @@ Object.defineProperty(exports, "__esModule", { value: true });
 require("reflect-metadata");
 const chai_1 = require("chai");
 const sinon_1 = __importDefault(require("sinon"));
-const prisma_1 = require("../../src/prisma");
 const test_container_1 = require("../helpers/test-container");
+const scratch_database_1 = require("../helpers/scratch-database");
 const SessionManager_1 = require("../../src/sessions/SessionManager");
 const SessionHeartbeatService_1 = require("../../src/services/SessionHeartbeatService");
 describe('SessionHeartbeatService write path', () => {
+    // Its own migrated database. It used the server's client directly, so it
+    // wrote this row to the developer's ~/.cache/xenon/xenon.db.
+    const scratch = (0, scratch_database_1.useScratchDatabase)();
     const TEST_SESSION_ID = 'test-heartbeat-sess-001';
-    let prismaClient;
     before(() => __awaiter(void 0, void 0, void 0, function* () {
         (0, test_container_1.setupTestContainer)();
-        prismaClient = (0, prisma_1.getPrismaClient)();
         // Create a minimal session row for the test
-        yield prismaClient.session.upsert({
+        yield scratch.db.session.upsert({
             where: { id: TEST_SESSION_ID },
             create: {
                 id: TEST_SESSION_ID,
@@ -50,8 +51,6 @@ describe('SessionHeartbeatService write path', () => {
         });
     }));
     after(() => __awaiter(void 0, void 0, void 0, function* () {
-        // Cleanup test session
-        yield prismaClient.session.deleteMany({ where: { id: TEST_SESSION_ID } });
         yield (0, test_container_1.resetTestContainer)();
     }));
     afterEach(() => {
@@ -72,7 +71,7 @@ describe('SessionHeartbeatService write path', () => {
         const svc = new SessionHeartbeatService_1.SessionHeartbeatService();
         yield svc.checkAllSessions();
         // Verify the session was updated with heartbeat fields in the DB
-        const updated = yield prismaClient.session.findUnique({
+        const updated = yield scratch.db.session.findUnique({
             where: { id: TEST_SESSION_ID },
             select: { last_heartbeat_at: true, heartbeat_pid: true, heartbeat_host: true },
         });

package/lib/test/unit/StreamTicketService.spec.js

@@ -22,10 +22,13 @@ const crypto_1 = require("crypto");
 const typedi_1 = require("typedi");
 const JwtKeyService_1 = require("../../src/services/token/JwtKeyService");
 const StreamTicketService_1 = require("../../src/services/token/StreamTicketService");
+const container_registration_1 = require("../helpers/container-registration");
 describe('StreamTicketService', () => {
     let dir;
     let svc;
+    let restoreContainer;
     beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        restoreContainer = (0, container_registration_1.saveRegistrations)(JwtKeyService_1.JwtKeyService);
         dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-ticket-'));
         const keys = new JwtKeyService_1.JwtKeyService();
         yield keys.init(dir);
@@ -33,7 +36,7 @@ describe('StreamTicketService', () => {
         svc = new StreamTicketService_1.StreamTicketService();
     }));
     afterEach(() => {
-        typedi_1.Container.reset();
+        restoreContainer();
         fs_1.default.rmSync(dir, { recursive: true, force: true });
     });
     it('mints and redeems a ticket once for the bound udid', () => __awaiter(void 0, void 0, void 0, function* () {

package/lib/test/unit/TokenEndpoint.spec.js

@@ -55,9 +55,12 @@ const path_1 = __importDefault(require("path"));
 const JwtKeyService_1 = require("../../src/services/token/JwtKeyService");
 const auth_1 = require("../../src/app/routers/auth");
 const mcpScopes_1 = require("../../src/services/token/mcpScopes");
+const container_registration_1 = require("../helpers/container-registration");
 describe('POST /auth/token handler (issueToken)', () => {
     let dir;
+    let restoreContainer;
     beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        restoreContainer = (0, container_registration_1.saveRegistrations)(JwtKeyService_1.JwtKeyService);
         dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-tok-'));
         const svc = new JwtKeyService_1.JwtKeyService();
         yield svc.init(dir);
@@ -65,7 +68,7 @@ describe('POST /auth/token handler (issueToken)', () => {
     }));
     afterEach(() => {
         fs_1.default.rmSync(dir, { recursive: true, force: true });
-        typedi_1.Container.reset();
+        restoreContainer();
     });
     const auth = {
         kind: 'api-key',
@@ -103,10 +106,21 @@ describe('POST /auth/token handler (issueToken)', () => {
 });
 describe('issueToken (xenon-mcp granular claims)', () => {
     const auth = { userId: 'u1', role: 'MEMBER', scopes: 'devices,sessions,read', teamId: 't1' };
+    let dir;
+    let restoreContainer;
+    // Its own key service, not the process-wide one: init() would give the
+    // shared singleton this suite's temporary keys for every later spec.
     before(() => __awaiter(void 0, void 0, void 0, function* () {
-        const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'jwtkeys-'));
-        yield typedi_1.Container.get(JwtKeyService_1.JwtKeyService).init(dir);
+        restoreContainer = (0, container_registration_1.saveRegistrations)(JwtKeyService_1.JwtKeyService);
+        dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'jwtkeys-'));
+        const svc = new JwtKeyService_1.JwtKeyService();
+        yield svc.init(dir);
+        typedi_1.Container.set(JwtKeyService_1.JwtKeyService, svc);
     }));
+    after(() => {
+        restoreContainer();
+        fs_1.default.rmSync(dir, { recursive: true, force: true });
+    });
     function decode(token) {
         return __awaiter(this, void 0, void 0, function* () {
             // decodeJwt skips signature verification — fine for claim-shape assertions

package/lib/test/unit/aggregate-hotspots-session-scope.spec.js

@@ -49,7 +49,7 @@ require("reflect-metadata");
 const chai_1 = require("chai");
 const sinon_1 = __importDefault(require("sinon"));
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const prisma_1 = require("../../src/prisma");
 const dashboard_1 = __importStar(require("../../src/app/routers/dashboard"));
 /**
@@ -144,7 +144,7 @@ describe('Selector Health reads — scoped to the caller’s sessions', () => {
     ];
     for (const url of ROUTES) {
         it(`${url}: a member counts only the sessions they may see`, () => __awaiter(void 0, void 0, void 0, function* () {
-            const r = yield (0, supertest_1.default)(app(member)).get(url);
+            const r = yield (0, loopbackRequest_1.default)(app(member)).get(url);
             (0, chai_1.expect)(r.status).to.equal(200);
             const session = findMany.firstCall.args[0].where.session;
             if (url.includes('build=')) {
@@ -155,7 +155,7 @@ describe('Selector Health reads — scoped to the caller’s sessions', () => {
             }
         }));
         it(`${url}: an admin counts every session`, () => __awaiter(void 0, void 0, void 0, function* () {
-            const r = yield (0, supertest_1.default)(app(admin)).get(url);
+            const r = yield (0, loopbackRequest_1.default)(app(admin)).get(url);
             (0, chai_1.expect)(r.status).to.equal(200);
             const session = findMany.firstCall.args[0].where.session;
             if (url.includes('build=')) {
@@ -183,7 +183,7 @@ describe('Selector Health reads — scoped to the caller’s sessions', () => {
             findFirst = sinon_1.default.stub(prisma_1.prisma.sessionLog, 'findFirst').resolves(null);
         });
         it('a member: the last heal among the sessions they may see', () => __awaiter(void 0, void 0, void 0, function* () {
-            const r = yield (0, supertest_1.default)(app(member)).get('/healing/state/muted');
+            const r = yield (0, loopbackRequest_1.default)(app(member)).get('/healing/state/muted');
             (0, chai_1.expect)(r.status).to.equal(200);
             (0, chai_1.expect)(r.body.muted).to.have.length(1);
             (0, chai_1.expect)(findFirst.firstCall.args[0].where).to.deep.equal({
@@ -194,7 +194,7 @@ describe('Selector Health reads — scoped to the caller’s sessions', () => {
             });
         }));
         it('an admin: the last heal on any session', () => __awaiter(void 0, void 0, void 0, function* () {
-            const r = yield (0, supertest_1.default)(app(admin)).get('/healing/state/muted');
+            const r = yield (0, loopbackRequest_1.default)(app(admin)).get('/healing/state/muted');
             (0, chai_1.expect)(r.status).to.equal(200);
             (0, chai_1.expect)(findFirst.firstCall.args[0].where).to.not.have.property('session');
         }));

package/lib/test/unit/android-h264-service.spec.js

@@ -17,6 +17,7 @@ const chai_1 = require("chai");
 const typedi_1 = require("typedi");
 const AndroidH264StreamService_1 = __importDefault(require("../../src/device-managers/android/AndroidH264StreamService"));
 const PluginContext_1 = require("../../src/PluginContext");
+const container_registration_1 = require("../helpers/container-registration");
 // Lifecycle/state only — the capture seam (openCapture) is stubbed so the test
 // drives packet flow without a real device or screenrecord process.
 function make() {
@@ -31,9 +32,14 @@ describe('AndroidH264StreamService', () => {
     // known default before each test (streaming undefined → source 'scrcpy'); the
     // WS-source tests override it in-test. Set (not remove) so TypeDI never hits a
     // ServiceNotFoundError on the next Container.get.
+    // The context is put back after each test: left behind, the plain object
+    // was every later spec's PluginContext, with no setContext().
+    let restoreContainer;
     beforeEach(() => {
+        restoreContainer = (0, container_registration_1.saveRegistrations)(PluginContext_1.PluginContext);
         typedi_1.Container.set(PluginContext_1.PluginContext, { pluginArgs: {} });
     });
+    afterEach(() => restoreContainer());
     it('start() creates a multiplexer, seeds it with the config packet, and resolves', () => __awaiter(void 0, void 0, void 0, function* () {
         const svc = make();
         svc.openCapture = (_udid, onPacket) => __awaiter(void 0, void 0, void 0, function* () {

package/lib/test/unit/android-stream-stall-eof.spec.js

@@ -31,8 +31,15 @@ function makeService() {
 }
 describe('Android MJPEG server: a stalled capture ends client responses', () => {
     let server;
+    // Stopped after each test. close() leaves an open response streaming, and a
+    // test whose client never ends left its writeFrame loop writing a frame
+    // every 60ms for the rest of the run.
+    const sessions = [];
     afterEach(() => {
+        for (const session of sessions.splice(0))
+            session.status = 'stopped';
         try {
+            server === null || server === void 0 ? void 0 : server.closeAllConnections();
             server === null || server === void 0 ? void 0 : server.close();
         }
         catch (_a) {
@@ -64,6 +71,7 @@ describe('Android MJPEG server: a stalled capture ends client responses', () =>
             viewerCount: 0,
             captureHealth: new androidStreamReuse_1.CaptureHealth(),
         };
+        sessions.push(session);
         const now = Date.now();
         session.captureHealth.recordFailure(now - androidStreamReuse_1.CAPTURE_STALL_MS * 2, now);
         server = yield svc.createAndListenMjpegServer(session, 0);
@@ -93,6 +101,7 @@ describe('Android MJPEG server: a stalled capture ends client responses', () =>
             viewerCount: 0,
             captureHealth: new androidStreamReuse_1.CaptureHealth(),
         };
+        sessions.push(session);
         // Port 0 → the OS picks a free one, so this never collides with a real lease.
         server = yield svc.createAndListenMjpegServer(session, 0);
         const port = server.address().port;
@@ -133,6 +142,7 @@ describe('Android MJPEG server: a stalled capture ends client responses', () =>
             viewerCount: 0,
             captureHealth: new androidStreamReuse_1.CaptureHealth(),
         };
+        sessions.push(session);
         server = yield svc.createAndListenMjpegServer(session, 0);
         const port = server.address().port;
         let ended = false;

package/lib/test/unit/apps-team-visibility.spec.js

@@ -16,7 +16,7 @@ require("reflect-metadata");
 const chai_1 = require("chai");
 const sinon_1 = __importDefault(require("sinon"));
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
@@ -101,20 +101,20 @@ describe('apps follow the device team rule', () => {
             findMany = sinon_1.default.stub(prisma_1.prisma.app, 'findMany').resolves([rows['app-shared']]);
         });
         it("asks the database for a member's shared and own-team apps only", () => __awaiter(void 0, void 0, void 0, function* () {
-            const r = yield (0, supertest_1.default)(server('member-a')).get('/apps');
+            const r = yield (0, loopbackRequest_1.default)(server('member-a')).get('/apps');
             (0, chai_1.expect)(r.status).to.equal(200);
             const args = findMany.firstCall.args[0];
             (0, chai_1.expect)(args.where).to.deep.equal({ OR: [{ teamId: null }, { teamId: { in: ['team-a'] } }] });
             (0, chai_1.expect)(args.include).to.deep.equal({ team: { select: { id: true, name: true } } });
         }));
         it('a member in no team gets the shared apps only', () => __awaiter(void 0, void 0, void 0, function* () {
-            yield (0, supertest_1.default)(server('member-none')).get('/apps');
+            yield (0, loopbackRequest_1.default)(server('member-none')).get('/apps');
             (0, chai_1.expect)(findMany.firstCall.args[0].where).to.deep.equal({
                 OR: [{ teamId: null }, { teamId: { in: [] } }],
             });
         }));
         it('an admin is not filtered, and still gets team names', () => __awaiter(void 0, void 0, void 0, function* () {
-            yield (0, supertest_1.default)(server('admin')).get('/apps');
+            yield (0, loopbackRequest_1.default)(server('admin')).get('/apps');
             const args = findMany.firstCall.args[0];
             (0, chai_1.expect)(args.where).to.equal(undefined);
             (0, chai_1.expect)(args.include).to.deep.equal({ team: { select: { id: true, name: true } } });
@@ -123,26 +123,26 @@ describe('apps follow the device team rule', () => {
     describe('GET /apps/:id/download', () => {
         it("serves a member their team's app and a shared one", () => __awaiter(void 0, void 0, void 0, function* () {
             for (const id of ['app-a', 'app-shared']) {
-                const r = yield (0, supertest_1.default)(server('member-a')).get(`/apps/${id}/download`);
+                const r = yield (0, loopbackRequest_1.default)(server('member-a')).get(`/apps/${id}/download`);
                 (0, chai_1.expect)(r.status, id).to.equal(200);
             }
         }));
         it("answers another team's app exactly as an unknown id", () => __awaiter(void 0, void 0, void 0, function* () {
-            const hidden = yield (0, supertest_1.default)(server('member-a')).get('/apps/app-b/download');
-            const unknown = yield (0, supertest_1.default)(server('member-a')).get('/apps/no-such-app/download');
+            const hidden = yield (0, loopbackRequest_1.default)(server('member-a')).get('/apps/app-b/download');
+            const unknown = yield (0, loopbackRequest_1.default)(server('member-a')).get('/apps/no-such-app/download');
             (0, chai_1.expect)(hidden.status).to.equal(404);
             (0, chai_1.expect)(hidden.body).to.deep.equal(UNKNOWN);
             (0, chai_1.expect)(unknown.status).to.equal(hidden.status);
             (0, chai_1.expect)(unknown.body).to.deep.equal(hidden.body);
         }));
         it('serves an admin any team’s app', () => __awaiter(void 0, void 0, void 0, function* () {
-            const r = yield (0, supertest_1.default)(server('admin')).get('/apps/app-b/download');
+            const r = yield (0, loopbackRequest_1.default)(server('admin')).get('/apps/app-b/download');
             (0, chai_1.expect)(r.status).to.equal(200);
         }));
         it("a download ticket's request sees its own app only, though it carries no teams", () => __awaiter(void 0, void 0, void 0, function* () {
-            (0, chai_1.expect)((yield (0, supertest_1.default)(server('ticket-for-app-a')).get('/apps/app-a/download')).status).to.equal(200);
+            (0, chai_1.expect)((yield (0, loopbackRequest_1.default)(server('ticket-for-app-a')).get('/apps/app-a/download')).status).to.equal(200);
             for (const id of ['app-b', 'app-shared']) {
-                const r = yield (0, supertest_1.default)(server('ticket-for-app-a')).get(`/apps/${id}/download`);
+                const r = yield (0, loopbackRequest_1.default)(server('ticket-for-app-a')).get(`/apps/${id}/download`);
                 (0, chai_1.expect)(r.status, id).to.equal(404);
                 (0, chai_1.expect)(r.body, id).to.deep.equal(UNKNOWN);
             }
@@ -154,20 +154,20 @@ describe('apps follow the device team rule', () => {
             deleteApp = sinon_1.default.stub(app_service_1.APP_SERVICE, 'deleteApp').resolves(undefined);
         });
         it('is refused to a member', () => __awaiter(void 0, void 0, void 0, function* () {
-            const r = yield (0, supertest_1.default)(server('member-a'))
+            const r = yield (0, loopbackRequest_1.default)(server('member-a'))
                 .delete('/apps/app-a')
                 .set('Origin', 'http://127.0.0.1');
             (0, chai_1.expect)(r.status).to.equal(403);
             (0, chai_1.expect)(deleteApp.called).to.equal(false);
         }));
         it('lets an admin delete any team’s app', () => __awaiter(void 0, void 0, void 0, function* () {
-            const r = yield (0, supertest_1.default)(server('admin')).delete('/apps/app-b');
+            const r = yield (0, loopbackRequest_1.default)(server('admin')).delete('/apps/app-b');
             (0, chai_1.expect)(r.status).to.equal(204);
             (0, chai_1.expect)(deleteApp.calledOnceWith('app-b')).to.equal(true);
         }));
         it('answers an unknown id 404, and a hidden app the same way, deleting nothing', () => __awaiter(void 0, void 0, void 0, function* () {
-            const unknown = yield (0, supertest_1.default)(server('admin')).delete('/apps/no-such-app');
-            const hidden = yield (0, supertest_1.default)(server('team-scoped-admin')).delete('/apps/app-b');
+            const unknown = yield (0, loopbackRequest_1.default)(server('admin')).delete('/apps/no-such-app');
+            const hidden = yield (0, loopbackRequest_1.default)(server('team-scoped-admin')).delete('/apps/app-b');
             (0, chai_1.expect)(unknown.status).to.equal(404);
             (0, chai_1.expect)(unknown.body).to.deep.equal(UNKNOWN);
             (0, chai_1.expect)(hidden.status).to.equal(unknown.status);
@@ -187,7 +187,7 @@ describe('apps follow the device team rule', () => {
                 .callsFake(((args) => __awaiter(void 0, void 0, void 0, function* () { return args.where.id === 'team-a' ? { id: 'team-a' } : null; })));
         });
         const post = (caller, teamId) => {
-            const r = (0, supertest_1.default)(server(caller))
+            const r = (0, loopbackRequest_1.default)(server(caller))
                 .post('/apps/upload')
                 .attach('app', Buffer.from('ipa bytes'), 'app.ipa');
             return teamId === undefined ? r : r.field('teamId', teamId);
@@ -229,7 +229,7 @@ describe('apps follow the device team rule', () => {
                 .stub(prisma_1.prisma.team, 'findUnique')
                 .callsFake(((args) => __awaiter(void 0, void 0, void 0, function* () { return ['team-a', 'team-b'].includes(args.where.id) ? { id: args.where.id } : null; })));
         });
-        const put = (caller, id, body) => (0, supertest_1.default)(server(caller))
+        const put = (caller, id, body) => (0, loopbackRequest_1.default)(server(caller))
             .put(`/apps/${id}/team`)
             .send(body);
         it('moves an app to a team, as PUT /device/:udid/team does a phone', () => __awaiter(void 0, void 0, void 0, function* () {

package/lib/test/unit/auth-me-auth-disabled.test.js

@@ -16,7 +16,7 @@ require("reflect-metadata");
 const chai_1 = require("chai");
 const sinon_1 = __importDefault(require("sinon"));
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const typedi_1 = require("typedi");
 const auth_1 = require("../../src/app/routers/auth");
 const UserService_1 = require("../../src/services/UserService");
@@ -58,7 +58,7 @@ describe('GET /auth/me with authDisabled', () => {
         config_1.config.authDisabled = true;
         // No User row exists for the synthetic id — this is the real-world state.
         const findById = sinon_1.default.stub(typedi_1.Container.get(UserService_1.UserService), 'findById').resolves(null);
-        const res = yield (0, supertest_1.default)(appWithSyntheticAuth()).get('/auth/me');
+        const res = yield (0, loopbackRequest_1.default)(appWithSyntheticAuth()).get('/auth/me');
         (0, chai_1.expect)(res.status).to.equal(200);
         (0, chai_1.expect)(res.body.userId).to.equal('auth-disabled');
         (0, chai_1.expect)(res.body.role).to.equal('SUPER_ADMIN');
@@ -74,14 +74,17 @@ describe('GET /auth/me with authDisabled', () => {
         sinon_1.default.stub(typedi_1.Container.get(UserService_1.UserService), 'findById').resolves({
             id: 'auth-disabled', email: 'u@x.local', name: 'U', role: 'SUPER_ADMIN', accessKey: 'ak',
         });
-        const res = yield (0, supertest_1.default)(appWithSyntheticAuth()).get('/auth/me');
+        const res = yield (0, loopbackRequest_1.default)(appWithSyntheticAuth()).get('/auth/me');
         (0, chai_1.expect)(res.status).to.equal(200);
         (0, chai_1.expect)(res.body.authDisabled).to.equal(false);
+        // The caller's own key, unredacted: the logger's accessKey redaction
+        // never touches a response.
+        (0, chai_1.expect)(res.body.accessKey).to.equal('ak');
     }));
     it('still 401s when auth is enabled and the user does not exist', () => __awaiter(void 0, void 0, void 0, function* () {
         config_1.config.authDisabled = false;
         sinon_1.default.stub(typedi_1.Container.get(UserService_1.UserService), 'findById').resolves(null);
-        const res = yield (0, supertest_1.default)(appWithSyntheticAuth()).get('/auth/me');
+        const res = yield (0, loopbackRequest_1.default)(appWithSyntheticAuth()).get('/auth/me');
         (0, chai_1.expect)(res.status).to.equal(401);
         (0, chai_1.expect)(res.body.error).to.equal('unauthenticated');
     }));

package/lib/test/unit/authMiddleware.appTicket.spec.js

@@ -16,7 +16,7 @@ require("reflect-metadata");
 const chai_1 = require("chai");
 const sinon_1 = __importDefault(require("sinon"));
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const typedi_1 = require("typedi");
 const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
@@ -110,7 +110,7 @@ describe('authMiddleware — app download ticket', () => {
         res.on('end', () => done(null, Buffer.concat(chunks)));
     };
     const download = (id, ticket) => {
-        const r = (0, supertest_1.default)(app).get(`/xenon/api/apps/${id}/download`);
+        const r = (0, loopbackRequest_1.default)(app).get(`/xenon/api/apps/${id}/download`);
         return ticket === undefined ? r : r.query({ ticket });
     };
     const INVALID = { error: 'invalid ticket' };
@@ -158,16 +158,16 @@ describe('authMiddleware — app download ticket', () => {
     }));
     it('an app ticket is refused on the stream route', () => __awaiter(void 0, void 0, void 0, function* () {
         const t = yield tickets.mint('UDID-1');
-        const r = yield (0, supertest_1.default)(app).get('/xenon/api/control/UDID-1/stream').query({ ticket: t });
+        const r = yield (0, loopbackRequest_1.default)(app).get('/xenon/api/control/UDID-1/stream').query({ ticket: t });
         (0, chai_1.expect)(r.status).to.equal(401);
         (0, chai_1.expect)(r.body).to.deep.equal(INVALID);
     }));
     it('opens nothing but the download: not the list, nor another method', () => __awaiter(void 0, void 0, void 0, function* () {
         const t = yield tickets.mint('app-A');
-        const list = yield (0, supertest_1.default)(app).get('/xenon/api/apps').query({ ticket: t });
+        const list = yield (0, loopbackRequest_1.default)(app).get('/xenon/api/apps').query({ ticket: t });
         (0, chai_1.expect)(list.status).to.equal(401);
         (0, chai_1.expect)(list.body).to.deep.equal({ error: 'unauthenticated' });
-        const del = yield (0, supertest_1.default)(app).delete('/xenon/api/apps/app-A/download').query({ ticket: t });
+        const del = yield (0, loopbackRequest_1.default)(app).delete('/xenon/api/apps/app-A/download').query({ ticket: t });
         (0, chai_1.expect)(del.status).to.equal(401);
         (0, chai_1.expect)(del.body).to.deep.equal({ error: 'unauthenticated' });
         // Neither attempt spent it.

package/lib/test/unit/authMiddleware.bearer.spec.js

@@ -25,6 +25,7 @@ const UserService_1 = require("../../src/services/UserService");
 const ApiKeyService_1 = require("../../src/services/ApiKeyService");
 const UserSessionService_1 = require("../../src/services/UserSessionService");
 const prisma_1 = require("../../src/prisma");
+const container_registration_1 = require("../helpers/container-registration");
 function fakeRes() {
     const res = { statusCode: 200 };
     res.status = (c) => { res.statusCode = c; return res; };
@@ -36,7 +37,9 @@ describe('authMiddleware — Bearer branch', () => {
     let dir;
     let keySvc;
     const user = { id: 'u1', role: 'MEMBER', status: 'ACTIVE' };
+    let restoreContainer;
     beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        restoreContainer = (0, container_registration_1.saveRegistrations)(JwtKeyService_1.JwtKeyService, UserService_1.UserService, ApiKeyService_1.ApiKeyService, UserSessionService_1.UserSessionService);
         dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-bearer-'));
         keySvc = new JwtKeyService_1.JwtKeyService();
         yield keySvc.init(dir);
@@ -48,7 +51,7 @@ describe('authMiddleware — Bearer branch', () => {
     }));
     afterEach(() => {
         sinon_1.default.restore();
-        typedi_1.Container.reset();
+        restoreContainer();
         fs_1.default.rmSync(dir, { recursive: true, force: true });
     });
     it('accepts a valid xenon-rest Bearer token and sets req.auth', () => __awaiter(void 0, void 0, void 0, function* () {

package/lib/test/unit/authMiddleware.mcpAudience.spec.js

@@ -25,6 +25,7 @@ const UserService_1 = require("../../src/services/UserService");
 const ApiKeyService_1 = require("../../src/services/ApiKeyService");
 const UserSessionService_1 = require("../../src/services/UserSessionService");
 const prisma_1 = require("../../src/prisma");
+const container_registration_1 = require("../helpers/container-registration");
 function fakeRes() {
     const res = { statusCode: 200 };
     res.status = (c) => { res.statusCode = c; return res; };
@@ -39,7 +40,9 @@ describe('authMiddleware — Bearer branch accepts xenon-mcp audience', () => {
     let dir;
     let keySvc;
     const user = { id: 'u1', role: 'MEMBER', status: 'ACTIVE' };
+    let restoreContainer;
     beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        restoreContainer = (0, container_registration_1.saveRegistrations)(JwtKeyService_1.JwtKeyService, UserService_1.UserService, ApiKeyService_1.ApiKeyService, UserSessionService_1.UserSessionService);
         dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-mcp-aud-'));
         keySvc = new JwtKeyService_1.JwtKeyService();
         yield keySvc.init(dir);
@@ -51,7 +54,7 @@ describe('authMiddleware — Bearer branch accepts xenon-mcp audience', () => {
     }));
     afterEach(() => {
         sinon_1.default.restore();
-        typedi_1.Container.reset();
+        restoreContainer();
         fs_1.default.rmSync(dir, { recursive: true, force: true });
     });
     it('accepts a valid xenon-mcp Bearer token (ACTIVE user) and sets req.auth.kind=bearer', () => __awaiter(void 0, void 0, void 0, function* () {

package/lib/test/unit/authMiddleware.streamTicket.spec.js

@@ -16,7 +16,7 @@ require("reflect-metadata");
 const chai_1 = require("chai");
 const sinon_1 = __importDefault(require("sinon"));
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const typedi_1 = require("typedi");
 const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
@@ -29,6 +29,8 @@ const device_store_1 = require("../../src/data-service/device-store");
 const UserService_1 = require("../../src/services/UserService");
 const ApiKeyService_1 = require("../../src/services/ApiKeyService");
 const UserSessionService_1 = require("../../src/services/UserSessionService");
+const container_registration_1 = require("../helpers/container-registration");
+const loopbackServer_1 = require("../helpers/loopbackServer");
 function fakeRes() {
     const res = { statusCode: 200 };
     res.status = (c) => {
@@ -46,7 +48,9 @@ describe('authMiddleware — stream-ticket branch', () => {
     let dir;
     let keySvc;
     let ticketSvc;
+    let restoreContainer;
     beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        restoreContainer = (0, container_registration_1.saveRegistrations)(JwtKeyService_1.JwtKeyService, StreamTicketService_1.StreamTicketService, UserService_1.UserService, ApiKeyService_1.ApiKeyService, UserSessionService_1.UserSessionService);
         dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-authmw-ticket-'));
         keySvc = new JwtKeyService_1.JwtKeyService();
         yield keySvc.init(dir);
@@ -62,7 +66,7 @@ describe('authMiddleware — stream-ticket branch', () => {
     }));
     afterEach(() => {
         sinon_1.default.restore();
-        typedi_1.Container.reset();
+        restoreContainer();
         fs_1.default.rmSync(dir, { recursive: true, force: true });
     });
     // req.path here mirrors what authMiddleware actually sees at runtime:
@@ -194,7 +198,12 @@ describe('authMiddleware — stream-ticket branch (real mount-order, supertest)'
     let dir;
     let app;
     let ticketSvc;
+    let restoreContainer;
+    // Served on 127.0.0.1: request(app) listens on every address and connects
+    // to 127.0.0.1, where another process's listener on that port can answer.
+    const loopback = (0, loopbackServer_1.loopbackServers)();
     beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        restoreContainer = (0, container_registration_1.saveRegistrations)(JwtKeyService_1.JwtKeyService, StreamTicketService_1.StreamTicketService, UserService_1.UserService, ApiKeyService_1.ApiKeyService, UserSessionService_1.UserSessionService);
         dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-authmw-mount-'));
         const keySvc = new JwtKeyService_1.JwtKeyService();
         yield keySvc.init(dir);
@@ -222,21 +231,24 @@ describe('authMiddleware — stream-ticket branch (real mount-order, supertest)'
         app = (0, express_1.default)();
         app.use('/xenon/api', apiRouter);
     }));
-    afterEach(() => {
+    afterEach(() => __awaiter(void 0, void 0, void 0, function* () {
         sinon_1.default.restore();
-        typedi_1.Container.reset();
+        restoreContainer();
+        yield loopback.closeAll();
         fs_1.default.rmSync(dir, { recursive: true, force: true });
-    });
+    }));
     it('a valid ticket on GET /xenon/api/control/:udid/stream reaches the route (past 401)', () => __awaiter(void 0, void 0, void 0, function* () {
         const ticket = yield ticketSvc.mint('UDID-1', 'actor-1');
-        const res = yield (0, supertest_1.default)(app).get('/xenon/api/control/UDID-1/stream').query({ ticket });
+        const res = yield (0, loopbackRequest_1.default)(yield loopback.serve(app))
+            .get('/xenon/api/control/UDID-1/stream')
+            .query({ ticket });
         // The ticket branch fired: request cleared auth and hit the handler's
         // device lookup (404), rather than being rejected at the middleware (401).
         (0, chai_1.expect)(res.status).to.not.equal(401);
         (0, chai_1.expect)(res.status).to.equal(404); // 'Device not found' from the stubbed store
     }));
     it('the SAME request without a ticket is rejected 401 (proves the guard is non-vacuous)', () => __awaiter(void 0, void 0, void 0, function* () {
-        const res = yield (0, supertest_1.default)(app).get('/xenon/api/control/UDID-1/stream');
+        const res = yield (0, loopbackRequest_1.default)(yield loopback.serve(app)).get('/xenon/api/control/UDID-1/stream');
         (0, chai_1.expect)(res.status).to.equal(401);
         (0, chai_1.expect)(res.body).to.deep.equal({ error: 'unauthenticated' });
     }));

package/lib/test/unit/authMiddleware.test.js

@@ -92,6 +92,9 @@ describe('authMiddleware', () => {
             role: 'MEMBER',
             status: 'ACTIVE',
         });
+        // A member's teams are looked up; without this the lookup read the
+        // developer's own database.
+        sinon_1.default.stub(prisma_1.prisma.teamMember, 'findMany').resolves([]);
         const req = { headers: { cookie: 'xenon_dashboard_session=legacy-key-id' } };
         let called = false;
         yield (0, authMiddleware_1.authMiddleware)(req, mkRes(), () => {

package/lib/test/unit/bug-report/route.spec.js

@@ -15,7 +15,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 require("reflect-metadata");
 const chai_1 = require("chai");
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../../helpers/loopbackRequest"));
 const sinon_1 = __importDefault(require("sinon"));
 const BugReportService_1 = require("../../../src/services/bug-report/BugReportService");
 const bug_report_1 = __importDefault(require("../../../src/app/routers/bug-report"));
@@ -63,8 +63,8 @@ describe('bug-report route', () => {
                 throw new Error(`Session ${opts.sessionId} not found`);
             throw new Error('built a report');
         }));
-        const hidden = yield (0, supertest_1.default)(makeApp()).post('/sessions/sess-b/bug-report?mode=full');
-        const unknown = yield (0, supertest_1.default)(makeApp()).post('/sessions/sess-nope/bug-report?mode=full');
+        const hidden = yield (0, loopbackRequest_1.default)(makeApp()).post('/sessions/sess-b/bug-report?mode=full');
+        const unknown = yield (0, loopbackRequest_1.default)(makeApp()).post('/sessions/sess-nope/bug-report?mode=full');
         (0, chai_1.expect)(hidden.status).to.equal(404);
         (0, chai_1.expect)(unknown.status).to.equal(404);
         (0, chai_1.expect)(hidden.body).to.deep.equal({ error: 'Session sess-b not found' });
@@ -78,26 +78,26 @@ describe('bug-report route', () => {
             entries: [{ name: 'a.txt', source: { kind: 'buffer', data: Buffer.from('hi') } }],
             cleanup: () => __awaiter(void 0, void 0, void 0, function* () { }),
         });
-        const res = yield (0, supertest_1.default)(makeApp({ admin: true })).post('/sessions/sess-b/bug-report?mode=full');
+        const res = yield (0, loopbackRequest_1.default)(makeApp({ admin: true })).post('/sessions/sess-b/bug-report?mode=full');
         (0, chai_1.expect)(res.status).to.equal(200);
     }));
     it('401 when the caller is not signed in', () => __awaiter(void 0, void 0, void 0, function* () {
-        const res = yield (0, supertest_1.default)(makeApp({ signedIn: false })).post('/sessions/sess-1/bug-report?mode=full');
+        const res = yield (0, loopbackRequest_1.default)(makeApp({ signedIn: false })).post('/sessions/sess-1/bug-report?mode=full');
         (0, chai_1.expect)(res.status).to.equal(401);
     }));
     it('400 on invalid mode', () => __awaiter(void 0, void 0, void 0, function* () {
-        const res = yield (0, supertest_1.default)(makeApp()).post('/sessions/sess-1/bug-report?mode=bogus');
+        const res = yield (0, loopbackRequest_1.default)(makeApp()).post('/sessions/sess-1/bug-report?mode=bogus');
         (0, chai_1.expect)(res.status).to.equal(400);
     }));
     it('400 on out-of-range windowSec', () => __awaiter(void 0, void 0, void 0, function* () {
-        const res = yield (0, supertest_1.default)(makeApp()).post('/sessions/sess-1/bug-report?mode=slice&windowSec=9999');
+        const res = yield (0, loopbackRequest_1.default)(makeApp()).post('/sessions/sess-1/bug-report?mode=slice&windowSec=9999');
         (0, chai_1.expect)(res.status).to.equal(400);
     }));
     it('404 when service throws not-found', () => __awaiter(void 0, void 0, void 0, function* () {
         sinon_1.default
             .stub(BugReportService_1.BugReportService.prototype, 'assemble')
             .rejects(new Error('Session sess-1 not found'));
-        const res = yield (0, supertest_1.default)(makeApp()).post('/sessions/sess-1/bug-report?mode=full');
+        const res = yield (0, loopbackRequest_1.default)(makeApp()).post('/sessions/sess-1/bug-report?mode=full');
         (0, chai_1.expect)(res.status).to.equal(404);
     }));
     it('200 streams zip on success', () => __awaiter(void 0, void 0, void 0, function* () {
@@ -107,7 +107,7 @@ describe('bug-report route', () => {
             entries: [{ name: 'a.txt', source: { kind: 'buffer', data: Buffer.from('hi') } }],
             cleanup: () => __awaiter(void 0, void 0, void 0, function* () { }),
         });
-        const res = yield (0, supertest_1.default)(makeApp())
+        const res = yield (0, loopbackRequest_1.default)(makeApp())
             .post('/sessions/sess-1/bug-report?mode=full')
             .buffer(true)
             .parse((r, cb) => {