@xenon-device-management/xenon 2.0.0 → 2.1.0

package/lib/test/unit/cliargs-admin-only.spec.js

@@ -49,7 +49,7 @@ require("reflect-metadata");
 const chai_1 = require("chai");
 const sinon_1 = __importDefault(require("sinon"));
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const typedi_1 = require("typedi");
 const prisma_1 = require("../../src/prisma");
 const config_1 = require("../../src/config");
@@ -125,7 +125,7 @@ describe('GET /xenon/api/cliArgs', () => {
         sinon_1.default.restore();
         config_1.config.authDisabled = savedAuthDisabled;
     });
-    const asCookie = (sessionId) => (0, supertest_1.default)(app).get('/xenon/api/cliArgs').set('Cookie', `xenon_dashboard_session=${sessionId}`);
+    const asCookie = (sessionId) => (0, loopbackRequest_1.default)(app).get('/xenon/api/cliArgs').set('Cookie', `xenon_dashboard_session=${sessionId}`);
     function asApiKey(scopes, ownerId) {
         sinon_1.default.stub(typedi_1.Container.get(ApiKeyService_1.ApiKeyService), 'verifyPair').resolves({
             id: 'key-1',
@@ -138,7 +138,7 @@ describe('GET /xenon/api/cliArgs', () => {
             userId: ownerId,
             teamId: null,
         });
-        return (0, supertest_1.default)(app)
+        return (0, loopbackRequest_1.default)(app)
             .get('/xenon/api/cliArgs')
             .set('x-xenon-access-key', 'ak')
             .set('x-xenon-token', 'tok');

package/lib/test/unit/clipboard-route.spec.js

@@ -16,7 +16,7 @@ require("reflect-metadata");
 const chai_1 = require("chai");
 const sinon_1 = __importDefault(require("sinon"));
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const typedi_1 = require("typedi");
 const control_1 = __importDefault(require("../../src/app/routers/control"));
 const device_store_1 = require("../../src/data-service/device-store");
@@ -24,6 +24,8 @@ const ApiKeyService_1 = require("../../src/services/ApiKeyService");
 const device_managers_1 = require("../../src/device-managers");
 const clipboardErrors_1 = require("../../src/device-managers/clipboardErrors");
 const authMiddleware_1 = require("../../src/middleware/authMiddleware");
+const container_registration_1 = require("../helpers/container-registration");
+const loopbackServer_1 = require("../helpers/loopbackServer");
 /**
  * GET/POST /control/:udid/clipboard answered 200 whatever happened on the
  * device: the Android manager swallowed its errors, and its "set" had no
@@ -57,7 +59,14 @@ function buildApp() {
 }
 describe('GET/POST /control/:udid/clipboard', () => {
     let manager;
+    let restoreContainer;
+    // Served on 127.0.0.1, not by request(app): that listens on every address
+    // and connects to 127.0.0.1, where another process's listener on the same
+    // port answers instead (a stray 501 or a socket hang-up in a full run).
+    const loopback = (0, loopbackServer_1.loopbackServers)();
+    const app = () => __awaiter(void 0, void 0, void 0, function* () { return loopback.serve(buildApp()); });
     beforeEach(() => {
+        restoreContainer = (0, container_registration_1.saveRegistrations)(ApiKeyService_1.ApiKeyService, device_managers_1.XenonManager);
         manager = new AndroidDeviceManager();
         sinon_1.default.stub(device_store_1.DeviceStoreFactory, 'getStore').returns({
             findDevice: () => __awaiter(void 0, void 0, void 0, function* () {
@@ -73,19 +82,20 @@ describe('GET/POST /control/:udid/clipboard', () => {
         typedi_1.Container.set(ApiKeyService_1.ApiKeyService, new ApiKeyService_1.ApiKeyService());
         typedi_1.Container.set(device_managers_1.XenonManager, { deviceInstances: () => __awaiter(void 0, void 0, void 0, function* () { return [manager]; }) });
     });
-    afterEach(() => {
+    afterEach(() => __awaiter(void 0, void 0, void 0, function* () {
         sinon_1.default.restore();
-        typedi_1.Container.reset();
-    });
+        restoreContainer();
+        yield loopback.closeAll();
+    }));
     it('returns the clipboard text', () => __awaiter(void 0, void 0, void 0, function* () {
         manager.getClipboard.resolves('xenonread');
-        const res = yield (0, supertest_1.default)(buildApp()).get(`/xenon/api/control/${UDID}/clipboard`);
+        const res = yield (0, loopbackRequest_1.default)(yield app()).get(`/xenon/api/control/${UDID}/clipboard`);
         (0, chai_1.expect)(res.status).to.equal(200);
         (0, chai_1.expect)(res.body).to.deep.equal({ content: 'xenonread' });
     }));
     it('says why a read failed, with a 500', () => __awaiter(void 0, void 0, void 0, function* () {
         manager.getClipboard.rejects(new Error('Appium Settings didn’t return the clipboard.'));
-        const res = yield (0, supertest_1.default)(buildApp()).get(`/xenon/api/control/${UDID}/clipboard`);
+        const res = yield (0, loopbackRequest_1.default)(yield app()).get(`/xenon/api/control/${UDID}/clipboard`);
         (0, chai_1.expect)(res.status).to.equal(500);
         (0, chai_1.expect)(res.body.error).to.match(/Appium Settings/);
     }));
@@ -93,7 +103,7 @@ describe('GET/POST /control/:udid/clipboard', () => {
     // won't help. 501 says exactly that.
     it('answers 501 when the device cannot set its clipboard', () => __awaiter(void 0, void 0, void 0, function* () {
         manager.setClipboard.rejects(new clipboardErrors_1.ClipboardUnsupportedError('Appium Settings can only read it.'));
-        const res = yield (0, supertest_1.default)(buildApp())
+        const res = yield (0, loopbackRequest_1.default)(yield app())
             .post(`/xenon/api/control/${UDID}/clipboard`)
             .send({ content: 'x' });
         (0, chai_1.expect)(res.status).to.equal(501);
@@ -101,7 +111,7 @@ describe('GET/POST /control/:udid/clipboard', () => {
     }));
     it('still answers 500 for any other write failure', () => __awaiter(void 0, void 0, void 0, function* () {
         manager.setClipboard.rejects(new Error('WDA is not running'));
-        const res = yield (0, supertest_1.default)(buildApp())
+        const res = yield (0, loopbackRequest_1.default)(yield app())
             .post(`/xenon/api/control/${UDID}/clipboard`)
             .send({ content: 'x' });
         (0, chai_1.expect)(res.status).to.equal(500);

package/lib/test/unit/command-auth-appium-server.spec.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
     return new (P || (P = Promise))(function (resolve, reject) {
@@ -16,7 +49,8 @@ const chai_1 = require("chai");
 const http_1 = __importDefault(require("http"));
 const path_1 = __importDefault(require("path"));
 const sinon_1 = __importDefault(require("sinon"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
+const ws_1 = __importStar(require("ws"));
 const commandCaller_1 = require("../../src/middleware/commandCaller");
 const commandAuth_1 = require("../../src/middleware/commandAuth");
 const registerCommandAuth_1 = require("../../src/app/registerCommandAuth");
@@ -29,9 +63,22 @@ const registerCommandAuth_1 = require("../../src/app/registerCommandAuth");
  * Express 5 as Appium builds it: its middleware, then every WebDriver route,
  * then the plugin updaters, then its catch-all 404. The fake driver records
  * each command that reaches it, which shows whether the check ran first.
+ *
+ * The session listing and the BiDi WebSocket go through the same server:
+ * registerSessionUpgradeGuard is a server updater too, and the BiDi handler is
+ * added after boot with addWebSocketHandler, as Appium's main adds it.
  */
 const EXACT_UNKNOWN_SESSION = JSON.stringify(commandAuth_1.UNKNOWN_SESSION_BODY);
 const LIVE_SESSION = 'live-session';
+const BOBS_SESSION = 'bobs-session';
+const LISTING = [
+    { id: LIVE_SESSION, created: 1, capabilities: { platformName: 'Fake' } },
+    { id: BOBS_SESSION, created: 2, capabilities: { platformName: 'Fake' } },
+];
+const OWNERS = { [LIVE_SESSION]: 'alice', [BOBS_SESSION]: 'bob' };
+function nativelyUsesUpgradeListener() {
+    return typeof http_1.default.createServer().shouldUpgradeCallback !== 'undefined';
+}
 function appiumBaseDriver() {
     const appiumDir = path_1.default.dirname(require.resolve('appium/package.json'));
     // eslint-disable-next-line @typescript-eslint/no-var-requires
@@ -47,11 +94,14 @@ describe("per-command auth in Appium 3's own server()", () => {
     let server;
     let commands;
     let enabled;
+    let infos;
     let warnings;
+    let bidiConnections;
     function boot() {
-        return __awaiter(this, void 0, void 0, function* () {
+        return __awaiter(this, arguments, void 0, function* (opts = {}) {
             const baseDriver = appiumBaseDriver();
             commands = [];
+            bidiConnections = [];
             const driver = {
                 log: quiet,
                 protocol: 'W3C',
@@ -63,44 +113,88 @@ describe("per-command auth in Appium 3's own server()", () => {
                     commands.push(command);
                     if (command === 'createSession')
                         return [LIVE_SESSION, {}];
+                    if (command === 'getAppiumSessions')
+                        return LISTING;
                     return 'about:blank';
                 }),
             };
+            const credentials = { 'alice-token': 'alice', 'bob-token': 'bob' };
             const verifier = new commandCaller_1.CommandCallerVerifier({
                 verifyKeyPair: sinon_1.default.stub().callsFake((_ak, token) => __awaiter(this, void 0, void 0, function* () {
-                    return token === 'alice-token'
+                    return credentials[token]
                         ? {
-                            row: { id: 'k', userId: 'alice', scopes: 'sessions', expiresAt: null },
-                            user: { id: 'alice', role: 'MEMBER', status: 'ACTIVE' },
+                            row: { id: 'k', userId: credentials[token], scopes: 'sessions', expiresAt: null },
+                            user: { id: credentials[token], role: 'MEMBER', status: 'ACTIVE' },
                         }
                         : null;
                 })),
                 verifyBearer: sinon_1.default.stub().resolves(null),
             });
-            server = yield baseDriver.server({
-                routeConfiguringFunction: baseDriver.routeConfiguringFunction(driver),
-                port: 0,
-                hostname: '127.0.0.1',
-                basePath: '/wd/hub',
-                // Appium hands plugins the raw CLI args; the base path here is normalised
-                // by registerCommandAuth itself.
-                cliArgs: { basePath: 'wd/hub/' },
-                serverUpdaters: [
-                    (app, _httpServer, cliArgs) => {
-                        (0, registerCommandAuth_1.registerCommandAuth)(app, cliArgs, {
-                            enabled: () => enabled,
-                            authDisabled: () => false,
-                            verifier,
-                            ownerOf: (id) => __awaiter(this, void 0, void 0, function* () { return (id === LIVE_SESSION ? 'alice' : null); }),
-                            logger: {
-                                info: () => undefined,
-                                warn: (m) => warnings.push(m),
-                                error: () => undefined,
-                            },
-                        });
-                    },
-                ],
+            const deps = {
+                enabled: () => enabled,
+                authDisabled: () => false,
+                verifier,
+                ownerOf: (id) => __awaiter(this, void 0, void 0, function* () { var _a; return (_a = OWNERS[id]) !== null && _a !== void 0 ? _a : null; }),
+                ownersOf: (ids) => __awaiter(this, void 0, void 0, function* () { return new Map(ids.map((id) => { var _a; return [id, (_a = OWNERS[id]) !== null && _a !== void 0 ? _a : null]; })); }),
+                logger: {
+                    info: (m) => infos.push(m),
+                    warn: (m) => warnings.push(m),
+                    error: () => undefined,
+                },
+            };
+            const createServer = http_1.default.createServer;
+            const forced = opts.upgrades === 'listener' ? sinon_1.default.stub(http_1.default, 'createServer') : undefined;
+            forced === null || forced === void 0 ? void 0 : forced.callsFake(((app) => {
+                const s = createServer(app);
+                if (typeof s.shouldUpgradeCallback === 'undefined') {
+                    s.shouldUpgradeCallback = () => true;
+                }
+                return s;
+            }));
+            try {
+                server = yield baseDriver.server({
+                    routeConfiguringFunction: baseDriver.routeConfiguringFunction(driver),
+                    port: 0,
+                    hostname: '127.0.0.1',
+                    basePath: '/wd/hub',
+                    // Appium hands plugins the raw CLI args; the base path here is normalised
+                    // by registerCommandAuth itself.
+                    cliArgs: { basePath: 'wd/hub/' },
+                    serverUpdaters: [
+                        (app, httpServer, cliArgs) => {
+                            (0, registerCommandAuth_1.registerCommandAuth)(app, cliArgs, deps);
+                            (0, registerCommandAuth_1.registerSessionUpgradeGuard)(httpServer, app, cliArgs, deps);
+                        },
+                    ],
+                });
+            }
+            finally {
+                forced === null || forced === void 0 ? void 0 : forced.restore();
+            }
+            // Appium's main adds its BiDi handler right after server() resolves.
+            const bidi = new ws_1.WebSocketServer({ noServer: true });
+            bidi.on('connection', (ws, req) => {
+                bidiConnections.push(String(req.url));
+                ws.on('error', () => undefined);
+            });
+            yield booted().addWebSocketHandler('/wd/hub/bidi', bidi);
+            yield booted().addWebSocketHandler('/wd/hub/bidi/:sessionId', bidi);
+        });
+    }
+    function upgrade(urlPath, headers = {}) {
+        const { port } = booted().address();
+        return new Promise((resolve) => {
+            const ws = new ws_1.default(`ws://127.0.0.1:${port}${urlPath}`, { headers });
+            ws.on('open', () => {
+                resolve('open');
+                ws.terminate();
+            });
+            ws.on('unexpected-response', (req, res) => {
+                var _a;
+                resolve((_a = res.statusCode) !== null && _a !== void 0 ? _a : 0);
+                req.destroy();
             });
+            ws.on('error', (err) => resolve(err.message));
         });
     }
     // Appium's HTTP logger writes every request to stdout; quiet it here only.
@@ -130,6 +224,7 @@ describe("per-command auth in Appium 3's own server()", () => {
     }
     beforeEach(() => {
         enabled = true;
+        infos = [];
         warnings = [];
     });
     afterEach(() => __awaiter(void 0, void 0, void 0, function* () {
@@ -144,7 +239,7 @@ describe("per-command auth in Appium 3's own server()", () => {
     }));
     it("refuses a session command before Appium's route runs", () => __awaiter(void 0, void 0, void 0, function* () {
         yield boot();
-        const res = yield (0, supertest_1.default)(booted()).get(`/wd/hub/session/${LIVE_SESSION}/url`);
+        const res = yield (0, loopbackRequest_1.default)(booted()).get(`/wd/hub/session/${LIVE_SESSION}/url`);
         (0, chai_1.expect)(res.status).to.equal(404);
         (0, chai_1.expect)(res.text).to.equal(EXACT_UNKNOWN_SESSION);
         (0, chai_1.expect)(commands).to.deep.equal([]);
@@ -152,7 +247,7 @@ describe("per-command auth in Appium 3's own server()", () => {
     }));
     it("lets the owner through to Appium's route and the driver", () => __awaiter(void 0, void 0, void 0, function* () {
         yield boot();
-        const res = yield (0, supertest_1.default)(booted())
+        const res = yield (0, loopbackRequest_1.default)(booted())
             .get(`/wd/hub/session/${LIVE_SESSION}/url`)
             .set({ 'x-xenon-access-key': 'ak', 'x-xenon-token': 'alice-token' });
         (0, chai_1.expect)(res.status).to.equal(200);
@@ -161,7 +256,7 @@ describe("per-command auth in Appium 3's own server()", () => {
     }));
     it('lets createSession reach the driver without credentials', () => __awaiter(void 0, void 0, void 0, function* () {
         yield boot();
-        yield (0, supertest_1.default)(booted())
+        yield (0, loopbackRequest_1.default)(booted())
             .post('/wd/hub/session')
             .send({ capabilities: { alwaysMatch: { platformName: 'Fake' } } })
             .expect(200);
@@ -170,7 +265,7 @@ describe("per-command auth in Appium 3's own server()", () => {
     it("with the setting off, Appium gives its own unknown-session answer, which the refusal matches but for Appium's stack trace", () => __awaiter(void 0, void 0, void 0, function* () {
         enabled = false;
         yield boot();
-        const res = yield (0, supertest_1.default)(booted()).get('/wd/hub/session/no-such-session/url');
+        const res = yield (0, loopbackRequest_1.default)(booted()).get('/wd/hub/session/no-such-session/url');
         (0, chai_1.expect)(res.status).to.equal(404);
         (0, chai_1.expect)(res.headers['content-type']).to.equal('application/json; charset=utf-8');
         (0, chai_1.expect)(res.body.value.error).to.equal(commandAuth_1.UNKNOWN_SESSION_BODY.value.error);
@@ -181,4 +276,64 @@ describe("per-command auth in Appium 3's own server()", () => {
         (0, chai_1.expect)(res.body.value.stacktrace).to.match(/^NoSuchDriverError: A session is either terminated or not started/);
         (0, chai_1.expect)(warnings).to.deep.equal([]);
     }));
+    describe("Appium's session listing (GET /appium/sessions)", () => {
+        it('answers a caller without credentials an empty list, though Appium produced the full one', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield boot();
+            const res = yield (0, loopbackRequest_1.default)(booted()).get('/wd/hub/appium/sessions');
+            (0, chai_1.expect)(res.status).to.equal(200);
+            (0, chai_1.expect)(res.headers['content-type']).to.equal('application/json; charset=utf-8');
+            (0, chai_1.expect)(res.text).to.equal('{"value":[]}');
+            (0, chai_1.expect)(commands).to.deep.equal(['getAppiumSessions']);
+            (0, chai_1.expect)(warnings).to.have.length(1);
+        }));
+        it('shows the owner only their own session', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield boot();
+            const res = yield (0, loopbackRequest_1.default)(booted())
+                .get('/wd/hub/appium/sessions')
+                .set({ 'x-xenon-access-key': 'ak', 'x-xenon-token': 'alice-token' });
+            (0, chai_1.expect)(res.body).to.deep.equal({ value: [LISTING[0]] });
+            (0, chai_1.expect)(infos.some((m) => m.includes('1 of 2'))).to.equal(true);
+        }));
+        it("with the setting off, answers Appium's listing untouched", () => __awaiter(void 0, void 0, void 0, function* () {
+            enabled = false;
+            yield boot();
+            const res = yield (0, loopbackRequest_1.default)(booted()).get('/wd/hub/appium/sessions');
+            (0, chai_1.expect)(res.body).to.deep.equal({ value: LISTING });
+        }));
+    });
+    for (const upgrades of ['native', 'listener']) {
+        const how = upgrades === 'listener' || nativelyUsesUpgradeListener()
+            ? 'with its upgrade listener'
+            : 'with its Express upgrade middleware';
+        describe(`the BiDi WebSocket, Appium dispatching upgrades ${how} (${upgrades})`, () => {
+            it('refuses a session upgrade without credentials with 404, before Appium attaches it', () => __awaiter(void 0, void 0, void 0, function* () {
+                yield boot({ upgrades });
+                (0, chai_1.expect)(yield upgrade(`/wd/hub/bidi/${LIVE_SESSION}`)).to.equal(404);
+                (0, chai_1.expect)(bidiConnections).to.deep.equal([]);
+                (0, chai_1.expect)(warnings).to.have.length(1);
+            }));
+            it('refuses another user with 404', () => __awaiter(void 0, void 0, void 0, function* () {
+                yield boot({ upgrades });
+                (0, chai_1.expect)(yield upgrade(`/wd/hub/bidi/${LIVE_SESSION}`, {
+                    'x-xenon-access-key': 'ak',
+                    'x-xenon-token': 'bob-token',
+                })).to.equal(404);
+                (0, chai_1.expect)(bidiConnections).to.deep.equal([]);
+            }));
+            it("lets the owner attach through Appium's own handler", () => __awaiter(void 0, void 0, void 0, function* () {
+                yield boot({ upgrades });
+                (0, chai_1.expect)(yield upgrade(`/wd/hub/bidi/${LIVE_SESSION}`, {
+                    'x-xenon-access-key': 'ak',
+                    'x-xenon-token': 'alice-token',
+                })).to.equal('open');
+                (0, chai_1.expect)(bidiConnections).to.deep.equal([`/wd/hub/bidi/${LIVE_SESSION}`]);
+            }));
+            it('with the setting off, lets anyone attach, as Appium does', () => __awaiter(void 0, void 0, void 0, function* () {
+                enabled = false;
+                yield boot({ upgrades });
+                (0, chai_1.expect)(yield upgrade(`/wd/hub/bidi/${LIVE_SESSION}`)).to.equal('open');
+                (0, chai_1.expect)(warnings).to.deep.equal([]);
+            }));
+        });
+    }
 });

package/lib/test/unit/command-auth.spec.js

@@ -16,7 +16,7 @@ const chai_1 = require("chai");
 const path_1 = __importDefault(require("path"));
 const sinon_1 = __importDefault(require("sinon"));
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const commandAuth_1 = require("../../src/middleware/commandAuth");
 const commandCaller_1 = require("../../src/middleware/commandCaller");
 const loopbackServer_1 = require("../helpers/loopbackServer");
@@ -199,14 +199,14 @@ describe('per-command auth (XENON_REQUIRE_COMMAND_AUTH)', () => {
             describe('who may drive a session', () => {
                 it("lets the owner's key through to the route", () => __awaiter(void 0, void 0, void 0, function* () {
                     const { app, ran } = yield lab();
-                    const res = yield (0, supertest_1.default)(app).get('/wd/hub/session/s-alice/url').set(as('alice-token'));
+                    const res = yield (0, loopbackRequest_1.default)(app).get('/wd/hub/session/s-alice/url').set(as('alice-token'));
                     (0, chai_1.expect)(res.status).to.equal(200);
                     (0, chai_1.expect)(ran).to.deep.equal(['getUrl']);
                     (0, chai_1.expect)(warnings).to.deep.equal([]);
                 }));
                 it("lets the owner's Bearer token through", () => __awaiter(void 0, void 0, void 0, function* () {
                     const { app, ran } = yield lab();
-                    yield (0, supertest_1.default)(app)
+                    yield (0, loopbackRequest_1.default)(app)
                         .get('/wd/hub/session/s-alice/url')
                         .set(bearer('alice-jwt'))
                         .expect(200);
@@ -214,13 +214,13 @@ describe('per-command auth (XENON_REQUIRE_COMMAND_AUTH)', () => {
                 }));
                 it('refuses another user with the unknown-session answer, before the route runs', () => __awaiter(void 0, void 0, void 0, function* () {
                     const { app, ran } = yield lab();
-                    const res = yield (0, supertest_1.default)(app).get('/wd/hub/session/s-alice/url').set(as('bob-token'));
+                    const res = yield (0, loopbackRequest_1.default)(app).get('/wd/hub/session/s-alice/url').set(as('bob-token'));
                     yield expectRefused(res);
                     (0, chai_1.expect)(ran).to.deep.equal([]);
                 }));
                 it('logs the refusal with the session and the caller, never the credential', () => __awaiter(void 0, void 0, void 0, function* () {
                     const { app } = yield lab();
-                    yield (0, supertest_1.default)(app).get('/wd/hub/session/s-alice/url').set(as('bob-token'));
+                    yield (0, loopbackRequest_1.default)(app).get('/wd/hub/session/s-alice/url').set(as('bob-token'));
                     (0, chai_1.expect)(warnings).to.have.length(1);
                     (0, chai_1.expect)(warnings[0]).to.include('s-alice');
                     (0, chai_1.expect)(warnings[0]).to.include('bob');
@@ -229,7 +229,7 @@ describe('per-command auth (XENON_REQUIRE_COMMAND_AUTH)', () => {
                 }));
                 it('refuses a request with no credentials, without looking anything up', () => __awaiter(void 0, void 0, void 0, function* () {
                     const { app, ran } = yield lab();
-                    yield expectRefused(yield (0, supertest_1.default)(app).get('/wd/hub/session/s-alice/url'));
+                    yield expectRefused(yield (0, loopbackRequest_1.default)(app).get('/wd/hub/session/s-alice/url'));
                     (0, chai_1.expect)(ran).to.deep.equal([]);
                     (0, chai_1.expect)(verifyKeyPair.called || verifyBearer.called).to.equal(false);
                     (0, chai_1.expect)(ownerOf.called).to.equal(false);
@@ -238,7 +238,7 @@ describe('per-command auth (XENON_REQUIRE_COMMAND_AUTH)', () => {
                 }));
                 it('refuses credentials that do not verify, without looking up the owner', () => __awaiter(void 0, void 0, void 0, function* () {
                     const { app } = yield lab();
-                    const res = yield (0, supertest_1.default)(app)
+                    const res = yield (0, loopbackRequest_1.default)(app)
                         .get('/wd/hub/session/s-alice/url')
                         .set({ 'x-xenon-access-key': 'ak-alice', 'x-xenon-token': 'guessed' });
                     yield expectRefused(res);
@@ -248,34 +248,34 @@ describe('per-command auth (XENON_REQUIRE_COMMAND_AUTH)', () => {
                 }));
                 it('lets an admin-scoped key drive a session it does not own', () => __awaiter(void 0, void 0, void 0, function* () {
                     const { app, ran } = yield lab();
-                    yield (0, supertest_1.default)(app).get('/wd/hub/session/s-alice/url').set(as('carol-admin')).expect(200);
+                    yield (0, loopbackRequest_1.default)(app).get('/wd/hub/session/s-alice/url').set(as('carol-admin')).expect(200);
                     (0, chai_1.expect)(ran).to.deep.equal(['getUrl']);
                 }));
                 it('lets a SUPER_ADMIN drive a session they do not own', () => __awaiter(void 0, void 0, void 0, function* () {
                     const { app, ran } = yield lab();
-                    yield (0, supertest_1.default)(app).get('/wd/hub/session/s-alice/url').set(bearer('root-jwt')).expect(200);
+                    yield (0, loopbackRequest_1.default)(app).get('/wd/hub/session/s-alice/url').set(bearer('root-jwt')).expect(200);
                     (0, chai_1.expect)(ran).to.deep.equal(['getUrl']);
                 }));
                 it("refuses an ADMIN's ordinary key on someone else's session", () => __awaiter(void 0, void 0, void 0, function* () {
                     const { app, ran } = yield lab();
-                    yield expectRefused(yield (0, supertest_1.default)(app).get('/wd/hub/session/s-alice/url').set(as('carol-ordinary')));
+                    yield expectRefused(yield (0, loopbackRequest_1.default)(app).get('/wd/hub/session/s-alice/url').set(as('carol-ordinary')));
                     (0, chai_1.expect)(ran).to.deep.equal([]);
                 }));
                 it('refuses everyone but override admins on a session nobody owns', () => __awaiter(void 0, void 0, void 0, function* () {
                     const { app, ran } = yield lab();
-                    yield expectRefused(yield (0, supertest_1.default)(app).get('/wd/hub/session/s-anon/url').set(as('alice-token')));
-                    yield expectRefused(yield (0, supertest_1.default)(app).get('/wd/hub/session/s-anon/url').set(as('carol-ordinary')));
+                    yield expectRefused(yield (0, loopbackRequest_1.default)(app).get('/wd/hub/session/s-anon/url').set(as('alice-token')));
+                    yield expectRefused(yield (0, loopbackRequest_1.default)(app).get('/wd/hub/session/s-anon/url').set(as('carol-ordinary')));
                     (0, chai_1.expect)(ran).to.deep.equal([]);
-                    yield (0, supertest_1.default)(app).get('/wd/hub/session/s-anon/url').set(as('carol-admin')).expect(200);
-                    yield (0, supertest_1.default)(app).get('/wd/hub/session/s-anon/url').set(bearer('root-jwt')).expect(200);
+                    yield (0, loopbackRequest_1.default)(app).get('/wd/hub/session/s-anon/url').set(as('carol-admin')).expect(200);
+                    yield (0, loopbackRequest_1.default)(app).get('/wd/hub/session/s-anon/url').set(bearer('root-jwt')).expect(200);
                     (0, chai_1.expect)(ran).to.deep.equal(['getUrl', 'getUrl']);
                 }));
                 it('answers a session the caller may not use exactly as one that does not exist', () => __awaiter(void 0, void 0, void 0, function* () {
                     const { app } = yield lab();
-                    const refused = yield (0, supertest_1.default)(app)
+                    const refused = yield (0, loopbackRequest_1.default)(app)
                         .get('/wd/hub/session/s-alice/url')
                         .set(as('bob-token'));
-                    const missing = yield (0, supertest_1.default)(app)
+                    const missing = yield (0, loopbackRequest_1.default)(app)
                         .get('/wd/hub/session/no-such-session/url')
                         .set(as('bob-token'));
                     (0, chai_1.expect)(refused.status).to.equal(missing.status);
@@ -293,38 +293,38 @@ describe('per-command auth (XENON_REQUIRE_COMMAND_AUTH)', () => {
                 for (const [method, url, name] of commands) {
                     it(`guards ${method.toUpperCase()} ${url.replace('/wd/hub', '')}`, () => __awaiter(void 0, void 0, void 0, function* () {
                         const { app, ran } = yield lab();
-                        yield expectRefused(yield (0, supertest_1.default)(app)[method](url).set(as('bob-token')).send({}));
+                        yield expectRefused(yield (0, loopbackRequest_1.default)(app)[method](url).set(as('bob-token')).send({}));
                         (0, chai_1.expect)(ran).to.deep.equal([]);
-                        yield (0, supertest_1.default)(app)[method](url).set(as('alice-token')).send({}).expect(200);
+                        yield (0, loopbackRequest_1.default)(app)[method](url).set(as('alice-token')).send({}).expect(200);
                         (0, chai_1.expect)(ran).to.deep.equal([name]);
                     }));
                 }
                 it('guards a path in another letter case, which the routes also match', () => __awaiter(void 0, void 0, void 0, function* () {
                     const { app, ran } = yield lab();
-                    yield expectRefused(yield (0, supertest_1.default)(app).get('/WD/HUB/SESSION/s-alice/url').set(as('bob-token')));
+                    yield expectRefused(yield (0, loopbackRequest_1.default)(app).get('/WD/HUB/SESSION/s-alice/url').set(as('bob-token')));
                     (0, chai_1.expect)(ran).to.deep.equal([]);
                 }));
             });
             describe('what it leaves alone', () => {
                 it('lets createSession through; it has its own credential checks', () => __awaiter(void 0, void 0, void 0, function* () {
                     const { app, ran } = yield lab();
-                    yield (0, supertest_1.default)(app).post('/wd/hub/session').send({ capabilities: {} }).expect(200);
+                    yield (0, loopbackRequest_1.default)(app).post('/wd/hub/session').send({ capabilities: {} }).expect(200);
                     (0, chai_1.expect)(ran).to.deep.equal(['createSession']);
                     (0, chai_1.expect)(ownerOf.called).to.equal(false);
                 }));
                 it('lets requests that are not session commands through', () => __awaiter(void 0, void 0, void 0, function* () {
                     const { app, ran } = yield lab();
-                    yield (0, supertest_1.default)(app).get('/wd/hub/status').expect(200);
-                    yield (0, supertest_1.default)(app).get('/wd/hub/appium/sessions').expect(200);
-                    yield (0, supertest_1.default)(app).get('/xenon/api/devices').expect(200);
+                    yield (0, loopbackRequest_1.default)(app).get('/wd/hub/status').expect(200);
+                    yield (0, loopbackRequest_1.default)(app).get('/wd/hub/appium/sessions').expect(200);
+                    yield (0, loopbackRequest_1.default)(app).get('/xenon/api/devices').expect(200);
                     (0, chai_1.expect)(ran).to.deep.equal(['getStatus', 'getAppiumSessions', 'xenonApi']);
                     (0, chai_1.expect)(verifyKeyPair.called || verifyBearer.called || ownerOf.called).to.equal(false);
                 }));
                 it('does nothing at all when the setting is off (the default)', () => __awaiter(void 0, void 0, void 0, function* () {
                     enabled = false;
                     const { app, ran } = yield lab();
-                    yield (0, supertest_1.default)(app).get('/wd/hub/session/s-alice/url').expect(200);
-                    yield (0, supertest_1.default)(app).get('/wd/hub/session/s-alice/url').set(as('bob-token')).expect(200);
+                    yield (0, loopbackRequest_1.default)(app).get('/wd/hub/session/s-alice/url').expect(200);
+                    yield (0, loopbackRequest_1.default)(app).get('/wd/hub/session/s-alice/url').set(as('bob-token')).expect(200);
                     (0, chai_1.expect)(ran).to.deep.equal(['getUrl', 'getUrl']);
                     (0, chai_1.expect)(verifyKeyPair.called || verifyBearer.called || ownerOf.called).to.equal(false);
                     (0, chai_1.expect)(warnings).to.deep.equal([]);
@@ -332,7 +332,7 @@ describe('per-command auth (XENON_REQUIRE_COMMAND_AUTH)', () => {
                 it('does nothing when auth is disabled, even with the setting on', () => __awaiter(void 0, void 0, void 0, function* () {
                     authDisabled = true;
                     const { app, ran } = yield lab();
-                    yield (0, supertest_1.default)(app).get('/wd/hub/session/s-alice/url').expect(200);
+                    yield (0, loopbackRequest_1.default)(app).get('/wd/hub/session/s-alice/url').expect(200);
                     (0, chai_1.expect)(ran).to.deep.equal(['getUrl']);
                     (0, chai_1.expect)(verifyKeyPair.called || verifyBearer.called || ownerOf.called).to.equal(false);
                 }));
@@ -341,7 +341,7 @@ describe('per-command auth (XENON_REQUIRE_COMMAND_AUTH)', () => {
                 it('answers 503 when the owner lookup fails, never letting the command through', () => __awaiter(void 0, void 0, void 0, function* () {
                     ownerOf.rejects(new Error('database is locked'));
                     const { app, ran } = yield lab();
-                    const res = yield (0, supertest_1.default)(app).get('/wd/hub/session/s-alice/url').set(as('alice-token'));
+                    const res = yield (0, loopbackRequest_1.default)(app).get('/wd/hub/session/s-alice/url').set(as('alice-token'));
                     (0, chai_1.expect)(res.status).to.equal(503);
                     (0, chai_1.expect)(res.body).to.deep.equal(commandAuth_1.COMMAND_AUTH_UNAVAILABLE_BODY);
                     (0, chai_1.expect)(ran).to.deep.equal([]);
@@ -351,7 +351,7 @@ describe('per-command auth (XENON_REQUIRE_COMMAND_AUTH)', () => {
                 it('answers 503 when the credential check fails', () => __awaiter(void 0, void 0, void 0, function* () {
                     verifyKeyPair.rejects(new Error('database is locked'));
                     const { app, ran } = yield lab();
-                    const res = yield (0, supertest_1.default)(app).get('/wd/hub/session/s-alice/url').set(as('alice-token'));
+                    const res = yield (0, loopbackRequest_1.default)(app).get('/wd/hub/session/s-alice/url').set(as('alice-token'));
                     (0, chai_1.expect)(res.status).to.equal(503);
                     (0, chai_1.expect)(res.body).to.deep.equal(commandAuth_1.COMMAND_AUTH_UNAVAILABLE_BODY);
                     (0, chai_1.expect)(ran).to.deep.equal([]);
@@ -360,13 +360,13 @@ describe('per-command auth (XENON_REQUIRE_COMMAND_AUTH)', () => {
             describe('base path', () => {
                 it("normalises the base path the way Appium does ('wd/hub/' → '/wd/hub')", () => __awaiter(void 0, void 0, void 0, function* () {
                     const { app, ran } = yield lab({ basePath: 'wd/hub/' });
-                    yield expectRefused(yield (0, supertest_1.default)(app).get('/wd/hub/session/s-alice/url').set(as('bob-token')));
+                    yield expectRefused(yield (0, loopbackRequest_1.default)(app).get('/wd/hub/session/s-alice/url').set(as('bob-token')));
                     (0, chai_1.expect)(ran).to.deep.equal([]);
                 }));
                 it("guards /session/:id under Appium 3's default empty base path", () => __awaiter(void 0, void 0, void 0, function* () {
                     const { app, ran } = yield lab({ basePath: '', routePrefix: '' });
-                    yield expectRefused(yield (0, supertest_1.default)(app).get('/session/s-alice/url').set(as('bob-token')));
-                    yield (0, supertest_1.default)(app).post('/session').send({}).expect(200);
+                    yield expectRefused(yield (0, loopbackRequest_1.default)(app).get('/session/s-alice/url').set(as('bob-token')));
+                    yield (0, loopbackRequest_1.default)(app).post('/session').send({}).expect(200);
                     (0, chai_1.expect)(ran).to.deep.equal(['createSession']);
                 }));
             });