@xenon-device-management/xenon 2.0.0 → 2.1.0

package/lib/test/unit/hub-node-control-forward.spec.js

@@ -0,0 +1,291 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const sinon_1 = __importDefault(require("sinon"));
+const express_1 = __importDefault(require("express"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
+const jose = __importStar(require("jose"));
+const typedi_1 = require("typedi");
+const control_1 = __importDefault(require("../../src/app/routers/control"));
+const auth_1 = require("../../src/app/routers/auth");
+const authMiddleware_1 = require("../../src/middleware/authMiddleware");
+const csrfMiddleware_1 = require("../../src/middleware/csrfMiddleware");
+const hubSessionToken_1 = require("../../src/gateway/hubSessionToken");
+const JwtKeyService_1 = require("../../src/services/token/JwtKeyService");
+const PluginContext_1 = require("../../src/PluginContext");
+const IPluginArgs_1 = require("../../src/interfaces/IPluginArgs");
+const device_managers_1 = require("../../src/device-managers");
+const device_store_1 = require("../../src/data-service/device-store");
+const prisma_store_1 = require("../../src/data-service/prisma-store");
+const SessionOwnerResolver_1 = require("../../src/services/device-access/SessionOwnerResolver");
+const LiveSessionOwners_1 = require("../../src/services/device-access/LiveSessionOwners");
+const config_1 = require("../../src/config");
+const container_registration_1 = require("../helpers/container-registration");
+const scratch_database_1 = require("../helpers/scratch-database");
+const loopbackServer_1 = require("../helpers/loopbackServer");
+/**
+ * A hub forwards five of its /control actions on a node's phone (tap, swipe,
+ * text, keyevent, touchAndHold) to the phone's node. It sent them with no
+ * credential at all, so a node with auth enabled refused every one (its CSRF
+ * check, then its login), and device control of a node's phone only worked
+ * with the node's auth off.
+ *
+ * The hub now signs each forwarded call for the user it acts for: audience
+ * xenon-node-control, one minute, naming the user, whether they are an admin,
+ * the phone and its node. The node accepts it for /control on that phone
+ * only, then runs its own ownership guard with that user, whose session it
+ * knows (LiveSessionOwners).
+ */
+// Named like the real manager: /control picks one by constructor.name.
+class AndroidDeviceManager {
+    constructor() {
+        this.taps = [];
+        this.tap = (udid) => __awaiter(this, void 0, void 0, function* () {
+            this.taps.push(udid);
+        });
+    }
+}
+describe('the hub’s device control on a node’s phone', () => {
+    const scratch = (0, scratch_database_1.useScratchDatabase)();
+    const loopback = (0, loopbackServer_1.loopbackServers)();
+    let dirs;
+    let hubKeys;
+    let manager;
+    let context;
+    let saved;
+    let restore;
+    let hubUrl;
+    let hubApp;
+    let nodeOrigin;
+    let nodePort;
+    let nodeArgs;
+    beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        dirs = [fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-control-keys-'))];
+        hubKeys = new JwtKeyService_1.JwtKeyService();
+        yield hubKeys.init(dirs[0]);
+        restore = (0, container_registration_1.saveRegistrations)(JwtKeyService_1.JwtKeyService, hubSessionToken_1.HubSessionTokenIssuer, device_managers_1.XenonManager, SessionOwnerResolver_1.SessionOwnerResolver, LiveSessionOwners_1.LiveSessionOwners);
+        typedi_1.Container.set(JwtKeyService_1.JwtKeyService, hubKeys);
+        typedi_1.Container.set(hubSessionToken_1.HubSessionTokenIssuer, new hubSessionToken_1.HubSessionTokenIssuer());
+        typedi_1.Container.set(SessionOwnerResolver_1.SessionOwnerResolver, new SessionOwnerResolver_1.SessionOwnerResolver());
+        typedi_1.Container.set(LiveSessionOwners_1.LiveSessionOwners, new LiveSessionOwners_1.LiveSessionOwners());
+        manager = new AndroidDeviceManager();
+        typedi_1.Container.set(device_managers_1.XenonManager, { deviceInstances: () => __awaiter(void 0, void 0, void 0, function* () { return [manager]; }) });
+        context = typedi_1.Container.get(PluginContext_1.PluginContext);
+        saved = {
+            context: Object.assign({}, context),
+            store: device_store_1.DeviceStoreFactory._deviceStore,
+            authDisabled: config_1.config.authDisabled,
+        };
+        device_store_1.DeviceStoreFactory._deviceStore = new prisma_store_1.PrismaDeviceStore();
+        config_1.config.authDisabled = false;
+        // The hub: its public keys, and its own /control with a caller named by a header.
+        const hub = (0, express_1.default)();
+        hub.get('/xenon/api/auth/jwks.json', (_req, res) => res.json(hubKeys.jwks()));
+        hubUrl = `http://127.0.0.1:${(yield loopback.serve(hub)).address().port}`;
+        hubApp = (0, express_1.default)();
+        // One process plays both servers, and PluginContext is a singleton: each
+        // app takes its own identity per request, so the hub's forward decision
+        // (the phone's nodeId against this server's) sees the hub, not the node.
+        hubApp.use((_req, _res, next) => {
+            context.setContext(Object.assign(Object.assign({}, IPluginArgs_1.DefaultPluginArgs), { bindHostOrIp: '127.0.0.1' }), 1, 'hub-1', '');
+            next();
+        });
+        hubApp.use(express_1.default.json());
+        hubApp.use((req, _res, next) => {
+            var _a;
+            const user = String((_a = req.headers['x-test-user']) !== null && _a !== void 0 ? _a : '');
+            const admin = user.startsWith('admin-');
+            req.auth = {
+                kind: 'user-session',
+                userId: user,
+                role: admin ? 'ADMIN' : 'MEMBER',
+                scopes: admin ? 'admin,devices,sessions,read' : 'devices,sessions,read',
+                rateLimit: 300,
+                teamIds: undefined,
+            };
+            next();
+        });
+        const hubApi = express_1.default.Router();
+        control_1.default.register(hubApi);
+        hubApp.use('/xenon/api', hubApi);
+        // The node: its CSRF check, its login and its /control, as ServerManager mounts them.
+        const node = (0, express_1.default)();
+        node.use((_req, _res, next) => {
+            context.setContext(nodeArgs, nodePort, 'node-1', '');
+            next();
+        });
+        node.use(express_1.default.json());
+        const nodeApi = express_1.default.Router();
+        nodeApi.use(csrfMiddleware_1.csrfMiddleware);
+        nodeApi.use(authMiddleware_1.authMiddleware);
+        nodeApi.get('/whoami', (req, res) => res.json(req.auth));
+        control_1.default.register(nodeApi);
+        node.use('/xenon/api', nodeApi);
+        nodePort = (yield loopback.serve(node)).address().port;
+        nodeOrigin = `http://127.0.0.1:${nodePort}`;
+        nodeArgs = Object.assign(Object.assign({}, IPluginArgs_1.DefaultPluginArgs), { hub: hubUrl, bindHostOrIp: '127.0.0.1' });
+        context.setContext(nodeArgs, nodePort, 'node-1', '');
+        yield scratch.db.device.deleteMany({});
+        // alice's session runs on the node's phone.
+        for (const udid of ['phone-1', 'phone-2']) {
+            yield scratch.db.device.create({
+                data: {
+                    udid,
+                    host: nodeOrigin,
+                    nodeId: 'node-1',
+                    platform: 'android',
+                    name: udid,
+                    busy: udid === 'phone-1',
+                    session_id: udid === 'phone-1' ? 's-1' : null,
+                },
+            });
+        }
+        typedi_1.Container.get(LiveSessionOwners_1.LiveSessionOwners).record('s-1', 'alice');
+    }));
+    afterEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        Object.assign(context, saved.context);
+        device_store_1.DeviceStoreFactory._deviceStore = saved.store;
+        config_1.config.authDisabled = saved.authDisabled;
+        sinon_1.default.restore();
+        restore();
+        yield loopback.closeAll();
+        for (const dir of dirs)
+            fs_1.default.rmSync(dir, { recursive: true, force: true });
+    }));
+    const tapThroughHub = (user) => (0, loopbackRequest_1.default)(hubApp)
+        .post('/xenon/api/control/phone-1/tap')
+        .set('x-test-user', user)
+        .send({ x: 10, y: 20 });
+    const controlToken = (grant = {}) => typedi_1.Container.get(hubSessionToken_1.HubSessionTokenIssuer).controlTokenFor(Object.assign({ userId: 'alice', isAdmin: false, udid: 'phone-1', host: nodeOrigin }, grant));
+    const toNode = (method, url, token) => {
+        const req = (0, loopbackRequest_1.default)(nodeOrigin)[method](url);
+        if (token)
+            req.set(hubSessionToken_1.HUB_TOKEN_HEADER, token);
+        return method === 'post' ? req.send({ x: 1, y: 2 }) : req;
+    };
+    it('the owner’s tap through the hub reaches the node’s phone', () => __awaiter(void 0, void 0, void 0, function* () {
+        const res = yield tapThroughHub('alice');
+        (0, chai_1.expect)(res.status, JSON.stringify(res.body)).to.equal(200);
+        (0, chai_1.expect)(manager.taps).to.deep.equal(['phone-1']);
+    }));
+    it('the hub signs the forwarded call for its user, that phone and its node', () => __awaiter(void 0, void 0, void 0, function* () {
+        const seen = [];
+        sinon_1.default.stub(typedi_1.Container.get(hubSessionToken_1.HubSessionTokenIssuer), 'controlTokenFor').callsFake((grant) => __awaiter(void 0, void 0, void 0, function* () {
+            seen.push(JSON.stringify(grant));
+            return hubKeys.sign({ sub: grant.userId, adm: grant.isAdmin, udid: grant.udid, host: grant.host }, { audience: hubSessionToken_1.HUB_CONTROL_AUDIENCE, ttlSeconds: 60 });
+        }));
+        yield tapThroughHub('alice').expect(200);
+        (0, chai_1.expect)(seen.map((g) => JSON.parse(g))).to.deep.equal([
+            { userId: 'alice', isAdmin: false, udid: 'phone-1', host: nodeOrigin },
+        ]);
+    }));
+    it('is a one-minute token /auth/token will never mint', () => __awaiter(void 0, void 0, void 0, function* () {
+        const claims = jose.decodeJwt(yield controlToken());
+        (0, chai_1.expect)(claims.aud).to.equal(hubSessionToken_1.HUB_CONTROL_AUDIENCE);
+        (0, chai_1.expect)(claims.exp - claims.iat).to.equal(60);
+        let refused;
+        yield (0, auth_1.issueToken)({ userId: 'alice', role: 'ADMIN', scopes: 'admin' }, { audience: hubSessionToken_1.HUB_CONTROL_AUDIENCE }).catch((error) => (refused = error));
+        (0, chai_1.expect)(refused === null || refused === void 0 ? void 0 : refused.message).to.include('unsupported audience');
+    }));
+    describe('on the node', () => {
+        it('the node’s own ownership guard judges the user the hub named', () => __awaiter(void 0, void 0, void 0, function* () {
+            const asBob = yield controlToken({ userId: 'bob' });
+            const bob = yield toNode('post', '/xenon/api/control/phone-1/tap', asBob);
+            (0, chai_1.expect)(bob.status).to.equal(409);
+            (0, chai_1.expect)(bob.body.error).to.equal('device_in_use_by_session');
+            const admin = yield controlToken({ userId: 'admin-carol', isAdmin: true });
+            yield toNode('post', '/xenon/api/control/phone-1/tap', admin).expect(200);
+            (0, chai_1.expect)(manager.taps).to.deep.equal(['phone-1']);
+        }));
+        it('is accepted for that phone’s /control only', () => __awaiter(void 0, void 0, void 0, function* () {
+            const token = yield controlToken();
+            const otherPhone = yield toNode('post', '/xenon/api/control/phone-2/tap', token);
+            (0, chai_1.expect)(otherPhone.status).to.equal(401);
+            const notControl = yield toNode('get', '/xenon/api/whoami', token);
+            (0, chai_1.expect)(notControl.status).to.equal(401);
+            (0, chai_1.expect)(manager.taps).to.deep.equal([]);
+        }));
+        it('is refused when it names another node, or is another kind of hub token', () => __awaiter(void 0, void 0, void 0, function* () {
+            const issuer = typedi_1.Container.get(hubSessionToken_1.HubSessionTokenIssuer);
+            const tokens = [
+                yield controlToken({ host: 'http://10.9.9.9:4725' }),
+                (yield issuer.tokenFor('s-1')),
+                (yield issuer.createTokenFor({
+                    userId: 'alice',
+                    udid: 'phone-1',
+                    host: nodeOrigin,
+                })),
+                yield hubKeys.sign({ sub: 'alice', adm: false, udid: 'phone-1', host: nodeOrigin }, { audience: hubSessionToken_1.HUB_CONTROL_AUDIENCE, ttlSeconds: -3600 }),
+                'not-a-jwt',
+            ];
+            for (const token of tokens) {
+                const res = yield toNode('post', '/xenon/api/control/phone-1/tap', token);
+                (0, chai_1.expect)(res.status, token.slice(0, 20)).to.equal(401);
+            }
+            (0, chai_1.expect)(manager.taps).to.deep.equal([]);
+        }));
+        it('cannot be checked while the hub’s keys cannot be fetched: 503', () => __awaiter(void 0, void 0, void 0, function* () {
+            const token = yield controlToken();
+            nodeArgs = Object.assign(Object.assign({}, nodeArgs), { hub: 'http://127.0.0.1:1' });
+            const res = yield toNode('post', '/xenon/api/control/phone-1/tap', token);
+            (0, chai_1.expect)(res.status).to.equal(503);
+            (0, chai_1.expect)(manager.taps).to.deep.equal([]);
+        }));
+        it('a server that is not a node ignores it', () => __awaiter(void 0, void 0, void 0, function* () {
+            const token = yield controlToken();
+            nodeArgs = Object.assign(Object.assign({}, nodeArgs), { hub: undefined });
+            const res = yield toNode('post', '/xenon/api/control/phone-1/tap', token);
+            (0, chai_1.expect)(res.status).to.not.equal(200);
+            (0, chai_1.expect)(manager.taps).to.deep.equal([]);
+        }));
+    });
+});