@xenon-device-management/xenon 2.0.0 → 2.1.0

package/lib/test/unit/lease/lease-token-oracle.spec.js

@@ -49,7 +49,7 @@ require("reflect-metadata");
 const chai_1 = require("chai");
 const sinon_1 = __importDefault(require("sinon"));
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../../helpers/loopbackRequest"));
 const sdk_leases_1 = require("../../../src/app/routers/sdk-leases");
 const LeaseService_1 = require("../../../src/services/lease/LeaseService");
 const leaseToken = __importStar(require("../../../src/services/lease/leaseToken"));
@@ -107,7 +107,10 @@ describe('lease token routes reveal nothing without the token', () => {
             },
             portLease: { deleteMany: sinon_1.default.stub().resolves({ count: 0 }) },
         };
-        store = { updateDevice: sinon_1.default.stub().resolves() };
+        store = {
+            updateDevice: sinon_1.default.stub().resolves(),
+            releaseLeaseLock: sinon_1.default.stub().resolves(true),
+        };
         const svc = new LeaseService_1.LeaseService(db, store, {}, { nodePairAuth: () => __awaiter(void 0, void 0, void 0, function* () { return ({ accessKey: '', token: '' }); }) });
         const app = (0, express_1.default)();
         app.use(express_1.default.json());
@@ -136,8 +139,8 @@ describe('lease token routes reveal nothing without the token', () => {
     function call(op, id, token) {
         const url = `/xenon/api/sdk/leases/${id}`;
         if (op === 'release')
-            return (0, supertest_1.default)(server).delete(url).set('x-xenon-lease-token', token);
-        const r = (0, supertest_1.default)(server).post(`${url}/${op}`).set('x-xenon-lease-token', token);
+            return (0, loopbackRequest_1.default)(server).delete(url).set('x-xenon-lease-token', token);
+        const r = (0, loopbackRequest_1.default)(server).post(`${url}/${op}`).set('x-xenon-lease-token', token);
         return op === 'extend' ? r.send({ durationMs: 60000 }) : r;
     }
     const answer = (r) => ({
@@ -177,6 +180,7 @@ describe('lease token routes reveal nothing without the token', () => {
                 (0, chai_1.expect)(db.lease.updateMany.called).to.equal(false);
                 (0, chai_1.expect)(db.portLease.deleteMany.called).to.equal(false);
                 (0, chai_1.expect)(store.updateDevice.called).to.equal(false);
+                (0, chai_1.expect)(store.releaseLeaseLock.called).to.equal(false);
             }));
             it(`the right token on an expired lease gets ${GONE[op]}`, () => __awaiter(void 0, void 0, void 0, function* () {
                 (0, chai_1.expect)((yield call(op, 'lse_expired', TOKEN)).status).to.equal(GONE[op]);
@@ -189,9 +193,18 @@ describe('lease token routes reveal nothing without the token', () => {
             }));
         });
     }
-    it('heartbeat: the right token on a lease past its expiry, not yet swept, gets 410', () => __awaiter(void 0, void 0, void 0, function* () {
-        (0, chai_1.expect)((yield call('heartbeat', 'lse_lapsed', TOKEN)).status).to.equal(410);
-    }));
+    // Neither may keep a lapsed lease alive: extend used to push its expiresAt
+    // out again and reset its heartbeat clock, so the sweeper never took it.
+    for (const op of ['heartbeat', 'extend']) {
+        it(`${op}: the right token on a lease past its expiry, not yet swept, gets 410 and changes nothing`, () => __awaiter(void 0, void 0, void 0, function* () {
+            const r = yield call(op, 'lse_lapsed', TOKEN);
+            (0, chai_1.expect)({ status: r.status, error: r.body.error }).to.deep.equal({
+                status: 410,
+                error: 'gone',
+            });
+            (0, chai_1.expect)(db.lease.updateMany.called).to.equal(false);
+        }));
+    }
     it('an unknown id still costs one token comparison, against one fixed hash', () => __awaiter(void 0, void 0, void 0, function* () {
         const verify = sinon_1.default.spy(leaseToken, 'verifyToken');
         yield call('heartbeat', 'lse_nope', WRONG);

package/lib/test/unit/lease/session-lease-proof.spec.js

@@ -65,6 +65,7 @@ const logger_1 = require("../../../src/logger");
 const RequestLogService_1 = require("../../../src/services/RequestLogService");
 const EventBus_1 = require("../../../src/services/EventBus");
 const JwtKeyService_1 = require("../../../src/services/token/JwtKeyService");
+const hubSessionToken_1 = require("../../../src/gateway/hubSessionToken");
 const prisma_1 = require("../../../src/prisma");
 const container_registration_1 = require("../../helpers/container-registration");
 // createSession end to end, from the capabilities a client sends to the
@@ -184,7 +185,7 @@ describe('createSession — a lease-bound session proves it holds the lease', ()
         }));
         sinon_1.default.stub(pendingSessions, 'removePendingSession').resolves();
         sinon_1.default.stub(deviceService, 'updateDeviceProgress').resolves();
-        sinon_1.default.stub(deviceService, 'updatedAllocatedDevice').resolves();
+        sinon_1.default.stub(deviceService, 'claimDeviceForSession').resolves(true);
         svc = new SessionLifecycleService_1.SessionLifecycleService();
         // Everything past finalizeSession's own bookkeeping is out of scope here;
         // what matters is the session response that becomes the Session row.
@@ -343,11 +344,15 @@ describe('createSession — a lease-bound session proves it holds the lease', ()
                     forwardedCaps = JSON.parse(JSON.stringify(c));
                     return { protocol: 'W3C', value: ['sess-1', {}, 'W3C'] };
                 }));
+                // The hub's token needs its signing key, which this spec has no use for.
+                sinon_1.default.stub(hubSessionToken_1.HubSessionTokenIssuer.prototype, 'createTokenFor').resolves('HUB-TOKEN');
             });
-            it('forwards the token to a peer Xenon node, which runs the same check', () => __awaiter(void 0, void 0, void 0, function* () {
+            it('forwards neither the lease id nor its token to a peer Xenon node: the hub resolved the lease to its phone', () => __awaiter(void 0, void 0, void 0, function* () {
                 device.nodeId = 'node-peer';
                 yield create(sessionCaps({ leaseToken: TOKEN }));
-                (0, chai_1.expect)(forwardedCaps.alwaysMatch['xe:options'].leaseToken).to.equal(TOKEN);
+                (0, chai_1.expect)(JSON.stringify(forwardedCaps)).to.not.include(TOKEN);
+                (0, chai_1.expect)(JSON.stringify(forwardedCaps)).to.not.include('lse_1');
+                (0, chai_1.expect)(forwardedCaps.alwaysMatch['appium:udid']).to.equal('u1');
                 (0, chai_1.expect)(JSON.stringify(finalCaps)).to.not.include(TOKEN);
                 (0, chai_1.expect)(JSON.stringify(pendingCopy)).to.not.include(TOKEN);
             }));

package/lib/test/unit/logcat-ws.spec.js

@@ -92,7 +92,10 @@ function harness(over) {
         if (over.maxBufferedBytes !== undefined)
             deps.maxBufferedBytes = over.maxBufferedBytes;
         (0, logcatWs_1.attachLogcatWs)(server, deps);
-        yield new Promise((r) => server.listen(0, r));
+        // 127.0.0.1, where the client connects. A listener on every address can
+        // share its port with another process's 127.0.0.1 listener, which then
+        // answers the handshake instead ("Unexpected server response: 501").
+        yield new Promise((r) => server.listen(0, '127.0.0.1', r));
         const port = server.address().port;
         return {
             port,

package/lib/test/unit/loopback-request.spec.js

@@ -0,0 +1,81 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+const express_1 = __importDefault(require("express"));
+const http_1 = __importDefault(require("http"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
+// The drop-in for supertest's request(app) that listens on 127.0.0.1, where
+// it connects, instead of on every address. See test/helpers/loopbackRequest.ts.
+describe('loopbackRequest', () => {
+    function echoApp() {
+        const app = (0, express_1.default)();
+        app.use(express_1.default.json());
+        app.all('/echo', (req, res) => {
+            res.json({ method: req.method, query: req.query, body: req.body });
+        });
+        return app;
+    }
+    it('serves the app on 127.0.0.1, not on every address', () => __awaiter(void 0, void 0, void 0, function* () {
+        const server = http_1.default.createServer(echoApp());
+        let bound;
+        server.on('listening', () => {
+            bound = server.address();
+        });
+        const res = yield (0, loopbackRequest_1.default)(server).get('/echo');
+        (0, chai_1.expect)(res.status).to.equal(200);
+        (0, chai_1.expect)(bound === null || bound === void 0 ? void 0 : bound.address).to.equal('127.0.0.1');
+    }));
+    it('closes the server it started once the request is answered', () => __awaiter(void 0, void 0, void 0, function* () {
+        const server = http_1.default.createServer(echoApp());
+        yield (0, loopbackRequest_1.default)(server).get('/echo');
+        (0, chai_1.expect)(server.listening).to.equal(false);
+    }));
+    it('keeps what supertest does with a request: method, query, body', () => __awaiter(void 0, void 0, void 0, function* () {
+        const res = yield (0, loopbackRequest_1.default)(echoApp()).post('/echo').query({ a: '1' }).send({ b: 2 });
+        (0, chai_1.expect)(res.body).to.deep.equal({ method: 'POST', query: { a: '1' }, body: { b: 2 } });
+    }));
+    it('answers several requests sent to one server at once', () => __awaiter(void 0, void 0, void 0, function* () {
+        const server = http_1.default.createServer(echoApp());
+        const answers = yield Promise.all([
+            (0, loopbackRequest_1.default)(server).get('/echo').query({ n: '1' }),
+            (0, loopbackRequest_1.default)(server).get('/echo').query({ n: '2' }),
+        ]);
+        (0, chai_1.expect)(answers.map((r) => r.body.query.n)).to.deep.equal(['1', '2']);
+    }));
+    it('uses a server that is already listening, and leaves it open', () => __awaiter(void 0, void 0, void 0, function* () {
+        const server = http_1.default.createServer(echoApp());
+        yield new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+        try {
+            const res = yield (0, loopbackRequest_1.default)(server).get('/echo');
+            (0, chai_1.expect)(res.status).to.equal(200);
+            (0, chai_1.expect)(server.listening).to.equal(true);
+        }
+        finally {
+            yield new Promise((resolve) => server.close(resolve));
+        }
+    }));
+    it('sends to a URL as given', () => __awaiter(void 0, void 0, void 0, function* () {
+        const server = http_1.default.createServer(echoApp());
+        yield new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+        try {
+            const { port } = server.address();
+            const res = yield (0, loopbackRequest_1.default)(`http://127.0.0.1:${port}`).get('/echo');
+            (0, chai_1.expect)(res.body.method).to.equal('GET');
+        }
+        finally {
+            yield new Promise((resolve) => server.close(resolve));
+        }
+    }));
+});

package/lib/test/unit/node-create-caps.spec.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+const nodeCreateCaps_1 = require("../../src/services/session/nodeCreateCaps");
+/**
+ * The capabilities a hub sends the node whose phone it allocated. The hub has
+ * checked the credentials, applied the team rule and resolved the lease; the
+ * node gets a request that stands on its own: that one phone, and nothing the
+ * node can't act on.
+ */
+describe('capsForNode — the copy of a create a node gets', () => {
+    const sent = () => ({
+        alwaysMatch: {
+            platformName: 'Android',
+            'appium:udids': 'phone-1,phone-2',
+            'xe:options': { leaseId: 'lse_1', buildId: 'b-1', token: 'SECRET' },
+        },
+        firstMatch: [
+            { 'appium:udid': 'phone-1', 'appium:systemPort': 8201 },
+            { 'appium:udid': 'phone-2', 'xenon:options': { leaseId: 'lse_1', leaseToken: 'SECRET' } },
+        ],
+    });
+    it('names exactly the phone the hub allocated, once, in alwaysMatch', () => {
+        const copy = (0, nodeCreateCaps_1.capsForNode)(sent(), 'phone-1');
+        (0, chai_1.expect)(copy.alwaysMatch['appium:udid']).to.equal('phone-1');
+        (0, chai_1.expect)(copy.alwaysMatch['appium:udids']).to.equal(undefined);
+        for (const entry of copy.firstMatch) {
+            (0, chai_1.expect)(entry['appium:udid']).to.equal(undefined);
+            (0, chai_1.expect)(entry['appium:udids']).to.equal(undefined);
+        }
+        // What the hub allocated for it travels.
+        (0, chai_1.expect)(copy.firstMatch[0]['appium:systemPort']).to.equal(8201);
+    });
+    it('drops the lease id, which only the hub can resolve, from both namespaces', () => {
+        const copy = (0, nodeCreateCaps_1.capsForNode)(sent(), 'phone-1');
+        (0, chai_1.expect)(JSON.stringify(copy)).to.not.include('lse_1');
+        (0, chai_1.expect)(copy.alwaysMatch['xe:options']).to.deep.equal({ buildId: 'b-1' });
+    });
+    it('never carries a credential', () => {
+        (0, chai_1.expect)(JSON.stringify((0, nodeCreateCaps_1.capsForNode)(sent(), 'phone-1'))).to.not.include('SECRET');
+    });
+    it('does not modify the caps the hub keeps', () => {
+        const caps = sent();
+        const before = JSON.stringify(caps);
+        (0, nodeCreateCaps_1.capsForNode)(caps, 'phone-1');
+        (0, chai_1.expect)(JSON.stringify(caps)).to.equal(before);
+    });
+    it('copes with missing buckets', () => {
+        (0, chai_1.expect)((0, nodeCreateCaps_1.capsForNode)({ alwaysMatch: undefined }, 'p')).to.deep.equal({
+            alwaysMatch: { 'appium:udid': 'p' },
+            firstMatch: [{}],
+        });
+    });
+});

package/lib/test/unit/node-gateway-create-appium-server.spec.js

@@ -0,0 +1,354 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const fs_1 = __importDefault(require("fs"));
+const http_1 = __importDefault(require("http"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const sinon_1 = __importDefault(require("sinon"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
+const typedi_1 = require("typedi");
+const plugin_1 = require("../../src/plugin");
+const registerCommandAuth_1 = require("../../src/app/registerCommandAuth");
+const defaultGateway_1 = require("../../src/gateway/defaultGateway");
+const hubSessionToken_1 = require("../../src/gateway/hubSessionToken");
+const JwtKeyService_1 = require("../../src/services/token/JwtKeyService");
+const PluginContext_1 = require("../../src/PluginContext");
+const IPluginArgs_1 = require("../../src/interfaces/IPluginArgs");
+const device_managers_1 = require("../../src/device-managers");
+const device_store_1 = require("../../src/data-service/device-store");
+const prisma_store_1 = require("../../src/data-service/prisma-store");
+const SessionManager_1 = require("../../src/sessions/SessionManager");
+const SessionLifecycleService_1 = require("../../src/services/SessionLifecycleService");
+const config_1 = require("../../src/config");
+const container_registration_1 = require("../helpers/container-registration");
+const scratch_database_1 = require("../helpers/scratch-database");
+const appium_umbrella_1 = require("../helpers/appium-umbrella");
+/**
+ * A Xenon node's side of a create the hub forwards, in Appium 3's own
+ * server(): Appium's real umbrella with Xenon's real plugin, the production
+ * node wiring (nodeGatewayOptions), the real SessionLifecycleService and a
+ * scratch SQLite database of the node's own.
+ *
+ * Each instance has its own database, so the node cannot check the client's
+ * key: the hub did. The hub's create carries a token it signed instead
+ * (x-xenon-hub-token, audience xenon-node-create), naming the verified owner,
+ * the phone and its node. The node checks it against the hub's JWKS, and it is
+ * the session's credential: it attributes the session and passes
+ * XENON_REQUIRE_SESSION_TOKEN.
+ *
+ * The hub here is only what the node talks to: an Appium server serving the
+ * hub's public keys. What the hub sends is hub-gateway-create-appium-server.spec.ts.
+ */
+const quiet = { info: () => undefined, warn: () => undefined, error: () => undefined };
+const NODE_ID = 'node-1';
+describe('a create the hub forwards, on the node, in Appium 3’s own server()', function () {
+    this.timeout(60000);
+    const scratch = (0, scratch_database_1.useScratchDatabase)();
+    const servers = [];
+    let dirs;
+    let hubKeys;
+    let appiumLogs;
+    let restore;
+    let saved;
+    let authDisabledBefore;
+    let gateBefore;
+    let umbrella;
+    let hubUrl;
+    let nodeOrigin;
+    let nodeAuthDisabled;
+    function keyService() {
+        return __awaiter(this, void 0, void 0, function* () {
+            const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-node-create-keys-'));
+            dirs.push(dir);
+            const keys = new JwtKeyService_1.JwtKeyService();
+            yield keys.init(dir);
+            return keys;
+        });
+    }
+    before(() => __awaiter(this, void 0, void 0, function* () {
+        appiumLogs = (0, appium_umbrella_1.quietAppiumLogs)();
+        dirs = [];
+        hubKeys = yield keyService();
+    }));
+    after(() => {
+        appiumLogs.restore();
+        for (const dir of dirs)
+            fs_1.default.rmSync(dir, { recursive: true, force: true });
+    });
+    beforeEach(() => __awaiter(this, void 0, void 0, function* () {
+        restore = (0, container_registration_1.saveRegistrations)(JwtKeyService_1.JwtKeyService, hubSessionToken_1.HubSessionTokenIssuer, device_managers_1.XenonManager);
+        // The hub's keys sign here only because the test mints what the hub would send.
+        typedi_1.Container.set(JwtKeyService_1.JwtKeyService, hubKeys);
+        typedi_1.Container.set(hubSessionToken_1.HubSessionTokenIssuer, new hubSessionToken_1.HubSessionTokenIssuer());
+        typedi_1.Container.set(device_managers_1.XenonManager, {
+            getMaxSessionCount: () => undefined,
+            deviceInstances: () => __awaiter(this, void 0, void 0, function* () { return []; }),
+        });
+        const context = typedi_1.Container.get(PluginContext_1.PluginContext);
+        saved = {
+            store: device_store_1.DeviceStoreFactory._deviceStore,
+            pending: device_store_1.DeviceStoreFactory._pendingSessionStore,
+            context: Object.assign({}, context),
+        };
+        device_store_1.DeviceStoreFactory._deviceStore = new prisma_store_1.PrismaDeviceStore();
+        device_store_1.DeviceStoreFactory._pendingSessionStore = new prisma_store_1.PrismaPendingSessionStore();
+        authDisabledBefore = config_1.config.authDisabled;
+        config_1.config.authDisabled = false;
+        nodeAuthDisabled = false;
+        gateBefore = process.env.XENON_REQUIRE_SESSION_TOKEN;
+        delete process.env.XENON_REQUIRE_SESSION_TOKEN;
+        yield scratch.db.pendingSession.deleteMany({});
+        yield scratch.db.device.deleteMany({});
+        yield boot();
+    }));
+    afterEach(() => __awaiter(this, void 0, void 0, function* () {
+        for (const s of SessionManager_1.SESSION_MANAGER.getAllSessions())
+            SessionManager_1.SESSION_MANAGER.removeSession(s.getId());
+        device_store_1.DeviceStoreFactory._deviceStore = saved.store;
+        device_store_1.DeviceStoreFactory._pendingSessionStore = saved.pending;
+        Object.assign(typedi_1.Container.get(PluginContext_1.PluginContext), saved.context);
+        config_1.config.authDisabled = authDisabledBefore;
+        if (gateBefore === undefined)
+            delete process.env.XENON_REQUIRE_SESSION_TOKEN;
+        else
+            process.env.XENON_REQUIRE_SESSION_TOKEN = gateBefore;
+        sinon_1.default.restore();
+        restore();
+        for (const s of servers.splice(0)) {
+            s.closeAllConnections();
+            yield new Promise((resolve) => http_1.default.Server.prototype.close.call(s, () => resolve()));
+        }
+    }));
+    const port = (s) => s.address().port;
+    function boot() {
+        return __awaiter(this, void 0, void 0, function* () {
+            const baseDriver = (0, appium_umbrella_1.appiumBaseDriver)();
+            // The hub: only its public keys matter to the node.
+            const hubServer = yield baseDriver.server({
+                routeConfiguringFunction: baseDriver.routeConfiguringFunction((0, appium_umbrella_1.umbrellaWith)([])),
+                port: 0,
+                hostname: '127.0.0.1',
+                basePath: '/wd/hub',
+                cliArgs: { basePath: '/wd/hub' },
+                serverUpdaters: [
+                    (app) => {
+                        app.get('/xenon/api/auth/jwks.json', (_req, res) => res.json(hubKeys.jwks()));
+                    },
+                ],
+            });
+            servers.push(hubServer);
+            hubUrl = `http://127.0.0.1:${port(hubServer)}`;
+            umbrella = (0, appium_umbrella_1.umbrellaWith)([[plugin_1.XenonPlugin, 'xenon']]);
+            const nodeServer = yield baseDriver.server({
+                routeConfiguringFunction: baseDriver.routeConfiguringFunction(umbrella),
+                port: 0,
+                hostname: '127.0.0.1',
+                basePath: '/node',
+                cliArgs: { basePath: '/node' },
+                serverUpdaters: [
+                    (app) => {
+                        (0, registerCommandAuth_1.registerSessionGateway)(app, { basePath: '/node' }, (0, registerCommandAuth_1.commandAuthDeps)({
+                            enabled: () => false,
+                            authDisabled: () => nodeAuthDisabled,
+                            logger: quiet,
+                        }), (0, defaultGateway_1.nodeGatewayOptions)(hubUrl));
+                    },
+                ],
+            });
+            servers.push(nodeServer);
+            nodeOrigin = `http://127.0.0.1:${port(nodeServer)}`;
+            typedi_1.Container.get(PluginContext_1.PluginContext).setContext(Object.assign(Object.assign({}, IPluginArgs_1.DefaultPluginArgs), { hub: hubUrl, bindHostOrIp: '127.0.0.1', 
+                // Registers the node's LocalSession in SESSION_MANAGER, where its owner is read.
+                enableDashboard: true, deviceAvailabilityTimeoutMs: 1000, deviceAvailabilityQueryIntervalMs: 100 }), port(nodeServer), NODE_ID, '/node');
+            for (const udid of ['phone-1', 'phone-2']) {
+                yield scratch.db.device.create({
+                    data: {
+                        udid,
+                        host: nodeOrigin,
+                        nodeId: NODE_ID,
+                        platform: 'android',
+                        name: udid,
+                        sdk: '14',
+                        busy: false,
+                        userBlocked: false,
+                        offline: false,
+                    },
+                });
+            }
+        });
+    }
+    /** What the hub mints for alice's create on phone-1. */
+    const hubToken = (grant = {}) => typedi_1.Container.get(hubSessionToken_1.HubSessionTokenIssuer).createTokenFor(Object.assign({ userId: 'alice', udid: 'phone-1', host: nodeOrigin }, grant));
+    /** The capabilities as the hub forwards them: no credentials, the phone pinned. */
+    const forwarded = (alwaysMatch = {}) => ({
+        capabilities: {
+            alwaysMatch: Object.assign({ platformName: 'Android', 'appium:automationName': appium_umbrella_1.FAKE_AUTOMATION, 'appium:newCommandTimeout': 0, 'appium:udid': 'phone-1', 
+                // No video: it would start Xenon's real capture pipeline for the phone.
+                'xe:options': { recordVideo: false } }, alwaysMatch),
+            firstMatch: [{}],
+        },
+    });
+    const create = (token_1, ...args_1) => __awaiter(this, [token_1, ...args_1], void 0, function* (token, body = forwarded()) {
+        const req = (0, loopbackRequest_1.default)(nodeOrigin).post('/node/session');
+        if (token !== undefined)
+            req.set(hubSessionToken_1.HUB_TOKEN_HEADER, token);
+        return req.send(body);
+    });
+    const row = (udid) => scratch.db.device.findFirst({ where: { udid } });
+    const settle = () => new Promise((resolve) => setTimeout(resolve, 50));
+    function expectNothingCreated() {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield settle();
+            (0, chai_1.expect)(Object.keys(umbrella.sessions), 'driver sessions').to.deep.equal([]);
+            (0, chai_1.expect)(yield row('phone-1')).to.include({ busy: false, session_id: null });
+            (0, chai_1.expect)(yield row('phone-2')).to.include({ busy: false, session_id: null });
+            (0, chai_1.expect)(yield scratch.db.pendingSession.count()).to.equal(0);
+        });
+    }
+    it('attributes the session to the owner the hub’s token names', () => __awaiter(this, void 0, void 0, function* () {
+        const res = yield create(yield hubToken());
+        (0, chai_1.expect)(res.status, JSON.stringify(res.body)).to.equal(200);
+        const sessionId = res.body.value.sessionId;
+        (0, chai_1.expect)(Object.keys(umbrella.sessions)).to.deep.equal([sessionId]);
+        const session = SessionManager_1.SESSION_MANAGER.getSession(sessionId);
+        (0, chai_1.expect)(session.userId).to.equal('alice');
+        (0, chai_1.expect)(session.apiKeyId).to.equal(null);
+        (0, chai_1.expect)(yield row('phone-1')).to.include({ busy: true, session_id: sessionId });
+        (0, chai_1.expect)(yield scratch.db.pendingSession.count()).to.equal(0);
+    }));
+    it('an unattributed create from the hub stays unattributed', () => __awaiter(this, void 0, void 0, function* () {
+        const res = yield create(yield hubToken({ userId: null }));
+        (0, chai_1.expect)(res.status, JSON.stringify(res.body)).to.equal(200);
+        (0, chai_1.expect)(SessionManager_1.SESSION_MANAGER.getSession(res.body.value.sessionId).userId).to.equal(null);
+    }));
+    describe('with XENON_REQUIRE_SESSION_TOKEN on', () => {
+        beforeEach(() => {
+            process.env.XENON_REQUIRE_SESSION_TOKEN = '1';
+        });
+        it('the hub’s token admits the session', () => __awaiter(this, void 0, void 0, function* () {
+            const res = yield create(yield hubToken());
+            (0, chai_1.expect)(res.status, JSON.stringify(res.body)).to.equal(200);
+        }));
+        it('a create with no credentials at all is refused, and nothing is allocated', () => __awaiter(this, void 0, void 0, function* () {
+            // Before the gate is asked: on a node, only the hub's creates are taken.
+            const res = yield create(undefined);
+            (0, chai_1.expect)(res.status).to.equal(500);
+            (0, chai_1.expect)(res.body.value.error).to.equal('session not created');
+            (0, chai_1.expect)(res.body.value.message).to.include('through the hub');
+            yield expectNothingCreated();
+        }));
+        it('client credentials the node cannot check are neither needed nor passed on', () => __awaiter(this, void 0, void 0, function* () {
+            const res = yield create(yield hubToken(), forwarded({
+                'xe:options': { accessKey: 'ak-unknown', token: 'CLIENT-SECRET', recordVideo: false },
+            }));
+            (0, chai_1.expect)(res.status, JSON.stringify(res.body)).to.equal(200);
+            const session = SessionManager_1.SESSION_MANAGER.getSession(res.body.value.sessionId);
+            (0, chai_1.expect)(session.userId).to.equal('alice');
+            const inner = umbrella.sessions[res.body.value.sessionId];
+            (0, chai_1.expect)(JSON.stringify(inner.originalCaps)).to.not.include('CLIENT-SECRET');
+        }));
+    });
+    describe('a token that is not the hub’s grant for this create', () => {
+        it('is refused when forged, expired or a command token, and nothing is allocated', () => __awaiter(this, void 0, void 0, function* () {
+            const forger = yield keyService();
+            const claims = { sub: 'alice', udid: 'phone-1', host: nodeOrigin };
+            const tokens = [
+                yield forger.sign(claims, { audience: hubSessionToken_1.HUB_CREATE_AUDIENCE, ttlSeconds: 120 }),
+                yield hubKeys.sign(claims, { audience: hubSessionToken_1.HUB_CREATE_AUDIENCE, ttlSeconds: -3600 }),
+                yield hubKeys.sign({ sid: 's-1' }, { audience: hubSessionToken_1.HUB_TOKEN_AUDIENCE, ttlSeconds: 300 }),
+                'not-a-jwt',
+            ];
+            for (const token of tokens) {
+                const res = yield create(token);
+                (0, chai_1.expect)(res.status, token).to.equal(400);
+                (0, chai_1.expect)(res.body.value.error).to.equal('invalid argument');
+                (0, chai_1.expect)(res.body.value.message).to.include('session rejected');
+            }
+            yield expectNothingCreated();
+        }));
+        it('is refused the second time: a create token is taken once', () => __awaiter(this, void 0, void 0, function* () {
+            const token = yield hubToken();
+            const first = yield create(token);
+            (0, chai_1.expect)(first.status, JSON.stringify(first.body)).to.equal(200);
+            const ended = yield (0, loopbackRequest_1.default)(nodeOrigin).delete(`/node/session/${first.body.value.sessionId}`);
+            (0, chai_1.expect)(ended.status, JSON.stringify(ended.body)).to.equal(200);
+            const again = yield create(token);
+            (0, chai_1.expect)(again.status).to.equal(400);
+            (0, chai_1.expect)(again.body.value.error).to.equal('invalid argument');
+            (0, chai_1.expect)(again.body.value.message).to.include('session rejected');
+            yield expectNothingCreated();
+        }));
+        it('is refused when the capabilities name another phone than the grant', () => __awaiter(this, void 0, void 0, function* () {
+            const res = yield create(yield hubToken(), forwarded({ 'appium:udid': 'phone-2' }));
+            (0, chai_1.expect)(res.status).to.equal(400);
+            (0, chai_1.expect)(res.body.value.message).to.include('session rejected');
+            yield expectNothingCreated();
+        }));
+        it('is refused, and the phone given back, when it names another node’s phone', () => __awaiter(this, void 0, void 0, function* () {
+            const res = yield create(yield hubToken({ host: 'http://10.9.9.9:4725' }));
+            (0, chai_1.expect)(res.status).to.equal(400);
+            (0, chai_1.expect)(res.body.value.message).to.include('session rejected');
+            yield expectNothingCreated();
+        }));
+        it('cannot be checked while the hub’s keys cannot be fetched: 503, and nothing is allocated', () => __awaiter(this, void 0, void 0, function* () {
+            const token = yield hubToken();
+            const hub = servers[0];
+            hub.closeAllConnections();
+            yield new Promise((resolve) => http_1.default.Server.prototype.close.call(hub, () => resolve()));
+            const res = yield create(token);
+            (0, chai_1.expect)(res.status).to.equal(503);
+            (0, chai_1.expect)(res.body.value.error).to.equal('unknown error');
+            yield expectNothingCreated();
+        }));
+    });
+    describe('a create that did not come from the hub', () => {
+        const direct = () => create(undefined, forwarded({
+            'xe:options': { accessKey: 'ak-node', token: 'node-secret', recordVideo: false },
+        }));
+        it('is refused, saying to create sessions through the hub, and nothing is allocated', () => __awaiter(this, void 0, void 0, function* () {
+            const res = yield direct();
+            (0, chai_1.expect)(res.status).to.equal(500);
+            (0, chai_1.expect)(res.body.value.error).to.equal('session not created');
+            (0, chai_1.expect)(res.body.value.message).to.include('through the hub');
+            (0, chai_1.expect)(res.body.value.message).to.include(hubUrl);
+            yield expectNothingCreated();
+        }));
+        it('is refused when it reaches the plugin without the gateway too', () => __awaiter(this, void 0, void 0, function* () {
+            const lifecycle = new SessionLifecycleService_1.SessionLifecycleService();
+            const caps = forwarded().capabilities;
+            let refused;
+            yield lifecycle
+                .createSession(() => ({}), umbrella, caps, { localOnly: true })
+                .catch((error) => (refused = error));
+            (0, chai_1.expect)(refused === null || refused === void 0 ? void 0 : refused.message).to.include('through the hub');
+            yield expectNothingCreated();
+        }));
+        it('still works on a node with auth disabled, as it did (local development)', () => __awaiter(this, void 0, void 0, function* () {
+            nodeAuthDisabled = true;
+            config_1.config.authDisabled = true;
+            const res = yield direct();
+            (0, chai_1.expect)(res.status, JSON.stringify(res.body)).to.equal(200);
+        }));
+    });
+    it('with the node’s auth disabled, a token is not checked and the session is unattributed', () => __awaiter(this, void 0, void 0, function* () {
+        nodeAuthDisabled = true;
+        config_1.config.authDisabled = true;
+        const res = yield create('not-a-jwt');
+        (0, chai_1.expect)(res.status, JSON.stringify(res.body)).to.equal(200);
+        (0, chai_1.expect)(SessionManager_1.SESSION_MANAGER.getSession(res.body.value.sessionId).userId).to.equal(null);
+    }));
+});