@xenon-device-management/xenon 2.0.0 → 2.1.0

package/lib/test/unit/remote-session-create.spec.js

@@ -0,0 +1,130 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const sinon_1 = __importDefault(require("sinon"));
+const express_1 = __importDefault(require("express"));
+const typedi_1 = require("typedi");
+const SessionLifecycleService_1 = require("../../src/services/SessionLifecycleService");
+const PluginContext_1 = require("../../src/PluginContext");
+const IPluginArgs_1 = require("../../src/interfaces/IPluginArgs");
+const deviceService = __importStar(require("../../src/data-service/device-service"));
+const SessionManager_1 = require("../../src/sessions/SessionManager");
+const SessionType_1 = __importDefault(require("../../src/enums/SessionType"));
+const nodeWebDriverUrl_1 = require("../../src/gateway/nodeWebDriverUrl");
+const container_registration_1 = require("../helpers/container-registration");
+const loopbackServer_1 = require("../helpers/loopbackServer");
+const loki_stores_1 = require("../helpers/loki-stores");
+/**
+ * A session the hub creates on a node's phone (today's createSession path,
+ * through the plugin):
+ * - it is created under the node's own base path, which need not be the hub's;
+ * - it is registered in SESSION_MANAGER whatever the dashboard and video
+ *   settings, because that is where the session gateway finds it.
+ */
+describe('a session the hub creates on a node', () => {
+    // The in-memory stores, also when this file runs on its own: without
+    // NODE_ENV=test the factory handed out the Prisma stores, which are the
+    // developer's ~/.cache/xenon/xenon.db.
+    (0, loki_stores_1.useLokiStores)();
+    const loopback = (0, loopbackServer_1.loopbackServers)();
+    let nodeOrigin;
+    let created;
+    let context;
+    let saved;
+    let restore;
+    const SESSION = 'node-session-1';
+    beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        created = [];
+        const node = (0, express_1.default)();
+        node.use(express_1.default.json());
+        // The node's Appium runs at the root; the hub's at /wd/hub.
+        node.get('/xenon/api/webdriver', (0, nodeWebDriverUrl_1.webdriverInfoHandler)(() => ''));
+        node.post('/session', (req, res) => {
+            created.push({ url: req.originalUrl, body: req.body });
+            res.json({ value: { sessionId: SESSION, capabilities: { platformName: 'Android' } } });
+        });
+        const server = yield loopback.serve(node);
+        nodeOrigin = `http://127.0.0.1:${server.address().port}`;
+        restore = (0, container_registration_1.saveRegistrations)(nodeWebDriverUrl_1.NodeBasePathResolver);
+        typedi_1.Container.set(nodeWebDriverUrl_1.NodeBasePathResolver, new nodeWebDriverUrl_1.NodeBasePathResolver());
+        context = typedi_1.Container.get(PluginContext_1.PluginContext);
+        saved = Object.assign({}, context);
+        context.pluginArgs = Object.assign(Object.assign({}, IPluginArgs_1.DefaultPluginArgs), { enableDashboard: false });
+        context.nodeId = 'hub-node-id';
+        context.nodeBasePath = '/wd/hub';
+        sinon_1.default.stub(deviceService, 'updatedAllocatedDevice').resolves();
+    }));
+    afterEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        SessionManager_1.SESSION_MANAGER.removeSession(SESSION);
+        Object.assign(context, saved);
+        sinon_1.default.restore();
+        restore();
+        yield loopback.closeAll();
+    }));
+    const device = () => ({ udid: 'u1', host: nodeOrigin, nodeId: 'node-peer', platform: 'android' });
+    const caps = {
+        alwaysMatch: { platformName: 'Android', 'xe:options': { recordVideo: false } },
+        firstMatch: [{}],
+    };
+    it('is created under the node’s own base path', () => __awaiter(void 0, void 0, void 0, function* () {
+        const svc = new SessionLifecycleService_1.SessionLifecycleService();
+        const response = yield svc.forwardSessionRequest(device(), caps);
+        (0, chai_1.expect)(created.map((c) => c.url)).to.deep.equal(['/session']);
+        (0, chai_1.expect)(response.value[0]).to.equal(SESSION);
+    }));
+    it('is registered in SESSION_MANAGER with the node’s URL, with the dashboard and video off', () => __awaiter(void 0, void 0, void 0, function* () {
+        const svc = new SessionLifecycleService_1.SessionLifecycleService();
+        sinon_1.default.stub(svc, 'getFreshDevice').callsFake((d) => __awaiter(void 0, void 0, void 0, function* () { return d; }));
+        yield svc.finalizeSession({ protocol: 'W3C', value: [SESSION, { platformName: 'Android' }, 'W3C'] }, device(), caps, {}, true);
+        const session = SessionManager_1.SESSION_MANAGER.getSession(SESSION);
+        (0, chai_1.expect)(session, 'registered').to.not.equal(undefined);
+        (0, chai_1.expect)(session.getType()).to.equal(SessionType_1.default.REMOTE);
+        (0, chai_1.expect)(session.getWebDriverUrl()).to.equal(nodeOrigin);
+    }));
+});

package/lib/test/unit/reservation-team-visibility.spec.js

@@ -49,7 +49,7 @@ require("reflect-metadata");
 const chai_1 = require("chai");
 const sinon_1 = __importDefault(require("sinon"));
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const reservation_1 = __importDefault(require("../../src/app/routers/reservation"));
 const deviceService = __importStar(require("../../src/data-service/device-service"));
 const prisma_1 = require("../../src/prisma");
@@ -105,13 +105,13 @@ function buildApp(caller) {
     app.use('/reservation', reservation_1.default);
     return app;
 }
-const reserve = (caller, udid) => (0, supertest_1.default)(buildApp(caller))
+const reserve = (caller, udid) => (0, loopbackRequest_1.default)(buildApp(caller))
     .post('/reservation')
     .send({ udid, host: HOST, reservedBy: 'alice', duration: '1h' });
-const extend = (caller, udid) => (0, supertest_1.default)(buildApp(caller))
+const extend = (caller, udid) => (0, loopbackRequest_1.default)(buildApp(caller))
     .post(`/reservation/${udid}/${encodeURIComponent(HOST)}/extend`)
     .send({ duration: '1h' });
-const release = (caller, udid) => (0, supertest_1.default)(buildApp(caller)).delete(`/reservation/${udid}/${encodeURIComponent(HOST)}`);
+const release = (caller, udid) => (0, loopbackRequest_1.default)(buildApp(caller)).delete(`/reservation/${udid}/${encodeURIComponent(HOST)}`);
 describe('reservations respect the team boundary', () => {
     let reserveDevice;
     let releaseReservation;
@@ -176,7 +176,7 @@ describe('reservations respect the team boundary', () => {
     }));
     describe('the list', () => {
         const listed = (caller) => __awaiter(void 0, void 0, void 0, function* () {
-            const res = yield (0, supertest_1.default)(buildApp(caller)).get('/reservation');
+            const res = yield (0, loopbackRequest_1.default)(buildApp(caller)).get('/reservation');
             (0, chai_1.expect)(res.status).to.equal(200);
             return res.body.reservations.map((r) => r.udid).sort();
         });

package/lib/test/unit/reset-link.test.js

@@ -16,7 +16,7 @@ require("reflect-metadata");
 const chai_1 = require("chai");
 const sinon_1 = __importDefault(require("sinon"));
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const typedi_1 = require("typedi");
 const users_1 = require("../../src/app/routers/users");
 const auth_1 = require("../../src/app/routers/auth");
@@ -71,7 +71,7 @@ describe('password-reset links', () => {
                     logged.push(args.map(String).join(' '));
                 });
             }
-            const r = yield (0, supertest_1.default)(usersApp({ userId: 'admin1', role: 'ADMIN' })).post('/users/m1/reset-link');
+            const r = yield (0, loopbackRequest_1.default)(usersApp({ userId: 'admin1', role: 'ADMIN' })).post('/users/m1/reset-link');
             (0, chai_1.expect)(r.status).to.equal(200);
             (0, chai_1.expect)(r.body.emailed).to.equal(false);
             (0, chai_1.expect)(r.body.link).to.match(new RegExp(`/xenon/reset-password#${RAW}$`));
@@ -87,7 +87,7 @@ describe('password-reset links', () => {
                 .stub(typedi_1.Container.get(PasswordResetService_1.PasswordResetService), 'createToken')
                 .resolves({ raw: RAW, id: 't1' });
             const send = sinon_1.default.stub(typedi_1.Container.get(EmailService_1.EmailService), 'send').resolves();
-            const r = yield (0, supertest_1.default)(usersApp({ userId: 'admin1', role: 'ADMIN' })).post('/users/m1/reset-link');
+            const r = yield (0, loopbackRequest_1.default)(usersApp({ userId: 'admin1', role: 'ADMIN' })).post('/users/m1/reset-link');
             (0, chai_1.expect)(r.status).to.equal(200);
             (0, chai_1.expect)(r.body).to.include({ emailed: true });
             (0, chai_1.expect)(r.body).to.not.have.property('link');
@@ -99,20 +99,20 @@ describe('password-reset links', () => {
                 .stub(prisma_1.prisma.user, 'findUnique')
                 .resolves(Object.assign(Object.assign({}, member), { id: 's1', role: 'SUPER_ADMIN' }));
             const create = sinon_1.default.stub(typedi_1.Container.get(PasswordResetService_1.PasswordResetService), 'createToken');
-            const r = yield (0, supertest_1.default)(usersApp({ userId: 'admin1', role: 'ADMIN' })).post('/users/s1/reset-link');
+            const r = yield (0, loopbackRequest_1.default)(usersApp({ userId: 'admin1', role: 'ADMIN' })).post('/users/s1/reset-link');
             (0, chai_1.expect)(r.status).to.equal(403);
             (0, chai_1.expect)(create.called).to.equal(false);
         }));
         it('refuses an ADMIN issuing a link for another ADMIN', () => __awaiter(void 0, void 0, void 0, function* () {
             sinon_1.default.stub(prisma_1.prisma.user, 'findUnique').resolves(Object.assign(Object.assign({}, member), { id: 'a2', role: 'ADMIN' }));
             const create = sinon_1.default.stub(typedi_1.Container.get(PasswordResetService_1.PasswordResetService), 'createToken');
-            const r = yield (0, supertest_1.default)(usersApp({ userId: 'admin1', role: 'ADMIN' })).post('/users/a2/reset-link');
+            const r = yield (0, loopbackRequest_1.default)(usersApp({ userId: 'admin1', role: 'ADMIN' })).post('/users/a2/reset-link');
             (0, chai_1.expect)(r.status).to.equal(403);
             (0, chai_1.expect)(create.called).to.equal(false);
         }));
         it('refuses a link for yourself', () => __awaiter(void 0, void 0, void 0, function* () {
             const create = sinon_1.default.stub(typedi_1.Container.get(PasswordResetService_1.PasswordResetService), 'createToken');
-            const r = yield (0, supertest_1.default)(usersApp({ userId: 'me', role: 'SUPER_ADMIN' })).post('/users/me/reset-link');
+            const r = yield (0, loopbackRequest_1.default)(usersApp({ userId: 'me', role: 'SUPER_ADMIN' })).post('/users/me/reset-link');
             (0, chai_1.expect)(r.status).to.equal(400);
             (0, chai_1.expect)(create.called).to.equal(false);
         }));
@@ -121,9 +121,9 @@ describe('password-reset links', () => {
             const create = sinon_1.default.stub(typedi_1.Container.get(PasswordResetService_1.PasswordResetService), 'createToken');
             const app = usersApp({ userId: 'root', role: 'SUPER_ADMIN' });
             find.resolves(null);
-            (0, chai_1.expect)((yield (0, supertest_1.default)(app).post('/users/nope/reset-link')).status).to.equal(404);
+            (0, chai_1.expect)((yield (0, loopbackRequest_1.default)(app).post('/users/nope/reset-link')).status).to.equal(404);
             find.resolves(Object.assign(Object.assign({}, member), { status: 'DISABLED' }));
-            (0, chai_1.expect)((yield (0, supertest_1.default)(app).post('/users/m1/reset-link')).status).to.equal(409);
+            (0, chai_1.expect)((yield (0, loopbackRequest_1.default)(app).post('/users/m1/reset-link')).status).to.equal(409);
             (0, chai_1.expect)(create.called).to.equal(false);
         }));
     });
@@ -154,7 +154,7 @@ describe('password-reset links', () => {
                 .resolves({ id: 'u1', email: 'u@x.local', name: 'U', status: 'ACTIVE' });
             const find = typedi_1.Container.get(UserService_1.UserService).findByEmail;
             const create = sinon_1.default.stub(typedi_1.Container.get(PasswordResetService_1.PasswordResetService), 'createToken');
-            const r = yield (0, supertest_1.default)(authApp()).post('/auth/forgot-password').send({ email: 'u@x.local' });
+            const r = yield (0, loopbackRequest_1.default)(authApp()).post('/auth/forgot-password').send({ email: 'u@x.local' });
             // The mint-or-skip decision runs in the same continuation as the user
             // lookup, so once the lookup has resolved and a macrotask has passed,
             // createToken has either been called or never will be.
@@ -172,7 +172,7 @@ describe('password-reset links', () => {
                 .stub(typedi_1.Container.get(PasswordResetService_1.PasswordResetService), 'createToken')
                 .resolves({ raw: RAW, id: 't1' });
             const send = sinon_1.default.stub(typedi_1.Container.get(EmailService_1.EmailService), 'send').resolves();
-            yield (0, supertest_1.default)(authApp()).post('/auth/forgot-password').send({ email: 'u@x.local' });
+            yield (0, loopbackRequest_1.default)(authApp()).post('/auth/forgot-password').send({ email: 'u@x.local' });
             yield until(() => send.called);
             (0, chai_1.expect)(send.calledOnce).to.equal(true);
             (0, chai_1.expect)(send.firstCall.args[0].text).to.include(`/xenon/reset-password#${RAW}`);
@@ -191,10 +191,10 @@ describe('password-reset links', () => {
             const verify = sinon_1.default
                 .stub(typedi_1.Container.get(PasswordResetService_1.PasswordResetService), 'verifyToken')
                 .resolves({ id: 't1', userId: 'u1' });
-            const ok = yield (0, supertest_1.default)(app).post('/auth/reset-password/check').send({ token: RAW });
+            const ok = yield (0, loopbackRequest_1.default)(app).post('/auth/reset-password/check').send({ token: RAW });
             (0, chai_1.expect)(ok.status).to.equal(200);
             (0, chai_1.expect)(verify.firstCall.args[0]).to.equal(RAW);
-            const old = yield (0, supertest_1.default)(app).get(`/auth/reset-password/check/${RAW}`);
+            const old = yield (0, loopbackRequest_1.default)(app).get(`/auth/reset-password/check/${RAW}`);
             (0, chai_1.expect)(old.status).to.equal(404);
         }));
     });
@@ -210,7 +210,7 @@ describe('password-reset links', () => {
             sinon_1.default.stub(reset, 'consume').resolves();
             sinon_1.default.stub(typedi_1.Container.get(UserSessionService_1.UserSessionService), 'revokeAllForUser').resolves();
             const revoke = sinon_1.default.stub(reset, 'revokeAllForUser').resolves(2);
-            const r = yield (0, supertest_1.default)(app)
+            const r = yield (0, loopbackRequest_1.default)(app)
                 .post('/auth/reset-password')
                 .send({ token: RAW, newPassword: 'a-new-password' });
             (0, chai_1.expect)(r.status).to.equal(204);
@@ -229,7 +229,7 @@ describe('password-reset links', () => {
             const revoke = sinon_1.default
                 .stub(typedi_1.Container.get(PasswordResetService_1.PasswordResetService), 'revokeAllForUser')
                 .resolves(1);
-            const r = yield (0, supertest_1.default)(app)
+            const r = yield (0, loopbackRequest_1.default)(app)
                 .post('/auth/change-password')
                 .send({ oldPassword: 'old-password', newPassword: 'new-password' });
             (0, chai_1.expect)(r.status).to.equal(204);

package/lib/test/unit/session-app-resolution.spec.js

@@ -51,8 +51,10 @@ const sinon_1 = __importDefault(require("sinon"));
 const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
+const jose = __importStar(require("jose"));
 const typedi_1 = require("typedi");
 const SessionLifecycleService_1 = require("../../src/services/SessionLifecycleService");
+const hubSessionToken_1 = require("../../src/gateway/hubSessionToken");
 const PluginContext_1 = require("../../src/PluginContext");
 const ApiKeyService_1 = require("../../src/services/ApiKeyService");
 const UserService_1 = require("../../src/services/UserService");
@@ -111,7 +113,7 @@ describe('createSession — an app named by id follows the team rule', () => {
     let restore;
     let pendingCopy;
     let finalCaps;
-    let unblock;
+    let release;
     const create = (c) => __awaiter(void 0, void 0, void 0, function* () {
         const next = sinon_1.default.stub().callsFake(() => __awaiter(void 0, void 0, void 0, function* () {
             driverCaps = JSON.parse(JSON.stringify(c));
@@ -152,8 +154,8 @@ describe('createSession — an app named by id follows the team rule', () => {
         }));
         sinon_1.default.stub(pendingSessions, 'removePendingSession').resolves();
         sinon_1.default.stub(deviceService, 'updateDeviceProgress').resolves();
-        sinon_1.default.stub(deviceService, 'updatedAllocatedDevice').resolves();
-        unblock = sinon_1.default.stub(deviceService, 'unblockDevice').resolves();
+        sinon_1.default.stub(deviceService, 'claimDeviceForSession').resolves(true);
+        release = sinon_1.default.stub(deviceService, 'releasePendingClaim').resolves(true);
         svc = new SessionLifecycleService_1.SessionLifecycleService();
         sinon_1.default.stub(svc, 'createSessionInstance').callsFake((...args) => {
             finalCaps = JSON.parse(JSON.stringify(args[2]));
@@ -286,7 +288,7 @@ describe('createSession — an app named by id follows the team rule', () => {
                 (0, chai_1.expect)(text, where).to.not.match(/"token"|"accessKey"/);
             }
         }));
-        it('a peer node gets the ticket and the credentials; the hub keeps neither', () => __awaiter(void 0, void 0, void 0, function* () {
+        it('a peer node gets the ticket and the hub’s token, never the credentials; the hub keeps neither', () => __awaiter(void 0, void 0, void 0, function* () {
             allocate.resolves({
                 udid: 'u2',
                 host: 'http://10.0.0.2:4723',
@@ -294,18 +296,19 @@ describe('createSession — an app named by id follows the team rule', () => {
                 nodeId: 'node-2',
             });
             let forwarded;
-            sinon_1.default.stub(svc, 'forwardSessionRequest').callsFake((_d, fc) => __awaiter(void 0, void 0, void 0, function* () {
+            let hubToken;
+            sinon_1.default.stub(svc, 'forwardSessionRequest').callsFake((_d, fc, t) => __awaiter(void 0, void 0, void 0, function* () {
                 forwarded = JSON.parse(JSON.stringify(fc));
+                hubToken = t;
                 return { value: ['sess-2', { platformName: 'Android' }] };
             }));
             sinon_1.default.stub(svc, 'finalizeSession').resolves();
             const c = caps('app-a', 'ak_team_a');
             yield svc.createSession(sinon_1.default.stub(), {}, c);
             (0, chai_1.expect)(parseAppUrl(forwarded.alwaysMatch['appium:app']).appId).to.equal('app-a');
-            (0, chai_1.expect)(forwarded.alwaysMatch['xe:options']).to.deep.equal({
-                accessKey: 'ak_team_a',
-                token: 'tk',
-            });
+            (0, chai_1.expect)(forwarded.alwaysMatch['xe:options']).to.deep.equal({});
+            (0, chai_1.expect)(JSON.stringify(forwarded)).to.not.match(/"token"|"accessKey"/);
+            (0, chai_1.expect)(jose.decodeJwt(hubToken)).to.include({ aud: hubSessionToken_1.HUB_CREATE_AUDIENCE, udid: 'u2' });
             for (const [where, seen] of Object.entries({ pendingCopy, sent: c })) {
                 const text = JSON.stringify(seen);
                 (0, chai_1.expect)(text, where).to.include(PLAIN);
@@ -326,6 +329,7 @@ describe('createSession — an app named by id follows the team rule', () => {
         }
         (0, chai_1.expect)(String(err === null || err === void 0 ? void 0 : err.message)).to.match(/app-a.*JWT key service not initialized/);
         (0, chai_1.expect)(driverCaps, 'the driver was never started').to.equal(undefined);
-        (0, chai_1.expect)(unblock.calledOnceWith('u1', 'h1')).to.equal(true);
+        (0, chai_1.expect)(release.calledOnce).to.equal(true);
+        (0, chai_1.expect)(release.firstCall.args[0]).to.include({ udid: 'u1', host: 'h1' });
     }));
 });

package/lib/test/unit/session-assets.spec.js

@@ -16,7 +16,7 @@ require("reflect-metadata");
 const chai_1 = require("chai");
 const sinon_1 = __importDefault(require("sinon"));
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
@@ -99,12 +99,12 @@ describe('session files', () => {
         fs_1.default.rmSync(dir, { recursive: true, force: true });
     });
     it("serves a visible session's screenshot to a member", () => __awaiter(void 0, void 0, void 0, function* () {
-        const r = yield (0, supertest_1.default)(app(member)).get('/session/sess-shared/asset/screenshots/shot.png');
+        const r = yield (0, loopbackRequest_1.default)(app(member)).get('/session/sess-shared/asset/screenshots/shot.png');
         (0, chai_1.expect)(r.status).to.equal(200);
         (0, chai_1.expect)(String(r.body)).to.equal('png of sess-shared');
     }));
     it('serves a video with Range, for seeking', () => __awaiter(void 0, void 0, void 0, function* () {
-        const r = yield (0, supertest_1.default)(app(member))
+        const r = yield (0, loopbackRequest_1.default)(app(member))
             .get('/session/sess-shared/asset/video/sess-shared.mp4')
             .set('Range', 'bytes=2-4');
         (0, chai_1.expect)(r.status).to.equal(206);
@@ -116,15 +116,15 @@ describe('session files', () => {
             error: true,
             message: `Session with id ${id} not found`,
         });
-        const hidden = yield (0, supertest_1.default)(app(member)).get('/session/sess-b/asset/screenshots/shot.png');
-        const unknown = yield (0, supertest_1.default)(app(member)).get('/session/sess-nope/asset/screenshots/shot.png');
+        const hidden = yield (0, loopbackRequest_1.default)(app(member)).get('/session/sess-b/asset/screenshots/shot.png');
+        const unknown = yield (0, loopbackRequest_1.default)(app(member)).get('/session/sess-nope/asset/screenshots/shot.png');
         (0, chai_1.expect)(unknown.status).to.equal(404);
         (0, chai_1.expect)(unknown.body).to.deep.equal(unknownBody('sess-nope'));
         (0, chai_1.expect)(hidden.status).to.equal(404);
         (0, chai_1.expect)(hidden.body).to.deep.equal(unknownBody('sess-b'));
     }));
     it("an admin gets another team's session file", () => __awaiter(void 0, void 0, void 0, function* () {
-        const r = yield (0, supertest_1.default)(app(admin)).get('/session/sess-b/asset/screenshots/shot.png');
+        const r = yield (0, loopbackRequest_1.default)(app(admin)).get('/session/sess-b/asset/screenshots/shot.png');
         (0, chai_1.expect)(r.status).to.equal(200);
         (0, chai_1.expect)(String(r.body)).to.equal('png of sess-b');
     }));
@@ -136,14 +136,14 @@ describe('session files', () => {
             '/session/sess-shared/asset/screenshots/%2e%2e%2finterceptor%2fsession.har',
             '/session/sess-shared/asset/video/..%2f..%2frecordings%2fgrp%2fcomposite.mp4',
         ]) {
-            const r = yield (0, supertest_1.default)(app(admin)).get(url);
+            const r = yield (0, loopbackRequest_1.default)(app(admin)).get(url);
             (0, chai_1.expect)(r.status, url).to.equal(404);
             (0, chai_1.expect)(r.text, url).to.not.include('HAR-SECRET');
             (0, chai_1.expect)(r.text, url).to.not.include('COMPOSITE-SECRET');
         }
     }));
     it('a missing file in a visible session is a JSON 404', () => __awaiter(void 0, void 0, void 0, function* () {
-        const r = yield (0, supertest_1.default)(app(member)).get('/session/sess-shared/asset/screenshots/none.png');
+        const r = yield (0, loopbackRequest_1.default)(app(member)).get('/session/sess-shared/asset/screenshots/none.png');
         (0, chai_1.expect)(r.status).to.equal(404);
         (0, chai_1.expect)(r.body).to.have.property('error');
     }));
@@ -160,7 +160,7 @@ describe('session files', () => {
         it('no longer serves session files to a caller with no login', () => __awaiter(void 0, void 0, void 0, function* () {
             const a = (0, express_1.default)();
             a.use('/xenon', (0, index_1.createRouter)({ bindHostOrIp: '127.0.0.1', enableDashboard: true }));
-            const r = yield (0, supertest_1.default)(a).get(`/xenon/session-recordings/${path_1.default.basename(probeDir)}/secret.txt`);
+            const r = yield (0, loopbackRequest_1.default)(a).get(`/xenon/session-recordings/${path_1.default.basename(probeDir)}/secret.txt`);
             (0, chai_1.expect)(r.text).to.not.include(secret);
         }));
     });

package/lib/test/unit/session-attribution-wiring.spec.js

@@ -36,15 +36,22 @@ const capsWith = (obj) => ({
 describe('authorizeSessionRequest — identity', () => {
     let svc;
     let authDisabledBefore;
+    let restore;
     beforeEach(() => {
         authDisabledBefore = config_1.config.authDisabled;
         config_1.config.authDisabled = false;
-        svc = typedi_1.Container.get(SessionLifecycleService_1.SessionLifecycleService);
+        restore = (0, container_registration_1.saveRegistrations)(ApiKeyService_1.ApiKeyService, JwtKeyService_1.JwtKeyService, UserService_1.UserService);
+        // No such user and no teams, as the developer's database answered for
+        // these ids: the real lookups read that database. Nothing here is about
+        // the owner's teams.
+        typedi_1.Container.set(UserService_1.UserService, { findById: () => __awaiter(void 0, void 0, void 0, function* () { return null; }) });
+        sinon_1.default.stub(prisma_1.prisma.teamMember, 'findMany').resolves([]);
+        svc = new SessionLifecycleService_1.SessionLifecycleService();
     });
     afterEach(() => {
         config_1.config.authDisabled = authDisabledBefore;
         sinon_1.default.restore();
-        typedi_1.Container.reset();
+        restore();
     });
     it('returns both ids for a valid xe:options pair', () => __awaiter(void 0, void 0, void 0, function* () {
         typedi_1.Container.set(ApiKeyService_1.ApiKeyService, {
@@ -304,6 +311,26 @@ describe('authorizeSessionRequest — leaseAccess', () => {
             }
             (0, chai_1.expect)(error === null || error === void 0 ? void 0 : error.message).to.match(/not allowed/);
         }));
+        it('reads the team from xe:options.team, over a flat cap, and still checks it', () => __awaiter(void 0, void 0, void 0, function* () {
+            withKey(keyRow('sessions'), user('MEMBER'));
+            teamRows.resolves([{ teamId: 'team_a' }, { teamId: 'team_b' }]);
+            const caps = (team) => capsWith({
+                'xe:options': { accessKey: 'ak', token: 'tk', team },
+                'xenon:team': 'team_a',
+            });
+            (0, chai_1.expect)(yield scope(caps('team_b'))).to.deep.equal({
+                callerTeamIds: ['team_b'],
+                scoped: true,
+            });
+            let error;
+            try {
+                yield invoke(svc, caps('team_c'));
+            }
+            catch (e) {
+                error = e;
+            }
+            (0, chai_1.expect)(error === null || error === void 0 ? void 0 : error.message).to.equal("xe:options.team 'team_c' is not allowed for this API key");
+        }));
         it('falls back to the shared pool when the lookup fails', () => __awaiter(void 0, void 0, void 0, function* () {
             withKey(keyRow('sessions'), null);
             typedi_1.Container.set(UserService_1.UserService, { findById: sinon_1.default.stub().rejects(new Error('db down')) });