@xenon-device-management/xenon 2.0.0 → 2.1.0

package/lib/public/index.html

@@ -36,7 +36,7 @@
       Learn how to configure a non-root public URL by running `npm run build`.
     -->
   <title>Xenon</title>
-  <script type="module" crossorigin src="/xenon/assets/index-BR1wTIPC.js"></script>
+  <script type="module" crossorigin src="/xenon/assets/index-BuIIcmGp.js"></script>
   <link rel="stylesheet" crossorigin href="/xenon/assets/index-hymrhlEZ.css">
 </head>
 

package/lib/src/InternalHttpClient.js

@@ -55,7 +55,8 @@ const logger_1 = __importDefault(require("./logger"));
  *
  * Features:
  * - Keep-alive connections for performance
- * - Automatic retry with exponential backoff
+ * - Automatic retry with exponential backoff, except for a request that sets
+ *   `retry: false` (InternalRequestConfig)
  * - Request/response logging for debugging
  * - Correlation ID tracking
  */
@@ -178,6 +179,9 @@ class InternalHttpClient {
                 logger_1.default.warn(`[HTTP ←] ${(_c = config === null || config === void 0 ? void 0 : config.method) === null || _c === void 0 ? void 0 : _c.toUpperCase()} ${config === null || config === void 0 ? void 0 : config.url} ` +
                     `[${status || 'ERR'}] ${duration}ms - ${error.message}`);
             }
+            if (config.retry === false) {
+                return Promise.reject(error);
+            }
             const decision = InternalHttpClient.classifyRetry(error);
             if (!decision.retryable || config.retryCount >= InternalHttpClient.MAX_RETRIES) {
                 return Promise.reject(error);

package/lib/src/XenonCapabilityManager.js

@@ -206,9 +206,23 @@ function iOSCapabilities(caps, freeDevice) {
         deleteMatch.forEach((value) => deleteAlwaysMatch(caps, value));
     });
 }
+/**
+ * The team a session asks to be placed in, or undefined. Documented as
+ * `xe:options.team` (`teamId` is read too), with `xenon:options` as the
+ * alias, through xenonOptionsOf like every other Xenon option. The flat caps
+ * older clients send (`xenon:team`, `xe:teamId`, ...) still work; an options
+ * field wins over them. `df:` is never read.
+ *
+ * The merge is field by field, so if a request spells it `team` in one
+ * namespace and `teamId` in the other, `team` wins.
+ */
 function extractTeamCap(caps) {
     var _a;
-    const merged = Object.assign({}, ((_a = caps.firstMatch) === null || _a === void 0 ? void 0 : _a[0]) || {}, caps.alwaysMatch || {});
+    const options = (0, xenonOptions_1.xenonOptionsOf)(caps);
+    const fromOptions = (_a = (0, xenonOptions_1.stringOption)(options, 'team')) !== null && _a !== void 0 ? _a : (0, xenonOptions_1.stringOption)(options, 'teamId');
+    if (fromOptions)
+        return fromOptions;
+    const merged = (0, xenonOptions_1.mergedFirstMatch)(caps);
     const prefixes = ['xenon:', 'xe:', 'appium:', ''];
     const names = ['teamId', 'team_id', 'team'];
     for (const prefix of prefixes) {

package/lib/src/app/appiumBasePath.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeBasePath = normalizeBasePath;
+exports.appiumPathname = appiumPathname;
+/**
+ * Appium's base-path rule (base-driver `normalizeBasePath`): drop one trailing
+ * '/', and add a leading '/' unless the path is empty. `cliArgs.basePath`
+ * reaches a plugin as the operator wrote it, while Appium normalises its own
+ * copy before building routes and WebSocket paths, so anything placed in front
+ * of those must normalise the same way or it would miss what it guards.
+ */
+function normalizeBasePath(basePath) {
+    let normalized = typeof basePath === 'string' ? basePath : '';
+    normalized = normalized.replace(/\/$/, '');
+    if (normalized !== '' && !normalized.startsWith('/'))
+        normalized = `/${normalized}`;
+    return normalized;
+}
+/**
+ * The pathname Appium matches an upgrade against, computed as
+ * base-driver's tryHandleWebSocketUpgrade does: WHATWG URL parsing, which
+ * resolves dot segments (also `%2e%2e`) and drops the query and an absolute
+ * form's host.
+ */
+function appiumPathname(url) {
+    try {
+        return new URL(url, 'http://localhost').pathname;
+    }
+    catch (_a) {
+        return url;
+    }
+}

package/lib/src/app/index.js

@@ -86,6 +86,9 @@ const rateLimitMiddleware_1 = require("../middleware/rateLimitMiddleware");
 const csrfMiddleware_1 = require("../middleware/csrfMiddleware");
 const swagger_1 = require("./swagger");
 const typedi_1 = require("typedi");
+const PluginContext_1 = require("../PluginContext");
+const nodeWebDriverUrl_1 = require("../gateway/nodeWebDriverUrl");
+const nodeSessionStatus_1 = require("../gateway/nodeSessionStatus");
 const dashboardPluginUrl = null;
 const ASYNC_LOCK = new async_lock_1.default();
 const router = express_1.default.Router(), apiRouter = express_1.default.Router(), staticFilesRouter = express_1.default.Router();
@@ -228,6 +231,15 @@ function createRouter(pluginArgs) {
     apiRouter.use(csrfMiddleware_1.csrfMiddleware);
     // Health endpoint: no auth, no rate limit
     apiRouter.get('/health', (_req, res) => res.json({ ok: true }));
+    // Where this server's WebDriver API lives: a hub asks a node before sending
+    // it a session or a command (gateway/nodeWebDriverUrl.ts). No login: the
+    // hub holds no credentials for the node, and the base path is in every
+    // client's URL anyway.
+    apiRouter.get('/webdriver', (0, nodeWebDriverUrl_1.webdriverInfoHandler)(() => typedi_1.Container.get(PluginContext_1.PluginContext).nodeBasePath));
+    // On a node: whether a session exists, for the hub's heartbeat, answered
+    // without sending the session a command. No login (the hub holds no
+    // credentials for the node); it takes the hub's session token instead.
+    (0, nodeSessionStatus_1.registerNodeSessionStatus)(apiRouter, pluginArgs);
     // Dashboard login: unauthenticated (rate-limited internally via separate IP logic)
     apiRouter.use('/auth', (0, auth_1.authPublicRouter)()); // login, logout — unauthenticated
     // All remaining /api/* requires authentication (cookie session for

package/lib/src/app/insertBeforeRoutes.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.routerStackOf = routerStackOf;
 exports.insertBeforeRoutes = insertBeforeRoutes;
+exports.insertAtStart = insertAtStart;
 function isRouter(candidate) {
     return !!candidate && Array.isArray(candidate.stack);
 }
@@ -28,7 +29,11 @@ function routerStackOf(app) {
     var _a;
     return (_a = findRouter(app)) === null || _a === void 0 ? void 0 : _a.router.stack;
 }
-function insertBeforeRoutes(app, path, handler) {
+/**
+ * Let `app.use()` build one layer, then move it to `positionOf(stack)` (the
+ * stack without the new layer).
+ */
+function spliceNewLayer(app, use, positionOf) {
     const found = findRouter(app);
     if (!found) {
         return {
@@ -38,7 +43,7 @@ function insertBeforeRoutes(app, path, handler) {
     }
     const { stack } = found.router;
     const lengthBefore = stack.length;
-    app.use(path, handler);
+    use();
     const added = stack.splice(lengthBefore);
     if (added.length !== 1) {
         // app.use() added its layer somewhere other than the stack we found, or
@@ -50,8 +55,23 @@ function insertBeforeRoutes(app, path, handler) {
             reason: `app.use() added ${added.length} layers to the router stack, expected 1`,
         };
     }
-    const firstRoute = stack.findIndex((layer) => !!layer.route);
-    const index = firstRoute === -1 ? stack.length : firstRoute;
+    const index = positionOf(stack);
     stack.splice(index, 0, added[0]);
     return { placed: true, shape: found.shape, index };
 }
+function insertBeforeRoutes(app, path, handler) {
+    return spliceNewLayer(app, () => app.use(path, handler), (stack) => {
+        const firstRoute = stack.findIndex((layer) => !!layer.route);
+        return firstRoute === -1 ? stack.length : firstRoute;
+    });
+}
+/**
+ * Put a path-less middleware at the very front of the router stack, ahead of
+ * middleware as well as routes. For a check that must run before one of
+ * Appium's own middlewares (its WebSocket `handleUpgrade`), which sit ahead of
+ * the routes. On Express 4 that is also ahead of `query` and `expressInit`, so
+ * the handler must use only Node's own request and response API.
+ */
+function insertAtStart(app, handler) {
+    return spliceNewLayer(app, () => app.use(handler), () => 0);
+}

package/lib/src/app/registerCommandAuth.js

@@ -1,67 +1,186 @@
 "use strict";
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.normalizeBasePath = normalizeBasePath;
+exports.normalizeBasePath = void 0;
 exports.sessionCommandPath = sessionCommandPath;
+exports.sessionListingPath = sessionListingPath;
+exports.commandAuthDeps = commandAuthDeps;
+exports.sessionCreatePath = sessionCreatePath;
+exports.registerSessionGateway = registerSessionGateway;
 exports.registerCommandAuth = registerCommandAuth;
+exports.registerSessionUpgradeGuard = registerSessionUpgradeGuard;
 const typedi_1 = require("typedi");
 const logger_1 = __importDefault(require("../logger"));
 const config_1 = require("../config");
 const SessionOwnerResolver_1 = require("../services/device-access/SessionOwnerResolver");
 const commandAuth_1 = require("../middleware/commandAuth");
 const commandCaller_1 = require("../middleware/commandCaller");
+const sessionListingFilter_1 = require("../middleware/sessionListingFilter");
+const sessionUpgradeGuard_1 = require("../middleware/sessionUpgradeGuard");
+const internalCall_1 = require("../gateway/internalCall");
+const sessionGateway_1 = require("../gateway/sessionGateway");
+const sessionCreate_1 = require("../gateway/sessionCreate");
+const appiumBasePath_1 = require("./appiumBasePath");
+Object.defineProperty(exports, "normalizeBasePath", { enumerable: true, get: function () { return appiumBasePath_1.normalizeBasePath; } });
 const insertBeforeRoutes_1 = require("./insertBeforeRoutes");
-/**
- * Appium's base-path rule (base-driver `normalizeBasePath`): drop one trailing
- * '/', and add a leading '/' unless the path is empty. `cliArgs.basePath`
- * reaches a plugin as the operator wrote it, while Appium normalises its own
- * copy before building routes, so the guard must normalise the same way or it
- * would miss the routes it is meant to sit in front of.
- */
-function normalizeBasePath(basePath) {
-    let normalized = typeof basePath === 'string' ? basePath : '';
-    normalized = normalized.replace(/\/$/, '');
-    if (normalized !== '' && !normalized.startsWith('/'))
-        normalized = `/${normalized}`;
-    return normalized;
-}
 /**
  * Everything under `<basePath>/session/:sessionId`, every method. The create
  * route (`POST <basePath>/session`) has no id segment and does not match.
  */
 function sessionCommandPath(basePath) {
-    return `${normalizeBasePath(basePath)}/session/:sessionId`;
+    return `${(0, appiumBasePath_1.normalizeBasePath)(basePath)}/session/:sessionId`;
+}
+/** Appium 3's session listing route (base-driver `getAppiumSessions`). */
+function sessionListingPath(basePath) {
+    return `${(0, appiumBasePath_1.normalizeBasePath)(basePath)}/appium/sessions`;
 }
 /**
- * Install per-command auth (commandAuth.ts) ahead of Appium's routes. Called
- * from ServerManager.registerRoutes, which Appium runs after adding them.
+ * The dependencies per-command auth runs with. ServerManager builds one set
+ * and hands it to both registrations below, so commands, the session listing
+ * and session WebSockets share one credential cache.
+ */
+function commandAuthDeps(overrides = {}) {
+    var _a, _b, _c, _d, _e, _f;
+    return {
+        enabled: (_a = overrides.enabled) !== null && _a !== void 0 ? _a : (() => (0, commandAuth_1.commandAuthEnabled)()),
+        authDisabled: (_b = overrides.authDisabled) !== null && _b !== void 0 ? _b : (() => config_1.config.authDisabled === true),
+        verifier: (_c = overrides.verifier) !== null && _c !== void 0 ? _c : new commandCaller_1.CommandCallerVerifier(),
+        ownerOf: (_d = overrides.ownerOf) !== null && _d !== void 0 ? _d : ((sessionId) => typedi_1.Container.get(SessionOwnerResolver_1.SessionOwnerResolver).ownerOf(sessionId)),
+        ownersOf: (_e = overrides.ownersOf) !== null && _e !== void 0 ? _e : ((sessionIds) => typedi_1.Container.get(SessionOwnerResolver_1.SessionOwnerResolver).ownersOf(sessionIds)),
+        logger: (_f = overrides.logger) !== null && _f !== void 0 ? _f : logger_1.default.scope('CommandAuth'),
+    };
+}
+const refuseToStart = (what) => new Error(`XENON_REQUIRE_COMMAND_AUTH is on, but ${what}. Refusing to start rather than ` +
+    'serve sessions unchecked.');
+/** The create route (`POST <basePath>/session`), where the create layer is mounted. */
+function sessionCreatePath(basePath) {
+    return `${(0, appiumBasePath_1.normalizeBasePath)(basePath)}/session`;
+}
+/**
+ * Install the session gateway (gateway/sessionGateway.ts) and the
+ * session-listing filter (sessionListingFilter.ts) ahead of Appium's routes.
+ * Called from ServerManager.registerRoutes, which Appium runs after adding
+ * them. The gateway is three adjacent layers:
+ *
+ * 1. the internal-call layer (gateway/internalCall.ts), path-less, which turns
+ *    Xenon's own `<basePath>/wd-internal/...` calls, when they carry this
+ *    process's secret, into the plain session command;
+ * 2. with `options.create`, the create layer at `<basePath>/session`
+ *    (gateway/sessionCreate.ts), which allocates the phone for
+ *    `POST <basePath>/session` and creates a remote phone's session itself;
+ * 3. the session layer at `<basePath>/session/:sessionId`: per-command auth,
+ *    then, on a hub, forwarding of the sessions other servers run.
+ *
+ * The first comes first, so the others see an internal call by its real path
+ * and know it for one. It is path-less because Express puts a mount path back
+ * onto the URL when a mounted layer calls next(), which would undo the strip.
+ * The others are mounted, so their path matching is the router's own.
+ *
+ * All of it is always installed and reads the setting per request, so a
+ * server with per-command auth off pays one env check per session command and
+ * does no lookups for it. If a layer cannot be placed ahead of the routes the
+ * error is logged, and with the setting on (and auth enabled) the server
+ * refuses to start: an operator who asked for the check must not get a server
+ * that silently serves session commands without it.
  *
- * The middleware is always installed and reads the setting per request, so a
- * server with the setting off pays one env check per session command and does
- * no lookups. If it cannot be placed ahead of the routes the error is logged,
- * and with the setting on (and auth enabled) the server refuses to start:
- * an operator who asked for the check must not get a server that silently
- * serves session commands without it.
+ * Returns where the session layer was placed.
  */
-function registerCommandAuth(app, cliArgs, overrides = {}) {
-    const deps = Object.assign({ enabled: () => (0, commandAuth_1.commandAuthEnabled)(), authDisabled: () => config_1.config.authDisabled === true, verifier: new commandCaller_1.CommandCallerVerifier(), ownerOf: (sessionId) => typedi_1.Container.get(SessionOwnerResolver_1.SessionOwnerResolver).ownerOf(sessionId), logger: logger_1.default.scope('CommandAuth') }, overrides);
-    const path = sessionCommandPath(cliArgs === null || cliArgs === void 0 ? void 0 : cliArgs.basePath);
-    const result = (0, insertBeforeRoutes_1.insertBeforeRoutes)(app, path, (0, commandAuth_1.createCommandAuthMiddleware)(deps));
+function registerSessionGateway(app, cliArgs, deps, options = {}) {
+    var _a;
     const active = deps.enabled() && !deps.authDisabled();
+    const basePath = (0, appiumBasePath_1.normalizeBasePath)(cliArgs === null || cliArgs === void 0 ? void 0 : cliArgs.basePath);
+    const { create } = options, gateway = __rest(options, ["create"]);
+    const path = sessionCommandPath(basePath);
+    const internal = (0, insertBeforeRoutes_1.insertBeforeRoutes)(app, '/', (0, internalCall_1.createInternalCallLayer)(basePath));
+    const created = internal.placed && create
+        ? (0, insertBeforeRoutes_1.insertBeforeRoutes)(app, sessionCreatePath(basePath), (0, sessionCreate_1.createSessionCreateLayer)(Object.assign(Object.assign({}, create), { authDisabled: deps.authDisabled, logger: (_a = create.logger) !== null && _a !== void 0 ? _a : deps.logger })))
+        : internal;
+    const result = created.placed
+        ? (0, insertBeforeRoutes_1.insertBeforeRoutes)(app, path, (0, sessionGateway_1.createSessionGatewayLayer)(Object.assign(Object.assign({}, gateway), { auth: deps })))
+        : created;
     if (!result.placed) {
         deps.logger.error(`Per-command auth could not be placed ahead of Appium's routes for ${path}: ${result.reason}.`);
         if (active) {
-            throw new Error('XENON_REQUIRE_COMMAND_AUTH is on, but the per-command check could not be placed ahead ' +
-                "of Appium's WebDriver routes, so it would never run. Refusing to start rather than " +
-                'serve session commands unchecked.');
+            throw refuseToStart("the per-command check could not be placed ahead of Appium's WebDriver routes, " +
+                'so it would never run');
+        }
+        return result;
+    }
+    const listingPath = sessionListingPath(cliArgs === null || cliArgs === void 0 ? void 0 : cliArgs.basePath);
+    const listing = (0, insertBeforeRoutes_1.insertBeforeRoutes)(app, listingPath, (0, sessionListingFilter_1.createSessionListingFilter)(deps));
+    if (!listing.placed) {
+        deps.logger.error("The session-listing filter could not be placed ahead of Appium's routes for " +
+            `${listingPath}: ${listing.reason}.`);
+        if (active) {
+            throw refuseToStart(`the session-listing filter could not be placed ahead of ${listingPath}`);
         }
         return result;
     }
     deps.logger.info(active
         ? `Per-command auth is ON: every request under ${path} needs the session owner's ` +
-            'credentials or an override admin (XENON_REQUIRE_COMMAND_AUTH).'
-        : `Per-command auth is off for ${path} (XENON_REQUIRE_COMMAND_AUTH not set, or auth disabled).`);
+            `credentials or an override admin, and ${listingPath} lists only the caller's ` +
+            'sessions (XENON_REQUIRE_COMMAND_AUTH).'
+        : `Per-command auth is off for ${path} and ${listingPath} ` +
+            '(XENON_REQUIRE_COMMAND_AUTH not set, or auth disabled).');
     return result;
 }
+/**
+ * Per-command auth (commandAuth.ts) and the session-listing filter, through the
+ * session gateway with no routing: a server that runs every session itself.
+ */
+function registerCommandAuth(app, cliArgs, overrides = {}) {
+    return registerSessionGateway(app, cliArgs, commandAuthDeps(overrides));
+}
+/**
+ * Install the session WebSocket guard (sessionUpgradeGuard.ts) on both of the
+ * paths Appium can take an upgrade by: the http.Server's `upgrade` event and
+ * the front of the Express stack. Called from ServerManager.updateServer with
+ * the http.Server Appium hands plugins.
+ *
+ * Like registerCommandAuth, it is always installed and reads the setting per
+ * upgrade; with the setting off every upgrade passes straight through. If
+ * either hook cannot be installed the error is logged, and with the setting on
+ * the server refuses to start.
+ */
+function registerSessionUpgradeGuard(httpServer, app, cliArgs, overrides = {}) {
+    const deps = commandAuthDeps(overrides);
+    const active = deps.enabled() && !deps.authDisabled();
+    const basePath = (0, appiumBasePath_1.normalizeBasePath)(cliArgs === null || cliArgs === void 0 ? void 0 : cliArgs.basePath);
+    const guard = (0, sessionUpgradeGuard_1.createSessionUpgradeGuard)(basePath, deps);
+    const problems = [];
+    if (httpServer && typeof httpServer.emit === 'function') {
+        (0, sessionUpgradeGuard_1.guardUpgradeEvents)(httpServer, guard);
+    }
+    else {
+        problems.push('no HTTP server was given to guard');
+    }
+    const front = (0, insertBeforeRoutes_1.insertAtStart)(app, guard.middleware);
+    if (!front.placed)
+        problems.push(`the Express guard was not placed: ${front.reason}`);
+    if (problems.length > 0) {
+        const reason = problems.join('; ');
+        deps.logger.error(`The session WebSocket guard could not be installed: ${reason}.`);
+        if (active) {
+            throw refuseToStart(`session WebSockets (${basePath}/bidi/<id>, /ws/session/<id>/...) could not be guarded`);
+        }
+        return { placed: false, shape: front.shape, reason };
+    }
+    deps.logger.info(active
+        ? `Session WebSocket guard is ON: upgrades to ${basePath}/bidi/:sessionId and ` +
+            "/ws/session/:sessionId/... need the session owner's credentials or an override admin."
+        : 'Session WebSocket guard is off (XENON_REQUIRE_COMMAND_AUTH not set, or auth disabled).');
+    return front;
+}

package/lib/src/app/routers/control.js

@@ -68,6 +68,7 @@ const InspectorService_1 = require("../../services/InspectorService");
 const StreamTicketService_1 = require("../../services/token/StreamTicketService");
 const appVisibility_1 = require("../../services/device-access/appVisibility");
 const PluginContext_1 = require("../../PluginContext");
+const localDeviceHosts_1 = require("../../device-managers/localDeviceHosts");
 const streamType_1 = require("./streamType");
 const iosStreamPort_1 = require("./iosStreamPort");
 const androidH264Config_1 = require("./androidH264Config");
@@ -83,6 +84,7 @@ const streamStartConflict_1 = require("./streamStartConflict");
 const streamLeave_1 = require("./streamLeave");
 const SessionOwnerResolver_1 = require("../../services/device-access/SessionOwnerResolver");
 const actor_1 = require("../../services/device-access/actor");
+const hubSessionToken_1 = require("../../gateway/hubSessionToken");
 const deviceAccessPolicy_1 = require("../../services/device-access/deviceAccessPolicy");
 const router = (0, express_1.Router)();
 /** True when an in-memory iOS/Android (MJPEG or H.264) stream session exists. */
@@ -141,6 +143,45 @@ function buildProxyUrl(deviceHost, req) {
     const forwardPath = req.originalUrl.startsWith('/') ? req.originalUrl : `/${req.originalUrl}`;
     return `${origin}${forwardPath}`;
 }
+/**
+ * Forward a control action on another server's phone to that server, signed
+ * for the caller: the hub's control token (hubSessionToken.ts) names the
+ * user, whether they are an admin, the phone and its node. This hub already
+ * checked them (the guards above); a node with auth enabled accepts the token
+ * for /control on that phone and runs its own ownership guard with that user.
+ * Sent with no credential at all, it was refused by every such node. A cloud
+ * provider never gets a hub token.
+ */
+function forwardControl(device, req, target) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const actor = (0, actor_1.resolveActor)(req);
+        const token = !device.cloud && actor.userId
+            ? yield typedi_1.Container.get(hubSessionToken_1.HubSessionTokenIssuer).controlTokenFor({
+                userId: actor.userId,
+                isAdmin: actor.isAdmin,
+                udid: device.udid,
+                host: device.host,
+            })
+            : null;
+        // Sent once: a retry after a slow node's timeout or 5xx could land the
+        // same tap twice.
+        const config = Object.assign(Object.assign({}, (token ? { headers: { [hubSessionToken_1.HUB_TOKEN_HEADER]: token } } : {})), { retry: false });
+        yield InternalHttpClient_1.InternalHttpClient.post(target, req.body, config);
+    });
+}
+/**
+ * A phone another server drives, whose /control actions are forwarded there.
+ * Decided by the phone's own row (its nodeId, else its exact host against this
+ * server's own hosts), never by the Host header the caller used: a substring
+ * match on that header forwarded a lab's own phone back to itself, with no
+ * login, whenever the lab was reached as `localhost`.
+ */
+function isOtherServersPhone(device) {
+    if (!device.host)
+        return false;
+    const context = typedi_1.Container.get(PluginContext_1.PluginContext);
+    return !(0, localDeviceHosts_1.isOwnDevice)((0, localDeviceHosts_1.localDeviceHosts)(context.pluginArgs, context.port), context.nodeId, device);
+}
 function getDeviceInfo(udid) {
     return __awaiter(this, void 0, void 0, function* () {
         const device = yield device_store_1.DeviceStoreFactory.getStore().findDevice({ udid });
@@ -179,13 +220,13 @@ router.post('/:udid/tap', (req, res) => __awaiter(void 0, void 0, void 0, functi
     if (!device)
         return res.status(404).send('Device not found');
     const manager = yield getDeviceManagerForPlatform(device.platform);
-    if (device.host && !device.host.includes(req.get('host') || '')) {
+    if (isOtherServersPhone(device)) {
         const target = buildProxyUrl(device.host, req);
         if (!target)
             return res.status(400).send({ error: 'Unsafe device host' });
         logger_1.default.info(`Proxying tap for ${udid} to ${target}`);
         try {
-            yield InternalHttpClient_1.InternalHttpClient.post(target, req.body);
+            yield forwardControl(device, req, target);
             return res.status(200).send({ success: true });
         }
         catch (err) {
@@ -223,13 +264,13 @@ router.post('/:udid/swipe', (req, res) => __awaiter(void 0, void 0, void 0, func
     if (!device)
         return res.status(404).send('Device not found');
     const manager = yield getDeviceManagerForPlatform(device.platform);
-    if (device.host && !device.host.includes(req.get('host') || '')) {
+    if (isOtherServersPhone(device)) {
         const target = buildProxyUrl(device.host, req);
         if (!target)
             return res.status(400).send({ error: 'Unsafe device host' });
         logger_1.default.info(`Proxying swipe for ${udid} to ${target}`);
         try {
-            yield InternalHttpClient_1.InternalHttpClient.post(target, req.body);
+            yield forwardControl(device, req, target);
             return res.status(200).send({ success: true });
         }
         catch (err) {
@@ -256,13 +297,13 @@ router.post('/:udid/text', (req, res) => __awaiter(void 0, void 0, void 0, funct
     if (!device)
         return res.status(404).send('Device not found');
     const manager = yield getDeviceManagerForPlatform(device.platform);
-    if (device.host && !device.host.includes(req.get('host') || '')) {
+    if (isOtherServersPhone(device)) {
         const target = buildProxyUrl(device.host, req);
         if (!target)
             return res.status(400).send({ error: 'Unsafe device host' });
         logger_1.default.info(`Proxying typeText for ${udid} to ${target}`);
         try {
-            yield InternalHttpClient_1.InternalHttpClient.post(target, req.body);
+            yield forwardControl(device, req, target);
             return res.status(200).send({ success: true });
         }
         catch (err) {
@@ -289,13 +330,13 @@ router.post('/:udid/keyevent', (req, res) => __awaiter(void 0, void 0, void 0, f
     if (!device)
         return res.status(404).send('Device not found');
     const manager = yield getDeviceManagerForPlatform(device.platform);
-    if (device.host && !device.host.includes(req.get('host') || '')) {
+    if (isOtherServersPhone(device)) {
         const target = buildProxyUrl(device.host, req);
         if (!target)
             return res.status(400).send({ error: 'Unsafe device host' });
         logger_1.default.info(`Proxying keyevent for ${udid} to ${target}`);
         try {
-            yield InternalHttpClient_1.InternalHttpClient.post(target, req.body);
+            yield forwardControl(device, req, target);
             return res.status(200).send({ success: true });
         }
         catch (err) {
@@ -392,13 +433,13 @@ router.post('/:udid/touchAndHold', (req, res) => __awaiter(void 0, void 0, void
     if (!device)
         return res.status(404).send('Device not found');
     const manager = yield getDeviceManagerForPlatform(device.platform);
-    if (device.host && !device.host.includes(req.get('host') || '')) {
+    if (isOtherServersPhone(device)) {
         const target = buildProxyUrl(device.host, req);
         if (!target)
             return res.status(400).send({ error: 'Unsafe device host' });
         logger_1.default.info(`Proxying touchAndHold for ${udid} to ${target}`);
         try {
-            yield InternalHttpClient_1.InternalHttpClient.post(target, req.body);
+            yield forwardControl(device, req, target);
             return res.status(200).send({ success: true });
         }
         catch (err) {
@@ -800,7 +841,9 @@ router.post('/:udid/stream/ticket', (req, res) => __awaiter(void 0, void 0, void
 function stopPreview(udid, device, release) {
     return __awaiter(this, void 0, void 0, function* () {
         if (device.platform === 'ios' || device.platform === 'tvos') {
-            yield typedi_1.Container.get(IOSStreamService_1.default).stopStream(udid);
+            // A viewer's stop: an Appium session on the phone may be driving this
+            // stream's WDA, and then the stream stays (see IOSStreamService.stopStream).
+            yield typedi_1.Container.get(IOSStreamService_1.default).stopStream(udid, { forViewer: true });
         }
         else {
             yield typedi_1.Container.get(AndroidStreamService_1.default).stopStream(udid);
@@ -1026,8 +1069,9 @@ router.get('/:udid/stream', (req, res) => __awaiter(void 0, void 0, void 0, func
                 getSession: (id) => iosStreamService.getStreamStatus(id),
                 // Single attempt (retries = 0): a healthy WDA answers in milliseconds,
                 // so this costs nothing on the happy path and stays bounded by the
-                // 2.5s /status timeout when WDA is dead.
-                isWdaHealthy: (wdaPort, id) => iosStreamService.isWDARunning(wdaPort, id, 0),
+                // 2.5s /status timeout when WDA is dead. No udid: WDA names no phone
+                // (see isWDARunning). The port is this phone's stream's own lease.
+                isWdaHealthy: (wdaPort) => iosStreamService.isWDARunning(wdaPort, 0),
                 startStream: (id) => __awaiter(void 0, void 0, void 0, function* () {
                     var _a;
                     logger_1.default.info(`Stream for iOS device ${id} requested (Status: ${((_a = iosStreamService.getStreamStatus(id)) === null || _a === void 0 ? void 0 : _a.status) || 'idle'})...`);

package/lib/src/app/routers/grid.js

@@ -58,6 +58,8 @@ const device_managers_1 = require("../../device-managers");
 const typedi_1 = require("typedi");
 const prisma_1 = require("../../prisma");
 const DeviceTeamResolver_1 = require("../../services/device-access/DeviceTeamResolver");
+const PluginContext_1 = require("../../PluginContext");
+const localDeviceHosts_1 = require("../../device-managers/localDeviceHosts");
 const store = device_store_1.DeviceStoreFactory.getStore();
 const pendingStore = device_store_1.DeviceStoreFactory.getPendingSessionStore();
 const SERVER_UP_TIME = new Date().toISOString();
@@ -141,26 +143,44 @@ function getDeviceByPlatform(request, response) {
         return response.status(200).send(yield (0, device_service_1.enrichDevicesWithTeamNames)(devices));
     });
 }
+/** A removal a node asked for, from what it sent: strings only. */
+function nodeRemoval(host, nodeId, udid) {
+    return {
+        udid,
+        host: typeof host === 'string' && host !== '' ? host : undefined,
+        nodeId: typeof nodeId === 'string' && nodeId !== '' ? nodeId : undefined,
+    };
+}
+/** Whether a row is one of this server's own phones, which no node may remove. */
+function isThisServersOwn() {
+    const context = typedi_1.Container.get(PluginContext_1.PluginContext);
+    const local = (0, localDeviceHosts_1.localDeviceHosts)(context.pluginArgs, context.port);
+    return (device) => (0, localDeviceHosts_1.isOwnDevice)(local, context.nodeId, device);
+}
 function registerNode(request, response) {
     return __awaiter(this, void 0, void 0, function* () {
         const requestBody = request.body;
         const { type } = request.query;
         if (type === 'add') {
-            // A node's own report of its phones: it is their source of truth, so the
-            // hub writes every column (AddDevicesOptions.mirror).
-            const addedDevices = yield (0, device_service_1.addNewDevice)(requestBody, undefined, { mirror: true });
+            // A node's report of its phones (AddDevicesOptions.nodeReport): what the
+            // node observes of them, and whether they are busy there (`nodeBusy`).
+            // It never frees a phone this hub has claimed for a session, nor changes
+            // the settings this hub owns for it: team, tags, reservation, block.
+            const addedDevices = yield (0, device_service_1.addNewDevice)(requestBody, undefined, { nodeReport: true });
             if (addedDevices.length > 0) {
                 logger_1.default.info(`Added new devices: ${JSON.stringify(addedDevices)}`);
             }
         }
         else if (type === 'remove') {
-            yield (0, device_service_1.removeDevice)(requestBody);
+            // One phone each, by udid: an entry without one names no phone.
+            const removals = (Array.isArray(requestBody) ? requestBody : [])
+                .filter((entry) => typeof (entry === null || entry === void 0 ? void 0 : entry.udid) === 'string' && entry.udid !== '')
+                .map((entry) => nodeRemoval(entry.host, entry.nodeId, entry.udid));
+            yield (0, device_service_1.removeNodeDevices)(removals, isThisServersOwn());
         }
         else if (type === 'unregister') {
-            const { host } = request.query;
-            if (host) {
-                yield (0, device_service_1.removeDevicesByHost)(host);
-            }
+            const { host, nodeId } = request.query;
+            yield (0, device_service_1.removeNodeDevices)([nodeRemoval(host, nodeId)], isThisServersOwn());
         }
         response.status(200).send({
             success: true,