@xenon-device-management/xenon 2.0.0 → 2.2.0

package/lib/test/unit/OrphanSweeper.test.js

@@ -48,22 +48,29 @@ Object.defineProperty(exports, "__esModule", { value: true });
 require("reflect-metadata");
 const chai_1 = require("chai");
 const sinon_1 = __importDefault(require("sinon"));
-const prisma_1 = require("../../src/prisma");
 const test_container_1 = require("../helpers/test-container");
+const scratch_database_1 = require("../helpers/scratch-database");
+const device_store_1 = require("../../src/data-service/device-store");
+const prisma_store_1 = require("../../src/data-service/prisma-store");
 const event_manager_1 = require("../../src/dashboard/event-manager");
 const SessionStatus_1 = require("../../src/types/SessionStatus");
 describe('OrphanSweeper', () => {
-    let prismaClient;
+    // Its own migrated database, never the developer's ~/.cache/xenon/xenon.db:
+    // that file's schema is whatever the last local migrate left, so a new
+    // column failed this spec there and nowhere else.
+    const scratch = (0, scratch_database_1.useScratchDatabase)();
+    let savedStore;
     const STALE_SESSION_ID = 'orphan-stale-sess-001';
     const STALE_UDID = 'udid-orphan-1';
     const NODE_ID = 'node-a';
     const FRESH_SESSION_ID = 'orphan-fresh-sess-002';
     before(() => __awaiter(void 0, void 0, void 0, function* () {
         (0, test_container_1.setupTestContainer)();
-        prismaClient = (0, prisma_1.getPrismaClient)();
+        savedStore = device_store_1.DeviceStoreFactory._deviceStore;
+        device_store_1.DeviceStoreFactory._deviceStore = new prisma_store_1.PrismaDeviceStore();
         // Create a stale session (last_heartbeat_at is old / null with old updatedAt)
         const oldDate = new Date(Date.now() - 5 * 60 * 1000); // 5 minutes ago
-        yield prismaClient.session.upsert({
+        yield scratch.db.session.upsert({
             where: { id: STALE_SESSION_ID },
             create: {
                 id: STALE_SESSION_ID,
@@ -87,7 +94,7 @@ describe('OrphanSweeper', () => {
             },
         });
         // Create a device for the stale session
-        yield prismaClient.device.upsert({
+        yield scratch.db.device.upsert({
             where: { udid_host: { udid: STALE_UDID, host: 'http://localhost:4723' } },
             create: {
                 udid: STALE_UDID,
@@ -105,10 +112,7 @@ describe('OrphanSweeper', () => {
         });
     }));
     after(() => __awaiter(void 0, void 0, void 0, function* () {
-        yield prismaClient.session.deleteMany({
-            where: { id: { in: [STALE_SESSION_ID, FRESH_SESSION_ID] } },
-        });
-        yield prismaClient.device.deleteMany({ where: { udid: STALE_UDID } });
+        device_store_1.DeviceStoreFactory._deviceStore = savedStore;
         yield (0, test_container_1.resetTestContainer)();
     }));
     afterEach(() => {
@@ -122,13 +126,13 @@ describe('OrphanSweeper', () => {
         const { OrphanSweeper } = yield Promise.resolve().then(() => __importStar(require('../../src/services/OrphanSweeper')));
         const sweeper = new OrphanSweeper();
         yield sweeper.sweep({ heartbeatIntervalMs: 30000 });
-        const session = yield prismaClient.session.findUnique({
+        const session = yield scratch.db.session.findUnique({
             where: { id: STALE_SESSION_ID },
             select: { status: true, failure_reason: true },
         });
         (0, chai_1.expect)(session.status).to.equal('failed');
         (0, chai_1.expect)(session.failure_reason).to.match(/heartbeat timeout/i);
-        const device = yield prismaClient.device.findFirst({
+        const device = yield scratch.db.device.findFirst({
             where: { udid: STALE_UDID },
             select: { busy: true, owningSessionId: true },
         });
@@ -138,7 +142,7 @@ describe('OrphanSweeper', () => {
     }));
     it('leaves fresh sessions alone', () => __awaiter(void 0, void 0, void 0, function* () {
         // Create a fresh session (heartbeat just now)
-        yield prismaClient.session.upsert({
+        yield scratch.db.session.upsert({
             where: { id: FRESH_SESSION_ID },
             create: {
                 id: FRESH_SESSION_ID,
@@ -164,7 +168,7 @@ describe('OrphanSweeper', () => {
         const { OrphanSweeper } = yield Promise.resolve().then(() => __importStar(require('../../src/services/OrphanSweeper')));
         const sweeper = new OrphanSweeper();
         yield sweeper.sweep({ heartbeatIntervalMs: 30000 });
-        const session = yield prismaClient.session.findUnique({
+        const session = yield scratch.db.session.findUnique({
             where: { id: FRESH_SESSION_ID },
             select: { status: true },
         });

package/lib/test/unit/SessionHeartbeatWrite.test.js

@@ -15,18 +15,19 @@ Object.defineProperty(exports, "__esModule", { value: true });
 require("reflect-metadata");
 const chai_1 = require("chai");
 const sinon_1 = __importDefault(require("sinon"));
-const prisma_1 = require("../../src/prisma");
 const test_container_1 = require("../helpers/test-container");
+const scratch_database_1 = require("../helpers/scratch-database");
 const SessionManager_1 = require("../../src/sessions/SessionManager");
 const SessionHeartbeatService_1 = require("../../src/services/SessionHeartbeatService");
 describe('SessionHeartbeatService write path', () => {
+    // Its own migrated database. It used the server's client directly, so it
+    // wrote this row to the developer's ~/.cache/xenon/xenon.db.
+    const scratch = (0, scratch_database_1.useScratchDatabase)();
     const TEST_SESSION_ID = 'test-heartbeat-sess-001';
-    let prismaClient;
     before(() => __awaiter(void 0, void 0, void 0, function* () {
         (0, test_container_1.setupTestContainer)();
-        prismaClient = (0, prisma_1.getPrismaClient)();
         // Create a minimal session row for the test
-        yield prismaClient.session.upsert({
+        yield scratch.db.session.upsert({
             where: { id: TEST_SESSION_ID },
             create: {
                 id: TEST_SESSION_ID,
@@ -50,8 +51,6 @@ describe('SessionHeartbeatService write path', () => {
         });
     }));
     after(() => __awaiter(void 0, void 0, void 0, function* () {
-        // Cleanup test session
-        yield prismaClient.session.deleteMany({ where: { id: TEST_SESSION_ID } });
         yield (0, test_container_1.resetTestContainer)();
     }));
     afterEach(() => {
@@ -72,7 +71,7 @@ describe('SessionHeartbeatService write path', () => {
         const svc = new SessionHeartbeatService_1.SessionHeartbeatService();
         yield svc.checkAllSessions();
         // Verify the session was updated with heartbeat fields in the DB
-        const updated = yield prismaClient.session.findUnique({
+        const updated = yield scratch.db.session.findUnique({
             where: { id: TEST_SESSION_ID },
             select: { last_heartbeat_at: true, heartbeat_pid: true, heartbeat_host: true },
         });

package/lib/test/unit/StreamTicketService.spec.js

@@ -22,10 +22,13 @@ const crypto_1 = require("crypto");
 const typedi_1 = require("typedi");
 const JwtKeyService_1 = require("../../src/services/token/JwtKeyService");
 const StreamTicketService_1 = require("../../src/services/token/StreamTicketService");
+const container_registration_1 = require("../helpers/container-registration");
 describe('StreamTicketService', () => {
     let dir;
     let svc;
+    let restoreContainer;
     beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        restoreContainer = (0, container_registration_1.saveRegistrations)(JwtKeyService_1.JwtKeyService);
         dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-ticket-'));
         const keys = new JwtKeyService_1.JwtKeyService();
         yield keys.init(dir);
@@ -33,7 +36,7 @@ describe('StreamTicketService', () => {
         svc = new StreamTicketService_1.StreamTicketService();
     }));
     afterEach(() => {
-        typedi_1.Container.reset();
+        restoreContainer();
         fs_1.default.rmSync(dir, { recursive: true, force: true });
     });
     it('mints and redeems a ticket once for the bound udid', () => __awaiter(void 0, void 0, void 0, function* () {

package/lib/test/unit/TokenEndpoint.spec.js

@@ -55,9 +55,12 @@ const path_1 = __importDefault(require("path"));
 const JwtKeyService_1 = require("../../src/services/token/JwtKeyService");
 const auth_1 = require("../../src/app/routers/auth");
 const mcpScopes_1 = require("../../src/services/token/mcpScopes");
+const container_registration_1 = require("../helpers/container-registration");
 describe('POST /auth/token handler (issueToken)', () => {
     let dir;
+    let restoreContainer;
     beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        restoreContainer = (0, container_registration_1.saveRegistrations)(JwtKeyService_1.JwtKeyService);
         dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-tok-'));
         const svc = new JwtKeyService_1.JwtKeyService();
         yield svc.init(dir);
@@ -65,7 +68,7 @@ describe('POST /auth/token handler (issueToken)', () => {
     }));
     afterEach(() => {
         fs_1.default.rmSync(dir, { recursive: true, force: true });
-        typedi_1.Container.reset();
+        restoreContainer();
     });
     const auth = {
         kind: 'api-key',
@@ -103,10 +106,21 @@ describe('POST /auth/token handler (issueToken)', () => {
 });
 describe('issueToken (xenon-mcp granular claims)', () => {
     const auth = { userId: 'u1', role: 'MEMBER', scopes: 'devices,sessions,read', teamId: 't1' };
+    let dir;
+    let restoreContainer;
+    // Its own key service, not the process-wide one: init() would give the
+    // shared singleton this suite's temporary keys for every later spec.
     before(() => __awaiter(void 0, void 0, void 0, function* () {
-        const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'jwtkeys-'));
-        yield typedi_1.Container.get(JwtKeyService_1.JwtKeyService).init(dir);
+        restoreContainer = (0, container_registration_1.saveRegistrations)(JwtKeyService_1.JwtKeyService);
+        dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'jwtkeys-'));
+        const svc = new JwtKeyService_1.JwtKeyService();
+        yield svc.init(dir);
+        typedi_1.Container.set(JwtKeyService_1.JwtKeyService, svc);
     }));
+    after(() => {
+        restoreContainer();
+        fs_1.default.rmSync(dir, { recursive: true, force: true });
+    });
     function decode(token) {
         return __awaiter(this, void 0, void 0, function* () {
             // decodeJwt skips signature verification — fine for claim-shape assertions

package/lib/test/unit/aggregate-hotspots-session-scope.spec.js

@@ -49,7 +49,7 @@ require("reflect-metadata");
 const chai_1 = require("chai");
 const sinon_1 = __importDefault(require("sinon"));
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const prisma_1 = require("../../src/prisma");
 const dashboard_1 = __importStar(require("../../src/app/routers/dashboard"));
 /**
@@ -144,7 +144,7 @@ describe('Selector Health reads — scoped to the caller’s sessions', () => {
     ];
     for (const url of ROUTES) {
         it(`${url}: a member counts only the sessions they may see`, () => __awaiter(void 0, void 0, void 0, function* () {
-            const r = yield (0, supertest_1.default)(app(member)).get(url);
+            const r = yield (0, loopbackRequest_1.default)(app(member)).get(url);
             (0, chai_1.expect)(r.status).to.equal(200);
             const session = findMany.firstCall.args[0].where.session;
             if (url.includes('build=')) {
@@ -155,7 +155,7 @@ describe('Selector Health reads — scoped to the caller’s sessions', () => {
             }
         }));
         it(`${url}: an admin counts every session`, () => __awaiter(void 0, void 0, void 0, function* () {
-            const r = yield (0, supertest_1.default)(app(admin)).get(url);
+            const r = yield (0, loopbackRequest_1.default)(app(admin)).get(url);
             (0, chai_1.expect)(r.status).to.equal(200);
             const session = findMany.firstCall.args[0].where.session;
             if (url.includes('build=')) {
@@ -183,7 +183,7 @@ describe('Selector Health reads — scoped to the caller’s sessions', () => {
             findFirst = sinon_1.default.stub(prisma_1.prisma.sessionLog, 'findFirst').resolves(null);
         });
         it('a member: the last heal among the sessions they may see', () => __awaiter(void 0, void 0, void 0, function* () {
-            const r = yield (0, supertest_1.default)(app(member)).get('/healing/state/muted');
+            const r = yield (0, loopbackRequest_1.default)(app(member)).get('/healing/state/muted');
             (0, chai_1.expect)(r.status).to.equal(200);
             (0, chai_1.expect)(r.body.muted).to.have.length(1);
             (0, chai_1.expect)(findFirst.firstCall.args[0].where).to.deep.equal({
@@ -194,7 +194,7 @@ describe('Selector Health reads — scoped to the caller’s sessions', () => {
             });
         }));
         it('an admin: the last heal on any session', () => __awaiter(void 0, void 0, void 0, function* () {
-            const r = yield (0, supertest_1.default)(app(admin)).get('/healing/state/muted');
+            const r = yield (0, loopbackRequest_1.default)(app(admin)).get('/healing/state/muted');
             (0, chai_1.expect)(r.status).to.equal(200);
             (0, chai_1.expect)(findFirst.firstCall.args[0].where).to.not.have.property('session');
         }));

package/lib/test/unit/android-h264-service.spec.js

@@ -14,9 +14,11 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 require("reflect-metadata");
 const chai_1 = require("chai");
+const sinon_1 = __importDefault(require("sinon"));
 const typedi_1 = require("typedi");
 const AndroidH264StreamService_1 = __importDefault(require("../../src/device-managers/android/AndroidH264StreamService"));
 const PluginContext_1 = require("../../src/PluginContext");
+const container_registration_1 = require("../helpers/container-registration");
 // Lifecycle/state only — the capture seam (openCapture) is stubbed so the test
 // drives packet flow without a real device or screenrecord process.
 function make() {
@@ -31,9 +33,14 @@ describe('AndroidH264StreamService', () => {
     // known default before each test (streaming undefined → source 'scrcpy'); the
     // WS-source tests override it in-test. Set (not remove) so TypeDI never hits a
     // ServiceNotFoundError on the next Container.get.
+    // The context is put back after each test: left behind, the plain object
+    // was every later spec's PluginContext, with no setContext().
+    let restoreContainer;
     beforeEach(() => {
+        restoreContainer = (0, container_registration_1.saveRegistrations)(PluginContext_1.PluginContext);
         typedi_1.Container.set(PluginContext_1.PluginContext, { pluginArgs: {} });
     });
+    afterEach(() => restoreContainer());
     it('start() creates a multiplexer, seeds it with the config packet, and resolves', () => __awaiter(void 0, void 0, void 0, function* () {
         const svc = make();
         svc.openCapture = (_udid, onPacket) => __awaiter(void 0, void 0, void 0, function* () {
@@ -44,6 +51,23 @@ describe('AndroidH264StreamService', () => {
         (0, chai_1.expect)(mux).to.equal(svc.getMultiplexer('udid-x'));
         (0, chai_1.expect)(mux.clientCount).to.equal(0);
     }));
+    it('start() leaves no timer behind once the config packet arrives', () => __awaiter(void 0, void 0, void 0, function* () {
+        const clock = sinon_1.default.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] });
+        try {
+            const svc = make();
+            svc.openCapture = (_udid, onPacket) => __awaiter(void 0, void 0, void 0, function* () {
+                onPacket({ type: 'config', data: Buffer.from([0]), ptsMs: 0 });
+                return { kill: () => undefined };
+            });
+            yield svc.start('udid-t');
+            // The 3 s wait is only a cap: a start that got its config in time must
+            // not leave it pending for the process to wait out.
+            (0, chai_1.expect)(clock.countTimers()).to.equal(0);
+        }
+        finally {
+            clock.restore();
+        }
+    }));
     it('start() is idempotent per udid (concurrent starts share one capture)', () => __awaiter(void 0, void 0, void 0, function* () {
         const svc = make();
         let opens = 0;

package/lib/test/unit/android-stream-stall-eof.spec.js

@@ -31,8 +31,15 @@ function makeService() {
 }
 describe('Android MJPEG server: a stalled capture ends client responses', () => {
     let server;
+    // Stopped after each test. close() leaves an open response streaming, and a
+    // test whose client never ends left its writeFrame loop writing a frame
+    // every 60ms for the rest of the run.
+    const sessions = [];
     afterEach(() => {
+        for (const session of sessions.splice(0))
+            session.status = 'stopped';
         try {
+            server === null || server === void 0 ? void 0 : server.closeAllConnections();
             server === null || server === void 0 ? void 0 : server.close();
         }
         catch (_a) {
@@ -64,6 +71,7 @@ describe('Android MJPEG server: a stalled capture ends client responses', () =>
             viewerCount: 0,
             captureHealth: new androidStreamReuse_1.CaptureHealth(),
         };
+        sessions.push(session);
         const now = Date.now();
         session.captureHealth.recordFailure(now - androidStreamReuse_1.CAPTURE_STALL_MS * 2, now);
         server = yield svc.createAndListenMjpegServer(session, 0);
@@ -93,6 +101,7 @@ describe('Android MJPEG server: a stalled capture ends client responses', () =>
             viewerCount: 0,
             captureHealth: new androidStreamReuse_1.CaptureHealth(),
         };
+        sessions.push(session);
         // Port 0 → the OS picks a free one, so this never collides with a real lease.
         server = yield svc.createAndListenMjpegServer(session, 0);
         const port = server.address().port;
@@ -133,6 +142,7 @@ describe('Android MJPEG server: a stalled capture ends client responses', () =>
             viewerCount: 0,
             captureHealth: new androidStreamReuse_1.CaptureHealth(),
         };
+        sessions.push(session);
         server = yield svc.createAndListenMjpegServer(session, 0);
         const port = server.address().port;
         let ended = false;

package/lib/test/unit/apps-team-visibility.spec.js

@@ -16,7 +16,7 @@ require("reflect-metadata");
 const chai_1 = require("chai");
 const sinon_1 = __importDefault(require("sinon"));
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
@@ -101,20 +101,20 @@ describe('apps follow the device team rule', () => {
             findMany = sinon_1.default.stub(prisma_1.prisma.app, 'findMany').resolves([rows['app-shared']]);
         });
         it("asks the database for a member's shared and own-team apps only", () => __awaiter(void 0, void 0, void 0, function* () {
-            const r = yield (0, supertest_1.default)(server('member-a')).get('/apps');
+            const r = yield (0, loopbackRequest_1.default)(server('member-a')).get('/apps');
             (0, chai_1.expect)(r.status).to.equal(200);
             const args = findMany.firstCall.args[0];
             (0, chai_1.expect)(args.where).to.deep.equal({ OR: [{ teamId: null }, { teamId: { in: ['team-a'] } }] });
             (0, chai_1.expect)(args.include).to.deep.equal({ team: { select: { id: true, name: true } } });
         }));
         it('a member in no team gets the shared apps only', () => __awaiter(void 0, void 0, void 0, function* () {
-            yield (0, supertest_1.default)(server('member-none')).get('/apps');
+            yield (0, loopbackRequest_1.default)(server('member-none')).get('/apps');
             (0, chai_1.expect)(findMany.firstCall.args[0].where).to.deep.equal({
                 OR: [{ teamId: null }, { teamId: { in: [] } }],
             });
         }));
         it('an admin is not filtered, and still gets team names', () => __awaiter(void 0, void 0, void 0, function* () {
-            yield (0, supertest_1.default)(server('admin')).get('/apps');
+            yield (0, loopbackRequest_1.default)(server('admin')).get('/apps');
             const args = findMany.firstCall.args[0];
             (0, chai_1.expect)(args.where).to.equal(undefined);
             (0, chai_1.expect)(args.include).to.deep.equal({ team: { select: { id: true, name: true } } });
@@ -123,26 +123,26 @@ describe('apps follow the device team rule', () => {
     describe('GET /apps/:id/download', () => {
         it("serves a member their team's app and a shared one", () => __awaiter(void 0, void 0, void 0, function* () {
             for (const id of ['app-a', 'app-shared']) {
-                const r = yield (0, supertest_1.default)(server('member-a')).get(`/apps/${id}/download`);
+                const r = yield (0, loopbackRequest_1.default)(server('member-a')).get(`/apps/${id}/download`);
                 (0, chai_1.expect)(r.status, id).to.equal(200);
             }
         }));
         it("answers another team's app exactly as an unknown id", () => __awaiter(void 0, void 0, void 0, function* () {
-            const hidden = yield (0, supertest_1.default)(server('member-a')).get('/apps/app-b/download');
-            const unknown = yield (0, supertest_1.default)(server('member-a')).get('/apps/no-such-app/download');
+            const hidden = yield (0, loopbackRequest_1.default)(server('member-a')).get('/apps/app-b/download');
+            const unknown = yield (0, loopbackRequest_1.default)(server('member-a')).get('/apps/no-such-app/download');
             (0, chai_1.expect)(hidden.status).to.equal(404);
             (0, chai_1.expect)(hidden.body).to.deep.equal(UNKNOWN);
             (0, chai_1.expect)(unknown.status).to.equal(hidden.status);
             (0, chai_1.expect)(unknown.body).to.deep.equal(hidden.body);
         }));
         it('serves an admin any team’s app', () => __awaiter(void 0, void 0, void 0, function* () {
-            const r = yield (0, supertest_1.default)(server('admin')).get('/apps/app-b/download');
+            const r = yield (0, loopbackRequest_1.default)(server('admin')).get('/apps/app-b/download');
             (0, chai_1.expect)(r.status).to.equal(200);
         }));
         it("a download ticket's request sees its own app only, though it carries no teams", () => __awaiter(void 0, void 0, void 0, function* () {
-            (0, chai_1.expect)((yield (0, supertest_1.default)(server('ticket-for-app-a')).get('/apps/app-a/download')).status).to.equal(200);
+            (0, chai_1.expect)((yield (0, loopbackRequest_1.default)(server('ticket-for-app-a')).get('/apps/app-a/download')).status).to.equal(200);
             for (const id of ['app-b', 'app-shared']) {
-                const r = yield (0, supertest_1.default)(server('ticket-for-app-a')).get(`/apps/${id}/download`);
+                const r = yield (0, loopbackRequest_1.default)(server('ticket-for-app-a')).get(`/apps/${id}/download`);
                 (0, chai_1.expect)(r.status, id).to.equal(404);
                 (0, chai_1.expect)(r.body, id).to.deep.equal(UNKNOWN);
             }
@@ -154,20 +154,20 @@ describe('apps follow the device team rule', () => {
             deleteApp = sinon_1.default.stub(app_service_1.APP_SERVICE, 'deleteApp').resolves(undefined);
         });
         it('is refused to a member', () => __awaiter(void 0, void 0, void 0, function* () {
-            const r = yield (0, supertest_1.default)(server('member-a'))
+            const r = yield (0, loopbackRequest_1.default)(server('member-a'))
                 .delete('/apps/app-a')
                 .set('Origin', 'http://127.0.0.1');
             (0, chai_1.expect)(r.status).to.equal(403);
             (0, chai_1.expect)(deleteApp.called).to.equal(false);
         }));
         it('lets an admin delete any team’s app', () => __awaiter(void 0, void 0, void 0, function* () {
-            const r = yield (0, supertest_1.default)(server('admin')).delete('/apps/app-b');
+            const r = yield (0, loopbackRequest_1.default)(server('admin')).delete('/apps/app-b');
             (0, chai_1.expect)(r.status).to.equal(204);
             (0, chai_1.expect)(deleteApp.calledOnceWith('app-b')).to.equal(true);
         }));
         it('answers an unknown id 404, and a hidden app the same way, deleting nothing', () => __awaiter(void 0, void 0, void 0, function* () {
-            const unknown = yield (0, supertest_1.default)(server('admin')).delete('/apps/no-such-app');
-            const hidden = yield (0, supertest_1.default)(server('team-scoped-admin')).delete('/apps/app-b');
+            const unknown = yield (0, loopbackRequest_1.default)(server('admin')).delete('/apps/no-such-app');
+            const hidden = yield (0, loopbackRequest_1.default)(server('team-scoped-admin')).delete('/apps/app-b');
             (0, chai_1.expect)(unknown.status).to.equal(404);
             (0, chai_1.expect)(unknown.body).to.deep.equal(UNKNOWN);
             (0, chai_1.expect)(hidden.status).to.equal(unknown.status);
@@ -187,7 +187,7 @@ describe('apps follow the device team rule', () => {
                 .callsFake(((args) => __awaiter(void 0, void 0, void 0, function* () { return args.where.id === 'team-a' ? { id: 'team-a' } : null; })));
         });
         const post = (caller, teamId) => {
-            const r = (0, supertest_1.default)(server(caller))
+            const r = (0, loopbackRequest_1.default)(server(caller))
                 .post('/apps/upload')
                 .attach('app', Buffer.from('ipa bytes'), 'app.ipa');
             return teamId === undefined ? r : r.field('teamId', teamId);
@@ -229,7 +229,7 @@ describe('apps follow the device team rule', () => {
                 .stub(prisma_1.prisma.team, 'findUnique')
                 .callsFake(((args) => __awaiter(void 0, void 0, void 0, function* () { return ['team-a', 'team-b'].includes(args.where.id) ? { id: args.where.id } : null; })));
         });
-        const put = (caller, id, body) => (0, supertest_1.default)(server(caller))
+        const put = (caller, id, body) => (0, loopbackRequest_1.default)(server(caller))
             .put(`/apps/${id}/team`)
             .send(body);
         it('moves an app to a team, as PUT /device/:udid/team does a phone', () => __awaiter(void 0, void 0, void 0, function* () {

package/lib/test/unit/auth-me-auth-disabled.test.js

@@ -16,7 +16,7 @@ require("reflect-metadata");
 const chai_1 = require("chai");
 const sinon_1 = __importDefault(require("sinon"));
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const typedi_1 = require("typedi");
 const auth_1 = require("../../src/app/routers/auth");
 const UserService_1 = require("../../src/services/UserService");
@@ -58,7 +58,7 @@ describe('GET /auth/me with authDisabled', () => {
         config_1.config.authDisabled = true;
         // No User row exists for the synthetic id — this is the real-world state.
         const findById = sinon_1.default.stub(typedi_1.Container.get(UserService_1.UserService), 'findById').resolves(null);
-        const res = yield (0, supertest_1.default)(appWithSyntheticAuth()).get('/auth/me');
+        const res = yield (0, loopbackRequest_1.default)(appWithSyntheticAuth()).get('/auth/me');
         (0, chai_1.expect)(res.status).to.equal(200);
         (0, chai_1.expect)(res.body.userId).to.equal('auth-disabled');
         (0, chai_1.expect)(res.body.role).to.equal('SUPER_ADMIN');
@@ -74,14 +74,17 @@ describe('GET /auth/me with authDisabled', () => {
         sinon_1.default.stub(typedi_1.Container.get(UserService_1.UserService), 'findById').resolves({
             id: 'auth-disabled', email: 'u@x.local', name: 'U', role: 'SUPER_ADMIN', accessKey: 'ak',
         });
-        const res = yield (0, supertest_1.default)(appWithSyntheticAuth()).get('/auth/me');
+        const res = yield (0, loopbackRequest_1.default)(appWithSyntheticAuth()).get('/auth/me');
         (0, chai_1.expect)(res.status).to.equal(200);
         (0, chai_1.expect)(res.body.authDisabled).to.equal(false);
+        // The caller's own key, unredacted: the logger's accessKey redaction
+        // never touches a response.
+        (0, chai_1.expect)(res.body.accessKey).to.equal('ak');
     }));
     it('still 401s when auth is enabled and the user does not exist', () => __awaiter(void 0, void 0, void 0, function* () {
         config_1.config.authDisabled = false;
         sinon_1.default.stub(typedi_1.Container.get(UserService_1.UserService), 'findById').resolves(null);
-        const res = yield (0, supertest_1.default)(appWithSyntheticAuth()).get('/auth/me');
+        const res = yield (0, loopbackRequest_1.default)(appWithSyntheticAuth()).get('/auth/me');
         (0, chai_1.expect)(res.status).to.equal(401);
         (0, chai_1.expect)(res.body.error).to.equal('unauthenticated');
     }));

package/lib/test/unit/authMiddleware.appTicket.spec.js

@@ -16,7 +16,7 @@ require("reflect-metadata");
 const chai_1 = require("chai");
 const sinon_1 = __importDefault(require("sinon"));
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const typedi_1 = require("typedi");
 const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
@@ -110,7 +110,7 @@ describe('authMiddleware — app download ticket', () => {
         res.on('end', () => done(null, Buffer.concat(chunks)));
     };
     const download = (id, ticket) => {
-        const r = (0, supertest_1.default)(app).get(`/xenon/api/apps/${id}/download`);
+        const r = (0, loopbackRequest_1.default)(app).get(`/xenon/api/apps/${id}/download`);
         return ticket === undefined ? r : r.query({ ticket });
     };
     const INVALID = { error: 'invalid ticket' };
@@ -158,16 +158,16 @@ describe('authMiddleware — app download ticket', () => {
     }));
     it('an app ticket is refused on the stream route', () => __awaiter(void 0, void 0, void 0, function* () {
         const t = yield tickets.mint('UDID-1');
-        const r = yield (0, supertest_1.default)(app).get('/xenon/api/control/UDID-1/stream').query({ ticket: t });
+        const r = yield (0, loopbackRequest_1.default)(app).get('/xenon/api/control/UDID-1/stream').query({ ticket: t });
         (0, chai_1.expect)(r.status).to.equal(401);
         (0, chai_1.expect)(r.body).to.deep.equal(INVALID);
     }));
     it('opens nothing but the download: not the list, nor another method', () => __awaiter(void 0, void 0, void 0, function* () {
         const t = yield tickets.mint('app-A');
-        const list = yield (0, supertest_1.default)(app).get('/xenon/api/apps').query({ ticket: t });
+        const list = yield (0, loopbackRequest_1.default)(app).get('/xenon/api/apps').query({ ticket: t });
         (0, chai_1.expect)(list.status).to.equal(401);
         (0, chai_1.expect)(list.body).to.deep.equal({ error: 'unauthenticated' });
-        const del = yield (0, supertest_1.default)(app).delete('/xenon/api/apps/app-A/download').query({ ticket: t });
+        const del = yield (0, loopbackRequest_1.default)(app).delete('/xenon/api/apps/app-A/download').query({ ticket: t });
         (0, chai_1.expect)(del.status).to.equal(401);
         (0, chai_1.expect)(del.body).to.deep.equal({ error: 'unauthenticated' });
         // Neither attempt spent it.

package/lib/test/unit/authMiddleware.bearer.spec.js

@@ -25,6 +25,7 @@ const UserService_1 = require("../../src/services/UserService");
 const ApiKeyService_1 = require("../../src/services/ApiKeyService");
 const UserSessionService_1 = require("../../src/services/UserSessionService");
 const prisma_1 = require("../../src/prisma");
+const container_registration_1 = require("../helpers/container-registration");
 function fakeRes() {
     const res = { statusCode: 200 };
     res.status = (c) => { res.statusCode = c; return res; };
@@ -36,7 +37,9 @@ describe('authMiddleware — Bearer branch', () => {
     let dir;
     let keySvc;
     const user = { id: 'u1', role: 'MEMBER', status: 'ACTIVE' };
+    let restoreContainer;
     beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        restoreContainer = (0, container_registration_1.saveRegistrations)(JwtKeyService_1.JwtKeyService, UserService_1.UserService, ApiKeyService_1.ApiKeyService, UserSessionService_1.UserSessionService);
         dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-bearer-'));
         keySvc = new JwtKeyService_1.JwtKeyService();
         yield keySvc.init(dir);
@@ -48,7 +51,7 @@ describe('authMiddleware — Bearer branch', () => {
     }));
     afterEach(() => {
         sinon_1.default.restore();
-        typedi_1.Container.reset();
+        restoreContainer();
         fs_1.default.rmSync(dir, { recursive: true, force: true });
     });
     it('accepts a valid xenon-rest Bearer token and sets req.auth', () => __awaiter(void 0, void 0, void 0, function* () {

package/lib/test/unit/authMiddleware.mcpAudience.spec.js

@@ -25,6 +25,7 @@ const UserService_1 = require("../../src/services/UserService");
 const ApiKeyService_1 = require("../../src/services/ApiKeyService");
 const UserSessionService_1 = require("../../src/services/UserSessionService");
 const prisma_1 = require("../../src/prisma");
+const container_registration_1 = require("../helpers/container-registration");
 function fakeRes() {
     const res = { statusCode: 200 };
     res.status = (c) => { res.statusCode = c; return res; };
@@ -39,7 +40,9 @@ describe('authMiddleware — Bearer branch accepts xenon-mcp audience', () => {
     let dir;
     let keySvc;
     const user = { id: 'u1', role: 'MEMBER', status: 'ACTIVE' };
+    let restoreContainer;
     beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        restoreContainer = (0, container_registration_1.saveRegistrations)(JwtKeyService_1.JwtKeyService, UserService_1.UserService, ApiKeyService_1.ApiKeyService, UserSessionService_1.UserSessionService);
         dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-mcp-aud-'));
         keySvc = new JwtKeyService_1.JwtKeyService();
         yield keySvc.init(dir);
@@ -51,7 +54,7 @@ describe('authMiddleware — Bearer branch accepts xenon-mcp audience', () => {
     }));
     afterEach(() => {
         sinon_1.default.restore();
-        typedi_1.Container.reset();
+        restoreContainer();
         fs_1.default.rmSync(dir, { recursive: true, force: true });
     });
     it('accepts a valid xenon-mcp Bearer token (ACTIVE user) and sets req.auth.kind=bearer', () => __awaiter(void 0, void 0, void 0, function* () {