@xenon-device-management/xenon 2.0.0 → 2.2.0

package/lib/test/unit/authMiddleware.streamTicket.spec.js

@@ -16,7 +16,7 @@ require("reflect-metadata");
 const chai_1 = require("chai");
 const sinon_1 = __importDefault(require("sinon"));
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const typedi_1 = require("typedi");
 const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
@@ -29,6 +29,8 @@ const device_store_1 = require("../../src/data-service/device-store");
 const UserService_1 = require("../../src/services/UserService");
 const ApiKeyService_1 = require("../../src/services/ApiKeyService");
 const UserSessionService_1 = require("../../src/services/UserSessionService");
+const container_registration_1 = require("../helpers/container-registration");
+const loopbackServer_1 = require("../helpers/loopbackServer");
 function fakeRes() {
     const res = { statusCode: 200 };
     res.status = (c) => {
@@ -46,7 +48,9 @@ describe('authMiddleware — stream-ticket branch', () => {
     let dir;
     let keySvc;
     let ticketSvc;
+    let restoreContainer;
     beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        restoreContainer = (0, container_registration_1.saveRegistrations)(JwtKeyService_1.JwtKeyService, StreamTicketService_1.StreamTicketService, UserService_1.UserService, ApiKeyService_1.ApiKeyService, UserSessionService_1.UserSessionService);
         dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-authmw-ticket-'));
         keySvc = new JwtKeyService_1.JwtKeyService();
         yield keySvc.init(dir);
@@ -62,7 +66,7 @@ describe('authMiddleware — stream-ticket branch', () => {
     }));
     afterEach(() => {
         sinon_1.default.restore();
-        typedi_1.Container.reset();
+        restoreContainer();
         fs_1.default.rmSync(dir, { recursive: true, force: true });
     });
     // req.path here mirrors what authMiddleware actually sees at runtime:
@@ -194,7 +198,12 @@ describe('authMiddleware — stream-ticket branch (real mount-order, supertest)'
     let dir;
     let app;
     let ticketSvc;
+    let restoreContainer;
+    // Served on 127.0.0.1: request(app) listens on every address and connects
+    // to 127.0.0.1, where another process's listener on that port can answer.
+    const loopback = (0, loopbackServer_1.loopbackServers)();
     beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        restoreContainer = (0, container_registration_1.saveRegistrations)(JwtKeyService_1.JwtKeyService, StreamTicketService_1.StreamTicketService, UserService_1.UserService, ApiKeyService_1.ApiKeyService, UserSessionService_1.UserSessionService);
         dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-authmw-mount-'));
         const keySvc = new JwtKeyService_1.JwtKeyService();
         yield keySvc.init(dir);
@@ -222,21 +231,24 @@ describe('authMiddleware — stream-ticket branch (real mount-order, supertest)'
         app = (0, express_1.default)();
         app.use('/xenon/api', apiRouter);
     }));
-    afterEach(() => {
+    afterEach(() => __awaiter(void 0, void 0, void 0, function* () {
         sinon_1.default.restore();
-        typedi_1.Container.reset();
+        restoreContainer();
+        yield loopback.closeAll();
         fs_1.default.rmSync(dir, { recursive: true, force: true });
-    });
+    }));
     it('a valid ticket on GET /xenon/api/control/:udid/stream reaches the route (past 401)', () => __awaiter(void 0, void 0, void 0, function* () {
         const ticket = yield ticketSvc.mint('UDID-1', 'actor-1');
-        const res = yield (0, supertest_1.default)(app).get('/xenon/api/control/UDID-1/stream').query({ ticket });
+        const res = yield (0, loopbackRequest_1.default)(yield loopback.serve(app))
+            .get('/xenon/api/control/UDID-1/stream')
+            .query({ ticket });
         // The ticket branch fired: request cleared auth and hit the handler's
         // device lookup (404), rather than being rejected at the middleware (401).
         (0, chai_1.expect)(res.status).to.not.equal(401);
         (0, chai_1.expect)(res.status).to.equal(404); // 'Device not found' from the stubbed store
     }));
     it('the SAME request without a ticket is rejected 401 (proves the guard is non-vacuous)', () => __awaiter(void 0, void 0, void 0, function* () {
-        const res = yield (0, supertest_1.default)(app).get('/xenon/api/control/UDID-1/stream');
+        const res = yield (0, loopbackRequest_1.default)(yield loopback.serve(app)).get('/xenon/api/control/UDID-1/stream');
         (0, chai_1.expect)(res.status).to.equal(401);
         (0, chai_1.expect)(res.body).to.deep.equal({ error: 'unauthenticated' });
     }));

package/lib/test/unit/authMiddleware.test.js

@@ -92,6 +92,9 @@ describe('authMiddleware', () => {
             role: 'MEMBER',
             status: 'ACTIVE',
         });
+        // A member's teams are looked up; without this the lookup read the
+        // developer's own database.
+        sinon_1.default.stub(prisma_1.prisma.teamMember, 'findMany').resolves([]);
         const req = { headers: { cookie: 'xenon_dashboard_session=legacy-key-id' } };
         let called = false;
         yield (0, authMiddleware_1.authMiddleware)(req, mkRes(), () => {

package/lib/test/unit/bug-report/route.spec.js

@@ -15,7 +15,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 require("reflect-metadata");
 const chai_1 = require("chai");
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../../helpers/loopbackRequest"));
 const sinon_1 = __importDefault(require("sinon"));
 const BugReportService_1 = require("../../../src/services/bug-report/BugReportService");
 const bug_report_1 = __importDefault(require("../../../src/app/routers/bug-report"));
@@ -63,8 +63,8 @@ describe('bug-report route', () => {
                 throw new Error(`Session ${opts.sessionId} not found`);
             throw new Error('built a report');
         }));
-        const hidden = yield (0, supertest_1.default)(makeApp()).post('/sessions/sess-b/bug-report?mode=full');
-        const unknown = yield (0, supertest_1.default)(makeApp()).post('/sessions/sess-nope/bug-report?mode=full');
+        const hidden = yield (0, loopbackRequest_1.default)(makeApp()).post('/sessions/sess-b/bug-report?mode=full');
+        const unknown = yield (0, loopbackRequest_1.default)(makeApp()).post('/sessions/sess-nope/bug-report?mode=full');
         (0, chai_1.expect)(hidden.status).to.equal(404);
         (0, chai_1.expect)(unknown.status).to.equal(404);
         (0, chai_1.expect)(hidden.body).to.deep.equal({ error: 'Session sess-b not found' });
@@ -78,26 +78,26 @@ describe('bug-report route', () => {
             entries: [{ name: 'a.txt', source: { kind: 'buffer', data: Buffer.from('hi') } }],
             cleanup: () => __awaiter(void 0, void 0, void 0, function* () { }),
         });
-        const res = yield (0, supertest_1.default)(makeApp({ admin: true })).post('/sessions/sess-b/bug-report?mode=full');
+        const res = yield (0, loopbackRequest_1.default)(makeApp({ admin: true })).post('/sessions/sess-b/bug-report?mode=full');
         (0, chai_1.expect)(res.status).to.equal(200);
     }));
     it('401 when the caller is not signed in', () => __awaiter(void 0, void 0, void 0, function* () {
-        const res = yield (0, supertest_1.default)(makeApp({ signedIn: false })).post('/sessions/sess-1/bug-report?mode=full');
+        const res = yield (0, loopbackRequest_1.default)(makeApp({ signedIn: false })).post('/sessions/sess-1/bug-report?mode=full');
         (0, chai_1.expect)(res.status).to.equal(401);
     }));
     it('400 on invalid mode', () => __awaiter(void 0, void 0, void 0, function* () {
-        const res = yield (0, supertest_1.default)(makeApp()).post('/sessions/sess-1/bug-report?mode=bogus');
+        const res = yield (0, loopbackRequest_1.default)(makeApp()).post('/sessions/sess-1/bug-report?mode=bogus');
         (0, chai_1.expect)(res.status).to.equal(400);
     }));
     it('400 on out-of-range windowSec', () => __awaiter(void 0, void 0, void 0, function* () {
-        const res = yield (0, supertest_1.default)(makeApp()).post('/sessions/sess-1/bug-report?mode=slice&windowSec=9999');
+        const res = yield (0, loopbackRequest_1.default)(makeApp()).post('/sessions/sess-1/bug-report?mode=slice&windowSec=9999');
         (0, chai_1.expect)(res.status).to.equal(400);
     }));
     it('404 when service throws not-found', () => __awaiter(void 0, void 0, void 0, function* () {
         sinon_1.default
             .stub(BugReportService_1.BugReportService.prototype, 'assemble')
             .rejects(new Error('Session sess-1 not found'));
-        const res = yield (0, supertest_1.default)(makeApp()).post('/sessions/sess-1/bug-report?mode=full');
+        const res = yield (0, loopbackRequest_1.default)(makeApp()).post('/sessions/sess-1/bug-report?mode=full');
         (0, chai_1.expect)(res.status).to.equal(404);
     }));
     it('200 streams zip on success', () => __awaiter(void 0, void 0, void 0, function* () {
@@ -107,7 +107,7 @@ describe('bug-report route', () => {
             entries: [{ name: 'a.txt', source: { kind: 'buffer', data: Buffer.from('hi') } }],
             cleanup: () => __awaiter(void 0, void 0, void 0, function* () { }),
         });
-        const res = yield (0, supertest_1.default)(makeApp())
+        const res = yield (0, loopbackRequest_1.default)(makeApp())
             .post('/sessions/sess-1/bug-report?mode=full')
             .buffer(true)
             .parse((r, cb) => {

package/lib/test/unit/cliargs-admin-only.spec.js

@@ -49,7 +49,7 @@ require("reflect-metadata");
 const chai_1 = require("chai");
 const sinon_1 = __importDefault(require("sinon"));
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const typedi_1 = require("typedi");
 const prisma_1 = require("../../src/prisma");
 const config_1 = require("../../src/config");
@@ -125,7 +125,7 @@ describe('GET /xenon/api/cliArgs', () => {
         sinon_1.default.restore();
         config_1.config.authDisabled = savedAuthDisabled;
     });
-    const asCookie = (sessionId) => (0, supertest_1.default)(app).get('/xenon/api/cliArgs').set('Cookie', `xenon_dashboard_session=${sessionId}`);
+    const asCookie = (sessionId) => (0, loopbackRequest_1.default)(app).get('/xenon/api/cliArgs').set('Cookie', `xenon_dashboard_session=${sessionId}`);
     function asApiKey(scopes, ownerId) {
         sinon_1.default.stub(typedi_1.Container.get(ApiKeyService_1.ApiKeyService), 'verifyPair').resolves({
             id: 'key-1',
@@ -138,7 +138,7 @@ describe('GET /xenon/api/cliArgs', () => {
             userId: ownerId,
             teamId: null,
         });
-        return (0, supertest_1.default)(app)
+        return (0, loopbackRequest_1.default)(app)
             .get('/xenon/api/cliArgs')
             .set('x-xenon-access-key', 'ak')
             .set('x-xenon-token', 'tok');

package/lib/test/unit/clipboard-route.spec.js

@@ -16,7 +16,7 @@ require("reflect-metadata");
 const chai_1 = require("chai");
 const sinon_1 = __importDefault(require("sinon"));
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const typedi_1 = require("typedi");
 const control_1 = __importDefault(require("../../src/app/routers/control"));
 const device_store_1 = require("../../src/data-service/device-store");
@@ -24,6 +24,9 @@ const ApiKeyService_1 = require("../../src/services/ApiKeyService");
 const device_managers_1 = require("../../src/device-managers");
 const clipboardErrors_1 = require("../../src/device-managers/clipboardErrors");
 const authMiddleware_1 = require("../../src/middleware/authMiddleware");
+const container_registration_1 = require("../helpers/container-registration");
+const loopbackServer_1 = require("../helpers/loopbackServer");
+const own_node_id_1 = require("../helpers/own-node-id");
 /**
  * GET/POST /control/:udid/clipboard answered 200 whatever happened on the
  * device: the Android manager swallowed its errors, and its "set" had no
@@ -56,14 +59,24 @@ function buildApp() {
     return app;
 }
 describe('GET/POST /control/:udid/clipboard', () => {
+    // The fake rows are this server's own phones.
+    (0, own_node_id_1.useOwnNodeId)();
     let manager;
+    let restoreContainer;
+    // Served on 127.0.0.1, not by request(app): that listens on every address
+    // and connects to 127.0.0.1, where another process's listener on the same
+    // port answers instead (a stray 501 or a socket hang-up in a full run).
+    const loopback = (0, loopbackServer_1.loopbackServers)();
+    const app = () => __awaiter(void 0, void 0, void 0, function* () { return loopback.serve(buildApp()); });
     beforeEach(() => {
+        restoreContainer = (0, container_registration_1.saveRegistrations)(ApiKeyService_1.ApiKeyService, device_managers_1.XenonManager);
         manager = new AndroidDeviceManager();
         sinon_1.default.stub(device_store_1.DeviceStoreFactory, 'getStore').returns({
             findDevice: () => __awaiter(void 0, void 0, void 0, function* () {
                 return ({
                     udid: UDID,
                     host: '127.0.0.1',
+                    nodeId: own_node_id_1.OWN_NODE_ID,
                     platform: 'android',
                     busy: false,
                     session_id: null,
@@ -73,19 +86,20 @@ describe('GET/POST /control/:udid/clipboard', () => {
         typedi_1.Container.set(ApiKeyService_1.ApiKeyService, new ApiKeyService_1.ApiKeyService());
         typedi_1.Container.set(device_managers_1.XenonManager, { deviceInstances: () => __awaiter(void 0, void 0, void 0, function* () { return [manager]; }) });
     });
-    afterEach(() => {
+    afterEach(() => __awaiter(void 0, void 0, void 0, function* () {
         sinon_1.default.restore();
-        typedi_1.Container.reset();
-    });
+        restoreContainer();
+        yield loopback.closeAll();
+    }));
     it('returns the clipboard text', () => __awaiter(void 0, void 0, void 0, function* () {
         manager.getClipboard.resolves('xenonread');
-        const res = yield (0, supertest_1.default)(buildApp()).get(`/xenon/api/control/${UDID}/clipboard`);
+        const res = yield (0, loopbackRequest_1.default)(yield app()).get(`/xenon/api/control/${UDID}/clipboard`);
         (0, chai_1.expect)(res.status).to.equal(200);
         (0, chai_1.expect)(res.body).to.deep.equal({ content: 'xenonread' });
     }));
     it('says why a read failed, with a 500', () => __awaiter(void 0, void 0, void 0, function* () {
         manager.getClipboard.rejects(new Error('Appium Settings didn’t return the clipboard.'));
-        const res = yield (0, supertest_1.default)(buildApp()).get(`/xenon/api/control/${UDID}/clipboard`);
+        const res = yield (0, loopbackRequest_1.default)(yield app()).get(`/xenon/api/control/${UDID}/clipboard`);
         (0, chai_1.expect)(res.status).to.equal(500);
         (0, chai_1.expect)(res.body.error).to.match(/Appium Settings/);
     }));
@@ -93,7 +107,7 @@ describe('GET/POST /control/:udid/clipboard', () => {
     // won't help. 501 says exactly that.
     it('answers 501 when the device cannot set its clipboard', () => __awaiter(void 0, void 0, void 0, function* () {
         manager.setClipboard.rejects(new clipboardErrors_1.ClipboardUnsupportedError('Appium Settings can only read it.'));
-        const res = yield (0, supertest_1.default)(buildApp())
+        const res = yield (0, loopbackRequest_1.default)(yield app())
             .post(`/xenon/api/control/${UDID}/clipboard`)
             .send({ content: 'x' });
         (0, chai_1.expect)(res.status).to.equal(501);
@@ -101,7 +115,7 @@ describe('GET/POST /control/:udid/clipboard', () => {
     }));
     it('still answers 500 for any other write failure', () => __awaiter(void 0, void 0, void 0, function* () {
         manager.setClipboard.rejects(new Error('WDA is not running'));
-        const res = yield (0, supertest_1.default)(buildApp())
+        const res = yield (0, loopbackRequest_1.default)(yield app())
             .post(`/xenon/api/control/${UDID}/clipboard`)
             .send({ content: 'x' });
         (0, chai_1.expect)(res.status).to.equal(500);

package/lib/test/unit/command-auth-appium-server.spec.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
     return new (P || (P = Promise))(function (resolve, reject) {
@@ -16,7 +49,8 @@ const chai_1 = require("chai");
 const http_1 = __importDefault(require("http"));
 const path_1 = __importDefault(require("path"));
 const sinon_1 = __importDefault(require("sinon"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
+const ws_1 = __importStar(require("ws"));
 const commandCaller_1 = require("../../src/middleware/commandCaller");
 const commandAuth_1 = require("../../src/middleware/commandAuth");
 const registerCommandAuth_1 = require("../../src/app/registerCommandAuth");
@@ -29,9 +63,22 @@ const registerCommandAuth_1 = require("../../src/app/registerCommandAuth");
  * Express 5 as Appium builds it: its middleware, then every WebDriver route,
  * then the plugin updaters, then its catch-all 404. The fake driver records
  * each command that reaches it, which shows whether the check ran first.
+ *
+ * The session listing and the BiDi WebSocket go through the same server:
+ * registerSessionUpgradeGuard is a server updater too, and the BiDi handler is
+ * added after boot with addWebSocketHandler, as Appium's main adds it.
  */
 const EXACT_UNKNOWN_SESSION = JSON.stringify(commandAuth_1.UNKNOWN_SESSION_BODY);
 const LIVE_SESSION = 'live-session';
+const BOBS_SESSION = 'bobs-session';
+const LISTING = [
+    { id: LIVE_SESSION, created: 1, capabilities: { platformName: 'Fake' } },
+    { id: BOBS_SESSION, created: 2, capabilities: { platformName: 'Fake' } },
+];
+const OWNERS = { [LIVE_SESSION]: 'alice', [BOBS_SESSION]: 'bob' };
+function nativelyUsesUpgradeListener() {
+    return typeof http_1.default.createServer().shouldUpgradeCallback !== 'undefined';
+}
 function appiumBaseDriver() {
     const appiumDir = path_1.default.dirname(require.resolve('appium/package.json'));
     // eslint-disable-next-line @typescript-eslint/no-var-requires
@@ -47,11 +94,14 @@ describe("per-command auth in Appium 3's own server()", () => {
     let server;
     let commands;
     let enabled;
+    let infos;
     let warnings;
+    let bidiConnections;
     function boot() {
-        return __awaiter(this, void 0, void 0, function* () {
+        return __awaiter(this, arguments, void 0, function* (opts = {}) {
             const baseDriver = appiumBaseDriver();
             commands = [];
+            bidiConnections = [];
             const driver = {
                 log: quiet,
                 protocol: 'W3C',
@@ -63,44 +113,88 @@ describe("per-command auth in Appium 3's own server()", () => {
                     commands.push(command);
                     if (command === 'createSession')
                         return [LIVE_SESSION, {}];
+                    if (command === 'getAppiumSessions')
+                        return LISTING;
                     return 'about:blank';
                 }),
             };
+            const credentials = { 'alice-token': 'alice', 'bob-token': 'bob' };
             const verifier = new commandCaller_1.CommandCallerVerifier({
                 verifyKeyPair: sinon_1.default.stub().callsFake((_ak, token) => __awaiter(this, void 0, void 0, function* () {
-                    return token === 'alice-token'
+                    return credentials[token]
                         ? {
-                            row: { id: 'k', userId: 'alice', scopes: 'sessions', expiresAt: null },
-                            user: { id: 'alice', role: 'MEMBER', status: 'ACTIVE' },
+                            row: { id: 'k', userId: credentials[token], scopes: 'sessions', expiresAt: null },
+                            user: { id: credentials[token], role: 'MEMBER', status: 'ACTIVE' },
                         }
                         : null;
                 })),
                 verifyBearer: sinon_1.default.stub().resolves(null),
             });
-            server = yield baseDriver.server({
-                routeConfiguringFunction: baseDriver.routeConfiguringFunction(driver),
-                port: 0,
-                hostname: '127.0.0.1',
-                basePath: '/wd/hub',
-                // Appium hands plugins the raw CLI args; the base path here is normalised
-                // by registerCommandAuth itself.
-                cliArgs: { basePath: 'wd/hub/' },
-                serverUpdaters: [
-                    (app, _httpServer, cliArgs) => {
-                        (0, registerCommandAuth_1.registerCommandAuth)(app, cliArgs, {
-                            enabled: () => enabled,
-                            authDisabled: () => false,
-                            verifier,
-                            ownerOf: (id) => __awaiter(this, void 0, void 0, function* () { return (id === LIVE_SESSION ? 'alice' : null); }),
-                            logger: {
-                                info: () => undefined,
-                                warn: (m) => warnings.push(m),
-                                error: () => undefined,
-                            },
-                        });
-                    },
-                ],
+            const deps = {
+                enabled: () => enabled,
+                authDisabled: () => false,
+                verifier,
+                ownerOf: (id) => __awaiter(this, void 0, void 0, function* () { var _a; return (_a = OWNERS[id]) !== null && _a !== void 0 ? _a : null; }),
+                ownersOf: (ids) => __awaiter(this, void 0, void 0, function* () { return new Map(ids.map((id) => { var _a; return [id, (_a = OWNERS[id]) !== null && _a !== void 0 ? _a : null]; })); }),
+                logger: {
+                    info: (m) => infos.push(m),
+                    warn: (m) => warnings.push(m),
+                    error: () => undefined,
+                },
+            };
+            const createServer = http_1.default.createServer;
+            const forced = opts.upgrades === 'listener' ? sinon_1.default.stub(http_1.default, 'createServer') : undefined;
+            forced === null || forced === void 0 ? void 0 : forced.callsFake(((app) => {
+                const s = createServer(app);
+                if (typeof s.shouldUpgradeCallback === 'undefined') {
+                    s.shouldUpgradeCallback = () => true;
+                }
+                return s;
+            }));
+            try {
+                server = yield baseDriver.server({
+                    routeConfiguringFunction: baseDriver.routeConfiguringFunction(driver),
+                    port: 0,
+                    hostname: '127.0.0.1',
+                    basePath: '/wd/hub',
+                    // Appium hands plugins the raw CLI args; the base path here is normalised
+                    // by registerCommandAuth itself.
+                    cliArgs: { basePath: 'wd/hub/' },
+                    serverUpdaters: [
+                        (app, httpServer, cliArgs) => {
+                            (0, registerCommandAuth_1.registerCommandAuth)(app, cliArgs, deps);
+                            (0, registerCommandAuth_1.registerSessionUpgradeGuard)(httpServer, app, cliArgs, deps);
+                        },
+                    ],
+                });
+            }
+            finally {
+                forced === null || forced === void 0 ? void 0 : forced.restore();
+            }
+            // Appium's main adds its BiDi handler right after server() resolves.
+            const bidi = new ws_1.WebSocketServer({ noServer: true });
+            bidi.on('connection', (ws, req) => {
+                bidiConnections.push(String(req.url));
+                ws.on('error', () => undefined);
+            });
+            yield booted().addWebSocketHandler('/wd/hub/bidi', bidi);
+            yield booted().addWebSocketHandler('/wd/hub/bidi/:sessionId', bidi);
+        });
+    }
+    function upgrade(urlPath, headers = {}) {
+        const { port } = booted().address();
+        return new Promise((resolve) => {
+            const ws = new ws_1.default(`ws://127.0.0.1:${port}${urlPath}`, { headers });
+            ws.on('open', () => {
+                resolve('open');
+                ws.terminate();
+            });
+            ws.on('unexpected-response', (req, res) => {
+                var _a;
+                resolve((_a = res.statusCode) !== null && _a !== void 0 ? _a : 0);
+                req.destroy();
             });
+            ws.on('error', (err) => resolve(err.message));
         });
     }
     // Appium's HTTP logger writes every request to stdout; quiet it here only.
@@ -130,6 +224,7 @@ describe("per-command auth in Appium 3's own server()", () => {
     }
     beforeEach(() => {
         enabled = true;
+        infos = [];
         warnings = [];
     });
     afterEach(() => __awaiter(void 0, void 0, void 0, function* () {
@@ -144,7 +239,7 @@ describe("per-command auth in Appium 3's own server()", () => {
     }));
     it("refuses a session command before Appium's route runs", () => __awaiter(void 0, void 0, void 0, function* () {
         yield boot();
-        const res = yield (0, supertest_1.default)(booted()).get(`/wd/hub/session/${LIVE_SESSION}/url`);
+        const res = yield (0, loopbackRequest_1.default)(booted()).get(`/wd/hub/session/${LIVE_SESSION}/url`);
         (0, chai_1.expect)(res.status).to.equal(404);
         (0, chai_1.expect)(res.text).to.equal(EXACT_UNKNOWN_SESSION);
         (0, chai_1.expect)(commands).to.deep.equal([]);
@@ -152,7 +247,7 @@ describe("per-command auth in Appium 3's own server()", () => {
     }));
     it("lets the owner through to Appium's route and the driver", () => __awaiter(void 0, void 0, void 0, function* () {
         yield boot();
-        const res = yield (0, supertest_1.default)(booted())
+        const res = yield (0, loopbackRequest_1.default)(booted())
             .get(`/wd/hub/session/${LIVE_SESSION}/url`)
             .set({ 'x-xenon-access-key': 'ak', 'x-xenon-token': 'alice-token' });
         (0, chai_1.expect)(res.status).to.equal(200);
@@ -161,7 +256,7 @@ describe("per-command auth in Appium 3's own server()", () => {
     }));
     it('lets createSession reach the driver without credentials', () => __awaiter(void 0, void 0, void 0, function* () {
         yield boot();
-        yield (0, supertest_1.default)(booted())
+        yield (0, loopbackRequest_1.default)(booted())
             .post('/wd/hub/session')
             .send({ capabilities: { alwaysMatch: { platformName: 'Fake' } } })
             .expect(200);
@@ -170,7 +265,7 @@ describe("per-command auth in Appium 3's own server()", () => {
     it("with the setting off, Appium gives its own unknown-session answer, which the refusal matches but for Appium's stack trace", () => __awaiter(void 0, void 0, void 0, function* () {
         enabled = false;
         yield boot();
-        const res = yield (0, supertest_1.default)(booted()).get('/wd/hub/session/no-such-session/url');
+        const res = yield (0, loopbackRequest_1.default)(booted()).get('/wd/hub/session/no-such-session/url');
         (0, chai_1.expect)(res.status).to.equal(404);
         (0, chai_1.expect)(res.headers['content-type']).to.equal('application/json; charset=utf-8');
         (0, chai_1.expect)(res.body.value.error).to.equal(commandAuth_1.UNKNOWN_SESSION_BODY.value.error);
@@ -181,4 +276,64 @@ describe("per-command auth in Appium 3's own server()", () => {
         (0, chai_1.expect)(res.body.value.stacktrace).to.match(/^NoSuchDriverError: A session is either terminated or not started/);
         (0, chai_1.expect)(warnings).to.deep.equal([]);
     }));
+    describe("Appium's session listing (GET /appium/sessions)", () => {
+        it('answers a caller without credentials an empty list, though Appium produced the full one', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield boot();
+            const res = yield (0, loopbackRequest_1.default)(booted()).get('/wd/hub/appium/sessions');
+            (0, chai_1.expect)(res.status).to.equal(200);
+            (0, chai_1.expect)(res.headers['content-type']).to.equal('application/json; charset=utf-8');
+            (0, chai_1.expect)(res.text).to.equal('{"value":[]}');
+            (0, chai_1.expect)(commands).to.deep.equal(['getAppiumSessions']);
+            (0, chai_1.expect)(warnings).to.have.length(1);
+        }));
+        it('shows the owner only their own session', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield boot();
+            const res = yield (0, loopbackRequest_1.default)(booted())
+                .get('/wd/hub/appium/sessions')
+                .set({ 'x-xenon-access-key': 'ak', 'x-xenon-token': 'alice-token' });
+            (0, chai_1.expect)(res.body).to.deep.equal({ value: [LISTING[0]] });
+            (0, chai_1.expect)(infos.some((m) => m.includes('1 of 2'))).to.equal(true);
+        }));
+        it("with the setting off, answers Appium's listing untouched", () => __awaiter(void 0, void 0, void 0, function* () {
+            enabled = false;
+            yield boot();
+            const res = yield (0, loopbackRequest_1.default)(booted()).get('/wd/hub/appium/sessions');
+            (0, chai_1.expect)(res.body).to.deep.equal({ value: LISTING });
+        }));
+    });
+    for (const upgrades of ['native', 'listener']) {
+        const how = upgrades === 'listener' || nativelyUsesUpgradeListener()
+            ? 'with its upgrade listener'
+            : 'with its Express upgrade middleware';
+        describe(`the BiDi WebSocket, Appium dispatching upgrades ${how} (${upgrades})`, () => {
+            it('refuses a session upgrade without credentials with 404, before Appium attaches it', () => __awaiter(void 0, void 0, void 0, function* () {
+                yield boot({ upgrades });
+                (0, chai_1.expect)(yield upgrade(`/wd/hub/bidi/${LIVE_SESSION}`)).to.equal(404);
+                (0, chai_1.expect)(bidiConnections).to.deep.equal([]);
+                (0, chai_1.expect)(warnings).to.have.length(1);
+            }));
+            it('refuses another user with 404', () => __awaiter(void 0, void 0, void 0, function* () {
+                yield boot({ upgrades });
+                (0, chai_1.expect)(yield upgrade(`/wd/hub/bidi/${LIVE_SESSION}`, {
+                    'x-xenon-access-key': 'ak',
+                    'x-xenon-token': 'bob-token',
+                })).to.equal(404);
+                (0, chai_1.expect)(bidiConnections).to.deep.equal([]);
+            }));
+            it("lets the owner attach through Appium's own handler", () => __awaiter(void 0, void 0, void 0, function* () {
+                yield boot({ upgrades });
+                (0, chai_1.expect)(yield upgrade(`/wd/hub/bidi/${LIVE_SESSION}`, {
+                    'x-xenon-access-key': 'ak',
+                    'x-xenon-token': 'alice-token',
+                })).to.equal('open');
+                (0, chai_1.expect)(bidiConnections).to.deep.equal([`/wd/hub/bidi/${LIVE_SESSION}`]);
+            }));
+            it('with the setting off, lets anyone attach, as Appium does', () => __awaiter(void 0, void 0, void 0, function* () {
+                enabled = false;
+                yield boot({ upgrades });
+                (0, chai_1.expect)(yield upgrade(`/wd/hub/bidi/${LIVE_SESSION}`)).to.equal('open');
+                (0, chai_1.expect)(warnings).to.deep.equal([]);
+            }));
+        });
+    }
 });