@xenon-device-management/xenon 2.0.0 → 2.2.0

package/lib/test/unit/command-auth.spec.js

@@ -16,7 +16,7 @@ const chai_1 = require("chai");
 const path_1 = __importDefault(require("path"));
 const sinon_1 = __importDefault(require("sinon"));
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const commandAuth_1 = require("../../src/middleware/commandAuth");
 const commandCaller_1 = require("../../src/middleware/commandCaller");
 const loopbackServer_1 = require("../helpers/loopbackServer");
@@ -199,14 +199,14 @@ describe('per-command auth (XENON_REQUIRE_COMMAND_AUTH)', () => {
             describe('who may drive a session', () => {
                 it("lets the owner's key through to the route", () => __awaiter(void 0, void 0, void 0, function* () {
                     const { app, ran } = yield lab();
-                    const res = yield (0, supertest_1.default)(app).get('/wd/hub/session/s-alice/url').set(as('alice-token'));
+                    const res = yield (0, loopbackRequest_1.default)(app).get('/wd/hub/session/s-alice/url').set(as('alice-token'));
                     (0, chai_1.expect)(res.status).to.equal(200);
                     (0, chai_1.expect)(ran).to.deep.equal(['getUrl']);
                     (0, chai_1.expect)(warnings).to.deep.equal([]);
                 }));
                 it("lets the owner's Bearer token through", () => __awaiter(void 0, void 0, void 0, function* () {
                     const { app, ran } = yield lab();
-                    yield (0, supertest_1.default)(app)
+                    yield (0, loopbackRequest_1.default)(app)
                         .get('/wd/hub/session/s-alice/url')
                         .set(bearer('alice-jwt'))
                         .expect(200);
@@ -214,13 +214,13 @@ describe('per-command auth (XENON_REQUIRE_COMMAND_AUTH)', () => {
                 }));
                 it('refuses another user with the unknown-session answer, before the route runs', () => __awaiter(void 0, void 0, void 0, function* () {
                     const { app, ran } = yield lab();
-                    const res = yield (0, supertest_1.default)(app).get('/wd/hub/session/s-alice/url').set(as('bob-token'));
+                    const res = yield (0, loopbackRequest_1.default)(app).get('/wd/hub/session/s-alice/url').set(as('bob-token'));
                     yield expectRefused(res);
                     (0, chai_1.expect)(ran).to.deep.equal([]);
                 }));
                 it('logs the refusal with the session and the caller, never the credential', () => __awaiter(void 0, void 0, void 0, function* () {
                     const { app } = yield lab();
-                    yield (0, supertest_1.default)(app).get('/wd/hub/session/s-alice/url').set(as('bob-token'));
+                    yield (0, loopbackRequest_1.default)(app).get('/wd/hub/session/s-alice/url').set(as('bob-token'));
                     (0, chai_1.expect)(warnings).to.have.length(1);
                     (0, chai_1.expect)(warnings[0]).to.include('s-alice');
                     (0, chai_1.expect)(warnings[0]).to.include('bob');
@@ -229,7 +229,7 @@ describe('per-command auth (XENON_REQUIRE_COMMAND_AUTH)', () => {
                 }));
                 it('refuses a request with no credentials, without looking anything up', () => __awaiter(void 0, void 0, void 0, function* () {
                     const { app, ran } = yield lab();
-                    yield expectRefused(yield (0, supertest_1.default)(app).get('/wd/hub/session/s-alice/url'));
+                    yield expectRefused(yield (0, loopbackRequest_1.default)(app).get('/wd/hub/session/s-alice/url'));
                     (0, chai_1.expect)(ran).to.deep.equal([]);
                     (0, chai_1.expect)(verifyKeyPair.called || verifyBearer.called).to.equal(false);
                     (0, chai_1.expect)(ownerOf.called).to.equal(false);
@@ -238,7 +238,7 @@ describe('per-command auth (XENON_REQUIRE_COMMAND_AUTH)', () => {
                 }));
                 it('refuses credentials that do not verify, without looking up the owner', () => __awaiter(void 0, void 0, void 0, function* () {
                     const { app } = yield lab();
-                    const res = yield (0, supertest_1.default)(app)
+                    const res = yield (0, loopbackRequest_1.default)(app)
                         .get('/wd/hub/session/s-alice/url')
                         .set({ 'x-xenon-access-key': 'ak-alice', 'x-xenon-token': 'guessed' });
                     yield expectRefused(res);
@@ -248,34 +248,34 @@ describe('per-command auth (XENON_REQUIRE_COMMAND_AUTH)', () => {
                 }));
                 it('lets an admin-scoped key drive a session it does not own', () => __awaiter(void 0, void 0, void 0, function* () {
                     const { app, ran } = yield lab();
-                    yield (0, supertest_1.default)(app).get('/wd/hub/session/s-alice/url').set(as('carol-admin')).expect(200);
+                    yield (0, loopbackRequest_1.default)(app).get('/wd/hub/session/s-alice/url').set(as('carol-admin')).expect(200);
                     (0, chai_1.expect)(ran).to.deep.equal(['getUrl']);
                 }));
                 it('lets a SUPER_ADMIN drive a session they do not own', () => __awaiter(void 0, void 0, void 0, function* () {
                     const { app, ran } = yield lab();
-                    yield (0, supertest_1.default)(app).get('/wd/hub/session/s-alice/url').set(bearer('root-jwt')).expect(200);
+                    yield (0, loopbackRequest_1.default)(app).get('/wd/hub/session/s-alice/url').set(bearer('root-jwt')).expect(200);
                     (0, chai_1.expect)(ran).to.deep.equal(['getUrl']);
                 }));
                 it("refuses an ADMIN's ordinary key on someone else's session", () => __awaiter(void 0, void 0, void 0, function* () {
                     const { app, ran } = yield lab();
-                    yield expectRefused(yield (0, supertest_1.default)(app).get('/wd/hub/session/s-alice/url').set(as('carol-ordinary')));
+                    yield expectRefused(yield (0, loopbackRequest_1.default)(app).get('/wd/hub/session/s-alice/url').set(as('carol-ordinary')));
                     (0, chai_1.expect)(ran).to.deep.equal([]);
                 }));
                 it('refuses everyone but override admins on a session nobody owns', () => __awaiter(void 0, void 0, void 0, function* () {
                     const { app, ran } = yield lab();
-                    yield expectRefused(yield (0, supertest_1.default)(app).get('/wd/hub/session/s-anon/url').set(as('alice-token')));
-                    yield expectRefused(yield (0, supertest_1.default)(app).get('/wd/hub/session/s-anon/url').set(as('carol-ordinary')));
+                    yield expectRefused(yield (0, loopbackRequest_1.default)(app).get('/wd/hub/session/s-anon/url').set(as('alice-token')));
+                    yield expectRefused(yield (0, loopbackRequest_1.default)(app).get('/wd/hub/session/s-anon/url').set(as('carol-ordinary')));
                     (0, chai_1.expect)(ran).to.deep.equal([]);
-                    yield (0, supertest_1.default)(app).get('/wd/hub/session/s-anon/url').set(as('carol-admin')).expect(200);
-                    yield (0, supertest_1.default)(app).get('/wd/hub/session/s-anon/url').set(bearer('root-jwt')).expect(200);
+                    yield (0, loopbackRequest_1.default)(app).get('/wd/hub/session/s-anon/url').set(as('carol-admin')).expect(200);
+                    yield (0, loopbackRequest_1.default)(app).get('/wd/hub/session/s-anon/url').set(bearer('root-jwt')).expect(200);
                     (0, chai_1.expect)(ran).to.deep.equal(['getUrl', 'getUrl']);
                 }));
                 it('answers a session the caller may not use exactly as one that does not exist', () => __awaiter(void 0, void 0, void 0, function* () {
                     const { app } = yield lab();
-                    const refused = yield (0, supertest_1.default)(app)
+                    const refused = yield (0, loopbackRequest_1.default)(app)
                         .get('/wd/hub/session/s-alice/url')
                         .set(as('bob-token'));
-                    const missing = yield (0, supertest_1.default)(app)
+                    const missing = yield (0, loopbackRequest_1.default)(app)
                         .get('/wd/hub/session/no-such-session/url')
                         .set(as('bob-token'));
                     (0, chai_1.expect)(refused.status).to.equal(missing.status);
@@ -293,38 +293,38 @@ describe('per-command auth (XENON_REQUIRE_COMMAND_AUTH)', () => {
                 for (const [method, url, name] of commands) {
                     it(`guards ${method.toUpperCase()} ${url.replace('/wd/hub', '')}`, () => __awaiter(void 0, void 0, void 0, function* () {
                         const { app, ran } = yield lab();
-                        yield expectRefused(yield (0, supertest_1.default)(app)[method](url).set(as('bob-token')).send({}));
+                        yield expectRefused(yield (0, loopbackRequest_1.default)(app)[method](url).set(as('bob-token')).send({}));
                         (0, chai_1.expect)(ran).to.deep.equal([]);
-                        yield (0, supertest_1.default)(app)[method](url).set(as('alice-token')).send({}).expect(200);
+                        yield (0, loopbackRequest_1.default)(app)[method](url).set(as('alice-token')).send({}).expect(200);
                         (0, chai_1.expect)(ran).to.deep.equal([name]);
                     }));
                 }
                 it('guards a path in another letter case, which the routes also match', () => __awaiter(void 0, void 0, void 0, function* () {
                     const { app, ran } = yield lab();
-                    yield expectRefused(yield (0, supertest_1.default)(app).get('/WD/HUB/SESSION/s-alice/url').set(as('bob-token')));
+                    yield expectRefused(yield (0, loopbackRequest_1.default)(app).get('/WD/HUB/SESSION/s-alice/url').set(as('bob-token')));
                     (0, chai_1.expect)(ran).to.deep.equal([]);
                 }));
             });
             describe('what it leaves alone', () => {
                 it('lets createSession through; it has its own credential checks', () => __awaiter(void 0, void 0, void 0, function* () {
                     const { app, ran } = yield lab();
-                    yield (0, supertest_1.default)(app).post('/wd/hub/session').send({ capabilities: {} }).expect(200);
+                    yield (0, loopbackRequest_1.default)(app).post('/wd/hub/session').send({ capabilities: {} }).expect(200);
                     (0, chai_1.expect)(ran).to.deep.equal(['createSession']);
                     (0, chai_1.expect)(ownerOf.called).to.equal(false);
                 }));
                 it('lets requests that are not session commands through', () => __awaiter(void 0, void 0, void 0, function* () {
                     const { app, ran } = yield lab();
-                    yield (0, supertest_1.default)(app).get('/wd/hub/status').expect(200);
-                    yield (0, supertest_1.default)(app).get('/wd/hub/appium/sessions').expect(200);
-                    yield (0, supertest_1.default)(app).get('/xenon/api/devices').expect(200);
+                    yield (0, loopbackRequest_1.default)(app).get('/wd/hub/status').expect(200);
+                    yield (0, loopbackRequest_1.default)(app).get('/wd/hub/appium/sessions').expect(200);
+                    yield (0, loopbackRequest_1.default)(app).get('/xenon/api/devices').expect(200);
                     (0, chai_1.expect)(ran).to.deep.equal(['getStatus', 'getAppiumSessions', 'xenonApi']);
                     (0, chai_1.expect)(verifyKeyPair.called || verifyBearer.called || ownerOf.called).to.equal(false);
                 }));
                 it('does nothing at all when the setting is off (the default)', () => __awaiter(void 0, void 0, void 0, function* () {
                     enabled = false;
                     const { app, ran } = yield lab();
-                    yield (0, supertest_1.default)(app).get('/wd/hub/session/s-alice/url').expect(200);
-                    yield (0, supertest_1.default)(app).get('/wd/hub/session/s-alice/url').set(as('bob-token')).expect(200);
+                    yield (0, loopbackRequest_1.default)(app).get('/wd/hub/session/s-alice/url').expect(200);
+                    yield (0, loopbackRequest_1.default)(app).get('/wd/hub/session/s-alice/url').set(as('bob-token')).expect(200);
                     (0, chai_1.expect)(ran).to.deep.equal(['getUrl', 'getUrl']);
                     (0, chai_1.expect)(verifyKeyPair.called || verifyBearer.called || ownerOf.called).to.equal(false);
                     (0, chai_1.expect)(warnings).to.deep.equal([]);
@@ -332,7 +332,7 @@ describe('per-command auth (XENON_REQUIRE_COMMAND_AUTH)', () => {
                 it('does nothing when auth is disabled, even with the setting on', () => __awaiter(void 0, void 0, void 0, function* () {
                     authDisabled = true;
                     const { app, ran } = yield lab();
-                    yield (0, supertest_1.default)(app).get('/wd/hub/session/s-alice/url').expect(200);
+                    yield (0, loopbackRequest_1.default)(app).get('/wd/hub/session/s-alice/url').expect(200);
                     (0, chai_1.expect)(ran).to.deep.equal(['getUrl']);
                     (0, chai_1.expect)(verifyKeyPair.called || verifyBearer.called || ownerOf.called).to.equal(false);
                 }));
@@ -341,7 +341,7 @@ describe('per-command auth (XENON_REQUIRE_COMMAND_AUTH)', () => {
                 it('answers 503 when the owner lookup fails, never letting the command through', () => __awaiter(void 0, void 0, void 0, function* () {
                     ownerOf.rejects(new Error('database is locked'));
                     const { app, ran } = yield lab();
-                    const res = yield (0, supertest_1.default)(app).get('/wd/hub/session/s-alice/url').set(as('alice-token'));
+                    const res = yield (0, loopbackRequest_1.default)(app).get('/wd/hub/session/s-alice/url').set(as('alice-token'));
                     (0, chai_1.expect)(res.status).to.equal(503);
                     (0, chai_1.expect)(res.body).to.deep.equal(commandAuth_1.COMMAND_AUTH_UNAVAILABLE_BODY);
                     (0, chai_1.expect)(ran).to.deep.equal([]);
@@ -351,7 +351,7 @@ describe('per-command auth (XENON_REQUIRE_COMMAND_AUTH)', () => {
                 it('answers 503 when the credential check fails', () => __awaiter(void 0, void 0, void 0, function* () {
                     verifyKeyPair.rejects(new Error('database is locked'));
                     const { app, ran } = yield lab();
-                    const res = yield (0, supertest_1.default)(app).get('/wd/hub/session/s-alice/url').set(as('alice-token'));
+                    const res = yield (0, loopbackRequest_1.default)(app).get('/wd/hub/session/s-alice/url').set(as('alice-token'));
                     (0, chai_1.expect)(res.status).to.equal(503);
                     (0, chai_1.expect)(res.body).to.deep.equal(commandAuth_1.COMMAND_AUTH_UNAVAILABLE_BODY);
                     (0, chai_1.expect)(ran).to.deep.equal([]);
@@ -360,13 +360,13 @@ describe('per-command auth (XENON_REQUIRE_COMMAND_AUTH)', () => {
             describe('base path', () => {
                 it("normalises the base path the way Appium does ('wd/hub/' → '/wd/hub')", () => __awaiter(void 0, void 0, void 0, function* () {
                     const { app, ran } = yield lab({ basePath: 'wd/hub/' });
-                    yield expectRefused(yield (0, supertest_1.default)(app).get('/wd/hub/session/s-alice/url').set(as('bob-token')));
+                    yield expectRefused(yield (0, loopbackRequest_1.default)(app).get('/wd/hub/session/s-alice/url').set(as('bob-token')));
                     (0, chai_1.expect)(ran).to.deep.equal([]);
                 }));
                 it("guards /session/:id under Appium 3's default empty base path", () => __awaiter(void 0, void 0, void 0, function* () {
                     const { app, ran } = yield lab({ basePath: '', routePrefix: '' });
-                    yield expectRefused(yield (0, supertest_1.default)(app).get('/session/s-alice/url').set(as('bob-token')));
-                    yield (0, supertest_1.default)(app).post('/session').send({}).expect(200);
+                    yield expectRefused(yield (0, loopbackRequest_1.default)(app).get('/session/s-alice/url').set(as('bob-token')));
+                    yield (0, loopbackRequest_1.default)(app).post('/session').send({}).expect(200);
                     (0, chai_1.expect)(ran).to.deep.equal(['createSession']);
                 }));
             });

package/lib/test/unit/control-device-lookup.spec.js

@@ -15,7 +15,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 require("reflect-metadata");
 const chai_1 = require("chai");
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const deviceTeamGuard_1 = require("../../src/middleware/deviceTeamGuard");
 const deviceAccessGuard_1 = require("../../src/middleware/deviceAccessGuard");
 /**
@@ -71,41 +71,41 @@ function appWith(caller) {
 describe('the /control guards share one device lookup', () => {
     it("costs a member's tap one lookup, not one per guard", () => __awaiter(void 0, void 0, void 0, function* () {
         const { app, lookups } = appWith(ALICE);
-        const res = yield (0, supertest_1.default)(app).post(`/control/${PHONE_A}/tap`);
+        const res = yield (0, loopbackRequest_1.default)(app).post(`/control/${PHONE_A}/tap`);
         (0, chai_1.expect)(res.status, res.text).to.equal(200);
         (0, chai_1.expect)(lookups).to.deep.equal([PHONE_A]);
     }));
     it("costs a member's clipboard read, which both guards check, one lookup", () => __awaiter(void 0, void 0, void 0, function* () {
         const { app, lookups } = appWith(ALICE);
-        const res = yield (0, supertest_1.default)(app).get(`/control/${PHONE_A}/clipboard`);
+        const res = yield (0, loopbackRequest_1.default)(app).get(`/control/${PHONE_A}/clipboard`);
         (0, chai_1.expect)(res.status, res.text).to.equal(200);
         (0, chai_1.expect)(lookups).to.deep.equal([PHONE_A]);
     }));
     it("costs a member's screenshot one lookup", () => __awaiter(void 0, void 0, void 0, function* () {
         const { app, lookups } = appWith(ALICE);
-        yield (0, supertest_1.default)(app).get(`/control/${PHONE_A}/screenshot`);
+        yield (0, loopbackRequest_1.default)(app).get(`/control/${PHONE_A}/screenshot`);
         (0, chai_1.expect)(lookups).to.deep.equal([PHONE_A]);
     }));
     // The same count either way, so the time an answer takes can't tell a
     // hidden phone from an unknown udid either.
     it('costs a hidden phone and an unknown udid the same single lookup', () => __awaiter(void 0, void 0, void 0, function* () {
         const hidden = appWith(ALICE);
-        yield (0, supertest_1.default)(hidden.app).post(`/control/${PHONE_B}/tap`);
+        yield (0, loopbackRequest_1.default)(hidden.app).post(`/control/${PHONE_B}/tap`);
         const unknown = appWith(ALICE);
-        yield (0, supertest_1.default)(unknown.app).post(`/control/${UNKNOWN}/tap`);
+        yield (0, loopbackRequest_1.default)(unknown.app).post(`/control/${UNKNOWN}/tap`);
         (0, chai_1.expect)(hidden.lookups).to.deep.equal([PHONE_B]);
         (0, chai_1.expect)(unknown.lookups).to.deep.equal([UNKNOWN]);
     }));
     it("costs an admin's tap one lookup (the team guard skips admins)", () => __awaiter(void 0, void 0, void 0, function* () {
         const { app, lookups } = appWith(ADMIN);
-        const res = yield (0, supertest_1.default)(app).post(`/control/${PHONE_B}/tap`);
+        const res = yield (0, loopbackRequest_1.default)(app).post(`/control/${PHONE_B}/tap`);
         (0, chai_1.expect)(res.status, res.text).to.equal(200);
         (0, chai_1.expect)(lookups).to.deep.equal([PHONE_B]);
     }));
     it('does not share a lookup between two requests', () => __awaiter(void 0, void 0, void 0, function* () {
         const { app, lookups } = appWith(ALICE);
-        yield (0, supertest_1.default)(app).post(`/control/${PHONE_A}/tap`);
-        yield (0, supertest_1.default)(app).post(`/control/${PHONE_A}/tap`);
+        yield (0, loopbackRequest_1.default)(app).post(`/control/${PHONE_A}/tap`);
+        yield (0, loopbackRequest_1.default)(app).post(`/control/${PHONE_A}/tap`);
         (0, chai_1.expect)(lookups).to.deep.equal([PHONE_A, PHONE_A]);
     }));
 });

package/lib/test/unit/control-forward-decision.spec.js

@@ -0,0 +1,115 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const sinon_1 = __importDefault(require("sinon"));
+const express_1 = __importDefault(require("express"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
+const typedi_1 = require("typedi");
+const control_1 = __importDefault(require("../../src/app/routers/control"));
+const device_store_1 = require("../../src/data-service/device-store");
+const device_managers_1 = require("../../src/device-managers");
+const PluginContext_1 = require("../../src/PluginContext");
+const IPluginArgs_1 = require("../../src/interfaces/IPluginArgs");
+const authMiddleware_1 = require("../../src/middleware/authMiddleware");
+const container_registration_1 = require("../helpers/container-registration");
+const loopbackServer_1 = require("../helpers/loopbackServer");
+/**
+ * Whether a /control action is forwarded to another server is decided by the
+ * phone's own row (its nodeId, else its exact host against this server's own
+ * hosts), never by the Host header the caller happened to use. It was a
+ * substring match on that header: a lab reached as `localhost` forwarded its
+ * own phone's tap back to itself with no login, and the tap failed. A
+ * forwarded tap is also sent once: InternalHttpClient's retry on a 5xx or a
+ * timeout could land the same tap twice on a slow node.
+ */
+// The route finds the manager by constructor name.
+class AndroidDeviceManager {
+    constructor() {
+        this.taps = [];
+        this.tap = (udid) => __awaiter(this, void 0, void 0, function* () {
+            this.taps.push(udid);
+        });
+    }
+}
+const OWN_HOST = 'http://192.168.0.104:4723';
+function buildApp() {
+    const app = (0, express_1.default)();
+    app.use(express_1.default.json());
+    const api = express_1.default.Router();
+    api.use((req, _res, next) => {
+        req.auth = {
+            kind: 'user-session',
+            userId: 'usr_me',
+            role: 'MEMBER',
+            scopes: (0, authMiddleware_1.scopesForRole)('MEMBER'),
+            rateLimit: 100,
+        };
+        next();
+    });
+    control_1.default.register(api);
+    app.use('/xenon/api', api);
+    return app;
+}
+describe('/control forwards only another server’s phone', () => {
+    const loopback = (0, loopbackServer_1.loopbackServers)();
+    let manager;
+    let restore;
+    let context;
+    let savedContext;
+    let device;
+    beforeEach(() => {
+        restore = (0, container_registration_1.saveRegistrations)(device_managers_1.XenonManager);
+        manager = new AndroidDeviceManager();
+        typedi_1.Container.set(device_managers_1.XenonManager, { deviceInstances: () => __awaiter(void 0, void 0, void 0, function* () { return [manager]; }) });
+        context = typedi_1.Container.get(PluginContext_1.PluginContext);
+        savedContext = Object.assign({}, context);
+        context.setContext(Object.assign(Object.assign({}, IPluginArgs_1.DefaultPluginArgs), { bindHostOrIp: '192.168.0.104' }), 4723, 'lab-1', '');
+        sinon_1.default
+            .stub(device_store_1.DeviceStoreFactory, 'getStore')
+            .returns({ findDevice: () => __awaiter(void 0, void 0, void 0, function* () { return (Object.assign({}, device)); }) });
+    });
+    afterEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        Object.assign(context, savedContext);
+        sinon_1.default.restore();
+        restore();
+        yield loopback.closeAll();
+    }));
+    const tap = (udid, hostHeader) => (0, loopbackRequest_1.default)(buildApp())
+        .post(`/xenon/api/control/${udid}/tap`)
+        .set('Host', hostHeader)
+        .send({ x: 1, y: 2 });
+    it('taps this server’s own phone here, whatever name the caller used for the server', () => __awaiter(void 0, void 0, void 0, function* () {
+        device = { udid: 'own-1', host: OWN_HOST, nodeId: 'lab-1', platform: 'android' };
+        const res = yield tap('own-1', 'localhost:4723');
+        (0, chai_1.expect)(res.status, JSON.stringify(res.body)).to.equal(200);
+        (0, chai_1.expect)(manager.taps).to.deep.equal(['own-1']);
+    }));
+    it('forwards a node’s phone once, never retried, and relays its answer', () => __awaiter(void 0, void 0, void 0, function* () {
+        const node = (0, express_1.default)();
+        const hits = [];
+        node.use((req, res) => {
+            hits.push(req.originalUrl);
+            res.status(503).json({ error: 'node busy' });
+        });
+        const nodeOrigin = `http://127.0.0.1:${(yield loopback.serve(node)).address().port}`;
+        device = { udid: 'node-phone', host: nodeOrigin, nodeId: 'node-9', platform: 'android' };
+        const res = yield tap('node-phone', '192.168.0.104:4723');
+        (0, chai_1.expect)(res.status).to.equal(503);
+        (0, chai_1.expect)(res.body).to.deep.equal({ error: 'node busy' });
+        (0, chai_1.expect)(manager.taps).to.deep.equal([]);
+        (0, chai_1.expect)(hits).to.deep.equal(['/xenon/api/control/node-phone/tap']);
+    }));
+});

package/lib/test/unit/control-lookup-failure.spec.js

@@ -16,7 +16,7 @@ require("reflect-metadata");
 const chai_1 = require("chai");
 const sinon_1 = __importDefault(require("sinon"));
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const typedi_1 = require("typedi");
 const control_1 = __importDefault(require("../../src/app/routers/control"));
 const device_store_1 = require("../../src/data-service/device-store");
@@ -71,7 +71,7 @@ describe('stream/ticket and inspector/snapshot answer a failed device lookup', (
     it('POST stream/ticket gets 503, not a hung request', function () {
         return __awaiter(this, void 0, void 0, function* () {
             this.timeout(5000);
-            const res = yield (0, supertest_1.default)(buildApp())
+            const res = yield (0, loopbackRequest_1.default)(buildApp())
                 .post('/xenon/api/control/DEV-1/stream/ticket')
                 .timeout(2000);
             (0, chai_1.expect)(res.status).to.equal(503);
@@ -81,7 +81,7 @@ describe('stream/ticket and inspector/snapshot answer a failed device lookup', (
     it('GET inspector/snapshot gets 503, not a hung request', function () {
         return __awaiter(this, void 0, void 0, function* () {
             this.timeout(5000);
-            const res = yield (0, supertest_1.default)(buildApp())
+            const res = yield (0, loopbackRequest_1.default)(buildApp())
                 .get('/xenon/api/control/DEV-1/inspector/snapshot')
                 .timeout(2000);
             (0, chai_1.expect)(res.status).to.equal(503);

package/lib/test/unit/create-error-message.spec.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const base_driver_1 = require("@appium/base-driver");
+const SessionLifecycleService_1 = require("../../src/services/SessionLifecycleService");
+/**
+ * Appium's createSession answers a failure as `{ error: <Error> }`. The old
+ * message JSON.stringify'd that Error, which is `{}`, so a create Appium
+ * refused (no driver for the automationName, bad capabilities) reached the
+ * client as "Failed to create session on node <host>. Error: {}" with a 500,
+ * instead of Appium's own reason and status.
+ */
+describe('SessionLifecycleService.throwProperError', () => {
+    const throwProperError = (session) => SessionLifecycleService_1.SessionLifecycleService.prototype.throwProperError.call({}, session, 'http://node:4723');
+    function thrown(session) {
+        try {
+            throwProperError(session);
+        }
+        catch (error) {
+            return error;
+        }
+        throw new Error('expected throwProperError to throw');
+    }
+    it("rethrows the Error in Appium's `{ error }` answer, keeping its type and reason", () => {
+        const cause = new base_driver_1.errors.SessionNotCreatedError("Could not find a driver for automationName 'NoSuchDriver'");
+        const error = thrown({ error: cause });
+        (0, chai_1.expect)(error).to.equal(cause);
+        (0, chai_1.expect)(error.message).to.include("automationName 'NoSuchDriver'");
+    });
+    it('keeps a string reason, naming the node', () => {
+        const error = thrown({ error: 'no device' });
+        (0, chai_1.expect)(error.message).to.equal('Failed to create session on node http://node:4723. Error: no device');
+    });
+    it('keeps a plain object reason as JSON', () => {
+        const error = thrown({ error: { code: 'X' } });
+        (0, chai_1.expect)(error.message).to.include('{"code":"X"}');
+    });
+    it('rethrows an Error it is given directly', () => {
+        const cause = new Error('boom');
+        (0, chai_1.expect)(thrown(cause)).to.equal(cause);
+    });
+});

package/lib/test/unit/create-handoff.spec.js

@@ -0,0 +1,86 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+const sinon_1 = __importDefault(require("sinon"));
+const createHandoff_1 = require("../../src/gateway/createHandoff");
+/**
+ * The allocation the session gateway made for one `POST /session`, on its way
+ * through Appium's route to the plugin's createSession. Taken once by the
+ * plugin, or given back once if the plugin never takes it.
+ */
+describe('CreateHandoff', () => {
+    afterEach(() => sinon_1.default.restore());
+    it('hands its allocation over exactly once', () => {
+        const release = sinon_1.default.spy();
+        const handoff = new createHandoff_1.CreateHandoff({ udid: 'u1' }, release);
+        (0, chai_1.expect)(handoff.take()).to.deep.equal({ udid: 'u1' });
+        (0, chai_1.expect)(() => handoff.take()).to.throw(/already/);
+        handoff.abandon();
+        (0, chai_1.expect)(release.called, 'a taken allocation is the taker’s to release').to.equal(false);
+    });
+    it('gives an allocation nobody took back once, and cannot be taken after', () => {
+        const release = sinon_1.default.spy();
+        const handoff = new createHandoff_1.CreateHandoff({ udid: 'u1' }, release);
+        handoff.abandon();
+        handoff.abandon();
+        (0, chai_1.expect)(release.callCount).to.equal(1);
+        (0, chai_1.expect)(release.firstCall.args[0]).to.deep.equal({ udid: 'u1' });
+        (0, chai_1.expect)(() => handoff.take()).to.throw(/closed/);
+    });
+    it('keeps no reference to the allocation once it is taken or released', () => {
+        const taken = new createHandoff_1.CreateHandoff({ udid: 'u1' }, () => undefined);
+        taken.take();
+        (0, chai_1.expect)(taken.allocation).to.equal(undefined);
+        const released = new createHandoff_1.CreateHandoff({ udid: 'u2' }, () => undefined);
+        released.abandon();
+        (0, chai_1.expect)(released.allocation).to.equal(undefined);
+    });
+    it('a release that throws is contained', () => {
+        const handoff = new createHandoff_1.CreateHandoff({ udid: 'u1' }, () => {
+            throw new Error('store down');
+        });
+        (0, chai_1.expect)(() => handoff.abandon()).to.not.throw();
+    });
+    describe('the request context', () => {
+        it('is none outside a request', () => {
+            (0, chai_1.expect)((0, createHandoff_1.currentCreateHandoff)()).to.equal(undefined);
+        });
+        it('follows the request through awaits, timers and callbacks', () => __awaiter(void 0, void 0, void 0, function* () {
+            const handoff = new createHandoff_1.CreateHandoff({ udid: 'u1' }, () => undefined);
+            const seen = yield (0, createHandoff_1.runWithCreateHandoff)(handoff, () => __awaiter(void 0, void 0, void 0, function* () {
+                yield Promise.resolve();
+                yield new Promise((resolve) => setTimeout(resolve, 5));
+                return new Promise((resolve) => setImmediate(() => resolve((0, createHandoff_1.currentCreateHandoff)())));
+            }));
+            (0, chai_1.expect)(seen).to.equal(handoff);
+        }));
+        it('keeps two requests apart', () => __awaiter(void 0, void 0, void 0, function* () {
+            const a = new createHandoff_1.CreateHandoff({ udid: 'a' }, () => undefined);
+            const b = new createHandoff_1.CreateHandoff({ udid: 'b' }, () => undefined);
+            const [seenA, seenB] = yield Promise.all([
+                (0, createHandoff_1.runWithCreateHandoff)(a, () => __awaiter(void 0, void 0, void 0, function* () {
+                    yield new Promise((resolve) => setTimeout(resolve, 10));
+                    return (0, createHandoff_1.currentCreateHandoff)();
+                })),
+                (0, createHandoff_1.runWithCreateHandoff)(b, () => __awaiter(void 0, void 0, void 0, function* () {
+                    yield new Promise((resolve) => setTimeout(resolve, 1));
+                    return (0, createHandoff_1.currentCreateHandoff)();
+                })),
+            ]);
+            (0, chai_1.expect)(seenA).to.equal(a);
+            (0, chai_1.expect)(seenB).to.equal(b);
+        }));
+    });
+});

package/lib/test/unit/dashboard-events-team-scope.spec.js

@@ -52,7 +52,7 @@ const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const typedi_1 = require("typedi");
 const SocketServer_1 = require("../../src/services/SocketServer");
 const SocketEvents_1 = require("../../src/enums/SocketEvents");
@@ -370,6 +370,9 @@ describe('Dashboard events name their phone (team-scoped call sites)', () => {
             entries: [{ name: 'a.txt', source: { kind: 'buffer', data: Buffer.from('hi') } }],
             cleanup: () => __awaiter(void 0, void 0, void 0, function* () { }),
         });
+        // The route looks the session up first. No row: it assembles as before.
+        // Unstubbed, that read the developer's database, and hung without it.
+        sinon_1.default.stub(prisma_1.prisma.session, 'findUnique').resolves(null);
         const app = (0, express_1.default)();
         app.use((req, _res, next) => {
             req.auth = {
@@ -382,7 +385,7 @@ describe('Dashboard events name their phone (team-scoped call sites)', () => {
             next();
         });
         bug_report_1.default.register(app);
-        yield (0, supertest_1.default)(app)
+        yield (0, loopbackRequest_1.default)(app)
             .post('/sessions/s5/bug-report?mode=full')
             .buffer(true)
             .parse((r, cb) => {
@@ -419,7 +422,7 @@ describe('Dashboard events name their phone (team-scoped call sites)', () => {
         const router = express_1.default.Router();
         grid_1.default.register(router, {});
         app.use(router);
-        const res = yield (0, supertest_1.default)(app).put('/device/phone-a/team').send({ teamId: 'team-c' });
+        const res = yield (0, loopbackRequest_1.default)(app).put('/device/phone-a/team').send({ teamId: 'team-c' });
         (0, chai_1.expect)(res.status).to.equal(200);
         (0, chai_1.expect)(yield resolver.resolve('phone-a')).to.deep.equal({ known: true, teamId: 'team-c' });
         (0, chai_1.expect)(lookups).to.deep.equal(['phone-a']);