@xenon-device-management/xenon 2.0.0 → 2.2.0

package/lib/test/unit/hub-node-control-forward.spec.js

@@ -0,0 +1,608 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const sinon_1 = __importDefault(require("sinon"));
+const express_1 = __importDefault(require("express"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
+const jose = __importStar(require("jose"));
+const typedi_1 = require("typedi");
+const control_1 = __importDefault(require("../../src/app/routers/control"));
+const auth_1 = require("../../src/app/routers/auth");
+const authMiddleware_1 = require("../../src/middleware/authMiddleware");
+const csrfMiddleware_1 = require("../../src/middleware/csrfMiddleware");
+const hubSessionToken_1 = require("../../src/gateway/hubSessionToken");
+const JwtKeyService_1 = require("../../src/services/token/JwtKeyService");
+const PluginContext_1 = require("../../src/PluginContext");
+const IPluginArgs_1 = require("../../src/interfaces/IPluginArgs");
+const device_managers_1 = require("../../src/device-managers");
+const device_store_1 = require("../../src/data-service/device-store");
+const prisma_store_1 = require("../../src/data-service/prisma-store");
+const SessionOwnerResolver_1 = require("../../src/services/device-access/SessionOwnerResolver");
+const LiveSessionOwners_1 = require("../../src/services/device-access/LiveSessionOwners");
+const config_1 = require("../../src/config");
+const container_registration_1 = require("../helpers/container-registration");
+const scratch_database_1 = require("../helpers/scratch-database");
+const loopbackServer_1 = require("../helpers/loopbackServer");
+const InspectorService_1 = require("../../src/services/InspectorService");
+const http_1 = __importDefault(require("http"));
+const AndroidStreamService_1 = __importDefault(require("../../src/device-managers/android/AndroidStreamService"));
+const AndroidH264StreamService_1 = __importDefault(require("../../src/device-managers/android/AndroidH264StreamService"));
+/**
+ * A hub forwards five of its /control actions on a node's phone (tap, swipe,
+ * text, keyevent, touchAndHold) to the phone's node. It sent them with no
+ * credential at all, so a node with auth enabled refused every one (its CSRF
+ * check, then its login), and device control of a node's phone only worked
+ * with the node's auth off.
+ *
+ * The hub now signs each forwarded call for the user it acts for: audience
+ * xenon-node-control, one minute, naming the user, whether they are an admin,
+ * the phone and its node. The node accepts it for /control on that phone
+ * only, then runs its own ownership guard with that user, whose session it
+ * knows (LiveSessionOwners).
+ */
+// Named like the real manager: /control picks one by constructor.name.
+// Hub and node share this process, so each call records the server it ran
+// on: an action the hub ran on its own would show up as `hub-1:...`.
+class AndroidDeviceManager {
+    constructor() {
+        this.taps = [];
+        this.calls = [];
+        this.failLogs = false;
+        this.tap = (udid) => __awaiter(this, void 0, void 0, function* () {
+            this.taps.push(udid);
+        });
+        this.getScreenshot = () => __awaiter(this, void 0, void 0, function* () {
+            this.at('getScreenshot');
+            return 'A'.repeat(200);
+        });
+        this.getClipboard = () => __awaiter(this, void 0, void 0, function* () {
+            this.at('getClipboard');
+            return 'copied';
+        });
+        this.setClipboard = () => __awaiter(this, void 0, void 0, function* () { return this.at('setClipboard'); });
+        this.lock = () => __awaiter(this, void 0, void 0, function* () { return this.at('lock'); });
+        this.unlock = () => __awaiter(this, void 0, void 0, function* () { return this.at('unlock'); });
+        this.getDisplayState = () => __awaiter(this, void 0, void 0, function* () {
+            this.at('getDisplayState');
+            return 'on';
+        });
+        this.uninstallApp = () => __awaiter(this, void 0, void 0, function* () { return this.at('uninstallApp'); });
+        this.listApps = () => __awaiter(this, void 0, void 0, function* () {
+            this.at('listApps');
+            return [{ bundleId: 'com.example' }];
+        });
+        this.getLogs = () => __awaiter(this, void 0, void 0, function* () {
+            this.at('getLogs');
+            if (this.failLogs)
+                throw new Error('logcat failed on the node');
+            return 'a log line';
+        });
+        this.executeShell = () => __awaiter(this, void 0, void 0, function* () {
+            this.at('executeShell');
+            return 'uid=2000(shell)';
+        });
+        this.installApp = () => __awaiter(this, void 0, void 0, function* () { return this.at('installApp'); });
+    }
+    at(name) {
+        this.calls.push(`${typedi_1.Container.get(PluginContext_1.PluginContext).nodeId}:${name}`);
+    }
+}
+describe('the hub’s device control on a node’s phone', () => {
+    const scratch = (0, scratch_database_1.useScratchDatabase)();
+    const loopback = (0, loopbackServer_1.loopbackServers)();
+    let dirs;
+    let hubKeys;
+    let manager;
+    let context;
+    let saved;
+    let restore;
+    let hubUrl;
+    let hubApp;
+    let nodeOrigin;
+    let nodePort;
+    let nodeArgs;
+    let nodeRequests;
+    beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        dirs = [fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-control-keys-'))];
+        hubKeys = new JwtKeyService_1.JwtKeyService();
+        yield hubKeys.init(dirs[0]);
+        restore = (0, container_registration_1.saveRegistrations)(JwtKeyService_1.JwtKeyService, hubSessionToken_1.HubSessionTokenIssuer, device_managers_1.XenonManager, SessionOwnerResolver_1.SessionOwnerResolver, LiveSessionOwners_1.LiveSessionOwners, InspectorService_1.InspectorService);
+        typedi_1.Container.set(JwtKeyService_1.JwtKeyService, hubKeys);
+        typedi_1.Container.set(hubSessionToken_1.HubSessionTokenIssuer, new hubSessionToken_1.HubSessionTokenIssuer());
+        typedi_1.Container.set(SessionOwnerResolver_1.SessionOwnerResolver, new SessionOwnerResolver_1.SessionOwnerResolver());
+        typedi_1.Container.set(LiveSessionOwners_1.LiveSessionOwners, new LiveSessionOwners_1.LiveSessionOwners());
+        manager = new AndroidDeviceManager();
+        typedi_1.Container.set(device_managers_1.XenonManager, { deviceInstances: () => __awaiter(void 0, void 0, void 0, function* () { return [manager]; }) });
+        typedi_1.Container.set(InspectorService_1.InspectorService, {
+            getSnapshot: () => __awaiter(void 0, void 0, void 0, function* () {
+                manager.calls.push(`${typedi_1.Container.get(PluginContext_1.PluginContext).nodeId}:getSnapshot`);
+                return { source: '<hierarchy/>' };
+            }),
+        });
+        nodeRequests = [];
+        context = typedi_1.Container.get(PluginContext_1.PluginContext);
+        saved = {
+            context: Object.assign({}, context),
+            store: device_store_1.DeviceStoreFactory._deviceStore,
+            authDisabled: config_1.config.authDisabled,
+        };
+        device_store_1.DeviceStoreFactory._deviceStore = new prisma_store_1.PrismaDeviceStore();
+        config_1.config.authDisabled = false;
+        // The hub: its public keys, and its own /control with a caller named by a header.
+        const hub = (0, express_1.default)();
+        hub.get('/xenon/api/auth/jwks.json', (_req, res) => res.json(hubKeys.jwks()));
+        hubUrl = `http://127.0.0.1:${(yield loopback.serve(hub)).address().port}`;
+        hubApp = (0, express_1.default)();
+        // One process plays both servers, and PluginContext is a singleton: each
+        // app takes its own identity per request, so the hub's forward decision
+        // (the phone's nodeId against this server's) sees the hub, not the node.
+        hubApp.use((_req, _res, next) => {
+            context.setContext(Object.assign(Object.assign({}, IPluginArgs_1.DefaultPluginArgs), { bindHostOrIp: '127.0.0.1' }), 1, 'hub-1', '');
+            next();
+        });
+        hubApp.use(express_1.default.json());
+        hubApp.use((req, _res, next) => {
+            var _a;
+            const user = String((_a = req.headers['x-test-user']) !== null && _a !== void 0 ? _a : '');
+            const admin = user.startsWith('admin-');
+            req.auth = {
+                kind: 'user-session',
+                userId: user,
+                role: admin ? 'ADMIN' : 'MEMBER',
+                scopes: admin ? 'admin,devices,sessions,read' : 'devices,sessions,read',
+                rateLimit: 300,
+                teamIds: undefined,
+            };
+            next();
+        });
+        const hubApi = express_1.default.Router();
+        control_1.default.register(hubApi);
+        hubApp.use('/xenon/api', hubApi);
+        // The node: its CSRF check, its login and its /control, as ServerManager mounts them.
+        const node = (0, express_1.default)();
+        node.use((req, _res, next) => {
+            nodeRequests.push({
+                method: req.method,
+                path: req.path,
+                url: req.originalUrl,
+                headers: Object.assign({}, req.headers),
+            });
+            next();
+        });
+        node.use((_req, _res, next) => {
+            context.setContext(nodeArgs, nodePort, 'node-1', '');
+            next();
+        });
+        node.use(express_1.default.json());
+        const nodeApi = express_1.default.Router();
+        nodeApi.use(csrfMiddleware_1.csrfMiddleware);
+        nodeApi.use(authMiddleware_1.authMiddleware);
+        nodeApi.get('/whoami', (req, res) => res.json(req.auth));
+        control_1.default.register(nodeApi);
+        node.use('/xenon/api', nodeApi);
+        nodePort = (yield loopback.serve(node)).address().port;
+        nodeOrigin = `http://127.0.0.1:${nodePort}`;
+        nodeArgs = Object.assign(Object.assign({}, IPluginArgs_1.DefaultPluginArgs), { hub: hubUrl, bindHostOrIp: '127.0.0.1' });
+        context.setContext(nodeArgs, nodePort, 'node-1', '');
+        yield scratch.db.device.deleteMany({});
+        // alice's session runs on the node's phone.
+        for (const udid of ['phone-1', 'phone-2']) {
+            yield scratch.db.device.create({
+                data: {
+                    udid,
+                    host: nodeOrigin,
+                    nodeId: 'node-1',
+                    platform: 'android',
+                    name: udid,
+                    busy: udid === 'phone-1',
+                    session_id: udid === 'phone-1' ? 's-1' : null,
+                },
+            });
+        }
+        typedi_1.Container.get(LiveSessionOwners_1.LiveSessionOwners).record('s-1', 'alice');
+    }));
+    afterEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        Object.assign(context, saved.context);
+        device_store_1.DeviceStoreFactory._deviceStore = saved.store;
+        config_1.config.authDisabled = saved.authDisabled;
+        sinon_1.default.restore();
+        restore();
+        yield loopback.closeAll();
+        for (const dir of dirs)
+            fs_1.default.rmSync(dir, { recursive: true, force: true });
+    }));
+    const tapThroughHub = (user) => (0, loopbackRequest_1.default)(hubApp)
+        .post('/xenon/api/control/phone-1/tap')
+        .set('x-test-user', user)
+        .send({ x: 10, y: 20 });
+    const controlToken = (grant = {}) => typedi_1.Container.get(hubSessionToken_1.HubSessionTokenIssuer).controlTokenFor(Object.assign({ userId: 'alice', isAdmin: false, udid: 'phone-1', host: nodeOrigin }, grant));
+    const toNode = (method, url, token) => {
+        const req = (0, loopbackRequest_1.default)(nodeOrigin)[method](url);
+        if (token)
+            req.set(hubSessionToken_1.HUB_TOKEN_HEADER, token);
+        return method === 'post' ? req.send({ x: 1, y: 2 }) : req;
+    };
+    it('the owner’s tap through the hub reaches the node’s phone', () => __awaiter(void 0, void 0, void 0, function* () {
+        const res = yield tapThroughHub('alice');
+        (0, chai_1.expect)(res.status, JSON.stringify(res.body)).to.equal(200);
+        (0, chai_1.expect)(manager.taps).to.deep.equal(['phone-1']);
+    }));
+    it('the hub signs the forwarded call for its user, that phone and its node', () => __awaiter(void 0, void 0, void 0, function* () {
+        const seen = [];
+        sinon_1.default.stub(typedi_1.Container.get(hubSessionToken_1.HubSessionTokenIssuer), 'controlTokenFor').callsFake((grant) => __awaiter(void 0, void 0, void 0, function* () {
+            seen.push(JSON.stringify(grant));
+            return hubKeys.sign({ sub: grant.userId, adm: grant.isAdmin, udid: grant.udid, host: grant.host }, { audience: hubSessionToken_1.HUB_CONTROL_AUDIENCE, ttlSeconds: 60 });
+        }));
+        yield tapThroughHub('alice').expect(200);
+        (0, chai_1.expect)(seen.map((g) => JSON.parse(g))).to.deep.equal([
+            { userId: 'alice', isAdmin: false, udid: 'phone-1', host: nodeOrigin },
+        ]);
+    }));
+    it('is a one-minute token /auth/token will never mint', () => __awaiter(void 0, void 0, void 0, function* () {
+        const claims = jose.decodeJwt(yield controlToken());
+        (0, chai_1.expect)(claims.aud).to.equal(hubSessionToken_1.HUB_CONTROL_AUDIENCE);
+        (0, chai_1.expect)(claims.exp - claims.iat).to.equal(60);
+        let refused;
+        yield (0, auth_1.issueToken)({ userId: 'alice', role: 'ADMIN', scopes: 'admin' }, { audience: hubSessionToken_1.HUB_CONTROL_AUDIENCE }).catch((error) => (refused = error));
+        (0, chai_1.expect)(refused === null || refused === void 0 ? void 0 : refused.message).to.include('unsupported audience');
+    }));
+    describe('which actions reach the node', () => {
+        const asAlice = (method, action, body) => {
+            const req = (0, loopbackRequest_1.default)(hubApp)[method](`/xenon/api/control/phone-1/${action}`);
+            req.set('x-test-user', 'alice');
+            return method === 'post' ? req.send(body !== null && body !== void 0 ? body : {}) : req;
+        };
+        const nodeSaw = (action) => nodeRequests.filter((r) => r.path === `/xenon/api/control/phone-1/${action}`);
+        // Each runs on the node and answers with the node's own reply.
+        const FORWARDED = [
+            {
+                method: 'get',
+                action: 'screenshot',
+                call: 'getScreenshot',
+                reply: { screenshot: 'A'.repeat(200) },
+            },
+            { method: 'get', action: 'clipboard', call: 'getClipboard', reply: { content: 'copied' } },
+            {
+                method: 'post',
+                action: 'clipboard',
+                send: { content: 'x' },
+                call: 'setClipboard',
+                reply: { success: true },
+            },
+            { method: 'post', action: 'lock', call: 'lock', reply: { success: true } },
+            { method: 'post', action: 'unlock', call: 'unlock', reply: { success: true } },
+            { method: 'get', action: 'display', call: 'getDisplayState', reply: { state: 'on' } },
+            {
+                method: 'post',
+                action: 'uninstall',
+                send: { bundleId: 'com.example' },
+                call: 'uninstallApp',
+                reply: { success: true },
+            },
+            { method: 'get', action: 'apps', call: 'listApps', reply: [{ bundleId: 'com.example' }] },
+            { method: 'get', action: 'logs', call: 'getLogs', reply: { logs: 'a log line' } },
+            {
+                method: 'post',
+                action: 'shell',
+                send: { command: 'id' },
+                call: 'executeShell',
+                reply: { output: 'uid=2000(shell)' },
+            },
+            {
+                method: 'get',
+                action: 'inspector/snapshot',
+                call: 'getSnapshot',
+                reply: { source: '<hierarchy/>' },
+            },
+        ];
+        for (const { method, action, send, call, reply } of FORWARDED) {
+            it(`${method.toUpperCase()} ${action} runs on the node and answers with the node's reply`, () => __awaiter(void 0, void 0, void 0, function* () {
+                const res = yield asAlice(method, action, send);
+                (0, chai_1.expect)(res.status, JSON.stringify(res.body)).to.equal(200);
+                (0, chai_1.expect)(res.body).to.deep.equal(reply);
+                (0, chai_1.expect)(manager.calls).to.deep.equal([`node-1:${call}`]);
+                (0, chai_1.expect)(nodeSaw(action)).to.have.length(1);
+            }));
+        }
+        it('relays the node’s own error answer unchanged, sent once', () => __awaiter(void 0, void 0, void 0, function* () {
+            manager.failLogs = true;
+            const res = yield asAlice('get', 'logs');
+            (0, chai_1.expect)(res.status).to.equal(500);
+            (0, chai_1.expect)(res.body).to.deep.equal({ error: 'logcat failed on the node' });
+            (0, chai_1.expect)(nodeSaw('logs')).to.have.length(1);
+        }));
+        it('sends the node none of the caller’s credentials, only its own token', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield (0, loopbackRequest_1.default)(hubApp)
+                .post('/xenon/api/control/phone-1/lock')
+                .set('x-test-user', 'alice')
+                .set('cookie', 'xenon_dashboard_session=secret-session')
+                .set('authorization', 'Bearer secret-jwt')
+                .set('x-xenon-access-key', 'secret-key')
+                .set('x-xenon-token', 'secret-token')
+                .send({})
+                .expect(200);
+            const [sent] = nodeSaw('lock');
+            for (const name of [
+                'cookie',
+                'authorization',
+                'x-xenon-access-key',
+                'x-xenon-token',
+                'x-test-user',
+            ]) {
+                (0, chai_1.expect)(sent.headers, name).to.not.have.property(name);
+            }
+            (0, chai_1.expect)(sent.headers[hubSessionToken_1.HUB_TOKEN_HEADER]).to.be.a('string');
+        }));
+        it('answers appium-session itself: the session is routed through the hub', () => __awaiter(void 0, void 0, void 0, function* () {
+            const res = yield asAlice('get', 'appium-session');
+            (0, chai_1.expect)(res.status).to.equal(200);
+            (0, chai_1.expect)(res.body).to.include({ status: 'success', sessionId: 's-1' });
+            (0, chai_1.expect)(nodeSaw('appium-session')).to.have.length(0);
+        }));
+        // Not passed on yet: uploads need a relayed body, an app from the hub's
+        // library isn't on the node, and a path is a path on one machine.
+        // Omni's AI settings are the hub's. Anything added later is refused the
+        // same way until it is on the list.
+        const REFUSED = [
+            ['post', 'install', { appPath: '/tmp/app.apk' }],
+            ['post', 'install-repository-app', { appId: 'app-1' }],
+            ['post', 'upload-install'],
+            ['get', 'omni-scan'],
+            ['post', 'test-locator', { strategy: '-custom:ai-text', selector: 'OK' }],
+            ['post', 'an-action-added-later'],
+        ];
+        describe('the live preview', () => {
+            // phone-2 is free: a preview holds it on the node.
+            const preview = (method, action) => {
+                const req = (0, loopbackRequest_1.default)(hubApp)[method](`/xenon/api/control/phone-2/${action}`);
+                req.set('x-test-user', 'alice');
+                return method === 'post' ? req.send({}) : req;
+            };
+            const nodeSawPreview = (action) => nodeRequests.filter((r) => r.path === `/xenon/api/control/phone-2/${action}`);
+            let started;
+            let stopped;
+            let mjpegPort;
+            beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+                started = [];
+                stopped = [];
+                // The camera the node's MJPEG fan-out reads: a frame every 50 ms.
+                const camera = (0, express_1.default)();
+                camera.get('/', (_req, res) => {
+                    res.writeHead(200, { 'content-type': 'multipart/x-mixed-replace; boundary=f' });
+                    const timer = setInterval(() => res.write('--f\r\nFAKE-JPEG-FRAME\r\n'), 50);
+                    res.on('close', () => clearInterval(timer));
+                });
+                mjpegPort = (yield loopback.serve(camera)).address().port;
+                const mjpeg = typedi_1.Container.get(AndroidStreamService_1.default);
+                const h264 = typedi_1.Container.get(AndroidH264StreamService_1.default);
+                const where = () => typedi_1.Container.get(PluginContext_1.PluginContext).nodeId;
+                sinon_1.default.stub(mjpeg, 'startStream').callsFake((udid) => __awaiter(void 0, void 0, void 0, function* () {
+                    started.push(`${where()}:${udid}`);
+                    return { mjpegPort };
+                }));
+                sinon_1.default.stub(mjpeg, 'stopStream').callsFake((udid) => __awaiter(void 0, void 0, void 0, function* () {
+                    stopped.push(`${where()}:${udid}`);
+                }));
+                sinon_1.default.stub(mjpeg, 'getStreamStatus').returns(undefined);
+                sinon_1.default.stub(mjpeg, 'updateViewerCount');
+                sinon_1.default.stub(h264, 'stop').resolves();
+                sinon_1.default.stub(h264, 'getMultiplexer').returns(undefined);
+            }));
+            it('starts on the node, which holds the phone, and the hub marks it busy for the node at once', () => __awaiter(void 0, void 0, void 0, function* () {
+                const res = yield preview('post', 'stream/start');
+                (0, chai_1.expect)(res.status, JSON.stringify(res.body)).to.equal(200);
+                (0, chai_1.expect)(res.body).to.include({ success: true, type: 'mjpeg' });
+                (0, chai_1.expect)(started).to.deep.equal(['node-1:phone-2']);
+                const row = yield scratch.db.device.findFirst({ where: { udid: 'phone-2' } });
+                (0, chai_1.expect)(row === null || row === void 0 ? void 0 : row.session_id).to.equal('manual_alice_phone-2');
+                (0, chai_1.expect)(row === null || row === void 0 ? void 0 : row.nodeBusy).to.equal(true);
+                (0, chai_1.expect)(row === null || row === void 0 ? void 0 : row.busy).to.equal(true);
+            }));
+            it('status, leave and stop are the node’s answers', () => __awaiter(void 0, void 0, void 0, function* () {
+                yield preview('post', 'stream/start').expect(200);
+                const status = yield preview('get', 'stream/status');
+                (0, chai_1.expect)(status.status).to.equal(200);
+                (0, chai_1.expect)(status.body).to.include({ udid: 'phone-2', status: 'stopped' });
+                yield preview('post', 'stream/leave').expect(202);
+                yield preview('post', 'stream/stop').expect(200);
+                (0, chai_1.expect)(stopped).to.deep.equal(['node-1:phone-2']);
+                for (const action of ['stream/status', 'stream/leave', 'stream/stop']) {
+                    (0, chai_1.expect)(nodeSawPreview(action), action).to.have.length(1);
+                }
+            }));
+            it('mints the viewer’s ticket here, where the team check ran', () => __awaiter(void 0, void 0, void 0, function* () {
+                const res = yield preview('post', 'stream/ticket');
+                (0, chai_1.expect)(res.status).to.equal(200);
+                (0, chai_1.expect)(res.body.ticket).to.be.a('string');
+                (0, chai_1.expect)(nodeSawPreview('stream/ticket')).to.have.length(0);
+            }));
+            it('relays the node’s MJPEG stream to the viewer, without the viewer’s ticket', () => __awaiter(void 0, void 0, void 0, function* () {
+                const hubPort = (yield loopback.serve(hubApp)).address().port;
+                const got = yield new Promise((resolve, reject) => {
+                    const req = http_1.default.get({
+                        host: '127.0.0.1',
+                        port: hubPort,
+                        path: '/xenon/api/control/phone-2/stream?ticket=spent&t=1',
+                        headers: { 'x-test-user': 'alice' },
+                    }, (res) => {
+                        let body = '';
+                        res.on('data', (chunk) => {
+                            body += chunk.toString();
+                            if (body.split('FAKE-JPEG-FRAME').length > 3) {
+                                req.destroy();
+                                resolve({ type: String(res.headers['content-type']), body });
+                            }
+                        });
+                    });
+                    req.on('error', (e) => (e.code === 'ECONNRESET' ? undefined : reject(e)));
+                });
+                (0, chai_1.expect)(got.type).to.include('multipart/x-mixed-replace');
+                (0, chai_1.expect)(started).to.deep.equal(['node-1:phone-2']);
+                (0, chai_1.expect)(nodeSawPreview('stream').map((r) => r.url)).to.deep.equal([
+                    '/xenon/api/control/phone-2/stream?t=1',
+                ]);
+                yield preview('post', 'stream/stop').expect(200);
+            }));
+        });
+        it('refuses the rest, naming the node, and runs none of it on the hub', () => __awaiter(void 0, void 0, void 0, function* () {
+            for (const [method, action, body] of REFUSED) {
+                const res = yield asAlice(method, action, body);
+                (0, chai_1.expect)(res.status, `${method} ${action}`).to.equal(501);
+                (0, chai_1.expect)(res.body.error, `${method} ${action}`).to.equal('not_available_through_hub');
+                (0, chai_1.expect)(res.body.message, `${method} ${action}`).to.include(nodeOrigin);
+            }
+            (0, chai_1.expect)(nodeRequests).to.have.length(0);
+            (0, chai_1.expect)(manager.calls).to.deep.equal([]);
+        }));
+        it('sends nothing to a cloud provider’s phone', () => __awaiter(void 0, void 0, void 0, function* () {
+            const provider = (0, express_1.default)();
+            let reached = 0;
+            provider.use((_req, res) => {
+                reached++;
+                res.status(200).json({});
+            });
+            const providerOrigin = `http://127.0.0.1:${(yield loopback.serve(provider)).address().port}`;
+            yield scratch.db.device.create({
+                data: {
+                    udid: 'cloud-1',
+                    host: providerOrigin,
+                    platform: 'android',
+                    name: 'cloud-1',
+                    cloud: JSON.stringify({ cloudName: 'example-cloud' }),
+                },
+            });
+            for (const [method, action, body] of [
+                ['post', 'tap', { x: 1, y: 2 }],
+                ['get', 'screenshot'],
+                ['post', 'text', { text: 'a secret' }],
+            ]) {
+                const req = (0, loopbackRequest_1.default)(hubApp)[method](`/xenon/api/control/cloud-1/${action}`)
+                    .set('x-test-user', 'alice');
+                const res = yield (method === 'post' ? req.send(body !== null && body !== void 0 ? body : {}) : req);
+                (0, chai_1.expect)(res.status, action).to.equal(501);
+                (0, chai_1.expect)(res.body.error, action).to.equal('not_available_for_cloud_phone');
+            }
+            (0, chai_1.expect)(reached).to.equal(0);
+            (0, chai_1.expect)(manager.taps).to.deep.equal([]);
+        }));
+        it('a node that can’t be reached: 502, naming the node', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield scratch.db.device.create({
+                data: {
+                    udid: 'gone-1',
+                    host: 'http://127.0.0.1:1',
+                    nodeId: 'node-2',
+                    platform: 'android',
+                    name: 'gone-1',
+                },
+            });
+            const res = yield (0, loopbackRequest_1.default)(hubApp)
+                .get('/xenon/api/control/gone-1/screenshot')
+                .set('x-test-user', 'alice');
+            (0, chai_1.expect)(res.status).to.equal(502);
+            (0, chai_1.expect)(res.body.error).to.equal('node_unreachable');
+            (0, chai_1.expect)(res.body.message).to.include('http://127.0.0.1:1');
+            (0, chai_1.expect)(manager.calls).to.deep.equal([]);
+        }));
+    });
+    describe('on the node', () => {
+        it('the node’s own ownership guard judges the user the hub named', () => __awaiter(void 0, void 0, void 0, function* () {
+            const asBob = yield controlToken({ userId: 'bob' });
+            const bob = yield toNode('post', '/xenon/api/control/phone-1/tap', asBob);
+            (0, chai_1.expect)(bob.status).to.equal(409);
+            (0, chai_1.expect)(bob.body.error).to.equal('device_in_use_by_session');
+            const admin = yield controlToken({ userId: 'admin-carol', isAdmin: true });
+            yield toNode('post', '/xenon/api/control/phone-1/tap', admin).expect(200);
+            (0, chai_1.expect)(manager.taps).to.deep.equal(['phone-1']);
+        }));
+        it('is accepted for that phone’s /control only', () => __awaiter(void 0, void 0, void 0, function* () {
+            const token = yield controlToken();
+            const otherPhone = yield toNode('post', '/xenon/api/control/phone-2/tap', token);
+            (0, chai_1.expect)(otherPhone.status).to.equal(401);
+            const notControl = yield toNode('get', '/xenon/api/whoami', token);
+            (0, chai_1.expect)(notControl.status).to.equal(401);
+            (0, chai_1.expect)(manager.taps).to.deep.equal([]);
+        }));
+        it('is refused when it names another node, or is another kind of hub token', () => __awaiter(void 0, void 0, void 0, function* () {
+            const issuer = typedi_1.Container.get(hubSessionToken_1.HubSessionTokenIssuer);
+            const tokens = [
+                yield controlToken({ host: 'http://10.9.9.9:4725' }),
+                (yield issuer.tokenFor('s-1')),
+                (yield issuer.createTokenFor({
+                    userId: 'alice',
+                    udid: 'phone-1',
+                    host: nodeOrigin,
+                })),
+                yield hubKeys.sign({ sub: 'alice', adm: false, udid: 'phone-1', host: nodeOrigin }, { audience: hubSessionToken_1.HUB_CONTROL_AUDIENCE, ttlSeconds: -3600 }),
+                'not-a-jwt',
+            ];
+            for (const token of tokens) {
+                const res = yield toNode('post', '/xenon/api/control/phone-1/tap', token);
+                (0, chai_1.expect)(res.status, token.slice(0, 20)).to.equal(401);
+            }
+            (0, chai_1.expect)(manager.taps).to.deep.equal([]);
+        }));
+        it('cannot be checked while the hub’s keys cannot be fetched: 503', () => __awaiter(void 0, void 0, void 0, function* () {
+            const token = yield controlToken();
+            nodeArgs = Object.assign(Object.assign({}, nodeArgs), { hub: 'http://127.0.0.1:1' });
+            const res = yield toNode('post', '/xenon/api/control/phone-1/tap', token);
+            (0, chai_1.expect)(res.status).to.equal(503);
+            (0, chai_1.expect)(manager.taps).to.deep.equal([]);
+        }));
+        it('a server that is not a node ignores it', () => __awaiter(void 0, void 0, void 0, function* () {
+            const token = yield controlToken();
+            nodeArgs = Object.assign(Object.assign({}, nodeArgs), { hub: undefined });
+            const res = yield toNode('post', '/xenon/api/control/phone-1/tap', token);
+            (0, chai_1.expect)(res.status).to.not.equal(200);
+            (0, chai_1.expect)(manager.taps).to.deep.equal([]);
+        }));
+    });
+});