@xenon-device-management/xenon 2.0.0 → 2.2.0

package/lib/test/unit/hub-node-gateway-appium-server.spec.js

@@ -0,0 +1,594 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const fs_1 = __importDefault(require("fs"));
+const http_1 = __importDefault(require("http"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const sinon_1 = __importDefault(require("sinon"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
+const jose = __importStar(require("jose"));
+const typedi_1 = require("typedi");
+const commandCaller_1 = require("../../src/middleware/commandCaller");
+const commandAuth_1 = require("../../src/middleware/commandAuth");
+const registerCommandAuth_1 = require("../../src/app/registerCommandAuth");
+const insertBeforeRoutes_1 = require("../../src/app/insertBeforeRoutes");
+const JwtKeyService_1 = require("../../src/services/token/JwtKeyService");
+const SessionLifecycleService_1 = require("../../src/services/SessionLifecycleService");
+const SessionOwnerResolver_1 = require("../../src/services/device-access/SessionOwnerResolver");
+const device_store_1 = require("../../src/data-service/device-store");
+const prisma_store_1 = require("../../src/data-service/prisma-store");
+const SessionManager_1 = require("../../src/sessions/SessionManager");
+const RemoteSession_1 = require("../../src/sessions/RemoteSession");
+const event_manager_1 = require("../../src/dashboard/event-manager");
+const hubSessionToken_1 = require("../../src/gateway/hubSessionToken");
+const internalCall_1 = require("../../src/gateway/internalCall");
+const nodeWebDriverUrl_1 = require("../../src/gateway/nodeWebDriverUrl");
+const defaultGateway_1 = require("../../src/gateway/defaultGateway");
+const container_registration_1 = require("../helpers/container-registration");
+const scratch_database_1 = require("../helpers/scratch-database");
+/**
+ * A Xenon hub and a Xenon node, each in Appium 3's own server() (Express 5,
+ * Appium's middleware, its WebDriver routes, the plugin updaters, then its
+ * catch-all 404), with the session gateway installed by the production wiring
+ * (hubGatewayOptions / nodeGatewayOptions), over a scratch SQLite database.
+ *
+ * Each server's driver is a fake that records the commands that reach it,
+ * which is how these tests show where a command went: a remote session's
+ * command must reach the node's driver and never the hub's.
+ */
+function appiumDir() {
+    return path_1.default.dirname(require.resolve('appium/package.json'));
+}
+function appiumBaseDriver() {
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    return require(require.resolve('@appium/base-driver', { paths: [appiumDir()] }));
+}
+const quiet = {
+    debug: () => undefined,
+    info: () => undefined,
+    warn: () => undefined,
+    error: () => undefined,
+};
+const EXACT_UNKNOWN_SESSION = JSON.stringify(commandAuth_1.UNKNOWN_SESSION_BODY);
+// A route only a driver defines (UiAutomator2 does): the node has it, the hub
+// has no driver and does not. The gateway must not need the hub to have it.
+const DRIVER_ROUTES = {
+    '/session/:sessionId/appium/stop_recording_screen': {
+        POST: { command: 'stopRecordingScreen', payloadParams: { optional: ['options'] } },
+    },
+};
+function fakeDriver(name) {
+    const { errors } = appiumBaseDriver();
+    const commands = [];
+    const sessions = new Set();
+    const driver = {
+        log: quiet,
+        protocol: 'W3C',
+        sessionExists: (id) => sessions.has(id),
+        proxyActive: () => false,
+        canProxy: () => false,
+        proxyRouteIsAvoided: () => false,
+        executeCommand: (command, ...args) => __awaiter(this, void 0, void 0, function* () {
+            commands.push(command);
+            if (command === 'getUrl')
+                return `https://${name}.example/`;
+            if (command === 'findElement') {
+                if (args[1] === 'missing')
+                    throw new errors.NoSuchElementError();
+                return { 'element-6066-11e4-a52e-4f735466cecf': `${name}-el` };
+            }
+            if (command === 'stopRecordingScreen')
+                return 'node-video.mp4';
+            if (command === 'deleteSession') {
+                sessions.delete(args[0]);
+                return null;
+            }
+            return null;
+        }),
+    };
+    return { commands, sessions, driver };
+}
+describe('the session gateway between a hub and a node, in Appium 3’s own server()', function () {
+    this.timeout(60000);
+    const scratch = (0, scratch_database_1.useScratchDatabase)();
+    const servers = [];
+    let keyDir;
+    let hubKeys;
+    let restore;
+    let savedStore;
+    let hub;
+    let node;
+    let hubUrl;
+    let nodeOrigin;
+    let nodeRequests;
+    let refusals;
+    let stamp = 0;
+    // Appium's HTTP logger writes every request to stdout; quiet it here only.
+    let appiumLog;
+    let appiumLogLevel;
+    before(() => __awaiter(this, void 0, void 0, function* () {
+        appiumBaseDriver();
+        const support = require.resolve('@appium/support', { paths: [appiumDir()] });
+        // eslint-disable-next-line @typescript-eslint/no-var-requires
+        const log = require(require.resolve('@appium/logger', { paths: [support] })).default;
+        appiumLog = log;
+        appiumLogLevel = log.level;
+        log.level = 'silent';
+        keyDir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-gateway-keys-'));
+        hubKeys = new JwtKeyService_1.JwtKeyService();
+        yield hubKeys.init(keyDir);
+    }));
+    after(() => {
+        if (appiumLog && appiumLogLevel)
+            appiumLog.level = appiumLogLevel;
+        fs_1.default.rmSync(keyDir, { recursive: true, force: true });
+    });
+    beforeEach(() => __awaiter(this, void 0, void 0, function* () {
+        restore = (0, container_registration_1.saveRegistrations)(JwtKeyService_1.JwtKeyService, hubSessionToken_1.HubSessionTokenIssuer, nodeWebDriverUrl_1.NodeBasePathResolver, SessionOwnerResolver_1.SessionOwnerResolver);
+        typedi_1.Container.set(JwtKeyService_1.JwtKeyService, hubKeys);
+        typedi_1.Container.set(hubSessionToken_1.HubSessionTokenIssuer, new hubSessionToken_1.HubSessionTokenIssuer());
+        typedi_1.Container.set(nodeWebDriverUrl_1.NodeBasePathResolver, new nodeWebDriverUrl_1.NodeBasePathResolver());
+        typedi_1.Container.set(SessionOwnerResolver_1.SessionOwnerResolver, new SessionOwnerResolver_1.SessionOwnerResolver());
+        savedStore = device_store_1.DeviceStoreFactory._deviceStore;
+        device_store_1.DeviceStoreFactory._deviceStore = new prisma_store_1.PrismaDeviceStore();
+        yield scratch.db.session.deleteMany({});
+        yield scratch.db.device.deleteMany({});
+        nodeRequests = [];
+        refusals = [];
+        stamp++;
+    }));
+    afterEach(() => __awaiter(this, void 0, void 0, function* () {
+        for (const s of SessionManager_1.SESSION_MANAGER.getAllSessions())
+            SessionManager_1.SESSION_MANAGER.removeSession(s.getId());
+        device_store_1.DeviceStoreFactory._deviceStore = savedStore;
+        sinon_1.default.restore();
+        restore();
+        for (const s of servers.splice(0)) {
+            s.closeAllConnections();
+            yield new Promise((resolve) => http_1.default.Server.prototype.close.call(s, () => resolve()));
+        }
+    }));
+    const port = (s) => s.address().port;
+    /** Credentials a client may present: alice's and bob's keys. */
+    function verifier() {
+        const users = { 'alice-token': 'alice', 'bob-token': 'bob' };
+        return new commandCaller_1.CommandCallerVerifier({
+            verifyKeyPair: (_ak, token) => __awaiter(this, void 0, void 0, function* () {
+                return users[token]
+                    ? {
+                        row: {
+                            id: `key-${users[token]}`,
+                            userId: users[token],
+                            scopes: 'sessions',
+                            expiresAt: null,
+                        },
+                        user: { id: users[token], role: 'MEMBER', status: 'ACTIVE' },
+                    }
+                    : null;
+            }),
+            verifyBearer: () => __awaiter(this, void 0, void 0, function* () { return null; }),
+        });
+    }
+    const as = (who) => ({
+        'x-xenon-access-key': `ak-${who}`,
+        'x-xenon-token': `${who}-token`,
+    });
+    function boot() {
+        return __awaiter(this, arguments, void 0, function* (opts = {}) {
+            var _a;
+            const baseDriver = appiumBaseDriver();
+            const nodeBase = (_a = opts.nodeBase) !== null && _a !== void 0 ? _a : '/node';
+            const authLogger = {
+                info: () => undefined,
+                warn: (m) => refusals.push(m),
+                error: () => undefined,
+            };
+            hub = fakeDriver('hub');
+            const hubServer = yield baseDriver.server({
+                routeConfiguringFunction: baseDriver.routeConfiguringFunction(hub.driver),
+                port: 0,
+                hostname: '127.0.0.1',
+                basePath: '/wd/hub',
+                cliArgs: { basePath: '/wd/hub' },
+                serverUpdaters: [
+                    (app) => {
+                        app.get('/xenon/api/auth/jwks.json', (_req, res) => res.json(hubKeys.jwks()));
+                        (0, registerCommandAuth_1.registerSessionGateway)(app, { basePath: '/wd/hub' }, (0, registerCommandAuth_1.commandAuthDeps)({
+                            enabled: () => !!opts.hubAuth,
+                            authDisabled: () => false,
+                            verifier: verifier(),
+                            logger: authLogger,
+                        }), (0, defaultGateway_1.hubGatewayOptions)({
+                            basePath: '/wd/hub',
+                            isLocalHost: (host) => host === hubUrl,
+                            nodeId: () => 'hub-node-id',
+                            dashboard: () => !!opts.dashboard,
+                        }));
+                    },
+                ],
+            });
+            servers.push(hubServer);
+            hubUrl = `http://127.0.0.1:${port(hubServer)}`;
+            node = fakeDriver('node');
+            const nodeServer = yield baseDriver.server({
+                routeConfiguringFunction: baseDriver.routeConfiguringFunction(node.driver),
+                port: 0,
+                hostname: '127.0.0.1',
+                basePath: nodeBase,
+                extraMethodMap: DRIVER_ROUTES,
+                cliArgs: { basePath: nodeBase },
+                serverUpdaters: [
+                    (app) => {
+                        // What reaches the node, headers and all (placed first).
+                        (0, insertBeforeRoutes_1.insertBeforeRoutes)(app, '/', (req, _res, next) => {
+                            if (!req.url.startsWith('/xenon/'))
+                                nodeRequests.push({ url: req.url, headers: Object.assign({}, req.headers) });
+                            next();
+                        });
+                        if (opts.advertise !== false) {
+                            app.get(nodeWebDriverUrl_1.WEBDRIVER_INFO_PATH, (0, nodeWebDriverUrl_1.webdriverInfoHandler)(() => nodeBase));
+                        }
+                        (0, registerCommandAuth_1.registerSessionGateway)(app, { basePath: nodeBase }, (0, registerCommandAuth_1.commandAuthDeps)({
+                            enabled: () => !!opts.nodeAuth,
+                            authDisabled: () => false,
+                            verifier: verifier(),
+                            ownerOf: () => __awaiter(this, void 0, void 0, function* () { return null; }), // the node's own database knows no owner
+                            logger: authLogger,
+                        }), (0, defaultGateway_1.nodeGatewayOptions)(hubUrl));
+                    },
+                ],
+            });
+            servers.push(nodeServer);
+            nodeOrigin = `http://127.0.0.1:${port(nodeServer)}`;
+            return { hub: hubServer, node: nodeServer, nodeBase };
+        });
+    }
+    /** A session running on the node, as the hub records it. */
+    function remoteSession() {
+        return __awaiter(this, arguments, void 0, function* (opts = {}) {
+            var _a;
+            const id = `node-session-${stamp}`;
+            node.sessions.add(id);
+            yield scratch.db.device.create({
+                data: {
+                    udid: `phone-${stamp}`,
+                    host: nodeOrigin,
+                    nodeId: 'node-1',
+                    platform: 'android',
+                    busy: true,
+                    session_id: id,
+                    sessionStartTime: Date.now(),
+                },
+            });
+            yield scratch.db.session.create({
+                data: {
+                    id,
+                    desired_capabilities: '{}',
+                    session_capabilities: '{}',
+                    node_id: 'node-1',
+                    has_live_video: false,
+                    device_udid: `phone-${stamp}`,
+                    device_platform: 'android',
+                    device_version: '14',
+                    user_id: (_a = opts.owner) !== null && _a !== void 0 ? _a : 'alice',
+                },
+            });
+            let session;
+            if (opts.registered !== false) {
+                const resolver = typedi_1.Container.get(nodeWebDriverUrl_1.NodeBasePathResolver);
+                const base = yield resolver.resolve(nodeOrigin, '/wd/hub');
+                session = new RemoteSession_1.RemoteSession({
+                    sessionId: id,
+                    device: {
+                        udid: `phone-${stamp}`,
+                        host: nodeOrigin,
+                        nodeId: 'node-1',
+                        platform: 'android',
+                    },
+                    sessionResponse: {},
+                    xenonOption: {},
+                    baseUrl: `${nodeOrigin}${base}`,
+                });
+                SessionManager_1.SESSION_MANAGER.addSession(id, session);
+            }
+            return { id, session };
+        });
+    }
+    describe('forwarding', () => {
+        it("a remote session's command reaches the node and its answer comes back; the hub's driver never sees it", () => __awaiter(this, void 0, void 0, function* () {
+            yield boot({ nodeAuth: true });
+            const { id } = yield remoteSession();
+            const res = yield (0, loopbackRequest_1.default)(hubUrl).get(`/wd/hub/session/${id}/url`).set(as('alice'));
+            (0, chai_1.expect)(res.status).to.equal(200);
+            (0, chai_1.expect)(res.headers['content-type']).to.equal('application/json; charset=utf-8');
+            (0, chai_1.expect)(res.body).to.deep.equal({ value: 'https://node.example/' });
+            (0, chai_1.expect)(node.commands).to.deep.equal(['getUrl']);
+            (0, chai_1.expect)(hub.commands).to.deep.equal([]);
+            // Under the node's own base path, with the hub's token and not the client's key.
+            (0, chai_1.expect)(nodeRequests.map((r) => r.url)).to.deep.equal([`/node/session/${id}/url`]);
+            const sent = nodeRequests[0].headers;
+            (0, chai_1.expect)(sent['x-xenon-access-key']).to.equal(undefined);
+            (0, chai_1.expect)(sent['x-xenon-token']).to.equal(undefined);
+            const claims = jose.decodeJwt(String(sent[hubSessionToken_1.HUB_TOKEN_HEADER]));
+            (0, chai_1.expect)(claims).to.include({ aud: hubSessionToken_1.HUB_TOKEN_AUDIENCE, sid: id });
+        }));
+        it("relays a body, the node's error status and its error body unchanged", () => __awaiter(this, void 0, void 0, function* () {
+            yield boot({ nodeAuth: true });
+            const { id } = yield remoteSession();
+            const found = yield (0, loopbackRequest_1.default)(hubUrl)
+                .post(`/wd/hub/session/${id}/element`)
+                .send({ using: 'id', value: 'login' });
+            (0, chai_1.expect)(found.status).to.equal(200);
+            (0, chai_1.expect)(found.body.value).to.deep.include({
+                'element-6066-11e4-a52e-4f735466cecf': 'node-el',
+            });
+            const missing = yield (0, loopbackRequest_1.default)(hubUrl)
+                .post(`/wd/hub/session/${id}/element`)
+                .send({ using: 'id', value: 'missing' });
+            (0, chai_1.expect)(missing.status).to.equal(404);
+            (0, chai_1.expect)(missing.body.value.error).to.equal('no such element');
+            (0, chai_1.expect)(node.commands).to.deep.equal(['findElement', 'findElement']);
+            (0, chai_1.expect)(hub.commands).to.deep.equal([]);
+        }));
+        it('forwards a driver-only route the hub has no route for', () => __awaiter(this, void 0, void 0, function* () {
+            yield boot({ nodeAuth: true });
+            const { id } = yield remoteSession();
+            const res = yield (0, loopbackRequest_1.default)(hubUrl)
+                .post(`/wd/hub/session/${id}/appium/stop_recording_screen`)
+                .send({});
+            (0, chai_1.expect)(res.status).to.equal(200);
+            (0, chai_1.expect)(res.body).to.deep.equal({ value: 'node-video.mp4' });
+            (0, chai_1.expect)(node.commands).to.deep.equal(['stopRecordingScreen']);
+        }));
+        it('matches the path as the routes do, in any letter case', () => __awaiter(this, void 0, void 0, function* () {
+            yield boot({ nodeAuth: true });
+            const { id } = yield remoteSession();
+            yield (0, loopbackRequest_1.default)(hubUrl).get(`/WD/HUB/SESSION/${id}/url`).expect(200);
+            (0, chai_1.expect)(node.commands).to.deep.equal(['getUrl']);
+            (0, chai_1.expect)(nodeRequests.map((r) => r.url)).to.deep.equal([`/node/session/${id}/url`]);
+        }));
+        it('keeps the dashboard’s command hooks for a registered remote session', () => __awaiter(this, void 0, void 0, function* () {
+            yield boot({ dashboard: true });
+            const { id } = yield remoteSession();
+            const before = sinon_1.default.stub(event_manager_1.DASHBORD_EVENT_MANAGER, 'beforeSessionCommand').resolves(true);
+            const after = sinon_1.default.stub(event_manager_1.DASHBORD_EVENT_MANAGER, 'afterSessionCommand').resolves();
+            yield (0, loopbackRequest_1.default)(hubUrl).get(`/wd/hub/session/${id}/url`).expect(200);
+            (0, chai_1.expect)(before.firstCall.args.slice(0, 2)).to.deep.equal([id, 'getUrl']);
+            (0, chai_1.expect)(after.firstCall.args[1]).to.equal('getUrl');
+            (0, chai_1.expect)(JSON.parse(after.firstCall.args[5])).to.deep.equal({ value: 'https://node.example/' });
+        }));
+        it('answers a node that cannot be reached with a WebDriver error', () => __awaiter(this, void 0, void 0, function* () {
+            yield boot();
+            const { id } = yield remoteSession();
+            yield new Promise((resolve) => {
+                const s = servers[1];
+                s.closeAllConnections();
+                http_1.default.Server.prototype.close.call(s, () => resolve());
+            });
+            const res = yield (0, loopbackRequest_1.default)(hubUrl).get(`/wd/hub/session/${id}/url`);
+            (0, chai_1.expect)(res.status).to.equal(500);
+            (0, chai_1.expect)(res.body.value.error).to.equal('unknown error');
+            (0, chai_1.expect)(hub.commands).to.deep.equal([]);
+        }));
+    });
+    describe('DELETE of a remote session', () => {
+        it('runs the session lifecycle with the forward as its driver step', () => __awaiter(this, void 0, void 0, function* () {
+            yield boot({ nodeAuth: true });
+            const { id, session } = yield remoteSession();
+            session.isVideoAvailable = true; // recording, as startVideoRecording leaves it
+            const lifecycle = sinon_1.default.spy(typedi_1.Container.get(SessionLifecycleService_1.SessionLifecycleService), 'deleteSession');
+            const stopped = sinon_1.default.stub(event_manager_1.DASHBORD_EVENT_MANAGER, 'onSessionStopped').resolves();
+            const res = yield (0, loopbackRequest_1.default)(hubUrl).delete(`/wd/hub/session/${id}`);
+            (0, chai_1.expect)(res.status).to.equal(200);
+            (0, chai_1.expect)(res.body).to.deep.equal({ value: null });
+            (0, chai_1.expect)(lifecycle.calledOnce).to.equal(true);
+            (0, chai_1.expect)(lifecycle.firstCall.args[1]).to.equal(id);
+            // The node's video is fetched while the session still exists, then it is deleted.
+            (0, chai_1.expect)(node.commands).to.deep.equal(['stopRecordingScreen', 'deleteSession']);
+            (0, chai_1.expect)(hub.commands).to.deep.equal([]);
+            (0, chai_1.expect)(stopped.calledWith(id)).to.equal(true);
+            (0, chai_1.expect)(SessionManager_1.SESSION_MANAGER.getSession(id)).to.equal(undefined);
+            const phone = yield scratch.db.device.findFirst({ where: { udid: `phone-${stamp}` } });
+            (0, chai_1.expect)(phone).to.include({ busy: false, session_id: null });
+            const row = yield scratch.db.session.findUnique({ where: { id } });
+            (0, chai_1.expect)(row === null || row === void 0 ? void 0 : row.video_recording).to.equal('node-video.mp4');
+        }));
+        it('treats DELETE of a sub-resource as an ordinary command', () => __awaiter(this, void 0, void 0, function* () {
+            yield boot();
+            const { id } = yield remoteSession();
+            const lifecycle = sinon_1.default.spy(typedi_1.Container.get(SessionLifecycleService_1.SessionLifecycleService), 'deleteSession');
+            yield (0, loopbackRequest_1.default)(hubUrl).delete(`/wd/hub/session/${id}/cookie`);
+            (0, chai_1.expect)(lifecycle.called).to.equal(false);
+            (0, chai_1.expect)(nodeRequests.map((r) => r.url)).to.deep.equal([`/node/session/${id}/cookie`]);
+            (0, chai_1.expect)(SessionManager_1.SESSION_MANAGER.getSession(id)).to.not.equal(undefined);
+        }));
+    });
+    describe('after a hub restart (the session only in the database)', () => {
+        it('routes from the Session row and the phone’s row, under the node’s own base path', () => __awaiter(this, void 0, void 0, function* () {
+            yield boot({ nodeAuth: true, nodeBase: '' });
+            const { id } = yield remoteSession({ registered: false });
+            (0, chai_1.expect)(SessionManager_1.SESSION_MANAGER.getSession(id)).to.equal(undefined);
+            const res = yield (0, loopbackRequest_1.default)(hubUrl).get(`/wd/hub/session/${id}/url`);
+            (0, chai_1.expect)(res.status).to.equal(200);
+            (0, chai_1.expect)(res.body).to.deep.equal({ value: 'https://node.example/' });
+            (0, chai_1.expect)(nodeRequests.map((r) => r.url)).to.deep.equal([`/session/${id}/url`]);
+            (0, chai_1.expect)(hub.commands).to.deep.equal([]);
+        }));
+        it('and its DELETE still forwards and frees the phone', () => __awaiter(this, void 0, void 0, function* () {
+            yield boot({ nodeAuth: true });
+            const { id } = yield remoteSession({ registered: false });
+            sinon_1.default.stub(event_manager_1.DASHBORD_EVENT_MANAGER, 'onSessionStopped').resolves();
+            yield (0, loopbackRequest_1.default)(hubUrl).delete(`/wd/hub/session/${id}`).expect(200);
+            (0, chai_1.expect)(node.commands).to.deep.equal(['deleteSession']);
+            const phone = yield scratch.db.device.findFirst({ where: { udid: `phone-${stamp}` } });
+            (0, chai_1.expect)(phone).to.include({ busy: false, session_id: null });
+        }));
+        it('a closed session is not routed', () => __awaiter(this, void 0, void 0, function* () {
+            yield boot();
+            const { id } = yield remoteSession({ registered: false });
+            yield scratch.db.session.update({ where: { id }, data: { endTime: new Date() } });
+            const res = yield (0, loopbackRequest_1.default)(hubUrl).get(`/wd/hub/session/${id}/url`);
+            (0, chai_1.expect)(res.status).to.equal(404);
+            (0, chai_1.expect)(res.body.value.error).to.equal('invalid session id');
+            (0, chai_1.expect)(nodeRequests).to.deep.equal([]);
+        }));
+    });
+    describe('base paths', () => {
+        it('a node that does not say its base path is taken to share the hub’s', () => __awaiter(this, void 0, void 0, function* () {
+            yield boot({ nodeBase: '/wd/hub', advertise: false });
+            const { id } = yield remoteSession({ registered: false });
+            yield (0, loopbackRequest_1.default)(hubUrl).get(`/wd/hub/session/${id}/url`).expect(200);
+            (0, chai_1.expect)(nodeRequests.map((r) => r.url)).to.deep.equal([`/wd/hub/session/${id}/url`]);
+        }));
+    });
+    describe('/wd-internal on the hub', () => {
+        it('without the secret, answers exactly as an unknown route does', () => __awaiter(this, void 0, void 0, function* () {
+            yield boot({ hubAuth: true });
+            hub.sessions.add('hub-local');
+            const internal = yield (0, loopbackRequest_1.default)(hubUrl).get('/wd/hub/wd-internal/session/hub-local/timeouts');
+            const unknown = yield (0, loopbackRequest_1.default)(hubUrl).get('/wd/hub/not-a-route/session/hub-local/timeouts');
+            (0, chai_1.expect)(internal.status).to.equal(404);
+            (0, chai_1.expect)(internal.status).to.equal(unknown.status);
+            (0, chai_1.expect)(internal.headers['content-type']).to.equal(unknown.headers['content-type']);
+            (0, chai_1.expect)(internal.body).to.deep.equal(unknown.body);
+            (0, chai_1.expect)(internal.body.value.error).to.equal('unknown command');
+            (0, chai_1.expect)(hub.commands).to.deep.equal([]);
+        }));
+        it('with the secret, reaches the route without credentials though command auth is on', () => __awaiter(this, void 0, void 0, function* () {
+            yield boot({ hubAuth: true });
+            hub.sessions.add('hub-local');
+            yield (0, loopbackRequest_1.default)(hubUrl).get('/wd/hub/session/hub-local/timeouts').expect(404);
+            (0, chai_1.expect)(hub.commands).to.deep.equal([]);
+            const res = yield (0, loopbackRequest_1.default)(hubUrl)
+                .get('/wd/hub/wd-internal/session/hub-local/timeouts')
+                .set((0, internalCall_1.internalCallHeaders)());
+            (0, chai_1.expect)(res.status).to.equal(200);
+            (0, chai_1.expect)(hub.commands).to.deep.equal(['getTimeouts']);
+        }));
+        it('never forwards the secret to a node', () => __awaiter(this, void 0, void 0, function* () {
+            yield boot();
+            const { id } = yield remoteSession();
+            yield (0, loopbackRequest_1.default)(hubUrl)
+                .get(`/wd/hub/wd-internal/session/${id}/url`)
+                .set((0, internalCall_1.internalCallHeaders)())
+                .expect(200);
+            (0, chai_1.expect)(nodeRequests).to.have.length(1);
+            (0, chai_1.expect)(nodeRequests[0].headers[internalCall_1.INTERNAL_CALL_HEADER]).to.equal(undefined);
+        }));
+    });
+    describe('per-command auth on a remote session (at the hub)', () => {
+        it('lets the owner through to the node', () => __awaiter(this, void 0, void 0, function* () {
+            yield boot({ hubAuth: true, nodeAuth: true });
+            const { id } = yield remoteSession({ owner: 'alice' });
+            yield (0, loopbackRequest_1.default)(hubUrl).get(`/wd/hub/session/${id}/url`).set(as('alice')).expect(200);
+            (0, chai_1.expect)(node.commands).to.deep.equal(['getUrl']);
+        }));
+        it('answers another user, or no credentials, with the unknown-session answer; the node sees nothing', () => __awaiter(this, void 0, void 0, function* () {
+            yield boot({ hubAuth: true, nodeAuth: true });
+            const { id } = yield remoteSession({ owner: 'alice' });
+            const bob = yield (0, loopbackRequest_1.default)(hubUrl).get(`/wd/hub/session/${id}/url`).set(as('bob'));
+            const nobody = yield (0, loopbackRequest_1.default)(hubUrl).get(`/wd/hub/session/${id}/url`);
+            for (const res of [bob, nobody]) {
+                (0, chai_1.expect)(res.status).to.equal(404);
+                (0, chai_1.expect)(res.text).to.equal(EXACT_UNKNOWN_SESSION);
+            }
+            (0, chai_1.expect)(nodeRequests).to.deep.equal([]);
+            (0, chai_1.expect)(node.commands).to.deep.equal([]);
+        }));
+    });
+    describe("the node's check of the hub's token (node command auth on)", () => {
+        function tokenFor(sessionId_1) {
+            return __awaiter(this, arguments, void 0, function* (sessionId, ttlSeconds = 300, keys = hubKeys) {
+                return keys.sign({ sid: sessionId }, { audience: hubSessionToken_1.HUB_TOKEN_AUDIENCE, ttlSeconds });
+            });
+        }
+        it("accepts the hub's token for the session", () => __awaiter(this, void 0, void 0, function* () {
+            const { nodeBase } = yield boot({ nodeAuth: true });
+            const { id } = yield remoteSession();
+            yield (0, loopbackRequest_1.default)(nodeOrigin)
+                .get(`${nodeBase}/session/${id}/url`)
+                .set(hubSessionToken_1.HUB_TOKEN_HEADER, yield tokenFor(id))
+                .expect(200);
+            (0, chai_1.expect)(node.commands).to.deep.equal(['getUrl']);
+        }));
+        it('refuses a forged, an expired, or another session’s token, and none at all', () => __awaiter(this, void 0, void 0, function* () {
+            const { nodeBase } = yield boot({ nodeAuth: true });
+            const { id } = yield remoteSession();
+            const otherDir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-forger-'));
+            try {
+                const forger = new JwtKeyService_1.JwtKeyService();
+                yield forger.init(otherDir);
+                const tokens = [
+                    yield tokenFor(id, 300, forger),
+                    yield tokenFor(id, -3600),
+                    yield tokenFor('another-session'),
+                ];
+                for (const token of tokens) {
+                    const res = yield (0, loopbackRequest_1.default)(nodeOrigin)
+                        .get(`${nodeBase}/session/${id}/url`)
+                        .set(hubSessionToken_1.HUB_TOKEN_HEADER, token);
+                    (0, chai_1.expect)(res.status).to.equal(404);
+                    (0, chai_1.expect)(res.text).to.equal(EXACT_UNKNOWN_SESSION);
+                }
+                const bare = yield (0, loopbackRequest_1.default)(nodeOrigin).get(`${nodeBase}/session/${id}/url`);
+                (0, chai_1.expect)(bare.text).to.equal(EXACT_UNKNOWN_SESSION);
+            }
+            finally {
+                fs_1.default.rmSync(otherDir, { recursive: true, force: true });
+            }
+            (0, chai_1.expect)(node.commands).to.deep.equal([]);
+        }));
+        it("with the node's command auth off, a hub token is not needed", () => __awaiter(this, void 0, void 0, function* () {
+            const { nodeBase } = yield boot({ nodeAuth: false });
+            const { id } = yield remoteSession();
+            yield (0, loopbackRequest_1.default)(nodeOrigin).get(`${nodeBase}/session/${id}/url`).expect(200);
+        }));
+    });
+});