@xenon-device-management/xenon 2.0.0 → 2.2.0

package/lib/test/unit/hub-session-token.spec.js

@@ -0,0 +1,265 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const sinon_1 = __importDefault(require("sinon"));
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const express_1 = __importDefault(require("express"));
+const jose = __importStar(require("jose"));
+const typedi_1 = require("typedi");
+const JwtKeyService_1 = require("../../src/services/token/JwtKeyService");
+const hubSessionToken_1 = require("../../src/gateway/hubSessionToken");
+const container_registration_1 = require("../helpers/container-registration");
+const loopbackServer_1 = require("../helpers/loopbackServer");
+/**
+ * The hub's session token: what a node accepts, with its own per-command auth
+ * on, in place of the client's credentials the hub already checked. Signed by
+ * the hub's JwtKeyService, checked by the node against the hub's public keys.
+ */
+describe('hub session tokens', () => {
+    const loopback = (0, loopbackServer_1.loopbackServers)();
+    let dirs;
+    let restore;
+    let hubKeys;
+    let hubUrl;
+    function keyService() {
+        return __awaiter(this, void 0, void 0, function* () {
+            const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-hub-token-'));
+            dirs.push(dir);
+            const keys = new JwtKeyService_1.JwtKeyService();
+            yield keys.init(dir);
+            return keys;
+        });
+    }
+    beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        dirs = [];
+        restore = (0, container_registration_1.saveRegistrations)(JwtKeyService_1.JwtKeyService, hubSessionToken_1.HubSessionTokenIssuer);
+        hubKeys = yield keyService();
+        typedi_1.Container.set(JwtKeyService_1.JwtKeyService, hubKeys);
+        // The hub serves its keys the way the real route does.
+        const hub = (0, express_1.default)();
+        hub.get('/xenon/api/auth/jwks.json', (_req, res) => res.json(hubKeys.jwks()));
+        const server = yield loopback.serve(hub);
+        hubUrl = `http://127.0.0.1:${server.address().port}`;
+    }));
+    afterEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        sinon_1.default.restore();
+        restore();
+        yield loopback.closeAll();
+        for (const dir of dirs)
+            fs_1.default.rmSync(dir, { recursive: true, force: true });
+    }));
+    describe('HubSessionTokenIssuer (hub)', () => {
+        it('signs a token for one session, audience xenon-node, for five minutes', () => __awaiter(void 0, void 0, void 0, function* () {
+            const issuer = new hubSessionToken_1.HubSessionTokenIssuer();
+            const token = yield issuer.tokenFor('s-1');
+            (0, chai_1.expect)(token).to.be.a('string');
+            const claims = jose.decodeJwt(token);
+            (0, chai_1.expect)(claims.aud).to.equal(hubSessionToken_1.HUB_TOKEN_AUDIENCE);
+            (0, chai_1.expect)(claims.sid).to.equal('s-1');
+            (0, chai_1.expect)(claims.exp - claims.iat).to.equal(hubSessionToken_1.HUB_TOKEN_TTL_SECONDS);
+            // The hub's own key verifies it.
+            yield hubKeys.verify(token, { audience: hubSessionToken_1.HUB_TOKEN_AUDIENCE });
+        }));
+        it('reuses a session’s token until it is forgotten', () => __awaiter(void 0, void 0, void 0, function* () {
+            const issuer = new hubSessionToken_1.HubSessionTokenIssuer();
+            const sign = sinon_1.default.spy(hubKeys, 'sign');
+            const first = yield issuer.tokenFor('s-1');
+            (0, chai_1.expect)(yield issuer.tokenFor('s-1')).to.equal(first);
+            (0, chai_1.expect)(sign.callCount).to.equal(1);
+            yield issuer.tokenFor('s-2');
+            (0, chai_1.expect)(sign.callCount).to.equal(2);
+            issuer.forget('s-1');
+            yield issuer.tokenFor('s-1');
+            (0, chai_1.expect)(sign.callCount).to.equal(3);
+        }));
+        it('answers null, and warns once, when this server cannot sign', () => __awaiter(void 0, void 0, void 0, function* () {
+            typedi_1.Container.set(JwtKeyService_1.JwtKeyService, new JwtKeyService_1.JwtKeyService()); // never initialised
+            const issuer = new hubSessionToken_1.HubSessionTokenIssuer();
+            const warn = sinon_1.default.stub(issuer.logger, 'warn');
+            (0, chai_1.expect)(yield issuer.tokenFor('s-1')).to.equal(null);
+            (0, chai_1.expect)(yield issuer.tokenFor('s-2')).to.equal(null);
+            (0, chai_1.expect)(warn.callCount).to.equal(1);
+        }));
+        it('is an audience /auth/token will not mint for a user', () => {
+            var _a, _b;
+            const source = fs_1.default.readFileSync(path_1.default.resolve(__dirname, '../../src/app/routers/auth.ts'), 'utf8');
+            const mintable = (_b = (_a = /MINTABLE_AUDIENCES = \[([^\]]*)\]/.exec(source)) === null || _a === void 0 ? void 0 : _a[1]) !== null && _b !== void 0 ? _b : '';
+            (0, chai_1.expect)(mintable).to.include('xenon-rest');
+            (0, chai_1.expect)(mintable).not.to.include(hubSessionToken_1.HUB_TOKEN_AUDIENCE);
+        });
+    });
+    describe('HubSessionTokenVerifier (node)', () => {
+        it('fetches the keys from the hub’s public JWKS route', () => {
+            (0, chai_1.expect)((0, hubSessionToken_1.hubJwksUrl)('http://hub:4724').toString()).to.equal('http://hub:4724/xenon/api/auth/jwks.json');
+        });
+        it('accepts the hub’s token for its session', () => __awaiter(void 0, void 0, void 0, function* () {
+            const token = (yield new hubSessionToken_1.HubSessionTokenIssuer().tokenFor('s-1'));
+            (0, chai_1.expect)(yield new hubSessionToken_1.HubSessionTokenVerifier(hubUrl).verify(token, 's-1')).to.equal(true);
+        }));
+        it('refuses the hub’s token for another session', () => __awaiter(void 0, void 0, void 0, function* () {
+            const token = (yield new hubSessionToken_1.HubSessionTokenIssuer().tokenFor('s-1'));
+            (0, chai_1.expect)(yield new hubSessionToken_1.HubSessionTokenVerifier(hubUrl).verify(token, 's-2')).to.equal(false);
+        }));
+        it('refuses an expired token', () => __awaiter(void 0, void 0, void 0, function* () {
+            const token = yield hubKeys.sign({ sid: 's-1' }, { audience: hubSessionToken_1.HUB_TOKEN_AUDIENCE, ttlSeconds: -3600 });
+            (0, chai_1.expect)(yield new hubSessionToken_1.HubSessionTokenVerifier(hubUrl).verify(token, 's-1')).to.equal(false);
+        }));
+        it('refuses a token signed by another key, even under the hub’s key id', () => __awaiter(void 0, void 0, void 0, function* () {
+            const other = yield keyService();
+            const foreign = yield other.sign({ sid: 's-1' }, { audience: hubSessionToken_1.HUB_TOKEN_AUDIENCE, ttlSeconds: 300 });
+            const verifier = new hubSessionToken_1.HubSessionTokenVerifier(hubUrl);
+            (0, chai_1.expect)(yield verifier.verify(foreign, 's-1')).to.equal(false);
+            const hubKid = hubKeys.jwks().keys[0].kid;
+            const { privateKey } = yield jose.generateKeyPair('RS256');
+            const forged = yield new jose.SignJWT({ sid: 's-1' })
+                .setProtectedHeader({ alg: 'RS256', kid: hubKid })
+                .setAudience(hubSessionToken_1.HUB_TOKEN_AUDIENCE)
+                .setIssuedAt()
+                .setExpirationTime('5m')
+                .sign(privateKey);
+            (0, chai_1.expect)(yield verifier.verify(forged, 's-1')).to.equal(false);
+        }));
+        it('refuses the hub’s token for another audience', () => __awaiter(void 0, void 0, void 0, function* () {
+            const rest = yield hubKeys.sign({ sid: 's-1', sub: 'alice' }, { audience: 'xenon-rest', ttlSeconds: 300 });
+            (0, chai_1.expect)(yield new hubSessionToken_1.HubSessionTokenVerifier(hubUrl).verify(rest, 's-1')).to.equal(false);
+        }));
+        it('refuses what is not a token at all', () => __awaiter(void 0, void 0, void 0, function* () {
+            (0, chai_1.expect)(yield new hubSessionToken_1.HubSessionTokenVerifier(hubUrl).verify('not-a-jwt', 's-1')).to.equal(false);
+        }));
+        it('throws HubTokenUnavailableError when the hub’s keys cannot be fetched', () => __awaiter(void 0, void 0, void 0, function* () {
+            const token = (yield new hubSessionToken_1.HubSessionTokenIssuer().tokenFor('s-1'));
+            yield loopback.closeAll();
+            let thrown;
+            try {
+                yield new hubSessionToken_1.HubSessionTokenVerifier(hubUrl).verify(token, 's-1');
+            }
+            catch (err) {
+                thrown = err;
+            }
+            (0, chai_1.expect)(thrown).to.be.instanceOf(hubSessionToken_1.HubTokenUnavailableError);
+        }));
+    });
+    describe('the token for a create (hub → node)', () => {
+        const grant = { userId: 'alice', udid: 'phone-1', host: 'http://10.0.0.5:4725' };
+        it('names the owner, the phone and its node, audience xenon-node-create, for two minutes', () => __awaiter(void 0, void 0, void 0, function* () {
+            const token = (yield new hubSessionToken_1.HubSessionTokenIssuer().createTokenFor(grant));
+            const claims = jose.decodeJwt(token);
+            (0, chai_1.expect)(claims.aud).to.equal(hubSessionToken_1.HUB_CREATE_AUDIENCE);
+            (0, chai_1.expect)(claims).to.include({ sub: 'alice', udid: 'phone-1', host: 'http://10.0.0.5:4725' });
+            (0, chai_1.expect)(claims.sid, 'no session yet').to.equal(undefined);
+            (0, chai_1.expect)(claims.exp - claims.iat).to.equal(hubSessionToken_1.HUB_CREATE_TTL_SECONDS);
+        }));
+        it('carries no owner for an unattributed create', () => __awaiter(void 0, void 0, void 0, function* () {
+            const token = (yield new hubSessionToken_1.HubSessionTokenIssuer().createTokenFor(Object.assign(Object.assign({}, grant), { userId: null })));
+            (0, chai_1.expect)(jose.decodeJwt(token).sub).to.equal(undefined);
+            (0, chai_1.expect)(yield new hubSessionToken_1.HubSessionTokenVerifier(hubUrl).verifyCreate(token)).to.deep.equal(Object.assign(Object.assign({}, grant), { userId: null }));
+        }));
+        it('is minted fresh for every create', () => __awaiter(void 0, void 0, void 0, function* () {
+            const issuer = new hubSessionToken_1.HubSessionTokenIssuer();
+            const sign = sinon_1.default.spy(hubKeys, 'sign');
+            yield issuer.createTokenFor(grant);
+            yield issuer.createTokenFor(grant);
+            (0, chai_1.expect)(sign.callCount).to.equal(2);
+        }));
+        it('answers null when this server cannot sign', () => __awaiter(void 0, void 0, void 0, function* () {
+            typedi_1.Container.set(JwtKeyService_1.JwtKeyService, new JwtKeyService_1.JwtKeyService()); // never initialised
+            const issuer = new hubSessionToken_1.HubSessionTokenIssuer();
+            sinon_1.default.stub(issuer.logger, 'warn');
+            (0, chai_1.expect)(yield issuer.createTokenFor(grant)).to.equal(null);
+        }));
+        it('the node reads the grant back from it', () => __awaiter(void 0, void 0, void 0, function* () {
+            const token = (yield new hubSessionToken_1.HubSessionTokenIssuer().createTokenFor(grant));
+            (0, chai_1.expect)(yield new hubSessionToken_1.HubSessionTokenVerifier(hubUrl).verifyCreate(token)).to.deep.equal(grant);
+        }));
+        it('is no command token, and a command token is no create token', () => __awaiter(void 0, void 0, void 0, function* () {
+            const issuer = new hubSessionToken_1.HubSessionTokenIssuer();
+            const verifier = new hubSessionToken_1.HubSessionTokenVerifier(hubUrl);
+            const create = (yield issuer.createTokenFor(grant));
+            const command = (yield issuer.tokenFor('s-1'));
+            (0, chai_1.expect)(yield verifier.verify(create, 's-1')).to.equal(false);
+            (0, chai_1.expect)(yield verifier.verifyCreate(command)).to.equal(null);
+        }));
+        it('refuses a forged, an expired, or an incomplete one', () => __awaiter(void 0, void 0, void 0, function* () {
+            const verifier = new hubSessionToken_1.HubSessionTokenVerifier(hubUrl);
+            const forger = yield keyService();
+            const claims = { sub: 'alice', udid: 'phone-1', host: grant.host };
+            const tokens = [
+                yield forger.sign(claims, { audience: hubSessionToken_1.HUB_CREATE_AUDIENCE, ttlSeconds: 120 }),
+                yield hubKeys.sign(claims, { audience: hubSessionToken_1.HUB_CREATE_AUDIENCE, ttlSeconds: -3600 }),
+                yield hubKeys.sign({ sub: 'alice', host: grant.host }, { audience: hubSessionToken_1.HUB_CREATE_AUDIENCE, ttlSeconds: 120 }),
+                yield hubKeys.sign({ sub: 'alice', udid: 'phone-1' }, { audience: hubSessionToken_1.HUB_CREATE_AUDIENCE, ttlSeconds: 120 }),
+                yield hubKeys.sign(claims, { audience: 'xenon-rest', ttlSeconds: 120 }),
+                'not-a-jwt',
+            ];
+            for (const token of tokens)
+                (0, chai_1.expect)(yield verifier.verifyCreate(token)).to.equal(null);
+        }));
+        it('throws HubTokenUnavailableError when the hub’s keys cannot be fetched', () => __awaiter(void 0, void 0, void 0, function* () {
+            const token = (yield new hubSessionToken_1.HubSessionTokenIssuer().createTokenFor(grant));
+            yield loopback.closeAll();
+            let thrown;
+            try {
+                yield new hubSessionToken_1.HubSessionTokenVerifier(hubUrl).verifyCreate(token);
+            }
+            catch (err) {
+                thrown = err;
+            }
+            (0, chai_1.expect)(thrown).to.be.instanceOf(hubSessionToken_1.HubTokenUnavailableError);
+        }));
+        it('is an audience /auth/token will not mint for a user', () => {
+            var _a, _b;
+            const source = fs_1.default.readFileSync(path_1.default.resolve(__dirname, '../../src/app/routers/auth.ts'), 'utf8');
+            const mintable = (_b = (_a = /MINTABLE_AUDIENCES = \[([^\]]*)\]/.exec(source)) === null || _a === void 0 ? void 0 : _a[1]) !== null && _b !== void 0 ? _b : '';
+            (0, chai_1.expect)(mintable).to.include('xenon-rest');
+            (0, chai_1.expect)(mintable).not.to.include(hubSessionToken_1.HUB_CREATE_AUDIENCE);
+        });
+    });
+});

package/lib/test/unit/insert-before-routes.spec.js

@@ -15,7 +15,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const chai_1 = require("chai");
 const path_1 = __importDefault(require("path"));
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const insertBeforeRoutes_1 = require("../../src/app/insertBeforeRoutes");
 const loopbackServer_1 = require("../helpers/loopbackServer");
 /**
@@ -80,7 +80,7 @@ describe('insertBeforeRoutes', () => {
                     next();
                 });
                 (0, chai_1.expect)(result.placed).to.equal(true);
-                yield (0, supertest_1.default)(yield loopback.serve(app))
+                yield (0, loopbackRequest_1.default)(yield loopback.serve(app))
                     .get('/wd/hub/session/abc/url')
                     .expect(200);
                 (0, chai_1.expect)(ran).to.deep.equal(['appium-middleware', 'guard:abc', 'route:abc']);
@@ -90,7 +90,7 @@ describe('insertBeforeRoutes', () => {
                 (0, insertBeforeRoutes_1.insertBeforeRoutes)(app, '/wd/hub/session/:sessionId', (_req, res) => {
                     res.status(404).json({ refused: true });
                 });
-                const res = yield (0, supertest_1.default)(yield loopback.serve(app))
+                const res = yield (0, loopbackRequest_1.default)(yield loopback.serve(app))
                     .get('/wd/hub/session/abc/url')
                     .expect(404);
                 (0, chai_1.expect)(res.body).to.deep.equal({ refused: true });
@@ -102,7 +102,7 @@ describe('insertBeforeRoutes', () => {
                     ran.push('guard');
                     next();
                 });
-                yield (0, supertest_1.default)(yield loopback.serve(app))
+                yield (0, loopbackRequest_1.default)(yield loopback.serve(app))
                     .post('/wd/hub/session')
                     .send({})
                     .expect(200);
@@ -133,7 +133,7 @@ describe('insertBeforeRoutes', () => {
                     res.json({});
                 });
                 (0, chai_1.expect)(result.placed).to.equal(true);
-                yield (0, supertest_1.default)(yield loopback.serve(app))
+                yield (0, loopbackRequest_1.default)(yield loopback.serve(app))
                     .get('/wd/hub/session/abc/url')
                     .expect(200);
                 (0, chai_1.expect)(ran).to.deep.equal(['guard', 'route']);

package/lib/test/unit/install-repository-app-team.spec.js

@@ -16,7 +16,7 @@ require("reflect-metadata");
 const chai_1 = require("chai");
 const sinon_1 = __importDefault(require("sinon"));
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const typedi_1 = require("typedi");
 const control_1 = __importDefault(require("../../src/app/routers/control"));
 const device_store_1 = require("../../src/data-service/device-store");
@@ -25,6 +25,7 @@ const device_managers_1 = require("../../src/device-managers");
 const app_service_1 = require("../../src/dashboard/services/app-service");
 const authMiddleware_1 = require("../../src/middleware/authMiddleware");
 const container_registration_1 = require("../helpers/container-registration");
+const own_node_id_1 = require("../helpers/own-node-id");
 /**
  * Installing an uploaded app onto a phone hands over its binary as surely as
  * downloading it does, so POST /control/:udid/install-repository-app follows
@@ -63,6 +64,8 @@ function buildApp(teamIds) {
     return app;
 }
 describe('POST /control/:udid/install-repository-app follows the app team rule', () => {
+    // The fake rows are this server's own phones.
+    (0, own_node_id_1.useOwnNodeId)();
     let manager;
     let restore;
     beforeEach(() => {
@@ -74,6 +77,7 @@ describe('POST /control/:udid/install-repository-app follows the app team rule',
                 return ({
                     udid: UDID,
                     host: '127.0.0.1',
+                    nodeId: own_node_id_1.OWN_NODE_ID,
                     platform: 'android',
                     busy: false,
                     session_id: null,
@@ -89,7 +93,7 @@ describe('POST /control/:udid/install-repository-app follows the app team rule',
         sinon_1.default.restore();
         restore();
     });
-    const install = (teamIds, appId) => (0, supertest_1.default)(buildApp(teamIds))
+    const install = (teamIds, appId) => (0, loopbackRequest_1.default)(buildApp(teamIds))
         .post(`/xenon/api/control/${UDID}/install-repository-app`)
         .send({ appId });
     it("installs a member's team app and a shared one", () => __awaiter(void 0, void 0, void 0, function* () {

package/lib/test/unit/interceptor/MitmProxyHost.spec.js

@@ -1,6 +1,10 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 const chai_1 = require("chai");
+const sinon_1 = __importDefault(require("sinon"));
 const MitmProxyHost_1 = require("../../../src/services/interceptor/MitmProxyHost");
 const MockEngine_1 = require("../../../src/services/interceptor/MockEngine");
 function makeHost(mockEngine = new MockEngine_1.MockEngine()) {
@@ -251,16 +255,25 @@ describe('MitmProxyHost.handleProxyError ring edge cases', () => {
     });
     // Tied to RECENT_CONNECT_TTL_MS in the source. If that constant changes, update here.
     it('honors the TTL boundary: entry exactly at the cutoff is still attributed', () => {
-        const { host, emitted } = makeHost();
-        host.recentConnects.push({
-            host: 'edge.example.com',
-            // strict `>` in the source means equal-to-TTL is still attributable
-            ts: Date.now() - 30000,
-            consumed: false,
-        });
-        host.handleProxyError(null, new Error('x'), 'HTTPS_CLIENT_ERROR');
-        (0, chai_1.expect)(emitted).to.have.length(1);
-        (0, chai_1.expect)(emitted[0].host).to.equal('edge.example.com');
+        // Freeze the clock: the source reads Date.now() again, and one millisecond
+        // passing in between (it does, under the full suite's load) puts the entry
+        // past the cutoff.
+        const clock = sinon_1.default.useFakeTimers({ now: Date.now(), toFake: ['Date'] });
+        try {
+            const { host, emitted } = makeHost();
+            host.recentConnects.push({
+                host: 'edge.example.com',
+                // strict `>` in the source means equal-to-TTL is still attributable
+                ts: Date.now() - 30000,
+                consumed: false,
+            });
+            host.handleProxyError(null, new Error('x'), 'HTTPS_CLIENT_ERROR');
+            (0, chai_1.expect)(emitted).to.have.length(1);
+            (0, chai_1.expect)(emitted[0].host).to.equal('edge.example.com');
+        }
+        finally {
+            clock.restore();
+        }
     });
     it('honors the TTL boundary: entry one ms past the cutoff is skipped', () => {
         const { host, emitted } = makeHost();

package/lib/test/unit/internal-call.spec.js

@@ -0,0 +1,181 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+const path_1 = __importDefault(require("path"));
+const sinon_1 = __importDefault(require("sinon"));
+const express_1 = __importDefault(require("express"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
+const commandCaller_1 = require("../../src/middleware/commandCaller");
+const registerCommandAuth_1 = require("../../src/app/registerCommandAuth");
+const insertBeforeRoutes_1 = require("../../src/app/insertBeforeRoutes");
+const internalCall_1 = require("../../src/gateway/internalCall");
+const loopbackServer_1 = require("../helpers/loopbackServer");
+/**
+ * Xenon's own loopback calls (`<basePath>/wd-internal/...`).
+ *
+ * A call that carries this process's secret header is Xenon's own: the
+ * `/wd-internal` marker is stripped and the call skips per-command auth. The
+ * path alone proves nothing, so without the secret a `/wd-internal` request
+ * is left exactly as it came and ends where any unknown route ends.
+ */
+function appiumExpress() {
+    const appiumDir = path_1.default.dirname(require.resolve('appium/package.json'));
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    return require(require.resolve('express', { paths: [appiumDir] }));
+}
+const shapes = [
+    ['Express 4', () => (0, express_1.default)()],
+    ['Express 5 (Appium 3)', () => appiumExpress()()],
+];
+// Appium's catch-all, in shape: every unknown route gets the same answer.
+const UNKNOWN_ROUTE = {
+    value: { error: 'unknown command', message: 'no route', stacktrace: '' },
+};
+describe('internal calls (/wd-internal with the per-process secret)', () => {
+    describe('the secret', () => {
+        it('is sent by internalCallHeaders and recognised by hasInternalCallSecret', () => {
+            const headers = (0, internalCall_1.internalCallHeaders)();
+            (0, chai_1.expect)(Object.keys(headers)).to.deep.equal([internalCall_1.INTERNAL_CALL_HEADER]);
+            (0, chai_1.expect)(headers[internalCall_1.INTERNAL_CALL_HEADER]).to.have.length.greaterThan(30);
+            (0, chai_1.expect)((0, internalCall_1.hasInternalCallSecret)(headers)).to.equal(true);
+        });
+        it('is refused when absent, wrong, a different length, or repeated', () => {
+            const secret = (0, internalCall_1.internalCallHeaders)()[internalCall_1.INTERNAL_CALL_HEADER];
+            (0, chai_1.expect)((0, internalCall_1.hasInternalCallSecret)({})).to.equal(false);
+            (0, chai_1.expect)((0, internalCall_1.hasInternalCallSecret)({ [internalCall_1.INTERNAL_CALL_HEADER]: `${secret.slice(1)}x` })).to.equal(false);
+            (0, chai_1.expect)((0, internalCall_1.hasInternalCallSecret)({ [internalCall_1.INTERNAL_CALL_HEADER]: 'short' })).to.equal(false);
+            (0, chai_1.expect)((0, internalCall_1.hasInternalCallSecret)({ [internalCall_1.INTERNAL_CALL_HEADER]: [secret, secret] })).to.equal(false);
+        });
+        it('builds the loopback base URL under the normalised base path', () => {
+            (0, chai_1.expect)((0, internalCall_1.internalCallBaseUrl)('0.0.0.0', 4723, 'wd/hub/')).to.equal('http://127.0.0.1:4723/wd/hub/wd-internal');
+            (0, chai_1.expect)((0, internalCall_1.internalCallBaseUrl)('10.0.0.5', 4723, '')).to.equal('http://10.0.0.5:4723/wd-internal');
+        });
+    });
+    for (const [shapeName, makeExpress] of shapes) {
+        describe(shapeName, () => {
+            const loopback = (0, loopbackServer_1.loopbackServers)();
+            let ran;
+            let ownerOf;
+            let warnings;
+            afterEach(() => loopback.closeAll());
+            beforeEach(() => {
+                ran = [];
+                warnings = [];
+                ownerOf = sinon_1.default.stub().resolves('alice');
+            });
+            function lab() {
+                return __awaiter(this, arguments, void 0, function* (basePath = '/wd/hub') {
+                    const app = makeExpress();
+                    app.use(express_1.default.json());
+                    const route = (name) => (req, res) => {
+                        var _a;
+                        ran.push({ name, url: req.originalUrl, secret: req.headers[internalCall_1.INTERNAL_CALL_HEADER] });
+                        res.json({ value: (_a = req.params.sessionId) !== null && _a !== void 0 ? _a : null });
+                    };
+                    app.get(`${basePath}/session/:sessionId/url`, route('getUrl'));
+                    app.get(`${basePath}/session/:sessionId/timeouts`, route('getTimeouts'));
+                    app.post(`${basePath}/session`, route('createSession'));
+                    const result = (0, registerCommandAuth_1.registerCommandAuth)(app, { basePath }, {
+                        enabled: () => true,
+                        authDisabled: () => false,
+                        verifier: new commandCaller_1.CommandCallerVerifier({
+                            verifyKeyPair: sinon_1.default.stub().resolves(null),
+                            verifyBearer: sinon_1.default.stub().resolves(null),
+                        }),
+                        ownerOf,
+                        logger: {
+                            info: () => undefined,
+                            warn: (m) => warnings.push(m),
+                            error: () => undefined,
+                        },
+                    });
+                    (0, chai_1.expect)(result.placed).to.equal(true);
+                    // Appium adds its catch-all after every updater.
+                    app.use((_req, res) => res.status(404).json(UNKNOWN_ROUTE));
+                    return { app: yield loopback.serve(app), raw: app };
+                });
+            }
+            it('without the secret, answers a /wd-internal command as an unknown route', () => __awaiter(void 0, void 0, void 0, function* () {
+                const { app } = yield lab();
+                const internal = yield (0, loopbackRequest_1.default)(app).get('/wd/hub/wd-internal/session/s1/url');
+                const unknown = yield (0, loopbackRequest_1.default)(app).get('/wd/hub/no-such-prefix/session/s1/url');
+                (0, chai_1.expect)(internal.status).to.equal(404);
+                (0, chai_1.expect)(internal.status).to.equal(unknown.status);
+                (0, chai_1.expect)(internal.text).to.equal(unknown.text);
+                (0, chai_1.expect)(ran).to.deep.equal([]);
+            }));
+            it('with a wrong secret, answers as an unknown route too', () => __awaiter(void 0, void 0, void 0, function* () {
+                const { app } = yield lab();
+                const res = yield (0, loopbackRequest_1.default)(app)
+                    .get('/wd/hub/wd-internal/session/s1/url')
+                    .set(internalCall_1.INTERNAL_CALL_HEADER, 'not-the-secret');
+                (0, chai_1.expect)(res.status).to.equal(404);
+                (0, chai_1.expect)(res.body).to.deep.equal(UNKNOWN_ROUTE);
+                (0, chai_1.expect)(ran).to.deep.equal([]);
+            }));
+            it('with the secret, strips the marker and skips per-command auth', () => __awaiter(void 0, void 0, void 0, function* () {
+                const { app } = yield lab();
+                const res = yield (0, loopbackRequest_1.default)(app)
+                    .get('/wd/hub/wd-internal/session/s1/timeouts')
+                    .set((0, internalCall_1.internalCallHeaders)());
+                (0, chai_1.expect)(res.status).to.equal(200);
+                (0, chai_1.expect)(res.body).to.deep.equal({ value: 's1' });
+                // The route saw the canonical path and never the secret.
+                (0, chai_1.expect)(ran).to.deep.equal([
+                    { name: 'getTimeouts', url: '/wd/hub/session/s1/timeouts', secret: undefined },
+                ]);
+                (0, chai_1.expect)(ownerOf.called).to.equal(false);
+                (0, chai_1.expect)(warnings).to.deep.equal([]);
+            }));
+            it('the same session command without the marker still needs credentials', () => __awaiter(void 0, void 0, void 0, function* () {
+                const { app } = yield lab();
+                const res = yield (0, loopbackRequest_1.default)(app).get('/wd/hub/session/s1/url').set((0, internalCall_1.internalCallHeaders)());
+                (0, chai_1.expect)(res.status).to.equal(404);
+                (0, chai_1.expect)(res.body.value.error).to.equal('invalid session id');
+                (0, chai_1.expect)(ran).to.deep.equal([]);
+            }));
+            it('works under an empty base path', () => __awaiter(void 0, void 0, void 0, function* () {
+                const { app } = yield lab('');
+                const res = yield (0, loopbackRequest_1.default)(app)
+                    .get('/wd-internal/session/s1/url')
+                    .set((0, internalCall_1.internalCallHeaders)());
+                (0, chai_1.expect)(res.status).to.equal(200);
+                (0, chai_1.expect)(ran.map((r) => r.url)).to.deep.equal(['/session/s1/url']);
+            }));
+            it('recognises only the exact marker, never a look-alike', () => __awaiter(void 0, void 0, void 0, function* () {
+                const { app } = yield lab();
+                for (const url of [
+                    '/wd/hub/wd-internalx/session/s1/url',
+                    '/WD/HUB/WD-INTERNAL/session/s1/url',
+                    '/wd-internal/wd/hub/session/s1/url',
+                ]) {
+                    const res = yield (0, loopbackRequest_1.default)(app).get(url).set((0, internalCall_1.internalCallHeaders)());
+                    (0, chai_1.expect)(res.status, url).to.equal(404);
+                }
+                (0, chai_1.expect)(ran).to.deep.equal([]);
+            }));
+            it('puts the internal-call layer ahead of the session layer, both ahead of the routes', () => __awaiter(void 0, void 0, void 0, function* () {
+                const { raw } = yield lab();
+                const stack = (0, insertBeforeRoutes_1.routerStackOf)(raw);
+                const firstRoute = stack.findIndex((layer) => !!layer.route);
+                const names = stack.slice(0, firstRoute).map((layer) => { var _a; return (_a = layer.handle) === null || _a === void 0 ? void 0 : _a.name; });
+                const internal = names.indexOf('xenonInternalCalls');
+                const gateway = names.indexOf('xenonSessionGateway');
+                (0, chai_1.expect)(internal, 'internal-call layer placed').to.be.greaterThan(-1);
+                (0, chai_1.expect)(gateway, 'session gateway placed').to.be.greaterThan(internal);
+            }));
+        });
+    }
+});