@xenon-device-management/xenon 2.0.0 → 2.2.0

package/lib/test/unit/lease/lease-reap-held-phone.spec.js

@@ -0,0 +1,154 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const lokijs_1 = __importDefault(require("lokijs"));
+const sinon_1 = __importDefault(require("sinon"));
+const LeaseOrphanSweeper_1 = require("../../../src/services/lease/LeaseOrphanSweeper");
+const LeaseService_1 = require("../../../src/services/lease/LeaseService");
+const leaseToken_1 = require("../../../src/services/lease/leaseToken");
+const device_store_1 = require("../../../src/data-service/device-store");
+const prisma_store_1 = require("../../../src/data-service/prisma-store");
+const db_1 = require("../../../src/data-service/db");
+const scratch_database_1 = require("../../helpers/scratch-database");
+/**
+ * A lease locks its phone with `busy` alone. A session created on the lease
+ * claims the phone too (claimForSession). Ending the lease (a reap at
+ * expiresAt or on missed heartbeats, or its holder's release) wrote
+ * `busy: false` unconditionally, so a session that outlived its lease had
+ * its phone handed to another session mid-run.
+ *
+ * #375's rule (deviceClaims.ts, UNHELD) applies: clear `busy` only where
+ * nothing else holds the phone. The session's own release frees it later.
+ *
+ * Both stores run for real: Prisma on a scratch SQLite file, Loki on an
+ * in-memory collection.
+ */
+const UDID = 'leased-phone-1';
+const HOST = 'http://127.0.0.1:4723';
+const TOKEN = 'd'.repeat(64);
+function lokiStore() {
+    // The factory only makes a Loki store under NODE_ENV=test; take it without
+    // keeping it as the process's store.
+    const factory = device_store_1.DeviceStoreFactory;
+    const saved = factory._deviceStore;
+    const savedEnv = process.env.NODE_ENV;
+    factory._deviceStore = undefined;
+    process.env.NODE_ENV = 'test';
+    try {
+        return device_store_1.DeviceStoreFactory.getStore();
+    }
+    finally {
+        process.env.NODE_ENV = savedEnv;
+        factory._deviceStore = saved;
+    }
+}
+describe('ending a lease frees only a phone nothing else holds', () => {
+    const scratch = (0, scratch_database_1.useScratchDatabase)();
+    let now;
+    function lease(over) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield scratch.db.lease.create({
+                data: Object.assign({ id: 'lse_held', tokenHash: (0, leaseToken_1.hashToken)(TOKEN), deviceUdid: UDID, deviceHost: HOST, actorId: 'usr_alice', status: 'active', heartbeatSeconds: 30, allocatedPorts: '{}', capabilityBag: '{}' }, over),
+            });
+        });
+    }
+    const cases = [
+        {
+            name: 'PrismaDeviceStore (scratch SQLite)',
+            make: () => __awaiter(void 0, void 0, void 0, function* () {
+                yield scratch.db.device.create({ data: { udid: UDID, host: HOST, busy: true } });
+                return {
+                    store: new prisma_store_1.PrismaDeviceStore(),
+                    busy: () => __awaiter(void 0, void 0, void 0, function* () {
+                        var _a;
+                        const where = { udid_host: { udid: UDID, host: HOST } };
+                        return (_a = (yield scratch.db.device.findUnique({ where }))) === null || _a === void 0 ? void 0 : _a.busy;
+                    }),
+                };
+            }),
+        },
+        {
+            name: 'LokiDeviceStore (in memory)',
+            make: () => __awaiter(void 0, void 0, void 0, function* () {
+                const devices = new lokijs_1.default('lease-reap-held-phone.json').addCollection('devices');
+                sinon_1.default.stub(db_1.XenonDatabase, 'DeviceModel').get(() => Promise.resolve(devices));
+                devices.insert({ udid: UDID, host: HOST, busy: true });
+                return {
+                    store: lokiStore(),
+                    busy: () => __awaiter(void 0, void 0, void 0, function* () { var _a; return (_a = devices.findOne({ udid: UDID, host: HOST })) === null || _a === void 0 ? void 0 : _a.busy; }),
+                };
+            }),
+        },
+    ];
+    for (const { name, make } of cases) {
+        describe(name, () => {
+            let store;
+            let busy;
+            beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+                yield scratch.db.portLease.deleteMany({});
+                yield scratch.db.lease.deleteMany({});
+                yield scratch.db.device.deleteMany({});
+                now = Date.now();
+                ({ store, busy } = yield make());
+            }));
+            afterEach(() => sinon_1.default.restore());
+            /** A session created on the lease: it claims the leased phone. */
+            function sessionOnLease() {
+                return __awaiter(this, void 0, void 0, function* () {
+                    (0, chai_1.expect)(yield store.claimForSession(UDID, HOST, null, 'sess-1', {})).to.equal(true);
+                });
+            }
+            const reap = () => new LeaseOrphanSweeper_1.LeaseOrphanSweeper(scratch.db, store).sweep();
+            const ended = () => __awaiter(void 0, void 0, void 0, function* () { var _a; return (_a = (yield scratch.db.lease.findUnique({ where: { id: 'lse_held' } }))) === null || _a === void 0 ? void 0 : _a.status; });
+            it('a reap at expiresAt leaves the phone busy while a session holds it', () => __awaiter(void 0, void 0, void 0, function* () {
+                yield lease({ expiresAt: now - 500, lastHeartbeatAt: now - 1000 });
+                yield sessionOnLease();
+                yield reap();
+                (0, chai_1.expect)(yield ended()).to.equal('expired');
+                (0, chai_1.expect)(yield busy(), "the session's phone").to.equal(true);
+            }));
+            it('a missed-heartbeat reap leaves the phone busy while a session holds it', () => __awaiter(void 0, void 0, void 0, function* () {
+                yield lease({ expiresAt: now + 60000, lastHeartbeatAt: now - 120000 });
+                yield sessionOnLease();
+                yield reap();
+                (0, chai_1.expect)(yield ended()).to.equal('expired');
+                (0, chai_1.expect)(yield busy()).to.equal(true);
+            }));
+            it('a reap frees the phone when nothing else holds it, as before', () => __awaiter(void 0, void 0, void 0, function* () {
+                yield lease({ expiresAt: now - 500, lastHeartbeatAt: now - 1000 });
+                yield reap();
+                (0, chai_1.expect)(yield ended()).to.equal('expired');
+                (0, chai_1.expect)(yield busy()).to.equal(false);
+            }));
+            it("once the session ends after the reap, the session's release frees the phone", () => __awaiter(void 0, void 0, void 0, function* () {
+                yield lease({ expiresAt: now - 500, lastHeartbeatAt: now - 1000 });
+                yield sessionOnLease();
+                yield reap();
+                (0, chai_1.expect)(yield store.releaseClaim(UDID, HOST, { sessionId: 'sess-1' }, {})).to.equal(true);
+                (0, chai_1.expect)(yield busy()).to.equal(false);
+            }));
+            it("the holder's release leaves the phone busy while a session holds it", () => __awaiter(void 0, void 0, void 0, function* () {
+                yield lease({ expiresAt: now + 60000, lastHeartbeatAt: now });
+                yield sessionOnLease();
+                const noAuth = { nodePairAuth: () => __awaiter(void 0, void 0, void 0, function* () { return ({}); }) };
+                const leases = new LeaseService_1.LeaseService(scratch.db, store, {}, noAuth);
+                yield leases.release('lse_held', TOKEN);
+                (0, chai_1.expect)(yield ended()).to.equal('released');
+                (0, chai_1.expect)(yield busy()).to.equal(true);
+            }));
+        });
+    }
+});

package/lib/test/unit/lease/lease-sweeper-expiry.spec.js

@@ -0,0 +1,107 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const sinon_1 = __importDefault(require("sinon"));
+const LeaseOrphanSweeper_1 = require("../../../src/services/lease/LeaseOrphanSweeper");
+const scratch_database_1 = require("../../helpers/scratch-database");
+/**
+ * A lease ends at expiresAt. Since #366 heartbeat and extend refuse a lease
+ * past it, but the sweeper reaped only on missed heartbeats, so the lease
+ * stayed 'active', its phone busy and out of allocation, for up to
+ * 3 x heartbeatSeconds (15 minutes at the 300 s maximum) after it ended.
+ *
+ * The sweeper runs its real queries against a scratch SQLite file.
+ */
+describe('LeaseOrphanSweeper: a lease ends at expiresAt (scratch DB)', () => {
+    const scratch = (0, scratch_database_1.useScratchDatabase)();
+    let releaseLeaseLock;
+    let sweeper;
+    let now;
+    function lease(id, over) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield scratch.db.lease.create({
+                data: Object.assign({ id, tokenHash: `hash-${id}`, deviceUdid: `udid-${id}`, deviceHost: 'http://127.0.0.1:4723', actorId: 'usr_alice', status: 'active', heartbeatSeconds: 30, allocatedPorts: '{}', capabilityBag: '{}' }, over),
+            });
+        });
+    }
+    function portLease(port, leaseId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield scratch.db.portLease.create({
+                data: {
+                    port,
+                    purpose: 'wdaLocalPort',
+                    leasedToUdid: `udid-${leaseId}`,
+                    leaseId,
+                    leasedAt: now,
+                    expiresAt: now + 3600000,
+                },
+            });
+        });
+    }
+    const statusOf = (id) => __awaiter(void 0, void 0, void 0, function* () { var _a; return (_a = (yield scratch.db.lease.findUnique({ where: { id } }))) === null || _a === void 0 ? void 0 : _a.status; });
+    const portsOf = (leaseId) => __awaiter(void 0, void 0, void 0, function* () { return (yield scratch.db.portLease.findMany({ where: { leaseId } })).map((p) => p.port); });
+    beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        yield scratch.db.portLease.deleteMany({});
+        yield scratch.db.lease.deleteMany({});
+        now = Date.now();
+        releaseLeaseLock = sinon_1.default.stub().resolves(true);
+        sweeper = new LeaseOrphanSweeper_1.LeaseOrphanSweeper(scratch.db, { releaseLeaseLock });
+    }));
+    it('reaps a lease past expiresAt whose client is still heartbeating, like a missed-heartbeat reap', () => __awaiter(void 0, void 0, void 0, function* () {
+        yield lease('ended', { expiresAt: now - 500, lastHeartbeatAt: now - 1000 });
+        yield portLease(28301, 'ended');
+        yield sweeper.sweep();
+        (0, chai_1.expect)(yield statusOf('ended')).to.equal('expired');
+        (0, chai_1.expect)(yield portsOf('ended'), 'its ports are freed').to.deep.equal([]);
+        (0, chai_1.expect)(releaseLeaseLock.calledOnceWith('udid-ended', 'http://127.0.0.1:4723')).to.equal(true);
+    }));
+    it('leaves a heartbeating lease alone until expiresAt', () => __awaiter(void 0, void 0, void 0, function* () {
+        yield lease('live', { expiresAt: now + 60000, lastHeartbeatAt: now - 1000 });
+        yield portLease(28302, 'live');
+        yield sweeper.sweep();
+        (0, chai_1.expect)(yield statusOf('live')).to.equal('active');
+        (0, chai_1.expect)(yield portsOf('live')).to.deep.equal([28302]);
+        (0, chai_1.expect)(releaseLeaseLock.called).to.equal(false);
+    }));
+    it('still reaps on missed heartbeats before expiresAt', () => __awaiter(void 0, void 0, void 0, function* () {
+        yield lease('silent', { expiresAt: now + 60000, lastHeartbeatAt: now - 120000 });
+        yield sweeper.sweep();
+        (0, chai_1.expect)(yield statusOf('silent')).to.equal('expired');
+        (0, chai_1.expect)(releaseLeaseLock.calledOnceWith('udid-silent', 'http://127.0.0.1:4723')).to.equal(true);
+    }));
+    it('never touches a lease that was released', () => __awaiter(void 0, void 0, void 0, function* () {
+        yield lease('gone', { expiresAt: now - 500, lastHeartbeatAt: now - 1000 });
+        yield scratch.db.lease.update({ where: { id: 'gone' }, data: { status: 'released' } });
+        yield sweeper.sweep();
+        (0, chai_1.expect)(yield statusOf('gone')).to.equal('released');
+        (0, chai_1.expect)(releaseLeaseLock.called).to.equal(false);
+    }));
+});
+describe('leaseReapReason', () => {
+    // Past expiresAt, heartbeat and extend refuse the lease (410), so by the next
+    // sweep its heartbeats are missed too. The end time is the cause; the lab's
+    // log said "missed heartbeats" for every such lease.
+    it('names the end time for a lease past expiresAt, even when its heartbeats are missed too', () => {
+        const now = Date.now();
+        const reason = (0, LeaseOrphanSweeper_1.leaseReapReason)({ heartbeatSeconds: 10, lastHeartbeatAt: now - 60000, expiresAt: now - 1000 }, now);
+        (0, chai_1.expect)(reason).to.match(/^expired at /);
+    });
+    it('names missed heartbeats for a lease before its end time', () => {
+        const now = Date.now();
+        const reason = (0, LeaseOrphanSweeper_1.leaseReapReason)({ heartbeatSeconds: 10, lastHeartbeatAt: now - 60000, expiresAt: now + 60000 }, now);
+        (0, chai_1.expect)(reason).to.equal('missed heartbeats');
+    });
+});

package/lib/test/unit/lease/lease-team-visibility.spec.js

@@ -16,7 +16,7 @@ require("reflect-metadata");
 const chai_1 = require("chai");
 const sinon_1 = __importDefault(require("sinon"));
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../../helpers/loopbackRequest"));
 const sdk_leases_1 = require("../../../src/app/routers/sdk-leases");
 const LeaseService_1 = require("../../../src/services/lease/LeaseService");
 const device_store_1 = require("../../../src/data-service/device-store");
@@ -120,7 +120,7 @@ describe('SDK leases respect the team boundary', () => {
             next();
         });
         app.use('/sdk/leases', (0, sdk_leases_1.makeRouter)({ leaseService: svc }));
-        return (0, supertest_1.default)(app)
+        return (0, loopbackRequest_1.default)(app)
             .post('/sdk/leases')
             .send({ filters: Object.assign({ platform: 'android', filterByHost: HOST }, filters) });
     }

package/lib/test/unit/lease/lease-token-log-filter.spec.js

@@ -21,95 +21,273 @@ const yaml_1 = __importDefault(require("yaml"));
 const secure_values_preprocessor_1 = require("@appium/logger/build/lib/secure-values-preprocessor");
 const constants_1 = require("@appium/base-driver/build/lib/constants");
 const leaseToken_1 = require("../../../src/services/lease/leaseToken");
-// Appium logs the POST /session body before any plugin sees it, so Xenon
-// can't strip the lease token from that line; the documented Appium log
-// filter has to. This runs the filter exactly as documented — the JSON for
-// --log-filters and the YAML for a --config file, read straight out of the
+// Appium logs every request body before any plugin sees it: the POST /session
+// capabilities with their tokens, and the dashboard's login body with its
+// password. Xenon can't strip them from those lines, so the documented Appium
+// log filters have to. This runs the filters exactly as documented — the JSON
+// for --log-filters and the YAML for a --config file, read straight out of the
 // doc — through Appium's own preprocessor, over the forms Appium logs.
-const DOC = path_1.default.resolve(__dirname, '../../../docs/superpowers/specs/2026-05-14-server-side-lease-api-design.md');
-const HEADING = "#### Keeping the lease token out of Appium's own log";
-function fencedBlock(language) {
-    const doc = fs_1.default.readFileSync(DOC, 'utf8');
-    const section = doc.slice(doc.indexOf(HEADING));
-    (0, chai_1.expect)(doc.indexOf(HEADING), `${HEADING} in ${DOC}`).to.be.greaterThan(-1);
-    const match = section.match(new RegExp('```' + language + '\\n([\\s\\S]*?)\\n```'));
-    if (!match)
-        throw new Error(`no ${language} block under ${HEADING}`);
-    return match[1];
+const ROOT = path_1.default.resolve(__dirname, '../../..');
+const DOC = path_1.default.join(ROOT, 'docs/superpowers/specs/2026-05-14-server-side-lease-api-design.md');
+const CHANGELOG = path_1.default.join(ROOT, 'CHANGELOG.md');
+const HEADING = "#### Keeping tokens and passwords out of Appium's own log";
+const REDACTED = '**REDACTED**';
+// The text from `heading` to the next heading of any level.
+function sectionAfter(text, heading) {
+    const start = text.indexOf(heading);
+    (0, chai_1.expect)(start, `${heading.trim()} found`).to.be.greaterThan(-1);
+    const rest = text.slice(start + heading.length);
+    const end = rest.search(/\n#+ /);
+    return end === -1 ? rest : rest.slice(0, end);
 }
+// Every ```language block in `text`, dedented by its fence's indent.
+function fencedBlocks(text, language) {
+    const fence = new RegExp('^( *)```' + language + '\\n([\\s\\S]*?)\\n\\1```', 'gm');
+    return [...text.matchAll(fence)].map(([, indent, body]) => body
+        .split('\n')
+        .map((line) => (line.startsWith(indent) ? line.slice(indent.length) : line))
+        .join('\n'));
+}
+// The doc's blocks: the token rule, then the password rule.
+const docBlocks = (language) => fencedBlocks(sectionAfter(fs_1.default.readFileSync(DOC, 'utf8'), HEADING), language);
+const RULE_INDEX = { token: 0, password: 1 };
+function docBlock(language, rule) {
+    const block = docBlocks(language)[RULE_INDEX[rule]];
+    (0, chai_1.expect)(block, `the ${rule} rule's ${language} block under ${HEADING}`).to.be.a('string');
+    return block;
+}
+const RULE_FORMS = [
+    ['--log-filters JSON', 'json', (block) => JSON.parse(block)],
+    [
+        '--config YAML (server.log-filters)',
+        'yaml',
+        (block) => yaml_1.default.parse(block).server['log-filters'],
+    ],
+];
 function filterFrom(rules) {
     return __awaiter(this, void 0, void 0, function* () {
         const pre = new secure_values_preprocessor_1.SecureValuesPreprocessor();
         (0, chai_1.expect)(yield pre.loadRules(rules)).to.deep.equal([]);
+        (0, chai_1.expect)(pre.rules).to.have.length(rules.length);
         return pre;
     });
 }
-const TOKEN = (0, leaseToken_1.generateToken)();
-function sessionBody(padding = 0) {
-    return JSON.stringify({
+// Appium's own cut: _.truncate to MAX_LOG_BODY_LENGTH, "..." included.
+const appiumCut = (body) => lodash_1.default.truncate(body, { length: constants_1.MAX_LOG_BODY_LENGTH });
+/**
+ * `body(padding)` cut by Appium `into` characters inside `secret` (the secret
+ * as the body spells it). Returns the cut body and where the secret starts.
+ */
+function cutInside(body, secret, into) {
+    const at = body(0).indexOf(secret);
+    (0, chai_1.expect)(at).to.be.greaterThan(-1);
+    const start = constants_1.MAX_LOG_BODY_LENGTH - '...'.length - into;
+    const cut = appiumCut(body(start - at));
+    (0, chai_1.expect)(cut.slice(start)).to.equal(secret.slice(0, into) + '...');
+    return { cut, start };
+}
+// `raw` with `length` characters at `start` replaced by the redaction mark.
+function redacted(raw, start, length) {
+    (0, chai_1.expect)(start).to.be.greaterThan(-1);
+    return { raw, expected: raw.slice(0, start) + REDACTED + raw.slice(start + length) };
+}
+// An [HTTP] request line: Appium logs the body, cut, after the method and URL.
+const httpLine = (url, body) => `[HTTP] --> POST ${url} ${body}`;
+// The same line as Appium colours it on a terminal.
+const colouredHttpLine = (url, body) => `[HTTP] \u001b[37m-->\u001b[39m \u001b[37mPOST\u001b[39m \u001b[37m${url}\u001b[39m ` +
+    `\u001b[90m${body}\u001b[39m`;
+// A line whose body Appium cut inside the secret: everything from the secret
+// on, the cut's "..." included, is redacted, and nothing before it changes.
+function cutLine(url, body, secret, into) {
+    const { cut, start } = cutInside(body, secret, into);
+    const raw = httpLine(url, cut);
+    const at = raw.length - cut.length + start;
+    return { raw, expected: raw.slice(0, at) + REDACTED };
+}
+const cutInto = (into) => `a body Appium cut ${into} character${into === 1 ? '' : 's'} into it`;
+// ---------------------------------------------------------------------------
+// Tokens: the API token, a session JWT and a lease token.
+const ACCESS_KEY = 'xen_AbC123dEf456';
+const TOKENS = [
+    {
+        key: 'token',
+        value: (0, leaseToken_1.generateToken)(),
+        options: { accessKey: ACCESS_KEY },
+    },
+    {
+        key: 'sessionToken',
+        value: 'eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJ1In0.sig_-x',
+        options: {},
+    },
+    {
+        key: 'leaseToken',
+        value: (0, leaseToken_1.generateToken)(),
+        options: { accessKey: ACCESS_KEY, leaseId: 'lse_1' },
+    },
+];
+function sessionRequest(options, padding = 0) {
+    return {
         capabilities: {
             alwaysMatch: {
                 platformName: 'Android',
                 'appium:padding': 'x'.repeat(padding),
-                'xe:options': { leaseId: 'lse_1', leaseToken: TOKEN },
+                'xe:options': options,
             },
             firstMatch: [{}],
         },
-    });
+    };
 }
-// Appium's own cut: _.truncate to MAX_LOG_BODY_LENGTH, "..." included.
-const appiumCut = (body) => lodash_1.default.truncate(body, { length: constants_1.MAX_LOG_BODY_LENGTH });
-// A body whose cut lands `into` characters inside the token.
-function truncatedInsideToken(into) {
-    const at = sessionBody().indexOf(TOKEN);
-    const cutAt = constants_1.MAX_LOG_BODY_LENGTH - '...'.length;
-    const cut = appiumCut(sessionBody(cutAt - at - into));
-    (0, chai_1.expect)(cut).to.include(TOKEN.slice(0, into));
-    (0, chai_1.expect)(cut).to.not.include(TOKEN);
-    return cut;
+function tokenLines(key, token, others) {
+    const options = Object.assign(Object.assign({}, others), { [key]: token });
+    const body = (padding = 0) => JSON.stringify(sessionRequest(options, padding));
+    const once = (raw) => redacted(raw, raw.indexOf(token), token.length);
+    const lines = [
+        ['the JSON body', () => once(body())],
+        ['the [HTTP] request line', () => once(httpLine('/session', appiumCut(body())))],
+        ['the coloured [HTTP] request line', () => once(colouredHttpLine('/session', body()))],
+        [
+            'the createSession args line',
+            () => once('Calling AppiumDriver.createSession() with args: ' +
+                appiumCut(JSON.stringify([null, null, sessionRequest(options).capabilities]))),
+        ],
+        ['util.inspect output', () => once(util_1.default.inspect(sessionRequest(options), { depth: 5 }))],
+        ['doubly-escaped JSON', () => once(JSON.stringify(body()))],
+    ];
+    for (const into of [1, 10, 30]) {
+        lines.push([cutInto(into), () => cutLine('/session', body, token, into)]);
+    }
+    return lines;
 }
-const LOGGED = [
-    ['the full JSON body', () => `--> POST /session ${sessionBody()}`],
-    [
-        'the colourised body Appium prints',
-        () => `--> POST /session \u001b[90m${sessionBody()}\u001b[39m`,
-    ],
-    [
-        'the createSession args line',
-        () => `Calling AppiumDriver.createSession() with args: ${appiumCut(JSON.stringify([null, null, JSON.parse(sessionBody()).capabilities]))}`,
-    ],
-    ['a util.inspect form', () => util_1.default.inspect(JSON.parse(sessionBody()), { depth: 5 })],
-    ['doubly-escaped JSON', () => JSON.stringify(sessionBody())],
-    ['a body Appium cut 30 characters into the token', () => truncatedInsideToken(30)],
-    ['a body Appium cut 1 character into the token', () => truncatedInsideToken(1)],
+// ---------------------------------------------------------------------------
+// Passwords: the dashboard's POST /xenon/api/auth/login body.
+const LOGIN_URL = '/xenon/api/auth/login';
+// A password can hold any character. Most of these would get past a rule that
+// stops at the first quote, or make one that doesn't read escapes eat the rest
+// of the line.
+const PASSWORDS = [
+    'hunter2-Hunter2',
+    "it's mine", // util.inspect switches to "..."
+    'say "hi", } then', // escaped quotes and JSON punctuation
+    'it\'s "all" `three`', // util.inspect escapes its own quote
+    'ends in a backslash\\',
+    '","password":"decoy', // reads like the next field
+    "password: 'decoy", // reads like the util.inspect key
+    'my token: abc"def', // the token rule rewrites part of it first
+    'tab\tnew\nline\u001bescape', // control characters are escaped
+    'pässwörd 🔑 ok',
 ];
-describe("the documented Appium log filter keeps the lease token out of Appium's log", () => {
-    const forms = [
-        ['--log-filters JSON', () => JSON.parse(fencedBlock('json'))],
+// Long enough to cut 30 characters in, with an escape early on. No astral
+// characters: lodash counts those as one when it cuts.
+const LONG_PASSWORD = 'c"x\\y it\'s, }] "correct horse" `battery` staple ä\n';
+function loginBody(password, padding = 0) {
+    // Padding the address moves the password, keeping the body's shape.
+    return { email: `${'x'.repeat(padding)}qa@example.com`, password };
+}
+function passwordLines(password) {
+    const body = (padding = 0) => JSON.stringify(loginBody(password, padding));
+    const json = JSON.stringify(password).slice(1, -1);
+    const inspected = util_1.default.inspect(password);
+    // Anchored on what follows the password: it is the body's last field.
+    const at = (raw, spelled, after) => redacted(raw, raw.lastIndexOf(spelled + after), spelled.length);
+    const lines = [
+        ['the JSON body', () => at(body(), json, '"}')],
+        ['the [HTTP] request line', () => at(httpLine(LOGIN_URL, appiumCut(body())), json, '"}')],
+        ['the coloured [HTTP] request line', () => at(colouredHttpLine(LOGIN_URL, body()), json, '"}')],
+        [
+            'util.inspect output',
+            () => at(util_1.default.inspect(loginBody(password)), inspected.slice(1, -1), inspected[0]),
+        ],
         [
-            '--config YAML (server.log-filters)',
-            () => yaml_1.default.parse(fencedBlock('yaml')).server['log-filters'],
+            'doubly-escaped JSON',
+            () => at(JSON.stringify(body()), JSON.stringify(json).slice(1, -1), '\\"}"'),
         ],
     ];
-    for (const [form, rules] of forms) {
+    return lines;
+}
+function passwordCutLines() {
+    const body = (padding = 0) => JSON.stringify(loginBody(LONG_PASSWORD, padding));
+    const json = JSON.stringify(LONG_PASSWORD).slice(1, -1);
+    return [1, 10, 30].map((into) => [
+        cutInto(into),
+        () => cutLine(LOGIN_URL, body, json, into),
+    ]);
+}
+describe("the documented Appium log filters keep tokens and passwords out of Appium's log", () => {
+    for (const [form, language, parse] of RULE_FORMS) {
         describe(form, () => {
-            for (const [name, line] of LOGGED) {
-                it(`redacts ${name}`, () => __awaiter(void 0, void 0, void 0, function* () {
-                    const pre = yield filterFrom(rules());
-                    const raw = line();
-                    const out = pre.preprocess(raw);
-                    // No run of the token's characters survives, not even its first one
-                    // beside the key.
-                    (0, chai_1.expect)(out).to.include('**LEASE TOKEN**');
-                    (0, chai_1.expect)(out).to.not.match(new RegExp(`leaseToken\\\\?["']?\\s*:\\s*\\\\?["']?${TOKEN[0]}`));
-                    (0, chai_1.expect)(out).to.not.include(TOKEN.slice(0, 8));
-                    // The lease id is not a secret, and the rest of the line is kept.
-                    (0, chai_1.expect)(out).to.include('lse_1');
-                }));
+            const tokenRule = () => parse(docBlock(language, 'token'));
+            const passwordRule = () => parse(docBlock(language, 'password'));
+            // An operator may run the token rule alone (it shipped first) or both.
+            const withTokenRule = [
+                ['the token rule', tokenRule],
+                ['both rules', () => [...tokenRule(), ...passwordRule()]],
+            ];
+            for (const { key, value, options } of TOKENS) {
+                describe(`a ${key}`, () => {
+                    for (const [name, line] of tokenLines(key, value, options)) {
+                        it(`is redacted from ${name}`, () => __awaiter(void 0, void 0, void 0, function* () {
+                            const { raw, expected } = line();
+                            for (const [rules, load] of withTokenRule) {
+                                const out = (yield filterFrom(load())).preprocess(raw);
+                                // Only the token changes: the access key, the lease id and
+                                // the rest of the line are kept.
+                                (0, chai_1.expect)(out, rules).to.equal(expected);
+                                (0, chai_1.expect)(out, rules).to.not.include(value.slice(0, 8));
+                                (0, chai_1.expect)(out, rules).to.not.match(new RegExp(`${key}\\\\?["']?\\s*:\\s*\\\\?["']?${lodash_1.default.escapeRegExp(value[0])}`));
+                            }
+                        }));
+                    }
+                });
             }
+            it('keeps the access key, which names a key without proving it', () => __awaiter(void 0, void 0, void 0, function* () {
+                const raw = JSON.stringify(sessionRequest({ accessKey: ACCESS_KEY }));
+                const pre = yield filterFrom([...tokenRule(), ...passwordRule()]);
+                (0, chai_1.expect)(pre.preprocess(raw)).to.equal(raw);
+            }));
+            describe('a password', () => {
+                for (const password of PASSWORDS) {
+                    for (const [name, line] of passwordLines(password)) {
+                        it(`${JSON.stringify(password)} is redacted from ${name}`, () => __awaiter(void 0, void 0, void 0, function* () {
+                            const { raw, expected } = line();
+                            for (const [rules, load] of [
+                                ['the password rule', passwordRule],
+                                ['both rules', () => [...tokenRule(), ...passwordRule()]],
+                            ]) {
+                                const out = (yield filterFrom(load())).preprocess(raw);
+                                // Exactly the password goes: the address, the closing quote
+                                // and everything after it stay.
+                                (0, chai_1.expect)(out, rules).to.equal(expected);
+                                (0, chai_1.expect)(out, rules).to.include('qa@example.com');
+                            }
+                        }));
+                    }
+                }
+                for (const [name, line] of passwordCutLines()) {
+                    it(`is redacted from ${name}`, () => __awaiter(void 0, void 0, void 0, function* () {
+                        const { raw, expected } = line();
+                        const out = (yield filterFrom([...tokenRule(), ...passwordRule()])).preprocess(raw);
+                        (0, chai_1.expect)(out).to.equal(expected);
+                    }));
+                }
+            });
         });
     }
-    it('reads the same rule in both forms', () => {
-        (0, chai_1.expect)(yaml_1.default.parse(fencedBlock('yaml')).server['log-filters']).to.deep.equal(JSON.parse(fencedBlock('json')));
+    it('shows each rule once in each form, and reads the same in both', () => {
+        (0, chai_1.expect)(docBlocks('json')).to.have.length(2);
+        (0, chai_1.expect)(docBlocks('yaml')).to.have.length(2);
+        for (const rule of ['token', 'password']) {
+            (0, chai_1.expect)(yaml_1.default.parse(docBlock('yaml', rule)).server['log-filters'], rule).to.deep.equal(JSON.parse(docBlock('json', rule)));
+        }
+    });
+    it('shows the token rule exactly as the 2.0.0 CHANGELOG publishes it', () => {
+        const changelog = fs_1.default.readFileSync(CHANGELOG, 'utf8');
+        const release = changelog.indexOf('\n## 2.0.0\n');
+        const entry = changelog.indexOf("**Keep tokens out of Appium's own request log.**", release);
+        (0, chai_1.expect)(release).to.be.greaterThan(-1);
+        (0, chai_1.expect)(entry).to.be.greaterThan(release);
+        for (const language of ['json', 'yaml']) {
+            const published = fencedBlocks(changelog.slice(entry), language)[0];
+            (0, chai_1.expect)(docBlock(language, 'token'), language).to.equal(published);
+        }
     });
 });