@xenon-device-management/xenon 2.0.0 → 2.2.0

package/lib/test/unit/node-gateway-create-appium-server.spec.js

@@ -0,0 +1,354 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const fs_1 = __importDefault(require("fs"));
+const http_1 = __importDefault(require("http"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const sinon_1 = __importDefault(require("sinon"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
+const typedi_1 = require("typedi");
+const plugin_1 = require("../../src/plugin");
+const registerCommandAuth_1 = require("../../src/app/registerCommandAuth");
+const defaultGateway_1 = require("../../src/gateway/defaultGateway");
+const hubSessionToken_1 = require("../../src/gateway/hubSessionToken");
+const JwtKeyService_1 = require("../../src/services/token/JwtKeyService");
+const PluginContext_1 = require("../../src/PluginContext");
+const IPluginArgs_1 = require("../../src/interfaces/IPluginArgs");
+const device_managers_1 = require("../../src/device-managers");
+const device_store_1 = require("../../src/data-service/device-store");
+const prisma_store_1 = require("../../src/data-service/prisma-store");
+const SessionManager_1 = require("../../src/sessions/SessionManager");
+const SessionLifecycleService_1 = require("../../src/services/SessionLifecycleService");
+const config_1 = require("../../src/config");
+const container_registration_1 = require("../helpers/container-registration");
+const scratch_database_1 = require("../helpers/scratch-database");
+const appium_umbrella_1 = require("../helpers/appium-umbrella");
+/**
+ * A Xenon node's side of a create the hub forwards, in Appium 3's own
+ * server(): Appium's real umbrella with Xenon's real plugin, the production
+ * node wiring (nodeGatewayOptions), the real SessionLifecycleService and a
+ * scratch SQLite database of the node's own.
+ *
+ * Each instance has its own database, so the node cannot check the client's
+ * key: the hub did. The hub's create carries a token it signed instead
+ * (x-xenon-hub-token, audience xenon-node-create), naming the verified owner,
+ * the phone and its node. The node checks it against the hub's JWKS, and it is
+ * the session's credential: it attributes the session and passes
+ * XENON_REQUIRE_SESSION_TOKEN.
+ *
+ * The hub here is only what the node talks to: an Appium server serving the
+ * hub's public keys. What the hub sends is hub-gateway-create-appium-server.spec.ts.
+ */
+const quiet = { info: () => undefined, warn: () => undefined, error: () => undefined };
+const NODE_ID = 'node-1';
+describe('a create the hub forwards, on the node, in Appium 3’s own server()', function () {
+    this.timeout(60000);
+    const scratch = (0, scratch_database_1.useScratchDatabase)();
+    const servers = [];
+    let dirs;
+    let hubKeys;
+    let appiumLogs;
+    let restore;
+    let saved;
+    let authDisabledBefore;
+    let gateBefore;
+    let umbrella;
+    let hubUrl;
+    let nodeOrigin;
+    let nodeAuthDisabled;
+    function keyService() {
+        return __awaiter(this, void 0, void 0, function* () {
+            const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-node-create-keys-'));
+            dirs.push(dir);
+            const keys = new JwtKeyService_1.JwtKeyService();
+            yield keys.init(dir);
+            return keys;
+        });
+    }
+    before(() => __awaiter(this, void 0, void 0, function* () {
+        appiumLogs = (0, appium_umbrella_1.quietAppiumLogs)();
+        dirs = [];
+        hubKeys = yield keyService();
+    }));
+    after(() => {
+        appiumLogs.restore();
+        for (const dir of dirs)
+            fs_1.default.rmSync(dir, { recursive: true, force: true });
+    });
+    beforeEach(() => __awaiter(this, void 0, void 0, function* () {
+        restore = (0, container_registration_1.saveRegistrations)(JwtKeyService_1.JwtKeyService, hubSessionToken_1.HubSessionTokenIssuer, device_managers_1.XenonManager);
+        // The hub's keys sign here only because the test mints what the hub would send.
+        typedi_1.Container.set(JwtKeyService_1.JwtKeyService, hubKeys);
+        typedi_1.Container.set(hubSessionToken_1.HubSessionTokenIssuer, new hubSessionToken_1.HubSessionTokenIssuer());
+        typedi_1.Container.set(device_managers_1.XenonManager, {
+            getMaxSessionCount: () => undefined,
+            deviceInstances: () => __awaiter(this, void 0, void 0, function* () { return []; }),
+        });
+        const context = typedi_1.Container.get(PluginContext_1.PluginContext);
+        saved = {
+            store: device_store_1.DeviceStoreFactory._deviceStore,
+            pending: device_store_1.DeviceStoreFactory._pendingSessionStore,
+            context: Object.assign({}, context),
+        };
+        device_store_1.DeviceStoreFactory._deviceStore = new prisma_store_1.PrismaDeviceStore();
+        device_store_1.DeviceStoreFactory._pendingSessionStore = new prisma_store_1.PrismaPendingSessionStore();
+        authDisabledBefore = config_1.config.authDisabled;
+        config_1.config.authDisabled = false;
+        nodeAuthDisabled = false;
+        gateBefore = process.env.XENON_REQUIRE_SESSION_TOKEN;
+        delete process.env.XENON_REQUIRE_SESSION_TOKEN;
+        yield scratch.db.pendingSession.deleteMany({});
+        yield scratch.db.device.deleteMany({});
+        yield boot();
+    }));
+    afterEach(() => __awaiter(this, void 0, void 0, function* () {
+        for (const s of SessionManager_1.SESSION_MANAGER.getAllSessions())
+            SessionManager_1.SESSION_MANAGER.removeSession(s.getId());
+        device_store_1.DeviceStoreFactory._deviceStore = saved.store;
+        device_store_1.DeviceStoreFactory._pendingSessionStore = saved.pending;
+        Object.assign(typedi_1.Container.get(PluginContext_1.PluginContext), saved.context);
+        config_1.config.authDisabled = authDisabledBefore;
+        if (gateBefore === undefined)
+            delete process.env.XENON_REQUIRE_SESSION_TOKEN;
+        else
+            process.env.XENON_REQUIRE_SESSION_TOKEN = gateBefore;
+        sinon_1.default.restore();
+        restore();
+        for (const s of servers.splice(0)) {
+            s.closeAllConnections();
+            yield new Promise((resolve) => http_1.default.Server.prototype.close.call(s, () => resolve()));
+        }
+    }));
+    const port = (s) => s.address().port;
+    function boot() {
+        return __awaiter(this, void 0, void 0, function* () {
+            const baseDriver = (0, appium_umbrella_1.appiumBaseDriver)();
+            // The hub: only its public keys matter to the node.
+            const hubServer = yield baseDriver.server({
+                routeConfiguringFunction: baseDriver.routeConfiguringFunction((0, appium_umbrella_1.umbrellaWith)([])),
+                port: 0,
+                hostname: '127.0.0.1',
+                basePath: '/wd/hub',
+                cliArgs: { basePath: '/wd/hub' },
+                serverUpdaters: [
+                    (app) => {
+                        app.get('/xenon/api/auth/jwks.json', (_req, res) => res.json(hubKeys.jwks()));
+                    },
+                ],
+            });
+            servers.push(hubServer);
+            hubUrl = `http://127.0.0.1:${port(hubServer)}`;
+            umbrella = (0, appium_umbrella_1.umbrellaWith)([[plugin_1.XenonPlugin, 'xenon']]);
+            const nodeServer = yield baseDriver.server({
+                routeConfiguringFunction: baseDriver.routeConfiguringFunction(umbrella),
+                port: 0,
+                hostname: '127.0.0.1',
+                basePath: '/node',
+                cliArgs: { basePath: '/node' },
+                serverUpdaters: [
+                    (app) => {
+                        (0, registerCommandAuth_1.registerSessionGateway)(app, { basePath: '/node' }, (0, registerCommandAuth_1.commandAuthDeps)({
+                            enabled: () => false,
+                            authDisabled: () => nodeAuthDisabled,
+                            logger: quiet,
+                        }), (0, defaultGateway_1.nodeGatewayOptions)(hubUrl));
+                    },
+                ],
+            });
+            servers.push(nodeServer);
+            nodeOrigin = `http://127.0.0.1:${port(nodeServer)}`;
+            typedi_1.Container.get(PluginContext_1.PluginContext).setContext(Object.assign(Object.assign({}, IPluginArgs_1.DefaultPluginArgs), { hub: hubUrl, bindHostOrIp: '127.0.0.1', 
+                // Registers the node's LocalSession in SESSION_MANAGER, where its owner is read.
+                enableDashboard: true, deviceAvailabilityTimeoutMs: 1000, deviceAvailabilityQueryIntervalMs: 100 }), port(nodeServer), NODE_ID, '/node');
+            for (const udid of ['phone-1', 'phone-2']) {
+                yield scratch.db.device.create({
+                    data: {
+                        udid,
+                        host: nodeOrigin,
+                        nodeId: NODE_ID,
+                        platform: 'android',
+                        name: udid,
+                        sdk: '14',
+                        busy: false,
+                        userBlocked: false,
+                        offline: false,
+                    },
+                });
+            }
+        });
+    }
+    /** What the hub mints for alice's create on phone-1. */
+    const hubToken = (grant = {}) => typedi_1.Container.get(hubSessionToken_1.HubSessionTokenIssuer).createTokenFor(Object.assign({ userId: 'alice', udid: 'phone-1', host: nodeOrigin }, grant));
+    /** The capabilities as the hub forwards them: no credentials, the phone pinned. */
+    const forwarded = (alwaysMatch = {}) => ({
+        capabilities: {
+            alwaysMatch: Object.assign({ platformName: 'Android', 'appium:automationName': appium_umbrella_1.FAKE_AUTOMATION, 'appium:newCommandTimeout': 0, 'appium:udid': 'phone-1', 
+                // No video: it would start Xenon's real capture pipeline for the phone.
+                'xe:options': { recordVideo: false } }, alwaysMatch),
+            firstMatch: [{}],
+        },
+    });
+    const create = (token_1, ...args_1) => __awaiter(this, [token_1, ...args_1], void 0, function* (token, body = forwarded()) {
+        const req = (0, loopbackRequest_1.default)(nodeOrigin).post('/node/session');
+        if (token !== undefined)
+            req.set(hubSessionToken_1.HUB_TOKEN_HEADER, token);
+        return req.send(body);
+    });
+    const row = (udid) => scratch.db.device.findFirst({ where: { udid } });
+    const settle = () => new Promise((resolve) => setTimeout(resolve, 50));
+    function expectNothingCreated() {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield settle();
+            (0, chai_1.expect)(Object.keys(umbrella.sessions), 'driver sessions').to.deep.equal([]);
+            (0, chai_1.expect)(yield row('phone-1')).to.include({ busy: false, session_id: null });
+            (0, chai_1.expect)(yield row('phone-2')).to.include({ busy: false, session_id: null });
+            (0, chai_1.expect)(yield scratch.db.pendingSession.count()).to.equal(0);
+        });
+    }
+    it('attributes the session to the owner the hub’s token names', () => __awaiter(this, void 0, void 0, function* () {
+        const res = yield create(yield hubToken());
+        (0, chai_1.expect)(res.status, JSON.stringify(res.body)).to.equal(200);
+        const sessionId = res.body.value.sessionId;
+        (0, chai_1.expect)(Object.keys(umbrella.sessions)).to.deep.equal([sessionId]);
+        const session = SessionManager_1.SESSION_MANAGER.getSession(sessionId);
+        (0, chai_1.expect)(session.userId).to.equal('alice');
+        (0, chai_1.expect)(session.apiKeyId).to.equal(null);
+        (0, chai_1.expect)(yield row('phone-1')).to.include({ busy: true, session_id: sessionId });
+        (0, chai_1.expect)(yield scratch.db.pendingSession.count()).to.equal(0);
+    }));
+    it('an unattributed create from the hub stays unattributed', () => __awaiter(this, void 0, void 0, function* () {
+        const res = yield create(yield hubToken({ userId: null }));
+        (0, chai_1.expect)(res.status, JSON.stringify(res.body)).to.equal(200);
+        (0, chai_1.expect)(SessionManager_1.SESSION_MANAGER.getSession(res.body.value.sessionId).userId).to.equal(null);
+    }));
+    describe('with XENON_REQUIRE_SESSION_TOKEN on', () => {
+        beforeEach(() => {
+            process.env.XENON_REQUIRE_SESSION_TOKEN = '1';
+        });
+        it('the hub’s token admits the session', () => __awaiter(this, void 0, void 0, function* () {
+            const res = yield create(yield hubToken());
+            (0, chai_1.expect)(res.status, JSON.stringify(res.body)).to.equal(200);
+        }));
+        it('a create with no credentials at all is refused, and nothing is allocated', () => __awaiter(this, void 0, void 0, function* () {
+            // Before the gate is asked: on a node, only the hub's creates are taken.
+            const res = yield create(undefined);
+            (0, chai_1.expect)(res.status).to.equal(500);
+            (0, chai_1.expect)(res.body.value.error).to.equal('session not created');
+            (0, chai_1.expect)(res.body.value.message).to.include('through the hub');
+            yield expectNothingCreated();
+        }));
+        it('client credentials the node cannot check are neither needed nor passed on', () => __awaiter(this, void 0, void 0, function* () {
+            const res = yield create(yield hubToken(), forwarded({
+                'xe:options': { accessKey: 'ak-unknown', token: 'CLIENT-SECRET', recordVideo: false },
+            }));
+            (0, chai_1.expect)(res.status, JSON.stringify(res.body)).to.equal(200);
+            const session = SessionManager_1.SESSION_MANAGER.getSession(res.body.value.sessionId);
+            (0, chai_1.expect)(session.userId).to.equal('alice');
+            const inner = umbrella.sessions[res.body.value.sessionId];
+            (0, chai_1.expect)(JSON.stringify(inner.originalCaps)).to.not.include('CLIENT-SECRET');
+        }));
+    });
+    describe('a token that is not the hub’s grant for this create', () => {
+        it('is refused when forged, expired or a command token, and nothing is allocated', () => __awaiter(this, void 0, void 0, function* () {
+            const forger = yield keyService();
+            const claims = { sub: 'alice', udid: 'phone-1', host: nodeOrigin };
+            const tokens = [
+                yield forger.sign(claims, { audience: hubSessionToken_1.HUB_CREATE_AUDIENCE, ttlSeconds: 120 }),
+                yield hubKeys.sign(claims, { audience: hubSessionToken_1.HUB_CREATE_AUDIENCE, ttlSeconds: -3600 }),
+                yield hubKeys.sign({ sid: 's-1' }, { audience: hubSessionToken_1.HUB_TOKEN_AUDIENCE, ttlSeconds: 300 }),
+                'not-a-jwt',
+            ];
+            for (const token of tokens) {
+                const res = yield create(token);
+                (0, chai_1.expect)(res.status, token).to.equal(400);
+                (0, chai_1.expect)(res.body.value.error).to.equal('invalid argument');
+                (0, chai_1.expect)(res.body.value.message).to.include('session rejected');
+            }
+            yield expectNothingCreated();
+        }));
+        it('is refused the second time: a create token is taken once', () => __awaiter(this, void 0, void 0, function* () {
+            const token = yield hubToken();
+            const first = yield create(token);
+            (0, chai_1.expect)(first.status, JSON.stringify(first.body)).to.equal(200);
+            const ended = yield (0, loopbackRequest_1.default)(nodeOrigin).delete(`/node/session/${first.body.value.sessionId}`);
+            (0, chai_1.expect)(ended.status, JSON.stringify(ended.body)).to.equal(200);
+            const again = yield create(token);
+            (0, chai_1.expect)(again.status).to.equal(400);
+            (0, chai_1.expect)(again.body.value.error).to.equal('invalid argument');
+            (0, chai_1.expect)(again.body.value.message).to.include('session rejected');
+            yield expectNothingCreated();
+        }));
+        it('is refused when the capabilities name another phone than the grant', () => __awaiter(this, void 0, void 0, function* () {
+            const res = yield create(yield hubToken(), forwarded({ 'appium:udid': 'phone-2' }));
+            (0, chai_1.expect)(res.status).to.equal(400);
+            (0, chai_1.expect)(res.body.value.message).to.include('session rejected');
+            yield expectNothingCreated();
+        }));
+        it('is refused, and the phone given back, when it names another node’s phone', () => __awaiter(this, void 0, void 0, function* () {
+            const res = yield create(yield hubToken({ host: 'http://10.9.9.9:4725' }));
+            (0, chai_1.expect)(res.status).to.equal(400);
+            (0, chai_1.expect)(res.body.value.message).to.include('session rejected');
+            yield expectNothingCreated();
+        }));
+        it('cannot be checked while the hub’s keys cannot be fetched: 503, and nothing is allocated', () => __awaiter(this, void 0, void 0, function* () {
+            const token = yield hubToken();
+            const hub = servers[0];
+            hub.closeAllConnections();
+            yield new Promise((resolve) => http_1.default.Server.prototype.close.call(hub, () => resolve()));
+            const res = yield create(token);
+            (0, chai_1.expect)(res.status).to.equal(503);
+            (0, chai_1.expect)(res.body.value.error).to.equal('unknown error');
+            yield expectNothingCreated();
+        }));
+    });
+    describe('a create that did not come from the hub', () => {
+        const direct = () => create(undefined, forwarded({
+            'xe:options': { accessKey: 'ak-node', token: 'node-secret', recordVideo: false },
+        }));
+        it('is refused, saying to create sessions through the hub, and nothing is allocated', () => __awaiter(this, void 0, void 0, function* () {
+            const res = yield direct();
+            (0, chai_1.expect)(res.status).to.equal(500);
+            (0, chai_1.expect)(res.body.value.error).to.equal('session not created');
+            (0, chai_1.expect)(res.body.value.message).to.include('through the hub');
+            (0, chai_1.expect)(res.body.value.message).to.include(hubUrl);
+            yield expectNothingCreated();
+        }));
+        it('is refused when it reaches the plugin without the gateway too', () => __awaiter(this, void 0, void 0, function* () {
+            const lifecycle = new SessionLifecycleService_1.SessionLifecycleService();
+            const caps = forwarded().capabilities;
+            let refused;
+            yield lifecycle
+                .createSession(() => ({}), umbrella, caps, { localOnly: true })
+                .catch((error) => (refused = error));
+            (0, chai_1.expect)(refused === null || refused === void 0 ? void 0 : refused.message).to.include('through the hub');
+            yield expectNothingCreated();
+        }));
+        it('still works on a node with auth disabled, as it did (local development)', () => __awaiter(this, void 0, void 0, function* () {
+            nodeAuthDisabled = true;
+            config_1.config.authDisabled = true;
+            const res = yield direct();
+            (0, chai_1.expect)(res.status, JSON.stringify(res.body)).to.equal(200);
+        }));
+    });
+    it('with the node’s auth disabled, a token is not checked and the session is unattributed', () => __awaiter(this, void 0, void 0, function* () {
+        nodeAuthDisabled = true;
+        config_1.config.authDisabled = true;
+        const res = yield create('not-a-jwt');
+        (0, chai_1.expect)(res.status, JSON.stringify(res.body)).to.equal(200);
+        (0, chai_1.expect)(SessionManager_1.SESSION_MANAGER.getSession(res.body.value.sessionId).userId).to.equal(null);
+    }));
+});

package/lib/test/unit/node-hub-session-owner.spec.js

@@ -0,0 +1,223 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const express_1 = __importDefault(require("express"));
+const fs_1 = __importDefault(require("fs"));
+const http_1 = __importDefault(require("http"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const sinon_1 = __importDefault(require("sinon"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
+const typedi_1 = require("typedi");
+const plugin_1 = require("../../src/plugin");
+const registerCommandAuth_1 = require("../../src/app/registerCommandAuth");
+const defaultGateway_1 = require("../../src/gateway/defaultGateway");
+const hubSessionToken_1 = require("../../src/gateway/hubSessionToken");
+const JwtKeyService_1 = require("../../src/services/token/JwtKeyService");
+const PluginContext_1 = require("../../src/PluginContext");
+const IPluginArgs_1 = require("../../src/interfaces/IPluginArgs");
+const device_managers_1 = require("../../src/device-managers");
+const device_store_1 = require("../../src/data-service/device-store");
+const prisma_store_1 = require("../../src/data-service/prisma-store");
+const SessionManager_1 = require("../../src/sessions/SessionManager");
+const SessionOwnerResolver_1 = require("../../src/services/device-access/SessionOwnerResolver");
+const LiveSessionOwners_1 = require("../../src/services/device-access/LiveSessionOwners");
+const deviceAccessGuard_1 = require("../../src/middleware/deviceAccessGuard");
+const config_1 = require("../../src/config");
+const container_registration_1 = require("../helpers/container-registration");
+const scratch_database_1 = require("../helpers/scratch-database");
+const appium_umbrella_1 = require("../helpers/appium-umbrella");
+/**
+ * Who owns a session the hub created on a node, as the node's own checks see
+ * it: SessionOwnerResolver, behind the /control ownership guard, the logcat
+ * WebSocket and the session listing.
+ *
+ * The node writes no Session row for a hub's session (the hub keeps the
+ * record), so the resolver, which read only rows, found no owner, and the
+ * fail-closed rule refused the device to everyone but admins, its owner
+ * included. The owner the hub's create token named is now known for as long
+ * as the session lives.
+ */
+const quiet = { info: () => undefined, warn: () => undefined, error: () => undefined };
+const NODE_ID = 'node-1';
+describe('the owner of a hub’s session, on the node', function () {
+    this.timeout(60000);
+    const scratch = (0, scratch_database_1.useScratchDatabase)();
+    const servers = [];
+    let dirs;
+    let hubKeys;
+    let appiumLogs;
+    let restore;
+    let saved;
+    let authDisabledBefore;
+    let nodeOrigin;
+    before(() => __awaiter(this, void 0, void 0, function* () {
+        appiumLogs = (0, appium_umbrella_1.quietAppiumLogs)();
+        dirs = [fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-node-owner-keys-'))];
+        hubKeys = new JwtKeyService_1.JwtKeyService();
+        yield hubKeys.init(dirs[0]);
+    }));
+    after(() => {
+        appiumLogs.restore();
+        for (const dir of dirs)
+            fs_1.default.rmSync(dir, { recursive: true, force: true });
+    });
+    beforeEach(() => __awaiter(this, void 0, void 0, function* () {
+        restore = (0, container_registration_1.saveRegistrations)(JwtKeyService_1.JwtKeyService, hubSessionToken_1.HubSessionTokenIssuer, device_managers_1.XenonManager, SessionOwnerResolver_1.SessionOwnerResolver, LiveSessionOwners_1.LiveSessionOwners);
+        typedi_1.Container.set(JwtKeyService_1.JwtKeyService, hubKeys);
+        typedi_1.Container.set(hubSessionToken_1.HubSessionTokenIssuer, new hubSessionToken_1.HubSessionTokenIssuer());
+        typedi_1.Container.set(SessionOwnerResolver_1.SessionOwnerResolver, new SessionOwnerResolver_1.SessionOwnerResolver());
+        typedi_1.Container.set(LiveSessionOwners_1.LiveSessionOwners, new LiveSessionOwners_1.LiveSessionOwners());
+        typedi_1.Container.set(device_managers_1.XenonManager, {
+            getMaxSessionCount: () => undefined,
+            deviceInstances: () => __awaiter(this, void 0, void 0, function* () { return []; }),
+        });
+        const context = typedi_1.Container.get(PluginContext_1.PluginContext);
+        saved = {
+            store: device_store_1.DeviceStoreFactory._deviceStore,
+            pending: device_store_1.DeviceStoreFactory._pendingSessionStore,
+            context: Object.assign({}, context),
+        };
+        device_store_1.DeviceStoreFactory._deviceStore = new prisma_store_1.PrismaDeviceStore();
+        device_store_1.DeviceStoreFactory._pendingSessionStore = new prisma_store_1.PrismaPendingSessionStore();
+        authDisabledBefore = config_1.config.authDisabled;
+        config_1.config.authDisabled = false;
+        yield scratch.db.pendingSession.deleteMany({});
+        yield scratch.db.session.deleteMany({});
+        yield scratch.db.device.deleteMany({});
+        yield boot();
+    }));
+    afterEach(() => __awaiter(this, void 0, void 0, function* () {
+        for (const s of SessionManager_1.SESSION_MANAGER.getAllSessions())
+            SessionManager_1.SESSION_MANAGER.removeSession(s.getId());
+        device_store_1.DeviceStoreFactory._deviceStore = saved.store;
+        device_store_1.DeviceStoreFactory._pendingSessionStore = saved.pending;
+        Object.assign(typedi_1.Container.get(PluginContext_1.PluginContext), saved.context);
+        config_1.config.authDisabled = authDisabledBefore;
+        sinon_1.default.restore();
+        restore();
+        for (const s of servers.splice(0)) {
+            s.closeAllConnections();
+            yield new Promise((resolve) => http_1.default.Server.prototype.close.call(s, () => resolve()));
+        }
+    }));
+    const port = (s) => s.address().port;
+    function boot() {
+        return __awaiter(this, void 0, void 0, function* () {
+            const baseDriver = (0, appium_umbrella_1.appiumBaseDriver)();
+            const hubServer = yield baseDriver.server({
+                routeConfiguringFunction: baseDriver.routeConfiguringFunction((0, appium_umbrella_1.umbrellaWith)([])),
+                port: 0,
+                hostname: '127.0.0.1',
+                basePath: '/wd/hub',
+                cliArgs: { basePath: '/wd/hub' },
+                serverUpdaters: [
+                    (app) => {
+                        app.get('/xenon/api/auth/jwks.json', (_req, res) => res.json(hubKeys.jwks()));
+                    },
+                ],
+            });
+            servers.push(hubServer);
+            const hubUrl = `http://127.0.0.1:${port(hubServer)}`;
+            const nodeServer = yield baseDriver.server({
+                routeConfiguringFunction: baseDriver.routeConfiguringFunction((0, appium_umbrella_1.umbrellaWith)([[plugin_1.XenonPlugin, 'xenon']])),
+                port: 0,
+                hostname: '127.0.0.1',
+                basePath: '/node',
+                cliArgs: { basePath: '/node' },
+                serverUpdaters: [
+                    (app) => {
+                        (0, registerCommandAuth_1.registerSessionGateway)(app, { basePath: '/node' }, (0, registerCommandAuth_1.commandAuthDeps)({ enabled: () => false, authDisabled: () => false, logger: quiet }), (0, defaultGateway_1.nodeGatewayOptions)(hubUrl));
+                        // The node's /control ownership guard, with a caller named by a header.
+                        const control = express_1.default.Router();
+                        control.use((0, deviceAccessGuard_1.deviceAccessGuard)());
+                        control.post('/:udid/tap', (_req, res) => res.json({ success: true }));
+                        app.use('/control', (req, _res, next) => {
+                            req.auth = { userId: req.headers['x-test-user'], role: 'MEMBER', scopes: 'devices' };
+                            next();
+                        }, control);
+                    },
+                ],
+            });
+            servers.push(nodeServer);
+            nodeOrigin = `http://127.0.0.1:${port(nodeServer)}`;
+            // The node's dashboard is off, as it usually is.
+            typedi_1.Container.get(PluginContext_1.PluginContext).setContext(Object.assign(Object.assign({}, IPluginArgs_1.DefaultPluginArgs), { hub: hubUrl, bindHostOrIp: '127.0.0.1', enableDashboard: false, deviceAvailabilityTimeoutMs: 1000, deviceAvailabilityQueryIntervalMs: 100 }), port(nodeServer), NODE_ID, '/node');
+            yield scratch.db.device.create({
+                data: {
+                    udid: 'phone-1',
+                    host: nodeOrigin,
+                    nodeId: NODE_ID,
+                    platform: 'android',
+                    name: 'phone-1',
+                    sdk: '14',
+                    busy: false,
+                    userBlocked: false,
+                    offline: false,
+                },
+            });
+        });
+    }
+    /** alice's session on phone-1, created as the hub creates it. */
+    function hubSession() {
+        return __awaiter(this, void 0, void 0, function* () {
+            const token = yield typedi_1.Container.get(hubSessionToken_1.HubSessionTokenIssuer).createTokenFor({
+                userId: 'alice',
+                udid: 'phone-1',
+                host: nodeOrigin,
+            });
+            const res = yield (0, loopbackRequest_1.default)(nodeOrigin)
+                .post('/node/session')
+                .set(hubSessionToken_1.HUB_TOKEN_HEADER, token)
+                .send({
+                capabilities: {
+                    alwaysMatch: {
+                        platformName: 'Android',
+                        'appium:automationName': appium_umbrella_1.FAKE_AUTOMATION,
+                        'appium:newCommandTimeout': 0,
+                        'appium:udid': 'phone-1',
+                        'xe:options': { recordVideo: false },
+                    },
+                    firstMatch: [{}],
+                },
+            });
+            (0, chai_1.expect)(res.status, JSON.stringify(res.body)).to.equal(200);
+            return res.body.value.sessionId;
+        });
+    }
+    const tap = (user) => (0, loopbackRequest_1.default)(nodeOrigin).post('/control/phone-1/tap').set('x-test-user', user).send({ x: 1, y: 1 });
+    it('is the owner the hub’s create token named, while the session lives', () => __awaiter(this, void 0, void 0, function* () {
+        const sessionId = yield hubSession();
+        (0, chai_1.expect)(yield scratch.db.session.count(), 'Session rows on the node').to.equal(0);
+        const owners = typedi_1.Container.get(SessionOwnerResolver_1.SessionOwnerResolver);
+        (0, chai_1.expect)(yield owners.ownerOf(sessionId)).to.equal('alice');
+        (0, chai_1.expect)((yield owners.ownersOf([sessionId])).get(sessionId)).to.equal('alice');
+    }));
+    it('lets its owner use the phone on the node, and nobody else', () => __awaiter(this, void 0, void 0, function* () {
+        yield hubSession();
+        const alice = yield tap('alice');
+        (0, chai_1.expect)(alice.status, JSON.stringify(alice.body)).to.equal(200);
+        const bob = yield tap('bob');
+        (0, chai_1.expect)(bob.status).to.equal(409);
+        (0, chai_1.expect)(bob.body.error).to.equal('device_in_use_by_session');
+    }));
+    it('is forgotten when the session ends', () => __awaiter(this, void 0, void 0, function* () {
+        const sessionId = yield hubSession();
+        (0, chai_1.expect)(typedi_1.Container.get(LiveSessionOwners_1.LiveSessionOwners).ownerOf(sessionId)).to.equal('alice');
+        yield (0, loopbackRequest_1.default)(nodeOrigin).delete(`/node/session/${sessionId}`).expect(200);
+        (0, chai_1.expect)(typedi_1.Container.get(LiveSessionOwners_1.LiveSessionOwners).ownerOf(sessionId)).to.equal(undefined);
+    }));
+});