@xenon-device-management/xenon 2.0.0 → 2.2.0

package/lib/test/unit/reset-link.test.js

@@ -16,7 +16,7 @@ require("reflect-metadata");
 const chai_1 = require("chai");
 const sinon_1 = __importDefault(require("sinon"));
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const typedi_1 = require("typedi");
 const users_1 = require("../../src/app/routers/users");
 const auth_1 = require("../../src/app/routers/auth");
@@ -71,7 +71,7 @@ describe('password-reset links', () => {
                     logged.push(args.map(String).join(' '));
                 });
             }
-            const r = yield (0, supertest_1.default)(usersApp({ userId: 'admin1', role: 'ADMIN' })).post('/users/m1/reset-link');
+            const r = yield (0, loopbackRequest_1.default)(usersApp({ userId: 'admin1', role: 'ADMIN' })).post('/users/m1/reset-link');
             (0, chai_1.expect)(r.status).to.equal(200);
             (0, chai_1.expect)(r.body.emailed).to.equal(false);
             (0, chai_1.expect)(r.body.link).to.match(new RegExp(`/xenon/reset-password#${RAW}$`));
@@ -87,7 +87,7 @@ describe('password-reset links', () => {
                 .stub(typedi_1.Container.get(PasswordResetService_1.PasswordResetService), 'createToken')
                 .resolves({ raw: RAW, id: 't1' });
             const send = sinon_1.default.stub(typedi_1.Container.get(EmailService_1.EmailService), 'send').resolves();
-            const r = yield (0, supertest_1.default)(usersApp({ userId: 'admin1', role: 'ADMIN' })).post('/users/m1/reset-link');
+            const r = yield (0, loopbackRequest_1.default)(usersApp({ userId: 'admin1', role: 'ADMIN' })).post('/users/m1/reset-link');
             (0, chai_1.expect)(r.status).to.equal(200);
             (0, chai_1.expect)(r.body).to.include({ emailed: true });
             (0, chai_1.expect)(r.body).to.not.have.property('link');
@@ -99,20 +99,20 @@ describe('password-reset links', () => {
                 .stub(prisma_1.prisma.user, 'findUnique')
                 .resolves(Object.assign(Object.assign({}, member), { id: 's1', role: 'SUPER_ADMIN' }));
             const create = sinon_1.default.stub(typedi_1.Container.get(PasswordResetService_1.PasswordResetService), 'createToken');
-            const r = yield (0, supertest_1.default)(usersApp({ userId: 'admin1', role: 'ADMIN' })).post('/users/s1/reset-link');
+            const r = yield (0, loopbackRequest_1.default)(usersApp({ userId: 'admin1', role: 'ADMIN' })).post('/users/s1/reset-link');
             (0, chai_1.expect)(r.status).to.equal(403);
             (0, chai_1.expect)(create.called).to.equal(false);
         }));
         it('refuses an ADMIN issuing a link for another ADMIN', () => __awaiter(void 0, void 0, void 0, function* () {
             sinon_1.default.stub(prisma_1.prisma.user, 'findUnique').resolves(Object.assign(Object.assign({}, member), { id: 'a2', role: 'ADMIN' }));
             const create = sinon_1.default.stub(typedi_1.Container.get(PasswordResetService_1.PasswordResetService), 'createToken');
-            const r = yield (0, supertest_1.default)(usersApp({ userId: 'admin1', role: 'ADMIN' })).post('/users/a2/reset-link');
+            const r = yield (0, loopbackRequest_1.default)(usersApp({ userId: 'admin1', role: 'ADMIN' })).post('/users/a2/reset-link');
             (0, chai_1.expect)(r.status).to.equal(403);
             (0, chai_1.expect)(create.called).to.equal(false);
         }));
         it('refuses a link for yourself', () => __awaiter(void 0, void 0, void 0, function* () {
             const create = sinon_1.default.stub(typedi_1.Container.get(PasswordResetService_1.PasswordResetService), 'createToken');
-            const r = yield (0, supertest_1.default)(usersApp({ userId: 'me', role: 'SUPER_ADMIN' })).post('/users/me/reset-link');
+            const r = yield (0, loopbackRequest_1.default)(usersApp({ userId: 'me', role: 'SUPER_ADMIN' })).post('/users/me/reset-link');
             (0, chai_1.expect)(r.status).to.equal(400);
             (0, chai_1.expect)(create.called).to.equal(false);
         }));
@@ -121,9 +121,9 @@ describe('password-reset links', () => {
             const create = sinon_1.default.stub(typedi_1.Container.get(PasswordResetService_1.PasswordResetService), 'createToken');
             const app = usersApp({ userId: 'root', role: 'SUPER_ADMIN' });
             find.resolves(null);
-            (0, chai_1.expect)((yield (0, supertest_1.default)(app).post('/users/nope/reset-link')).status).to.equal(404);
+            (0, chai_1.expect)((yield (0, loopbackRequest_1.default)(app).post('/users/nope/reset-link')).status).to.equal(404);
             find.resolves(Object.assign(Object.assign({}, member), { status: 'DISABLED' }));
-            (0, chai_1.expect)((yield (0, supertest_1.default)(app).post('/users/m1/reset-link')).status).to.equal(409);
+            (0, chai_1.expect)((yield (0, loopbackRequest_1.default)(app).post('/users/m1/reset-link')).status).to.equal(409);
             (0, chai_1.expect)(create.called).to.equal(false);
         }));
     });
@@ -154,7 +154,7 @@ describe('password-reset links', () => {
                 .resolves({ id: 'u1', email: 'u@x.local', name: 'U', status: 'ACTIVE' });
             const find = typedi_1.Container.get(UserService_1.UserService).findByEmail;
             const create = sinon_1.default.stub(typedi_1.Container.get(PasswordResetService_1.PasswordResetService), 'createToken');
-            const r = yield (0, supertest_1.default)(authApp()).post('/auth/forgot-password').send({ email: 'u@x.local' });
+            const r = yield (0, loopbackRequest_1.default)(authApp()).post('/auth/forgot-password').send({ email: 'u@x.local' });
             // The mint-or-skip decision runs in the same continuation as the user
             // lookup, so once the lookup has resolved and a macrotask has passed,
             // createToken has either been called or never will be.
@@ -172,7 +172,7 @@ describe('password-reset links', () => {
                 .stub(typedi_1.Container.get(PasswordResetService_1.PasswordResetService), 'createToken')
                 .resolves({ raw: RAW, id: 't1' });
             const send = sinon_1.default.stub(typedi_1.Container.get(EmailService_1.EmailService), 'send').resolves();
-            yield (0, supertest_1.default)(authApp()).post('/auth/forgot-password').send({ email: 'u@x.local' });
+            yield (0, loopbackRequest_1.default)(authApp()).post('/auth/forgot-password').send({ email: 'u@x.local' });
             yield until(() => send.called);
             (0, chai_1.expect)(send.calledOnce).to.equal(true);
             (0, chai_1.expect)(send.firstCall.args[0].text).to.include(`/xenon/reset-password#${RAW}`);
@@ -191,10 +191,10 @@ describe('password-reset links', () => {
             const verify = sinon_1.default
                 .stub(typedi_1.Container.get(PasswordResetService_1.PasswordResetService), 'verifyToken')
                 .resolves({ id: 't1', userId: 'u1' });
-            const ok = yield (0, supertest_1.default)(app).post('/auth/reset-password/check').send({ token: RAW });
+            const ok = yield (0, loopbackRequest_1.default)(app).post('/auth/reset-password/check').send({ token: RAW });
             (0, chai_1.expect)(ok.status).to.equal(200);
             (0, chai_1.expect)(verify.firstCall.args[0]).to.equal(RAW);
-            const old = yield (0, supertest_1.default)(app).get(`/auth/reset-password/check/${RAW}`);
+            const old = yield (0, loopbackRequest_1.default)(app).get(`/auth/reset-password/check/${RAW}`);
             (0, chai_1.expect)(old.status).to.equal(404);
         }));
     });
@@ -210,7 +210,7 @@ describe('password-reset links', () => {
             sinon_1.default.stub(reset, 'consume').resolves();
             sinon_1.default.stub(typedi_1.Container.get(UserSessionService_1.UserSessionService), 'revokeAllForUser').resolves();
             const revoke = sinon_1.default.stub(reset, 'revokeAllForUser').resolves(2);
-            const r = yield (0, supertest_1.default)(app)
+            const r = yield (0, loopbackRequest_1.default)(app)
                 .post('/auth/reset-password')
                 .send({ token: RAW, newPassword: 'a-new-password' });
             (0, chai_1.expect)(r.status).to.equal(204);
@@ -229,7 +229,7 @@ describe('password-reset links', () => {
             const revoke = sinon_1.default
                 .stub(typedi_1.Container.get(PasswordResetService_1.PasswordResetService), 'revokeAllForUser')
                 .resolves(1);
-            const r = yield (0, supertest_1.default)(app)
+            const r = yield (0, loopbackRequest_1.default)(app)
                 .post('/auth/change-password')
                 .send({ oldPassword: 'old-password', newPassword: 'new-password' });
             (0, chai_1.expect)(r.status).to.equal(204);

package/lib/test/unit/session-app-resolution.spec.js

@@ -51,8 +51,10 @@ const sinon_1 = __importDefault(require("sinon"));
 const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
+const jose = __importStar(require("jose"));
 const typedi_1 = require("typedi");
 const SessionLifecycleService_1 = require("../../src/services/SessionLifecycleService");
+const hubSessionToken_1 = require("../../src/gateway/hubSessionToken");
 const PluginContext_1 = require("../../src/PluginContext");
 const ApiKeyService_1 = require("../../src/services/ApiKeyService");
 const UserService_1 = require("../../src/services/UserService");
@@ -111,7 +113,7 @@ describe('createSession — an app named by id follows the team rule', () => {
     let restore;
     let pendingCopy;
     let finalCaps;
-    let unblock;
+    let release;
     const create = (c) => __awaiter(void 0, void 0, void 0, function* () {
         const next = sinon_1.default.stub().callsFake(() => __awaiter(void 0, void 0, void 0, function* () {
             driverCaps = JSON.parse(JSON.stringify(c));
@@ -152,8 +154,8 @@ describe('createSession — an app named by id follows the team rule', () => {
         }));
         sinon_1.default.stub(pendingSessions, 'removePendingSession').resolves();
         sinon_1.default.stub(deviceService, 'updateDeviceProgress').resolves();
-        sinon_1.default.stub(deviceService, 'updatedAllocatedDevice').resolves();
-        unblock = sinon_1.default.stub(deviceService, 'unblockDevice').resolves();
+        sinon_1.default.stub(deviceService, 'claimDeviceForSession').resolves(true);
+        release = sinon_1.default.stub(deviceService, 'releasePendingClaim').resolves(true);
         svc = new SessionLifecycleService_1.SessionLifecycleService();
         sinon_1.default.stub(svc, 'createSessionInstance').callsFake((...args) => {
             finalCaps = JSON.parse(JSON.stringify(args[2]));
@@ -286,7 +288,7 @@ describe('createSession — an app named by id follows the team rule', () => {
                 (0, chai_1.expect)(text, where).to.not.match(/"token"|"accessKey"/);
             }
         }));
-        it('a peer node gets the ticket and the credentials; the hub keeps neither', () => __awaiter(void 0, void 0, void 0, function* () {
+        it('a peer node gets the ticket and the hub’s token, never the credentials; the hub keeps neither', () => __awaiter(void 0, void 0, void 0, function* () {
             allocate.resolves({
                 udid: 'u2',
                 host: 'http://10.0.0.2:4723',
@@ -294,18 +296,19 @@ describe('createSession — an app named by id follows the team rule', () => {
                 nodeId: 'node-2',
             });
             let forwarded;
-            sinon_1.default.stub(svc, 'forwardSessionRequest').callsFake((_d, fc) => __awaiter(void 0, void 0, void 0, function* () {
+            let hubToken;
+            sinon_1.default.stub(svc, 'forwardSessionRequest').callsFake((_d, fc, t) => __awaiter(void 0, void 0, void 0, function* () {
                 forwarded = JSON.parse(JSON.stringify(fc));
+                hubToken = t;
                 return { value: ['sess-2', { platformName: 'Android' }] };
             }));
             sinon_1.default.stub(svc, 'finalizeSession').resolves();
             const c = caps('app-a', 'ak_team_a');
             yield svc.createSession(sinon_1.default.stub(), {}, c);
             (0, chai_1.expect)(parseAppUrl(forwarded.alwaysMatch['appium:app']).appId).to.equal('app-a');
-            (0, chai_1.expect)(forwarded.alwaysMatch['xe:options']).to.deep.equal({
-                accessKey: 'ak_team_a',
-                token: 'tk',
-            });
+            (0, chai_1.expect)(forwarded.alwaysMatch['xe:options']).to.deep.equal({});
+            (0, chai_1.expect)(JSON.stringify(forwarded)).to.not.match(/"token"|"accessKey"/);
+            (0, chai_1.expect)(jose.decodeJwt(hubToken)).to.include({ aud: hubSessionToken_1.HUB_CREATE_AUDIENCE, udid: 'u2' });
             for (const [where, seen] of Object.entries({ pendingCopy, sent: c })) {
                 const text = JSON.stringify(seen);
                 (0, chai_1.expect)(text, where).to.include(PLAIN);
@@ -326,6 +329,7 @@ describe('createSession — an app named by id follows the team rule', () => {
         }
         (0, chai_1.expect)(String(err === null || err === void 0 ? void 0 : err.message)).to.match(/app-a.*JWT key service not initialized/);
         (0, chai_1.expect)(driverCaps, 'the driver was never started').to.equal(undefined);
-        (0, chai_1.expect)(unblock.calledOnceWith('u1', 'h1')).to.equal(true);
+        (0, chai_1.expect)(release.calledOnce).to.equal(true);
+        (0, chai_1.expect)(release.firstCall.args[0]).to.include({ udid: 'u1', host: 'h1' });
     }));
 });

package/lib/test/unit/session-assets.spec.js

@@ -16,7 +16,7 @@ require("reflect-metadata");
 const chai_1 = require("chai");
 const sinon_1 = __importDefault(require("sinon"));
 const express_1 = __importDefault(require("express"));
-const supertest_1 = __importDefault(require("supertest"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
 const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
@@ -99,12 +99,12 @@ describe('session files', () => {
         fs_1.default.rmSync(dir, { recursive: true, force: true });
     });
     it("serves a visible session's screenshot to a member", () => __awaiter(void 0, void 0, void 0, function* () {
-        const r = yield (0, supertest_1.default)(app(member)).get('/session/sess-shared/asset/screenshots/shot.png');
+        const r = yield (0, loopbackRequest_1.default)(app(member)).get('/session/sess-shared/asset/screenshots/shot.png');
         (0, chai_1.expect)(r.status).to.equal(200);
         (0, chai_1.expect)(String(r.body)).to.equal('png of sess-shared');
     }));
     it('serves a video with Range, for seeking', () => __awaiter(void 0, void 0, void 0, function* () {
-        const r = yield (0, supertest_1.default)(app(member))
+        const r = yield (0, loopbackRequest_1.default)(app(member))
             .get('/session/sess-shared/asset/video/sess-shared.mp4')
             .set('Range', 'bytes=2-4');
         (0, chai_1.expect)(r.status).to.equal(206);
@@ -116,15 +116,15 @@ describe('session files', () => {
             error: true,
             message: `Session with id ${id} not found`,
         });
-        const hidden = yield (0, supertest_1.default)(app(member)).get('/session/sess-b/asset/screenshots/shot.png');
-        const unknown = yield (0, supertest_1.default)(app(member)).get('/session/sess-nope/asset/screenshots/shot.png');
+        const hidden = yield (0, loopbackRequest_1.default)(app(member)).get('/session/sess-b/asset/screenshots/shot.png');
+        const unknown = yield (0, loopbackRequest_1.default)(app(member)).get('/session/sess-nope/asset/screenshots/shot.png');
         (0, chai_1.expect)(unknown.status).to.equal(404);
         (0, chai_1.expect)(unknown.body).to.deep.equal(unknownBody('sess-nope'));
         (0, chai_1.expect)(hidden.status).to.equal(404);
         (0, chai_1.expect)(hidden.body).to.deep.equal(unknownBody('sess-b'));
     }));
     it("an admin gets another team's session file", () => __awaiter(void 0, void 0, void 0, function* () {
-        const r = yield (0, supertest_1.default)(app(admin)).get('/session/sess-b/asset/screenshots/shot.png');
+        const r = yield (0, loopbackRequest_1.default)(app(admin)).get('/session/sess-b/asset/screenshots/shot.png');
         (0, chai_1.expect)(r.status).to.equal(200);
         (0, chai_1.expect)(String(r.body)).to.equal('png of sess-b');
     }));
@@ -136,14 +136,14 @@ describe('session files', () => {
             '/session/sess-shared/asset/screenshots/%2e%2e%2finterceptor%2fsession.har',
             '/session/sess-shared/asset/video/..%2f..%2frecordings%2fgrp%2fcomposite.mp4',
         ]) {
-            const r = yield (0, supertest_1.default)(app(admin)).get(url);
+            const r = yield (0, loopbackRequest_1.default)(app(admin)).get(url);
             (0, chai_1.expect)(r.status, url).to.equal(404);
             (0, chai_1.expect)(r.text, url).to.not.include('HAR-SECRET');
             (0, chai_1.expect)(r.text, url).to.not.include('COMPOSITE-SECRET');
         }
     }));
     it('a missing file in a visible session is a JSON 404', () => __awaiter(void 0, void 0, void 0, function* () {
-        const r = yield (0, supertest_1.default)(app(member)).get('/session/sess-shared/asset/screenshots/none.png');
+        const r = yield (0, loopbackRequest_1.default)(app(member)).get('/session/sess-shared/asset/screenshots/none.png');
         (0, chai_1.expect)(r.status).to.equal(404);
         (0, chai_1.expect)(r.body).to.have.property('error');
     }));
@@ -160,7 +160,7 @@ describe('session files', () => {
         it('no longer serves session files to a caller with no login', () => __awaiter(void 0, void 0, void 0, function* () {
             const a = (0, express_1.default)();
             a.use('/xenon', (0, index_1.createRouter)({ bindHostOrIp: '127.0.0.1', enableDashboard: true }));
-            const r = yield (0, supertest_1.default)(a).get(`/xenon/session-recordings/${path_1.default.basename(probeDir)}/secret.txt`);
+            const r = yield (0, loopbackRequest_1.default)(a).get(`/xenon/session-recordings/${path_1.default.basename(probeDir)}/secret.txt`);
             (0, chai_1.expect)(r.text).to.not.include(secret);
         }));
     });

package/lib/test/unit/session-attribution-wiring.spec.js

@@ -36,15 +36,22 @@ const capsWith = (obj) => ({
 describe('authorizeSessionRequest — identity', () => {
     let svc;
     let authDisabledBefore;
+    let restore;
     beforeEach(() => {
         authDisabledBefore = config_1.config.authDisabled;
         config_1.config.authDisabled = false;
-        svc = typedi_1.Container.get(SessionLifecycleService_1.SessionLifecycleService);
+        restore = (0, container_registration_1.saveRegistrations)(ApiKeyService_1.ApiKeyService, JwtKeyService_1.JwtKeyService, UserService_1.UserService);
+        // No such user and no teams, as the developer's database answered for
+        // these ids: the real lookups read that database. Nothing here is about
+        // the owner's teams.
+        typedi_1.Container.set(UserService_1.UserService, { findById: () => __awaiter(void 0, void 0, void 0, function* () { return null; }) });
+        sinon_1.default.stub(prisma_1.prisma.teamMember, 'findMany').resolves([]);
+        svc = new SessionLifecycleService_1.SessionLifecycleService();
     });
     afterEach(() => {
         config_1.config.authDisabled = authDisabledBefore;
         sinon_1.default.restore();
-        typedi_1.Container.reset();
+        restore();
     });
     it('returns both ids for a valid xe:options pair', () => __awaiter(void 0, void 0, void 0, function* () {
         typedi_1.Container.set(ApiKeyService_1.ApiKeyService, {
@@ -304,6 +311,26 @@ describe('authorizeSessionRequest — leaseAccess', () => {
             }
             (0, chai_1.expect)(error === null || error === void 0 ? void 0 : error.message).to.match(/not allowed/);
         }));
+        it('reads the team from xe:options.team, over a flat cap, and still checks it', () => __awaiter(void 0, void 0, void 0, function* () {
+            withKey(keyRow('sessions'), user('MEMBER'));
+            teamRows.resolves([{ teamId: 'team_a' }, { teamId: 'team_b' }]);
+            const caps = (team) => capsWith({
+                'xe:options': { accessKey: 'ak', token: 'tk', team },
+                'xenon:team': 'team_a',
+            });
+            (0, chai_1.expect)(yield scope(caps('team_b'))).to.deep.equal({
+                callerTeamIds: ['team_b'],
+                scoped: true,
+            });
+            let error;
+            try {
+                yield invoke(svc, caps('team_c'));
+            }
+            catch (e) {
+                error = e;
+            }
+            (0, chai_1.expect)(error === null || error === void 0 ? void 0 : error.message).to.equal("xe:options.team 'team_c' is not allowed for this API key");
+        }));
         it('falls back to the shared pool when the lookup fails', () => __awaiter(void 0, void 0, void 0, function* () {
             withKey(keyRow('sessions'), null);
             typedi_1.Container.set(UserService_1.UserService, { findById: sinon_1.default.stub().rejects(new Error('db down')) });

package/lib/test/unit/session-create-layer.spec.js

@@ -0,0 +1,255 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+const express_1 = __importDefault(require("express"));
+const sinon_1 = __importDefault(require("sinon"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
+const base_driver_1 = require("@appium/base-driver");
+const sessionCreate_1 = require("../../src/gateway/sessionCreate");
+const createHandoff_1 = require("../../src/gateway/createHandoff");
+const hubSessionToken_1 = require("../../src/gateway/hubSessionToken");
+const loopbackServer_1 = require("../helpers/loopbackServer");
+/**
+ * `POST <basePath>/session` in the session gateway: allocation happens here,
+ * before Appium's route. A remote phone's session is created on its node and
+ * answered here; a local phone's allocation goes on to the plugin through the
+ * request's async context, and is given back if nothing takes it.
+ *
+ * Appium's route is stood in for by a plain route, and the plugin by a
+ * function that takes the handoff, the way XenonPlugin.createSession does.
+ */
+describe('the session gateway’s create layer', () => {
+    const loopback = (0, loopbackServer_1.loopbackServers)();
+    const quiet = { info: () => undefined, warn: () => undefined, error: () => undefined };
+    let lifecycle;
+    let routeHits;
+    let pluginTakes;
+    let base;
+    const grant = { userId: 'alice', udid: 'phone-1', host: 'http://node:4725' };
+    const caps = () => ({
+        capabilities: { alwaysMatch: { platformName: 'Android' }, firstMatch: [{}] },
+    });
+    beforeEach(() => {
+        routeHits = [];
+        pluginTakes = true;
+        lifecycle = {
+            prepareSession: sinon_1.default.stub().resolves({ remote: false, device: { udid: 'phone-1' } }),
+            completeRemoteSession: sinon_1.default
+                .stub()
+                .resolves({ protocol: 'W3C', value: ['node-s1', { platformName: 'Android' }, 'W3C'] }),
+            releaseAllocation: sinon_1.default.stub().resolves(),
+        };
+    });
+    afterEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        sinon_1.default.restore();
+        yield loopback.closeAll();
+    }));
+    function serve() {
+        return __awaiter(this, arguments, void 0, function* (opts = {}) {
+            var _a;
+            const basePath = (_a = opts.basePath) !== null && _a !== void 0 ? _a : '/wd/hub';
+            const app = (0, express_1.default)();
+            app.use(express_1.default.json());
+            app.use(`${basePath}/session`, (0, sessionCreate_1.createSessionCreateLayer)({
+                lifecycle: () => lifecycle,
+                hubGrants: opts.hubGrants,
+                authDisabled: () => !!opts.authDisabled,
+                logger: quiet,
+            }));
+            if (opts.beforeRoute)
+                app.use(opts.beforeRoute);
+            // Appium's route, with the plugin inside it.
+            app.post(`${basePath}/session`, (req, res) => __awaiter(this, void 0, void 0, function* () {
+                var _a;
+                const hit = { headers: Object.assign({}, req.headers), body: req.body };
+                routeHits.push(hit);
+                yield new Promise((resolve) => setTimeout(resolve, 1));
+                if (pluginTakes)
+                    hit.took = (_a = (0, createHandoff_1.currentCreateHandoff)()) === null || _a === void 0 ? void 0 : _a.take();
+                res.json({ value: { sessionId: 'local-s1', capabilities: {} } });
+            }));
+            app.all('*', (_req, res) => res.status(404).json({ value: { error: 'unknown command' } }));
+            const server = yield loopback.serve(app);
+            base = `http://127.0.0.1:${server.address().port}`;
+            return base;
+        });
+    }
+    describe('what it handles', () => {
+        it('only a POST of exactly the create path', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield serve();
+            yield (0, loopbackRequest_1.default)(base).get('/wd/hub/session').expect(404);
+            yield (0, loopbackRequest_1.default)(base).post('/wd/hub/session/abc/url').send({}).expect(404);
+            yield (0, loopbackRequest_1.default)(base).post('/wd/hub/sessionx').send(caps()).expect(404);
+            (0, chai_1.expect)(lifecycle.prepareSession.called).to.equal(false);
+        }));
+        it('a body without a capabilities object goes straight on, for Appium to answer', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield serve();
+            yield (0, loopbackRequest_1.default)(base).post('/wd/hub/session').send({ desiredCapabilities: {} }).expect(200);
+            yield (0, loopbackRequest_1.default)(base).post('/wd/hub/session').send({ capabilities: 'no' }).expect(200);
+            (0, chai_1.expect)(lifecycle.prepareSession.called).to.equal(false);
+        }));
+        it('matches the path as the router does: letter case, a trailing slash, any base path', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield serve({ basePath: '' });
+            yield (0, loopbackRequest_1.default)(base).post('/SESSION/').send(caps()).expect(200);
+            (0, chai_1.expect)(lifecycle.prepareSession.calledOnce).to.equal(true);
+        }));
+        it('fills in an omitted firstMatch, as the plugin used to', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield serve();
+            yield (0, loopbackRequest_1.default)(base)
+                .post('/wd/hub/session')
+                .send({ capabilities: { alwaysMatch: { platformName: 'Android' } } })
+                .expect(200);
+            (0, chai_1.expect)(lifecycle.prepareSession.firstCall.args[0].firstMatch).to.deep.equal([{}]);
+            (0, chai_1.expect)(routeHits[0].body.capabilities.firstMatch).to.deep.equal([{}]);
+        }));
+    });
+    describe('a remote phone', () => {
+        beforeEach(() => lifecycle.prepareSession.resolves({ remote: true }));
+        it('is created on its node and answered here, as Appium answers a new session', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield serve();
+            const res = yield (0, loopbackRequest_1.default)(base).post('/wd/hub/session').send(caps());
+            (0, chai_1.expect)(res.status).to.equal(200);
+            (0, chai_1.expect)(res.headers['content-type']).to.equal('application/json; charset=utf-8');
+            (0, chai_1.expect)(res.body).to.deep.equal({
+                value: { capabilities: { platformName: 'Android' }, sessionId: 'node-s1' },
+            });
+            (0, chai_1.expect)(routeHits, 'Appium’s route').to.deep.equal([]);
+            (0, chai_1.expect)(lifecycle.completeRemoteSession.calledOnce).to.equal(true);
+        }));
+        it('a failure is answered as Appium answers the error', () => __awaiter(void 0, void 0, void 0, function* () {
+            lifecycle.completeRemoteSession.rejects(new base_driver_1.errors.SessionNotCreatedError('node said no'));
+            yield serve();
+            const res = yield (0, loopbackRequest_1.default)(base).post('/wd/hub/session').send(caps());
+            (0, chai_1.expect)(res.status).to.equal(500);
+            (0, chai_1.expect)(res.body.value.error).to.equal('session not created');
+            (0, chai_1.expect)(res.body.value.message).to.include('node said no');
+            (0, chai_1.expect)(routeHits).to.deep.equal([]);
+        }));
+    });
+    describe('a refusal before any phone is allocated', () => {
+        it('is answered as Appium answers the error, and Appium never sees the request', () => __awaiter(void 0, void 0, void 0, function* () {
+            lifecycle.prepareSession.rejects(new base_driver_1.errors.InvalidArgumentError('session rejected: no'));
+            yield serve();
+            const res = yield (0, loopbackRequest_1.default)(base).post('/wd/hub/session').send(caps());
+            (0, chai_1.expect)(res.status).to.equal(400);
+            (0, chai_1.expect)(res.body.value).to.include({ error: 'invalid argument' });
+            (0, chai_1.expect)(res.body.value.message).to.include('session rejected: no');
+            (0, chai_1.expect)(routeHits).to.deep.equal([]);
+        }));
+        it('a plain error is an unknown error', () => __awaiter(void 0, void 0, void 0, function* () {
+            lifecycle.prepareSession.rejects(new Error('No device matching request.'));
+            yield serve();
+            const res = yield (0, loopbackRequest_1.default)(base).post('/wd/hub/session').send(caps());
+            (0, chai_1.expect)(res.status).to.equal(500);
+            (0, chai_1.expect)(res.body.value.error).to.equal('unknown error');
+        }));
+    });
+    describe('a local phone', () => {
+        it('its allocation reaches the plugin through Appium’s route, and is not given back', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield serve();
+            yield (0, loopbackRequest_1.default)(base).post('/wd/hub/session').send(caps()).expect(200);
+            (0, chai_1.expect)(routeHits[0].took).to.deep.equal({ remote: false, device: { udid: 'phone-1' } });
+            (0, chai_1.expect)(lifecycle.prepareSession.calledOnce).to.equal(true);
+            (0, chai_1.expect)(lifecycle.releaseAllocation.called).to.equal(false);
+        }));
+        it('is given back once when Appium answers without the plugin taking it', () => __awaiter(void 0, void 0, void 0, function* () {
+            pluginTakes = false;
+            yield serve();
+            yield (0, loopbackRequest_1.default)(base).post('/wd/hub/session').send(caps()).expect(200);
+            yield new Promise((resolve) => setImmediate(resolve));
+            (0, chai_1.expect)(lifecycle.releaseAllocation.callCount).to.equal(1);
+            (0, chai_1.expect)(lifecycle.releaseAllocation.firstCall.args[0].device.udid).to.equal('phone-1');
+        }));
+        it('is given back, and Appium never called, when the client left while it waited', () => __awaiter(void 0, void 0, void 0, function* () {
+            let allocated;
+            lifecycle.prepareSession.callsFake(() => new Promise((resolve) => {
+                allocated = () => resolve({ remote: false, device: { udid: 'phone-1' } });
+            }));
+            yield serve();
+            const req = (0, loopbackRequest_1.default)(base).post('/wd/hub/session').send(caps()).timeout(50);
+            yield req.then(() => undefined, () => undefined);
+            // The server sees the connection close, then the phone turns up.
+            yield new Promise((resolve) => setTimeout(resolve, 20));
+            allocated();
+            yield new Promise((resolve) => setTimeout(resolve, 20));
+            (0, chai_1.expect)(lifecycle.releaseAllocation.callCount).to.equal(1);
+            (0, chai_1.expect)(routeHits).to.deep.equal([]);
+        }));
+    });
+    describe('on a node: the hub’s token', () => {
+        it('a valid one is the grant the node allocates by; the header goes no further', () => __awaiter(void 0, void 0, void 0, function* () {
+            const verifyCreate = sinon_1.default.stub().resolves(grant);
+            yield serve({ hubGrants: { verifyCreate } });
+            yield (0, loopbackRequest_1.default)(base)
+                .post('/wd/hub/session')
+                .set(hubSessionToken_1.HUB_TOKEN_HEADER, 'good-token')
+                .send(caps())
+                .expect(200);
+            (0, chai_1.expect)(verifyCreate.calledOnceWith('good-token')).to.equal(true);
+            (0, chai_1.expect)(lifecycle.prepareSession.firstCall.args[1]).to.deep.equal({ hubGrant: grant });
+            (0, chai_1.expect)(routeHits[0].headers[hubSessionToken_1.HUB_TOKEN_HEADER]).to.equal(undefined);
+        }));
+        it('an invalid one is refused, and nothing is allocated', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield serve({ hubGrants: { verifyCreate: () => __awaiter(void 0, void 0, void 0, function* () { return null; }) } });
+            const res = yield (0, loopbackRequest_1.default)(base)
+                .post('/wd/hub/session')
+                .set(hubSessionToken_1.HUB_TOKEN_HEADER, 'forged')
+                .send(caps());
+            (0, chai_1.expect)(res.status).to.equal(400);
+            (0, chai_1.expect)(res.body.value.error).to.equal('invalid argument');
+            (0, chai_1.expect)(res.body.value.message).to.include('session rejected');
+            (0, chai_1.expect)(lifecycle.prepareSession.called).to.equal(false);
+            (0, chai_1.expect)(routeHits).to.deep.equal([]);
+        }));
+        it('one that cannot be checked is a 503, and nothing is allocated', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield serve({
+                hubGrants: {
+                    verifyCreate: () => __awaiter(void 0, void 0, void 0, function* () {
+                        throw new hubSessionToken_1.HubTokenUnavailableError('hub down');
+                    }),
+                },
+            });
+            const res = yield (0, loopbackRequest_1.default)(base)
+                .post('/wd/hub/session')
+                .set(hubSessionToken_1.HUB_TOKEN_HEADER, 'token')
+                .send(caps());
+            (0, chai_1.expect)(res.status).to.equal(503);
+            (0, chai_1.expect)(res.body.value.error).to.equal('unknown error');
+            (0, chai_1.expect)(lifecycle.prepareSession.called).to.equal(false);
+        }));
+        it('with auth disabled it is not checked, only removed', () => __awaiter(void 0, void 0, void 0, function* () {
+            const verifyCreate = sinon_1.default.stub().resolves(null);
+            yield serve({ hubGrants: { verifyCreate }, authDisabled: true });
+            yield (0, loopbackRequest_1.default)(base)
+                .post('/wd/hub/session')
+                .set(hubSessionToken_1.HUB_TOKEN_HEADER, 'anything')
+                .send(caps())
+                .expect(200);
+            (0, chai_1.expect)(verifyCreate.called).to.equal(false);
+            (0, chai_1.expect)(lifecycle.prepareSession.firstCall.args[1]).to.deep.equal({});
+            (0, chai_1.expect)(routeHits[0].headers[hubSessionToken_1.HUB_TOKEN_HEADER]).to.equal(undefined);
+        }));
+        it('a hub, which checks no hub tokens, ignores and removes one', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield serve();
+            yield (0, loopbackRequest_1.default)(base)
+                .post('/wd/hub/session')
+                .set(hubSessionToken_1.HUB_TOKEN_HEADER, 'anything')
+                .send(caps())
+                .expect(200);
+            (0, chai_1.expect)(lifecycle.prepareSession.firstCall.args[1]).to.deep.equal({});
+            (0, chai_1.expect)(routeHits[0].headers[hubSessionToken_1.HUB_TOKEN_HEADER]).to.equal(undefined);
+        }));
+    });
+});