@xenon-device-management/xenon 2.0.0 → 2.2.0

package/lib/test/unit/session-credential-strip.spec.js

@@ -54,12 +54,15 @@ const PluginContext_1 = require("../../src/PluginContext");
 const ApiKeyService_1 = require("../../src/services/ApiKeyService");
 const UserService_1 = require("../../src/services/UserService");
 const JwtKeyService_1 = require("../../src/services/token/JwtKeyService");
+const hubSessionToken_1 = require("../../src/gateway/hubSessionToken");
 const pendingSessions = __importStar(require("../../src/data-service/pending-sessions-service"));
 const deviceService = __importStar(require("../../src/data-service/device-service"));
 const deviceUtils = __importStar(require("../../src/device-utils"));
 const IPluginArgs_1 = require("../../src/interfaces/IPluginArgs");
 const config_1 = require("../../src/config");
+const prisma_1 = require("../../src/prisma");
 const container_registration_1 = require("../helpers/container-registration");
+const loki_stores_1 = require("../helpers/loki-stores");
 /**
  * createSession end to end: the credentials a session presents in
  * `xe:options` (or its alias `xenon:options`) are read once, then taken out of
@@ -85,6 +88,10 @@ const caps = (always, firstMatch = [{}]) => ({
 });
 const leaked = (value) => SECRETS.filter((s) => JSON.stringify(value !== null && value !== void 0 ? value : null).includes(s));
 describe('createSession — credentials never reach the driver or storage', () => {
+    // The in-memory stores, also when this file runs on its own: without
+    // NODE_ENV=test the factory handed out the Prisma stores, which are the
+    // developer's ~/.cache/xenon/xenon.db.
+    (0, loki_stores_1.useLokiStores)();
     let svc;
     let device;
     let context;
@@ -125,7 +132,7 @@ describe('createSession — credentials never reach the driver or storage', () =
         context.pluginArgs = Object.assign({}, IPluginArgs_1.DefaultPluginArgs, { bindHostOrIp: '127.0.0.1' });
         context.nodeId = 'node-hub';
         device = { udid: 'u1', host: 'h1', platform: 'android', nodeId: 'node-hub', teamId: null };
-        restore = (0, container_registration_1.saveRegistrations)(ApiKeyService_1.ApiKeyService, UserService_1.UserService, JwtKeyService_1.JwtKeyService);
+        restore = (0, container_registration_1.saveRegistrations)(ApiKeyService_1.ApiKeyService, UserService_1.UserService, JwtKeyService_1.JwtKeyService, hubSessionToken_1.HubSessionTokenIssuer);
         typedi_1.Container.set(ApiKeyService_1.ApiKeyService, {
             verifyPair: sinon_1.default
                 .stub()
@@ -142,6 +149,8 @@ describe('createSession — credentials never reach the driver or storage', () =
                 return { sub: t.slice('jwt:'.length), teamId: null };
             }),
         });
+        // The owner's teams: none, and not read from the developer's database.
+        sinon_1.default.stub(prisma_1.prisma.teamMember, 'findMany').resolves([]);
         seen = {};
         sinon_1.default.stub(pendingSessions, 'addNewPendingSession').callsFake((c) => __awaiter(void 0, void 0, void 0, function* () {
             seen.pending = JSON.parse(JSON.stringify(c));
@@ -246,32 +255,39 @@ describe('createSession — credentials never reach the driver or storage', () =
         }));
     });
     describe('when the device is on another node', () => {
+        let grants;
         beforeEach(() => {
             sinon_1.default.stub(svc, 'finalizeSession').callsFake((...args) => __awaiter(void 0, void 0, void 0, function* () {
                 seen.sessionResponse = { desired: JSON.parse(JSON.stringify(args[2])) };
             }));
-            sinon_1.default.stub(svc, 'forwardSessionRequest').callsFake((_d, c) => __awaiter(void 0, void 0, void 0, function* () {
+            sinon_1.default.stub(svc, 'forwardSessionRequest').callsFake((_d, c, t) => __awaiter(void 0, void 0, void 0, function* () {
                 seen.forwarded = JSON.parse(JSON.stringify(c));
+                seen.hubToken = t;
                 return { protocol: 'W3C', value: ['sess-1', {}, 'W3C'] };
             }));
+            grants = sinon_1.default.stub().resolves('HUB-CREATE-TOKEN');
+            typedi_1.Container.set(hubSessionToken_1.HubSessionTokenIssuer, {
+                createTokenFor: grants,
+                forget: () => undefined,
+            });
         });
-        it('a peer Xenon node gets them, since it authenticates the session itself', () => __awaiter(void 0, void 0, void 0, function* () {
+        it('a peer Xenon node never gets them: it gets the hub’s token for the verified owner', () => __awaiter(void 0, void 0, void 0, function* () {
             device.nodeId = 'node-peer';
             yield create(caps({ 'xe:options': { accessKey: KEY, token: TOKEN, sessionToken: JWT } }));
-            (0, chai_1.expect)(seen.forwarded.alwaysMatch['xe:options']).to.deep.equal({
-                accessKey: KEY,
-                token: TOKEN,
-                sessionToken: JWT,
-            });
+            (0, chai_1.expect)(leaked(seen.forwarded), 'forwarded').to.deep.equal([]);
+            (0, chai_1.expect)(seen.hubToken).to.equal('HUB-CREATE-TOKEN');
+            (0, chai_1.expect)(grants.firstCall.args[0]).to.deep.equal({ userId: 'usr_key', udid: 'u1', host: 'h1' });
             for (const where of ['pending', 'sent', 'sessionResponse']) {
                 (0, chai_1.expect)(leaked(seen[where]), where).to.deep.equal([]);
             }
         }));
-        it('a cloud provider never does', () => __awaiter(void 0, void 0, void 0, function* () {
+        it('a cloud provider gets neither', () => __awaiter(void 0, void 0, void 0, function* () {
             device.nodeId = undefined;
             device.cloud = true;
             yield create(caps({ 'xe:options': { accessKey: KEY, token: TOKEN, sessionToken: JWT } }));
             (0, chai_1.expect)(leaked(seen.forwarded)).to.deep.equal([]);
+            (0, chai_1.expect)(seen.hubToken).to.equal(null);
+            (0, chai_1.expect)(grants.called).to.equal(false);
         }));
     });
 });

package/lib/test/unit/session-credentials.spec.js

@@ -100,50 +100,3 @@ describe('takeSessionCredentials', () => {
         (0, chai_1.expect)(() => (0, sessionCredentials_1.takeSessionCredentials)({ alwaysMatch: null, firstMatch: 'x' })).to.not.throw();
     });
 });
-describe('capsWithCredentials — the copy a peer Xenon node gets', () => {
-    // A peer node re-runs createSession: it authenticates and attributes the
-    // session and checks the lease itself, so it needs what the hub read. It
-    // takes the credentials out again before its own driver sees them.
-    const take = (caps) => ({ caps, credentials: (0, sessionCredentials_1.takeSessionCredentials)(caps) });
-    it('puts every credential back, so the node reads the same ones the hub did', () => {
-        const { caps, credentials } = take({
-            alwaysMatch: {
-                'xenon:options': { leaseId: 'lse_1', accessKey: 'ak_old', token: 'tk_old' },
-                'xe:options': { token: SECRETS.token, sessionToken: SECRETS.sessionToken },
-            },
-            firstMatch: [{}],
-        });
-        const forwarded = (0, sessionCredentials_1.capsWithCredentials)(caps, credentials);
-        (0, chai_1.expect)((0, sessionCredentials_1.takeSessionCredentials)(JSON.parse(JSON.stringify(forwarded)))).to.deep.equal(credentials);
-    });
-    it('writes them into the namespace that wins, in the bucket it is in', () => {
-        const { caps, credentials } = take({
-            alwaysMatch: { 'xenon:options': { leaseId: 'lse_1', leaseToken: SECRETS.leaseToken } },
-            firstMatch: [{ 'xe:options': { accessKey: SECRETS.accessKey, token: SECRETS.token } }],
-        });
-        const forwarded = (0, sessionCredentials_1.capsWithCredentials)(caps, credentials);
-        (0, chai_1.expect)(forwarded.firstMatch[0]['xe:options']).to.deep.equal({
-            accessKey: SECRETS.accessKey,
-            token: SECRETS.token,
-            leaseToken: SECRETS.leaseToken,
-        });
-        (0, chai_1.expect)(forwarded.alwaysMatch['xenon:options']).to.deep.equal({ leaseId: 'lse_1' });
-    });
-    it('does not modify the caps it copies', () => {
-        const { caps, credentials } = take({
-            alwaysMatch: { 'xe:options': Object.assign({ leaseId: 'lse_1' }, SECRETS) },
-            firstMatch: [{}],
-        });
-        const before = JSON.stringify(caps);
-        (0, sessionCredentials_1.capsWithCredentials)(caps, credentials);
-        (0, chai_1.expect)(JSON.stringify(caps)).to.equal(before);
-        (0, chai_1.expect)(leaks(caps)).to.deep.equal([]);
-    });
-    it('returns the caps unchanged when there is nothing to put back', () => {
-        const { caps, credentials } = take({
-            alwaysMatch: { 'xe:options': { leaseId: 'lse_1' } },
-            firstMatch: [{}],
-        });
-        (0, chai_1.expect)((0, sessionCredentials_1.capsWithCredentials)(caps, credentials)).to.equal(caps);
-    });
-});

package/lib/test/unit/session-listing-auth.spec.js

@@ -0,0 +1,345 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+const path_1 = __importDefault(require("path"));
+const sinon_1 = __importDefault(require("sinon"));
+const express_1 = __importDefault(require("express"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
+const commandAuth_1 = require("../../src/middleware/commandAuth");
+const commandCaller_1 = require("../../src/middleware/commandCaller");
+const registerCommandAuth_1 = require("../../src/app/registerCommandAuth");
+const loopbackServer_1 = require("../helpers/loopbackServer");
+/**
+ * Appium 3's session listing (`GET <basePath>/appium/sessions`) under
+ * XENON_REQUIRE_COMMAND_AUTH.
+ *
+ * Appium answers it for anyone with every live session's id and capabilities,
+ * which is the easiest way to find an id to use. With the setting on, the
+ * answer is filtered: an override admin sees everything, a verified caller sees
+ * the sessions they own, and a caller without valid credentials sees an empty
+ * list in Appium's own shape. Appium still produces the listing; Xenon only
+ * removes entries from it.
+ *
+ * The apps are built as Appium builds its own (middleware, routes, then the
+ * plugin's updater), and the listing route records that it ran.
+ */
+function appiumExpress() {
+    const appiumDir = path_1.default.dirname(require.resolve('appium/package.json'));
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    return require(require.resolve('express', { paths: [appiumDir] }));
+}
+const USERS = {
+    alice: { id: 'alice', role: 'MEMBER', status: 'ACTIVE' },
+    bob: { id: 'bob', role: 'MEMBER', status: 'ACTIVE' },
+    carol: { id: 'carol', role: 'ADMIN', status: 'ACTIVE' },
+    root: { id: 'root', role: 'SUPER_ADMIN', status: 'ACTIVE' },
+};
+// token -> [owner, scopes]
+const KEYS = {
+    'alice-token': ['alice', 'devices,sessions,read'],
+    'bob-token': ['bob', 'devices,sessions,read'],
+    'carol-ordinary': ['carol', 'devices,sessions,read'],
+    'carol-admin': ['carol', 'admin,devices,sessions,read'],
+};
+const JWTS = {
+    'alice-jwt': ['alice', 'devices,sessions,read'],
+    'root-jwt': ['root', 'sessions'],
+};
+const OWNERS = {
+    's-alice': 'alice',
+    's-bob': 'bob',
+    's-anon': null,
+    's-alice-2': 'alice',
+};
+/** What Appium's getAppiumSessions answers: id, creation time, capabilities. */
+const LISTING = [
+    { id: 's-alice', created: 1, capabilities: { platformName: 'Android' } },
+    { id: 's-bob', created: 2, capabilities: { platformName: 'iOS' } },
+    { id: 's-anon', created: 3, capabilities: { platformName: 'Android' } },
+    { id: 's-alice-2', created: 4, capabilities: { platformName: 'iOS' } },
+];
+const ALL_IDS = LISTING.map((s) => s.id);
+const as = (token) => ({
+    'x-xenon-access-key': `ak-${KEYS[token][0]}`,
+    'x-xenon-token': token,
+});
+const bearer = (jwt) => ({ authorization: `Bearer ${jwt}` });
+const idsOf = (res) => res.body.value.map((s) => s.id);
+const shapes = [
+    ['Express 4', () => (0, express_1.default)()],
+    ['Express 5 (Appium 3)', () => appiumExpress()()],
+];
+describe('session listing under per-command auth (GET <basePath>/appium/sessions)', () => {
+    it('is the listing route under the normalised base path', () => {
+        (0, chai_1.expect)((0, registerCommandAuth_1.sessionListingPath)('/wd/hub')).to.equal('/wd/hub/appium/sessions');
+        (0, chai_1.expect)((0, registerCommandAuth_1.sessionListingPath)('wd/hub/')).to.equal('/wd/hub/appium/sessions');
+        (0, chai_1.expect)((0, registerCommandAuth_1.sessionListingPath)('')).to.equal('/appium/sessions');
+        (0, chai_1.expect)((0, registerCommandAuth_1.sessionListingPath)(undefined)).to.equal('/appium/sessions');
+    });
+    for (const [shapeName, makeExpress] of shapes) {
+        describe(shapeName, () => {
+            let enabled;
+            let authDisabled;
+            let verifyKeyPair;
+            let verifyBearer;
+            let ownerOf;
+            let ownersOf;
+            let infos;
+            let warnings;
+            let errors;
+            /** What the listing route answers; a test may swap in an error. */
+            let answer;
+            const loopback = (0, loopbackServer_1.loopbackServers)();
+            afterEach(() => loopback.closeAll());
+            function lab() {
+                return __awaiter(this, void 0, void 0, function* () {
+                    const ran = [];
+                    const app = makeExpress();
+                    app.use(express_1.default.json());
+                    app.get('/wd/hub/appium/sessions', (_req, res) => {
+                        ran.push('getAppiumSessions');
+                        res.status(answer.status).json(answer.body);
+                    });
+                    app.get('/wd/hub/status', (_req, res) => {
+                        ran.push('getStatus');
+                        res.json({ value: { ready: true } });
+                    });
+                    const result = (0, registerCommandAuth_1.registerCommandAuth)(app, { basePath: '/wd/hub' }, {
+                        enabled: () => enabled,
+                        authDisabled: () => authDisabled,
+                        verifier: new commandCaller_1.CommandCallerVerifier({ verifyKeyPair, verifyBearer }),
+                        ownerOf,
+                        ownersOf,
+                        logger: {
+                            info: (m) => infos.push(m),
+                            warn: (m) => warnings.push(m),
+                            error: (m) => errors.push(m),
+                        },
+                    });
+                    (0, chai_1.expect)(result.placed, 'placed ahead of the routes').to.equal(true);
+                    // Only what requests log counts below; drop the registration's own line.
+                    infos.splice(0);
+                    return { app: yield loopback.serve(app), ran };
+                });
+            }
+            beforeEach(() => {
+                enabled = true;
+                authDisabled = false;
+                infos = [];
+                warnings = [];
+                errors = [];
+                answer = { status: 200, body: { value: LISTING } };
+                verifyKeyPair = sinon_1.default.stub().callsFake((accessKey, token) => __awaiter(void 0, void 0, void 0, function* () {
+                    const key = KEYS[token];
+                    if (!key || accessKey !== `ak-${key[0]}`)
+                        return null;
+                    return {
+                        row: { id: `key-${token}`, userId: key[0], scopes: key[1], expiresAt: null },
+                        user: USERS[key[0]],
+                    };
+                }));
+                verifyBearer = sinon_1.default.stub().callsFake((jwt) => __awaiter(void 0, void 0, void 0, function* () {
+                    const t = JWTS[jwt];
+                    if (!t)
+                        return null;
+                    return { payload: { sub: t[0], scopes: t[1] }, user: USERS[t[0]] };
+                }));
+                ownerOf = sinon_1.default.stub().callsFake((id) => __awaiter(void 0, void 0, void 0, function* () { return (id in OWNERS ? OWNERS[id] : null); }));
+                ownersOf = sinon_1.default
+                    .stub()
+                    .callsFake((ids) => __awaiter(void 0, void 0, void 0, function* () { return new Map(ids.map((id) => [id, id in OWNERS ? OWNERS[id] : null])); }));
+            });
+            describe('who sees what', () => {
+                it('shows the owner only the sessions they own', () => __awaiter(void 0, void 0, void 0, function* () {
+                    const { app, ran } = yield lab();
+                    const res = yield (0, loopbackRequest_1.default)(app).get('/wd/hub/appium/sessions').set(as('alice-token'));
+                    (0, chai_1.expect)(res.status).to.equal(200);
+                    (0, chai_1.expect)(res.headers['content-type']).to.equal('application/json; charset=utf-8');
+                    (0, chai_1.expect)(res.body).to.deep.equal({ value: [LISTING[0], LISTING[3]] });
+                    (0, chai_1.expect)(ran).to.deep.equal(['getAppiumSessions']);
+                }));
+                it('decides every listed session with one owner lookup, not one per session', () => __awaiter(void 0, void 0, void 0, function* () {
+                    const { app } = yield lab();
+                    yield (0, loopbackRequest_1.default)(app).get('/wd/hub/appium/sessions').set(as('alice-token')).expect(200);
+                    (0, chai_1.expect)(ownersOf.callCount).to.equal(1);
+                    (0, chai_1.expect)(ownersOf.firstCall.args[0]).to.have.members(ALL_IDS);
+                    (0, chai_1.expect)(ownerOf.called).to.equal(false);
+                }));
+                it('shows the owner their sessions for a Bearer token too', () => __awaiter(void 0, void 0, void 0, function* () {
+                    const { app } = yield lab();
+                    const res = yield (0, loopbackRequest_1.default)(app).get('/wd/hub/appium/sessions').set(bearer('alice-jwt'));
+                    (0, chai_1.expect)(idsOf(res)).to.deep.equal(['s-alice', 's-alice-2']);
+                }));
+                it('shows another user only theirs', () => __awaiter(void 0, void 0, void 0, function* () {
+                    const { app } = yield lab();
+                    const res = yield (0, loopbackRequest_1.default)(app).get('/wd/hub/appium/sessions').set(as('bob-token'));
+                    (0, chai_1.expect)(idsOf(res)).to.deep.equal(['s-bob']);
+                }));
+                it('logs the filtering at info with the caller and the counts, never the credential', () => __awaiter(void 0, void 0, void 0, function* () {
+                    const { app } = yield lab();
+                    yield (0, loopbackRequest_1.default)(app).get('/wd/hub/appium/sessions').set(as('bob-token')).expect(200);
+                    (0, chai_1.expect)(infos).to.have.length(1);
+                    (0, chai_1.expect)(infos[0]).to.include('bob');
+                    (0, chai_1.expect)(infos[0]).to.include('1 of 4');
+                    (0, chai_1.expect)(infos[0]).not.to.include('bob-token');
+                    (0, chai_1.expect)(warnings).to.deep.equal([]);
+                }));
+                it('shows an admin-scoped key every session, without looking up owners', () => __awaiter(void 0, void 0, void 0, function* () {
+                    const { app } = yield lab();
+                    const res = yield (0, loopbackRequest_1.default)(app).get('/wd/hub/appium/sessions').set(as('carol-admin'));
+                    (0, chai_1.expect)(res.body).to.deep.equal({ value: LISTING });
+                    (0, chai_1.expect)(ownersOf.called || ownerOf.called).to.equal(false);
+                }));
+                it('shows a SUPER_ADMIN every session', () => __awaiter(void 0, void 0, void 0, function* () {
+                    const { app } = yield lab();
+                    const res = yield (0, loopbackRequest_1.default)(app).get('/wd/hub/appium/sessions').set(bearer('root-jwt'));
+                    (0, chai_1.expect)(idsOf(res)).to.deep.equal(ALL_IDS);
+                }));
+                it("shows an ADMIN's ordinary key only their own sessions, here none", () => __awaiter(void 0, void 0, void 0, function* () {
+                    const { app } = yield lab();
+                    const res = yield (0, loopbackRequest_1.default)(app).get('/wd/hub/appium/sessions').set(as('carol-ordinary'));
+                    (0, chai_1.expect)(res.status).to.equal(200);
+                    (0, chai_1.expect)(res.body).to.deep.equal({ value: [] });
+                }));
+                it('never shows a session nobody owns to anyone but an override admin', () => __awaiter(void 0, void 0, void 0, function* () {
+                    const { app } = yield lab();
+                    for (const who of ['alice-token', 'bob-token', 'carol-ordinary']) {
+                        const res = yield (0, loopbackRequest_1.default)(app).get('/wd/hub/appium/sessions').set(as(who));
+                        (0, chai_1.expect)(idsOf(res), who).not.to.include('s-anon');
+                    }
+                    const admin = yield (0, loopbackRequest_1.default)(app).get('/wd/hub/appium/sessions').set(as('carol-admin'));
+                    (0, chai_1.expect)(idsOf(admin)).to.include('s-anon');
+                }));
+            });
+            describe('callers without valid credentials', () => {
+                it("get an empty list in Appium's normal shape, with no lookups at all", () => __awaiter(void 0, void 0, void 0, function* () {
+                    const { app, ran } = yield lab();
+                    const res = yield (0, loopbackRequest_1.default)(app).get('/wd/hub/appium/sessions');
+                    (0, chai_1.expect)(res.status).to.equal(200);
+                    (0, chai_1.expect)(res.headers['content-type']).to.equal('application/json; charset=utf-8');
+                    (0, chai_1.expect)(res.text).to.equal('{"value":[]}');
+                    (0, chai_1.expect)(ran).to.deep.equal(['getAppiumSessions']);
+                    (0, chai_1.expect)(verifyKeyPair.called || verifyBearer.called).to.equal(false);
+                    (0, chai_1.expect)(ownersOf.called || ownerOf.called).to.equal(false);
+                    (0, chai_1.expect)(warnings).to.have.length(1);
+                    (0, chai_1.expect)(warnings[0]).to.include('no credentials');
+                }));
+                it('get an empty list for credentials that do not verify, logged without the secret', () => __awaiter(void 0, void 0, void 0, function* () {
+                    const { app } = yield lab();
+                    const res = yield (0, loopbackRequest_1.default)(app)
+                        .get('/wd/hub/appium/sessions')
+                        .set({ 'x-xenon-access-key': 'ak-alice', 'x-xenon-token': 'guessed' });
+                    (0, chai_1.expect)(res.status).to.equal(200);
+                    (0, chai_1.expect)(res.body).to.deep.equal({ value: [] });
+                    (0, chai_1.expect)(ownersOf.called).to.equal(false);
+                    (0, chai_1.expect)(warnings).to.have.length(1);
+                    (0, chai_1.expect)(warnings[0]).to.include('invalid credentials');
+                    (0, chai_1.expect)(warnings[0]).not.to.include('guessed');
+                }));
+                it('get the same answer as when no session is running', () => __awaiter(void 0, void 0, void 0, function* () {
+                    const { app } = yield lab();
+                    const filtered = yield (0, loopbackRequest_1.default)(app).get('/wd/hub/appium/sessions');
+                    answer = { status: 200, body: { value: [] } };
+                    const empty = yield (0, loopbackRequest_1.default)(app).get('/wd/hub/appium/sessions').set(as('carol-admin'));
+                    (0, chai_1.expect)(filtered.status).to.equal(empty.status);
+                    (0, chai_1.expect)(filtered.headers['content-type']).to.equal(empty.headers['content-type']);
+                    (0, chai_1.expect)(filtered.text).to.equal(empty.text);
+                }));
+                it('are filtered on the path in another letter case and with a trailing slash', () => __awaiter(void 0, void 0, void 0, function* () {
+                    const { app, ran } = yield lab();
+                    for (const url of ['/WD/HUB/APPIUM/SESSIONS', '/wd/hub/appium/sessions/']) {
+                        const res = yield (0, loopbackRequest_1.default)(app).get(url);
+                        (0, chai_1.expect)(res.status, url).to.equal(200);
+                        (0, chai_1.expect)(res.body, url).to.deep.equal({ value: [] });
+                    }
+                    (0, chai_1.expect)(ran).to.deep.equal(['getAppiumSessions', 'getAppiumSessions']);
+                }));
+            });
+            describe('what it leaves alone', () => {
+                it('does nothing at all when the setting is off (the default)', () => __awaiter(void 0, void 0, void 0, function* () {
+                    enabled = false;
+                    const { app } = yield lab();
+                    const res = yield (0, loopbackRequest_1.default)(app).get('/wd/hub/appium/sessions');
+                    (0, chai_1.expect)(res.body).to.deep.equal({ value: LISTING });
+                    (0, chai_1.expect)(verifyKeyPair.called || verifyBearer.called).to.equal(false);
+                    (0, chai_1.expect)(ownersOf.called || ownerOf.called).to.equal(false);
+                    (0, chai_1.expect)(infos.concat(warnings, errors)).to.deep.equal([]);
+                }));
+                it('does nothing when auth is disabled, even with the setting on', () => __awaiter(void 0, void 0, void 0, function* () {
+                    authDisabled = true;
+                    const { app } = yield lab();
+                    const res = yield (0, loopbackRequest_1.default)(app).get('/wd/hub/appium/sessions');
+                    (0, chai_1.expect)(res.body).to.deep.equal({ value: LISTING });
+                    (0, chai_1.expect)(ownersOf.called).to.equal(false);
+                }));
+                it("passes Appium's error answer through untouched (session_discovery not enabled)", () => __awaiter(void 0, void 0, void 0, function* () {
+                    answer = {
+                        status: 400,
+                        body: {
+                            value: {
+                                error: 'invalid argument',
+                                message: 'Potentially insecure feature session_discovery has not been enabled',
+                                stacktrace: '',
+                            },
+                        },
+                    };
+                    const { app } = yield lab();
+                    for (const headers of [{}, as('alice-token')]) {
+                        const res = yield (0, loopbackRequest_1.default)(app).get('/wd/hub/appium/sessions').set(headers);
+                        (0, chai_1.expect)(res.status).to.equal(400);
+                        (0, chai_1.expect)(res.body).to.deep.equal(answer.body);
+                    }
+                    (0, chai_1.expect)(ownersOf.called).to.equal(false);
+                }));
+                it('leaves other requests alone', () => __awaiter(void 0, void 0, void 0, function* () {
+                    const { app, ran } = yield lab();
+                    const res = yield (0, loopbackRequest_1.default)(app).get('/wd/hub/status');
+                    (0, chai_1.expect)(res.body).to.deep.equal({ value: { ready: true } });
+                    (0, chai_1.expect)(ran).to.deep.equal(['getStatus']);
+                    (0, chai_1.expect)(warnings).to.deep.equal([]);
+                }));
+            });
+            describe('failing closed', () => {
+                it('answers 503 when the credential check fails, before the listing runs', () => __awaiter(void 0, void 0, void 0, function* () {
+                    verifyKeyPair.rejects(new Error('database is locked'));
+                    const { app, ran } = yield lab();
+                    const res = yield (0, loopbackRequest_1.default)(app).get('/wd/hub/appium/sessions').set(as('alice-token'));
+                    (0, chai_1.expect)(res.status).to.equal(503);
+                    (0, chai_1.expect)(res.body).to.deep.equal(commandAuth_1.COMMAND_AUTH_UNAVAILABLE_BODY);
+                    (0, chai_1.expect)(ran).to.deep.equal([]);
+                    (0, chai_1.expect)(errors).to.have.length(1);
+                    (0, chai_1.expect)(errors[0]).to.include('database is locked');
+                }));
+                it('answers 503 when the owner lookup fails, never the unfiltered list', () => __awaiter(void 0, void 0, void 0, function* () {
+                    ownersOf.rejects(new Error('database is locked\nSELECT secret FROM ...'));
+                    const { app } = yield lab();
+                    const res = yield (0, loopbackRequest_1.default)(app).get('/wd/hub/appium/sessions').set(as('alice-token'));
+                    (0, chai_1.expect)(res.status).to.equal(503);
+                    (0, chai_1.expect)(res.body).to.deep.equal(commandAuth_1.COMMAND_AUTH_UNAVAILABLE_BODY);
+                    (0, chai_1.expect)(res.text).not.to.include('s-bob');
+                    (0, chai_1.expect)(errors).to.have.length(1);
+                    (0, chai_1.expect)(errors[0]).to.include('database is locked');
+                    (0, chai_1.expect)(errors[0]).not.to.include('SELECT');
+                }));
+                it('drops a listed entry it cannot attribute rather than showing it', () => __awaiter(void 0, void 0, void 0, function* () {
+                    answer = { status: 200, body: { value: [LISTING[0], { created: 5 }, 'junk'] } };
+                    const { app } = yield lab();
+                    const res = yield (0, loopbackRequest_1.default)(app).get('/wd/hub/appium/sessions').set(as('alice-token'));
+                    (0, chai_1.expect)(res.body).to.deep.equal({ value: [LISTING[0]] });
+                }));
+            });
+        });
+    }
+});