@xenon-device-management/xenon 2.0.0 → 2.2.0

package/lib/src/app/routers/control.js

@@ -80,6 +80,7 @@ const deviceTeamGuard_1 = require("../../middleware/deviceTeamGuard");
 const controlDevice_1 = require("../../middleware/controlDevice");
 const manualLock_1 = require("../../services/recording/manualLock");
 const streamStartConflict_1 = require("./streamStartConflict");
+const nodePhoneControl_1 = require("./nodePhoneControl");
 const streamLeave_1 = require("./streamLeave");
 const SessionOwnerResolver_1 = require("../../services/device-access/SessionOwnerResolver");
 const actor_1 = require("../../services/device-access/actor");
@@ -110,37 +111,10 @@ router.use((0, deviceTeamGuard_1.deviceTeamGuard)());
 // another user's Appium session. Mounted here so every current and future
 // mutation is covered without per-handler opt-in.
 router.use((0, deviceAccessGuard_1.deviceAccessGuard)());
-// Cloud metadata endpoints — never proxy to these regardless of caller.
-const FORBIDDEN_PROXY_HOSTS = new Set([
-    '169.254.169.254', // AWS/Azure/GCP IMDS
-    'metadata.google.internal',
-    'metadata.goog',
-    '100.100.100.200', // Alibaba ECS metadata
-    'fd00:ec2::254', // AWS IMDSv6
-]);
-/**
- * Build a safe proxy URL from a device's reported host. Strips any path,
- * query, or fragment the host string carried, blocks cloud-metadata targets,
- * and refuses non-http(s) schemes. Returns null if the host is unsafe.
- */
-function buildProxyUrl(deviceHost, req) {
-    let parsed;
-    try {
-        parsed = new URL(deviceHost);
-    }
-    catch (_a) {
-        return null;
-    }
-    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')
-        return null;
-    if (FORBIDDEN_PROXY_HOSTS.has(parsed.hostname))
-        return null;
-    // Only keep scheme + host + port; discard any attacker-baked path/query/fragment.
-    const origin = `${parsed.protocol}//${parsed.host}`;
-    // Treat req.originalUrl as a path — reparse to strip any control characters.
-    const forwardPath = req.originalUrl.startsWith('/') ? req.originalUrl : `/${req.originalUrl}`;
-    return `${origin}${forwardPath}`;
-}
+// Another server's phone (a node's, or a cloud provider's): its actions are
+// sent on to its node, answered here, or refused, before any handler below
+// runs it with this server's own tools. See nodePhoneControl.ts.
+router.use((0, nodePhoneControl_1.nodePhoneControl)());
 function getDeviceInfo(udid) {
     return __awaiter(this, void 0, void 0, function* () {
         const device = yield device_store_1.DeviceStoreFactory.getStore().findDevice({ udid });
@@ -172,26 +146,12 @@ function getDeviceManagerForPlatform(platform) {
     });
 }
 router.post('/:udid/tap', (req, res) => __awaiter(void 0, void 0, void 0, function* () {
-    var _a, _b;
     const { udid } = req.params;
     const { x, y } = req.body;
     const device = yield getDeviceInfo(udid);
     if (!device)
         return res.status(404).send('Device not found');
     const manager = yield getDeviceManagerForPlatform(device.platform);
-    if (device.host && !device.host.includes(req.get('host') || '')) {
-        const target = buildProxyUrl(device.host, req);
-        if (!target)
-            return res.status(400).send({ error: 'Unsafe device host' });
-        logger_1.default.info(`Proxying tap for ${udid} to ${target}`);
-        try {
-            yield InternalHttpClient_1.InternalHttpClient.post(target, req.body);
-            return res.status(200).send({ success: true });
-        }
-        catch (err) {
-            return res.status(((_a = err.response) === null || _a === void 0 ? void 0 : _a.status) || 500).send(((_b = err.response) === null || _b === void 0 ? void 0 : _b.data) || err.message);
-        }
-    }
     if (manager && manager.tap) {
         try {
             yield manager.tap(udid, x, y);
@@ -216,26 +176,12 @@ router.post('/:udid/tap', (req, res) => __awaiter(void 0, void 0, void 0, functi
     res.status(400).send('Manager not found or tap not supported');
 }));
 router.post('/:udid/swipe', (req, res) => __awaiter(void 0, void 0, void 0, function* () {
-    var _a, _b;
     const { udid } = req.params;
     const { x, y, endX, endY, duration = 1000 } = req.body;
     const device = yield getDeviceInfo(udid);
     if (!device)
         return res.status(404).send('Device not found');
     const manager = yield getDeviceManagerForPlatform(device.platform);
-    if (device.host && !device.host.includes(req.get('host') || '')) {
-        const target = buildProxyUrl(device.host, req);
-        if (!target)
-            return res.status(400).send({ error: 'Unsafe device host' });
-        logger_1.default.info(`Proxying swipe for ${udid} to ${target}`);
-        try {
-            yield InternalHttpClient_1.InternalHttpClient.post(target, req.body);
-            return res.status(200).send({ success: true });
-        }
-        catch (err) {
-            return res.status(((_a = err.response) === null || _a === void 0 ? void 0 : _a.status) || 500).send(((_b = err.response) === null || _b === void 0 ? void 0 : _b.data) || err.message);
-        }
-    }
     if (manager && manager.swipe) {
         try {
             yield manager.swipe(udid, x, y, endX, endY, duration);
@@ -249,26 +195,12 @@ router.post('/:udid/swipe', (req, res) => __awaiter(void 0, void 0, void 0, func
     res.status(400).send('Manager not found or swipe not supported');
 }));
 router.post('/:udid/text', (req, res) => __awaiter(void 0, void 0, void 0, function* () {
-    var _a, _b;
     const { udid } = req.params;
     const { text } = req.body;
     const device = yield getDeviceInfo(udid);
     if (!device)
         return res.status(404).send('Device not found');
     const manager = yield getDeviceManagerForPlatform(device.platform);
-    if (device.host && !device.host.includes(req.get('host') || '')) {
-        const target = buildProxyUrl(device.host, req);
-        if (!target)
-            return res.status(400).send({ error: 'Unsafe device host' });
-        logger_1.default.info(`Proxying typeText for ${udid} to ${target}`);
-        try {
-            yield InternalHttpClient_1.InternalHttpClient.post(target, req.body);
-            return res.status(200).send({ success: true });
-        }
-        catch (err) {
-            return res.status(((_a = err.response) === null || _a === void 0 ? void 0 : _a.status) || 500).send(((_b = err.response) === null || _b === void 0 ? void 0 : _b.data) || err.message);
-        }
-    }
     if (manager && manager.typeText) {
         try {
             yield manager.typeText(udid, text);
@@ -282,26 +214,12 @@ router.post('/:udid/text', (req, res) => __awaiter(void 0, void 0, void 0, funct
     res.status(400).send('Manager not found or typeText not supported');
 }));
 router.post('/:udid/keyevent', (req, res) => __awaiter(void 0, void 0, void 0, function* () {
-    var _a, _b;
     const { udid } = req.params;
     const { keyCode } = req.body;
     const device = yield getDeviceInfo(udid);
     if (!device)
         return res.status(404).send('Device not found');
     const manager = yield getDeviceManagerForPlatform(device.platform);
-    if (device.host && !device.host.includes(req.get('host') || '')) {
-        const target = buildProxyUrl(device.host, req);
-        if (!target)
-            return res.status(400).send({ error: 'Unsafe device host' });
-        logger_1.default.info(`Proxying keyevent for ${udid} to ${target}`);
-        try {
-            yield InternalHttpClient_1.InternalHttpClient.post(target, req.body);
-            return res.status(200).send({ success: true });
-        }
-        catch (err) {
-            return res.status(((_a = err.response) === null || _a === void 0 ? void 0 : _a.status) || 500).send(((_b = err.response) === null || _b === void 0 ? void 0 : _b.data) || err.message);
-        }
-    }
     if (manager && manager.pressKey) {
         try {
             yield manager.pressKey(udid, keyCode);
@@ -385,26 +303,12 @@ router.post('/:udid/clipboard', (req, res) => __awaiter(void 0, void 0, void 0,
     res.status(400).send('Manager not found or setClipboard not supported');
 }));
 router.post('/:udid/touchAndHold', (req, res) => __awaiter(void 0, void 0, void 0, function* () {
-    var _a, _b;
     const { udid } = req.params;
     const { x, y, duration = 1000 } = req.body;
     const device = yield getDeviceInfo(udid);
     if (!device)
         return res.status(404).send('Device not found');
     const manager = yield getDeviceManagerForPlatform(device.platform);
-    if (device.host && !device.host.includes(req.get('host') || '')) {
-        const target = buildProxyUrl(device.host, req);
-        if (!target)
-            return res.status(400).send({ error: 'Unsafe device host' });
-        logger_1.default.info(`Proxying touchAndHold for ${udid} to ${target}`);
-        try {
-            yield InternalHttpClient_1.InternalHttpClient.post(target, req.body);
-            return res.status(200).send({ success: true });
-        }
-        catch (err) {
-            return res.status(((_a = err.response) === null || _a === void 0 ? void 0 : _a.status) || 500).send(((_b = err.response) === null || _b === void 0 ? void 0 : _b.data) || err.message);
-        }
-    }
     if (manager && manager.touchAndHold) {
         try {
             yield manager.touchAndHold(udid, x, y, duration);
@@ -800,7 +704,9 @@ router.post('/:udid/stream/ticket', (req, res) => __awaiter(void 0, void 0, void
 function stopPreview(udid, device, release) {
     return __awaiter(this, void 0, void 0, function* () {
         if (device.platform === 'ios' || device.platform === 'tvos') {
-            yield typedi_1.Container.get(IOSStreamService_1.default).stopStream(udid);
+            // A viewer's stop: an Appium session on the phone may be driving this
+            // stream's WDA, and then the stream stays (see IOSStreamService.stopStream).
+            yield typedi_1.Container.get(IOSStreamService_1.default).stopStream(udid, { forViewer: true });
         }
         else {
             yield typedi_1.Container.get(AndroidStreamService_1.default).stopStream(udid);
@@ -1026,8 +932,9 @@ router.get('/:udid/stream', (req, res) => __awaiter(void 0, void 0, void 0, func
                 getSession: (id) => iosStreamService.getStreamStatus(id),
                 // Single attempt (retries = 0): a healthy WDA answers in milliseconds,
                 // so this costs nothing on the happy path and stays bounded by the
-                // 2.5s /status timeout when WDA is dead.
-                isWdaHealthy: (wdaPort, id) => iosStreamService.isWDARunning(wdaPort, id, 0),
+                // 2.5s /status timeout when WDA is dead. No udid: WDA names no phone
+                // (see isWDARunning). The port is this phone's stream's own lease.
+                isWdaHealthy: (wdaPort) => iosStreamService.isWDARunning(wdaPort, 0),
                 startStream: (id) => __awaiter(void 0, void 0, void 0, function* () {
                     var _a;
                     logger_1.default.info(`Stream for iOS device ${id} requested (Status: ${((_a = iosStreamService.getStreamStatus(id)) === null || _a === void 0 ? void 0 : _a.status) || 'idle'})...`);

package/lib/src/app/routers/grid.js

@@ -58,6 +58,8 @@ const device_managers_1 = require("../../device-managers");
 const typedi_1 = require("typedi");
 const prisma_1 = require("../../prisma");
 const DeviceTeamResolver_1 = require("../../services/device-access/DeviceTeamResolver");
+const PluginContext_1 = require("../../PluginContext");
+const localDeviceHosts_1 = require("../../device-managers/localDeviceHosts");
 const store = device_store_1.DeviceStoreFactory.getStore();
 const pendingStore = device_store_1.DeviceStoreFactory.getPendingSessionStore();
 const SERVER_UP_TIME = new Date().toISOString();
@@ -141,26 +143,44 @@ function getDeviceByPlatform(request, response) {
         return response.status(200).send(yield (0, device_service_1.enrichDevicesWithTeamNames)(devices));
     });
 }
+/** A removal a node asked for, from what it sent: strings only. */
+function nodeRemoval(host, nodeId, udid) {
+    return {
+        udid,
+        host: typeof host === 'string' && host !== '' ? host : undefined,
+        nodeId: typeof nodeId === 'string' && nodeId !== '' ? nodeId : undefined,
+    };
+}
+/** Whether a row is one of this server's own phones, which no node may remove. */
+function isThisServersOwn() {
+    const context = typedi_1.Container.get(PluginContext_1.PluginContext);
+    const local = (0, localDeviceHosts_1.localDeviceHosts)(context.pluginArgs, context.port);
+    return (device) => (0, localDeviceHosts_1.isOwnDevice)(local, context.nodeId, device);
+}
 function registerNode(request, response) {
     return __awaiter(this, void 0, void 0, function* () {
         const requestBody = request.body;
         const { type } = request.query;
         if (type === 'add') {
-            // A node's own report of its phones: it is their source of truth, so the
-            // hub writes every column (AddDevicesOptions.mirror).
-            const addedDevices = yield (0, device_service_1.addNewDevice)(requestBody, undefined, { mirror: true });
+            // A node's report of its phones (AddDevicesOptions.nodeReport): what the
+            // node observes of them, and whether they are busy there (`nodeBusy`).
+            // It never frees a phone this hub has claimed for a session, nor changes
+            // the settings this hub owns for it: team, tags, reservation, block.
+            const addedDevices = yield (0, device_service_1.addNewDevice)(requestBody, undefined, { nodeReport: true });
             if (addedDevices.length > 0) {
                 logger_1.default.info(`Added new devices: ${JSON.stringify(addedDevices)}`);
             }
         }
         else if (type === 'remove') {
-            yield (0, device_service_1.removeDevice)(requestBody);
+            // One phone each, by udid: an entry without one names no phone.
+            const removals = (Array.isArray(requestBody) ? requestBody : [])
+                .filter((entry) => typeof (entry === null || entry === void 0 ? void 0 : entry.udid) === 'string' && entry.udid !== '')
+                .map((entry) => nodeRemoval(entry.host, entry.nodeId, entry.udid));
+            yield (0, device_service_1.removeNodeDevices)(removals, isThisServersOwn());
         }
         else if (type === 'unregister') {
-            const { host } = request.query;
-            if (host) {
-                yield (0, device_service_1.removeDevicesByHost)(host);
-            }
+            const { host, nodeId } = request.query;
+            yield (0, device_service_1.removeNodeDevices)([nodeRemoval(host, nodeId)], isThisServersOwn());
         }
         response.status(200).send({
             success: true,

package/lib/src/app/routers/nodePhoneControl.js

@@ -0,0 +1,301 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NODE_CONTROL_TIMEOUT_MS = exports.ANSWERED_HERE = exports.NODE_FORWARDED_CONTROL = void 0;
+exports.safeNodeOrigin = safeNodeOrigin;
+exports.nodeControlUrl = nodeControlUrl;
+exports.isOtherServersPhone = isOtherServersPhone;
+exports.nodePhoneControl = nodePhoneControl;
+const typedi_1 = require("typedi");
+const logger_1 = __importDefault(require("../../logger"));
+const PluginContext_1 = require("../../PluginContext");
+const localDeviceHosts_1 = require("../../device-managers/localDeviceHosts");
+const actor_1 = require("../../services/device-access/actor");
+const hubSessionToken_1 = require("../../gateway/hubSessionToken");
+const forwardToNode_1 = require("../../gateway/forwardToNode");
+const device_store_1 = require("../../data-service/device-store");
+const deviceAccessPolicy_1 = require("../../services/device-access/deviceAccessPolicy");
+const controlDevice_1 = require("../../middleware/controlDevice");
+/**
+ * /control on another server's phone: a node's, or a cloud provider's.
+ *
+ * The handlers in control.ts act on this server's own phones, with this
+ * server's adb and go-ios. On a hub they used to run for a node's phone too,
+ * against a phone the hub doesn't have: only five actions were sent on to the
+ * node. This sits after the team and ownership guards and decides every
+ * request for another server's phone before any handler runs, so an action
+ * added later is refused for it until someone puts it on a list below.
+ */
+/**
+ * Sent on to the phone's node, and the node's answer relayed unchanged. Each
+ * is about the phone alone. The preview's are too: the node holds the phone
+ * for the preview, counts its viewers and releases it, by its own rules and
+ * with the hub's user, so none of that is kept here.
+ */
+exports.NODE_FORWARDED_CONTROL = [
+    'POST tap',
+    'POST swipe',
+    'POST text',
+    'POST keyevent',
+    'POST touchandhold',
+    'GET screenshot',
+    'GET clipboard',
+    'POST clipboard',
+    'POST lock',
+    'POST unlock',
+    'GET display',
+    'POST uninstall',
+    'GET apps',
+    'GET logs',
+    'POST shell',
+    'GET inspector/snapshot',
+    'POST stream/start',
+    'GET stream/status',
+    'POST stream/leave',
+    'POST stream/stop',
+    // The MJPEG stream itself: relayed for as long as the viewer watches.
+    'GET stream',
+];
+/**
+ * Answered by this server's own handler.
+ * - appium-session: the session runs through this server, which routes its
+ *   commands, so its id and base path are this server's.
+ * - stream/ticket: the viewer's ticket is this server's, minted after its
+ *   team check. The stream it opens is relayed from the node: GET stream
+ *   above, and the H.264 and logcat sockets (src/app/ws/nodeSocketRelay.ts),
+ *   which get a ticket of the node's own.
+ */
+exports.ANSWERED_HERE = ['GET appium-session', 'POST stream/ticket'];
+// Not on either list, and why, so nobody adds them as a plain forward:
+// - upload-install is a multipart upload;
+// - install-repository-app installs a file from this server's app library,
+//   which the node doesn't have;
+// - install takes a path, which names a file on one machine only;
+// - omni-scan and test-locator run this server's AI settings on a
+//   screenshot.
+/**
+ * A node that hasn't started answering in this long is treated as gone. Once
+ * it has, the answer may take as long as it takes: a stream lasts as long as
+ * its viewer.
+ */
+exports.NODE_CONTROL_TIMEOUT_MS = 60000;
+// Cloud metadata endpoints — never proxy to these regardless of caller.
+const FORBIDDEN_PROXY_HOSTS = new Set([
+    '169.254.169.254', // AWS/Azure/GCP IMDS
+    'metadata.google.internal',
+    'metadata.goog',
+    '100.100.100.200', // Alibaba ECS metadata
+    'fd00:ec2::254', // AWS IMDSv6
+]);
+/**
+ * The node's origin from the phone's reported host: scheme, host and port
+ * only, dropping any path, query or fragment the host string carried. Null
+ * for a cloud-metadata target or a scheme other than http(s).
+ */
+function safeNodeOrigin(deviceHost) {
+    let parsed;
+    try {
+        parsed = new URL(deviceHost);
+    }
+    catch (_a) {
+        return null;
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')
+        return null;
+    if (FORBIDDEN_PROXY_HOSTS.has(parsed.hostname))
+        return null;
+    return `${parsed.protocol}//${parsed.host}`;
+}
+/** The node's own URL for this request, or null if the host is unsafe. */
+function nodeControlUrl(deviceHost, req) {
+    const origin = safeNodeOrigin(deviceHost);
+    if (!origin)
+        return null;
+    const forwardPath = req.originalUrl.startsWith('/') ? req.originalUrl : `/${req.originalUrl}`;
+    return `${origin}${withoutTicket(forwardPath)}`;
+}
+/**
+ * The path without a `ticket` query parameter. A viewer's ticket is this
+ * server's, already spent here, and not the node's business: the node gets
+ * the hub's token instead.
+ */
+function withoutTicket(path) {
+    const q = path.indexOf('?');
+    if (q < 0)
+        return path;
+    const params = new URLSearchParams(path.slice(q + 1));
+    if (!params.has('ticket'))
+        return path;
+    params.delete('ticket');
+    const query = params.toString();
+    return query ? `${path.slice(0, q)}?${query}` : path.slice(0, q);
+}
+/**
+ * A phone another server drives. Decided by the phone's own row (its nodeId,
+ * else its exact host against this server's own hosts), never by the Host
+ * header the caller used: a substring match on that header forwarded a lab's
+ * own phone back to itself, with no login, whenever the lab was reached as
+ * `localhost`.
+ */
+function isOtherServersPhone(device) {
+    if (!device.host)
+        return false;
+    const context = typedi_1.Container.get(PluginContext_1.PluginContext);
+    return !(0, localDeviceHosts_1.isOwnDevice)((0, localDeviceHosts_1.localDeviceHosts)(context.pluginArgs, context.port), context.nodeId, device);
+}
+function originOf(host) {
+    try {
+        return new URL(host).origin;
+    }
+    catch (_a) {
+        return host;
+    }
+}
+function refuse(res, error, message) {
+    return res.status(501).json({ success: false, error, message });
+}
+function nodePhoneControl(deps = {}) {
+    var _a, _b, _c;
+    const findDevice = (_a = deps.findDevice) !== null && _a !== void 0 ? _a : controlDevice_1.findControlDeviceInStore;
+    const timeoutMs = (_b = deps.timeoutMs) !== null && _b !== void 0 ? _b : exports.NODE_CONTROL_TIMEOUT_MS;
+    const markNodeBusy = (_c = deps.markNodeBusy) !== null && _c !== void 0 ? _c : ((udid, host) => device_store_1.DeviceStoreFactory.getStore().markNodeBusy(udid, host));
+    return function (req, res, next) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const action = (0, controlDevice_1.controlAction)(req);
+            if (!action)
+                return next();
+            const udid = (0, controlDevice_1.readControlUdid)(req, res, 'nodePhoneControl');
+            if (udid === null)
+                return;
+            if (!udid)
+                return next();
+            // The guards' memoized lookup: usually no query of its own.
+            let device;
+            try {
+                device = yield (0, controlDevice_1.lookupControlDevice)(res, udid, findDevice);
+            }
+            catch (e) {
+                // Falling through would let the handler, with its own lookup, run a
+                // node's phone here: fail closed.
+                // Answered as every /control lookup failure is.
+                logger_1.default.error(`nodePhoneControl: device lookup failed for ${udid}: ${(_a = e === null || e === void 0 ? void 0 : e.message) !== null && _a !== void 0 ? _a : e}`);
+                return res.status(503).json((0, deviceAccessPolicy_1.ownershipUnavailableBody)());
+            }
+            if (!device || !isOtherServersPhone(device))
+                return next();
+            const key = `${req.method} ${action}`;
+            if (exports.ANSWERED_HERE.includes(key))
+                return next();
+            if (device.cloud) {
+                return refuse(res, 'not_available_for_cloud_phone', "This phone is a cloud provider's. Device control isn't available for it here.");
+            }
+            const node = originOf(device.host);
+            if (!exports.NODE_FORWARDED_CONTROL.includes(key)) {
+                return refuse(res, 'not_available_through_hub', `This phone is on node ${node}, and the hub doesn't pass ${action} on to nodes yet.`);
+            }
+            return forward(req, res, { udid, device, node, timeoutMs, markNodeBusy });
+        });
+    };
+}
+function forward(req, res, target) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c, _d, _e, _f;
+        const { udid, device, node, timeoutMs } = target;
+        const url = nodeControlUrl(device.host, req);
+        if (!url)
+            return res.status(400).json({ error: 'Unsafe device host' });
+        const actor = (0, actor_1.resolveActor)(req);
+        const headers = {
+            accept: (_a = req.headers.accept) !== null && _a !== void 0 ? _a : 'application/json',
+            'accept-encoding': 'identity',
+        };
+        // Null when this server can't sign (it warns once): the call goes without,
+        // which a node with auth disabled accepts and one with auth enabled refuses.
+        const token = actor.userId
+            ? yield typedi_1.Container.get(hubSessionToken_1.HubSessionTokenIssuer).controlTokenFor({
+                userId: actor.userId,
+                isAdmin: actor.isAdmin,
+                udid,
+                host: device.host,
+            })
+            : null;
+        if (token)
+            headers[hubSessionToken_1.HUB_TOKEN_HEADER] = token;
+        let body;
+        if (req.method !== 'GET' && req.method !== 'HEAD') {
+            body = Buffer.from(JSON.stringify((_b = req.body) !== null && _b !== void 0 ? _b : {}));
+            headers['content-type'] = 'application/json';
+        }
+        const controller = new AbortController();
+        let timedOut = false;
+        const timer = setTimeout(() => {
+            timedOut = true;
+            controller.abort();
+        }, timeoutMs);
+        // The caller left: stop waiting for the node on their behalf.
+        const onClose = () => {
+            if (!res.writableFinished)
+                controller.abort();
+        };
+        res.on('close', onClose);
+        logger_1.default.debug(`Forwarding ${req.method} ${(0, controlDevice_1.controlAction)(req)} for ${udid} to node ${node}`);
+        try {
+            const upstream = yield (0, forwardToNode_1.sendToNode)({
+                url,
+                method: req.method,
+                headers,
+                body,
+                signal: controller.signal,
+            });
+            // The node has answered: from here the answer takes as long as it takes.
+            clearTimeout(timer);
+            const status = (_c = upstream.statusCode) !== null && _c !== void 0 ? _c : 502;
+            if (req.method === 'POST' && (0, controlDevice_1.controlAction)(req) === 'stream/start' && status < 300) {
+                // The node holds the phone for the preview now, and says so in its
+                // next report, up to an interval away. Until then this server could
+                // hand the phone to a session the node would refuse.
+                yield target.markNodeBusy(udid, device.host).catch((e) => {
+                    var _a;
+                    logger_1.default.warn(`nodePhoneControl: could not mark ${udid} busy for its node: ${(_a = e === null || e === void 0 ? void 0 : e.message) !== null && _a !== void 0 ? _a : e}`);
+                });
+            }
+            yield (0, forwardToNode_1.relayAnswer)(upstream, res, false);
+        }
+        catch (e) {
+            if (res.headersSent || res.destroyed) {
+                res.destroy();
+            }
+            else if (timedOut) {
+                res.status(504).json({
+                    success: false,
+                    error: 'node_timeout',
+                    message: `Node ${node} didn't answer within ${Math.round(timeoutMs / 1000)} s.`,
+                });
+            }
+            else {
+                logger_1.default.warn(`nodePhoneControl: node ${node} unreachable for ${udid}: ${(_d = e === null || e === void 0 ? void 0 : e.message) !== null && _d !== void 0 ? _d : e}`);
+                res.status(502).json({
+                    success: false,
+                    error: 'node_unreachable',
+                    message: `Xenon could not reach node ${node} for this phone: ${(_f = (_e = e === null || e === void 0 ? void 0 : e.code) !== null && _e !== void 0 ? _e : e === null || e === void 0 ? void 0 : e.message) !== null && _f !== void 0 ? _f : e}`,
+                });
+            }
+        }
+        finally {
+            clearTimeout(timer);
+            res.off('close', onClose);
+        }
+    });
+}