@xenon-device-management/xenon 2.1.0 → 2.2.0

package/lib/public/assets/{users-7yviqflc.js → users-Nb_rzRmF.js}

@@ -1,4 +1,4 @@
-import{c as w,b as k,r as a,j as e,$ as C}from"./index-BuIIcmGp.js";import{l as M,d as R,c as I,a as A,u as D}from"./users-BUE7MoTq.js";import{f as U}from"./time-B8FIgwPE.js";import{P}from"./page-header-CKWFOjOI.js";import{B as y}from"./button-Dd-IhMC1.js";import{I as N}from"./input-Bq9aY-We.js";import{S as g}from"./select-DIZWIoVR.js";import{P as B}from"./plus-BpFKVdC8.js";import{T as L}from"./trash-2-BV88cV3Z.js";import"./utils-CDN07tui.js";/**
+import{c as w,b as k,r as a,j as e,$ as C}from"./index-3uxl3o7K.js";import{l as M,d as R,c as I,a as A,u as D}from"./users-BU0nXIVe.js";import{f as U}from"./time-B8FIgwPE.js";import{P}from"./page-header-CfR4Sm9V.js";import{B as y}from"./button-_Y78wXiP.js";import{I as N}from"./input-CzTWvUXZ.js";import{S as g}from"./select-Cqx7pEou.js";import{P as B}from"./plus-DOS8P9CQ.js";import{T as L}from"./trash-2-BV4hSmXJ.js";import"./utils-CDN07tui.js";/**
  * @license lucide-react v0.555.0 - ISC
  *
  * This source code is licensed under the ISC license.

package/lib/public/assets/{video-off-BTRxtlGo.js → video-off-CUNzD2kH.js}

@@ -1,4 +1,4 @@
-import{c as o}from"./index-BuIIcmGp.js";/**
+import{c as o}from"./index-3uxl3o7K.js";/**
  * @license lucide-react v0.555.0 - ISC
  *
  * This source code is licensed under the ISC license.

package/lib/public/assets/{webhook-settings-DMKD9Pgm.js → webhook-settings-Ca3UFXZe.js}

@@ -1 +1 @@
-import{t as P,r,X as c,j as e,J as u,A as b,C as U,K as D}from"./index-BuIIcmGp.js";/* empty css                 */import{F as S}from"./FieldGroup-CCdFlZm6.js";import{P as O}from"./page-header-CKWFOjOI.js";import{T as V}from"./trash-2-BV88cV3Z.js";import{P as x}from"./plus-BpFKVdC8.js";import{C as B}from"./circle-x-pdVkomLa.js";import{C as H}from"./circle-check-Ckn00yMB.js";import{Z as I}from"./zap-CWE94qcK.js";import{A as J}from"./activity-K-hdylwq.js";const C=[{id:"device_offline",label:"Device offline",icon:U,tone:"red"},{id:"device_new",label:"New device",icon:x,tone:"green"},{id:"session_failed",label:"Session failed",icon:B,tone:"amber"},{id:"selector_health_digest",label:"Selector health digest",icon:D,tone:"green"}],X=["udid","host","name","sessionId","failureReason","eventType","platform"],ae=()=>{const{toast:o}=P(),[g,T]=r.useState([]),[A,w]=r.useState(!0),[l,j]=r.useState(""),[d,k]=r.useState(["device_offline","session_failed"]),[h,f]=r.useState(!1),[v,N]=r.useState(!1),[n,_]=r.useState(!1),[y,m]=r.useState("");r.useEffect(()=>{p()},[]);const p=async()=>{w(!0);try{const s=await c.getWebhookConfigs();T(s||[])}catch(s){console.error("Failed to load webhook configs",s),o("Failed to load webhooks.","error")}finally{w(!1)}},z=async()=>{if(!l.trim()){o("Webhook URL is required.","error");return}if(d.length===0){o("Select at least one trigger event.","error");return}f(!0);try{await c.addWebhookConfig(l.trim(),d,"slack",y||void 0),j(""),m(""),_(!1),k(["device_offline","session_failed"]),await p(),o("Webhook saved.","success")}catch(s){console.error("Failed to add webhook",s),o(`Failed to add webhook: ${s.message||"unknown error"}`,"error")}finally{f(!1)}},E=async(s,t)=>{if(window.confirm(`Remove webhook for "${t}"?`))try{await c.deleteWebhookConfig(s),await p(),o("Webhook removed.","success")}catch(a){console.error("Failed to delete webhook",a),o(`Failed to delete: ${a.message||"unknown error"}`,"error")}},L=async()=>{if(l.trim()){N(!0);try{await c.testWebhook(l.trim(),"slack"),o("Test payload delivered.","success")}catch(s){o(`Test failed: ${s.message||"check the URL"}`,"error")}finally{N(!1)}}},$=s=>{k(t=>t.includes(s)?t.filter(a=>a!==s):[...t,s])},R=s=>{m(t=>t+`{{${s}}} `)};return e.jsxs("div",{className:"settings-container",children:[e.jsx(O,{icon:u,title:"Notifications",subtitle:"Configure Slack or generic webhooks to receive alerts for critical infrastructure events."}),e.jsxs("div",{className:"settings-content",children:[A?e.jsxs("div",{className:"settings-loading",style:{height:200},children:[e.jsx(b,{className:"animate-spin",size:28}),e.jsx("span",{children:"Loading webhooks…"})]}):g.length===0?e.jsxs("div",{className:"empty-state",children:[e.jsx("div",{className:"empty-state__icon",children:e.jsx(u,{size:28})}),e.jsx("h3",{className:"empty-state__title",children:"No webhooks configured"}),e.jsx("p",{className:"empty-state__copy",children:"Wire up a Slack incoming webhook or any HTTPS endpoint to receive alerts when devices go offline, new devices register, or sessions fail. Configure your first webhook below."})]}):e.jsx("div",{className:"webhook-list-grid",children:g.map(s=>{const t=(()=>{try{return JSON.parse(s.events)}catch{return[]}})();return e.jsxs("div",{className:"webhook-row-card",children:[e.jsxs("div",{className:"webhook-row-card__header",children:[e.jsx("span",{className:`pill-chip ${s.payloadTemplate?"pill-chip--admin":"pill-chip--scope"}`,children:s.payloadTemplate?"CUSTOM":"SLACK"}),e.jsx("span",{className:"webhook-row-card__url",title:s.url,children:s.url}),e.jsxs("button",{type:"button",className:"row-action row-action--danger",onClick:()=>E(s.id,s.url),"aria-label":`Remove webhook for ${s.url}`,children:[e.jsx(V,{size:13}),e.jsx("span",{children:"Remove"})]})]}),e.jsx("div",{className:"webhook-row-card__events",children:t.length===0?e.jsx("span",{className:"webhook-row-card__no-events",children:"No triggers"}):t.map(a=>{const i=C.find(F=>F.id===a),W=(i==null?void 0:i.icon)??u;return e.jsxs("span",{className:`event-pill event-pill--${(i==null?void 0:i.tone)||"gray"}`,children:[e.jsx(W,{size:11}),(i==null?void 0:i.label)||a]},a)})})]},s.id)})}),e.jsxs("div",{className:"add-webhook-card",children:[e.jsxs("div",{className:"add-webhook-card__header",children:[e.jsx(x,{size:14}),e.jsx("span",{children:"Add a new webhook"})]}),e.jsxs("div",{className:"add-webhook-card__body",children:[e.jsx(S,{label:"Webhook URL",description:"The endpoint we POST webhook events to.",htmlFor:"webhook-url",children:e.jsx("div",{className:"setting-input-wrapper",children:e.jsx("input",{id:"webhook-url",type:"url",placeholder:"https://hooks.slack.com/services/...",value:l,onChange:s=>j(s.target.value)})})}),e.jsx(S,{label:"Trigger events",children:e.jsx("div",{className:"event-toggle-grid",children:C.map(s=>{const t=d.includes(s.id),a=s.icon;return e.jsxs("button",{type:"button",role:"checkbox","aria-checked":t,className:`event-toggle event-toggle--${s.tone} ${t?"is-selected":""}`,onClick:()=>$(s.id),children:[e.jsx(a,{size:14,className:"event-toggle__lead"}),e.jsx("span",{children:s.label}),t&&e.jsx(H,{size:14,className:"event-toggle__check"})]},s.id)})})}),e.jsxs("div",{className:"template-section",children:[e.jsxs("button",{type:"button",className:"template-section__toggle",onClick:()=>_(!n),"aria-expanded":n,children:[e.jsx(I,{size:14,className:n?"tone-amber":"tone-dim"}),e.jsx("span",{children:"Use custom payload (optional)"}),e.jsx("span",{className:"template-section__indicator",children:n?"−":"+"})]}),n&&e.jsxs("div",{className:"template-editor",children:[e.jsx("p",{className:"template-editor__hint",children:"Define a JSON or text template. Click a variable below to insert it."}),e.jsx("div",{className:"template-editor__chips",children:X.map(s=>e.jsx("button",{type:"button",className:"template-editor__chip",onClick:()=>R(s),children:`{{${s}}}`},s))}),e.jsx("textarea",{className:"template-editor__textarea",placeholder:'Example: { "text": "Alert: Device {{udid}} is offline!" }',value:y,onChange:s=>m(s.target.value),rows:4})]})]})]}),e.jsxs("div",{className:"add-webhook-card__footer",children:[e.jsxs("button",{type:"button",className:"page-header-action page-header-action--ghost",onClick:L,disabled:!l.trim()||v,children:[v?e.jsx(b,{size:14,className:"animate-spin"}):e.jsx(J,{size:14}),e.jsx("span",{children:"Test payload"})]}),e.jsxs("button",{type:"button",className:"page-header-action",onClick:z,disabled:h||!l.trim(),children:[h?e.jsx(b,{size:14,className:"animate-spin"}):e.jsx(x,{size:14}),e.jsx("span",{children:h?"Saving…":"Save webhook"})]})]})]})]})]})};export{ae as WebhookSettings};
+import{t as P,r,X as c,j as e,J as u,A as b,C as U,K as D}from"./index-3uxl3o7K.js";/* empty css                 */import{F as S}from"./FieldGroup-5bCutWrs.js";import{P as O}from"./page-header-CfR4Sm9V.js";import{T as V}from"./trash-2-BV4hSmXJ.js";import{P as x}from"./plus-DOS8P9CQ.js";import{C as B}from"./circle-x-B4IOD1DE.js";import{C as H}from"./circle-check-D3Qq0tKp.js";import{Z as I}from"./zap-B2bH2vKX.js";import{A as J}from"./activity-DxRFWvkN.js";const C=[{id:"device_offline",label:"Device offline",icon:U,tone:"red"},{id:"device_new",label:"New device",icon:x,tone:"green"},{id:"session_failed",label:"Session failed",icon:B,tone:"amber"},{id:"selector_health_digest",label:"Selector health digest",icon:D,tone:"green"}],X=["udid","host","name","sessionId","failureReason","eventType","platform"],ae=()=>{const{toast:o}=P(),[g,T]=r.useState([]),[A,w]=r.useState(!0),[l,j]=r.useState(""),[d,k]=r.useState(["device_offline","session_failed"]),[h,f]=r.useState(!1),[v,N]=r.useState(!1),[n,_]=r.useState(!1),[y,m]=r.useState("");r.useEffect(()=>{p()},[]);const p=async()=>{w(!0);try{const s=await c.getWebhookConfigs();T(s||[])}catch(s){console.error("Failed to load webhook configs",s),o("Failed to load webhooks.","error")}finally{w(!1)}},z=async()=>{if(!l.trim()){o("Webhook URL is required.","error");return}if(d.length===0){o("Select at least one trigger event.","error");return}f(!0);try{await c.addWebhookConfig(l.trim(),d,"slack",y||void 0),j(""),m(""),_(!1),k(["device_offline","session_failed"]),await p(),o("Webhook saved.","success")}catch(s){console.error("Failed to add webhook",s),o(`Failed to add webhook: ${s.message||"unknown error"}`,"error")}finally{f(!1)}},E=async(s,t)=>{if(window.confirm(`Remove webhook for "${t}"?`))try{await c.deleteWebhookConfig(s),await p(),o("Webhook removed.","success")}catch(a){console.error("Failed to delete webhook",a),o(`Failed to delete: ${a.message||"unknown error"}`,"error")}},L=async()=>{if(l.trim()){N(!0);try{await c.testWebhook(l.trim(),"slack"),o("Test payload delivered.","success")}catch(s){o(`Test failed: ${s.message||"check the URL"}`,"error")}finally{N(!1)}}},$=s=>{k(t=>t.includes(s)?t.filter(a=>a!==s):[...t,s])},R=s=>{m(t=>t+`{{${s}}} `)};return e.jsxs("div",{className:"settings-container",children:[e.jsx(O,{icon:u,title:"Notifications",subtitle:"Configure Slack or generic webhooks to receive alerts for critical infrastructure events."}),e.jsxs("div",{className:"settings-content",children:[A?e.jsxs("div",{className:"settings-loading",style:{height:200},children:[e.jsx(b,{className:"animate-spin",size:28}),e.jsx("span",{children:"Loading webhooks…"})]}):g.length===0?e.jsxs("div",{className:"empty-state",children:[e.jsx("div",{className:"empty-state__icon",children:e.jsx(u,{size:28})}),e.jsx("h3",{className:"empty-state__title",children:"No webhooks configured"}),e.jsx("p",{className:"empty-state__copy",children:"Wire up a Slack incoming webhook or any HTTPS endpoint to receive alerts when devices go offline, new devices register, or sessions fail. Configure your first webhook below."})]}):e.jsx("div",{className:"webhook-list-grid",children:g.map(s=>{const t=(()=>{try{return JSON.parse(s.events)}catch{return[]}})();return e.jsxs("div",{className:"webhook-row-card",children:[e.jsxs("div",{className:"webhook-row-card__header",children:[e.jsx("span",{className:`pill-chip ${s.payloadTemplate?"pill-chip--admin":"pill-chip--scope"}`,children:s.payloadTemplate?"CUSTOM":"SLACK"}),e.jsx("span",{className:"webhook-row-card__url",title:s.url,children:s.url}),e.jsxs("button",{type:"button",className:"row-action row-action--danger",onClick:()=>E(s.id,s.url),"aria-label":`Remove webhook for ${s.url}`,children:[e.jsx(V,{size:13}),e.jsx("span",{children:"Remove"})]})]}),e.jsx("div",{className:"webhook-row-card__events",children:t.length===0?e.jsx("span",{className:"webhook-row-card__no-events",children:"No triggers"}):t.map(a=>{const i=C.find(F=>F.id===a),W=(i==null?void 0:i.icon)??u;return e.jsxs("span",{className:`event-pill event-pill--${(i==null?void 0:i.tone)||"gray"}`,children:[e.jsx(W,{size:11}),(i==null?void 0:i.label)||a]},a)})})]},s.id)})}),e.jsxs("div",{className:"add-webhook-card",children:[e.jsxs("div",{className:"add-webhook-card__header",children:[e.jsx(x,{size:14}),e.jsx("span",{children:"Add a new webhook"})]}),e.jsxs("div",{className:"add-webhook-card__body",children:[e.jsx(S,{label:"Webhook URL",description:"The endpoint we POST webhook events to.",htmlFor:"webhook-url",children:e.jsx("div",{className:"setting-input-wrapper",children:e.jsx("input",{id:"webhook-url",type:"url",placeholder:"https://hooks.slack.com/services/...",value:l,onChange:s=>j(s.target.value)})})}),e.jsx(S,{label:"Trigger events",children:e.jsx("div",{className:"event-toggle-grid",children:C.map(s=>{const t=d.includes(s.id),a=s.icon;return e.jsxs("button",{type:"button",role:"checkbox","aria-checked":t,className:`event-toggle event-toggle--${s.tone} ${t?"is-selected":""}`,onClick:()=>$(s.id),children:[e.jsx(a,{size:14,className:"event-toggle__lead"}),e.jsx("span",{children:s.label}),t&&e.jsx(H,{size:14,className:"event-toggle__check"})]},s.id)})})}),e.jsxs("div",{className:"template-section",children:[e.jsxs("button",{type:"button",className:"template-section__toggle",onClick:()=>_(!n),"aria-expanded":n,children:[e.jsx(I,{size:14,className:n?"tone-amber":"tone-dim"}),e.jsx("span",{children:"Use custom payload (optional)"}),e.jsx("span",{className:"template-section__indicator",children:n?"−":"+"})]}),n&&e.jsxs("div",{className:"template-editor",children:[e.jsx("p",{className:"template-editor__hint",children:"Define a JSON or text template. Click a variable below to insert it."}),e.jsx("div",{className:"template-editor__chips",children:X.map(s=>e.jsx("button",{type:"button",className:"template-editor__chip",onClick:()=>R(s),children:`{{${s}}}`},s))}),e.jsx("textarea",{className:"template-editor__textarea",placeholder:'Example: { "text": "Alert: Device {{udid}} is offline!" }',value:y,onChange:s=>m(s.target.value),rows:4})]})]})]}),e.jsxs("div",{className:"add-webhook-card__footer",children:[e.jsxs("button",{type:"button",className:"page-header-action page-header-action--ghost",onClick:L,disabled:!l.trim()||v,children:[v?e.jsx(b,{size:14,className:"animate-spin"}):e.jsx(J,{size:14}),e.jsx("span",{children:"Test payload"})]}),e.jsxs("button",{type:"button",className:"page-header-action",onClick:z,disabled:h||!l.trim(),children:[h?e.jsx(b,{size:14,className:"animate-spin"}):e.jsx(x,{size:14}),e.jsx("span",{children:h?"Saving…":"Save webhook"})]})]})]})]})]})};export{ae as WebhookSettings};

package/lib/public/assets/{zap-CWE94qcK.js → zap-B2bH2vKX.js}

@@ -1,4 +1,4 @@
-import{c as a}from"./index-BuIIcmGp.js";/**
+import{c as a}from"./index-3uxl3o7K.js";/**
  * @license lucide-react v0.555.0 - ISC
  *
  * This source code is licensed under the ISC license.

package/lib/public/index.html

@@ -36,7 +36,7 @@
       Learn how to configure a non-root public URL by running `npm run build`.
     -->
   <title>Xenon</title>
-  <script type="module" crossorigin src="/xenon/assets/index-BuIIcmGp.js"></script>
+  <script type="module" crossorigin src="/xenon/assets/index-3uxl3o7K.js"></script>
   <link rel="stylesheet" crossorigin href="/xenon/assets/index-hymrhlEZ.css">
 </head>
 

package/lib/src/app/routers/control.js

@@ -68,7 +68,6 @@ const InspectorService_1 = require("../../services/InspectorService");
 const StreamTicketService_1 = require("../../services/token/StreamTicketService");
 const appVisibility_1 = require("../../services/device-access/appVisibility");
 const PluginContext_1 = require("../../PluginContext");
-const localDeviceHosts_1 = require("../../device-managers/localDeviceHosts");
 const streamType_1 = require("./streamType");
 const iosStreamPort_1 = require("./iosStreamPort");
 const androidH264Config_1 = require("./androidH264Config");
@@ -81,10 +80,10 @@ const deviceTeamGuard_1 = require("../../middleware/deviceTeamGuard");
 const controlDevice_1 = require("../../middleware/controlDevice");
 const manualLock_1 = require("../../services/recording/manualLock");
 const streamStartConflict_1 = require("./streamStartConflict");
+const nodePhoneControl_1 = require("./nodePhoneControl");
 const streamLeave_1 = require("./streamLeave");
 const SessionOwnerResolver_1 = require("../../services/device-access/SessionOwnerResolver");
 const actor_1 = require("../../services/device-access/actor");
-const hubSessionToken_1 = require("../../gateway/hubSessionToken");
 const deviceAccessPolicy_1 = require("../../services/device-access/deviceAccessPolicy");
 const router = (0, express_1.Router)();
 /** True when an in-memory iOS/Android (MJPEG or H.264) stream session exists. */
@@ -112,76 +111,10 @@ router.use((0, deviceTeamGuard_1.deviceTeamGuard)());
 // another user's Appium session. Mounted here so every current and future
 // mutation is covered without per-handler opt-in.
 router.use((0, deviceAccessGuard_1.deviceAccessGuard)());
-// Cloud metadata endpoints — never proxy to these regardless of caller.
-const FORBIDDEN_PROXY_HOSTS = new Set([
-    '169.254.169.254', // AWS/Azure/GCP IMDS
-    'metadata.google.internal',
-    'metadata.goog',
-    '100.100.100.200', // Alibaba ECS metadata
-    'fd00:ec2::254', // AWS IMDSv6
-]);
-/**
- * Build a safe proxy URL from a device's reported host. Strips any path,
- * query, or fragment the host string carried, blocks cloud-metadata targets,
- * and refuses non-http(s) schemes. Returns null if the host is unsafe.
- */
-function buildProxyUrl(deviceHost, req) {
-    let parsed;
-    try {
-        parsed = new URL(deviceHost);
-    }
-    catch (_a) {
-        return null;
-    }
-    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')
-        return null;
-    if (FORBIDDEN_PROXY_HOSTS.has(parsed.hostname))
-        return null;
-    // Only keep scheme + host + port; discard any attacker-baked path/query/fragment.
-    const origin = `${parsed.protocol}//${parsed.host}`;
-    // Treat req.originalUrl as a path — reparse to strip any control characters.
-    const forwardPath = req.originalUrl.startsWith('/') ? req.originalUrl : `/${req.originalUrl}`;
-    return `${origin}${forwardPath}`;
-}
-/**
- * Forward a control action on another server's phone to that server, signed
- * for the caller: the hub's control token (hubSessionToken.ts) names the
- * user, whether they are an admin, the phone and its node. This hub already
- * checked them (the guards above); a node with auth enabled accepts the token
- * for /control on that phone and runs its own ownership guard with that user.
- * Sent with no credential at all, it was refused by every such node. A cloud
- * provider never gets a hub token.
- */
-function forwardControl(device, req, target) {
-    return __awaiter(this, void 0, void 0, function* () {
-        const actor = (0, actor_1.resolveActor)(req);
-        const token = !device.cloud && actor.userId
-            ? yield typedi_1.Container.get(hubSessionToken_1.HubSessionTokenIssuer).controlTokenFor({
-                userId: actor.userId,
-                isAdmin: actor.isAdmin,
-                udid: device.udid,
-                host: device.host,
-            })
-            : null;
-        // Sent once: a retry after a slow node's timeout or 5xx could land the
-        // same tap twice.
-        const config = Object.assign(Object.assign({}, (token ? { headers: { [hubSessionToken_1.HUB_TOKEN_HEADER]: token } } : {})), { retry: false });
-        yield InternalHttpClient_1.InternalHttpClient.post(target, req.body, config);
-    });
-}
-/**
- * A phone another server drives, whose /control actions are forwarded there.
- * Decided by the phone's own row (its nodeId, else its exact host against this
- * server's own hosts), never by the Host header the caller used: a substring
- * match on that header forwarded a lab's own phone back to itself, with no
- * login, whenever the lab was reached as `localhost`.
- */
-function isOtherServersPhone(device) {
-    if (!device.host)
-        return false;
-    const context = typedi_1.Container.get(PluginContext_1.PluginContext);
-    return !(0, localDeviceHosts_1.isOwnDevice)((0, localDeviceHosts_1.localDeviceHosts)(context.pluginArgs, context.port), context.nodeId, device);
-}
+// Another server's phone (a node's, or a cloud provider's): its actions are
+// sent on to its node, answered here, or refused, before any handler below
+// runs it with this server's own tools. See nodePhoneControl.ts.
+router.use((0, nodePhoneControl_1.nodePhoneControl)());
 function getDeviceInfo(udid) {
     return __awaiter(this, void 0, void 0, function* () {
         const device = yield device_store_1.DeviceStoreFactory.getStore().findDevice({ udid });
@@ -213,26 +146,12 @@ function getDeviceManagerForPlatform(platform) {
     });
 }
 router.post('/:udid/tap', (req, res) => __awaiter(void 0, void 0, void 0, function* () {
-    var _a, _b;
     const { udid } = req.params;
     const { x, y } = req.body;
     const device = yield getDeviceInfo(udid);
     if (!device)
         return res.status(404).send('Device not found');
     const manager = yield getDeviceManagerForPlatform(device.platform);
-    if (isOtherServersPhone(device)) {
-        const target = buildProxyUrl(device.host, req);
-        if (!target)
-            return res.status(400).send({ error: 'Unsafe device host' });
-        logger_1.default.info(`Proxying tap for ${udid} to ${target}`);
-        try {
-            yield forwardControl(device, req, target);
-            return res.status(200).send({ success: true });
-        }
-        catch (err) {
-            return res.status(((_a = err.response) === null || _a === void 0 ? void 0 : _a.status) || 500).send(((_b = err.response) === null || _b === void 0 ? void 0 : _b.data) || err.message);
-        }
-    }
     if (manager && manager.tap) {
         try {
             yield manager.tap(udid, x, y);
@@ -257,26 +176,12 @@ router.post('/:udid/tap', (req, res) => __awaiter(void 0, void 0, void 0, functi
     res.status(400).send('Manager not found or tap not supported');
 }));
 router.post('/:udid/swipe', (req, res) => __awaiter(void 0, void 0, void 0, function* () {
-    var _a, _b;
     const { udid } = req.params;
     const { x, y, endX, endY, duration = 1000 } = req.body;
     const device = yield getDeviceInfo(udid);
     if (!device)
         return res.status(404).send('Device not found');
     const manager = yield getDeviceManagerForPlatform(device.platform);
-    if (isOtherServersPhone(device)) {
-        const target = buildProxyUrl(device.host, req);
-        if (!target)
-            return res.status(400).send({ error: 'Unsafe device host' });
-        logger_1.default.info(`Proxying swipe for ${udid} to ${target}`);
-        try {
-            yield forwardControl(device, req, target);
-            return res.status(200).send({ success: true });
-        }
-        catch (err) {
-            return res.status(((_a = err.response) === null || _a === void 0 ? void 0 : _a.status) || 500).send(((_b = err.response) === null || _b === void 0 ? void 0 : _b.data) || err.message);
-        }
-    }
     if (manager && manager.swipe) {
         try {
             yield manager.swipe(udid, x, y, endX, endY, duration);
@@ -290,26 +195,12 @@ router.post('/:udid/swipe', (req, res) => __awaiter(void 0, void 0, void 0, func
     res.status(400).send('Manager not found or swipe not supported');
 }));
 router.post('/:udid/text', (req, res) => __awaiter(void 0, void 0, void 0, function* () {
-    var _a, _b;
     const { udid } = req.params;
     const { text } = req.body;
     const device = yield getDeviceInfo(udid);
     if (!device)
         return res.status(404).send('Device not found');
     const manager = yield getDeviceManagerForPlatform(device.platform);
-    if (isOtherServersPhone(device)) {
-        const target = buildProxyUrl(device.host, req);
-        if (!target)
-            return res.status(400).send({ error: 'Unsafe device host' });
-        logger_1.default.info(`Proxying typeText for ${udid} to ${target}`);
-        try {
-            yield forwardControl(device, req, target);
-            return res.status(200).send({ success: true });
-        }
-        catch (err) {
-            return res.status(((_a = err.response) === null || _a === void 0 ? void 0 : _a.status) || 500).send(((_b = err.response) === null || _b === void 0 ? void 0 : _b.data) || err.message);
-        }
-    }
     if (manager && manager.typeText) {
         try {
             yield manager.typeText(udid, text);
@@ -323,26 +214,12 @@ router.post('/:udid/text', (req, res) => __awaiter(void 0, void 0, void 0, funct
     res.status(400).send('Manager not found or typeText not supported');
 }));
 router.post('/:udid/keyevent', (req, res) => __awaiter(void 0, void 0, void 0, function* () {
-    var _a, _b;
     const { udid } = req.params;
     const { keyCode } = req.body;
     const device = yield getDeviceInfo(udid);
     if (!device)
         return res.status(404).send('Device not found');
     const manager = yield getDeviceManagerForPlatform(device.platform);
-    if (isOtherServersPhone(device)) {
-        const target = buildProxyUrl(device.host, req);
-        if (!target)
-            return res.status(400).send({ error: 'Unsafe device host' });
-        logger_1.default.info(`Proxying keyevent for ${udid} to ${target}`);
-        try {
-            yield forwardControl(device, req, target);
-            return res.status(200).send({ success: true });
-        }
-        catch (err) {
-            return res.status(((_a = err.response) === null || _a === void 0 ? void 0 : _a.status) || 500).send(((_b = err.response) === null || _b === void 0 ? void 0 : _b.data) || err.message);
-        }
-    }
     if (manager && manager.pressKey) {
         try {
             yield manager.pressKey(udid, keyCode);
@@ -426,26 +303,12 @@ router.post('/:udid/clipboard', (req, res) => __awaiter(void 0, void 0, void 0,
     res.status(400).send('Manager not found or setClipboard not supported');
 }));
 router.post('/:udid/touchAndHold', (req, res) => __awaiter(void 0, void 0, void 0, function* () {
-    var _a, _b;
     const { udid } = req.params;
     const { x, y, duration = 1000 } = req.body;
     const device = yield getDeviceInfo(udid);
     if (!device)
         return res.status(404).send('Device not found');
     const manager = yield getDeviceManagerForPlatform(device.platform);
-    if (isOtherServersPhone(device)) {
-        const target = buildProxyUrl(device.host, req);
-        if (!target)
-            return res.status(400).send({ error: 'Unsafe device host' });
-        logger_1.default.info(`Proxying touchAndHold for ${udid} to ${target}`);
-        try {
-            yield forwardControl(device, req, target);
-            return res.status(200).send({ success: true });
-        }
-        catch (err) {
-            return res.status(((_a = err.response) === null || _a === void 0 ? void 0 : _a.status) || 500).send(((_b = err.response) === null || _b === void 0 ? void 0 : _b.data) || err.message);
-        }
-    }
     if (manager && manager.touchAndHold) {
         try {
             yield manager.touchAndHold(udid, x, y, duration);

package/lib/src/app/routers/nodePhoneControl.js

@@ -0,0 +1,301 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NODE_CONTROL_TIMEOUT_MS = exports.ANSWERED_HERE = exports.NODE_FORWARDED_CONTROL = void 0;
+exports.safeNodeOrigin = safeNodeOrigin;
+exports.nodeControlUrl = nodeControlUrl;
+exports.isOtherServersPhone = isOtherServersPhone;
+exports.nodePhoneControl = nodePhoneControl;
+const typedi_1 = require("typedi");
+const logger_1 = __importDefault(require("../../logger"));
+const PluginContext_1 = require("../../PluginContext");
+const localDeviceHosts_1 = require("../../device-managers/localDeviceHosts");
+const actor_1 = require("../../services/device-access/actor");
+const hubSessionToken_1 = require("../../gateway/hubSessionToken");
+const forwardToNode_1 = require("../../gateway/forwardToNode");
+const device_store_1 = require("../../data-service/device-store");
+const deviceAccessPolicy_1 = require("../../services/device-access/deviceAccessPolicy");
+const controlDevice_1 = require("../../middleware/controlDevice");
+/**
+ * /control on another server's phone: a node's, or a cloud provider's.
+ *
+ * The handlers in control.ts act on this server's own phones, with this
+ * server's adb and go-ios. On a hub they used to run for a node's phone too,
+ * against a phone the hub doesn't have: only five actions were sent on to the
+ * node. This sits after the team and ownership guards and decides every
+ * request for another server's phone before any handler runs, so an action
+ * added later is refused for it until someone puts it on a list below.
+ */
+/**
+ * Sent on to the phone's node, and the node's answer relayed unchanged. Each
+ * is about the phone alone. The preview's are too: the node holds the phone
+ * for the preview, counts its viewers and releases it, by its own rules and
+ * with the hub's user, so none of that is kept here.
+ */
+exports.NODE_FORWARDED_CONTROL = [
+    'POST tap',
+    'POST swipe',
+    'POST text',
+    'POST keyevent',
+    'POST touchandhold',
+    'GET screenshot',
+    'GET clipboard',
+    'POST clipboard',
+    'POST lock',
+    'POST unlock',
+    'GET display',
+    'POST uninstall',
+    'GET apps',
+    'GET logs',
+    'POST shell',
+    'GET inspector/snapshot',
+    'POST stream/start',
+    'GET stream/status',
+    'POST stream/leave',
+    'POST stream/stop',
+    // The MJPEG stream itself: relayed for as long as the viewer watches.
+    'GET stream',
+];
+/**
+ * Answered by this server's own handler.
+ * - appium-session: the session runs through this server, which routes its
+ *   commands, so its id and base path are this server's.
+ * - stream/ticket: the viewer's ticket is this server's, minted after its
+ *   team check. The stream it opens is relayed from the node: GET stream
+ *   above, and the H.264 and logcat sockets (src/app/ws/nodeSocketRelay.ts),
+ *   which get a ticket of the node's own.
+ */
+exports.ANSWERED_HERE = ['GET appium-session', 'POST stream/ticket'];
+// Not on either list, and why, so nobody adds them as a plain forward:
+// - upload-install is a multipart upload;
+// - install-repository-app installs a file from this server's app library,
+//   which the node doesn't have;
+// - install takes a path, which names a file on one machine only;
+// - omni-scan and test-locator run this server's AI settings on a
+//   screenshot.
+/**
+ * A node that hasn't started answering in this long is treated as gone. Once
+ * it has, the answer may take as long as it takes: a stream lasts as long as
+ * its viewer.
+ */
+exports.NODE_CONTROL_TIMEOUT_MS = 60000;
+// Cloud metadata endpoints — never proxy to these regardless of caller.
+const FORBIDDEN_PROXY_HOSTS = new Set([
+    '169.254.169.254', // AWS/Azure/GCP IMDS
+    'metadata.google.internal',
+    'metadata.goog',
+    '100.100.100.200', // Alibaba ECS metadata
+    'fd00:ec2::254', // AWS IMDSv6
+]);
+/**
+ * The node's origin from the phone's reported host: scheme, host and port
+ * only, dropping any path, query or fragment the host string carried. Null
+ * for a cloud-metadata target or a scheme other than http(s).
+ */
+function safeNodeOrigin(deviceHost) {
+    let parsed;
+    try {
+        parsed = new URL(deviceHost);
+    }
+    catch (_a) {
+        return null;
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')
+        return null;
+    if (FORBIDDEN_PROXY_HOSTS.has(parsed.hostname))
+        return null;
+    return `${parsed.protocol}//${parsed.host}`;
+}
+/** The node's own URL for this request, or null if the host is unsafe. */
+function nodeControlUrl(deviceHost, req) {
+    const origin = safeNodeOrigin(deviceHost);
+    if (!origin)
+        return null;
+    const forwardPath = req.originalUrl.startsWith('/') ? req.originalUrl : `/${req.originalUrl}`;
+    return `${origin}${withoutTicket(forwardPath)}`;
+}
+/**
+ * The path without a `ticket` query parameter. A viewer's ticket is this
+ * server's, already spent here, and not the node's business: the node gets
+ * the hub's token instead.
+ */
+function withoutTicket(path) {
+    const q = path.indexOf('?');
+    if (q < 0)
+        return path;
+    const params = new URLSearchParams(path.slice(q + 1));
+    if (!params.has('ticket'))
+        return path;
+    params.delete('ticket');
+    const query = params.toString();
+    return query ? `${path.slice(0, q)}?${query}` : path.slice(0, q);
+}
+/**
+ * A phone another server drives. Decided by the phone's own row (its nodeId,
+ * else its exact host against this server's own hosts), never by the Host
+ * header the caller used: a substring match on that header forwarded a lab's
+ * own phone back to itself, with no login, whenever the lab was reached as
+ * `localhost`.
+ */
+function isOtherServersPhone(device) {
+    if (!device.host)
+        return false;
+    const context = typedi_1.Container.get(PluginContext_1.PluginContext);
+    return !(0, localDeviceHosts_1.isOwnDevice)((0, localDeviceHosts_1.localDeviceHosts)(context.pluginArgs, context.port), context.nodeId, device);
+}
+function originOf(host) {
+    try {
+        return new URL(host).origin;
+    }
+    catch (_a) {
+        return host;
+    }
+}
+function refuse(res, error, message) {
+    return res.status(501).json({ success: false, error, message });
+}
+function nodePhoneControl(deps = {}) {
+    var _a, _b, _c;
+    const findDevice = (_a = deps.findDevice) !== null && _a !== void 0 ? _a : controlDevice_1.findControlDeviceInStore;
+    const timeoutMs = (_b = deps.timeoutMs) !== null && _b !== void 0 ? _b : exports.NODE_CONTROL_TIMEOUT_MS;
+    const markNodeBusy = (_c = deps.markNodeBusy) !== null && _c !== void 0 ? _c : ((udid, host) => device_store_1.DeviceStoreFactory.getStore().markNodeBusy(udid, host));
+    return function (req, res, next) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const action = (0, controlDevice_1.controlAction)(req);
+            if (!action)
+                return next();
+            const udid = (0, controlDevice_1.readControlUdid)(req, res, 'nodePhoneControl');
+            if (udid === null)
+                return;
+            if (!udid)
+                return next();
+            // The guards' memoized lookup: usually no query of its own.
+            let device;
+            try {
+                device = yield (0, controlDevice_1.lookupControlDevice)(res, udid, findDevice);
+            }
+            catch (e) {
+                // Falling through would let the handler, with its own lookup, run a
+                // node's phone here: fail closed.
+                // Answered as every /control lookup failure is.
+                logger_1.default.error(`nodePhoneControl: device lookup failed for ${udid}: ${(_a = e === null || e === void 0 ? void 0 : e.message) !== null && _a !== void 0 ? _a : e}`);
+                return res.status(503).json((0, deviceAccessPolicy_1.ownershipUnavailableBody)());
+            }
+            if (!device || !isOtherServersPhone(device))
+                return next();
+            const key = `${req.method} ${action}`;
+            if (exports.ANSWERED_HERE.includes(key))
+                return next();
+            if (device.cloud) {
+                return refuse(res, 'not_available_for_cloud_phone', "This phone is a cloud provider's. Device control isn't available for it here.");
+            }
+            const node = originOf(device.host);
+            if (!exports.NODE_FORWARDED_CONTROL.includes(key)) {
+                return refuse(res, 'not_available_through_hub', `This phone is on node ${node}, and the hub doesn't pass ${action} on to nodes yet.`);
+            }
+            return forward(req, res, { udid, device, node, timeoutMs, markNodeBusy });
+        });
+    };
+}
+function forward(req, res, target) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c, _d, _e, _f;
+        const { udid, device, node, timeoutMs } = target;
+        const url = nodeControlUrl(device.host, req);
+        if (!url)
+            return res.status(400).json({ error: 'Unsafe device host' });
+        const actor = (0, actor_1.resolveActor)(req);
+        const headers = {
+            accept: (_a = req.headers.accept) !== null && _a !== void 0 ? _a : 'application/json',
+            'accept-encoding': 'identity',
+        };
+        // Null when this server can't sign (it warns once): the call goes without,
+        // which a node with auth disabled accepts and one with auth enabled refuses.
+        const token = actor.userId
+            ? yield typedi_1.Container.get(hubSessionToken_1.HubSessionTokenIssuer).controlTokenFor({
+                userId: actor.userId,
+                isAdmin: actor.isAdmin,
+                udid,
+                host: device.host,
+            })
+            : null;
+        if (token)
+            headers[hubSessionToken_1.HUB_TOKEN_HEADER] = token;
+        let body;
+        if (req.method !== 'GET' && req.method !== 'HEAD') {
+            body = Buffer.from(JSON.stringify((_b = req.body) !== null && _b !== void 0 ? _b : {}));
+            headers['content-type'] = 'application/json';
+        }
+        const controller = new AbortController();
+        let timedOut = false;
+        const timer = setTimeout(() => {
+            timedOut = true;
+            controller.abort();
+        }, timeoutMs);
+        // The caller left: stop waiting for the node on their behalf.
+        const onClose = () => {
+            if (!res.writableFinished)
+                controller.abort();
+        };
+        res.on('close', onClose);
+        logger_1.default.debug(`Forwarding ${req.method} ${(0, controlDevice_1.controlAction)(req)} for ${udid} to node ${node}`);
+        try {
+            const upstream = yield (0, forwardToNode_1.sendToNode)({
+                url,
+                method: req.method,
+                headers,
+                body,
+                signal: controller.signal,
+            });
+            // The node has answered: from here the answer takes as long as it takes.
+            clearTimeout(timer);
+            const status = (_c = upstream.statusCode) !== null && _c !== void 0 ? _c : 502;
+            if (req.method === 'POST' && (0, controlDevice_1.controlAction)(req) === 'stream/start' && status < 300) {
+                // The node holds the phone for the preview now, and says so in its
+                // next report, up to an interval away. Until then this server could
+                // hand the phone to a session the node would refuse.
+                yield target.markNodeBusy(udid, device.host).catch((e) => {
+                    var _a;
+                    logger_1.default.warn(`nodePhoneControl: could not mark ${udid} busy for its node: ${(_a = e === null || e === void 0 ? void 0 : e.message) !== null && _a !== void 0 ? _a : e}`);
+                });
+            }
+            yield (0, forwardToNode_1.relayAnswer)(upstream, res, false);
+        }
+        catch (e) {
+            if (res.headersSent || res.destroyed) {
+                res.destroy();
+            }
+            else if (timedOut) {
+                res.status(504).json({
+                    success: false,
+                    error: 'node_timeout',
+                    message: `Node ${node} didn't answer within ${Math.round(timeoutMs / 1000)} s.`,
+                });
+            }
+            else {
+                logger_1.default.warn(`nodePhoneControl: node ${node} unreachable for ${udid}: ${(_d = e === null || e === void 0 ? void 0 : e.message) !== null && _d !== void 0 ? _d : e}`);
+                res.status(502).json({
+                    success: false,
+                    error: 'node_unreachable',
+                    message: `Xenon could not reach node ${node} for this phone: ${(_f = (_e = e === null || e === void 0 ? void 0 : e.code) !== null && _e !== void 0 ? _e : e === null || e === void 0 ? void 0 : e.message) !== null && _f !== void 0 ? _f : e}`,
+                });
+            }
+        }
+        finally {
+            clearTimeout(timer);
+            res.off('close', onClose);
+        }
+    });
+}