@xenon-device-management/xenon 2.1.0 → 2.3.0

package/lib/test/unit/screenshot-route.spec.js

@@ -0,0 +1,104 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const sinon_1 = __importDefault(require("sinon"));
+const express_1 = __importDefault(require("express"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
+const typedi_1 = require("typedi");
+const control_1 = __importDefault(require("../../src/app/routers/control"));
+const device_store_1 = require("../../src/data-service/device-store");
+const ApiKeyService_1 = require("../../src/services/ApiKeyService");
+const device_managers_1 = require("../../src/device-managers");
+const authMiddleware_1 = require("../../src/middleware/authMiddleware");
+const container_registration_1 = require("../helpers/container-registration");
+const loopbackServer_1 = require("../helpers/loopbackServer");
+const own_node_id_1 = require("../helpers/own-node-id");
+/**
+ * GET /control/:udid/screenshot. A capture that threw left the request
+ * unanswered: the handler had no catch, and Express 4 doesn't catch a
+ * rejected async handler. An iPhone with no live preview (no WebDriverAgent,
+ * no go-ios tunnel) did exactly that, and its Screenshot tab spun forever.
+ */
+const UDID = 'DEV-SHOT';
+// The route finds the manager by constructor name.
+class IOSDeviceManager {
+    constructor() {
+        this.getScreenshot = sinon_1.default.stub();
+    }
+}
+function buildApp() {
+    const app = (0, express_1.default)();
+    app.use(express_1.default.json());
+    const apiRouter = express_1.default.Router();
+    apiRouter.use((req, _res, next) => {
+        req.auth = {
+            kind: 'user-session',
+            userId: 'usr_me',
+            role: 'MEMBER',
+            scopes: (0, authMiddleware_1.scopesForRole)('MEMBER'),
+            rateLimit: 100,
+        };
+        next();
+    });
+    control_1.default.register(apiRouter);
+    app.use('/xenon/api', apiRouter);
+    return app;
+}
+describe('GET /control/:udid/screenshot', () => {
+    // The fake row is this server's own phone.
+    (0, own_node_id_1.useOwnNodeId)();
+    let manager;
+    let restoreContainer;
+    const loopback = (0, loopbackServer_1.loopbackServers)();
+    const app = () => __awaiter(void 0, void 0, void 0, function* () { return loopback.serve(buildApp()); });
+    beforeEach(() => {
+        restoreContainer = (0, container_registration_1.saveRegistrations)(ApiKeyService_1.ApiKeyService, device_managers_1.XenonManager);
+        manager = new IOSDeviceManager();
+        sinon_1.default.stub(device_store_1.DeviceStoreFactory, 'getStore').returns({
+            findDevice: () => __awaiter(void 0, void 0, void 0, function* () {
+                return ({
+                    udid: UDID,
+                    host: '127.0.0.1',
+                    nodeId: own_node_id_1.OWN_NODE_ID,
+                    platform: 'ios',
+                    busy: false,
+                    session_id: null,
+                });
+            }),
+        });
+        typedi_1.Container.set(ApiKeyService_1.ApiKeyService, new ApiKeyService_1.ApiKeyService());
+        typedi_1.Container.set(device_managers_1.XenonManager, { deviceInstances: () => __awaiter(void 0, void 0, void 0, function* () { return [manager]; }) });
+    });
+    afterEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        sinon_1.default.restore();
+        restoreContainer();
+        yield loopback.closeAll();
+    }));
+    it('returns the screenshot', () => __awaiter(void 0, void 0, void 0, function* () {
+        manager.getScreenshot.resolves('A'.repeat(200));
+        const res = yield (0, loopbackRequest_1.default)(yield app()).get(`/xenon/api/control/${UDID}/screenshot`);
+        (0, chai_1.expect)(res.status).to.equal(200);
+        (0, chai_1.expect)(res.body.screenshot).to.have.length(200);
+    }));
+    it('answers a capture that failed with 502 and the reason, rather than never', () => __awaiter(void 0, void 0, void 0, function* () {
+        manager.getScreenshot.rejects(new Error('connect ECONNREFUSED 127.0.0.1:8100'));
+        const res = yield (0, loopbackRequest_1.default)(yield app())
+            .get(`/xenon/api/control/${UDID}/screenshot`)
+            .timeout(5000);
+        (0, chai_1.expect)(res.status).to.equal(502);
+        (0, chai_1.expect)(res.body.error).to.include('ECONNREFUSED');
+    }));
+});

package/lib/test/unit/stream-leave-route.spec.js

@@ -62,6 +62,7 @@ const AndroidH264StreamService_1 = __importDefault(require("../../src/device-man
 const authMiddleware_1 = require("../../src/middleware/authMiddleware");
 const container_registration_1 = require("../helpers/container-registration");
 const loopbackServer_1 = require("../helpers/loopbackServer");
+const own_node_id_1 = require("../helpers/own-node-id");
 const UDID = 'DEV-1';
 const ALICE = 'usr_alice';
 const BOB = 'usr_bob';
@@ -84,6 +85,8 @@ function buildApp(userId) {
     return app;
 }
 describe('POST /control/:udid/stream/leave', () => {
+    // The fake rows are this server's own phones.
+    (0, own_node_id_1.useOwnNodeId)();
     let deviceRow;
     let unblock;
     let androidStop;
@@ -101,6 +104,7 @@ describe('POST /control/:udid/stream/leave', () => {
         deviceRow = {
             udid: UDID,
             host: '127.0.0.1',
+            nodeId: own_node_id_1.OWN_NODE_ID,
             platform: 'android',
             busy: true,
             session_id: `manual_${ALICE}_${UDID}`,

package/lib/test/unit/stream-stop-ownership.spec.js

@@ -62,6 +62,7 @@ const AndroidH264StreamService_1 = __importDefault(require("../../src/device-man
 const authMiddleware_1 = require("../../src/middleware/authMiddleware");
 const container_registration_1 = require("../helpers/container-registration");
 const loopbackServer_1 = require("../helpers/loopbackServer");
+const own_node_id_1 = require("../helpers/own-node-id");
 /**
  * Round-trip guard for POST /control/:udid/stream/stop.
  *
@@ -119,6 +120,8 @@ function buildApp(caller) {
     return app;
 }
 describe('POST /control/:udid/stream/stop — lock ownership round-trip', () => {
+    // The fake rows are this server's own phones.
+    (0, own_node_id_1.useOwnNodeId)();
     let unblock;
     let androidStop;
     let h264Stop;
@@ -131,6 +134,7 @@ describe('POST /control/:udid/stream/stop — lock ownership round-trip', () =>
         deviceRow = {
             udid: UDID,
             host: '127.0.0.1',
+            nodeId: own_node_id_1.OWN_NODE_ID,
             platform: 'android',
             busy: sessionId !== null,
             session_id: sessionId,

package/lib/test/unit/stream-stop-recording.spec.js

@@ -62,6 +62,7 @@ const AndroidH264StreamService_1 = __importDefault(require("../../src/device-man
 const authMiddleware_1 = require("../../src/middleware/authMiddleware");
 const container_registration_1 = require("../helpers/container-registration");
 const loopbackServer_1 = require("../helpers/loopbackServer");
+const own_node_id_1 = require("../helpers/own-node-id");
 /**
  * POST /control/:udid/stream/stop must not stop the stream under a live
  * recording. The recording reads from that stream: measured 2026-09-26 on a
@@ -94,6 +95,8 @@ function buildApp(caller) {
     return app;
 }
 describe('POST /control/:udid/stream/stop — a device being recorded', () => {
+    // The fake rows are this server's own phones.
+    (0, own_node_id_1.useOwnNodeId)();
     let unblock;
     let androidStop;
     let h264Stop;
@@ -110,6 +113,7 @@ describe('POST /control/:udid/stream/stop — a device being recorded', () => {
                 return ({
                     udid: UDID,
                     host: '127.0.0.1',
+                    nodeId: own_node_id_1.OWN_NODE_ID,
                     platform: 'android',
                     busy: true,
                     session_id: `manual_${ALICE}_${UDID}`,

package/lib/test/unit/stream-ticket-identity.spec.js

@@ -31,6 +31,7 @@ const UserSessionService_1 = require("../../src/services/UserSessionService");
 const device_store_1 = require("../../src/data-service/device-store");
 const container_registration_1 = require("../helpers/container-registration");
 const loopbackServer_1 = require("../helpers/loopbackServer");
+const own_node_id_1 = require("../helpers/own-node-id");
 /**
  * `req.auth.userId` must always hold a User id.
  *
@@ -51,6 +52,8 @@ const UDID = 'UDID-1';
 const ALICE_USER = 'usr_alice';
 const ALICE_KEY = 'key_abc';
 describe('stream/ticket carries the user identity, not the credential', () => {
+    // The fake rows are this server's own phones.
+    (0, own_node_id_1.useOwnNodeId)();
     let dir;
     let ticketSvc;
     function buildApp(caller = {}) {
@@ -103,7 +106,14 @@ describe('stream/ticket carries the user identity, not the credential', () => {
         sinon_1.default.stub(device_store_1.DeviceStoreFactory, 'getStore').returns({
             findDevice: (_a) => __awaiter(void 0, [_a], void 0, function* ({ udid }) {
                 return udid === UDID
-                    ? { udid, host: 'h', platform: 'android', screenWidth: '1080', screenHeight: '1920' }
+                    ? {
+                        udid,
+                        host: 'h',
+                        nodeId: own_node_id_1.OWN_NODE_ID,
+                        platform: 'android',
+                        screenWidth: '1080',
+                        screenHeight: '1920',
+                    }
                     : null;
             }),
         });

package/lib/test/unit/stream-watchdog-timers.spec.js

@@ -0,0 +1,46 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const sinon_1 = __importDefault(require("sinon"));
+const AndroidStreamService_1 = __importDefault(require("../../src/device-managers/android/AndroidStreamService"));
+const AndroidH264StreamService_1 = __importDefault(require("../../src/device-managers/android/AndroidH264StreamService"));
+const IOSStreamService_1 = __importDefault(require("../../src/device-managers/ios/IOSStreamService"));
+/**
+ * The stream services start their watchdogs in their constructors. On a
+ * server the HTTP listener keeps the process alive, so those intervals only
+ * need to fire while it runs; referenced, they also kept a test run (or any
+ * script that merely constructs a service) alive after its work was done.
+ */
+describe('stream service watchdogs', () => {
+    let created;
+    beforeEach(() => {
+        created = [];
+        const realSetInterval = global.setInterval;
+        sinon_1.default.stub(global, 'setInterval').callsFake(((fn, ms) => {
+            const timer = realSetInterval(fn, ms);
+            created.push(timer);
+            return timer;
+        }));
+    });
+    afterEach(() => {
+        sinon_1.default.restore();
+        for (const timer of created)
+            clearInterval(timer);
+    });
+    for (const [name, Service] of [
+        ['AndroidStreamService', AndroidStreamService_1.default],
+        ['AndroidH264StreamService', AndroidH264StreamService_1.default],
+        ['IOSStreamService', IOSStreamService_1.default],
+    ]) {
+        it(`${name}'s intervals don't keep the process alive`, () => {
+            new Service();
+            (0, chai_1.expect)(created.length, 'the constructor starts its watchdog').to.be.greaterThan(0);
+            for (const timer of created)
+                (0, chai_1.expect)(timer.hasRef(), 'unref()ed').to.equal(false);
+        });
+    }
+});

package/lib/test/unit/upload-install-route.spec.js

@@ -0,0 +1,205 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const sinon_1 = __importDefault(require("sinon"));
+const express_1 = __importDefault(require("express"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
+const typedi_1 = require("typedi");
+const control_1 = __importStar(require("../../src/app/routers/control"));
+const device_store_1 = require("../../src/data-service/device-store");
+const ApiKeyService_1 = require("../../src/services/ApiKeyService");
+const device_managers_1 = require("../../src/device-managers");
+const authMiddleware_1 = require("../../src/middleware/authMiddleware");
+const container_registration_1 = require("../helpers/container-registration");
+const loopbackServer_1 = require("../helpers/loopbackServer");
+const own_node_id_1 = require("../helpers/own-node-id");
+/**
+ * POST /control/:udid/upload-install, device control's "Upload file". No
+ * multipart parser was mounted for /control, only for /apps, so every upload
+ * was answered "No files were uploaded." and nothing was installed.
+ */
+const UDID = 'DEV-UPLOAD';
+const UPLOADS = path_1.default.join(os_1.default.tmpdir(), 'xenon-uploads');
+// The route finds the manager by constructor name.
+class AndroidDeviceManager {
+    constructor() {
+        this.installed = [];
+        this.fail = false;
+        this.installApp = (_udid, appPath) => __awaiter(this, void 0, void 0, function* () {
+            this.installed.push({ path: appPath, bytes: fs_1.default.readFileSync(appPath, 'utf8') });
+            if (this.fail)
+                throw new Error('INSTALL_FAILED_INVALID_APK');
+        });
+    }
+}
+function buildApp() {
+    const app = (0, express_1.default)();
+    app.use(express_1.default.json());
+    const apiRouter = express_1.default.Router();
+    apiRouter.use((req, _res, next) => {
+        req.auth = {
+            kind: 'user-session',
+            userId: 'usr_me',
+            role: 'MEMBER',
+            scopes: (0, authMiddleware_1.scopesForRole)('MEMBER'),
+            rateLimit: 100,
+        };
+        next();
+    });
+    control_1.default.register(apiRouter);
+    app.use('/xenon/api', apiRouter);
+    return app;
+}
+describe('POST /control/:udid/upload-install', () => {
+    // The fake row is this server's own phone.
+    (0, own_node_id_1.useOwnNodeId)();
+    let manager;
+    let restoreContainer;
+    const loopback = (0, loopbackServer_1.loopbackServers)();
+    const app = () => __awaiter(void 0, void 0, void 0, function* () { return loopback.serve(buildApp()); });
+    const upload = (bytes, name) => __awaiter(void 0, void 0, void 0, function* () {
+        return (0, loopbackRequest_1.default)(yield app())
+            .post(`/xenon/api/control/${UDID}/upload-install`)
+            .attach('app', Buffer.from(bytes), name);
+    });
+    beforeEach(() => {
+        restoreContainer = (0, container_registration_1.saveRegistrations)(ApiKeyService_1.ApiKeyService, device_managers_1.XenonManager);
+        manager = new AndroidDeviceManager();
+        sinon_1.default.stub(device_store_1.DeviceStoreFactory, 'getStore').returns({
+            findDevice: () => __awaiter(void 0, void 0, void 0, function* () {
+                return ({
+                    udid: UDID,
+                    host: '127.0.0.1',
+                    nodeId: own_node_id_1.OWN_NODE_ID,
+                    platform: 'android',
+                    busy: false,
+                    session_id: null,
+                });
+            }),
+        });
+        typedi_1.Container.set(ApiKeyService_1.ApiKeyService, new ApiKeyService_1.ApiKeyService());
+        typedi_1.Container.set(device_managers_1.XenonManager, { deviceInstances: () => __awaiter(void 0, void 0, void 0, function* () { return [manager]; }) });
+    });
+    afterEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        sinon_1.default.restore();
+        restoreContainer();
+        yield loopback.closeAll();
+    }));
+    it('installs the uploaded file, under its own extension, in the upload folder', () => __awaiter(void 0, void 0, void 0, function* () {
+        const res = yield upload('fake-apk-bytes', 'build-42.apk');
+        (0, chai_1.expect)(res.status, res.text).to.equal(200);
+        (0, chai_1.expect)(res.body.success).to.equal(true);
+        (0, chai_1.expect)(manager.installed).to.have.length(1);
+        const [{ path: saved, bytes }] = manager.installed;
+        (0, chai_1.expect)(bytes).to.equal('fake-apk-bytes');
+        (0, chai_1.expect)(path_1.default.dirname(saved)).to.equal(UPLOADS);
+        (0, chai_1.expect)(saved.endsWith('.apk')).to.equal(true);
+    }));
+    it('keeps a crafted file name inside the upload folder', () => __awaiter(void 0, void 0, void 0, function* () {
+        // Built by hand: the test client's multipart library cuts a file name to
+        // its last segment itself, but a client under nobody's control needn't.
+        // The parser (busboy) cuts it too; uploadName is tested alone below.
+        const boundary = 'xenonboundary';
+        const body = [
+            `--${boundary}`,
+            'Content-Disposition: form-data; name="app"; filename="a/../../../../../tmp/xenon-escape.apk"',
+            'Content-Type: application/octet-stream',
+            '',
+            'x',
+            `--${boundary}--`,
+            '',
+        ].join('\r\n');
+        const res = yield (0, loopbackRequest_1.default)(yield app())
+            .post(`/xenon/api/control/${UDID}/upload-install`)
+            .set('content-type', `multipart/form-data; boundary=${boundary}`)
+            .send(body);
+        (0, chai_1.expect)(res.status, res.text).to.equal(200);
+        const [{ path: saved }] = manager.installed;
+        (0, chai_1.expect)(path_1.default.dirname(saved)).to.equal(UPLOADS);
+        (0, chai_1.expect)(fs_1.default.existsSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-escape.apk'))).to.equal(false);
+    }));
+    it('removes the saved file once the install is over, whether it worked or not', () => __awaiter(void 0, void 0, void 0, function* () {
+        yield upload('ok', 'one.apk');
+        manager.fail = true;
+        const failed = yield upload('bad', 'two.apk');
+        (0, chai_1.expect)(failed.status).to.equal(500);
+        (0, chai_1.expect)(failed.body.error).to.include('INSTALL_FAILED_INVALID_APK');
+        for (const { path: saved } of manager.installed) {
+            (0, chai_1.expect)(fs_1.default.existsSync(saved), saved).to.equal(false);
+        }
+    }));
+    it('still says so when no file came', () => __awaiter(void 0, void 0, void 0, function* () {
+        const res = yield (0, loopbackRequest_1.default)(yield app())
+            .post(`/xenon/api/control/${UDID}/upload-install`)
+            .send({});
+        (0, chai_1.expect)(res.status).to.equal(400);
+        (0, chai_1.expect)(manager.installed).to.deep.equal([]);
+    }));
+});
+// The saved name, alone: the route's parser already cuts a name to its last
+// segment, so this is what holds if one ever doesn't.
+describe('uploadName', () => {
+    it('keeps only the last path segment, in safe characters, with its extension', () => {
+        for (const [name, rest] of [
+            ['a/../../../../../tmp/xenon-escape.apk', 'xenon-escape.apk'],
+            ['..\\..\\evil.ipa', '_.._evil.ipa'],
+            ['My App (1).apk', 'My_App_1_.apk'],
+            ['..', 'app'],
+            ['', 'app'],
+        ]) {
+            const saved = (0, control_1.uploadName)(name);
+            (0, chai_1.expect)(saved, name).to.match(/^\d+-/);
+            (0, chai_1.expect)(saved.replace(/^\d+-/, ''), name).to.equal(rest);
+            (0, chai_1.expect)(path_1.default.basename(saved), name).to.equal(saved);
+        }
+    });
+});