@xenon-device-management/xenon 2.1.0 → 2.3.0

package/lib/src/app/routers/nodePhoneControl.js

@@ -0,0 +1,520 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __await = (this && this.__await) || function (v) { return this instanceof __await ? (this.v = v, this) : new __await(v); }
+var __asyncValues = (this && this.__asyncValues) || function (o) {
+    if (!Symbol.asyncIterator) throw new TypeError("Symbol.asyncIterator is not defined.");
+    var m = o[Symbol.asyncIterator], i;
+    return m ? m.call(o) : (o = typeof __values === "function" ? __values(o) : o[Symbol.iterator](), i = {}, verb("next"), verb("throw"), verb("return"), i[Symbol.asyncIterator] = function () { return this; }, i);
+    function verb(n) { i[n] = o[n] && function (v) { return new Promise(function (resolve, reject) { v = o[n](v), settle(resolve, reject, v.done, v.value); }); }; }
+    function settle(resolve, reject, d, v) { Promise.resolve(v).then(function(v) { resolve({ value: v, done: d }); }, reject); }
+};
+var __asyncDelegator = (this && this.__asyncDelegator) || function (o) {
+    var i, p;
+    return i = {}, verb("next"), verb("throw", function (e) { throw e; }), verb("return"), i[Symbol.iterator] = function () { return this; }, i;
+    function verb(n, f) { i[n] = o[n] ? function (v) { return (p = !p) ? { value: __await(o[n](v)), done: false } : f ? f(v) : v; } : f; }
+};
+var __asyncGenerator = (this && this.__asyncGenerator) || function (thisArg, _arguments, generator) {
+    if (!Symbol.asyncIterator) throw new TypeError("Symbol.asyncIterator is not defined.");
+    var g = generator.apply(thisArg, _arguments || []), i, q = [];
+    return i = Object.create((typeof AsyncIterator === "function" ? AsyncIterator : Object).prototype), verb("next"), verb("throw"), verb("return", awaitReturn), i[Symbol.asyncIterator] = function () { return this; }, i;
+    function awaitReturn(f) { return function (v) { return Promise.resolve(v).then(f, reject); }; }
+    function verb(n, f) { if (g[n]) { i[n] = function (v) { return new Promise(function (a, b) { q.push([n, v, a, b]) > 1 || resume(n, v); }); }; if (f) i[n] = f(i[n]); } }
+    function resume(n, v) { try { step(g[n](v)); } catch (e) { settle(q[0][3], e); } }
+    function step(r) { r.value instanceof __await ? Promise.resolve(r.value.v).then(fulfill, reject) : settle(q[0][2], r); }
+    function fulfill(value) { resume("next", value); }
+    function reject(value) { resume("throw", value); }
+    function settle(f, v) { if (f(v), q.shift(), q.length) resume(q[0][0], q[0][1]); }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NODE_INSTALL_TIMEOUT_MS = exports.NODE_CONTROL_TIMEOUT_MS = exports.ANSWERED_HERE_FOR_NODES = exports.ANSWERED_HERE = exports.NODE_FORWARDED_CONTROL = void 0;
+exports.safeNodeOrigin = safeNodeOrigin;
+exports.nodeControlUrl = nodeControlUrl;
+exports.isOtherServersPhone = isOtherServersPhone;
+exports.nodePhoneControl = nodePhoneControl;
+exports.installFileOnNode = installFileOnNode;
+exports.screenshotFromNode = screenshotFromNode;
+const crypto_1 = require("crypto");
+const fs_1 = __importDefault(require("fs"));
+const stream_1 = require("stream");
+const typedi_1 = require("typedi");
+const logger_1 = __importDefault(require("../../logger"));
+const PluginContext_1 = require("../../PluginContext");
+const localDeviceHosts_1 = require("../../device-managers/localDeviceHosts");
+const actor_1 = require("../../services/device-access/actor");
+const hubSessionToken_1 = require("../../gateway/hubSessionToken");
+const forwardToNode_1 = require("../../gateway/forwardToNode");
+const manualLock_1 = require("../../services/recording/manualLock");
+const SessionOwnerResolver_1 = require("../../services/device-access/SessionOwnerResolver");
+const device_store_1 = require("../../data-service/device-store");
+const deviceAccessPolicy_1 = require("../../services/device-access/deviceAccessPolicy");
+const controlDevice_1 = require("../../middleware/controlDevice");
+/**
+ * /control on another server's phone: a node's, or a cloud provider's.
+ *
+ * The handlers in control.ts act on this server's own phones, with this
+ * server's adb and go-ios. On a hub they used to run for a node's phone too,
+ * against a phone the hub doesn't have: only five actions were sent on to the
+ * node. This sits after the team and ownership guards and decides every
+ * request for another server's phone before any handler runs, so an action
+ * added later is refused for it until someone puts it on a list below.
+ */
+/**
+ * Sent on to the phone's node, and the node's answer relayed unchanged. Each
+ * is about the phone alone. The preview's are too: the node holds the phone
+ * for the preview, counts its viewers and releases it, by its own rules and
+ * with the hub's user, so none of that is kept here.
+ */
+exports.NODE_FORWARDED_CONTROL = [
+    'POST tap',
+    'POST swipe',
+    'POST text',
+    'POST keyevent',
+    'POST touchandhold',
+    'GET screenshot',
+    'GET clipboard',
+    'POST clipboard',
+    'POST lock',
+    'POST unlock',
+    'GET display',
+    'POST uninstall',
+    'GET apps',
+    'GET logs',
+    'POST shell',
+    'GET inspector/snapshot',
+    'POST stream/start',
+    'GET stream/status',
+    'POST stream/leave',
+    'POST stream/stop',
+    // The MJPEG stream itself: relayed for as long as the viewer watches.
+    'GET stream',
+    // The upload is streamed on as it came: nothing here reads it first.
+    'POST upload-install',
+];
+/**
+ * Answered by this server's own handler.
+ * - appium-session: the session runs through this server, which routes its
+ *   commands, so its id and base path are this server's.
+ * - stream/ticket: the viewer's ticket is this server's, minted after its
+ *   team check. The stream it opens is relayed from the node: GET stream
+ *   above, and the H.264 and logcat sockets (src/app/ws/nodeSocketRelay.ts),
+ *   which get a ticket of the node's own.
+ */
+exports.ANSWERED_HERE = ['GET appium-session', 'POST stream/ticket'];
+/**
+ * Answered by this server's own handler for a node's phone (a cloud
+ * provider's is refused), which does its part here and asks the node for
+ * the rest:
+ * - install-repository-app: the app is in this server's library, checked
+ *   against the caller's teams here, and sent to the node's upload-install
+ *   (installFileOnNode).
+ * - omni-scan, test-locator: Omni-Vision runs here, with this server's AI
+ *   settings, on the node's screenshot (screenshotFromNode).
+ */
+exports.ANSWERED_HERE_FOR_NODES = [
+    'POST install-repository-app',
+    'GET omni-scan',
+    'POST test-locator',
+];
+// Not on any list, so refused: install takes a path, which names a file on
+// one machine only.
+/**
+ * A node that hasn't started answering in this long is treated as gone. Once
+ * it has, the answer may take as long as it takes: a stream lasts as long as
+ * its viewer.
+ */
+exports.NODE_CONTROL_TIMEOUT_MS = 60000;
+/**
+ * An install is answered when it is done, which can take minutes (a large
+ * app, a slow phone): its node gets this long to start answering instead.
+ */
+exports.NODE_INSTALL_TIMEOUT_MS = 15 * 60000;
+/** Forwarded actions that are installs, and get NODE_INSTALL_TIMEOUT_MS. */
+const INSTALLS = ['POST upload-install'];
+// Cloud metadata endpoints — never proxy to these regardless of caller.
+const FORBIDDEN_PROXY_HOSTS = new Set([
+    '169.254.169.254', // AWS/Azure/GCP IMDS
+    'metadata.google.internal',
+    'metadata.goog',
+    '100.100.100.200', // Alibaba ECS metadata
+    'fd00:ec2::254', // AWS IMDSv6
+]);
+/**
+ * The node's origin from the phone's reported host: scheme, host and port
+ * only, dropping any path, query or fragment the host string carried. Null
+ * for a cloud-metadata target or a scheme other than http(s).
+ */
+function safeNodeOrigin(deviceHost) {
+    let parsed;
+    try {
+        parsed = new URL(deviceHost);
+    }
+    catch (_a) {
+        return null;
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')
+        return null;
+    if (FORBIDDEN_PROXY_HOSTS.has(parsed.hostname))
+        return null;
+    return `${parsed.protocol}//${parsed.host}`;
+}
+/** The node's own URL for this request, or null if the host is unsafe. */
+function nodeControlUrl(deviceHost, req) {
+    const origin = safeNodeOrigin(deviceHost);
+    if (!origin)
+        return null;
+    const forwardPath = req.originalUrl.startsWith('/') ? req.originalUrl : `/${req.originalUrl}`;
+    return `${origin}${withoutTicket(forwardPath)}`;
+}
+/**
+ * The path without a `ticket` query parameter. A viewer's ticket is this
+ * server's, already spent here, and not the node's business: the node gets
+ * the hub's token instead.
+ */
+function withoutTicket(path) {
+    const q = path.indexOf('?');
+    if (q < 0)
+        return path;
+    const params = new URLSearchParams(path.slice(q + 1));
+    if (!params.has('ticket'))
+        return path;
+    params.delete('ticket');
+    const query = params.toString();
+    return query ? `${path.slice(0, q)}?${query}` : path.slice(0, q);
+}
+/**
+ * A phone another server drives. Decided by the phone's own row (its nodeId,
+ * else its exact host against this server's own hosts), never by the Host
+ * header the caller used: a substring match on that header forwarded a lab's
+ * own phone back to itself, with no login, whenever the lab was reached as
+ * `localhost`.
+ */
+function isOtherServersPhone(device) {
+    if (!device.host)
+        return false;
+    const context = typedi_1.Container.get(PluginContext_1.PluginContext);
+    return !(0, localDeviceHosts_1.isOwnDevice)((0, localDeviceHosts_1.localDeviceHosts)(context.pluginArgs, context.port), context.nodeId, device);
+}
+function originOf(host) {
+    try {
+        return new URL(host).origin;
+    }
+    catch (_a) {
+        return host;
+    }
+}
+function refuse(res, error, message) {
+    return res.status(501).json({ success: false, error, message });
+}
+function nodePhoneControl(deps = {}) {
+    var _a, _b, _c, _d, _e, _f;
+    const findDevice = (_a = deps.findDevice) !== null && _a !== void 0 ? _a : controlDevice_1.findControlDeviceInStore;
+    const forwardDeps = {
+        timeoutMs: (_b = deps.timeoutMs) !== null && _b !== void 0 ? _b : exports.NODE_CONTROL_TIMEOUT_MS,
+        installTimeoutMs: (_c = deps.installTimeoutMs) !== null && _c !== void 0 ? _c : exports.NODE_INSTALL_TIMEOUT_MS,
+        markNodeBusy: (_d = deps.markNodeBusy) !== null && _d !== void 0 ? _d : ((udid, host, hold) => device_store_1.DeviceStoreFactory.getStore().markNodeBusy(udid, host, hold)),
+        describeHolder: (_e = deps.describeHolder) !== null && _e !== void 0 ? _e : ((id) => typedi_1.Container.get(SessionOwnerResolver_1.SessionOwnerResolver).displayName(id)),
+        controlToken: (_f = deps.controlToken) !== null && _f !== void 0 ? _f : defaultControlToken,
+    };
+    return function (req, res, next) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const action = (0, controlDevice_1.controlAction)(req);
+            if (!action)
+                return next();
+            const udid = (0, controlDevice_1.readControlUdid)(req, res, 'nodePhoneControl');
+            if (udid === null)
+                return;
+            if (!udid)
+                return next();
+            // The guards' memoized lookup: usually no query of its own.
+            let device;
+            try {
+                device = yield (0, controlDevice_1.lookupControlDevice)(res, udid, findDevice);
+            }
+            catch (e) {
+                // Falling through would let the handler, with its own lookup, run a
+                // node's phone here: fail closed.
+                // Answered as every /control lookup failure is.
+                logger_1.default.error(`nodePhoneControl: device lookup failed for ${udid}: ${(_a = e === null || e === void 0 ? void 0 : e.message) !== null && _a !== void 0 ? _a : e}`);
+                return res.status(503).json((0, deviceAccessPolicy_1.ownershipUnavailableBody)());
+            }
+            if (!device || !isOtherServersPhone(device))
+                return next();
+            const key = `${req.method} ${action}`;
+            if (exports.ANSWERED_HERE.includes(key))
+                return next();
+            if (device.cloud) {
+                return refuse(res, 'not_available_for_cloud_phone', "This phone is a cloud provider's. Device control isn't available for it here.");
+            }
+            if (exports.ANSWERED_HERE_FOR_NODES.includes(key))
+                return next();
+            const node = originOf(device.host);
+            if (!exports.NODE_FORWARDED_CONTROL.includes(key)) {
+                return refuse(res, 'not_available_through_hub', `This phone is on node ${node}, and the hub doesn't pass ${action} on to nodes yet.`);
+            }
+            return forward(req, res, { udid, device, node }, forwardDeps);
+        });
+    };
+}
+const defaultControlToken = (grant) => typedi_1.Container.get(hubSessionToken_1.HubSessionTokenIssuer).controlTokenFor(grant);
+/**
+ * The headers of a call to the phone's node, signed for the caller. Null
+ * token when this server can't sign (it warns once): the call goes without,
+ * which a node with auth disabled accepts and one with auth enabled refuses.
+ */
+function signedHeaders(req, udid, device, controlToken) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const actor = (0, actor_1.resolveActor)(req);
+        const headers = {
+            accept: (_a = req.headers.accept) !== null && _a !== void 0 ? _a : 'application/json',
+            'accept-encoding': 'identity',
+        };
+        const token = actor.userId
+            ? yield controlToken({
+                userId: actor.userId,
+                isAdmin: actor.isAdmin,
+                udid,
+                host: device.host,
+            })
+            : null;
+        if (token)
+            headers[hubSessionToken_1.HUB_TOKEN_HEADER] = token;
+        return headers;
+    });
+}
+/**
+ * Send one call to the node and relay its answer to `res`. A node that can't
+ * be reached is 502, and one that hasn't started answering in `timeoutMs` is
+ * 504; once it has, the answer takes as long as it takes. `onAnswer` sees the
+ * node's answer first and may reply itself (returning true). Sent once: a
+ * retry after a slow node's timeout or 5xx could land the same tap twice.
+ */
+function relayNodeCall(res, call, onAnswer) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c;
+        const controller = new AbortController();
+        let timedOut = false;
+        const timer = setTimeout(() => {
+            timedOut = true;
+            controller.abort();
+        }, call.timeoutMs);
+        // The caller left: stop waiting for the node on their behalf.
+        const onClose = () => {
+            if (!res.writableFinished)
+                controller.abort();
+        };
+        res.on('close', onClose);
+        try {
+            const upstream = yield (0, forwardToNode_1.sendToNode)({
+                url: call.url,
+                method: call.method,
+                headers: call.headers,
+                body: call.body,
+                signal: controller.signal,
+            });
+            clearTimeout(timer);
+            if (onAnswer && (yield onAnswer(upstream)))
+                return;
+            yield (0, forwardToNode_1.relayAnswer)(upstream, res, false);
+        }
+        catch (e) {
+            if (res.headersSent || res.destroyed) {
+                res.destroy();
+            }
+            else if (timedOut) {
+                res.status(504).json({
+                    success: false,
+                    error: 'node_timeout',
+                    message: `Node ${call.node} didn't answer within ${Math.round(call.timeoutMs / 1000)} s.`,
+                });
+            }
+            else {
+                logger_1.default.warn(`nodePhoneControl: node ${call.node} unreachable for ${call.udid}: ${(_a = e === null || e === void 0 ? void 0 : e.message) !== null && _a !== void 0 ? _a : e}`);
+                res.status(502).json({
+                    success: false,
+                    error: 'node_unreachable',
+                    message: `Xenon could not reach node ${call.node} for this phone: ${(_c = (_b = e === null || e === void 0 ? void 0 : e.code) !== null && _b !== void 0 ? _b : e === null || e === void 0 ? void 0 : e.message) !== null && _c !== void 0 ? _c : e}`,
+                });
+            }
+        }
+        finally {
+            clearTimeout(timer);
+            res.off('close', onClose);
+        }
+    });
+}
+function forward(req, res, target, deps) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const { udid, device, node } = target;
+        const url = nodeControlUrl(device.host, req);
+        if (!url)
+            return res.status(400).json({ error: 'Unsafe device host' });
+        const key = `${req.method} ${(0, controlDevice_1.controlAction)(req)}`;
+        const actor = (0, actor_1.resolveActor)(req);
+        const headers = yield signedHeaders(req, udid, device, deps.controlToken);
+        let body;
+        if (req.method !== 'GET' && req.method !== 'HEAD') {
+            const type = req.headers['content-type'];
+            if (typeof type === 'string' && type.toLowerCase().startsWith('multipart/')) {
+                // An upload, streamed on as it came: the route's own parser runs after
+                // this, so nothing here has read it.
+                body = req;
+                headers['content-type'] = type;
+                if (req.headers['content-length'])
+                    headers['content-length'] = req.headers['content-length'];
+            }
+            else {
+                body = Buffer.from(JSON.stringify((_a = req.body) !== null && _a !== void 0 ? _a : {}));
+                headers['content-type'] = 'application/json';
+            }
+        }
+        logger_1.default.debug(`Forwarding ${key} for ${udid} to node ${node}`);
+        const timeoutMs = INSTALLS.includes(key) ? deps.installTimeoutMs : deps.timeoutMs;
+        yield relayNodeCall(res, { url, method: req.method, headers, body, timeoutMs, node, udid }, (upstream) => __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const status = (_a = upstream.statusCode) !== null && _a !== void 0 ? _a : 502;
+            if (key === 'POST stream/start' && status < 300) {
+                // The node holds the phone for the preview now, and says so in its
+                // next report, up to an interval away. Until then this server could
+                // hand the phone to a session the node would refuse, and would show
+                // no holder. The node writes the same hold for the same user.
+                const hold = actor.userId ? (0, manualLock_1.formatManualLock)(actor.userId, udid) : undefined;
+                yield deps.markNodeBusy(udid, device.host, hold).catch((e) => {
+                    var _a;
+                    logger_1.default.warn(`nodePhoneControl: could not mark ${udid} busy for its node: ${(_a = e === null || e === void 0 ? void 0 : e.message) !== null && _a !== void 0 ? _a : e}`);
+                });
+            }
+            if (status === 409) {
+                yield relayRefusal(yield (0, forwardToNode_1.readAnswer)(upstream), res, deps.describeHolder);
+                return true;
+            }
+            return false;
+        }));
+    });
+}
+/**
+ * A file as a multipart upload in one field, streamed from disk, with its
+ * length known so the node's parser can apply its limit up front.
+ */
+function multipartFile(field, file) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const boundary = `----xenon-${(0, crypto_1.randomBytes)(12).toString('hex')}`;
+        const name = file.name.replace(/["\\\r\n]/g, '_');
+        const head = Buffer.from(`--${boundary}\r\n` +
+            `Content-Disposition: form-data; name="${field}"; filename="${name}"\r\n` +
+            'Content-Type: application/octet-stream\r\n\r\n');
+        const tail = Buffer.from(`\r\n--${boundary}--\r\n`);
+        const { size } = yield fs_1.default.promises.stat(file.path);
+        const stream = stream_1.Readable.from((function () {
+            return __asyncGenerator(this, arguments, function* () {
+                yield yield __await(head);
+                yield __await(yield* __asyncDelegator(__asyncValues(fs_1.default.createReadStream(file.path))));
+                yield yield __await(tail);
+            });
+        })());
+        return {
+            type: `multipart/form-data; boundary=${boundary}`,
+            length: head.length + size + tail.length,
+            stream,
+        };
+    });
+}
+/**
+ * Install a file of this server's on another server's phone: sent to the
+ * node's upload-install as a multipart upload, signed for the caller, and
+ * the node's answer relayed. install-repository-app's, for an app from this
+ * server's library, which the node doesn't have. The file's name keeps the
+ * extension the node's installer reads.
+ */
+function installFileOnNode(req_1, res_1, udid_1, device_1, file_1) {
+    return __awaiter(this, arguments, void 0, function* (req, res, udid, device, file, deps = {}) {
+        var _a, _b;
+        const origin = safeNodeOrigin(device.host);
+        if (!origin) {
+            res.status(400).json({ error: 'Unsafe device host' });
+            return;
+        }
+        const headers = yield signedHeaders(req, udid, device, (_a = deps.controlToken) !== null && _a !== void 0 ? _a : defaultControlToken);
+        const upload = yield multipartFile('app', file);
+        headers['content-type'] = upload.type;
+        headers['content-length'] = upload.length;
+        logger_1.default.info(`Sending ${file.name} to node ${origin} to install on ${udid}`);
+        yield relayNodeCall(res, {
+            url: `${origin}/xenon/api/control/${encodeURIComponent(udid)}/upload-install`,
+            method: 'POST',
+            headers,
+            body: upload.stream,
+            timeoutMs: (_b = deps.timeoutMs) !== null && _b !== void 0 ? _b : exports.NODE_INSTALL_TIMEOUT_MS,
+            node: origin,
+            udid,
+        });
+    });
+}
+/**
+ * The node's screenshot of another server's phone, base64, for work this
+ * server does on it: Omni-Vision, with this server's AI settings. Throws when
+ * the node doesn't give one.
+ */
+function screenshotFromNode(req_1, udid_1, device_1) {
+    return __awaiter(this, arguments, void 0, function* (req, udid, device, deps = {}) {
+        var _a, _b, _c;
+        const origin = safeNodeOrigin(device.host);
+        if (!origin)
+            throw new Error('Unsafe device host');
+        const headers = yield signedHeaders(req, udid, device, (_a = deps.controlToken) !== null && _a !== void 0 ? _a : defaultControlToken);
+        headers.accept = 'application/json';
+        const answer = yield (0, forwardToNode_1.readAnswer)(yield (0, forwardToNode_1.sendToNode)({
+            url: `${origin}/xenon/api/control/${encodeURIComponent(udid)}/screenshot`,
+            method: 'GET',
+            headers,
+            signal: AbortSignal.timeout((_b = deps.timeoutMs) !== null && _b !== void 0 ? _b : exports.NODE_CONTROL_TIMEOUT_MS),
+        }));
+        if (answer.status !== 200) {
+            throw new Error(`Node ${origin} answered ${answer.status} for a screenshot`);
+        }
+        const shot = (_c = JSON.parse(answer.body.toString('utf8'))) === null || _c === void 0 ? void 0 : _c.screenshot;
+        if (typeof shot !== 'string' || !shot)
+            throw new Error(`Node ${origin} sent no screenshot`);
+        return shot;
+    });
+}
+const HOLDER_REFUSALS = new Set(['device_held_by_another_user', 'device_in_use_by_session']);
+/**
+ * A node's 409, with the holder's name filled in when the node could only
+ * give their id: its database has no rows for this server's users, so it
+ * says "another user". The wording is denyBody's, as for this server's own
+ * refusals. Anything else is passed on as it came.
+ */
+function relayRefusal(answer, res, describeHolder) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        let refusal;
+        try {
+            refusal = JSON.parse(answer.body.toString('utf8'));
+        }
+        catch (_b) {
+            return (0, forwardToNode_1.sendAnswer)(res, answer);
+        }
+        const holderId = (_a = refusal === null || refusal === void 0 ? void 0 : refusal.holder) === null || _a === void 0 ? void 0 : _a.userId;
+        if (!HOLDER_REFUSALS.has(refusal === null || refusal === void 0 ? void 0 : refusal.error) || typeof holderId !== 'string' || refusal.holder.name) {
+            return (0, forwardToNode_1.sendAnswer)(res, answer);
+        }
+        const name = yield describeHolder(holderId).catch(() => null);
+        if (!name)
+            return (0, forwardToNode_1.sendAnswer)(res, answer);
+        res.status(409).json(Object.assign(Object.assign({}, refusal), (0, deviceAccessPolicy_1.denyBody)(refusal.error, holderId, name)));
+    });
+}

package/lib/src/app/ws/h264StreamWs.js

@@ -18,6 +18,7 @@ exports.attachH264Ws = attachH264Ws;
 const ws_1 = require("ws");
 const logger_1 = __importDefault(require("../../logger"));
 const upgradeRouter_1 = require("./upgradeRouter");
+const nodeSocketRelay_1 = require("./nodeSocketRelay");
 /**
  * Authenticated H.264 video WebSocket.
  *
@@ -62,6 +63,7 @@ function attachH264Ws(server, deps) {
     function upgrade(req, socket, head) {
         const parsed = parseH264WsPath(req.url);
         wss.handleUpgrade(req, socket, head, (ws) => __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c;
             // Register cleanup BEFORE the awaits below. redeem + startStream can take
             // seconds; if the client disconnects during that window we must still
             // remove it from the multiplexer — otherwise clientCount stays inflated
@@ -74,20 +76,44 @@ function attachH264Ws(server, deps) {
             };
             ws.on('close', onClose);
             ws.on('error', onClose);
+            let actor;
             try {
-                yield deps.redeem(parsed.ticket, parsed.udid);
+                actor = yield deps.redeem(parsed.ticket, parsed.udid);
             }
-            catch (_a) {
+            catch (_d) {
                 try {
                     ws.close(1008, 'unauthorized');
                 }
-                catch (_b) {
+                catch (_e) {
                     /* noop */
                 }
                 return;
             }
             if (closed)
                 return; // disconnected during redeem
+            // Another server's phone: its node streams it, relayed from here.
+            let upstream = null;
+            try {
+                upstream = (_b = (yield ((_a = deps.nodeSocket) === null || _a === void 0 ? void 0 : _a.call(deps, parsed.udid, actor)))) !== null && _b !== void 0 ? _b : null;
+            }
+            catch (e) {
+                const refused = e instanceof nodeSocketRelay_1.NodeSocketRefused;
+                logger_1.default.warn(`[${parsed.udid}] H.264 WS from its node failed: ${(_c = e === null || e === void 0 ? void 0 : e.message) !== null && _c !== void 0 ? _c : e}`);
+                try {
+                    ws.close(refused ? 1008 : 1011, refused ? 'refused by the node' : 'node unreachable');
+                }
+                catch (_f) {
+                    /* noop */
+                }
+                return;
+            }
+            if (upstream) {
+                if (closed)
+                    return void upstream.terminate();
+                (0, nodeSocketRelay_1.relaySocket)(ws, upstream, maxBuffered);
+                logger_1.default.info(`[${parsed.udid}] H.264 WS client connected, relayed from its node`);
+                return;
+            }
             let mux;
             try {
                 mux = yield deps.startStream(parsed.udid);
@@ -97,7 +123,7 @@ function attachH264Ws(server, deps) {
                 try {
                     ws.close(1011, 'stream failed');
                 }
-                catch (_c) {
+                catch (_g) {
                     /* noop */
                 }
                 return;